@gnolith/taproot 0.2.0 → 0.3.0

package/docs/testing.md

@@ -20,7 +20,9 @@ same-adapter enforcement, late-batch rollback, and concurrent writers.
 `consumer:check` packs the
 package, installs the tarball into a fresh temporary project with registry
 Diamond and Miniflare dependencies, initializes a new D1 database, writes an
-entity, and verifies the RDF through SPARQL using only public package exports.
+entity, and verifies the RDF through privileged package-test SPARQL using only
+public package exports. This proves RDF interoperability, not authorization of
+a user-facing SPARQL endpoint.
 
 `npm run check` is the complete local package release-quality gate. Coverage
 thresholds are enforced in `vitest.config.ts`; lowering them requires an
@@ -28,3 +30,18 @@ explained review. Miniflare/Workerd and packed-consumer success verifies the
 package's supported D1 runtime contract, not assembly, provisioning, deployment,
 or acceptance of a complete Gnolith Site. The Codex agent creating a Site owns
 those checks.
+
+## Miniflare dependency security
+
+Miniflare is a development-only dependency used to qualify Taproot against its
+supported Workerd D1 runtime. Taproot applies an exact root override of
+`sharp@0.35.3` because Miniflare currently declares `sharp@0.34.5`, which is
+affected by GHSA-f88m-g3jw-g9cj. This is a temporary upstream-compatibility
+exception tracked in [Cloudflare workers-sdk PR #14493](https://github.com/cloudflare/workers-sdk/pull/14493).
+Remove the override once a Miniflare release in Taproot's supported range
+declares a non-vulnerable Sharp version and the full D1, interop,
+packed-consumer, Node 22/24, and audit gates pass without it.
+
+The override is qualified for Taproot's Miniflare D1 test use. It is not a claim
+of general Cloudflare Images compatibility, nor a compatibility claim for
+macOS, ARM, or musl environments.

package/docs/threat-model.md

@@ -8,8 +8,18 @@ association between an edit and its claimed attribution metadata.
 
 ## Trust boundaries
 
-Taproot assumes its consumer supplies a D1 binding and absolute base IRI, and
-that callers reaching mutations have already been authenticated and authorized.
+Taproot assumes its consumer supplies a SQLite/D1 binding and absolute base IRI.
+Hosts create `AuthorizationContext` values only from authenticated state;
+Taproot loads persisted canonical policies and checks them before and after
+hydration. The normal package export has no raw canonical repository. Every
+public mutation requires a runtime-branded installation guard, a current
+context with exact `knowledge:write`, current target visibility, and canonical
+policy. Policy changes require exact `knowledge:policy`. Invalid guards or
+contexts fail before database work or observers. Mutation receipts do not
+disclose canonical bodies. Host assembly withholds the database binding,
+host capability, guard, and keys from request, user, agent, and MCP code. The
+host capability is bootstrap/maintenance authority, while ordinary mutations
+remain per-entity policy authorized.
 Attribution is a stored claim, not proof of identity. Diamond executes
 the RDF patch prepared by Taproot and exposes read-only SPARQL querying; hosts
 must not give untrusted callers an independent write path to Taproot or Diamond
@@ -19,6 +29,8 @@ tables.
 
 - Lost updates are blocked by expected-revision guards inside the same D1 batch
   as all canonical and projected writes.
+- Authorization ABA races are blocked by a shared counter CAS plus a unique
+  durable advance ID asserted inside the same ordered batch.
 - Partial writes are blocked by D1 batch atomicity; injected Workerd failures
   verify rollback across Taproot and Diamond.
 - History tampering is deterred and detected by immutable-table triggers,
@@ -28,13 +40,21 @@ tables.
   outside the package boundary.
 - RDF projection confusion is constrained by strict entity validation,
   deterministic mapping, site-owned namespaces, and per-entity quad ownership.
+- Application/search canonical reads fail closed on absent policy,
+  cross-installation identity, stale authorization revision, policy changes
+  during hydration, and malformed CNF visibility. Denials have a generic body.
+- Search administration requires the exact `search:admin` capability; personas
+  and generic administrator labels do not imply it.
+- Page cursors require a non-extractable host AES-GCM key, use fixed-size
+  plaintext padding, and bind caller, grants, operation, query/filter, auth
+  revision, and search generation.
 - Dependency and release compromise is reduced through locked installs, pinned
   GitHub Actions, dependency review, CodeQL, secret scanning, license checks,
   OIDC npm publishing, provenance, SBOMs, checksums, and attestations.
 
