@hasna/infinity 0.1.0

package/dist/types/brokers/checkpoint/clean-verifier.d.ts

@@ -0,0 +1,145 @@
+import { type AuthenticatedFenceContext, type BrokerFence } from "../../contracts/fence";
+import { type AuthorityReceiptCryptographyPort } from "./seal-authority";
+import { type CheckpointProvenanceReceiptCryptographyPort, type FenceAuthorityPort } from "./service";
+import { type CheckpointManifestSigningTrustHeadResolverPort, type CheckpointManifestSigningTrustHeadVerifierPort, type CheckpointManifestSigningTrustResolverPort, type CheckpointManifestSignatureVerifierPort } from "./manifest-signature";
+import type { VersionedObjectStore } from "./store";
+import { type CleanVerifierHandoff, type PassingVerificationReceipt, type VerificationReceiptCryptographyPort } from "./verifier";
+import { type ManagedVerifierSandboxHandle, type SandboxesVerifierCleanupReceipt, type SandboxesVerifierAllocationReceiptVerifierPort, type SandboxesVerifierCleanupReceiptVerifierPort, type SandboxesVerifierQuarantineReceipt, type SandboxesVerifierQuarantineReceiptVerifierPort, type VerifierCleanupAuthorityPort, type VerifierCleanupGrant } from "./verifier-cleanup";
+import type { CleanVerifierFinalizationAuthorityPort } from "./clean-verifier-finalization";
+export interface VerifierEvidenceLoaderPort {
+    loadDigest(digest: string, mediaType: "application/json" | "application/octet-stream"): Promise<Uint8Array>;
+    loadExactSourceBase(input: {
+        repositoryId: string;
+        objectFormat: "sha1" | "sha256";
+        expectedBaseOid: string;
+        sourceSnapshotSha256: string;
+    }): Promise<Uint8Array>;
+}
+export interface ManagedVerifierSandboxResult {
+    schemaVersion: "infinity.managed-verifier-result/v1";
+    verdict: "pass" | "fail";
+    expectedBaseOid: string;
+    candidateOid: string;
+    candidateTreeOid: string;
+    candidateParentOids: string[];
+    advertisedRefs: string[];
+    prerequisites: string[];
+    gitBundleVerified: boolean;
+    strictObjectVerificationPassed: boolean;
+    sourceBaseVerified: boolean;
+    binaryDiffMatchesCandidate: boolean;
+    packerEvidenceValidated: boolean;
+    pathPolicyPassed: boolean;
+    secretScanPassed: boolean;
+    requiredTestsPassed: boolean;
+    skippedRequiredTests: number;
+    secretFindingCount: number;
+    networkAccessObserved: boolean;
+    credentialMaterialObserved: boolean;
+    producerStateObserved: boolean;
+    testReceiptSha256: string;
+    secretScanReceiptSha256: string;
+    startedAt: string;
+    completedAt: string;
+    fence: BrokerFence;
+    resourceId: string;
+    resourceLeaseId: string;
+    resourceLifecycleGeneration: number | bigint;
+    nativeIncarnationId: string;
+    providerHandleSha256: string;
+    dependentResourceClosureSha256: string;
+    verifierImageSha256: string;
+    resourceLimitsSha256: string;
+    testCommandsSha256: string;
+    attestation: Readonly<{
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signedResultSha256: string;
+        signatureBase64: string;
+        signatureSha256: string;
+    }>;
+}
+export interface ManagedVerifierResultAttestationPort {
+    verifyDigest(input: {
+        domain: "infinity.managed-verifier-result/v1";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface ManagedVerifierSandboxPort {
+    allocate(input: {
+        fence: BrokerFence;
+        verifierImageSha256: string;
+        credentialMode: "none";
+        networkMode: "deny_all";
+        reuseProducerState: false;
+    }): Promise<ManagedVerifierSandboxHandle>;
+    verify(input: {
+        handle: ManagedVerifierSandboxHandle;
+        fence: BrokerFence;
+        manifestCanonicalBytes: Uint8Array;
+        gitBundleBytes: Uint8Array;
