@hasna/infinity 0.1.0

package/dist/types/brokers/checkpoint/seal-authority.d.ts

@@ -0,0 +1,86 @@
+import { type BrokerFence } from "../../contracts/fence";
+import type { SqlExecutor } from "../persistence/postgres";
+import { type CheckpointManifestSigningTrustHead } from "./manifest-signature";
+import type { CheckpointSealCore } from "./service";
+export interface AuthorityReceiptCryptographyPort {
+    signDigest(input: {
+        domain: "infinity.checkpoint-seal-authority/v1";
+        digest: string;
+        fence: BrokerFence;
+    }): Promise<{
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }>;
+    verifyDigest(input: {
+        domain: "infinity.checkpoint-seal-authority/v1";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface AuthorityCheckpointSealCommitReceipt {
+    readonly schemaVersion: "infinity.checkpoint-authority-commit/v1";
+    readonly checkpointId: string;
+    readonly operationId: string;
+    readonly operationDigest: string;
+    readonly sealCoreSha256: string;
+    readonly manifestSha256: string;
+    readonly fence: BrokerFence;
+    readonly authorityTransactionId: string;
+    readonly authorityEventId: string;
+    readonly committedAt: string;
+    readonly signingKeyId: string;
+    readonly signatureAlgorithm: "ecdsa-p256-sha256";
+    readonly signatureBase64: string;
+    readonly signatureSha256: string;
+}
+export interface CheckpointSealAuthorityPort {
+    commitCheckpointSeal(input: {
+        core: CheckpointSealCore;
+        coreDigest: string;
+    }): Promise<AuthorityCheckpointSealCommitReceipt>;
+}
+/**
+ * Locks the authority's durable current signing-trust head in the supplied
+ * seal transaction. Implementations must read the authority-owned persisted
+ * head (never echo caller state), compare it with expectedHead, and retain the
+ * row/advisory lock until that transaction commits. observationSequence is a
+ * durable high-water mark and must increase for every issued observation.
+ */
+export interface CheckpointManifestSigningTrustFinalizationAuthorityPort {
+    lockCurrentHead(input: {
+        transaction: SqlExecutor;
+        expectedHead: CheckpointManifestSigningTrustHead;
+    }): Promise<{
+        head: CheckpointManifestSigningTrustHead;
+        databaseTime: Date;
+    }>;
+}
+export declare class PostgresCheckpointSealAuthority implements CheckpointSealAuthorityPort {
+    private readonly dependencies;
+    constructor(dependencies: {
+        sql: SqlExecutor;
+        cryptography: AuthorityReceiptCryptographyPort;
+        signingTrustFinalizationAuthority: CheckpointManifestSigningTrustFinalizationAuthorityPort;
+    });
+    commitCheckpointSeal(input: {
+        core: CheckpointSealCore;
+        coreDigest: string;
+    }): Promise<AuthorityCheckpointSealCommitReceipt>;
+    private readExisting;
+}
+export declare class InMemoryCheckpointSealAuthority implements CheckpointSealAuthorityPort {
+    private readonly cryptography;
+    private sequence;
+    private readonly byCheckpoint;
+    private readonly checkpointByOperation;
+    constructor(cryptography: AuthorityReceiptCryptographyPort);
+    commitCheckpointSeal(input: {
+        core: CheckpointSealCore;
+        coreDigest: string;
+    }): Promise<AuthorityCheckpointSealCommitReceipt>;
+}
+export declare function verifyAuthorityCheckpointSeal(core: CheckpointSealCore, receiptInput: AuthorityCheckpointSealCommitReceipt, cryptography: AuthorityReceiptCryptographyPort): Promise<AuthorityCheckpointSealCommitReceipt>;
