@claudian-collab/protocol 3.2.1 → 3.3.0

package/dist/CollabProjectBackupCheckpoint.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COLLAB_PROJECT_BACKUP_RECORD_KINDS = exports.COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION = void 0;
+exports.COLLAB_PROJECT_BACKUP_RECORD_KINDS = exports.COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION = exports.COLLAB_PROJECT_BACKUP_COMPATIBILITY_STAGE = void 0;
 exports.collabProjectBackupIdempotencyRecordId = collabProjectBackupIdempotencyRecordId;
 exports.decodeCollabProjectBackupCheckpointManifest = decodeCollabProjectBackupCheckpointManifest;
 exports.encodeCollabProjectBackupCheckpointManifestCanonicalJson = encodeCollabProjectBackupCheckpointManifestCanonicalJson;
@@ -13,8 +13,10 @@ const CollabConstants_1 = require("./CollabConstants");
 const CollabControlOperationCodecs_1 = require("./CollabControlOperationCodecs");
 const CollabError_1 = require("./CollabError");
 const CollabProjectCheckpoint_1 = require("./CollabProjectCheckpoint");
+const CollabProjectMembership_1 = require("./CollabProjectMembership");
 const CollabValidation_1 = require("./CollabValidation");
-exports.COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION = 2;
+exports.COLLAB_PROJECT_BACKUP_COMPATIBILITY_STAGE = 'pre-production-replaceable';
+exports.COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION = 3;
 const BACKUP_CONTINUITY_RECORD_KINDS = Object.freeze([
     'lifecycle-journal',
     'authority-transfer-recovery',
@@ -25,11 +27,28 @@ const BACKUP_CONTINUITY_RECORD_KINDS = Object.freeze([
     'terminal-principal',
     'terminal-responder-replay',
     'leave-former-principal-replay',
+    'project-invitation',
+    'protected-invitation-envelope',
+    'transferred-membership-claim-override',
+    'protected-claim-override-envelope',
+    'manager-responsibility-offer',
+    'project-membership-recovery',
+    'secret-replay-tombstone',
 ]);
 exports.COLLAB_PROJECT_BACKUP_RECORD_KINDS = Object.freeze([
-    ...CollabProjectCheckpoint_1.COLLAB_CHECKPOINT_BACKUP_RECORD_KINDS.slice(0, 13),
+    ...CollabProjectCheckpoint_1.COLLAB_CHECKPOINT_PORTABLE_RECORD_KINDS,
+    'cloud-event',
+    'cloud-event-cursor',
+    'idempotency-result',
+    'principal-binding',
+    'repository-placement',
     ...BACKUP_CONTINUITY_RECORD_KINDS,
-    ...CollabProjectCheckpoint_1.COLLAB_CHECKPOINT_BACKUP_RECORD_KINDS.slice(14),
+    'terminal-responder',
+    'protected-claim-envelope',
+    'tombstone',
+    'schema-catalog',
+    'server-compatibility',
+    'authority-volume-pair',
 ]);
 const CONTINUITY_KIND_SET = new Set(BACKUP_CONTINUITY_RECORD_KINDS);
 const BACKUP_KIND_SET = new Set(exports.COLLAB_PROJECT_BACKUP_RECORD_KINDS);
@@ -59,7 +78,9 @@ const DELETE_ACTIVE_PHASE_SET = new Set([
     'tombstoned',
 ]);
 const PLAINTEXT_CLAIM_RESPONSE_OPERATION_SET = new Set([
+    'createProjectInvitation',
     'getTransferredMembershipClaim',
+    'reissueTransferredMembershipClaim',
     'rotateTransferredMembershipClaims',
 ]);
 function invalidPayload(field) {
@@ -117,6 +138,9 @@ function timestampValue(value, field) {
 function timestamp(source, field) {
     return timestampValue(source[field], field);
 }
+function hasExactDuration(start, end, durationMs) {
+    return Date.parse(end) === Date.parse(start) + durationMs;
+}
 function nullableTimestamp(source, field) {
     return source[field] === null ? null : timestampValue(source[field], field);
 }
@@ -467,7 +491,15 @@ function lifecycleJournalRecord(source, recordId, revision) {
     if (recordId !== operationId)
         throw invalidPayload('recordId');
     const operationKind = literal(value, 'operationKind', [
-        'authority-transfer', 'backup', 'delete', 'export', 'leave', 'retire',
+        'authority-transfer',
+        'backup',
+        'create-project',
+        'delete',
+        'export',
+        'join-project',
+        'leave',
+        'remove-member',
+        'retire',
     ]);
     const direction = value.direction === null
         ? null
@@ -838,6 +870,350 @@ function leaveFormerPrincipalReplayRecord(source, recordId, revision) {
         },
     };
 }
+function projectInvitationRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'createdAt',
+        'expiresAt',
+        'idempotencyKey',
+        'invitationId',
+        'issuedByMemberId',
+        'projectId',
+        'requestFingerprint',
+        'revision',
+        'secretReplayExpiresAt',
+        'secretSha256',
+        'state',
+        'terminalAt',
+    ]);
+    const invitationId = token(value, 'invitationId');
+    if (recordId !== invitationId)
+        throw invalidPayload('recordId');
+    const createdAt = timestamp(value, 'createdAt');
+    const expiresAt = timestamp(value, 'expiresAt');
+    const secretReplayExpiresAt = timestamp(value, 'secretReplayExpiresAt');
+    const state = literal(value, 'state', [
+        'active', 'redeeming', 'redeemed', 'revoked', 'expired',
+    ]);
+    const terminalAt = nullableTimestamp(value, 'terminalAt');
