@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/keyingProjectionVerification/documentPurgePrincipalEvidence.js

@@ -0,0 +1,104 @@
+import { KeyingVerificationError, principalPolicyMatchesReference, verifyDocumentPurgeEvent, } from "../../internal/crypto/index.js";
+import { verifyStandaloneAccessEventBundle } from "./bundleVerification.js";
+import { verifyPurgeDocumentManifest } from "./documentPurgeDocumentChainVerification.js";
+function principalIdentity(input) {
+    return `${input.principalType}:${input.principalId}`;
+}
+function collectEvidenceContainerManifests(input) {
+    const selected = new Map();
+    const pending = [...input.roots];
+    while (pending.length > 0) {
+        const manifest = pending.shift();
+        if (!manifest || selected.has(manifest.manifestHash))
+            continue;
+        selected.set(manifest.manifestHash, manifest);
+        for (const dependencyHash of [
+            manifest.manifest.previousManifestHash,
+            manifest.state.parentManifestHash,
+        ]) {
+            if (!dependencyHash)
+                continue;
+            const dependency = input.verifiedByHash.get(dependencyHash);
+            if (dependency)
+                pending.push(dependency);
+        }
+    }
+    return [...selected.values()];
+}
+function requireExactPurgePrincipalEvidence(input) {
+    const pendingReferences = input.verifiedContainerManifests.flatMap((manifest) => manifest.state.referencedPrincipalHeads);
+    const requiredByPrincipal = new Map();
+    while (pendingReferences.length > 0) {
+        const reference = pendingReferences.shift();
+        if (!reference)
+            break;
+        const policy = input.authorizationEvidence.find((candidate) => principalPolicyMatchesReference({ policy: candidate, reference }));
+        if (!policy) {
+            throw new KeyingVerificationError("missing_dependency", "Document purge proof omits referenced principal policy evidence");
+        }
+        const identity = principalIdentity(policy);
+        if (requiredByPrincipal.has(identity))
+            continue;
+        requiredByPrincipal.set(identity, policy);
+        pendingReferences.push(...(policy.history ?? []).flatMap((entry) => entry.state.externalAuthority ? [entry.state.externalAuthority] : []));
+    }
+    if (requiredByPrincipal.size !== input.authorizationEvidence.length) {
+        throw new KeyingVerificationError("invalid_shape", "Document purge proof includes unrelated principal policy evidence");
+    }
+    return input.authorizationEvidence.filter((policy) => requiredByPrincipal.has(principalIdentity(policy)));
+}
+async function authenticateDocumentPurgeEvent(input) {
+    const event = await verifyStandaloneAccessEventBundle({
+        bundle: input.purgeEvent,
+        label: "Document purge event",
+        resolveUserKey: input.resolveUserKey,
+    });
+    const evidenceContainerManifests = collectEvidenceContainerManifests({
+        roots: input.rootContainerManifests,
+        verifiedByHash: input.verifiedContainerManifests,
+    });
+    const principalPolicies = requireExactPurgePrincipalEvidence({
+        authorizationEvidence: input.authorizationEvidence,
+        verifiedContainerManifests: evidenceContainerManifests,
+    });
+    const verified = await verifyDocumentPurgeEvent({
+        authorizingContainerPath: input.authorizingContainerPath,
+        documentManifest: input.documentManifest,
+        event,
+        expectedDocumentId: input.expectedDocumentId,
+        principalPolicies,
+    });
+    if (!verified.ok)
+        throw verified.error;
+    return { principalPolicies, purgeEventHash: verified.value.eventHash };
+}
+export async function authenticateDocumentPurgeArtifacts(input) {
+    const usedContainerManifests = new Map();
+    const documentManifest = await verifyPurgeDocumentManifest({
+        authorizationEvidence: input.authorizationEvidence,
+        checkpointContext: input.checkpointContext,
+        containerPathByManifestHash: input.containerPathByManifestHash,
+        enforceLocalCheckpoints: input.enforceLocalCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        proof: input.proof,
+        resolveUserKey: input.resolveUserKey,
+        usedContainerManifests,
+    });
+    return {
+        documentManifest,
+        ...(await authenticateDocumentPurgeEvent({
+            authorizationEvidence: input.authorizationEvidence,
+            authorizingContainerPath: input.authorizingContainerPath,
+            documentManifest,
+            expectedDocumentId: input.expectedDocumentId,
+            purgeEvent: input.proof.purgeEvent,
+            resolveUserKey: input.resolveUserKey,
+            rootContainerManifests: [
+                ...input.authorizingContainerPath,
+                ...usedContainerManifests.values(),
+            ],
+            verifiedContainerManifests: input.verifiedContainerManifests,
+        })),
+    };
+}
+//# sourceMappingURL=documentPurgePrincipalEvidence.js.map