+        binaryDiffBytes: Uint8Array;
+        packerEvidenceBytes: Uint8Array;
+        sourceBaseBytes: Uint8Array;
+        runSpecBytes: Uint8Array;
+        testPlanBytes: Uint8Array;
+        secretScanPolicyBytes: Uint8Array;
+        networkPolicyBytes: Uint8Array;
+    }): Promise<ManagedVerifierSandboxResult>;
+    destroy(input: {
+        handle: ManagedVerifierSandboxHandle;
+        grant: VerifierCleanupGrant;
+    }): Promise<SandboxesVerifierCleanupReceipt>;
+    quarantineInvalidAllocation(input: {
+        untrustedHandle: unknown;
+        verificationFence: BrokerFence;
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+    quarantineCleanupFailure(input: {
+        handle: ManagedVerifierSandboxHandle;
+        verificationFence: BrokerFence;
+        failureCode: "cleanup_authority_or_provider_failure";
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+}
+export interface CleanCheckpointVerifierLimits {
+    maxManifestBytes: number;
+    maxBundleBytes: number;
+    maxSourceSnapshotBytes: number;
+    maxDeclaredInputBytes: number;
+}
+export declare class CleanCheckpointVerifier {
+    private readonly dependencies;
+    private readonly limits;
+    private readonly resourceLimitsSha256;
+    private currentManifestSigningTrustHead;
+    private signingTrustHeadResolution;
+    constructor(dependencies: {
+        authority: FenceAuthorityPort;
+        authorityCryptography: AuthorityReceiptCryptographyPort;
+        manifestSignatureVerifier: CheckpointManifestSignatureVerifierPort;
+        manifestSigningTrustResolver: CheckpointManifestSigningTrustResolverPort;
+        manifestSigningTrustHeadResolver: CheckpointManifestSigningTrustHeadResolverPort;
+        manifestSigningTrustHeadVerifier: CheckpointManifestSigningTrustHeadVerifierPort;
+        provenanceReceiptCryptography: CheckpointProvenanceReceiptCryptographyPort;
+        store: VersionedObjectStore;
+        evidence: VerifierEvidenceLoaderPort;
+        sandbox: ManagedVerifierSandboxPort;
+        resultAttestation: ManagedVerifierResultAttestationPort;
+        cleanupAuthority: VerifierCleanupAuthorityPort;
+        sandboxesAllocationReceiptVerifier: SandboxesVerifierAllocationReceiptVerifierPort;
+        sandboxesCleanupReceiptVerifier: SandboxesVerifierCleanupReceiptVerifierPort;
+        sandboxesQuarantineReceiptVerifier: SandboxesVerifierQuarantineReceiptVerifierPort;
+        verificationReceiptCryptography: VerificationReceiptCryptographyPort;
+        finalizationAuthority: CleanVerifierFinalizationAuthorityPort;
+    }, limits: CleanCheckpointVerifierLimits);
+    verify(handoff: CleanVerifierHandoff, authenticated: AuthenticatedFenceContext): Promise<PassingVerificationReceipt>;
+    private loadDeclared;
+    private resolveCurrentSigningTrustHead;
+    private revalidate;
+    private verifyManagedResultAttestation;
+}
+export declare function parseManagedVerifierResult(value: unknown, objectFormat: "sha1" | "sha256"): ManagedVerifierSandboxResult;
+export { parseManagedVerifierSandboxHandle, parseSandboxesVerifierAllocationReceipt, parseSandboxesVerifierCleanupReceipt, parseSandboxesVerifierQuarantineReceipt, parseVerifierCleanupCommitReceipt, parseVerifierCleanupGrant, sandboxesVerifierAllocationReceiptDigest, sandboxesVerifierCleanupReceiptDigest, sandboxesVerifierQuarantineReceiptCanonicalBytes, sandboxesVerifierQuarantineReceiptDigest, verifierCleanupCommitReceiptDigest, verifierCleanupGrantDigest, verifierCleanupGrantRequestDigest, verifierCleanupOperationDigest, verifierCleanupTarget, verifierInvalidAllocationEvidenceDigest, verifierQuarantineSubjectDigest, verifyRecordAndReadbackVerifierQuarantine, verifySandboxesVerifierAllocationReceipt, verifySandboxesVerifierCleanupReceipt, verifySandboxesVerifierQuarantineReceipt, } from "./verifier-cleanup";