 ## Out of scope
 
-Taproot does not provide authentication, authorization, agent/MCP isolation,
+Taproot does not provide authentication, principal/workspace persistence, agent/MCP isolation,
 network rate limiting, D1 backup custody, UI sanitization, or arbitrary SPARQL
 Update. A compromised host with direct D1 access can bypass library controls;
 restore from a trusted backup and verify audit chains after such an incident.
@@ -43,3 +63,10 @@ Taproot's local Workerd tests validate its package controls under the supported
 D1 contract. They do not qualify a deployed host. The Codex agent creating a
 Site owns assembly, provisioning, route and security wiring, deployment, backup
 policy, and production acceptance.
+
+Diamond's database-level SPARQL handler sees Taproot's complete RDF projection
+and is therefore privileged host maintenance/debug infrastructure, not a
+normal user, agent, MCP, or search endpoint. Workshop must construct an
+authorization-scoped dataset (with a final canonical recheck) before exposing
+SPARQL results. Possession of the SQLite/D1 binding itself remains privileged:
+a compromised host can query tables outside any package API.

package/examples/d1-diamond-interop/README.md

@@ -3,7 +3,8 @@
 Pass a D1-compatible database to `runTaprootInteropDemo(db)`. The demo
 initializes Taproot and Diamond in the same database, creates Properties and an
 Item, applies revision-guarded edits, and queries Taproot's RDF projection
-through Diamond SPARQL.
+through Diamond SPARQL. The SPARQL call is a package interoperability probe
+over a privileged database binding, not an authorization-safe endpoint.
 
 The automated test runs this example locally with Miniflare's Workerd D1
 implementation. It verifies the published package's D1 and Diamond contracts;

package/examples/d1-diamond-interop/demo.ts

@@ -1,33 +1,66 @@
 import {
   RevisionConflictError,
-  TaprootRepository,
+  SEARCH_ADMIN_CAPABILITY,
+  KNOWLEDGE_WRITE_CAPABILITY,
+  KNOWLEDGE_POLICY_CAPABILITY,
+  addStatement,
+  bootstrapTaprootAuthorization,
+  createAuthorizationCursorCodec,
+  createAuthorizedTaproot,
+  createItem,
+  createProperty,
+  createTaprootHostWriteCapability,
+  createInstallationAuthorizationGuard,
   exportEntityJson,
   initializeTaproot,
+  setLabel,
+  setStatementRank,
+  type CanonicalAuthorizationPolicyInput,
   type D1DatabaseLike,
   type Statement,
+  type AuthorizationContext,
 } from '@gnolith/taproot';
 import { createSparqlHandler } from '@gnolith/diamond';
 
 export async function runTaprootInteropDemo(db: D1DatabaseLike) {
   await initializeTaproot(db, { baseIri: 'https://knowledge.example' });
-  const taproot = new TaprootRepository(db, {
-    baseIri: 'https://knowledge.example',
-  });
+  const options = { baseIri: 'https://knowledge.example' };
+  const writeCapability = createTaprootHostWriteCapability(
+    db,
+    options,
+    await crypto.subtle.generateKey({ name: 'HMAC', hash: 'SHA-256' }, false, [
+      'sign',
+    ]),
+  );
+  await bootstrapTaprootAuthorization(
+    db,
+    options,
+    writeCapability,
+    'demo-installation',
+  );
+  const authorizationGuard = await createInstallationAuthorizationGuard(
+    db,
+    options,
+    writeCapability,
+  );
 
-  await taproot.createProperty({
+  await createProperty(db, options, authorizationGuard, writer(1), {
     datatype: 'string',
     labels: { en: { language: 'en', value: 'occupation' } },
+    authorization: policy(1),
   });
-  await taproot.createProperty({
+  await createProperty(db, options, authorizationGuard, writer(2), {
     datatype: 'time',
     labels: { en: { language: 'en', value: 'point in time' } },
+    authorization: policy(2),
   });
-  await taproot.createProperty({
+  await createProperty(db, options, authorizationGuard, writer(3), {
     datatype: 'url',
     labels: { en: { language: 'en', value: 'reference URL' } },
+    authorization: policy(3),
   });
 