package/data/keyingProjectionVerification/documentPurgePrincipalEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentPurgePrincipalEvidence.js","sourceRoot":"","sources":["documentPurgePrincipalEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,EACvB,+BAA+B,EAM/B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AAEzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAGvF,SAAS,iBAAiB,CAAC,KAG1B;IACC,OAAO,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,iCAAiC,CAAC,KAG1C;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2C,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,SAAS;QAC/D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9C,KAAK,MAAM,cAAc,IAAI;YAC3B,QAAQ,CAAC,QAAQ,CAAC,oBAAoB;YACtC,QAAQ,CAAC,KAAK,CAAC,kBAAkB;SAClC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc;gBAAE,SAAS;YAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5D,IAAI,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kCAAkC,CAEzC,KAGD;IACC,MAAM,iBAAiB,GACrB,KAAK,CAAC,0BAA0B,CAAC,OAAO,CACtC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD,CAAC;IACJ,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEvD,OAAO,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,MAAM;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5D,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAChD,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,iBAAiB,CAAC,IAAI,CACpB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACrE,CACF,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,IAAI,KAAK,KAAK,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACnD,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAc7C;IAIC,MAAM,KAAK,GAAG,MAAM,iCAAiC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,UAAU;QACxB,KAAK,EAAE,sBAAsB;QAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;QACnE,KAAK,EAAE,KAAK,CAAC,sBAAsB;QACnC,cAAc,EAAE,KAAK,CAAC,0BAA0B;KACjD,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;QAC3D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,0BAA0B,EAAE,0BAA0B;KACvD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,KAAK;QACL,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAiBxD;IACC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAGnC,CAAC;IACJ,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CAAC;QACzD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB;KACvB,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB;QAChB,GAAG,CAAC,MAAM,8BAA8B,CAAC;YACvC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,gBAAgB;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YAClC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,sBAAsB,EAAE;gBACtB,GAAG,KAAK,CAAC,wBAAwB;gBACjC,GAAG,sBAAsB,CAAC,MAAM,EAAE;aACnC;YACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type ReferencedPrincipalHead,\n  type VerifiedContainerAccessManifest,\n  type VerifiedDocumentLinkSetManifest,\n  type VerifiedDocumentLinkSetSnapshot,\n  type VerifiedPrincipalPolicySnapshot,\n  verifyDocumentPurgeEvent,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeProofResponse } from \"@tearleads/validators/response\";\nimport { verifyStandaloneAccessEventBundle } from \"./bundleVerification\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { verifyPurgeDocumentManifest } from \"./documentPurgeDocumentChainVerification\";\nimport type { PrincipalPolicyCache, ProjectionUserKeyResolver } from \"./types\";\n\nfunction principalIdentity(input: {\n  readonly principalId: string;\n  readonly principalType: string;\n}): string {\n  return `${input.principalType}:${input.principalId}`;\n}\n\nfunction collectEvidenceContainerManifests(input: {\n  readonly roots: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): VerifiedContainerAccessManifest[] {\n  const selected = new Map<string, VerifiedContainerAccessManifest>();\n  const pending = [...input.roots];\n  while (pending.length > 0) {\n    const manifest = pending.shift();\n    if (!manifest || selected.has(manifest.manifestHash)) continue;\n    selected.set(manifest.manifestHash, manifest);\n    for (const dependencyHash of [\n      manifest.manifest.previousManifestHash,\n      manifest.state.parentManifestHash,\n    ]) {\n      if (!dependencyHash) continue;\n      const dependency = input.verifiedByHash.get(dependencyHash);\n      if (dependency) pending.push(dependency);\n    }\n  }\n  return [...selected.values()];\n}\n\nfunction requireExactPurgePrincipalEvidence<\n  TPolicy extends AnyVerifiedPrincipalPolicy,\n>(input: {\n  readonly authorizationEvidence: readonly TPolicy[];\n  readonly verifiedContainerManifests: readonly VerifiedContainerAccessManifest[];\n}): TPolicy[] {\n  const pendingReferences: ReferencedPrincipalHead[] =\n    input.verifiedContainerManifests.flatMap(\n      (manifest) => manifest.state.referencedPrincipalHeads,\n    );\n  const requiredByPrincipal = new Map<string, TPolicy>();\n\n  while (pendingReferences.length > 0) {\n    const reference = pendingReferences.shift();\n    if (!reference) break;\n    const policy = input.authorizationEvidence.find((candidate) =>\n      principalPolicyMatchesReference({ policy: candidate, reference }),\n    );\n    if (!policy) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Document purge proof omits referenced principal policy evidence\",\n      );\n    }\n    const identity = principalIdentity(policy);\n    if (requiredByPrincipal.has(identity)) continue;\n    requiredByPrincipal.set(identity, policy);\n    pendingReferences.push(\n      ...(policy.history ?? []).flatMap((entry) =>\n        entry.state.externalAuthority ? [entry.state.externalAuthority] : [],\n      ),\n    );\n  }\n\n  if (requiredByPrincipal.size !== input.authorizationEvidence.length) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Document purge proof includes unrelated principal policy evidence\",\n    );\n  }\n  return input.authorizationEvidence.filter((policy) =>\n    requiredByPrincipal.has(principalIdentity(policy)),\n  );\n}\n\nasync function authenticateDocumentPurgeEvent(input: {\n  readonly authorizationEvidence: readonly VerifiedPrincipalPolicySnapshot[];\n  readonly authorizingContainerPath: readonly VerifiedContainerAccessManifest[];\n  readonly documentManifest:\n    | VerifiedDocumentLinkSetManifest\n    | VerifiedDocumentLinkSetSnapshot;\n  readonly expectedDocumentId: string;\n  readonly purgeEvent: DocumentPurgeProofResponse[\"purgeEvent\"];\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly rootContainerManifests: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedContainerManifests: ReadonlyMap<\n    string,\n    VerifiedContainerAccessManifest\n  >;\n}): Promise<{\n  readonly principalPolicies: VerifiedPrincipalPolicySnapshot[];\n  readonly purgeEventHash: string;\n}> {\n  const event = await verifyStandaloneAccessEventBundle({\n    bundle: input.purgeEvent,\n    label: \"Document purge event\",\n    resolveUserKey: input.resolveUserKey,\n  });\n  const evidenceContainerManifests = collectEvidenceContainerManifests({\n    roots: input.rootContainerManifests,\n    verifiedByHash: input.verifiedContainerManifests,\n  });\n  const principalPolicies = requireExactPurgePrincipalEvidence({\n    authorizationEvidence: input.authorizationEvidence,\n    verifiedContainerManifests: evidenceContainerManifests,\n  });\n  const verified = await verifyDocumentPurgeEvent({\n    authorizingContainerPath: input.authorizingContainerPath,\n    documentManifest: input.documentManifest,\n    event,\n    expectedDocumentId: input.expectedDocumentId,\n    principalPolicies,\n  });\n  if (!verified.ok) throw verified.error;\n  return { principalPolicies, purgeEventHash: verified.value.eventHash };\n}\n\nexport async function authenticateDocumentPurgeArtifacts(input: {\n  readonly authorizationEvidence: readonly VerifiedPrincipalPolicySnapshot[];\n  readonly authorizingContainerPath: readonly VerifiedContainerAccessManifest[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly enforceLocalCheckpoints: boolean;\n  readonly expectedDocumentId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly proof: DocumentPurgeProofResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedContainerManifests: ReadonlyMap<\n    string,\n    VerifiedContainerAccessManifest\n  >;\n}) {\n  const usedContainerManifests = new Map<\n    string,\n    VerifiedContainerAccessManifest\n  >();\n  const documentManifest = await verifyPurgeDocumentManifest({\n    authorizationEvidence: input.authorizationEvidence,\n    checkpointContext: input.checkpointContext,\n    containerPathByManifestHash: input.containerPathByManifestHash,\n    enforceLocalCheckpoints: input.enforceLocalCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    proof: input.proof,\n    resolveUserKey: input.resolveUserKey,\n    usedContainerManifests,\n  });\n  return {\n    documentManifest,\n    ...(await authenticateDocumentPurgeEvent({\n      authorizationEvidence: input.authorizationEvidence,\n      authorizingContainerPath: input.authorizingContainerPath,\n      documentManifest,\n      expectedDocumentId: input.expectedDocumentId,\n      purgeEvent: input.proof.purgeEvent,\n      resolveUserKey: input.resolveUserKey,\n      rootContainerManifests: [\n        ...input.authorizingContainerPath,\n        ...usedContainerManifests.values(),\n      ],\n      verifiedContainerManifests: input.verifiedContainerManifests,\n    })),\n  };\n}\n"]}