+export type { ManagedVerifierDependentResource, ManagedVerifierProviderHandle, ManagedVerifierSandboxHandle, SandboxesVerifierAllocationReceipt, SandboxesVerifierAllocationReceiptAttestation, SandboxesVerifierAllocationReceiptCore, SandboxesVerifierAllocationReceiptVerifierPort, SandboxesResourceAbsence, SandboxesVerifierCleanupReceipt, SandboxesVerifierCleanupReceiptAttestation, SandboxesVerifierCleanupReceiptCore, SandboxesVerifierCleanupReceiptVerifierPort, SandboxesVerifierQuarantineReceipt, SandboxesVerifierQuarantineReceiptAttestation, SandboxesVerifierQuarantineReceiptCore, SandboxesVerifierQuarantineReceiptVerifierPort, VerifiedVerifierCleanupEvidence, VerifierCleanupAuthorityPort, VerifierCleanupFenceAuthorityPort, VerifierCleanupCommitReceipt, VerifierCleanupGrant, VerifierCleanupGrantAuthorityPort, VerifierCleanupGrantBinding, VerifierCleanupGrantCore, VerifierCleanupTarget, VerifierQuarantineExpectation, VerifierQuarantineReason, } from "./verifier-cleanup";

package/dist/types/brokers/checkpoint/final-trust-authority.d.ts

@@ -0,0 +1,55 @@
+import type { BrokerFence } from "../../contracts/fence";
+import { type SqlExecutor } from "../persistence/postgres";
+import { type CheckpointManifestSigningTrustHead, type CheckpointManifestSigningTrustHeadResolverPort, type CheckpointManifestSigningTrustHeadVerifierPort } from "./manifest-signature";
+import type { CheckpointManifestSigningTrustFinalizationAuthorityPort } from "./seal-authority";
+import { type AuthoritySignedPassingVerificationReceipt, type PassingVerificationReceipt, type VerificationReceiptCurrentTrustEffectContext, type VerificationReceiptFinalTrustAuthorization, type VerificationReceiptFinalTrustAuthorityPort, type VerificationReceiptFinalTrustCryptographyPort } from "./verifier";
+export declare class PostgresVerificationReceiptFinalTrustAuthority implements VerificationReceiptFinalTrustAuthorityPort, CheckpointManifestSigningTrustFinalizationAuthorityPort {
+    private readonly dependencies;
+    constructor(dependencies: {
+        sql: SqlExecutor;
+        cryptography: VerificationReceiptFinalTrustCryptographyPort;
+    });
+    recordVerifiedCurrentHead(headInput: CheckpointManifestSigningTrustHead): Promise<void>;
+    lockCurrentHead(input: {
+        transaction: SqlExecutor;
+        expectedHead: CheckpointManifestSigningTrustHead;
+    }): Promise<{
+        head: CheckpointManifestSigningTrustHead;
+        databaseTime: Date;
+    }>;
+    authorizePassingReceipt(input: {
+        signedReceipt: AuthoritySignedPassingVerificationReceipt;
+        signedReceiptSha256: string;
+        manifestSigningKeyId: string;
+        expectedCurrentSigningTrustHead: CheckpointManifestSigningTrustHead;
+    }): Promise<VerificationReceiptFinalTrustAuthorization>;
+    verifyCurrentAuthorization(input: {
+        signedReceipt: AuthoritySignedPassingVerificationReceipt;
+        signedReceiptSha256: string;
+        manifestSigningKeyId: string;
+        authorization: VerificationReceiptFinalTrustAuthorization;
+    }): Promise<{
+        verified: boolean;
+        databaseTime: Date;
+        currentSigningTrustHead: CheckpointManifestSigningTrustHead;
+    }>;
+    withCurrentAuthorization<T>(input: {
+        receipt: PassingVerificationReceipt;
+        action: string;
+        promotionFence: BrokerFence;
+    }, effect: (context: VerificationReceiptCurrentTrustEffectContext) => Promise<T>): Promise<T>;
+    private verifyAuthorizationCryptography;
+    private isPersistedAuthorization;
+    private requireCurrent;
+    private readCurrent;
+}
