@tearleads/client-sdk 0.1.14 → 0.1.15

package/data/keyingProjectionVerification/containerProjectionVerification.d.ts

@@ -1,6 +1,7 @@
+import type { PrincipalPolicyAuthorization } from "../../internal/crypto/index.js";
 import { type VerifiedContainerAccessManifest } from "../../internal/crypto/index.js";
 import type { AccessManifestBundleWireResponse, ContainerWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { PrincipalPolicyCheckpointEvidence, PrincipalPolicyCurrentEvidence } from "../principals/principalPolicyEvidence.js";
+import type { PrincipalPolicyCurrentEvidence } from "../principals/principalPolicyEvidence.js";
 import type { ExecSql } from "../sqlite/sqlSchema.js";
 import { type ProjectionCheckpointContext } from "./checkpointContext.js";
 import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "./types.js";
@@ -16,7 +17,7 @@ interface ContainerWriterProjectionVerificationInput {
 }
 export declare function verifiedContainerManifestsForBundles(bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>, verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>): VerifiedContainerAccessManifest[];
 export declare function verifyContainerWriterProjectionWithContext(input: Omit<ContainerWriterProjectionVerificationInput, "execSql"> & {
-    readonly authorizationEvidence?: readonly PrincipalPolicyCheckpointEvidence[];
+    readonly authorizationEvidence?: readonly PrincipalPolicyAuthorization[];
 }, checkpointContext: ProjectionCheckpointContext): Promise<VerifiedContainerAccessManifest[]>;
 export declare function verifyContainerWriterProjection(input: ContainerWriterProjectionVerificationInput): Promise<VerifiedContainerAccessManifest[]>;
 export declare function collectContainerWriterProjectionPrincipalPolicies(input: ContainerWriterProjectionVerificationInput): Promise<PrincipalPolicyCurrentEvidence[]>;

package/data/keyingProjectionVerification/containerProjectionVerification.js

@@ -106,28 +106,30 @@ export async function verifyContainerWriterProjectionWithContext(input, checkpoi
     const bundlesByHash = collectContainerProjectionBundles(input.projection);
     const verifiedByHash = input.verifiedByHash ?? new Map();
     const principalPolicyCache = input.principalPolicyCache ?? new Map();
+    const verification = {
+        checkpointContext,
+        principalPolicyCache,
+        resolveUserKey: input.resolveUserKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    };
     const authorizationEvidence = input.authorizationEvidence ??
         (await verifyProjectionAuthorizationEvidence({
+            ...verification,
             bundles: [...bundlesByHash.values()],
-            checkpointContext,
             policyEvidence: input.projection.policyEvidence,
             organizationId: input.projection.organizationId,
-            principalPolicyCache,
-            resolveUserKey: input.resolveUserKey,
+            stillCurrent: input.stillCurrent,
         }));
     const verifiedPath = await verifyContainerManifestPath({
+        ...verification,
         authorizationEvidence,
         requireAuthorizationEvidence: true,
         servedAsCurrent: true,
         bundlesByHash,
-        checkpointContext,
         enforceLocalCheckpoints: true,
         label: "Container writer projection path",
         path: input.projection.path,
-        principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
         verifiedByHash,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
     });
     const verifiedKekStates = [];
     for (const [index, kek] of input.projection.containerKeks.entries()) {
@@ -138,18 +140,15 @@ export async function verifyContainerWriterProjectionWithContext(input, checkpoi
         const verifiedManifestHistory = [];
         for (const [historyIndex, bundle,] of kek.containerManifestHistory.entries()) {
             verifiedManifestHistory.push(await verifyContainerManifestBundle({
+                ...verification,
                 authorizationEvidence,
                 requireAuthorizationEvidence: true,
                 bundle,
                 bundlesByHash,
-                checkpointContext,
                 enforceLocalCheckpoint: false,
                 label: `Container writer projection KEK[${index}] history[${historyIndex}]`,
                 parentPath: verifiedPath.slice(0, index),
-                principalPolicyCache,
-                resolveUserKey: input.resolveUserKey,