+export declare function parseAuthorityCheckpointSealCommitReceipt(value: unknown): AuthorityCheckpointSealCommitReceipt;

package/dist/types/brokers/checkpoint/service.d.ts

@@ -0,0 +1,198 @@
+import { type AuthenticatedFenceContext, type BrokerFence, type BrokerFenceInput } from "../../contracts/fence";
+import { type ArchiveEntry, type ArchivePolicy } from "./archive";
+import { type BinarySource } from "./bytes";
+import { type GitBundleInspectionPolicy } from "./bundle";
+import type { IdempotentExecutor } from "./idempotency";
+import { type CheckpointManifest } from "./manifest";
+import { type CheckpointManifestSignatureVerifierPort, type CheckpointManifestSigningTrustHead, type CheckpointManifestSigningTrustHeadResolverPort, type CheckpointManifestSigningTrustHeadVerifierPort } from "./manifest-signature";
+import { CHECKPOINT_MANIFEST_SIGNATURE_DOMAIN, CHECKPOINT_PROVENANCE_SIGNATURE_DOMAIN } from "./signing-message";
+import { type VersionedObjectStore, type VersionedReadbackReceipt } from "./store";
+import type { AuthorityCheckpointSealCommitReceipt, CheckpointSealAuthorityPort } from "./seal-authority";
+export interface FenceAuthorityPort {
+    readCurrentFence(operationId: string): Promise<{
+        fence: BrokerFence;
+        databaseTime: Date;
+    }>;
+}
+export interface ManifestSignerPort {
+    signManifestDigest(input: {
+        domain: typeof CHECKPOINT_MANIFEST_SIGNATURE_DOMAIN;
+        messageType: "digest";
+        digestAlgorithm: "sha256";
+        manifestDigest: string;
+        signingMessageDigest: string;
+        signingMessageDigestBytes: Uint8Array;
+        checkpointId: string;
+        fence: BrokerFence;
+    }): Promise<{
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }>;
+}
+export interface CheckpointProvenanceVerificationInput {
+    fence: BrokerFence;
+    checkpointId: string;
+    projectId: string;
+    repositoryId: string;
+    authorityActivationReceiptSha256: string;
+    routeActivationReceiptSha256: string;
+    attemptLeaseGrantSha256: string;
+    captureGrantReceiptSha256: string;
+    workspaceExportReceiptSha256: string;
+    packerReceiptSha256: string;
+    scanReceiptSha256: string;
+    runSpecSha256: string;
+    policySha256: string;
+    objectFormat: "sha1" | "sha256";
+    expectedBaseOid: string;
+    targetRef: string;
+    candidateOid: string;
+    candidateParentOid: string;
+    candidateTreeOid: string;
+    packerImageSha256: string;
+    packerIdentity: string;
+    executorIdentity: string;
+    bundleSha256: string;
+    binaryDiffSha256: string;
+    testPlanSha256: string;
+    packerEvidenceSha256: string;
+    archiveIndexSha256: string;
+}
+export interface VerifiedCheckpointProvenanceReceipt {
+    schemaVersion: "infinity.checkpoint-provenance-verification/v1";
+    fence: BrokerFence;
+    provenanceInputSha256: string;
+    authorityEventId: string;
+    verifiedAt: string;
+    signingKeyId: string;
+    signatureAlgorithm: "ecdsa-p256-sha256";
+    signatureBase64: string;
+    signatureSha256: string;
+}
+/** Trusted boundary that verifies signed capture, export, packer, and scan receipts. */
+export interface CheckpointProvenanceVerifierPort {
+    verifyCheckpointProvenance(input: CheckpointProvenanceVerificationInput): Promise<VerifiedCheckpointProvenanceReceipt>;
+}
+/** Verifies provenance authority signatures against implementation-pinned trust roots and key history. */
+export interface CheckpointProvenanceReceiptCryptographyPort {
