@hasna/infinity 0.1.0

package/migrations/20260711_z_accounts_claim_authority_v2.sql

@@ -0,0 +1,172 @@
+-- Normalize Accounts claim authority around one serialization domain with many
+-- resource-lease children. The v1 raw-projection installer was never a trusted
+-- production input, so populated v1 state must be explicitly re-attested rather
+-- than silently upgraded into authoritative claim evidence.
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM infinity.accounts_resource_authority LIMIT 1)
+    OR EXISTS (SELECT 1 FROM infinity.accounts_serialization_domains LIMIT 1) THEN
+    RAISE EXCEPTION 'accounts v1 projection state requires explicit re-attestation before v2 migration'
+      USING ERRCODE = '55000';
+  END IF;
+END;
+$$;
+
+ALTER TABLE infinity.accounts_serialization_domains
+  DROP CONSTRAINT IF EXISTS accounts_serialization_domains_resource_lease_id_key,
+  DROP COLUMN resource_lease_id,
+  ADD COLUMN resource_id text NOT NULL,
+  ADD COLUMN resource_lifecycle_generation bigint NOT NULL
+    CHECK (resource_lifecycle_generation > 0),
+  ADD CONSTRAINT accounts_serialization_domains_resource_identity_key
+    UNIQUE (resource_id, resource_lifecycle_generation);
+
+ALTER TABLE infinity.accounts_resource_authority
+  DROP CONSTRAINT IF EXISTS accounts_resource_authority_effect_namespace_id_serialization_key_digest_key,
+  DROP CONSTRAINT IF EXISTS accounts_resource_authority_effect_namespace_id_serializati_key,
+  ADD COLUMN domain_key text NOT NULL
+    REFERENCES infinity.accounts_serialization_domains(domain_key) DEFERRABLE INITIALLY DEFERRED,
+  ADD COLUMN authority_epoch bigint NOT NULL CHECK (authority_epoch > 0),
+  ADD COLUMN provider_account_id text NOT NULL,
+  ADD COLUMN owner_ref text NOT NULL,
+  ADD COLUMN account_lane_id text NOT NULL,
+  ADD COLUMN capacity_pool_id text NOT NULL,
+  ADD COLUMN capacity_domain_ref text NOT NULL,
+  ADD COLUMN credential_family_id text NOT NULL,
+  ADD COLUMN serialization_key text NOT NULL,
+  ADD COLUMN route_epoch bigint NOT NULL CHECK (route_epoch > 0),
+  ADD COLUMN acquisition_operation_id text NOT NULL,
+  ADD COLUMN slot_eligibility_request_digest text NOT NULL
+    CHECK (slot_eligibility_request_digest ~ '^sha256:[0-9a-f]{64}$'),
+  ADD COLUMN slot_eligibility_id text NOT NULL,
+  ADD COLUMN slot_eligibility_digest text NOT NULL
+    CHECK (slot_eligibility_digest ~ '^sha256:[0-9a-f]{64}$'),
+  ADD COLUMN slot_eligibility_jcs_base64url text NOT NULL,
+  ADD COLUMN slot_eligibility_record text NOT NULL,
+  ADD COLUMN access_target_digest text NOT NULL
+    CHECK (access_target_digest ~ '^sha256:[0-9a-f]{64}$'),
+  ADD COLUMN slot_id text NOT NULL,
+  ADD COLUMN slot_index bigint NOT NULL CHECK (slot_index >= 0),
+  ADD COLUMN capacity_generation bigint NOT NULL CHECK (capacity_generation > 0),
+  ADD COLUMN deny_generation bigint NOT NULL CHECK (deny_generation >= 0),
+  ADD COLUMN credential_generation bigint NOT NULL CHECK (credential_generation >= 0),
+  ADD COLUMN max_concurrency bigint NOT NULL CHECK (max_concurrency > 0),
+  ADD COLUMN state text NOT NULL CHECK (state IN ('reserved','released','fenced')),
+  ADD COLUMN lease_projection_digest text NOT NULL
+    CHECK (lease_projection_digest ~ '^sha256:[0-9a-f]{64}$'),