+    const terminal = state === 'redeemed' || state === 'revoked' || state === 'expired';
+    if (!hasExactDuration(createdAt, expiresAt, CollabProjectMembership_1.COLLAB_PROJECT_MEMBERSHIP_LIMITS.invitationTtlMs)
+        || !hasExactDuration(createdAt, secretReplayExpiresAt, CollabProjectMembership_1.COLLAB_PROJECT_MEMBERSHIP_LIMITS.secretReplayTtlMs)
+        || terminal !== (terminalAt !== null)
+        || (terminalAt !== null && Date.parse(terminalAt) < Date.parse(createdAt)))
+        throw invalidPayload('state');
+    return {
+        kind: 'project-invitation',
+        recordId,
+        revision,
+        value: {
+            createdAt,
+            expiresAt,
+            idempotencyKey: token(value, 'idempotencyKey'),
+            invitationId,
+            issuedByMemberId: token(value, 'issuedByMemberId', CollabValidation_1.isCollabMemberId),
+            projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+            revision: positiveInteger(value, 'revision'),
+            secretReplayExpiresAt,
+            secretSha256: sha256(value, 'secretSha256'),
+            state,
+            terminalAt,
+        },
+    };
+}
+function protectedSecretEnvelopeFields(value) {
+    const ciphertext = boundedString(value, 'ciphertext', 4096);
+    const nonce = boundedString(value, 'nonce', 128);
+    if (!BASE64URL_PATTERN.test(ciphertext) || !BASE64URL_PATTERN.test(nonce)) {
+        throw invalidPayload('ciphertext');
+    }
+    const createdAt = timestamp(value, 'createdAt');
+    const expiresAt = timestamp(value, 'expiresAt');
+    if (Date.parse(expiresAt) <= Date.parse(createdAt))
+        throw invalidPayload('expiresAt');
+    return {
+        associatedDataSha256: sha256(value, 'associatedDataSha256'),
+        ciphertext,
+        createdAt,
+        expiresAt,
+        keyId: token(value, 'keyId'),
+        nonce,
+        projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+    };
+}
+function protectedInvitationEnvelopeRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'associatedDataSha256',
+        'ciphertext',
+        'createdAt',
+        'expiresAt',
+        'invitationId',
+        'keyId',
+        'nonce',
+        'projectId',
+    ]);
+    const invitationId = token(value, 'invitationId');
+    if (recordId !== invitationId)
+        throw invalidPayload('recordId');
+    const envelope = protectedSecretEnvelopeFields(value);
+    return {
+        kind: 'protected-invitation-envelope',
+        recordId,
+        revision,
+        value: {
+            associatedDataSha256: envelope.associatedDataSha256,
+            ciphertext: envelope.ciphertext,
+            createdAt: envelope.createdAt,
+            expiresAt: envelope.expiresAt,
+            invitationId,
+            keyId: envelope.keyId,
+            nonce: envelope.nonce,
+            projectId: envelope.projectId,
+        },
+    };
+}
+function transferredMembershipClaimOverrideRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'claimGeneration',
+        'claimSha256',
+        'createdAt',
+        'expiresAt',
+        'idempotencyKey',
+        'managerMemberId',
+        'memberId',
+        'projectId',
+        'redemptionReceiptId',
+        'requestFingerprint',
+        'secretReplayExpiresAt',
+        'state',
+        'supersededClaimSha256',
+        'targetPrincipalId',
+        'transferId',
+        'updatedAt',
+    ]);
+    const transferId = token(value, 'transferId');
+    const memberId = token(value, 'memberId', CollabValidation_1.isCollabMemberId);
+    const claimGeneration = positiveInteger(value, 'claimGeneration');
+    if (recordId !== `${transferId}:${memberId}:${claimGeneration}`) {
+        throw invalidPayload('recordId');
+    }
+    const state = literal(value, 'state', [
+        'active', 'redeemed', 'revoked', 'superseded', 'expired',
+    ]);
+    const targetPrincipalId = nullableToken(value, 'targetPrincipalId', candidate => (typeof candidate === 'string' && PRINCIPAL_PATTERN.test(candidate)));
+    const redemptionReceiptId = nullableToken(value, 'redemptionReceiptId');
+    if ((state === 'redeemed') !== (targetPrincipalId !== null && redemptionReceiptId !== null)
+        || (state !== 'redeemed' && (targetPrincipalId !== null || redemptionReceiptId !== null)))
+        throw invalidPayload('state');
+    const createdAt = timestamp(value, 'createdAt');
+    const expiresAt = timestamp(value, 'expiresAt');
+    const secretReplayExpiresAt = timestamp(value, 'secretReplayExpiresAt');
+    const updatedAt = timestamp(value, 'updatedAt');
+    if (!hasExactDuration(createdAt, expiresAt, CollabProjectMembership_1.COLLAB_PROJECT_MEMBERSHIP_LIMITS.transferredClaimTtlMs)
+        || !hasExactDuration(createdAt, secretReplayExpiresAt, CollabProjectMembership_1.COLLAB_PROJECT_MEMBERSHIP_LIMITS.secretReplayTtlMs)
+        || Date.parse(updatedAt) < Date.parse(createdAt))
+        throw invalidPayload('updatedAt');
+    return {
+        kind: 'transferred-membership-claim-override',
