@gmickel/gno 1.28.0 → 1.29.0

package/src/core/collection-egress-policy-validation.ts

@@ -0,0 +1,242 @@
+/** Closed, getter-safe runtime parsing for collection egress policy services. */
+
+import type { EgressPolicy } from "../config/types";
+import type {
+  CollectionEgressCheckInput,
+  EgressRelaxationConfirmation,
+} from "./collection-egress-policy-service";
+
+import { EGRESS_POLICIES } from "../config/types";
+import {
+  EGRESS_ACTIONS,
+  EGRESS_CONTENT_CLASSES,
+  EGRESS_DESTINATION_ZONES,
+} from "./egress-policy";
+
+const COLLECTION_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/u;
+const MAX_COLLECTIONS = 64;
+const POLICIES = new Set<unknown>(EGRESS_POLICIES);
+const ACTIONS = new Set<unknown>(EGRESS_ACTIONS);
+const DESTINATIONS = new Set<unknown>(EGRESS_DESTINATION_ZONES);
+const CONTENT_CLASSES = new Set<unknown>(EGRESS_CONTENT_CLASSES);
+
+export type PolicyValidationResult<T> =
+  | { ok: true; value: T }
+  | { ok: false; code: "VALIDATION"; error: string };
+
+const invalid = <T>(message: string): PolicyValidationResult<T> => ({
+  ok: false,
+  code: "VALIDATION",
+  error: message,
+});
+
+/**
+ * Snapshot only own data properties. Accessors, exotic prototypes, symbols,
+ * proxy traps, arrays, and unknown keys are rejected without invoking getters.
+ */
+const closedRecord = (
+  value: unknown,
+  allowedKeys: readonly string[]
+): PolicyValidationResult<Record<string, unknown>> => {
+  try {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      return invalid("Expected a JSON object");
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      return invalid("Expected a plain JSON object");
+    }
+    const keys = Reflect.ownKeys(value);
+    if (
+      keys.length > allowedKeys.length ||
+      keys.some((key) => typeof key !== "string" || !allowedKeys.includes(key))
+    ) {
+      return invalid("Object contains unknown fields");
+    }
+    const result: Record<string, unknown> = {};
+    for (const key of keys) {
+      if (typeof key !== "string") return invalid("Invalid object field");
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor || !("value" in descriptor)) {
+        return invalid("Accessor fields are not allowed");
+      }
+      result[key] = descriptor.value;
+    }
+    return { ok: true, value: result };
+  } catch {
+    return invalid("Unreadable input object");
+  }
+};
+
+export const parseCollectionName = (
+  value: unknown
+): PolicyValidationResult<string> =>
+  typeof value === "string" && COLLECTION_PATTERN.test(value)
+    ? { ok: true, value }
+    : invalid("Invalid collection name");
+
+const parsePolicy = (value: unknown): PolicyValidationResult<EgressPolicy> =>
+  POLICIES.has(value)
+    ? { ok: true, value: value as EgressPolicy }
+    : invalid("Invalid collection egress policy");
+
+const parseConfirmation = (
+  value: unknown
+): PolicyValidationResult<EgressRelaxationConfirmation | undefined> => {
+  if (value === undefined) return { ok: true, value: undefined };
+  const record = closedRecord(value, [
+    "acknowledged",
+    "collection",
+    "currentPolicy",
+    "currentRevision",
+    "targetPolicy",
+  ]);
+  if (!record.ok) return record;
+  const collection = parseCollectionName(record.value.collection);
+  const currentPolicy = parsePolicy(record.value.currentPolicy);
+  const targetPolicy = parsePolicy(record.value.targetPolicy);
+  if (
+    !collection.ok ||
+    !currentPolicy.ok ||
+    !targetPolicy.ok ||
+    !Number.isSafeInteger(record.value.currentRevision) ||
+    (record.value.currentRevision as number) < 0 ||
+    record.value.acknowledged !== true
+  ) {
+    return invalid("Invalid egress relaxation confirmation");
+  }
+  return {
+    ok: true,
+    value: {
+      acknowledged: true,
+      collection: collection.value,
+      currentPolicy: currentPolicy.value,
+      currentRevision: record.value.currentRevision as number,
+      targetPolicy: targetPolicy.value,
+    },
+  };
+};
+