+  ADD COLUMN lease_projection_jcs_base64url text NOT NULL,
+  ADD COLUMN lease_projection_record text NOT NULL,
+  ADD COLUMN updated_at timestamptz NOT NULL,
+  ADD CONSTRAINT accounts_resource_authority_domain_lease_key
+    UNIQUE (domain_key, resource_lease_id),
+  ADD CONSTRAINT accounts_resource_authority_attempt_key
+    UNIQUE (attempt_id, resource_lease_id);
+
+CREATE UNIQUE INDEX accounts_resource_authority_live_slot_key
+  ON infinity.accounts_resource_authority(account_lane_id, capacity_generation, slot_index)
+  WHERE state = 'reserved';
+
+ALTER TABLE infinity.accounts_model_call_operations
+  DROP CONSTRAINT accounts_model_call_operations_state_check,
+  DROP CONSTRAINT IF EXISTS accounts_model_call_operations_check,
+  DROP CONSTRAINT IF EXISTS accounts_model_call_operations_check1,
+  ADD CONSTRAINT accounts_model_call_operations_state_check
+    CHECK (state IN ('PREPARED','CONSUME_BOUND','INVALIDATED')),
+  ADD CONSTRAINT accounts_model_call_operations_evidence_check
+    CHECK (((state = 'PREPARED' OR state = 'INVALIDATED')
+          AND consume_receipt_digest IS NULL AND use_id IS NULL)
+      OR (state = 'CONSUME_BOUND' AND consume_receipt_digest IS NOT NULL AND use_id IS NOT NULL)),
+  ADD COLUMN resource_lease_id text NOT NULL
+    REFERENCES infinity.accounts_resource_authority(resource_lease_id)
+    DEFERRABLE INITIALLY DEFERRED;
+
+CREATE OR REPLACE FUNCTION infinity.validate_accounts_resource_authority_update() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'accounts resource authority evidence is append-only and cannot be deleted'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW.resource_lease_id IS DISTINCT FROM OLD.resource_lease_id
+    OR NEW.domain_key IS DISTINCT FROM OLD.domain_key
+    OR NEW.effect_namespace_id IS DISTINCT FROM OLD.effect_namespace_id
+    OR NEW.serialization_key_digest IS DISTINCT FROM OLD.serialization_key_digest
+    OR NEW.resource_id IS DISTINCT FROM OLD.resource_id
+    OR NEW.resource_lifecycle_generation IS DISTINCT FROM OLD.resource_lifecycle_generation
+    OR NEW.authority_epoch IS DISTINCT FROM OLD.authority_epoch
+    OR NEW.provider_account_id IS DISTINCT FROM OLD.provider_account_id
+    OR NEW.owner_ref IS DISTINCT FROM OLD.owner_ref
+    OR NEW.account_lane_id IS DISTINCT FROM OLD.account_lane_id
+    OR NEW.capacity_pool_id IS DISTINCT FROM OLD.capacity_pool_id
+    OR NEW.capacity_domain_ref IS DISTINCT FROM OLD.capacity_domain_ref
+    OR NEW.credential_family_id IS DISTINCT FROM OLD.credential_family_id
+    OR NEW.serialization_key IS DISTINCT FROM OLD.serialization_key
+    OR NEW.run_id IS DISTINCT FROM OLD.run_id
+    OR NEW.attempt_id IS DISTINCT FROM OLD.attempt_id
+    OR NEW.attempt_lease_id IS DISTINCT FROM OLD.attempt_lease_id
+    OR NEW.lease_epoch IS DISTINCT FROM OLD.lease_epoch
+    OR NEW.route_epoch IS DISTINCT FROM OLD.route_epoch
+    OR NEW.acquisition_operation_id IS DISTINCT FROM OLD.acquisition_operation_id
+    OR NEW.slot_eligibility_request_digest IS DISTINCT FROM OLD.slot_eligibility_request_digest
+    OR NEW.slot_eligibility_id IS DISTINCT FROM OLD.slot_eligibility_id
+    OR NEW.slot_eligibility_digest IS DISTINCT FROM OLD.slot_eligibility_digest