+        recordId,
+        revision,
+        value: {
+            claimGeneration,
+            claimSha256: sha256(value, 'claimSha256'),
+            createdAt,
+            expiresAt,
+            idempotencyKey: token(value, 'idempotencyKey'),
+            managerMemberId: token(value, 'managerMemberId', CollabValidation_1.isCollabMemberId),
+            memberId,
+            projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+            redemptionReceiptId,
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+            secretReplayExpiresAt,
+            state,
+            supersededClaimSha256: sha256(value, 'supersededClaimSha256'),
+            targetPrincipalId,
+            transferId,
+            updatedAt,
+        },
+    };
+}
+function protectedClaimOverrideEnvelopeRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'associatedDataSha256',
+        'ciphertext',
+        'claimGeneration',
+        'createdAt',
+        'expiresAt',
+        'keyId',
+        'memberId',
+        'nonce',
+        'projectId',
+        'transferId',
+    ]);
+    const transferId = token(value, 'transferId');
+    const memberId = token(value, 'memberId', CollabValidation_1.isCollabMemberId);
+    const claimGeneration = positiveInteger(value, 'claimGeneration');
+    if (recordId !== `${transferId}:${memberId}:${claimGeneration}`) {
+        throw invalidPayload('recordId');
+    }
+    const envelope = protectedSecretEnvelopeFields(value);
+    return {
+        kind: 'protected-claim-override-envelope',
+        recordId,
+        revision,
+        value: {
+            associatedDataSha256: envelope.associatedDataSha256,
+            ciphertext: envelope.ciphertext,
+            claimGeneration,
+            createdAt: envelope.createdAt,
+            expiresAt: envelope.expiresAt,
+            keyId: envelope.keyId,
+            memberId,
+            nonce: envelope.nonce,
+            projectId: envelope.projectId,
+            transferId,
+        },
+    };
+}
+function managerResponsibilityOfferRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'acknowledgedAt',
+        'expiresAt',
+        'idempotencyKey',
+        'managerSetGenerationAtOffer',
+        'offeredAt',
+        'offerId',
+        'projectId',
+        'purpose',
+        'requestFingerprint',
+        'revision',
+        'sourceManagerMemberId',
+        'state',
+        'targetMemberId',
+        'targetMembershipRevisionAtOffer',
+        'terminalAt',
+    ]);
+    const offerId = token(value, 'offerId');
+    if (recordId !== offerId)
+        throw invalidPayload('recordId');
+    const state = literal(value, 'state', [
+        'offered', 'acknowledged', 'declined', 'cancelled', 'consumed', 'expired',
+    ]);
+    const offeredAt = timestamp(value, 'offeredAt');
+    const expiresAt = timestamp(value, 'expiresAt');
+    const acknowledgedAt = nullableTimestamp(value, 'acknowledgedAt');
+    const terminalAt = nullableTimestamp(value, 'terminalAt');
+    const terminal = state === 'declined'
+        || state === 'cancelled'
+        || state === 'consumed'
+        || state === 'expired';
+    if (!hasExactDuration(offeredAt, expiresAt, CollabProjectMembership_1.COLLAB_PROJECT_MEMBERSHIP_LIMITS.managerResponsibilityOfferTtlMs)
+        || (state === 'offered' && acknowledgedAt !== null)
+        || (state === 'acknowledged' && acknowledgedAt === null)
+        || terminal !== (terminalAt !== null))
+        throw invalidPayload('state');
+    return {
+        kind: 'manager-responsibility-offer',
+        recordId,
+        revision,
+        value: {
+            acknowledgedAt,
+            expiresAt,
+            idempotencyKey: token(value, 'idempotencyKey'),
+            managerSetGenerationAtOffer: positiveInteger(value, 'managerSetGenerationAtOffer'),
+            offeredAt,
+            offerId,
+            projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+            purpose: literal(value, 'purpose', ['manager-promotion', 'manager-leave']),
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+            revision: positiveInteger(value, 'revision'),
+            sourceManagerMemberId: token(value, 'sourceManagerMemberId', CollabValidation_1.isCollabMemberId),
+            state,
+            targetMemberId: token(value, 'targetMemberId', CollabValidation_1.isCollabMemberId),
+            targetMembershipRevisionAtOffer: positiveInteger(value, 'targetMembershipRevisionAtOffer'),
+            terminalAt,
+        },
+    };
+}
+function membershipRecoveryRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'expectedMainOid',
+        'expectedPersonalRefOid',
+        'invitationId',
+        'memberId',
+        'operationId',
+        'operationKind',
+        'principalSha256',
+        'projectId',
+        'publicationMarkerSha256',
+        'repositoryPlanSha256',
+        'requestFingerprint',
+    ]);
+    const operationId = token(value, 'operationId');
+    if (recordId !== operationId)