+export const parsePolicySetInput = (
+  value: unknown
+): PolicyValidationResult<{
+  collection: string;
+  policy: EgressPolicy;
+  confirmation?: EgressRelaxationConfirmation;
+}> => {
+  const record = closedRecord(value, ["collection", "confirmation", "policy"]);
+  if (!record.ok) return record;
+  const collection = parseCollectionName(record.value.collection);
+  const policy = parsePolicy(record.value.policy);
+  const confirmation = parseConfirmation(record.value.confirmation);
+  if (!collection.ok || !policy.ok || !confirmation.ok) {
+    return invalid("Invalid collection egress policy mutation");
+  }
+  return {
+    ok: true,
+    value: {
+      collection: collection.value,
+      policy: policy.value,
+      confirmation: confirmation.value,
+    },
+  };
+};
+
+export const parsePolicySetBody = (
+  value: unknown,
+  collectionValue: unknown
+): PolicyValidationResult<{
+  collection: string;
+  policy: EgressPolicy;
+  confirmation?: EgressRelaxationConfirmation;
+}> => {
+  const record = closedRecord(value, ["confirmation", "policy"]);
+  if (!record.ok) return record;
+  return parsePolicySetInput({
+    collection: collectionValue,
+    confirmation: record.value.confirmation,
+    policy: record.value.policy,
+  });
+};
+
+const parseCollections = (
+  value: unknown
+): PolicyValidationResult<string[] | undefined> => {
+  if (value === undefined) return { ok: true, value: undefined };
+  try {
+    if (
+      !Array.isArray(value) ||
+      value.length === 0 ||
+      value.length > MAX_COLLECTIONS
+    ) {
+      return invalid("Invalid collection scope");
+    }
+    const names: string[] = [];
+    const seenNames = new Set<string>();
+    for (let index = 0; index < value.length; index += 1) {
+      if (!(index in value)) return invalid("Invalid collection scope");
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (!descriptor || !("value" in descriptor)) {
+        return invalid("Invalid collection scope");
+      }
+      const name = parseCollectionName(descriptor.value);
+      if (!name.ok) return invalid("Invalid collection scope");
+      if (seenNames.has(name.value)) {
+        return invalid("Invalid collection scope");
+      }
+      seenNames.add(name.value);
+      names.push(name.value);
+    }
+    return { ok: true, value: names };
+  } catch {
+    return invalid("Unreadable collection scope");
+  }
+};
+
+export const parsePolicyCheckInput = (
+  value: unknown
+): PolicyValidationResult<CollectionEgressCheckInput> => {
+  const record = closedRecord(value, [
+    "action",
+    "caller",
+    "collections",
+    "contentClass",
+    "destinationZone",
+    "partialResults",
+  ]);
+  if (!record.ok) return record;
+  const caller = closedRecord(record.value.caller, [
+    "authenticated",
+    "operationAuthorized",
+  ]);
+  const collections = parseCollections(record.value.collections);
+  const partialResults = record.value.partialResults ?? "deny";
+  if (
+    !caller.ok ||
+    !collections.ok ||
+    !ACTIONS.has(record.value.action) ||
+    !DESTINATIONS.has(record.value.destinationZone) ||
+    !CONTENT_CLASSES.has(record.value.contentClass) ||
+    (partialResults !== "deny" && partialResults !== "explicit") ||
+    typeof caller.value.authenticated !== "boolean" ||
+    typeof caller.value.operationAuthorized !== "boolean"
+  ) {
+    return invalid("Invalid egress policy check");
+  }
+  return {
+    ok: true,
+    value: {
+      collections: collections.value,
+      action: record.value.action as CollectionEgressCheckInput["action"],
+      destinationZone: record.value
+        .destinationZone as CollectionEgressCheckInput["destinationZone"],
+      caller: {
+        authenticated: caller.value.authenticated,
+        operationAuthorized: caller.value.operationAuthorized,
+      },
+      contentClass: record.value
+        .contentClass as CollectionEgressCheckInput["contentClass"],
+      partialResults,
+    },
+  };
+};