+    OR NEW.slot_eligibility_jcs_base64url IS DISTINCT FROM OLD.slot_eligibility_jcs_base64url
+    OR NEW.slot_eligibility_record IS DISTINCT FROM OLD.slot_eligibility_record
+    OR NEW.access_target_digest IS DISTINCT FROM OLD.access_target_digest
+    OR NEW.slot_id IS DISTINCT FROM OLD.slot_id
+    OR NEW.slot_index IS DISTINCT FROM OLD.slot_index
+    OR NEW.capacity_generation IS DISTINCT FROM OLD.capacity_generation
+    OR NEW.deny_generation IS DISTINCT FROM OLD.deny_generation
+    OR NEW.credential_generation IS DISTINCT FROM OLD.credential_generation
+    OR NEW.max_concurrency IS DISTINCT FROM OLD.max_concurrency
+    OR NEW.projection_digest IS DISTINCT FROM OLD.projection_digest
+    OR NEW.projection_record IS DISTINCT FROM OLD.projection_record
+    OR NEW.lease_projection_digest IS DISTINCT FROM OLD.lease_projection_digest
+    OR NEW.lease_projection_jcs_base64url IS DISTINCT FROM OLD.lease_projection_jcs_base64url
+    OR NEW.lease_projection_record IS DISTINCT FROM OLD.lease_projection_record
+    OR NEW.installed_at IS DISTINCT FROM OLD.installed_at
+    OR NEW.updated_at <= OLD.updated_at
+    OR NOT (OLD.state = 'reserved' AND NEW.state IN ('released','fenced')) THEN
+    RAISE EXCEPTION 'accounts resource authority update mutates immutable evidence or is a no-op'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION infinity.validate_accounts_operation_signer_pin_update() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'accounts signer-history pin is append-only and cannot be deleted'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW.trust_anchor_digest IS DISTINCT FROM OLD.trust_anchor_digest
+    OR NEW.head_sequence < OLD.head_sequence
+    OR (NEW.head_sequence = OLD.head_sequence AND (
+      NEW.head_digest IS DISTINCT FROM OLD.head_digest
+      OR NEW.pin_digest IS DISTINCT FROM OLD.pin_digest
+      OR NEW.pin_record IS DISTINCT FROM OLD.pin_record
+    )) THEN
+    RAISE EXCEPTION 'accounts signer-history pin update rewinds or equivocates'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER accounts_resource_authority_immutable ON infinity.accounts_resource_authority;
+CREATE TRIGGER accounts_resource_authority_update_guard
+BEFORE UPDATE OR DELETE ON infinity.accounts_resource_authority
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_accounts_resource_authority_update();
+
+DROP TRIGGER accounts_resource_authority_mutation_capture ON infinity.accounts_resource_authority;
+CREATE TRIGGER accounts_resource_authority_mutation_capture
+AFTER INSERT OR UPDATE ON infinity.accounts_resource_authority
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+
+DROP TRIGGER accounts_operation_signer_pin_update_guard ON infinity.accounts_operation_signer_pin;
+CREATE TRIGGER accounts_operation_signer_pin_update_guard
+BEFORE UPDATE OR DELETE ON infinity.accounts_operation_signer_pin
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_accounts_operation_signer_pin_update();

package/migrations/20260711_zz_sandbox_dispatch_authority_v1.sql

@@ -0,0 +1,143 @@
+-- Durable, signed, one-use sandbox dispatch authority. Authorization and
+-- consumption receipts retain exact canonical bytes and every state change is
+-- reconstructed through the external authority mutation journal.