+        throw invalidPayload('recordId');
+    const operationKind = literal(value, 'operationKind', [
+        'create-project', 'join-project', 'remove-member',
+    ]);
+    const invitationId = nullableToken(value, 'invitationId');
+    const principalSha256 = nullableSha256(value, 'principalSha256');
+    const publicationMarkerSha256 = nullableSha256(value, 'publicationMarkerSha256');
+    const repositoryPlanSha256 = nullableSha256(value, 'repositoryPlanSha256');
+    if ((operationKind === 'join-project') !== (invitationId !== null)
+        || (operationKind === 'remove-member') === (principalSha256 !== null)
+        || (operationKind === 'create-project') !== (repositoryPlanSha256 !== null)
+        || (operationKind !== 'create-project' && publicationMarkerSha256 !== null))
+        throw invalidPayload('operationKind');
+    return {
+        kind: 'project-membership-recovery',
+        recordId,
+        revision,
+        value: {
+            expectedMainOid: token(value, 'expectedMainOid', CollabValidation_1.isCollabGitOid),
+            expectedPersonalRefOid: token(value, 'expectedPersonalRefOid', CollabValidation_1.isCollabGitOid),
+            invitationId,
+            memberId: token(value, 'memberId', CollabValidation_1.isCollabMemberId),
+            operationId,
+            operationKind,
+            principalSha256,
+            projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+            publicationMarkerSha256,
+            repositoryPlanSha256,
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+        },
+    };
+}
+function secretReplayTombstoneRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'actorMemberId',
+        'expiredAt',
+        'idempotencyKey',
+        'operation',
+        'projectId',
+        'requestFingerprint',
+    ]);
+    const actorMemberId = token(value, 'actorMemberId', CollabValidation_1.isCollabMemberId);
+    const idempotencyKey = token(value, 'idempotencyKey');
+    const operation = literal(value, 'operation', [
+        'createProjectInvitation', 'reissueTransferredMembershipClaim',
+    ]);
+    if (recordId !== `${operation}:${actorMemberId}:${idempotencyKey}`) {
+        throw invalidPayload('recordId');
+    }
+    return {
+        kind: 'secret-replay-tombstone',
+        recordId,
+        revision,
+        value: {
+            actorMemberId,
+            expiredAt: timestamp(value, 'expiredAt'),
+            idempotencyKey,
+            operation,
+            projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+        },
+    };
+}
 function decodeContinuityRecord(kind, source, recordId, revision) {
     switch (kind) {
         case 'lifecycle-journal': return lifecycleJournalRecord(source, recordId, revision);
@@ -855,6 +1231,19 @@ function decodeContinuityRecord(kind, source, recordId, revision) {
             return terminalResponderReplayRecord(source, recordId, revision);
         case 'leave-former-principal-replay':
             return leaveFormerPrincipalReplayRecord(source, recordId, revision);
+        case 'project-invitation': return projectInvitationRecord(source, recordId, revision);
+        case 'protected-invitation-envelope':
+            return protectedInvitationEnvelopeRecord(source, recordId, revision);
+        case 'transferred-membership-claim-override':
+            return transferredMembershipClaimOverrideRecord(source, recordId, revision);
+        case 'protected-claim-override-envelope':
+            return protectedClaimOverrideEnvelopeRecord(source, recordId, revision);
+        case 'manager-responsibility-offer':
+            return managerResponsibilityOfferRecord(source, recordId, revision);
+        case 'project-membership-recovery':
+            return membershipRecoveryRecord(source, recordId, revision);
+        case 'secret-replay-tombstone':
+            return secretReplayTombstoneRecord(source, recordId, revision);
     }
 }
 function kindOrder(kind) {
@@ -911,6 +1300,33 @@ function lifecycleJournalHasInvalidSemantics(item) {
     }
     if (hasCheckpoint)
         return true;
+    if (value.operationKind === 'create-project'
+        || value.operationKind === 'join-project'
+        || value.operationKind === 'remove-member') {
+        const phases = value.operationKind === 'create-project'
+            ? new Set([
+                'prepared',
+                'repository-publication-intent',
+                'repository-published',
+                'activated',
+            ])
+            : value.operationKind === 'join-project'
+                ? new Set(['prepared', 'membership-pending', 'personal-ref-created', 'membership-active'])
+                : new Set(['prepared', 'membership-revoked', 'personal-ref-removed']);
+        const statePhaseValid = (value.state === 'active' && phases.has(value.phase))
+            || (value.state === 'recovery-required'
+                && value.phase === 'recovery-required'
+                && value.recoveryFromPhase !== null
+                && phases.has(value.recoveryFromPhase))