package/data/keyingProjectionVerification/documentPurgeProofVerification.d.ts

@@ -0,0 +1,32 @@
+import { type AccessManifestCheckpoint, type AnyVerifiedPrincipalPolicy, type VerifiedContainerAccessManifest } from "../../internal/crypto/index.js";
+import type { DocumentPurgeProofResponse } from "../../internal/validators/response/index.js";
+import type { ExecSql } from "../sqlite/sqlSchema.js";
+import { createProjectionCheckpointContext } from "./checkpointContext.js";
+import type { PrincipalPolicyCache, ProjectionUserKeyResolver } from "./types.js";
+interface VerifyDocumentPurgeProofInput {
+    readonly execSql: ExecSql;
+    readonly expectedDocumentId: string;
+    readonly expectedOrganizationId: string;
+    readonly principalPolicyCache?: PrincipalPolicyCache | undefined;
+    readonly proof: DocumentPurgeProofResponse;
+    readonly resolveUserKey: ProjectionUserKeyResolver;
+}
+interface VerifiedDocumentPurgeProofCommit {
+    readonly commitCheckpoints: (execSql?: ExecSql) => Promise<void>;
+    readonly documentCheckpoint: AccessManifestCheckpoint;
+}
+type PurgeContainerEvidence = Pick<DocumentPurgeProofResponse, "authorizingContainerPath" | "documentContainerManifestHistory" | "documentManifestContainerPaths">;
+export declare function verifyPurgeContainerPaths(input: {
+    readonly authorizationEvidence: readonly AnyVerifiedPrincipalPolicy[];
+    readonly checkpointContext: ReturnType<typeof createProjectionCheckpointContext>;
+    readonly principalPolicyCache: PrincipalPolicyCache;
+    readonly proof: PurgeContainerEvidence;
+    readonly resolveUserKey: ProjectionUserKeyResolver;
+}): Promise<{
+    authorizingContainerPath: VerifiedContainerAccessManifest[];
+    containerPathByManifestHash: Map<string, readonly VerifiedContainerAccessManifest[]>;
+    verifiedContainerManifests: Map<string, VerifiedContainerAccessManifest>;
+}>;
+export declare function verifyDocumentPurgeProofBaseline(input: VerifyDocumentPurgeProofInput): Promise<Pick<VerifiedDocumentPurgeProofCommit, "documentCheckpoint">>;
+export declare function verifyDocumentPurgeProof(input: VerifyDocumentPurgeProofInput): Promise<VerifiedDocumentPurgeProofCommit>;
+export {};

package/data/keyingProjectionVerification/documentPurgeProofVerification.js

@@ -0,0 +1,164 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { isDocumentPurgeProofResponse } from "../../internal/validators/response/index.js";
+import { addBundleByHash } from "./bundleVerification.js";
+import { createProjectionCheckpointContext, observeAccessManifestCheckpoints, } from "./checkpointContext.js";
+import { verifyContainerManifestPath } from "./containerPathVerification.js";
+import { verifiedContainerManifestsForBundles } from "./containerProjectionVerification.js";
+import { commitDocumentPurgeCheckpoints, validateDocumentPurgeCheckpoints, } from "./documentPurgeCheckpointCurrency.js";
+import { authenticateDocumentPurgeArtifacts } from "./documentPurgePrincipalEvidence.js";
+import { verifyPrincipalPolicySnapshots } from "./principalPolicySnapshotVerification.js";
+function collectContainerBundles(proof) {
+    const bundlesByHash = new Map();
+    for (const [index, bundle] of proof.authorizingContainerPath.entries()) {
+        addBundleByHash(bundlesByHash, bundle, `Document purge authorizing container path[${index}]`);
+    }
+    for (const [index, bundle,] of proof.documentContainerManifestHistory.entries()) {
+        addBundleByHash(bundlesByHash, bundle, `Document purge container history[${index}]`);
+    }
+    for (const [pathIndex, path,] of proof.documentManifestContainerPaths.entries()) {
+        for (const [bundleIndex, bundle] of path.entries()) {
+            addBundleByHash(bundlesByHash, bundle, `Document purge dependency path[${pathIndex}][${bundleIndex}]`);
+        }
+    }
+    return bundlesByHash;
+}
+export async function verifyPurgeContainerPaths(input) {
+    const bundlesByHash = collectContainerBundles(input.proof);
+    const verifiedByHash = new Map();
+    const authorizingContainerPath = await verifyContainerManifestPath({
+        servedAsCurrent: false,
+        authorizationMembership: "referenced",
+        authorizationEvidence: input.authorizationEvidence,
+        bundlesByHash,
+        checkpointContext: input.checkpointContext,
+        // Authenticate the signed path here; the complete purge's local currency
+        // is checked after its event and document evidence have authenticated.
+        enforceLocalCheckpoints: false,
+        label: "Document purge authorizing container path",
+        path: input.proof.authorizingContainerPath,
+        principalPolicyCache: input.principalPolicyCache,
+        resolveUserKey: input.resolveUserKey,
+        requireAuthorizationEvidence: true,
+        verifiedByHash,
+    });
+    const authorizingLeaf = authorizingContainerPath.at(-1);
+    if (!authorizingLeaf) {
+        throw new KeyingVerificationError("missing_dependency", "Document purge authorizing container path is empty");
+    }
+    const containerPathByManifestHash = new Map();
+    containerPathByManifestHash.set(authorizingLeaf.manifestHash, [
+        ...authorizingContainerPath,
+    ]);
+    for (const [index, path,] of input.proof.documentManifestContainerPaths.entries()) {
+        const verifiedPath = await verifyContainerManifestPath({
+            servedAsCurrent: false,
+            authorizationMembership: "referenced",
+            authorizationEvidence: input.authorizationEvidence,
+            bundlesByHash,
+            checkpointContext: input.checkpointContext,
+            enforceLocalCheckpoints: false,
+            label: `Document purge dependency path[${index}]`,
+            path,
+            principalPolicyCache: input.principalPolicyCache,
+            resolveUserKey: input.resolveUserKey,
+            requireAuthorizationEvidence: true,
+            verifiedByHash,
+        });
+        const leaf = verifiedPath.at(-1);
+        if (leaf && !containerPathByManifestHash.has(leaf.manifestHash)) {
+            containerPathByManifestHash.set(leaf.manifestHash, verifiedPath);
+        }
+    }
+    // Purge verification consumes event citations only, never content-write
+    // headers, so historical evidence needs no pinned target-path grouping.
+    for (const [hash, manifest] of verifiedByHash) {
+        if (!containerPathByManifestHash.has(hash)) {
+            containerPathByManifestHash.set(hash, [manifest]);
+        }
+    }
+    observeAccessManifestCheckpoints(input.checkpointContext, {
+        verifiedHeads: authorizingContainerPath,
+        verifiedManifests: verifiedContainerManifestsForBundles(bundlesByHash, verifiedByHash),
+    });
+    return {
+        authorizingContainerPath,
+        containerPathByManifestHash,
+        verifiedContainerManifests: new Map(verifiedByHash),
+    };
+}
+function requirePurgeProofShape(proof) {
+    if (!isDocumentPurgeProofResponse(proof)) {
+        throw new KeyingVerificationError("invalid_shape", "Document purge proof has an invalid shape");
+    }
+}
+async function verifyDocumentPurgeProofWithMode(input, enforceLocalCheckpoints) {
+    requirePurgeProofShape(input.proof);
+    if (input.proof.documentId !== input.expectedDocumentId ||
+        input.proof.documentManifest.manifestHash.length === 0) {
+        throw new KeyingVerificationError("object_mismatch", "Document purge proof targets the wrong document");
+    }
+    const checkpointContext = createProjectionCheckpointContext({
+        execSql: input.execSql,
+        organizationId: input.expectedOrganizationId,
+    });
+    const principalPolicyCache = input.principalPolicyCache ?? new Map();
+    const authorizationEvidence = await verifyPrincipalPolicySnapshots({
+        resolveUserKey: input.resolveUserKey,
+        snapshots: input.proof.principalPolicySnapshots,
+    });
+    const { authorizingContainerPath, containerPathByManifestHash, verifiedContainerManifests, } = await verifyPurgeContainerPaths({
+        authorizationEvidence,
+        checkpointContext,
+        principalPolicyCache,
+        proof: input.proof,
+        resolveUserKey: input.resolveUserKey,
+    });
+    const { documentManifest, principalPolicies, purgeEventHash } = await authenticateDocumentPurgeArtifacts({
+        authorizationEvidence,
+        authorizingContainerPath,
+        checkpointContext,
+        containerPathByManifestHash,
+        enforceLocalCheckpoints,
+        expectedDocumentId: input.expectedDocumentId,
+        principalPolicyCache,
+        proof: input.proof,
+        resolveUserKey: input.resolveUserKey,
+        verifiedContainerManifests,
+    });
+    if (documentManifest.state.organizationId !== input.expectedOrganizationId) {
+        throw new KeyingVerificationError("object_mismatch", "Document purge proof belongs to another organization");
+    }
+    if (enforceLocalCheckpoints) {
+        await validateDocumentPurgeCheckpoints({
+            context: checkpointContext,
+            execSql: input.execSql,
+            principalPolicies,
+        });
+    }
+    const documentPurgeCheckpoint = {
+        documentId: input.expectedDocumentId,
+        documentManifestHash: documentManifest.manifestHash,
+        organizationId: documentManifest.state.organizationId,
+        purgeEventHash,
+    };
+    return {
+        commitCheckpoints: (execSql = input.execSql) => commitDocumentPurgeCheckpoints({
+            context: checkpointContext,
+            documentPurgeCheckpoint,
+            execSql,
+            principalPolicies,
+        }),
+        documentCheckpoint: documentManifest.checkpoint,
+    };
+}
+export async function verifyDocumentPurgeProofBaseline(input) {
+    requirePurgeProofShape(input.proof);
+    const verified = await verifyDocumentPurgeProofWithMode(input, false);
+    return {
+        documentCheckpoint: verified.documentCheckpoint,
+    };
+}
+export function verifyDocumentPurgeProof(input) {
+    return verifyDocumentPurgeProofWithMode(input, true);
+}
+//# sourceMappingURL=documentPurgeProofVerification.js.map