+
+CREATE TABLE infinity.sandbox_dispatch_accounts_consume_evidence (
+  model_operation_id text PRIMARY KEY
+    REFERENCES infinity.accounts_model_call_operations(operation_id),
+  bind_operation_id text NOT NULL UNIQUE,
+  bind_idempotency_key text NOT NULL,
+  consume_receipt_digest text NOT NULL UNIQUE
+    CHECK (consume_receipt_digest ~ '^sha256:[0-9a-f]{64}$'),
+  consume_tombstone_digest text NOT NULL UNIQUE
+    CHECK (consume_tombstone_digest ~ '^sha256:[0-9a-f]{64}$'),
+  consume_use_id text NOT NULL UNIQUE
+    CHECK (consume_use_id ~ '^sha256:[0-9a-f]{64}$'),
+  consume_binding_digest text NOT NULL UNIQUE
+    CHECK (consume_binding_digest ~ '^sha256:[0-9a-f]{64}$'),
+  evidence_request_digest text NOT NULL UNIQUE
+    CHECK (evidence_request_digest ~ '^sha256:[0-9a-f]{64}$'),
+  evidence_digest text NOT NULL UNIQUE
+    CHECK (evidence_digest ~ '^sha256:[0-9a-f]{64}$'),
+  evidence_record text NOT NULL,
+  recorded_at timestamptz NOT NULL
+);
+
+CREATE TRIGGER sandbox_dispatch_accounts_consume_evidence_immutable
+BEFORE UPDATE OR DELETE ON infinity.sandbox_dispatch_accounts_consume_evidence
+FOR EACH ROW EXECUTE FUNCTION infinity.reject_immutable_mutation();
+
+CREATE TRIGGER sandbox_dispatch_accounts_consume_evidence_mutation_capture
+AFTER INSERT ON infinity.sandbox_dispatch_accounts_consume_evidence
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();
+
+CREATE TABLE infinity.sandbox_dispatch_authorizations (
+  dispatch_id text PRIMARY KEY,
+  mint_operation_id text NOT NULL UNIQUE,
+  mint_idempotency_key text NOT NULL,
+  run_id text NOT NULL REFERENCES infinity.runs(id),
+  attempt_id text NOT NULL REFERENCES infinity.attempts(id),
+  attempt_lease_id text NOT NULL,
+  lease_epoch bigint NOT NULL CHECK (lease_epoch > 0),
+  account_lane_id text NOT NULL,
+  model_operation_id text NOT NULL
+    REFERENCES infinity.accounts_model_call_operations(operation_id),
+  authority_epoch bigint NOT NULL CHECK (authority_epoch > 0),
+  audience text NOT NULL,
+  authorization_request_digest text NOT NULL UNIQUE
+    CHECK (authorization_request_digest ~ '^sha256:[0-9a-f]{64}$'),
+  authorization_digest text NOT NULL UNIQUE
+    CHECK (authorization_digest ~ '^sha256:[0-9a-f]{64}$'),
+  authorization_record text NOT NULL,
+  state text NOT NULL CHECK (state IN ('AVAILABLE','CONSUMED')),
+  consume_operation_id text UNIQUE,
+  consume_idempotency_key text,
+  consume_request_digest text UNIQUE
+    CHECK (consume_request_digest IS NULL OR consume_request_digest ~ '^sha256:[0-9a-f]{64}$'),
+  effect_claim_digest text UNIQUE
+    CHECK (effect_claim_digest IS NULL OR effect_claim_digest ~ '^sha256:[0-9a-f]{64}$'),
+  sandbox_request_digest text UNIQUE
+    CHECK (sandbox_request_digest IS NULL OR sandbox_request_digest ~ '^sha256:[0-9a-f]{64}$'),
+  dispatch_use_id text UNIQUE
+    CHECK (dispatch_use_id IS NULL OR dispatch_use_id ~ '^sha256:[0-9a-f]{64}$'),
+  consumption_receipt_digest text UNIQUE
+    CHECK (consumption_receipt_digest IS NULL OR consumption_receipt_digest ~ '^sha256:[0-9a-f]{64}$'),
+  consumption_receipt_record text,
+  issued_at timestamptz NOT NULL,
+  expires_at timestamptz NOT NULL CHECK (expires_at > issued_at),
+  consumed_at timestamptz,
+  provider_contact_expires_at timestamptz,
+  updated_at timestamptz NOT NULL CHECK (updated_at >= issued_at),
+  FOREIGN KEY (attempt_lease_id, attempt_id, lease_epoch)
+    REFERENCES infinity.attempt_lease_grants(attempt_lease_id, attempt_id, lease_epoch),