-  const created = await taproot.createItem({
+  const created = await createItem(db, options, authorizationGuard, writer(4), {
     labels: { en: { language: 'en', value: 'Ada Lovelace' } },
     descriptions: {
       en: { language: 'en', value: 'English mathematician' },
@@ -38,10 +71,12 @@ export async function runTaprootInteropDemo(db: D1DatabaseLike) {
       tool: 'gnolith-mcp',
     },
     requestId: 'demo-request',
+    authorization: policy(4),
   });
   const occupation: Statement = {
     id: `${created.entityId}$occupation`,
     type: 'statement',
+    text: 'Ada Lovelace worked as a computer programmer in 1843.',
     rank: 'normal',
     mainsnak: {
       snaktype: 'value',
@@ -90,18 +125,36 @@ export async function runTaprootInteropDemo(db: D1DatabaseLike) {
       },
     ],
   };
-  const added = await taproot.addStatement(created.entityId, occupation, {
-    expectedRevision: created.newRevision,
-  });
-  const preferred = await taproot.setStatementRank(
+  const added = await addStatement(
+    db,
+    options,
+    authorizationGuard,
+    writer(5, true),
+    created.entityId,
+    occupation,
+    {
+      expectedRevision: created.newRevision,
+      authorization: policy(5, { [occupation.id]: [] }),
+    },
+  );
+  const preferred = await setStatementRank(
+    db,
+    options,
+    authorizationGuard,
+    writer(6),
     created.entityId,
     occupation.id,
     'preferred',
-    { expectedRevision: added.newRevision },
+    'Ada Lovelace worked as a computer programmer in 1843 (preferred).',
+    {
+      expectedRevision: added.newRevision,
+      authorization: policy(6, { [occupation.id]: [] }),
+    },
   );
   const unknownOccupation: Statement = {
     id: `${created.entityId}$unknown-occupation`,
     type: 'statement',
+    text: 'Ada Lovelace had another occupation whose value is unknown.',
     rank: 'normal',
     mainsnak: {
       snaktype: 'somevalue',
@@ -112,10 +165,20 @@ export async function runTaprootInteropDemo(db: D1DatabaseLike) {
     'qualifiers-order': [],
     references: [],
   };
-  const special = await taproot.addStatement(
+  await addStatement(
+    db,
+    options,
+    authorizationGuard,
+    writer(7, true),
     created.entityId,
     unknownOccupation,
-    { expectedRevision: preferred.newRevision },
+    {
+      expectedRevision: preferred.newRevision,
+      authorization: policy(7, {
+        [occupation.id]: [],
+        [unknownOccupation.id]: [],
+      }),
+    },
   );
 
   const sparql = createSparqlHandler({ db });
@@ -132,21 +195,87 @@ export async function runTaprootInteropDemo(db: D1DatabaseLike) {
 
   let staleRevisionRejected = false;
   try {
-    await taproot.setLabel(created.entityId, 'en', 'stale edit', {
-      expectedRevision: created.newRevision,
-    });
+    await setLabel(
+      db,
+      options,
+      authorizationGuard,
+      writer(8),
+      created.entityId,
+      'en',
+      'stale edit',
+      {
+        expectedRevision: created.newRevision,
+        authorization: policy(8, {
+          [occupation.id]: [],
+          [unknownOccupation.id]: [],
+        }),
+      },
+    );
   } catch (cause) {
     staleRevisionRejected = cause instanceof RevisionConflictError;
   }
 
   const sparqlResults: unknown = await response.json();
-  const audit = await taproot.listAuditEvents({ entityId: created.entityId });
-  const integrity = await taproot.inspectEntityIntegrity(created.entityId);
+  const reader = createAuthorizedTaproot(
+    db,
+    options,
+    {
+      installationId: 'demo-installation',
+      principalId: 'demo-principal',
+      activeWorkspaceId: null,
+      workspaceIds: [],
+      capabilities: [SEARCH_ADMIN_CAPABILITY],
+      authorizationRevision: 8,
+    },
+    {
+      cursorCodec: createAuthorizationCursorCodec(
+        await crypto.subtle.generateKey(
+          { name: 'AES-GCM', length: 256 },
+          false,
+          ['encrypt', 'decrypt'],
+        ),
+      ),
+    },
+  );
+  const audit = await reader.listAuditEvents({ entityId: created.entityId });
+  const integrity = await reader.inspectEntityIntegrity(created.entityId);
+  const canonical = await reader.getEntity(created.entityId);
   return {
-    entityJson: exportEntityJson(special.entity),
+    entityJson: exportEntityJson(canonical.entity),
     sparqlResults,
     staleRevisionRejected,
     audit: audit.items,
     integrity,
   };
 }
+
+function policy(
+  expectedAuthorizationRevision: number,
+  statementRestrictions: CanonicalAuthorizationPolicyInput['statementRestrictions'] = {},
+): CanonicalAuthorizationPolicyInput {
+  return {
+    installationId: 'demo-installation',
+    workspaceId: null,
+    ownerPrincipalId: 'demo-principal',
+    visibility: { version: 1, clauses: [] },
+    statementRestrictions,
+    expectedAuthorizationRevision,
+  };
+}
+
+function writer(
+  authorizationRevision: number,
+  policyAuthority = false,
+): AuthorizationContext {
+  return {
+    installationId: 'demo-installation',
+    principalId: 'demo-principal',
+    activeWorkspaceId: null,
+    workspaceIds: [],
+    capabilities: [
+      KNOWLEDGE_WRITE_CAPABILITY,
+      ...(policyAuthority ? [KNOWLEDGE_POLICY_CAPABILITY] : []),
+    ],
+    authorizationRevision,
+  };
+}