+export declare class PostgresRecordedManifestSigningTrustHeadResolver implements CheckpointManifestSigningTrustHeadResolverPort {
+    private readonly dependencies;
+    constructor(dependencies: {
+        sql: SqlExecutor;
+        upstream: CheckpointManifestSigningTrustHeadResolverPort;
+        verifier: CheckpointManifestSigningTrustHeadVerifierPort;
+        authority: PostgresVerificationReceiptFinalTrustAuthority;
+    });
+    resolveCurrentSigningTrust(input: Parameters<CheckpointManifestSigningTrustHeadResolverPort["resolveCurrentSigningTrust"]>[0]): Promise<CheckpointManifestSigningTrustHead>;
+}

package/dist/types/brokers/checkpoint/idempotency.d.ts

@@ -0,0 +1,25 @@
+import type { BrokerFence } from "../../contracts/fence";
+export interface IdempotentExecutionContext {
+    readonly fence: BrokerFence;
+    readonly executionLeaseMs?: number;
+}
+export interface IdempotentExecutor<T> {
+    execute(operationId: string, operationDigest: string, effect: () => Promise<T>, context?: IdempotentExecutionContext, classifyResult?: (result: T) => "committed" | "unknown_requires_review"): Promise<T>;
+}
+export type IdempotentResolution<T> = Readonly<{
+    state: "missing";
+}> | Readonly<{
+    state: "in_flight";
+}> | Readonly<{
+    state: "unknown_requires_review";
+    result?: T;
+}> | Readonly<{
+    state: "committed";
+    result: T;
+}>;
+export declare class IdempotentOperationLedger<T> implements IdempotentExecutor<T> {
+    private readonly entries;
+    resolve(operationId: string, operationDigest: string): IdempotentResolution<T>;
+    commit(operationId: string, operationDigest: string, result: T): T;
+    execute(operationId: string, operationDigest: string, effect: () => Promise<T>, _context?: IdempotentExecutionContext, classifyResult?: (result: T) => "committed" | "unknown_requires_review"): Promise<T>;
+}

package/dist/types/brokers/checkpoint/journaled-store.d.ts

@@ -0,0 +1,9 @@
+import { type ProviderStepExecutor } from "../persistence/contracts";
+import type { PutVersionedObjectInput, VersionedObjectRead, VersionedObjectRef, VersionedObjectStore } from "./store";
+export declare class ProviderJournaledVersionedObjectStore implements VersionedObjectStore {
+    private readonly store;
+    private readonly providerSteps;
+    constructor(store: VersionedObjectStore, providerSteps: ProviderStepExecutor);
+    putIfAbsent(input: PutVersionedObjectInput): Promise<VersionedObjectRef>;
+    getVersion(reference: VersionedObjectRef): Promise<VersionedObjectRead>;
+}

package/dist/types/brokers/checkpoint/manifest-signature.d.ts

@@ -0,0 +1,135 @@
+import { type BrokerFence } from "../../contracts/fence";
+import { type Int64 } from "../../core/int64";
+import { type CheckpointManifest } from "./manifest";
+import { CHECKPOINT_MANIFEST_SIGNATURE_DOMAIN } from "./signing-message";
+export type CheckpointManifestSigningKeyStatus = "active" | "retired" | "revoked";
+export interface CheckpointManifestSigningKeyRecordInput {
+    keyId: string;
+    algorithm: "ecdsa-p256-sha256";
+    publicKeySpkiSha256: string;
+    activatedAt: string;
+    status: CheckpointManifestSigningKeyStatus;
+    statusChangedAt: string;
+}
+export interface CheckpointManifestSigningKeyRecord extends Readonly<CheckpointManifestSigningKeyRecordInput> {
+}
+export interface CheckpointManifestSigningTrustInput {
+    schemaVersion: "infinity.checkpoint-manifest-signing-trust/v1";
+    trustAnchorSha256: string;
+    keyHistorySha256: string;
+    keys: readonly CheckpointManifestSigningKeyRecordInput[];
+}
+export interface CheckpointManifestSigningTrust extends Omit<Readonly<CheckpointManifestSigningTrustInput>, "keys"> {
+    readonly keys: readonly CheckpointManifestSigningKeyRecord[];
+}
+export interface CheckpointManifestSigningTrustHeadCore {