+  FOREIGN KEY (model_operation_id)
+    REFERENCES infinity.sandbox_dispatch_accounts_consume_evidence(model_operation_id),
+  CHECK (
+    (state = 'AVAILABLE'
+      AND consume_operation_id IS NULL
+      AND consume_idempotency_key IS NULL
+      AND consume_request_digest IS NULL
+      AND effect_claim_digest IS NULL
+      AND sandbox_request_digest IS NULL
+      AND dispatch_use_id IS NULL
+      AND consumption_receipt_digest IS NULL
+      AND consumption_receipt_record IS NULL
+      AND consumed_at IS NULL
+      AND provider_contact_expires_at IS NULL)
+    OR
+    (state = 'CONSUMED'
+      AND consume_operation_id IS NOT NULL
+      AND consume_idempotency_key IS NOT NULL
+      AND consume_request_digest IS NOT NULL
+      AND effect_claim_digest IS NOT NULL
+      AND sandbox_request_digest IS NOT NULL
+      AND dispatch_use_id IS NOT NULL
+      AND consumption_receipt_digest IS NOT NULL
+      AND consumption_receipt_record IS NOT NULL
+      AND consumed_at IS NOT NULL
+      AND provider_contact_expires_at IS NOT NULL
+      AND provider_contact_expires_at > consumed_at
+      AND provider_contact_expires_at <= expires_at)
+  )
+);
+
+CREATE OR REPLACE FUNCTION infinity.validate_sandbox_dispatch_authorization_update() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'sandbox dispatch authority records cannot be deleted'
+      USING ERRCODE = '23514';
+  END IF;
+  IF OLD.state IS DISTINCT FROM 'AVAILABLE'
+    OR NEW.state IS DISTINCT FROM 'CONSUMED'
+    OR NEW.dispatch_id IS DISTINCT FROM OLD.dispatch_id
+    OR NEW.mint_operation_id IS DISTINCT FROM OLD.mint_operation_id
+    OR NEW.mint_idempotency_key IS DISTINCT FROM OLD.mint_idempotency_key
+    OR NEW.run_id IS DISTINCT FROM OLD.run_id
+    OR NEW.attempt_id IS DISTINCT FROM OLD.attempt_id
+    OR NEW.attempt_lease_id IS DISTINCT FROM OLD.attempt_lease_id
+    OR NEW.lease_epoch IS DISTINCT FROM OLD.lease_epoch
+    OR NEW.account_lane_id IS DISTINCT FROM OLD.account_lane_id
+    OR NEW.model_operation_id IS DISTINCT FROM OLD.model_operation_id
+    OR NEW.authority_epoch IS DISTINCT FROM OLD.authority_epoch
+    OR NEW.audience IS DISTINCT FROM OLD.audience
+    OR NEW.authorization_request_digest IS DISTINCT FROM OLD.authorization_request_digest
+    OR NEW.authorization_digest IS DISTINCT FROM OLD.authorization_digest
+    OR NEW.authorization_record IS DISTINCT FROM OLD.authorization_record
+    OR NEW.issued_at IS DISTINCT FROM OLD.issued_at
+    OR NEW.expires_at IS DISTINCT FROM OLD.expires_at
+    OR NEW.updated_at < OLD.updated_at THEN
+    RAISE EXCEPTION 'sandbox dispatch update mutates immutable authority or is not one-use'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER sandbox_dispatch_authorization_update_guard
+BEFORE UPDATE OR DELETE ON infinity.sandbox_dispatch_authorizations
+FOR EACH ROW EXECUTE FUNCTION infinity.validate_sandbox_dispatch_authorization_update();
+
+CREATE TRIGGER sandbox_dispatch_authorization_mutation_capture
+AFTER INSERT OR UPDATE ON infinity.sandbox_dispatch_authorizations
+FOR EACH ROW EXECUTE FUNCTION infinity.capture_authority_mutation_change();

package/migrations/20260712_sandbox_dispatch_authority_v2.sql

@@ -0,0 +1,58 @@
+-- V2 makes the Sandboxes PREPARED tuple an immutable part of the signed
+-- Infinity authorization and permits exactly one dispatch authorization for
+-- each durable Accounts CONSUME_BOUND operation. Existing V1 rows cannot be
+-- reinterpreted as V2 because they never signed these fields.