package/data/keyingProjectionVerification/documentPurgeProofVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentPurgeProofVerification.js","sourceRoot":"","sources":["documentPurgeProofVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAwBvF,SAAS,uBAAuB,CAC9B,KAA6B;IAE7B,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;QACvE,eAAe,CACb,aAAa,EACb,MAAM,EACN,6CAA6C,KAAK,GAAG,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CACT,KAAK,EACL,MAAM,EACP,IAAI,KAAK,CAAC,gCAAgC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,eAAe,CACb,aAAa,EACb,MAAM,EACN,oCAAoC,KAAK,GAAG,CAC7C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CACT,SAAS,EACT,IAAI,EACL,IAAI,KAAK,CAAC,8BAA8B,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,eAAe,CACb,aAAa,EACb,MAAM,EACN,kCAAkC,SAAS,KAAK,WAAW,GAAG,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAQ/C;IACC,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,wBAAwB,GAAG,MAAM,2BAA2B,CAAC;QACjE,eAAe,EAAE,KAAK;QACtB,uBAAuB,EAAE,YAAY;QACrC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,yEAAyE;QACzE,uEAAuE;QACvE,uBAAuB,EAAE,KAAK;QAC9B,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QAC1C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,IAAI;QAClC,cAAc;KACf,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,2BAA2B,GAAG,IAAI,GAAG,EAGxC,CAAC;IACJ,2BAA2B,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE;QAC5D,GAAG,wBAAwB;KAC5B,CAAC,CAAC;IACH,KAAK,MAAM,CACT,KAAK,EACL,IAAI,EACL,IAAI,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;YACrD,eAAe,EAAE,KAAK;YACtB,uBAAuB,EAAE,YAAY;YACrC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,KAAK;YAC9B,KAAK,EAAE,kCAAkC,KAAK,GAAG;YACjD,IAAI;YACJ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,4BAA4B,EAAE,IAAI;YAClC,cAAc;SACf,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxD,aAAa,EAAE,wBAAwB;QACvC,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IACH,OAAO;QACL,wBAAwB;QACxB,2BAA2B;QAC3B,0BAA0B,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc;IAEd,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,KAAoC,EACpC,uBAAgC;IAEhC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IACE,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,kBAAkB;QACnD,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,sBAAsB;KAC7C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAmC,CAAC;IAC3E,MAAM,qBAAqB,GAAG,MAAM,8BAA8B,CAAC;QACjE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;KAChD,CAAC,CAAC;IACH,MAAM,EACJ,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,GAC3B,GAAG,MAAM,yBAAyB,CAAC;QAClC,qBAAqB;QACrB,iBAAiB;QACjB,oBAAoB;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAC3D,MAAM,kCAAkC,CAAC;QACvC,qBAAqB;QACrB,wBAAwB;QACxB,iBAAiB;QACjB,2BAA2B;QAC3B,uBAAuB;QACvB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B;KAC3B,CAAC,CAAC;IACL,IAAI,gBAAgB,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,gCAAgC,CAAC;YACrC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,uBAAuB,GAAG;QAC9B,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,oBAAoB,EAAE,gBAAgB,CAAC,YAAY;QACnD,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC,cAAc;QACrD,cAAc;KACf,CAAC;IACF,OAAO;QACL,iBAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAC7C,8BAA8B,CAAC;YAC7B,OAAO,EAAE,iBAAiB;YAC1B,uBAAuB;YACvB,OAAO;YACP,iBAAiB;SAClB,CAAC;QACJ,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAoC;IAEpC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAoC;IAEpC,OAAO,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentPurgeProofResponse,\n} from \"@tearleads/validators/response\";\nimport { isDocumentPurgeProofResponse } from \"@tearleads/validators/response\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"./bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  observeAccessManifestCheckpoints,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport { verifiedContainerManifestsForBundles } from \"./containerProjectionVerification\";\nimport {\n  commitDocumentPurgeCheckpoints,\n  validateDocumentPurgeCheckpoints,\n} from \"./documentPurgeCheckpointCurrency\";\nimport { authenticateDocumentPurgeArtifacts } from \"./documentPurgePrincipalEvidence\";\nimport { verifyPrincipalPolicySnapshots } from \"./principalPolicySnapshotVerification\";\nimport type { PrincipalPolicyCache, ProjectionUserKeyResolver } from \"./types\";\n\ninterface VerifyDocumentPurgeProofInput {\n  readonly execSql: ExecSql;\n  readonly expectedDocumentId: string;\n  readonly expectedOrganizationId: string;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly proof: DocumentPurgeProofResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}\n\ninterface VerifiedDocumentPurgeProofCommit {\n  readonly commitCheckpoints: (execSql?: ExecSql) => Promise<void>;\n  readonly documentCheckpoint: AccessManifestCheckpoint;\n}\n\ntype PurgeContainerEvidence = Pick<\n  DocumentPurgeProofResponse,\n  | \"authorizingContainerPath\"\n  | \"documentContainerManifestHistory\"\n  | \"documentManifestContainerPaths\"\n>;\n\nfunction collectContainerBundles(\n  proof: PurgeContainerEvidence,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  for (const [index, bundle] of proof.authorizingContainerPath.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document purge authorizing container path[${index}]`,\n    );\n  }\n  for (const [\n    index,\n    bundle,\n  ] of proof.documentContainerManifestHistory.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document purge container history[${index}]`,\n    );\n  }\n  for (const [\n    pathIndex,\n    path,\n  ] of proof.documentManifestContainerPaths.entries()) {\n    for (const [bundleIndex, bundle] of path.