+    schemaVersion: "infinity.checkpoint-manifest-signing-trust-head/v1";
+    signingTrust: CheckpointManifestSigningTrust;
+    headSequence: Int64;
+    observationSequence: Int64;
+    authorityChallengeSha256: string;
+    fence: BrokerFence;
+    authorityEventId: string;
+    observedAt: string;
+    expiresAt: string;
+}
+export interface CheckpointManifestSigningTrustHeadAttestation {
+    schemaVersion: "infinity.checkpoint-manifest-signing-trust-head-attestation/v1";
+    keyId: string;
+    algorithm: "ecdsa-p256-sha256";
+    signedCoreSha256: string;
+    signatureBase64: string;
+    signatureSha256: string;
+    receiptSha256: string;
+}
+export interface CheckpointManifestSigningTrustHead extends CheckpointManifestSigningTrustHeadCore {
+    attestation: CheckpointManifestSigningTrustHeadAttestation;
+}
+export interface CheckpointManifestSigningTrustHeadVerifierPort {
+    verifyDigest(input: {
+        domain: "infinity.checkpoint-manifest-signing-trust-head/v1";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface CheckpointManifestSigningTrustHeadResolverPort {
+    resolveCurrentSigningTrust(input: {
+        fence: BrokerFence;
+        authorityChallengeSha256: string;
+        minimumHeadSequence?: Int64;
+        minimumObservationSequence?: Int64;
+    }): Promise<CheckpointManifestSigningTrustHead>;
+}
+/**
+ * Resolves the exact historical, authority-signed trust snapshot named by a
+ * sealed checkpoint. Implementations are responsible for authenticating the
+ * snapshot under the requested recovery trust anchor; callers still
+ * close-parse it and recompute its exact history digest before use.
+ */
+export interface CheckpointManifestSigningTrustResolverPort {
+    resolveSigningTrust(input: {
+        trustAnchorSha256: string;
+        keyHistorySha256: string;
+    }): Promise<CheckpointManifestSigningTrustInput | CheckpointManifestSigningTrust>;
+}
+export interface CheckpointManifestSignatureVerificationResult {
+    verified: boolean;
+    signingKeyId: string;
+    publicKeySpkiSha256: string;
+    trustAnchorSha256: string;
+    keyHistorySha256: string;
+}
+/**
+ * The implementation must verify signingMessageDigest as a 32-byte prehash
+ * with the exact public key resolved from signingKey and must validate that
+ * key history against the independently pinned recovery trust anchor.
+ */
+export interface CheckpointManifestSignatureVerifierPort {
+    verify(input: {
+        domain: typeof CHECKPOINT_MANIFEST_SIGNATURE_DOMAIN;
+        messageType: "digest";
+        digestAlgorithm: "sha256";
+        manifestCanonicalBytes: Uint8Array;
+        manifestDigest: string;
+        signingMessageDigest: string;
+        signingMessageDigestBytes: Uint8Array;
+        checkpointId: string;
+        fence: BrokerFence;
+        signature: Uint8Array;
+        signingKeyId: string;
+        signingKey: CheckpointManifestSigningKeyRecord;
+        algorithm: "ecdsa-p256-sha256";
+        signingTrust: CheckpointManifestSigningTrust;
+    }): Promise<CheckpointManifestSignatureVerificationResult>;
+}
+export declare function checkpointManifestKeyHistoryDigest(input: {
+    trustAnchorSha256: string;
+    keys: readonly CheckpointManifestSigningKeyRecordInput[] | readonly CheckpointManifestSigningKeyRecord[];
+}): string;
+export declare function parseCheckpointManifestSigningTrust(value: unknown): CheckpointManifestSigningTrust;
+export declare function parseCheckpointManifestSigningTrustHead(value: unknown, expectedFenceInput: BrokerFence): CheckpointManifestSigningTrustHead;
+export declare function checkpointManifestSigningTrustHeadDigest(head: CheckpointManifestSigningTrustHead): string;