package/src/core/config-mutation.ts

@@ -179,30 +179,42 @@ export async function applyConfigChange<T = void>(
         };
       }
     } else {
-      const syncCollResult = await ctx.store.syncCollections(
-        newConfig.collections
-      );
-      if (!syncCollResult.ok) {
-        console.warn(
-          `Config saved but DB sync failed: ${syncCollResult.error.message}`
+      const syncProjection = async (): Promise<void> => {
+        const syncCollResult = await ctx.store.syncCollections(
+          newConfig.collections
         );
-        return {
-          ok: false,
-          error: `DB sync failed: ${syncCollResult.error.message}`,
-          code: "SYNC_ERROR",
-        };
-      }
-
-      const syncCtxResult = await ctx.store.syncContexts(
-        newConfig.contexts ?? []
-      );
-      if (!syncCtxResult.ok) {
+        if (!syncCollResult.ok) {
+          throw new Error(
+            `Collection sync failed: ${syncCollResult.error.message}`
+          );
+        }
+        const syncCtxResult = await ctx.store.syncContexts(
+          newConfig.contexts ?? []
+        );
+        if (!syncCtxResult.ok) {
+          throw new Error(
+            `Context sync failed: ${syncCtxResult.error.message}`
+          );
+        }
+      };
+      const transaction = ctx.store.withTransaction
+        ? await ctx.store.withTransaction(syncProjection)
+        : await syncProjection()
+            .then(() => ({ ok: true as const, value: undefined }))
+            .catch((cause: unknown) => ({
+              ok: false as const,
+              error: {
+                message:
+                  cause instanceof Error ? cause.message : "DB sync failed",
+              },
+            }));
+      if (!transaction.ok) {
         console.warn(
-          `Config saved but context sync failed: ${syncCtxResult.error.message}`
+          `Config saved but DB sync failed: ${transaction.error.message}`
         );
         return {
           ok: false,
-          error: `Context sync failed: ${syncCtxResult.error.message}`,
+          error: `DB sync failed: ${transaction.error.message}`,
           code: "SYNC_ERROR",
         };
       }

package/src/core/context-capsule-schema.ts

@@ -11,10 +11,12 @@ import {
   sha256Text,
   validateContextCapsulePayload,
 } from "./context-capsule-validation";
+import { egressLineageSchema } from "./egress-provenance";
 
 export { contextCapsuleIndexSnapshotSchema } from "./context-capsule-index-schema";
 
 export const CONTEXT_CAPSULE_SCHEMA_VERSION = "1.0" as const;
+export const CONTEXT_CAPSULE_CURRENT_SCHEMA_VERSION = "1.1" as const;
 export const CONTEXT_CAPSULE_COORDINATE_SPACE = "canonical_mirror" as const;
 
 const SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -356,6 +358,7 @@ export const contextCapsuleEvidenceSchema = z
       "unclassified",
       "unavailable",
     ]),
+    egressLineage: egressLineageSchema.optional(),
     record: recordEvidenceMetadataSchema.optional(),
   })
   .strict()
@@ -406,6 +409,11 @@ export const contextCapsuleEvidenceSchema = z
     }
   });
 
+export const contextCapsuleEvidenceV1_1Schema =
+  contextCapsuleEvidenceSchema.and(
+    z.object({ egressLineage: egressLineageSchema }).passthrough()
+  );
+
 const coveredFacetSchema = z
   .object({
     facet: nonEmptyTextSchema.max(512),
@@ -570,8 +578,110 @@ export const contextCapsulePayloadV1Schema = z
     warnings: z.array(warningSchema).max(32),
   })
   .strict()
-  .superRefine(validateContextCapsulePayload);
+  .superRefine((value, context) => {
+    validateContextCapsulePayload(value, context);
+    if (
+      value.evidence.some((evidence) => evidence.egressLineage !== undefined)
+    ) {
+      context.addIssue({
+        code: "custom",
+        message: "Context Capsule 1.0 cannot contain egress lineage",
+        path: ["evidence"],
+      });
+    }
+  });
 