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `Document purge dependency path[${pathIndex}][${bundleIndex}]`,\n      );\n    }\n  }\n  return bundlesByHash;\n}\n\nexport async function verifyPurgeContainerPaths(input: {\n  readonly authorizationEvidence: readonly AnyVerifiedPrincipalPolicy[];\n  readonly checkpointContext: ReturnType<\n    typeof createProjectionCheckpointContext\n  >;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly proof: PurgeContainerEvidence;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}) {\n  const bundlesByHash = collectContainerBundles(input.proof);\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const authorizingContainerPath = await verifyContainerManifestPath({\n    servedAsCurrent: false,\n    authorizationMembership: \"referenced\",\n    authorizationEvidence: input.authorizationEvidence,\n    bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    // Authenticate the signed path here; the complete purge's local currency\n    // is checked after its event and document evidence have authenticated.\n    enforceLocalCheckpoints: false,\n    label: \"Document purge authorizing container path\",\n    path: input.proof.authorizingContainerPath,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: true,\n    verifiedByHash,\n  });\n  const authorizingLeaf = authorizingContainerPath.at(-1);\n  if (!authorizingLeaf) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Document purge authorizing container path is empty\",\n    );\n  }\n  const containerPathByManifestHash = new Map<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >();\n  containerPathByManifestHash.set(authorizingLeaf.manifestHash, [\n    ...authorizingContainerPath,\n  ]);\n  for (const [\n    index,\n    path,\n  ] of input.proof.documentManifestContainerPaths.entries()) {\n    const verifiedPath = await verifyContainerManifestPath({\n      servedAsCurrent: false,\n      authorizationMembership: \"referenced\",\n      authorizationEvidence: input.authorizationEvidence,\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoints: false,\n      label: `Document purge dependency path[${index}]`,\n      path,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      requireAuthorizationEvidence: true,\n      verifiedByHash,\n    });\n    const leaf = verifiedPath.at(-1);\n    if (leaf && !containerPathByManifestHash.has(leaf.manifestHash)) {\n      containerPathByManifestHash.set(leaf.manifestHash, verifiedPath);\n    }\n  }\n  // Purge verification consumes event citations only, never content-write\n  // headers, so historical evidence needs no pinned target-path grouping.\n  for (const [hash, manifest] of verifiedByHash) {\n    if (!containerPathByManifestHash.has(hash)) {\n      containerPathByManifestHash.set(hash, [manifest]);\n    }\n  }\n  observeAccessManifestCheckpoints(input.checkpointContext, {\n    verifiedHeads: authorizingContainerPath,\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n  return {\n    authorizingContainerPath,\n    containerPathByManifestHash,\n    verifiedContainerManifests: new Map(verifiedByHash),\n  };\n}\n\nfunction requirePurgeProofShape(\n  proof: unknown,\n): asserts proof is DocumentPurgeProofResponse {\n  if (!isDocumentPurgeProofResponse(proof)) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Document purge proof has an invalid shape\",\n    );\n  }\n}\n\nasync function verifyDocumentPurgeProofWithMode(\n  input: VerifyDocumentPurgeProofInput,\n  enforceLocalCheckpoints: boolean,\n): Promise<VerifiedDocumentPurgeProofCommit> {\n  requirePurgeProofShape(input.proof);\n  if (\n    input.proof.documentId !== input.expectedDocumentId ||\n    input.proof.documentManifest.manifestHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge proof targets the wrong document\",\n    );\n  }\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n    organizationId: input.expectedOrganizationId,\n  });\n  const principalPolicyCache =\n    input.principalPolicyCache ?? new Map<string, VerifiedPrincipalPolicy>();\n  const authorizationEvidence = await verifyPrincipalPolicySnapshots({\n    resolveUserKey: input.resolveUserKey,\n    snapshots: input.proof.principalPolicySnapshots,\n  });\n  const {\n    authorizingContainerPath,\n    containerPathByManifestHash,\n    verifiedContainerManifests,\n  } = await verifyPurgeContainerPaths({\n    authorizationEvidence,\n    checkpointContext,\n    principalPolicyCache,\n    proof: input.proof,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const { documentManifest, principalPolicies, purgeEventHash } =\n    await authenticateDocumentPurgeArtifacts({\n      authorizationEvidence,\n      authorizingContainerPath,\n      checkpointContext,\n      containerPathByManifestHash,\n      enforceLocalCheckpoints,\n      expectedDocumentId: input.expectedDocumentId,\n      principalPolicyCache,\n      proof: input.proof,\n      resolveUserKey: input.resolveUserKey,\n      verifiedContainerManifests,\n    });\n  if (documentManifest.state.organizationId !== input.expectedOrganizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge proof belongs to another organization\",\n    );\n  }\n  if (enforceLocalCheckpoints) {\n    await validateDocumentPurgeCheckpoints({\n      context: checkpointContext,\n      execSql: input.execSql,\n      principalPolicies,\n    });\n  }\n  const documentPurgeCheckpoint = {\n    documentId: input.expectedDocumentId,\n    documentManifestHash: documentManifest.manifestHash,\n    organizationId: documentManifest.state.organizationId,\n    purgeEventHash,\n  };\n  return {\n    commitCheckpoints: (execSql = input.execSql) =>\n      commitDocumentPurgeCheckpoints({\n        context: checkpointContext,\n        documentPurgeCheckpoint,\n        execSql,\n        principalPolicies,\n      }),\n    documentCheckpoint: documentManifest.checkpoint,\n  };\n}\n\nexport async function verifyDocumentPurgeProofBaseline(\n  input: VerifyDocumentPurgeProofInput,\n): Promise<Pick<VerifiedDocumentPurgeProofCommit, \"documentCheckpoint\">> {\n  requirePurgeProofShape(input.proof);\n  const verified = await verifyDocumentPurgeProofWithMode(input, false);\n  return {\n    documentCheckpoint: verified.documentCheckpoint,\n  };\n}\n\nexport function verifyDocumentPurgeProof(\n  input: VerifyDocumentPurgeProofInput,\n): Promise<VerifiedDocumentPurgeProofCommit> {\n  return verifyDocumentPurgeProofWithMode(input, true);\n}\n"]}