+export declare function verifyCheckpointManifestSigningTrustHead(input: {
+    head: CheckpointManifestSigningTrustHead;
+    expectedFence: BrokerFence;
+    expectedAuthorityChallengeSha256?: string;
+    databaseTime?: Date;
+}, verifier: CheckpointManifestSigningTrustHeadVerifierPort): Promise<CheckpointManifestSigningTrustHead>;
+export declare function assertCheckpointManifestSigningTrustHeadFreshAtDatabaseTime(headInput: CheckpointManifestSigningTrustHead, databaseTimeInput: Date): void;
+export declare function assertCheckpointManifestSigningTrustHeadMonotonic(previous: Pick<CheckpointManifestSigningTrustHead, "headSequence" | "observationSequence" | "observedAt" | "signingTrust"> | undefined, current: CheckpointManifestSigningTrustHead): void;
+export declare function verifyCheckpointManifestSignature(input: {
+    manifest: CheckpointManifest;
+    manifestCanonicalBytes: Uint8Array;
+    manifestDigest: string;
+    trustedSigningTime: string;
+    checkpointId: string;
+    fence: BrokerFence;
+    signature: Uint8Array;
+    signingKeyId: string;
+    algorithm: "ecdsa-p256-sha256";
+    signingTrust: CheckpointManifestSigningTrustInput | CheckpointManifestSigningTrust;
+    currentSigningTrust: CheckpointManifestSigningTrustInput | CheckpointManifestSigningTrust;
+    requireCurrentSigningKeyActive?: boolean;
+}, verifier: CheckpointManifestSignatureVerifierPort): Promise<void>;

package/dist/types/brokers/checkpoint/manifest.d.ts

@@ -0,0 +1,57 @@
+import { type BrokerFence, type BrokerFenceInput } from "../../contracts/fence";
+import { type Int64 } from "../../core/int64";
+export type CheckpointArtifactName = "git_bundle" | "binary_diff" | "test_plan" | "packer_evidence" | "provenance_receipt";
+export interface CheckpointArtifactRefInput {
+    logical_name: CheckpointArtifactName;
+    media_type: string;
+    byte_length: number;
+    sha256: string;
+    bucket_alias: string;
+    object_key: string;
+    version_id: string;
+    store_checksum_sha256: string;
+    kms_key_alias: string;
+    encryption_context_sha256: string;
+}
+export interface CheckpointArtifactRef extends Readonly<CheckpointArtifactRefInput> {
+}
+export interface CheckpointManifestInput {
+    schema_version: "infinity.checkpoint-manifest/v1";
+    checkpoint_id: string;
+    project_id: string;
+    repository_id: string;
+    fence: BrokerFenceInput;
+    authority_activation_receipt_sha256: string;
+    route_activation_receipt_sha256: string;
+    attempt_lease_grant_sha256: string;
+    run_spec_sha256: string;
+    policy_sha256: string;
+    object_format: "sha1" | "sha256";
+    expected_base_oid: string;
+    target_ref: string;
+    candidate_oid: string;
+    candidate_parent_oid: string;
+    candidate_tree_oid: string;
+    operation_input_sha256: string;
+    packer_image_sha256: string;
+    packer_identity: string;
+    executor_identity: string;
+    data_class: "public" | "internal_non_sensitive" | "sensitive_restricted";
+    created_at: string;
+    signing_trust_head_sha256: string;
+    signing_trust_authority_event_id: string;
+    signing_trust_head_sequence: Int64;
+    signing_trust_observation_sequence: Int64;
+    retention_class: "phase1_evidence" | "recovery_only_secret_quarantine";
+    artifacts: CheckpointArtifactRefInput[];
+    scan_receipt_sha256: string;
+    provenance_verification_receipt_sha256: string;
+}
+export interface CheckpointManifest extends Omit<Readonly<CheckpointManifestInput>, "fence" | "artifacts"> {
+    readonly fence: BrokerFence;
+    readonly artifacts: readonly CheckpointArtifactRef[];
+}
+export declare function parseCheckpointManifest(value: unknown): CheckpointManifest;
+export declare function checkpointManifestDigest(manifest: CheckpointManifest): string;