package/migrations/0003_canonical_statement_text.sql

@@ -0,0 +1,31 @@
+-- Documentation copy of canonical JSON migration 3.
+-- Hosts must use applyTaprootMigrations() so the package migration ledger is
+-- updated atomically. No fallback statement prose is generated.
+INSERT INTO taproot_assertions(assertion_key)
+WITH canonical_json(entity_json) AS (
+  SELECT entity_json FROM taproot_entities
+  UNION ALL
+  SELECT entity_json FROM taproot_entity_revisions
+)
+SELECT NULL
+FROM canonical_json AS source,
+  json_each(source.entity_json, '$.claims') AS claim,
+  json_each(claim.value) AS statement
+WHERE json_type(statement.value, '$.text') IS NOT 'text'
+   OR trim(json_extract(statement.value, '$.text')) = ''
+LIMIT 1;
+
+UPDATE taproot_metadata SET metadata_value = '2'
+WHERE metadata_key = 'canonical_json_version'
+  AND metadata_value = '1';
+
+INSERT INTO taproot_assertions(assertion_key)
+SELECT NULL WHERE NOT EXISTS (
+  SELECT 1 FROM taproot_metadata
+  WHERE metadata_key = 'canonical_json_version'
+    AND metadata_value = '2'
+);
+
+INSERT INTO taproot_migrations(version, name)
+VALUES (3, 'canonical-statement-text')
+ON CONFLICT(version) DO NOTHING;