package/data/keyingProjectionVerification/error.js

@@ -0,0 +1,139 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { errorMessage } from "../errorMessage.js";
+import { isDatabaseUnavailableError } from "../sync/databaseUnavailable.js";
+import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
+import { rethrowProjectionVerificationCancelled } from "./types.js";
+const KEYING_VERIFICATION_CONTEXT_LIMIT = 16;
+const KEYING_VERIFICATION_CAUSE_LIMIT = 16;
+/** Use only for synchronous parsing of received protocol material. */
+export function readKeyingVerificationShape(read) {
+    try {
+        return read();
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw error;
+        throw new KeyingVerificationError("invalid_shape", errorMessage(error));
+    }
+}
+/**
+ * Preserve identity and projection verification failures across workflow
+ * boundaries that intentionally soften ordinary transport or availability
+ * errors. These failures are terminal: retrying or falling back could continue
+ * with an untrusted identity.
+ */
+export function isKeyingVerificationError(error) {
+    return (error instanceof KeyingVerificationError ||
+        (error instanceof Error && error.name === "KeyingVerificationError"));
+}
+export function rethrowKeyingVerificationError(error) {
+    if (isKeyingVerificationError(error)) {
+        throw error;
+    }
+}
+function keyingVerificationErrorInCauseChain(error) {
+    let current = error;
+    const seen = new Set();
+    for (let depth = 0; depth < KEYING_VERIFICATION_CAUSE_LIMIT; depth += 1) {
+        if (isKeyingVerificationError(current))
+            return current;
+        if (!(current instanceof Error) || seen.has(current))
+            return null;
+        seen.add(current);
+        current = current.cause;
+    }
+    return null;
+}
+export async function reportKeyingVerificationErrorInCauseChain(error, reporter, context) {
+    const verificationError = keyingVerificationErrorInCauseChain(error);
+    if (!verificationError)
+        return false;
+    try {
+        await reporter?.(verificationError, context);
+    }
+    catch {
+        // Incident reporting is best-effort at this boundary. It must never replace
+        // the boundary behavior that stopped use of untrusted data.
+    }
+    return true;
+}
+/**
+ * Persist a terminal integrity failure before preserving the boundary error.
+ * Call only outside an open persistence transaction: the reporter serializes
+ * its own write and awaiting it from that transaction would deadlock.
+ */
+export async function reportAndRethrowKeyingVerificationError(error, reporter, context) {
+    const reported = await reportKeyingVerificationErrorInCauseChain(error, reporter, context);
+    if (!reported)
+        return;
+    throw error;
+}
+export async function runWithSecurityIncidentReporting(reporter, context, operation) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        await reportAndRethrowKeyingVerificationError(error, reporter, context);
+        throw error;
+    }
+}
+export function rethrowDatabaseUnavailableError(error) {
+    if (isDatabaseUnavailableError(error)) {
+        throw error;
+    }
+}
+export function rethrowProjectionVerificationBoundaryError(error) {
+    rethrowDatabaseUnavailableError(error);
+    rethrowProjectionVerificationCancelled(error);
+    if (error instanceof ProjectionDependencyUnavailableError)
+        throw error;
+}
+/**
+ * The verification layer reports a shape or hash failure in received protocol
+ * material with a plain `Error` (or a `SyntaxError` from decoding its JSON).
+ * Anything more specific is not evidence about that material: a boundary error
+ * is retryable, a `TypeError` or other typed runtime failure is a defect, and a
+ * non-Error value is a foreign throw. Those keep their type so callers can
+ * classify them instead of recording them as tampering.
+ */
+function isReceivedMaterialShapeFailure(error) {
+    return (error instanceof Error &&
+        (Object.getPrototypeOf(error) === Error.prototype ||
+            error instanceof SyntaxError));
+}
+/** Classify the failure of an async verification pass; never returns. */
+export function throwKeyingVerificationShapeFailure(error) {
+    rethrowProjectionVerificationBoundaryError(error);
+    if (isKeyingVerificationError(error) ||
+        !isReceivedMaterialShapeFailure(error))
+        throw error;
+    throw new KeyingVerificationError("invalid_shape", error.message);
+}
+export function throwKeyingVerificationErrorWithContext(error, context) {
+    // Availability and cancellation keep their retryable types across contexts.
+    rethrowProjectionVerificationBoundaryError(error);
+    if (isKeyingVerificationError(error)) {
+        // Preserve identity so nested reporting boundaries persist one incident.
+        // The incident's operation supplies boundary context without minting a new
+        // verification error that could bypass identity-based deduplication. Keep
+        // the boundary labels non-enumerably for host-side diagnostics.
+        try {
+            const previous = Reflect.get(error, "keyingVerificationContexts");
+            const contexts = Array.isArray(previous)
+                ? [...previous, context].slice(-KEYING_VERIFICATION_CONTEXT_LIMIT)
+                : [context];
+            Object.defineProperty(error, "keyingVerificationContexts", {
+                configurable: true,
+                enumerable: false,
+                value: contexts,
+            });
+        }
+        catch {
+            // A frozen foreign error still preserves its identity and code.
+        }
+        throw error;
+    }
+    const message = errorMessage(error);
+    throw new Error(`${context}: ${message}`);
+}
+//# sourceMappingURL=error.js.map