 export type ContextCapsulePayloadV1 = z.infer<
   typeof contextCapsulePayloadV1Schema
 >;
+
+const validateContextCapsuleV1_1Lineage = (
+  value: {
+    scope: { collections: string[] };
+    egressLineage: z.infer<typeof egressLineageSchema>;
+    evidence: z.infer<typeof contextCapsuleEvidenceV1_1Schema>[];
+  },
+  context: z.RefinementCtx
+): void => {
+  const aggregateByCollection = new Map(
+    value.egressLineage.sources.map((source) => [source.collection, source])
+  );
+  const requiredCollections = new Set(value.scope.collections);
+  for (const [evidenceIndex, evidence] of value.evidence.entries()) {
+    const evidenceCollection = evidence.collection;
+    const evidenceOwnSource = evidence.egressLineage.sources.find(
+      (source) => source.collection === evidenceCollection
+    );
+    if (!evidenceOwnSource) {
+      context.addIssue({
+        code: "custom",
+        message: "Evidence lineage must include its source collection",
+        path: ["evidence", evidenceIndex, "egressLineage"],
+      });
+    }
+    for (const source of evidence.egressLineage.sources) {
+      requiredCollections.add(source.collection);
+      const aggregateSource = aggregateByCollection.get(source.collection);
+      if (
+        !aggregateSource ||
+        aggregateSource.policy !== source.policy ||
+        aggregateSource.source !== source.source
+      ) {
+        context.addIssue({
+          code: "custom",
+          message:
+            "Aggregate lineage must preserve every evidence policy source",
+          path: ["egressLineage"],
+        });
+      }
+    }
+  }
+  if (value.scope.collections.length > 0) {
+    const aggregateCollections = value.egressLineage.sources.map(
+      ({ collection }) => collection
+    );
+    const required = [...requiredCollections].sort(compareCodeUnits);
+    if (JSON.stringify(aggregateCollections) !== JSON.stringify(required)) {
+      context.addIssue({
+        code: "custom",
+        message:
+          "Aggregate lineage membership must equal requested scope and evidence ownership",
+        path: ["egressLineage", "sources"],
+      });
+    }
+  }
+};
+
+export const contextCapsulePayloadV1_1Schema = z
+  .object({
+    schemaVersion: z.literal(CONTEXT_CAPSULE_CURRENT_SCHEMA_VERSION),
+    coordinateSpace: z.literal(CONTEXT_CAPSULE_COORDINATE_SPACE),
+    goal: nonEmptyTextSchema,
+    query: nonEmptyTextSchema,
+    scope: scopeSchema,
+    budget: budgetSchema,
+    retrieval: contextCapsuleRetrievalSchema,
+    fingerprints: fingerprintsSchema,
+    capabilities: capabilitiesSchema,
+    fallbacks: z.array(fallbackSchema).max(16),
+    guidance: guidanceSchema,
+    egressLineage: egressLineageSchema,
+    evidence: z.array(contextCapsuleEvidenceV1_1Schema).min(1),
+    coverage: coverageSchema,
+    omissions: omissionsSchema,
+    truncated: z.boolean(),
+    warnings: z.array(warningSchema).max(32),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    validateContextCapsulePayload(value, context);
+    validateContextCapsuleV1_1Lineage(value, context);
+  });
+
+export type ContextCapsulePayloadV1_1 = z.infer<
+  typeof contextCapsulePayloadV1_1Schema
+>;
+
+export type ContextCapsulePayload =
+  | ContextCapsulePayloadV1
+  | ContextCapsulePayloadV1_1;

package/src/core/context-capsule-validation.ts

@@ -1,6 +1,6 @@
 import type { RefinementCtx } from "zod";
 
-import type { ContextCapsulePayloadV1 } from "./context-capsule-schema";
+import type { ContextCapsulePayload } from "./context-capsule-schema";
 
 import { DEFAULT_INDEX_NAME, parseUri } from "../app/constants";
 import { canonicalizeIndexName } from "../app/index-name";
@@ -86,7 +86,7 @@ const isWithinPrefix = (
     uri.path.startsWith(`${prefix.path}/`));
 
 const validateCapabilityBindings = (
-  value: ContextCapsulePayloadV1,
+  value: ContextCapsulePayload,
   fallbackKeys: Set<string>,
   context: RefinementCtx
 ): void => {
@@ -165,7 +165,7 @@ const validateCapabilityBindings = (
 };
 
 const validateCoverageBindings = (
-  value: ContextCapsulePayloadV1,
+  value: ContextCapsulePayload,
   context: RefinementCtx
 ): void => {
   const requested = new Set(value.coverage.requestedFacets);
@@ -329,7 +329,7 @@ const validateCoverageBindings = (
 };
 
 export const validateContextCapsulePayload = (
-  value: ContextCapsulePayloadV1,
+  value: ContextCapsulePayload,
   context: RefinementCtx
 ): void => {
   const fallbackKeys = new Set(value.fallbacks.map((item) => item.code));

package/src/core/context-capsule-verification.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 
 import {
   CONTEXT_CAPSULE_COORDINATE_SPACE,
+  CONTEXT_CAPSULE_CURRENT_SCHEMA_VERSION,
   CONTEXT_CAPSULE_SCHEMA_VERSION,
   contextCapsuleGnoUriSchema,
   contextCapsuleIndexSnapshotSchema,
@@ -120,7 +121,10 @@ export const contextCapsuleVerificationEvidenceSchema = z
 
 export const contextCapsuleVerificationSchema = z
   .object({
-    schemaVersion: z.literal(CONTEXT_CAPSULE_SCHEMA_VERSION),
+    schemaVersion: z.union([
+      z.literal(CONTEXT_CAPSULE_SCHEMA_VERSION),
+      z.literal(CONTEXT_CAPSULE_CURRENT_SCHEMA_VERSION),
+    ]),
     coordinateSpace: z.literal(CONTEXT_CAPSULE_COORDINATE_SPACE),
     capsuleId: sha256Schema,
     operationStatus: z.literal("completed"),