package/migrations/0004_canonical_authorization_policy.sql

@@ -0,0 +1,213 @@
+CREATE TABLE IF NOT EXISTS taproot_installation_authorization (
+  singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+  installation_id TEXT NOT NULL UNIQUE,
+  authorization_revision INTEGER NOT NULL CHECK (authorization_revision >= 1),
+  search_generation INTEGER NOT NULL CHECK (search_generation >= 1),
+  last_advance_id TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_entity_authorization (
+  entity_id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL,
+  workspace_id TEXT,
+  owner_principal_id TEXT NOT NULL,
+  visibility_json TEXT NOT NULL CHECK (json_valid(visibility_json)),
+  effective_visibility_json TEXT NOT NULL CHECK (json_valid(effective_visibility_json)),
+  source_revision INTEGER NOT NULL,
+  authorization_revision INTEGER NOT NULL,
+  deleted_at TEXT,
+  event_id TEXT NOT NULL UNIQUE,
+  updated_at TEXT NOT NULL,
+  FOREIGN KEY (entity_id) REFERENCES taproot_entities(entity_id),
+  FOREIGN KEY (event_id) REFERENCES taproot_audit_events(event_id)
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_entity_authorization_revisions (
+  entity_id TEXT NOT NULL,
+  source_revision INTEGER NOT NULL,
+  installation_id TEXT NOT NULL,
+  workspace_id TEXT,
+  owner_principal_id TEXT NOT NULL,
+  visibility_json TEXT NOT NULL CHECK (json_valid(visibility_json)),
+  effective_visibility_json TEXT NOT NULL CHECK (json_valid(effective_visibility_json)),
+  authorization_revision INTEGER NOT NULL,
+  deleted_at TEXT,
+  event_id TEXT NOT NULL UNIQUE,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (entity_id, source_revision),
+  FOREIGN KEY (entity_id, source_revision)
+    REFERENCES taproot_entity_revisions(entity_id, revision),
+  FOREIGN KEY (event_id) REFERENCES taproot_audit_events(event_id)
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_statement_authorization (
+  entity_id TEXT NOT NULL,
+  statement_id TEXT NOT NULL,
+  source_revision INTEGER NOT NULL,
+  restrictions_json TEXT NOT NULL CHECK (json_valid(restrictions_json)),
+  effective_visibility_json TEXT NOT NULL CHECK (json_valid(effective_visibility_json)),
+  authorization_revision INTEGER NOT NULL,
+  PRIMARY KEY (entity_id, statement_id),
+  FOREIGN KEY (entity_id) REFERENCES taproot_entities(entity_id)
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_statement_authorization_revisions (
+  entity_id TEXT NOT NULL,
+  source_revision INTEGER NOT NULL,
+  statement_id TEXT NOT NULL,
+  restrictions_json TEXT NOT NULL CHECK (json_valid(restrictions_json)),
+  effective_visibility_json TEXT NOT NULL CHECK (json_valid(effective_visibility_json)),
+  authorization_revision INTEGER NOT NULL,
+  PRIMARY KEY (entity_id, source_revision, statement_id),
+  FOREIGN KEY (entity_id, source_revision)
+    REFERENCES taproot_entity_revisions(entity_id, revision)
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_authorization_projection_outbox (
+  event_id TEXT PRIMARY KEY,
+  entity_id TEXT NOT NULL,
+  source_revision INTEGER NOT NULL,
+  authorization_revision INTEGER NOT NULL,
+  search_generation INTEGER NOT NULL,
+  operation TEXT NOT NULL CHECK (operation IN ('upsert', 'delete', 'repair', 'backfill')),
+  state TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending', 'claimed', 'complete')),
+  created_at TEXT NOT NULL,
+  FOREIGN KEY (event_id) REFERENCES taproot_audit_events(event_id)
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_authorization_backfill_plans (
+  plan_id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL,
+  base_authorization_revision INTEGER NOT NULL,
+  manifest_json TEXT NOT NULL CHECK (json_valid(manifest_json)),
+  manifest_hash TEXT NOT NULL,
+  entity_count INTEGER NOT NULL CHECK (entity_count > 0 AND entity_count <= 100),
+  revision_count INTEGER NOT NULL CHECK (revision_count > 0),
+  status TEXT NOT NULL CHECK (status IN ('planned', 'applying', 'complete')),
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  completed_at TEXT
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_authorization_admin_audit (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  audit_id TEXT NOT NULL UNIQUE,
+  event_type TEXT NOT NULL CHECK (event_type IN ('backfill-plan', 'backfill-apply')),
+  principal_id TEXT NOT NULL,
+  plan_id TEXT NOT NULL,
+  authorization_revision INTEGER NOT NULL,
+  details_json TEXT NOT NULL CHECK (json_valid(details_json)),
+  created_at TEXT NOT NULL,
+  FOREIGN KEY (plan_id) REFERENCES taproot_authorization_backfill_plans(plan_id)
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS taproot_installation_authorization_advances (
+  advance_id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL,
+  from_revision INTEGER NOT NULL,
+  to_revision INTEGER NOT NULL,
+  search_generation INTEGER NOT NULL,
+  domain TEXT NOT NULL,
+  principal_id TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  CHECK (to_revision = from_revision + 1)
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS taproot_entity_authorization_candidate_idx
+  ON taproot_entity_authorization(installation_id, deleted_at, entity_id);
+CREATE INDEX IF NOT EXISTS taproot_entity_authorization_revision_idx
+  ON taproot_entity_authorization_revisions(entity_id, source_revision DESC);
+CREATE INDEX IF NOT EXISTS taproot_statement_authorization_candidate_idx
+  ON taproot_statement_authorization(entity_id, source_revision, statement_id);
+CREATE INDEX IF NOT EXISTS taproot_authorization_outbox_state_idx
+  ON taproot_authorization_projection_outbox(state, authorization_revision, event_id);
+