+            || (value.state === 'completed' && value.phase === 'completed');
+        const resultRequired = value.state === 'completed'
+            || (value.operationKind === 'create-project' && effectivePhase === 'activated')
+            || (value.operationKind === 'join-project' && effectivePhase === 'membership-active')
+            || (value.operationKind === 'remove-member'
+                && (effectivePhase === 'membership-revoked'
+                    || effectivePhase === 'personal-ref-removed'));
+        return !statePhaseValid || hasResult !== resultRequired;
+    }
     if (value.operationKind === 'leave') {
         const statePhaseValid = (value.state === 'active' && (value.phase === 'prepared'
             || value.phase === 'membership-left'
@@ -979,13 +1395,41 @@ function validateContinuity(records) {
     const leaveReplays = new Map(records
         .filter((item) => (item.kind === 'leave-former-principal-replay'))
         .map(item => [item.value.operationId, item]));
+    const invitations = new Map(records
+        .filter((item) => (item.kind === 'project-invitation'))
+        .map(item => [item.value.invitationId, item]));
+    const invitationEnvelopes = new Map(records
+        .filter((item) => (item.kind === 'protected-invitation-envelope'))
+        .map(item => [item.value.invitationId, item]));
+    const claimOverrides = records.filter((item) => (item.kind === 'transferred-membership-claim-override'));
+    const claimOverrideEnvelopes = new Map(records
+        .filter((item) => (item.kind === 'protected-claim-override-envelope'))
+        .map(item => [
+        `${item.value.transferId}:${item.value.memberId}:${item.value.claimGeneration}`,
+        item,
+    ]));
+    const managerOffers = records.filter((item) => (item.kind === 'manager-responsibility-offer'));
+    const membershipRecoveries = new Map(records
+        .filter((item) => (item.kind === 'project-membership-recovery'))
+        .map(item => [item.value.operationId, item]));
+    const secretReplayTombstones = records.filter((item) => (item.kind === 'secret-replay-tombstone'));
     const nonterminalLifecycles = [...lifecycles.values()].filter(item => (item.value.state === 'active' || item.value.state === 'recovery-required'));
     if (nonterminalLifecycles.length > 1
         || principalBindingRecords.some(item => (memberRecords.get(item.value.memberId)?.value.status !== 'active'))
         || new Set(principalBindingRecords.map(item => item.value.principalId)).size
             !== principalBindingRecords.length
         || new Set(claimRecords.map(item => (`${item.value.transferId}:${item.value.claimSha256}`))).size !== claimRecords.length
-        || new Set(redemptionReceiptRecords.map(item => (`${item.value.receipt.transferId}:${item.value.receipt.receiptId}`))).size !== redemptionReceiptRecords.length)
+        || new Set(redemptionReceiptRecords.map(item => (`${item.value.receipt.transferId}:${item.value.receipt.receiptId}`))).size !== redemptionReceiptRecords.length
+        || invitations.size !== records.filter(item => item.kind === 'project-invitation').length
+        || invitationEnvelopes.size
+            !== records.filter(item => item.kind === 'protected-invitation-envelope').length
+        || new Set([...invitations.values()].map(item => (`${item.value.issuedByMemberId}:${item.value.idempotencyKey}`))).size !== invitations.size
+        || new Set(claimOverrides.map(item => (`${item.value.transferId}:${item.value.memberId}:${item.value.claimGeneration}`))).size !== claimOverrides.length
+        || new Set(claimOverrides.map(item => (`${item.value.managerMemberId}:${item.value.idempotencyKey}`))).size !== claimOverrides.length
+        || claimOverrideEnvelopes.size
+            !== records.filter(item => item.kind === 'protected-claim-override-envelope').length
+        || membershipRecoveries.size
+            !== records.filter(item => item.kind === 'project-membership-recovery').length)
         throw invalidPayload('records');
     for (const lifecycle of lifecycles.values()) {
         if (lifecycleJournalHasInvalidSemantics(lifecycle)
@@ -996,6 +1440,11 @@ function validateContinuity(records) {
         if (lifecycle.value.operationKind === 'authority-transfer'
             && !recoveries.has(lifecycle.value.operationId))
             throw invalidPayload('records');
+        if ((lifecycle.value.operationKind === 'create-project'
+            || lifecycle.value.operationKind === 'join-project'
+            || lifecycle.value.operationKind === 'remove-member')
+            && !membershipRecoveries.has(lifecycle.value.operationId))
+            throw invalidPayload('records');
         if (lifecycle.value.operationKind === 'leave') {
             const actorMemberId = lifecycle.value.actorMemberId;
             const actor = actorMemberId === null ? undefined : memberRecords.get(actorMemberId);
@@ -1172,6 +1621,13 @@ function validateContinuity(records) {