+    verifyDigest(input: {
+        domain: typeof CHECKPOINT_PROVENANCE_SIGNATURE_DOMAIN;
+        messageType: "digest";
+        digestAlgorithm: "sha256";
+        payloadDigest: string;
+        signingMessageDigest: string;
+        signingMessageDigestBytes: Uint8Array;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface CheckpointSealRequest {
+    fence: BrokerFenceInput;
+    checkpointId: string;
+    projectId: string;
+    repositoryId: string;
+    authorityActivationReceiptSha256: string;
+    routeActivationReceiptSha256: string;
+    attemptLeaseGrantSha256: string;
+    captureGrantReceiptSha256: string;
+    workspaceExportReceiptSha256: string;
+    packerReceiptSha256: string;
+    runSpecSha256: string;
+    policySha256: string;
+    objectFormat: "sha1" | "sha256";
+    expectedBaseOid: string;
+    targetRef: string;
+    candidateOid: string;
+    candidateParentOid: string;
+    candidateTreeOid: string;
+    packerImageSha256: string;
+    packerIdentity: string;
+    executorIdentity: string;
+    dataClass: "public" | "internal_non_sensitive" | "sensitive_restricted";
+    retentionClass: "phase1_evidence" | "recovery_only_secret_quarantine";
+    scanReceiptSha256: string;
+    bundle: BinarySource;
+    declaredBundleSha256: string;
+    binaryDiff: Uint8Array;
+    declaredBinaryDiffSha256: string;
+    testPlan: Uint8Array;
+    declaredTestPlanSha256: string;
+    packerEvidence: Uint8Array;
+    declaredPackerEvidenceSha256: string;
+    archiveEntries: readonly ArchiveEntry[];
+    declaredArchiveIndexSha256: string;
+    bundlePolicy: GitBundleInspectionPolicy;
+    archivePolicy: ArchivePolicy;
+}
+export interface CheckpointSealCore {
+    readonly schemaVersion: "infinity.checkpoint-seal-receipt/v1";
+    readonly checkpointId: string;
+    readonly fence: BrokerFence;
+    readonly manifest: CheckpointManifest;
+    readonly manifestDigest: string;
+    readonly bundle: Readonly<{
+        byteLength: number;
+        sha256: string;
+        prerequisiteOid: string;
+        candidateOid: string;
+        candidateRef: "refs/infinity/candidate";
+        bundleVersion: 2 | 3;
+        packVersion: 2 | 3;
+        packObjectCount: number;
+        verificationLevel: "bounded_header_only_requires_clean_verifier";
+    }>;
+    readonly bundleObject: VersionedReadbackReceipt;
+    readonly binaryDiffObject: VersionedReadbackReceipt;
+    readonly testPlanObject: VersionedReadbackReceipt;
+    readonly packerEvidenceObject: VersionedReadbackReceipt;
+    readonly provenanceReceiptObject: VersionedReadbackReceipt;
+    readonly manifestObject: VersionedReadbackReceipt;
+    readonly signatureObject: VersionedReadbackReceipt;
+    readonly archiveIndexSha256: string;
+    readonly signatureKeyId: string;
+    readonly signatureAlgorithm: "ecdsa-p256-sha256";
+    readonly signatureSha256: string;
+    readonly signatureTrustAnchorSha256: string;
+    readonly signatureKeyHistorySha256: string;
+    readonly signatureTrustHead: CheckpointManifestSigningTrustHead;
+    readonly signatureTrustHeadSha256: string;
+    readonly signaturePostSigningTrustHead: CheckpointManifestSigningTrustHead;
+    readonly signaturePostSigningTrustHeadSha256: string;
+    readonly signatureFinalTrustHead: CheckpointManifestSigningTrustHead;
+    readonly signatureFinalTrustHeadSha256: string;
+    readonly sealedAt: string;
+}
+export interface CheckpointSealReceipt extends CheckpointSealCore {