+CREATE TRIGGER IF NOT EXISTS taproot_revisions_no_replace
+  BEFORE INSERT ON taproot_entity_revisions
+  WHEN EXISTS (
+    SELECT 1 FROM taproot_entity_revisions
+    WHERE entity_id = NEW.entity_id AND revision = NEW.revision
+  )
+  BEGIN SELECT RAISE(ABORT, 'taproot revisions cannot be replaced'); END;
+
+CREATE TRIGGER IF NOT EXISTS taproot_audit_no_replace
+  BEFORE INSERT ON taproot_audit_events
+  WHEN EXISTS (
+    SELECT 1 FROM taproot_audit_events WHERE event_id = NEW.event_id
+  )
+  BEGIN SELECT RAISE(ABORT, 'taproot audit events cannot be replaced'); END;
+
+CREATE TRIGGER IF NOT EXISTS taproot_installation_identity_no_update
+  BEFORE UPDATE OF installation_id ON taproot_installation_authorization
+  BEGIN SELECT RAISE(ABORT, 'taproot installation identity is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_installation_authorization_no_delete
+  BEFORE DELETE ON taproot_installation_authorization
+  BEGIN SELECT RAISE(ABORT, 'taproot installation authorization is durable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_installation_authorization_no_replace
+  BEFORE INSERT ON taproot_installation_authorization
+  WHEN EXISTS (SELECT 1 FROM taproot_installation_authorization WHERE singleton = NEW.singleton)
+  BEGIN SELECT RAISE(ABORT, 'taproot installation authorization cannot be replaced'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_entity_authorization_revisions_no_update
+  BEFORE UPDATE ON taproot_entity_authorization_revisions
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization revisions are immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_entity_authorization_revisions_no_delete
+  BEFORE DELETE ON taproot_entity_authorization_revisions
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization revisions are immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_entity_authorization_revisions_no_replace
+  BEFORE INSERT ON taproot_entity_authorization_revisions
+  WHEN EXISTS (
+    SELECT 1 FROM taproot_entity_authorization_revisions
+    WHERE (entity_id = NEW.entity_id AND source_revision = NEW.source_revision)
+       OR event_id = NEW.event_id
+  )
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization revisions cannot be replaced'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_statement_authorization_revisions_no_update
+  BEFORE UPDATE ON taproot_statement_authorization_revisions
+  BEGIN SELECT RAISE(ABORT, 'taproot statement authorization revisions are immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_statement_authorization_revisions_no_delete
+  BEFORE DELETE ON taproot_statement_authorization_revisions
+  BEGIN SELECT RAISE(ABORT, 'taproot statement authorization revisions are immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_statement_authorization_revisions_no_replace
+  BEFORE INSERT ON taproot_statement_authorization_revisions
+  WHEN EXISTS (
+    SELECT 1 FROM taproot_statement_authorization_revisions
+    WHERE entity_id = NEW.entity_id AND source_revision = NEW.source_revision
+      AND statement_id = NEW.statement_id
+  )
+  BEGIN SELECT RAISE(ABORT, 'taproot statement authorization revisions cannot be replaced'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_authorization_admin_audit_no_update
+  BEFORE UPDATE ON taproot_authorization_admin_audit
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization administration audit is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_authorization_admin_audit_no_delete
+  BEFORE DELETE ON taproot_authorization_admin_audit
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization administration audit is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_authorization_admin_audit_no_replace
+  BEFORE INSERT ON taproot_authorization_admin_audit
+  WHEN EXISTS (
+    SELECT 1 FROM taproot_authorization_admin_audit
+    WHERE sequence = NEW.sequence OR audit_id = NEW.audit_id
+  )
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization administration audit cannot be replaced'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_installation_authorization_advances_no_update
+  BEFORE UPDATE ON taproot_installation_authorization_advances
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization advances are immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_installation_authorization_advances_no_delete
+  BEFORE DELETE ON taproot_installation_authorization_advances
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization advances are immutable'); END;
+CREATE TRIGGER IF NOT EXISTS taproot_installation_authorization_advances_no_replace
+  BEFORE INSERT ON taproot_installation_authorization_advances
+  WHEN EXISTS (
+    SELECT 1 FROM taproot_installation_authorization_advances
+    WHERE advance_id = NEW.advance_id
+  )
+  BEGIN SELECT RAISE(ABORT, 'taproot authorization advances cannot be replaced'); END;
+
+INSERT INTO taproot_metadata(metadata_key, metadata_value)
+  VALUES ('schema_version', '3')
+  ON CONFLICT(metadata_key) DO UPDATE SET metadata_value = excluded.metadata_value;
+INSERT INTO taproot_migrations(version, name)
+  VALUES (4, 'canonical-authorization-policy')
+  ON CONFLICT(version) DO NOTHING;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gnolith/taproot",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Portable SQLite and D1 Wikibase-compatible knowledge graph and revision layer for Gnolith.",
   "author": "Gnolith contributors",
   "keywords": [
@@ -75,6 +75,9 @@
     "rdf-data-factory": "^2.0.2"
   },
   "packageManager": "npm@11.9.0",
+  "overrides": {
+    "sharp": "0.35.3"
+  },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/node": "^24.0.0",