         const lifecycle = lifecycles.get(claim.value.transferId);
         const recovery = recoveries.get(claim.value.transferId);
         const redemptionReceipt = redemptionReceipts.get(`${claim.value.transferId}:${claim.value.memberId}`);
+        const redeemedOverride = redemptionReceipt === undefined
+            ? undefined
+            : claimOverrides.find(item => (item.value.transferId === claim.value.transferId
+                && item.value.memberId === claim.value.memberId
+                && item.value.state === 'redeemed'
+                && item.value.claimSha256 === redemptionReceipt.value.receipt.claimSha256
+                && item.value.redemptionReceiptId === redemptionReceipt.value.receipt.receiptId));
         if (memberRecords.get(claim.value.memberId)?.value.status !== 'active'
             || recovery === undefined
             || recovery.value.sourceAuthority.kind !== 'lan'
@@ -1181,7 +1637,11 @@ function validateContinuity(records) {
             || claim.value.expiresAt !== recovery.value.expiresAt
             || (claim.value.targetPrincipalId !== null
                 && principalBindings.get(claim.value.memberId) !== claim.value.targetPrincipalId)
-            || (claim.value.state === 'redeemed') !== (redemptionReceipt !== undefined)) {
+            || (claim.value.state === 'redeemed' && redemptionReceipt === undefined)
+            || (redemptionReceipt !== undefined
+                && claim.value.state !== 'redeemed'
+                && redeemedOverride === undefined)
+            || (claim.value.state === 'redeemed' && redeemedOverride !== undefined)) {
             throw invalidPayload('records');
         }
     }
@@ -1197,6 +1657,141 @@ function validateContinuity(records) {
                 !== responderReplays.has(terminal.value.operationId))
             throw invalidPayload('records');
     }
+    for (const recovery of membershipRecoveries.values()) {
+        const lifecycle = lifecycles.get(recovery.value.operationId);
+        const invitation = recovery.value.invitationId === null
+            ? undefined
+            : invitations.get(recovery.value.invitationId);
+        const member = memberRecords.get(recovery.value.memberId);
+        if (lifecycle === undefined
+            || lifecycle.value.operationKind !== recovery.value.operationKind
+            || lifecycle.value.requestFingerprint !== recovery.value.requestFingerprint
+            || lifecycle.value.state !== 'completed'
+            || member === undefined
+            || (recovery.value.operationKind === 'join-project' && invitation === undefined)
+            || (recovery.value.operationKind !== 'join-project' && invitation !== undefined)
+            || (recovery.value.operationKind === 'create-project'
+                && lifecycle.value.actorMemberId !== null)
+            || (recovery.value.operationKind === 'join-project'
+                && lifecycle.value.actorMemberId !== null)
+            || (recovery.value.operationKind === 'remove-member'
+                && lifecycle.value.actorMemberId === null)
+            || (recovery.value.operationKind === 'join-project'
+                && invitation?.value.state !== 'redeemed')
+            || (recovery.value.operationKind === 'remove-member' && (member.value.status !== 'revoked'
+                || principalBindings.has(recovery.value.memberId))))
+            throw invalidPayload('records');
+    }
+    for (const invitation of invitations.values()) {
+        const envelope = invitationEnvelopes.get(invitation.value.invitationId);
+        const tombstone = secretReplayTombstones.find(item => (item.value.operation === 'createProjectInvitation'
+            && item.value.actorMemberId === invitation.value.issuedByMemberId
+            && item.value.idempotencyKey === invitation.value.idempotencyKey
+            && item.value.requestFingerprint === invitation.value.requestFingerprint));
+        if (!members.has(invitation.value.issuedByMemberId)
+            || (envelope === undefined) === (tombstone === undefined)
+            || (tombstone !== undefined
+                && tombstone.value.expiredAt !== invitation.value.secretReplayExpiresAt)
+            || (envelope !== undefined && (envelope.value.projectId !== invitation.value.projectId
+                || envelope.value.createdAt !== invitation.value.createdAt
+                || envelope.value.expiresAt !== invitation.value.secretReplayExpiresAt)))
+            throw invalidPayload('records');
+    }
+    for (const envelope of invitationEnvelopes.values()) {
+        if (!invitations.has(envelope.value.invitationId))
+            throw invalidPayload('records');
+    }
+    const overridesByMember = new Map();
+    for (const override of claimOverrides) {
+        const identity = `${override.value.transferId}:${override.value.memberId}`;
+        const values = overridesByMember.get(identity) ?? [];
+        values.push(override);
+        overridesByMember.set(identity, values);
+        const envelope = claimOverrideEnvelopes.get(`${identity}:${override.value.claimGeneration}`);