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM infinity.sandbox_dispatch_authorizations) THEN
+    RAISE EXCEPTION 'sandbox dispatch V1 authorization rows cannot be reinterpreted as V2'
+      USING ERRCODE = '23514';
+  END IF;
+END;
+$$;
+
+ALTER TABLE infinity.sandbox_dispatch_authorizations
+  RENAME COLUMN sandbox_request_digest TO canonical_intent_digest;
+
+ALTER TABLE infinity.sandbox_dispatch_authorizations
+  ADD COLUMN authorized_effect_claim_digest text NOT NULL
+    UNIQUE CHECK (authorized_effect_claim_digest ~ '^sha256:[0-9a-f]{64}$'),
+  ADD COLUMN sandbox_prepare_anchor_digest text NOT NULL
+    UNIQUE CHECK (sandbox_prepare_anchor_digest ~ '^sha256:[0-9a-f]{64}$'),
+  ADD CONSTRAINT sandbox_dispatch_model_operation_unique UNIQUE (model_operation_id);
+
+CREATE OR REPLACE FUNCTION infinity.validate_sandbox_dispatch_authorization_update() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'sandbox dispatch authority records cannot be deleted'
+      USING ERRCODE = '23514';
+  END IF;
+  IF OLD.state IS DISTINCT FROM 'AVAILABLE'
+    OR NEW.state IS DISTINCT FROM 'CONSUMED'
+    OR NEW.dispatch_id IS DISTINCT FROM OLD.dispatch_id
+    OR NEW.mint_operation_id IS DISTINCT FROM OLD.mint_operation_id
+    OR NEW.mint_idempotency_key IS DISTINCT FROM OLD.mint_idempotency_key
+    OR NEW.run_id IS DISTINCT FROM OLD.run_id
+    OR NEW.attempt_id IS DISTINCT FROM OLD.attempt_id
+    OR NEW.attempt_lease_id IS DISTINCT FROM OLD.attempt_lease_id
+    OR NEW.lease_epoch IS DISTINCT FROM OLD.lease_epoch
+    OR NEW.account_lane_id IS DISTINCT FROM OLD.account_lane_id
+    OR NEW.model_operation_id IS DISTINCT FROM OLD.model_operation_id
+    OR NEW.authority_epoch IS DISTINCT FROM OLD.authority_epoch
+    OR NEW.audience IS DISTINCT FROM OLD.audience
+    OR NEW.authorized_effect_claim_digest IS DISTINCT FROM OLD.authorized_effect_claim_digest
+    OR NEW.sandbox_prepare_anchor_digest IS DISTINCT FROM OLD.sandbox_prepare_anchor_digest
+    OR NEW.authorization_request_digest IS DISTINCT FROM OLD.authorization_request_digest
+    OR NEW.authorization_digest IS DISTINCT FROM OLD.authorization_digest
+    OR NEW.authorization_record IS DISTINCT FROM OLD.authorization_record
+    OR NEW.issued_at IS DISTINCT FROM OLD.issued_at
+    OR NEW.expires_at IS DISTINCT FROM OLD.expires_at
+    OR NEW.updated_at < OLD.updated_at THEN
+    RAISE EXCEPTION 'sandbox dispatch update mutates immutable V2 authority or is not one-use'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;

package/migrations/external-journal/0001_external_authority_mutation_journal.sql

@@ -0,0 +1,175 @@
+CREATE SCHEMA IF NOT EXISTS infinity_external_journal;
+
+REVOKE ALL ON SCHEMA infinity_external_journal FROM PUBLIC;
+
+CREATE TABLE infinity_external_journal.store (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  protection_schema_version text NOT NULL,
+  configured_journal_id text NOT NULL,
+  journal_id text NOT NULL,
+  cluster_system_identifier text NOT NULL CHECK (cluster_system_identifier ~ '^[0-9]+$'),
+  database_name text NOT NULL,
+  restore_domain_id text NOT NULL,
+  encrypted_at_rest boolean NOT NULL CHECK (encrypted_at_rest),
+  durability text NOT NULL CHECK (durability = 'durable'),
+  signer_principal text NOT NULL,
+  signing_key_id text NOT NULL,
+  verification_key_digest text NOT NULL CHECK (verification_key_digest ~ '^sha256:[0-9a-f]{64}$'),
+  protection_digest text NOT NULL CHECK (protection_digest ~ '^sha256:[0-9a-f]{64}$'),
+  protection_record text NOT NULL,
+  head_sequence bigint NOT NULL DEFAULT 0 CHECK (head_sequence >= 0),