                 verifiedByHash,
-                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
             }));
         }
         const verifiedKekState = await verifyContainerKekProjection({

package/data/keyingProjectionVerification/containerProjectionVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerProjectionVerification.js","sourceRoot":"","sources":["containerProjectionVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,EAC5B,aAAa,EAGb,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAMnB,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,iCAAiC,CAAC,KAGhD;IACC,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY;aACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CACnC;KACF,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAE1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,oCAAoC,CAC5C,uEAAuE,MAAM,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,GAAG,MAAM,aAAa,CACjD,OAAO,CAAC,sBAAsB,CAC/B,CAAC;QACF,iBAAiB,CAAC,IAAI,CAAC;YACrB,MAAM;YACN,mBAAmB,EAAE,QAAQ,MAAM,kBAAkB,uBAAuB,EAAE;YAC9E,uBAAuB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,2BAA2B,CAAC,KAGpC;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2C,CAAC;IAEzE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,IACE,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW;YACvE,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAC7D,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAS3C;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAClB,GAAG,KAAK,CAAC,KAAK,YAAY,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,oBAAoB,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,SAAS,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,iCAAiC,CAAC;QAChE,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,uBAAuB;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,0BAA0B,EAAE,IAAI;QAChC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,wBAAwB,EAAE,0BAA0B;QACpD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,qBAAqB;QAC9C,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACxE,+BAA+B,CAC7B,MAAM,EACN,GAAG,KAAK,CAAC,KAAK,qBAAqB,KAAK,GAAG,CAC5C,CACF,CAAC;IACF,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,IACE,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa;QACzC,aAAa,KAAK,QAAQ,CAAC,KAAK,CAAC,aAAa,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,GAAG,CAAC,mBAAmB;QACpE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,GAAG,CAAC,iBAAiB;QAChE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,GAAG,CAAC,kBAAkB;QAClE,QAAQ,CAAC,KAAK,CAAC,yBAAyB;YACtC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAiBD,MAAM,UAAU,oCAAoC,CAClD,aAAoE,EACpE,cAAoE;IAEpE,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iCAAiC,CACxC,UAA6C;IAE7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,mCAAmC,CACjC,aAAa,EACb,UAAU,EACV,6BAA6B,CAC9B,CAAC;IACF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,KAEC,EACD,iBAA8C;IAE9C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE1E,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,IAAI,GAAG,EAA2C,CAAC;IAC7E,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1C,MAAM,qBAAqB,GACzB,KAAK,CAAC,qBAAqB;QAC3B,CAAC,MAAM,qCAAqC,CAAC;YAC3C,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;YACpC,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,oBAAoB;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC,CAAC;IACN,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,qBAAqB;QACrB,4BAA4B,EAAE,IAAI;QAClC,eAAe,EAAE,IAAI;QACrB,aAAa;QACb,iBAAiB;QACjB,uBAAuB,EAAE,IAAI;QAC7B,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,cAAc,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,uBAAuB,GAAsC,EAAE,CAAC;QACtE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,uBAAuB,CAAC,IAAI,CAC1B,MAAM,6BAA6B,CAAC;gBAClC,qBAAqB;gBACrB,4BAA4B,EAAE,IAAI;gBAClC,MAAM;gBACN,aAAa;gBACb,iBAAiB;gBACjB,sBAAsB,EAAE,KAAK;gBAC7B,KAAK,EAAE,mCAAmC,KAAK,aAAa,YAAY,GAAG;gBAC3E,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,oBAAoB;gBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,cAAc;gBACd,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;aACxC,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC;YAC1D,qBAAqB;YACrB,GAAG;YACH,KAAK,EAAE,mCAAmC,KAAK,GAAG;YAClD,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;YAChB,uBAAuB;YACvB,qBAAqB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC,CAAC,iBAAiB,EAAE;QAClD,