+        const tombstone = secretReplayTombstones.find(item => (item.value.operation === 'reissueTransferredMembershipClaim'
+            && item.value.actorMemberId === override.value.managerMemberId
+            && item.value.idempotencyKey === override.value.idempotencyKey
+            && item.value.requestFingerprint === override.value.requestFingerprint));
+        if (!members.has(override.value.memberId)
+            || !members.has(override.value.managerMemberId)
+            || (envelope === undefined) === (tombstone === undefined)
+            || (tombstone !== undefined
+                && tombstone.value.expiredAt !== override.value.secretReplayExpiresAt)
+            || (envelope !== undefined && (envelope.value.projectId !== override.value.projectId
+                || envelope.value.createdAt !== override.value.createdAt
+                || envelope.value.expiresAt !== override.value.secretReplayExpiresAt)))
+            throw invalidPayload('records');
+    }
+    for (const overrides of overridesByMember.values()) {
+        overrides.sort((left, right) => left.value.claimGeneration - right.value.claimGeneration);
+        const highest = overrides.at(-1);
+        const first = overrides[0];
+        const identity = first === undefined
+            ? ''
+            : `${first.value.transferId}:${first.value.memberId}`;
+        const sourceClaim = claims.get(identity);
+        const recovery = first === undefined ? undefined : recoveries.get(first.value.transferId);
+        const member = first === undefined ? undefined : memberRecords.get(first.value.memberId);
+        const principalBinding = first === undefined
+            ? undefined
+            : principalBindings.get(first.value.memberId);
+        const redemptionReceipt = redemptionReceipts.get(identity);
+        const redeemedOverrides = overrides.filter(item => item.value.state === 'redeemed');
+        if (first === undefined
+            || sourceClaim === undefined
+            || recovery?.value.sourceAuthority.kind !== 'lan'
+            || member?.value.status !== 'active'
+            || sourceClaim.value.state === 'redeemed'
+            || overrides.some((item, index) => item.value.claimGeneration !== index + 1)
+            || overrides.some((item, index) => item.value.supersededClaimSha256 !== (index === 0
+                ? sourceClaim.value.claimSha256
+                : overrides[index - 1].value.claimSha256))
+            || new Set(overrides.map(item => item.value.claimSha256)).size !== overrides.length
+            || overrides.filter(item => item.value.state === 'active').length > 1
+            || overrides.some(item => item.value.state === 'active' && item !== highest)
+            || redeemedOverrides.length > 1
+            || redeemedOverrides.some(item => item !== highest)
+            || highest?.value.state === 'superseded'
+            || (highest?.value.state === 'active' && (principalBinding !== undefined
+                || redemptionReceipt !== undefined))
+            || (highest?.value.state === 'redeemed' && (principalBinding !== highest.value.targetPrincipalId
+                || redemptionReceipt === undefined
+                || redemptionReceipt.value.receipt.transferId !== highest.value.transferId
+                || redemptionReceipt.value.receipt.memberId !== highest.value.memberId
+                || redemptionReceipt.value.receipt.claimSha256 !== highest.value.claimSha256
+                || redemptionReceipt.value.receipt.receiptId !== highest.value.redemptionReceiptId
+                || redemptionReceipt.value.receipt.checkpointSha256
+                    !== sourceClaim.value.checkpointSha256))
+            || (highest?.value.state !== 'redeemed' && redemptionReceipt !== undefined))
+            throw invalidPayload('records');
+    }
+    for (const envelope of claimOverrideEnvelopes.values()) {
+        if (!claimOverrides.some(item => (item.value.transferId === envelope.value.transferId
+            && item.value.memberId === envelope.value.memberId
+            && item.value.claimGeneration === envelope.value.claimGeneration)))
+            throw invalidPayload('records');
+    }
+    const currentOffers = managerOffers.filter(item => (item.value.state === 'offered' || item.value.state === 'acknowledged'));
+    if (managerOffers.some(item => (item.value.sourceManagerMemberId === item.value.targetMemberId
+        || !members.has(item.value.sourceManagerMemberId)
+        || !members.has(item.value.targetMemberId)))
+        || new Set(currentOffers.map(item => item.value.sourceManagerMemberId)).size
+            !== currentOffers.length
+        || new Set(currentOffers.map(item => item.value.targetMemberId)).size
+            !== currentOffers.length)
+        throw invalidPayload('records');
+    for (const tombstone of secretReplayTombstones) {
+        const liveSecretRecord = tombstone.value.operation === 'createProjectInvitation'