+/** Exact RFC-8785-style bytes whose SHA-256 digest is signed by the manifest key. */
+export declare function checkpointManifestCanonicalBytes(manifest: CheckpointManifest): Uint8Array;

package/dist/types/brokers/checkpoint/s3-store.d.ts

@@ -0,0 +1,215 @@
+import { parseBrokerFence } from "../../contracts/fence";
+import { type BinarySource } from "./bytes";
+import type { PutVersionedObjectInput, VersionedObjectRef, VersionedObjectStore } from "./store";
+export interface S3PutObjectRequest {
+    Bucket: string;
+    Key: string;
+    Body: Uint8Array;
+    ContentType: string;
+    ContentLength: number;
+    IfNoneMatch: "*";
+    ChecksumAlgorithm: "SHA256";
+    ChecksumSHA256: string;
+    ServerSideEncryption: "aws:kms";
+    SSEKMSKeyId: string;
+    SSEKMSEncryptionContext: string;
+    ObjectLockMode: "COMPLIANCE";
+    ObjectLockRetainUntilDate: Date;
+    Metadata: Readonly<Record<string, string>>;
+}
+export interface S3PutObjectResponse {
+    VersionId?: string;
+    ChecksumSHA256?: string;
+    ServerSideEncryption?: string;
+    SSEKMSKeyId?: string;
+    ObjectLockMode?: string;
+    ObjectLockRetainUntilDate?: Date | string;
+    RequestId?: string;
+}
+export interface S3GetObjectRequest {
+    Bucket: string;
+    Key: string;
+    VersionId: string;
+    ChecksumMode: "ENABLED";
+}
+export interface S3GetObjectResponse {
+    Body?: BinarySource;
+    VersionId?: string;
+    ContentLength?: number;
+    ChecksumSHA256?: string;
+    ServerSideEncryption?: string;
+    SSEKMSKeyId?: string;
+    ObjectLockMode?: string;
+    ObjectLockRetainUntilDate?: Date | string;
+    RequestId?: string;
+}
+export interface S3ObjectVersionSummary {
+    Key?: string;
+    VersionId?: string;
+    Size?: number;
+}
+export interface S3HeadObjectVersionResponse {
+    VersionId?: string;
+    ContentLength?: number;
+    ChecksumSHA256?: string;
+    ServerSideEncryption?: string;
+    SSEKMSKeyId?: string;
+    ObjectLockMode?: string;
+    ObjectLockRetainUntilDate?: Date | string;
+    RequestId?: string;
+    Metadata?: Readonly<Record<string, string>>;
+}
+export interface S3EvidenceClient {
+    putObject(request: S3PutObjectRequest): Promise<S3PutObjectResponse>;
+    getObject(request: S3GetObjectRequest): Promise<S3GetObjectResponse>;
+    listObjectVersions(request: {
+        Bucket: string;
+        Prefix: string;
+        MaxKeys: number;
+    }): Promise<{
+        Versions?: readonly S3ObjectVersionSummary[];
+        IsTruncated?: boolean;
+    }>;
+    headObjectVersion(request: {
+        Bucket: string;
+        Key: string;
+        VersionId: string;
+        ChecksumMode: "ENABLED";
+    }): Promise<S3HeadObjectVersionResponse>;
+}
+export interface S3EvidenceBucketControls {
+    versioning: "Enabled" | "Suspended" | "Disabled";
+    versioningSuspensionDenied: boolean;
+    objectLockEnabled: boolean;
+    defaultRetentionMode: "COMPLIANCE" | "GOVERNANCE" | "NONE";
+    defaultRetentionDays: number;
+    lifecycleMinimumRetentionDays: number;
+    accountBlockPublicAccess: boolean;
+    blockPublicAcls: boolean;
+    ignorePublicAcls: boolean;
+    blockPublicPolicy: boolean;
+    restrictPublicBuckets: boolean;
+    objectOwnership: "BucketOwnerEnforced" | "Other";
+    aclWritesDenied: boolean;
+    tlsOnlyEnforced: boolean;
+    defaultEncryption: "aws:kms" | "AES256" | "none";
+    kmsKeyId: string;
+    unexpectedKmsKeyDenied: boolean;
+    encryptionContextRequired: boolean;
+    createOnlyConditionalWritesEnforced: boolean;
+    unversionedReadsDenied: boolean;
+    crossProjectAccessDenied: boolean;
+    cloudTrailDataEventsEnabled: boolean;
+    cloudTrailKmsEventsEnabled: boolean;
+    controlChangeAlarmsEnabled: boolean;