+  head_frontier_digest text CHECK (head_frontier_digest IS NULL OR head_frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  CHECK ((head_sequence = 0 AND head_frontier_digest IS NULL)
+    OR (head_sequence > 0 AND head_frontier_digest IS NOT NULL))
+);
+
+CREATE TABLE infinity_external_journal.receipts (
+  journal_sequence bigint PRIMARY KEY CHECK (journal_sequence > 0),
+  prior_frontier_digest text CHECK (prior_frontier_digest IS NULL OR prior_frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  record_digest text NOT NULL CHECK (record_digest ~ '^sha256:[0-9a-f]{64}$'),
+  frontier_digest text NOT NULL UNIQUE CHECK (frontier_digest ~ '^sha256:[0-9a-f]{64}$'),
+  envelope_record text NOT NULL,
+  envelope_digest text NOT NULL CHECK (envelope_digest ~ '^sha256:[0-9a-f]{64}$'),
+  acknowledgement_digest text NOT NULL CHECK (acknowledgement_digest ~ '^sha256:[0-9a-f]{64}$'),
+  receipt_digest text NOT NULL CHECK (receipt_digest ~ '^sha256:[0-9a-f]{64}$'),
+  receipt_record text NOT NULL
+);
+
+CREATE FUNCTION infinity_external_journal.reject_immutable_mutation()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  RAISE EXCEPTION 'external authority mutation journal rows are immutable';
+END;
+$$;
+
+CREATE FUNCTION infinity_external_journal.guard_receipt_insert()
+RETURNS trigger LANGUAGE plpgsql AS $$
+DECLARE
+  current_head bigint;
+  current_frontier text;
+BEGIN
+  SELECT head_sequence, head_frontier_digest
+    INTO current_head, current_frontier
+    FROM infinity_external_journal.store
+    WHERE singleton
+    FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'external authority mutation journal protection is not initialized';
+  END IF;
+  IF NEW.journal_sequence <> current_head + 1 THEN
+    RAISE EXCEPTION 'external authority mutation journal insert is not contiguous';
+  END IF;
+  IF NEW.prior_frontier_digest IS DISTINCT FROM current_frontier THEN
+    RAISE EXCEPTION 'external authority mutation journal predecessor differs';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE FUNCTION infinity_external_journal.guard_store_update()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF ROW(
+      NEW.protection_schema_version, NEW.configured_journal_id, NEW.journal_id,
+      NEW.cluster_system_identifier, NEW.database_name, NEW.restore_domain_id,
+      NEW.encrypted_at_rest, NEW.durability, NEW.signer_principal,
+      NEW.signing_key_id, NEW.verification_key_digest,
+      NEW.protection_digest, NEW.protection_record
+    ) IS DISTINCT FROM ROW(
+      OLD.protection_schema_version, OLD.configured_journal_id, OLD.journal_id,
+      OLD.cluster_system_identifier, OLD.database_name, OLD.restore_domain_id,
+      OLD.encrypted_at_rest, OLD.durability, OLD.signer_principal,
+      OLD.signing_key_id, OLD.verification_key_digest,
+      OLD.protection_digest, OLD.protection_record
+    ) THEN
+    RAISE EXCEPTION 'external authority mutation journal protection is immutable';
+  END IF;
+  IF NEW.head_sequence <> OLD.head_sequence + 1 THEN
+    RAISE EXCEPTION 'external authority mutation journal head may only advance by one';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM infinity_external_journal.receipts
+    WHERE journal_sequence = NEW.head_sequence
+      AND frontier_digest = NEW.head_frontier_digest
+  ) THEN
+    RAISE EXCEPTION 'external authority mutation journal head is not backed by a receipt';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE FUNCTION infinity_external_journal.require_receipt_head_commit()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM infinity_external_journal.store
+    WHERE singleton
+      AND head_sequence = NEW.journal_sequence