+    readonly authorityCommit: AuthorityCheckpointSealCommitReceipt;
+}
+export declare class CheckpointBroker {
+    private readonly dependencies;
+    private currentSigningTrustHead;
+    private signingTrustHeadResolution;
+    constructor(dependencies: {
+        authority: FenceAuthorityPort;
+        store: VersionedObjectStore;
+        signer: ManifestSignerPort;
+        ledger: IdempotentExecutor<CheckpointSealReceipt>;
+        sealAuthority: CheckpointSealAuthorityPort;
+        provenanceVerifier: CheckpointProvenanceVerifierPort;
+        provenanceReceiptCryptography: CheckpointProvenanceReceiptCryptographyPort;
+        manifestSignatureVerifier: CheckpointManifestSignatureVerifierPort;
+        manifestSigningTrustHeadResolver: CheckpointManifestSigningTrustHeadResolverPort;
+        manifestSigningTrustHeadVerifier: CheckpointManifestSigningTrustHeadVerifierPort;
+    });
+    seal(input: CheckpointSealRequest, authenticated: AuthenticatedFenceContext): Promise<CheckpointSealReceipt>;
+    private resolveCurrentSigningTrustHead;
+    private revalidate;
+}
+export declare function checkpointSealOperationDigest(request: CheckpointSealRequest): string;
+export declare function checkpointSealReceiptDigest(receipt: CheckpointSealReceipt): string;
+export declare function fenceDigestInput(fence: BrokerFenceInput | BrokerFence): Record<string, unknown>;
+export declare function checkpointProvenanceInputDigest(input: CheckpointProvenanceVerificationInput): string;
+export declare function checkpointProvenanceReceiptSigningPreimage(receipt: Pick<VerifiedCheckpointProvenanceReceipt, "schemaVersion" | "fence" | "provenanceInputSha256" | "authorityEventId" | "verifiedAt">): Readonly<Record<string, unknown>>;
+export declare function checkpointProvenanceReceiptCoreDigest(receipt: Pick<VerifiedCheckpointProvenanceReceipt, "schemaVersion" | "fence" | "provenanceInputSha256" | "authorityEventId" | "verifiedAt">): string;
+export declare function checkpointProvenanceReceiptDigest(receipt: VerifiedCheckpointProvenanceReceipt): string;
+export declare function verifyCheckpointProvenanceReceiptSignature(receipt: VerifiedCheckpointProvenanceReceipt, cryptography: CheckpointProvenanceReceiptCryptographyPort): Promise<void>;
+export declare function parseVerifiedCheckpointProvenanceReceipt(value: unknown): VerifiedCheckpointProvenanceReceipt;

package/dist/types/brokers/checkpoint/signing-message.d.ts

@@ -0,0 +1,22 @@
+export declare const CHECKPOINT_MANIFEST_SIGNATURE_DOMAIN: "infinity.checkpoint-manifest-signature/v1";
+export declare const CHECKPOINT_PROVENANCE_SIGNATURE_DOMAIN: "infinity.checkpoint-provenance-verification/v1";
+export type CheckpointSignatureDomain = typeof CHECKPOINT_MANIFEST_SIGNATURE_DOMAIN | typeof CHECKPOINT_PROVENANCE_SIGNATURE_DOMAIN;
+export interface CheckpointSigningMessage {
+    readonly schema_version: "infinity.checkpoint-signing-message/v1";
+    readonly domain: CheckpointSignatureDomain;
+    readonly message_type: "digest";
+    readonly digest_algorithm: "sha256";
+    readonly payload_sha256: string;
+}
+/**
+ * Exact domain-separated message contract for checkpoint signatures.
+ *
+ * The payload digest is SHA-256 over that domain's canonical payload bytes.
+ * Cryptography adapters receive signingMessageDigest with messageType=digest and
+ * MUST decode its 32-byte hex value as a prehash (for example KMS MessageType
+ * DIGEST). They must not sign the UTF-8 digest label or hash it as a RAW message.