package/data/keyingProjectionVerification/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAK/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,sCAAsC,EAAE,MAAM,SAAS,CAAC;AAEjE,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAC7C,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAE3C,sEAAsE;AACtE,MAAM,UAAU,2BAA2B,CAAI,IAAa;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,uBAAuB;QACxC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAC1C,KAAc;IAEd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,+BAA+B,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,yBAAyB,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QACvD,IAAI,CAAC,CAAC,OAAO,YAAY,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAc,EACd,QAA8C,EAC9C,OAAgC;IAEhC,MAAM,iBAAiB,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,EAAE,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,4DAA4D;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,KAAc,EACd,QAA8C,EAC9C,OAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,KAAK,EACL,QAAQ,EACR,OAAO,CACR,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,KAAK,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,QAA8C,EAC9C,OAAgC,EAChC,SAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uCAAuC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,KAAc;IAEd,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACvC,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,YAAY,oCAAoC;QAAE,MAAM,KAAK,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CAAC,KAAc;IACpD,OAAO,CACL,KAAK,YAAY,KAAK;QACtB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,SAAS;YAC/C,KAAK,YAAY,WAAW,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,0CAA0C,CAAC,KAAK,CAAC,CAAC;IAClD,IACE,yBAAyB,CAAC,KAAK,CAAC;QAChC,CAAC,8BAA8B,CAAC,KAAK,CAAC;QAEtC,MAAM,KAAK,CAAC;IACd,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc,EACd,OAAe;IAEf,4EAA4E;IAC5E,0CAA0C,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACtC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,iCAAiC,CAAC;gBAClE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACd,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,4BAA4B,EAAE;gBACzD,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { errorMessage } from \"../errorMessage\";\nimport type {\n  SecurityIncidentContext,\n  SecurityIncidentReporter,\n} from \"../securityIncidents\";\nimport { isDatabaseUnavailableError } from \"../sync/databaseUnavailable\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { rethrowProjectionVerificationCancelled } from \"./types\";\n\nconst KEYING_VERIFICATION_CONTEXT_LIMIT = 16;\nconst KEYING_VERIFICATION_CAUSE_LIMIT = 16;\n\n/** Use only for synchronous parsing of received protocol material. */\nexport function readKeyingVerificationShape<T>(read: () => T): T {\n  try {\n    return read();\n  } catch (error) {\n    if (error instanceof KeyingVerificationError) throw error;\n    throw new KeyingVerificationError(\"invalid_shape\", errorMessage(error));\n  }\n}\n\n/**\n * Preserve identity and projection verification failures across workflow\n * boundaries that intentionally soften ordinary transport or availability\n * errors. These failures are terminal: retrying or falling back could continue\n * with an untrusted identity.\n */\nexport function isKeyingVerificationError(\n  error: unknown,\n): error is Error & { readonly code?: unknown } {\n  return (\n    error instanceof KeyingVerificationError ||\n    (error instanceof Error && error.name === \"KeyingVerificationError\")\n  );\n}\n\nexport function rethrowKeyingVerificationError(error: unknown): void {\n  if (isKeyingVerificationError(error)) {\n    throw error;\n  }\n}\n\nfunction keyingVerificationErrorInCauseChain(\n  error: unknown,\n): (Error & { readonly code?: unknown }) | null {\n  let current = error;\n  const seen = new Set<unknown>();\n  for (let depth = 0; depth < KEYING_VERIFICATION_CAUSE_LIMIT; depth += 1) {\n    if (isKeyingVerificationError(current)) return current;\n    if (!(current instanceof Error) || seen.has(current)) return null;\n    seen.add(current);\n    current = current.cause;\n  }\n  return null;\n}\n\nexport async function reportKeyingVerificationErrorInCauseChain(\n  error: unknown,\n  reporter: SecurityIncidentReporter | undefined,\n  context: SecurityIncidentContext,\n): Promise<boolean> {\n  const verificationError = keyingVerificationErrorInCauseChain(error);\n  if (!verificationError) return false;\n  try {\n    await reporter?.(verificationError, context);\n  } catch {\n    // Incident reporting is best-effort at this boundary. It must never replace\n    // the boundary behavior that stopped use of untrusted data.\n  }\n  return true;\n}\n\n/**\n * Persist a terminal integrity failure before preserving the boundary error.\n * Call only outside an open persistence transaction: the reporter serializes\n * its own write and awaiting it from that transaction would deadlock.\n */\nexport async function reportAndRethrowKeyingVerificationError(\n  error: unknown,\n  reporter: SecurityIncidentReporter | undefined,\n  context: SecurityIncidentContext,\n): Promise<void> {\n  const reported = await reportKeyingVerificationErrorInCauseChain(\n    error,\n    reporter,\n    context,\n  );\n  if (!reported) return;\n  throw error;\n}\n\nexport async function runWithSecurityIncidentReporting<T>(\n  reporter: SecurityIncidentReporter | undefined,\n  context: SecurityIncidentContext,\n  operation: () => Promise<T>,\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    await reportAndRethrowKeyingVerificationError(error, reporter, context);\n    throw error;\n  }\n}\n\nexport function rethrowDatabaseUnavailableError(error: unknown): void {\n  if (isDatabaseUnavailableError(error)) {\n    throw error;\n  }\n}\n\nexport function rethrowProjectionVerificationBoundaryError(\n  error: unknown,\n): void {\n  rethrowDatabaseUnavailableError(error);\n  rethrowProjectionVerificationCancelled(error);\n  if (error instanceof ProjectionDependencyUnavailableError) throw error;\n}\n\n/**\n * The verification layer reports a shape or hash failure in received protocol\n * material with a plain `Error` (or a `SyntaxError` from decoding its JSON).\n * Anything more specific is not evidence about that material: a boundary error\n * is retryable, a `TypeError` or other typed runtime failure is a defect, and a\n * non-Error value is a foreign throw. Those keep their type so callers can\n * classify them instead of recording them as tampering.\n */\nfunction isReceivedMaterialShapeFailure(error: unknown): error is Error {\n  return (\n    error instanceof Error &&\n    (Object.getPrototypeOf(error) === Error.prototype ||\n      error instanceof SyntaxError)\n  );\n}\n\n/** Classify the failure of an async verification pass; never returns. */\nexport function throwKeyingVerificationShapeFailure(error: unknown): never {\n  rethrowProjectionVerificationBoundaryError(error);\n  if (\n    isKeyingVerificationError(error) ||\n    !isReceivedMaterialShapeFailure(error)\n  )\n    throw error;\n  throw new KeyingVerificationError(\"invalid_shape\", error.message);\n}\n\nexport function throwKeyingVerificationErrorWithContext(\n  error: unknown,\n  context: string,\n): never {\n  // Availability and cancellation keep their retryable types across contexts.\n  rethrowProjectionVerificationBoundaryError(error);\n  if (isKeyingVerificationError(error)) {\n    // Preserve identity so nested reporting boundaries persist one incident.\n    // The incident's operation supplies boundary context without minting a new\n    // verification error that could bypass identity-based deduplication. Keep\n    // the boundary labels non-enumerably for host-side diagnostics.\n    try {\n      const previous = Reflect.get(error, \"keyingVerificationContexts\");\n      const contexts = Array.isArray(previous)\n        ? [...previous, context].slice(-KEYING_VERIFICATION_CONTEXT_LIMIT)\n        : [context];\n      Object.defineProperty(error, \"keyingVerificationContexts\", {\n        configurable: true,\n        enumerable: false,\n        value: contexts,\n      });\n    } catch {\n      // A frozen foreign error still preserves its identity and code.\n    }\n    throw error;\n  }\n  const message = errorMessage(error);\n  throw new Error(`${context}: ${message}`);\n}\n"]}

package/data/keyingProjectionVerification/manifestCheckpointVerification.js

@@ -0,0 +1,64 @@
+import { verifyAccessManifestLocalCheckpoint, } from "../../internal/crypto/index.js";
+import { loadAccessManifestCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
+/**
+ * The local checkpoint for one object, read once per verification: every
+ * checkpoint-enforced element of a served path reads its own checkpoint,
+ * and the atomic advance re-validates every checkpoint at commit.
+ */
+async function loadLocalAccessManifestCheckpoint(input) {
+    const key = JSON.stringify([
+        input.objectKind,
+        input.organizationId,
+        input.objectId,
+    ]);
+    const cached = input.localCheckpoints.get(key);
+    if (cached !== undefined)
+        return cached;
+    const loaded = await loadAccessManifestCheckpoint(input.execSql, input.objectKind, input.organizationId, input.objectId);
+    input.localCheckpoints.set(key, loaded);
+    return loaded;
+}
+function isCheckpointPredecessor(input) {
+    const candidate = input.candidate.checkpoint;
+    return (candidate.objectKind === input.current.objectKind &&
+        candidate.organizationId === input.current.organizationId &&
+        candidate.objectId === input.current.objectId &&
+        candidate.epoch > input.localCheckpoint.epoch &&
+        candidate.epoch < input.current.epoch);
+}
+export async function loadManifestCheckpointVerification(input) {
+    const localCheckpoint = await loadLocalAccessManifestCheckpoint({
+        execSql: input.execSql,
+        localCheckpoints: input.localCheckpoints,
+        objectId: input.current.objectId,
+        objectKind: input.current.objectKind,
+        organizationId: input.current.organizationId,
+    });
+    const checkpointPredecessors = localCheckpoint
+        ? [...input.verifiedManifests.values()]
+            .filter((candidate) => isCheckpointPredecessor({
+            candidate,
+            current: input.current,
+            localCheckpoint,
+        }))
+            .sort((left, right) => left.checkpoint.epoch - right.checkpoint.epoch)
+        : [];
+    return { checkpointPredecessors, localCheckpoint };
+}
+export async function verifyCachedManifestCheckpoint(input) {
+    const checkpoint = await loadManifestCheckpointVerification({
+        current: input.current.manifest,
+        execSql: input.execSql,
+        localCheckpoints: input.localCheckpoints,
+        verifiedManifests: input.verifiedManifests,
+    });
+    verifyAccessManifestLocalCheckpoint({
+        checkpointPredecessors: checkpoint.checkpointPredecessors,
+        current: {
+            ...input.current.checkpoint,
+            previousManifestHash: input.current.manifest.previousManifestHash,
+        },
+        localCheckpoint: checkpoint.localCheckpoint,
+    });
+}
+//# sourceMappingURL=manifestCheckpointVerification.js.map