+      AND head_frontier_digest = NEW.frontier_digest
+  ) THEN
+    RAISE EXCEPTION 'external authority mutation journal receipt was not atomically committed with its head';
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+CREATE FUNCTION infinity_external_journal.append_receipt(
+  p_journal_sequence bigint,
+  p_prior_frontier_digest text,
+  p_record_digest text,
+  p_frontier_digest text,
+  p_envelope_record text,
+  p_envelope_digest text,
+  p_acknowledgement_digest text,
+  p_receipt_digest text,
+  p_receipt_record text
+)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+BEGIN
+  INSERT INTO infinity_external_journal.receipts
+    (journal_sequence, prior_frontier_digest, record_digest, frontier_digest,
+     envelope_record, envelope_digest, acknowledgement_digest, receipt_digest,
+     receipt_record)
+  VALUES
+    (p_journal_sequence, p_prior_frontier_digest, p_record_digest, p_frontier_digest,
+     p_envelope_record, p_envelope_digest, p_acknowledgement_digest, p_receipt_digest,
+     p_receipt_record);
+
+  UPDATE infinity_external_journal.store
+  SET head_sequence = p_journal_sequence,
+    head_frontier_digest = p_frontier_digest
+  WHERE singleton;
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'external authority mutation journal protection is not initialized';
+  END IF;
+END;
+$$;
+
+CREATE TRIGGER receipts_insert_guard
+BEFORE INSERT ON infinity_external_journal.receipts
+FOR EACH ROW EXECUTE FUNCTION infinity_external_journal.guard_receipt_insert();
+
+CREATE TRIGGER receipts_immutable
+BEFORE UPDATE OR DELETE ON infinity_external_journal.receipts
+FOR EACH ROW EXECUTE FUNCTION infinity_external_journal.reject_immutable_mutation();
+
+CREATE CONSTRAINT TRIGGER receipts_require_head_commit
+AFTER INSERT ON infinity_external_journal.receipts
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW EXECUTE FUNCTION infinity_external_journal.require_receipt_head_commit();
+
+CREATE TRIGGER store_update_guard
+BEFORE UPDATE ON infinity_external_journal.store
+FOR EACH ROW EXECUTE FUNCTION infinity_external_journal.guard_store_update();
+
+CREATE TRIGGER store_delete_guard
+BEFORE DELETE ON infinity_external_journal.store
+FOR EACH ROW EXECUTE FUNCTION infinity_external_journal.reject_immutable_mutation();
+
+REVOKE ALL ON ALL TABLES IN SCHEMA infinity_external_journal FROM PUBLIC;
+REVOKE ALL ON ALL FUNCTIONS IN SCHEMA infinity_external_journal FROM PUBLIC;

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@hasna/infinity",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Infinity V1 reference Run Authority",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hasna/infinity.git"
+  },
+  "main": "dist/index.js",
+  "types": "dist/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "infinity": "dist/cli.js",
+    "infinity-api": "dist/http-api.js",
+    "infinity-self-hosted": "dist/self-hosted.js",
+    "infinity-self-hosted-migrate": "dist/self-hosted-migrate.js",
+    "infinity-migrate": "dist/migrate.js"
+  },
+  "files": [
+    "dist",
+    "evidence",
+    "migrations",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "bun test",
+    "test:golden:packages": "bun test ./tests/golden-package-loader.integration.ts ./tests/golden-source-pins.integration.ts",
+    "test:golden:accounts-pg": "bun test ./tests/golden-accounts-postgres.integration.ts",
+    "typecheck": "tsc --noEmit",
+    "build": "bun scripts/build.ts",
+    "clean": "rm -rf dist",
+    "pack": "bun pm pack",
+    "audit": "bun audit",
+    "migrate": "bun src/persistence/migrate-main.ts"
+  },
+  "devDependencies": {
+    "@types/bun": "1.3.6",
+    "typescript": "5.9.3"
+  }
+}