+ */
+export declare function checkpointSigningMessage(domain: CheckpointSignatureDomain, payloadSha256: string): CheckpointSigningMessage;
+export declare function checkpointSigningMessageCanonicalBytes(domain: CheckpointSignatureDomain, payloadSha256: string): Uint8Array;
+export declare function checkpointSigningMessageDigest(domain: CheckpointSignatureDomain, payloadSha256: string): string;
+export declare function checkpointSigningMessageDigestBytes(signingMessageSha256: string): Uint8Array;

package/dist/types/brokers/checkpoint/store.d.ts

@@ -0,0 +1,76 @@
+import { type BrokerFence, type BrokerFenceInput } from "../../contracts/fence";
+export interface PutVersionedObjectInput {
+    objectKey: string;
+    bytes: Uint8Array;
+    contentType: string;
+    sha256: string;
+    operationId: string;
+    fence: BrokerFence;
+}
+export interface VersionedObjectRef {
+    readonly fence: BrokerFence;
+    readonly bucketAlias: string;
+    readonly objectKey: string;
+    readonly versionId: string;
+    readonly byteLength: number;
+    readonly checksumSha256: string;
+    readonly kmsKeyAlias: string;
+    readonly encryptionContextSha256: string;
+    readonly putProviderRequestId: string;
+    readonly kmsContextAuditReceiptSha256: string;
+    readonly kmsContextAuditProviderRequestId: string;
+    readonly objectLockMode: "COMPLIANCE";
+    readonly objectLockRetainUntil: string;
+    readonly bucketControlsSha256: string;
+}
+export interface VersionedObjectRead {
+    readonly bytes: Uint8Array;
+    readonly getProviderRequestId: string;
+}
+export declare function parseVersionedObjectRef(value: unknown): VersionedObjectRef;
+export interface VersionedObjectStore {
+    putIfAbsent(input: PutVersionedObjectInput): Promise<VersionedObjectRef>;
+    getVersion(reference: VersionedObjectRef): Promise<VersionedObjectRead>;
+}
+export interface PutAndReadbackInput {
+    objectKey: string;
+    bytes: Uint8Array;
+    contentType: string;
+    operationId: string;
+    fence: BrokerFenceInput | BrokerFence;
+}
+export interface VersionedReadbackReceipt {
+    readonly bucketAlias: string;
+    readonly objectKey: string;
+    readonly versionId: string;
+    readonly byteLength: number;
+    readonly putSha256: string;
+    readonly readbackSha256: string;
+    readonly fence: BrokerFence;
+    readonly kmsKeyAlias: string;
+    readonly encryptionContextSha256: string;
+    readonly putProviderRequestId: string;
+    readonly kmsContextAuditReceiptSha256: string;
+    readonly kmsContextAuditProviderRequestId: string;
+    readonly getProviderRequestId: string;
+    readonly objectLockMode: "COMPLIANCE";
+    readonly objectLockRetainUntil: string;
+    readonly bucketControlsSha256: string;
+}
+export declare function putAndReadbackVerified(store: VersionedObjectStore, input: PutAndReadbackInput): Promise<VersionedReadbackReceipt>;
+export declare class InMemoryVersionedObjectStore implements VersionedObjectStore {
+    private readonly options;
+    readonly bucketAlias: string;
+    putCalls: number;
+    readCalls: number;
+    unversionedReadCalls: number;
+    readonly observedFences: BrokerFence[];
+    private sequence;
+    private readonly versions;
+    private readonly currentByKey;
+    constructor(bucketAlias: string, options?: {
+        corruptReadback?: boolean;
+    });
+    putIfAbsent(input: PutVersionedObjectInput): Promise<VersionedObjectRef>;
+    getVersion(reference: VersionedObjectRef): Promise<VersionedObjectRead>;
+}

package/dist/types/brokers/checkpoint/verifier-cleanup-authority.d.ts

@@ -0,0 +1,108 @@
+import { type BrokerFence } from "../../contracts/fence";
+import { type Int64 } from "../../core/int64";
+import type { SqlExecutor } from "../persistence/postgres";
+import { type SandboxesVerifierCleanupReceipt, type SandboxesVerifierAllocationReceiptVerifierPort, type SandboxesVerifierCleanupReceiptVerifierPort, type SandboxesVerifierQuarantineReceipt, type SandboxesVerifierQuarantineReceiptVerifierPort, type VerifierCleanupAuthorityPort, type VerifierCleanupCommitReceipt, type VerifierCleanupGrant, type VerifierCleanupGrantAuthorityPort, type VerifierCleanupFenceAuthorityPort } from "./verifier-cleanup";
+/**
+ * Final authority boundary for cleanup. Implementations must lock the
+ * authoritative full-fence row and resource-generation head using the supplied
+ * transaction, then conditionally advance the head. The lock is held until the
+ * caller's cleanup-consumption transaction commits or rolls back.