package/data/keyingProjectionVerification/manifestCheckpointVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestCheckpointVerification.js","sourceRoot":"","sources":["manifestCheckpointVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAG1F;;;;GAIG;AACH,KAAK,UAAU,iCAAiC,CAAC,KAMhD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;IAC7C,OAAO,CACL,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO,CAAC,UAAU;QACjD,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QACzD,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAEtD,KAKD;IACC,MAAM,eAAe,GAAG,MAAM,iCAAiC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;KAC7C,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,eAAe;QAC5C,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,uBAAuB,CAAC;YACtB,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe;SAChB,CAAC,CACH;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAQpD;IACC,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU;YAC3B,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;SAClE;QACD,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  type VerifiedAccessManifestCheckpointEvidence,\n  verifyAccessManifestLocalCheckpoint,\n} from \"@tearleads/crypto\";\nimport { loadAccessManifestCheckpoint } from \"../persistence/keyingCheckpointPersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\n/**\n * The local checkpoint for one object, read once per verification: every\n * checkpoint-enforced element of a served path reads its own checkpoint,\n * and the atomic advance re-validates every checkpoint at commit.\n */\nasync function loadLocalAccessManifestCheckpoint(input: {\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly objectId: string;\n  readonly objectKind: AccessManifest[\"objectKind\"];\n  readonly organizationId: string;\n}): Promise<AccessManifestCheckpoint | null> {\n  const key = JSON.stringify([\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  ]);\n  const cached = input.localCheckpoints.get(key);\n  if (cached !== undefined) return cached;\n  const loaded = await loadAccessManifestCheckpoint(\n    input.execSql,\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  );\n  input.localCheckpoints.set(key, loaded);\n  return loaded;\n}\n\ninterface ManifestCheckpointVerificationInput<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n> {\n  readonly checkpointPredecessors: readonly TManifest[];\n  readonly localCheckpoint: AccessManifestCheckpoint | null;\n}\n\nfunction isCheckpointPredecessor(input: {\n  readonly candidate: VerifiedAccessManifestCheckpointEvidence;\n  readonly current: AccessManifest;\n  readonly localCheckpoint: AccessManifestCheckpoint;\n}): boolean {\n  const candidate = input.candidate.checkpoint;\n  return (\n    candidate.objectKind === input.current.objectKind &&\n    candidate.organizationId === input.current.organizationId &&\n    candidate.objectId === input.current.objectId &&\n    candidate.epoch > input.localCheckpoint.epoch &&\n    candidate.epoch < input.current.epoch\n  );\n}\n\nexport async function loadManifestCheckpointVerification<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n>(input: {\n  readonly current: AccessManifest;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<string, TManifest>;\n}): Promise<ManifestCheckpointVerificationInput<TManifest>> {\n  const localCheckpoint = await loadLocalAccessManifestCheckpoint({\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    objectId: input.current.objectId,\n    objectKind: input.current.objectKind,\n    organizationId: input.current.organizationId,\n  });\n  const checkpointPredecessors = localCheckpoint\n    ? [...input.verifiedManifests.values()]\n        .filter((candidate) =>\n          isCheckpointPredecessor({\n            candidate,\n            current: input.current,\n            localCheckpoint,\n          }),\n        )\n        .sort((left, right) => left.checkpoint.epoch - right.checkpoint.epoch)\n    : [];\n  return { checkpointPredecessors, localCheckpoint };\n}\n\nexport async function verifyCachedManifestCheckpoint(input: {\n  readonly current: VerifiedAccessManifestCheckpointEvidence;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<\n    string,\n    VerifiedAccessManifestCheckpointEvidence\n  >;\n}): Promise<void> {\n  const checkpoint = await loadManifestCheckpointVerification({\n    current: input.current.manifest,\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    verifiedManifests: input.verifiedManifests,\n  });\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: checkpoint.checkpointPredecessors,\n    current: {\n      ...input.current.checkpoint,\n      previousManifestHash: input.current.manifest.previousManifestHash,\n    },\n    localCheckpoint: checkpoint.localCheckpoint,\n  });\n}\n"]}

package/data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js

@@ -0,0 +1,43 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+function newer(previous, next) {
+    if (!previous)
+        return true;
+    if (previous.currentState.principalId !== next.currentState.principalId)
+        throw new KeyingVerificationError("object_mismatch", "Projection evidence crosses principals");
+    if (previous.currentState.version === next.currentState.version &&
+        previous.currentState.stateHash !== next.currentState.stateHash)
+        throw new KeyingVerificationError("hash_mismatch", "Projection evidence contains conflicting heads");
+    return previous.currentState.version < next.currentState.version;
+}
+/** Combine proof material when locally composing projections; verification follows. */
+export function mergeProjectionPolicyEvidence(evidence) {
+    let directory;
+    const groups = new Map();
+    const payloads = new Map();
+    for (const proof of evidence) {
+        const organization = proof.organization;
+        if (organization && newer(directory?.organization, organization))
+            directory = proof;
+        for (const payload of proof.organizationPayloads) {
+            const previous = payloads.get(payload.stateHash);
+            if (previous &&
+                (previous.principalId !== payload.principalId ||
+                    previous.principalType !== payload.principalType ||
+                    previous.ciphertext !== payload.ciphertext ||
+                    previous.ciphertextHash !== payload.ciphertextHash))
+                throw new KeyingVerificationError("hash_mismatch", "Projection evidence contains conflicting directory payloads");
+            payloads.set(payload.stateHash, payload);
+        }
+        for (const group of proof.groups) {
+            const prior = groups.get(group.currentState.principalId);
+            if (newer(prior, group))
+                groups.set(group.currentState.principalId, group);
+        }
+    }
+    return {
+        organization: directory?.organization ?? null,
+        organizationPayloads: [...payloads.values()],
+        groups: [...groups.values()],
+    };
+}
+//# sourceMappingURL=mergeProjectionPolicyEvidence.js.map