+            ? [...invitations.values()].some(item => (item.value.issuedByMemberId === tombstone.value.actorMemberId
+                && item.value.idempotencyKey === tombstone.value.idempotencyKey
+                && invitationEnvelopes.has(item.value.invitationId)))
+            : claimOverrides.some(item => (item.value.managerMemberId === tombstone.value.actorMemberId
+                && item.value.idempotencyKey === tombstone.value.idempotencyKey
+                && claimOverrideEnvelopes.has(`${item.value.transferId}:${item.value.memberId}:${item.value.claimGeneration}`)));
+        if (!members.has(tombstone.value.actorMemberId) || liveSecretRecord) {
+            throw invalidPayload('records');
+        }
+    }
     for (const item of records) {
         if (item.kind === 'idempotency-result' && !members.has(item.value.memberId)) {
             throw invalidPayload('records');
@@ -1248,6 +1843,19 @@ function validateContinuity(records) {
             const lifecycle = lifecycles.get(receipt.transferId);
             const terminalPrincipal = terminalPrincipals.get(identity);
             const lanToCloud = recovery?.value.sourceAuthority.kind === 'lan';
+            const redeemedOverride = claimOverrides.find(item => (item.value.transferId === receipt.transferId
+                && item.value.memberId === receipt.memberId
+                && item.value.state === 'redeemed'
+                && item.value.claimSha256 === receipt.claimSha256
+                && item.value.redemptionReceiptId === receipt.receiptId));
+            const matchesSourceClaim = claim?.value.state === 'redeemed'
+                && claim.value.claimSha256 === receipt.claimSha256
+                && claim.value.checkpointSha256 === receipt.checkpointSha256
+                && claim.value.operationIntentId === receipt.operationIntentId
+                && claim.value.redemptionReceiptId === receipt.receiptId;
+            const matchesOverride = claim !== undefined
+                && redeemedOverride !== undefined
+                && claim.value.checkpointSha256 === receipt.checkpointSha256;
             if (recovery === undefined
                 || lifecycle === undefined
                 || memberRecords.get(receipt.memberId)?.value.status !== 'active'
@@ -1255,11 +1863,7 @@ function validateContinuity(records) {
                 || !keys.has(`${receipt.transferId}:${receipt.receiptKeyId}`)
                 || Date.parse(receipt.redeemedAt) > Date.parse(recovery.value.expiresAt)
                 || (lanToCloud && (item.value.acknowledgedAt !== null
-                    || claim === undefined
-                    || claim.value.claimSha256 !== receipt.claimSha256
-                    || claim.value.checkpointSha256 !== receipt.checkpointSha256
-                    || claim.value.operationIntentId !== receipt.operationIntentId
-                    || claim.value.redemptionReceiptId !== receipt.receiptId))
+                    || (!matchesSourceClaim && !matchesOverride)))
                 || (!lanToCloud && (item.value.acknowledgedAt === null
                     || receipt.memberId === recovery.value.targetHostMemberId
                     || receipt.checkpointSha256 !== lifecycle.value.checkpointSha256
@@ -1454,6 +2058,30 @@ function encodeCollabProjectBackupCheckpointCoordinationNdjson(records) {
 function validateCollabProjectBackupCheckpointConsistency(manifest, records) {
     const decodedManifest = decodeCollabProjectBackupCheckpointManifest(manifest);
     const decodedRecords = decodeCollabProjectBackupCheckpointCoordinationNdjson(records.map(item => JSON.stringify(item)).join('\n') + '\n');
+    const invitationEnvelopeIds = new Set(decodedRecords
+        .filter(item => item.kind === 'protected-invitation-envelope')
+        .map(item => item.recordId));
+    const claimOverrideEnvelopeIds = new Set(decodedRecords
+        .filter(item => item.kind === 'protected-claim-override-envelope')
+        .map(item => item.recordId));
+    const captureTime = Date.parse(decodedManifest.createdAt);
+    if (decodedRecords.some(item => {
+        if (item.kind === 'secret-replay-tombstone') {
+            return Date.parse(item.value.expiredAt) > captureTime;
+        }
+        if (item.kind === 'project-invitation') {
+            return captureTime < Date.parse(item.value.createdAt)
+                || (captureTime < Date.parse(item.value.secretReplayExpiresAt))
+                    !== invitationEnvelopeIds.has(item.recordId);
+        }
+        if (item.kind === 'transferred-membership-claim-override') {
+            return captureTime < Date.parse(item.value.createdAt)
+                || (captureTime < Date.parse(item.value.secretReplayExpiresAt))
+                    !== claimOverrideEnvelopeIds.has(item.recordId);
+        }
+        return false;
+    }))
+        throw invalidPayload('records');
     if (decodedRecords.some(item => {
         switch (item.kind) {
             case 'lifecycle-journal': return item.value.operationId === decodedManifest.operationId;