+ */
+export interface VerifierCleanupFinalizationAuthorityPort {
+    recordInitialHead?(input: {
+        transaction: SqlExecutor;
+        verificationFence: BrokerFence;
+        resourceId: string;
+        resourceLeaseId: string;
+        resourceGeneration: Int64;
+    }): Promise<void>;
+    lockAndAdvance(input: {
+        transaction: SqlExecutor;
+        verificationFence: BrokerFence;
+        cleanupFence: BrokerFence;
+        resourceId: string;
+        resourceLeaseId: string;
+        resourceGenerationBefore: Int64;
+        resourceGenerationAfter: Int64;
+    }): Promise<{
+        cleanupFence: BrokerFence;
+        databaseTime: Date;
+        resourceId: string;
+        resourceLeaseId: string;
+        resourceGenerationBefore: Int64;
+        resourceGenerationAfter: Int64;
+    }>;
+}
+/**
+ * PostgreSQL-owned cleanup fence and generation authority. The current head is
+ * seeded while the durable cleanup grant is issued, then locked and advanced
+ * in the same transaction that commits the exact signed cleanup receipt.
+ */
+export declare class PostgresVerifierCleanupFinalizationAuthority implements VerifierCleanupFinalizationAuthorityPort {
+    recordInitialHead(input: {
+        transaction: SqlExecutor;
+        verificationFence: BrokerFence;
+        resourceId: string;
+        resourceLeaseId: string;
+        resourceGeneration: Int64;
+    }): Promise<void>;
+    lockAndAdvance(input: {
+        transaction: SqlExecutor;
+        verificationFence: BrokerFence;
+        cleanupFence: BrokerFence;
+        resourceId: string;
+        resourceLeaseId: string;
+        resourceGenerationBefore: Int64;
+        resourceGenerationAfter: Int64;
+    }): Promise<{
+        cleanupFence: BrokerFence;
+        databaseTime: Date;
+        resourceId: string;
+        resourceLeaseId: string;
+        resourceGenerationBefore: Int64;
+        resourceGenerationAfter: Int64;
+    }>;
+}
+export declare class PostgresVerifierCleanupAuthority implements VerifierCleanupAuthorityPort {
+    private readonly dependencies;
+    constructor(dependencies: {
+        sql: SqlExecutor;
+        grantAuthority: VerifierCleanupGrantAuthorityPort;
+        receiptVerifier: SandboxesVerifierCleanupReceiptVerifierPort;
+        allocationReceiptVerifier: SandboxesVerifierAllocationReceiptVerifierPort;
+        quarantineReceiptVerifier: SandboxesVerifierQuarantineReceiptVerifierPort;
+        fenceAuthority: VerifierCleanupFenceAuthorityPort;
+        finalizationAuthority: VerifierCleanupFinalizationAuthorityPort;
+    });
+    authorize(input: Parameters<VerifierCleanupGrantAuthorityPort["authorize"]>[0]): Promise<VerifierCleanupGrant>;
+    consumeAndCommit(input: {
+        verificationFence: BrokerFence;
+        grant: VerifierCleanupGrant;
+        receipt: SandboxesVerifierCleanupReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<VerifierCleanupCommitReceipt>;
+    verifyCommitted(input: {
+        consumptionTransactionId: string;
+        cleanupNonce: string;
+        grant: VerifierCleanupGrant;
+        receipt: SandboxesVerifierCleanupReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+        commit: VerifierCleanupCommitReceipt;
+    }): Promise<VerifierCleanupCommitReceipt>;
+    recordQuarantine(input: {
+        receipt: SandboxesVerifierQuarantineReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+    verifyQuarantineRecorded(input: {
+        receipt: SandboxesVerifierQuarantineReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+    private normalizeConsumption;
+    private normalizeQuarantine;
+    private readAny;
+    private assertCurrentFence;
+}