+    runtimeDeleteDenied: boolean;
+    runtimeVersionDeleteDenied: boolean;
+    runtimeDeleteMarkersDenied: boolean;
+    runtimeBypassGovernanceDenied: boolean;
+    runtimeKmsKeyDeletionDenied: boolean;
+}
+export interface S3EvidenceBucketInspector {
+    inspect(bucket: string): Promise<S3EvidenceBucketControls>;
+}
+export interface S3EvidenceFenceAuthorityPort {
+    revalidate(fence: ReturnType<typeof parseBrokerFence>): Promise<{
+        fence: ReturnType<typeof parseBrokerFence>;
+        databaseTime: Date;
+    }>;
+}
+export interface S3KmsContextAuditPort {
+    verifyAcceptedPut(input: {
+        bucketName: string;
+        objectKey: string;
+        versionId: string;
+        operationId: string;
+        operationDigest: string;
+        fenceSha256: string;
+        kmsKeyId: string;
+        encryptionContextSha256: string;
+        expectedChecksumSha256: string;
+    }): Promise<{
+        versionId: string;
+        putProviderRequestId: string;
+        auditProviderRequestId: string;
+        encryptionContextSha256: string;
+        auditReceiptSha256: string;
+    }>;
+}
+export interface S3VersionedObjectStoreConfig {
+    bucketAlias: string;
+    bucketName: string;
+    kmsKeyId: string;
+    kmsKeyAlias: string;
+    retentionDays: number;
+    inspector: S3EvidenceBucketInspector;
+    authority: S3EvidenceFenceAuthorityPort;
+    kmsContextAudit: S3KmsContextAuditPort;
+}
+export declare class S3AmbiguousWriteError extends Error {
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class S3ConditionalWriteConflictError extends Error {
+    constructor(message?: string);
+}
+export declare class S3VersionedObjectStore implements VersionedObjectStore {
+    private readonly client;
+    readonly bucketAlias: string;
+    private readonly bucketName;
+    private readonly kmsKeyId;
+    private readonly kmsKeyAlias;
+    private readonly retentionDays;
+    private readonly inspector;
+    private readonly authority;
+    private readonly kmsContextAudit;
+    constructor(client: S3EvidenceClient, config: S3VersionedObjectStoreConfig);
+    verifyBucketControls(): Promise<string>;
+    putIfAbsent(input: PutVersionedObjectInput): Promise<VersionedObjectRef>;
+    getVersion(reference: VersionedObjectRef): Promise<{
+        bytes: Uint8Array;
+        getProviderRequestId: string;
+    }>;
+    private validatePutResponse;
+    private reconcileAmbiguousPut;
+}
+export interface AwsSdkV3S3CommandFactory {
+    putObject(input: S3PutObjectRequest): unknown;
+    getObject(input: S3GetObjectRequest): unknown;
+    listObjectVersions(input: {
+        Bucket: string;
+        Prefix: string;
+        MaxKeys: number;
+    }): unknown;
+    headObject(input: {
+        Bucket: string;
+        Key: string;
+        VersionId: string;
+        ChecksumMode: "ENABLED";
+    }): unknown;
+}
+export interface AwsSdkV3Client {
+    send(command: unknown): Promise<unknown>;
+}
+export declare class AwsSdkV3S3EvidenceClient implements S3EvidenceClient {
+    private readonly client;
+    private readonly commands;
+    constructor(client: AwsSdkV3Client, commands: AwsSdkV3S3CommandFactory);
+    putObject(request: S3PutObjectRequest): Promise<S3PutObjectResponse>;
+    getObject(request: S3GetObjectRequest): Promise<S3GetObjectResponse>;
+    listObjectVersions(request: {
+        Bucket: string;
+        Prefix: string;
+        MaxKeys: number;
+    }): Promise<{
+        Versions?: readonly S3ObjectVersionSummary[];
+        IsTruncated?: boolean;
+    }>;
+    headObjectVersion(request: {
+        Bucket: string;
+        Key: string;
+        VersionId: string;
+        ChecksumMode: "ENABLED";
+    }): Promise<S3HeadObjectVersionResponse>;
+}