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IAEH,iBAAiB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iDAAiD,CACrE,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE;YACE,oBAAoB;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,EACD,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAAC;YAC/D,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,oBAAoB;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,aAA4D,EAC5D,UAA6C,EAC7C,KAAa;IAEb,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,eAAe,CACb,aAAa,EACb,MAAM,EACN,GAAG,KAAK,QAAQ,QAAQ,aAAa,YAAY,GAAG,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yCAAyC,CAAC,KAOxD;IACC,MAAM,wBAAwB,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5D,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAC5E,CAAC;IAEF,OAAO,kCAAkC,CAAC;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { retainVerifiedProjectionHistory } from \"@tearleads/api-client\";\nimport {\n  type ContainerUserRecipientKey,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  toFingerprint,\n  type VerifiedContainerAccessManifest,\n  type VerifiedContainerKekState,\n  verifyContainerKekState,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  PrincipalPolicyCheckpointEvidence,\n  PrincipalPolicyCurrentEvidence,\n} from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"./bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeAccessManifestCheckpoints,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestBundle } from \"./containerManifestVerification\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { throwKeyingVerificationShapeFailure } from \"./error\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport {\n  readContainerKekRecipientTarget,\n  readContainerKeyEpoch,\n  readContainerKeyWrap,\n} from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n  withGenerationGuardedPolicyWarmer,\n} from \"./types\";\n\nasync function collectContainerUserRecipientKeys(input: {\n  readonly containerManifest: VerifiedContainerAccessManifest;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<ContainerUserRecipientKey[]> {\n  const userIds = [\n    ...new Set(\n      input.containerManifest.state.directGrants\n        .filter((grant) => grant.subjectType === \"user\")\n        .map((grant) => grant.subjectId),\n    ),\n  ].sort();\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n\n  for (const userId of userIds) {\n    const userKey = await input.resolveUserKey(userId);\n    if (!userKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `Container writer projection recipient key could not be resolved for ${userId}`,\n      );\n    }\n    const recipientKeyFingerprint = await toFingerprint(\n      userKey.encapsulationPublicKey,\n    );\n    userRecipientKeys.push({\n      userId,\n      recipientKeyEpochId: `user:${userId}:encapsulation:${recipientKeyFingerprint}`,\n      recipientKeyFingerprint,\n    });\n  }\n\n  return userRecipientKeys;\n}\n\nfunction containerKekManifestHistory(input: {\n  readonly history: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n}): VerifiedContainerAccessManifest[] {\n  const historyByHash = new Map<string, VerifiedContainerAccessManifest>();\n\n  for (const manifest of input.history) {\n    if (\n      manifest.state.containerId === input.verifiedManifest.state.containerId &&\n      manifest.manifestHash !== input.verifiedManifest.manifestHash\n    ) {\n      historyByHash.set(manifest.manifestHash, manifest);\n    }\n  }\n\n  return [...historyByHash.values()];\n}\n\nasync function verifyContainerKekProjection(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly kek: ContainerWriterProjectionResponse[\"containerKeks\"][number];\n  readonly label: string;\n  readonly parentKekState: VerifiedContainerKekState | null;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n  readonly verifiedManifestHistory: readonly VerifiedContainerAccessManifest[];\n  readonly parentManifestHistory: readonly VerifiedContainerAccessManifest[];\n}): Promise<VerifiedContainerKekState> {\n  if (input.verifiedManifest.state.parentContainerId && !input.parentKekState) {\n    throw new Error(`${input.label} requires verified parent KEK state`);\n  }\n\n  const keyEpoch = readContainerKeyEpoch(\n    input.kek.keyEpoch,\n    `${input.label} key epoch`,\n  );\n  const wraps = input.kek.wraps.map((wrap, index) =>\n    readContainerKeyWrap(wrap, `${input.label} wrap[${index}]`),\n  );\n  const userRecipientKeys = await collectContainerUserRecipientKeys({\n    containerManifest: input.verifiedManifest,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verifiedKekManifestHistory = containerKekManifestHistory({\n    history: input.verifiedManifestHistory,\n    verifiedManifest: input.verifiedManifest,\n  });\n  const verified = await verifyContainerKekState({\n    allowHistoricalParentEpoch: true,\n    containerManifest: input.verifiedManifest,\n    containerManifestHistory: verifiedKekManifestHistory,\n    parentManifestHistory: input.parentManifestHistory,\n    keyEpoch,\n    parentKekState: input.parentKekState,\n    principalPolicies: input.authorizationEvidence,\n    userRecipientKeys,\n    wraps,\n  });\n  if (!verified.ok) {\n    throw new Error(`${input.label} KEK verification failed`);\n  }\n\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  if (keyEpochHash !== input.kek.keyEpochHash) {\n    throw new Error(`${input.label} key epoch hash mismatch`);\n  }\n  const recipientTargets = input.kek.recipientTargets.map((target, index) =>\n    readContainerKekRecipientTarget(\n      target,\n      `${input.label} recipient target[${index}]`,\n    ),\n  );\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  if (\n    keyTargetHash !== input.kek.keyTargetHash ||\n    keyTargetHash !== verified.value.keyTargetHash\n  ) {\n    throw new Error(`${input.label} target hash mismatch`);\n  }\n  if (\n    verified.value.containerKeyEpochId !== input.kek.containerKeyEpochId ||\n    verified.value.containerKeyEpoch !== input.kek.containerKeyEpoch ||\n    verified.value.accessManifestHash !== input.kek.accessManifestHash ||\n    verified.value.parentContainerKeyEpochId !==\n      input.kek.parentContainerKeyEpochId\n  ) {\n    throw new Error(`${input.label} identity mismatch`);\n  }\n\n  return verified.value;\n}\n\ninterface ContainerWriterProjectionVerificationInput {\n  readonly execSql: ExecSql;\n  readonly persistVerificationCheckpoints?: boolean | undefined;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedByHash?:\n    | Map<string, VerifiedContainerAccessManifest>\n    | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport function verifiedContainerManifestsForBundles(\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): VerifiedContainerAccessManifest[] {\n  return [...bundlesByHash.keys()].flatMap((manifestHash) => {\n    const verified = verifiedByHash.get(manifestHash);\n    return verified ? [verified] : [];\n  });\n}\n\nfunction collectContainerProjectionBundles(\n  projection: ContainerWriterProjectionResponse,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addContainerWriterProjectionBundles(\n    bundlesByHash,\n    projection,\n    \"Container writer projection\",\n  );\n  return bundlesByHash;\n}\n\nexport async function verifyContainerWriterProjectionWithContext(\n  input: Omit<ContainerWriterProjectionVerificationInput, \"execSql\"> & {\n    readonly authorizationEvidence?: readonly PrincipalPolicyCheckpointEvidence[];\n  },\n  checkpointContext: ProjectionCheckpointContext,\n): Promise<VerifiedContainerAccessManifest[]> {\n  if (input.projection.path.length !== input.projection.containerKeks.length) {\n    throw new Error(\n      \"Container writer projection path and KEKs are inconsistent\",\n    );\n  }\n\n  const bundlesByHash = collectContainerProjectionBundles(input.projection);\n\n  const verifiedByHash =\n    input.verifiedByHash ?? new Map<string, VerifiedContainerAccessManifest>();\n  const principalPolicyCache: PrincipalPolicyCache =\n    input.principalPolicyCache ?? new Map();\n  const authorizationEvidence =\n    input.authorizationEvidence ??\n    (await verifyProjectionAuthorizationEvidence({\n      bundles: [...bundlesByHash.values()],\n      checkpointContext,\n      policyEvidence: input.projection.policyEvidence,\n      organizationId: input.projection.organizationId,\n      principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n    }));\n  const verifiedPath = await verifyContainerManifestPath({\n    authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    servedAsCurrent: true,\n    bundlesByHash,\n    checkpointContext,\n    enforceLocalCheckpoints: true,\n    label: \"Container writer projection path\",\n    path: input.projection.path,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n\n  const verifiedKekStates: VerifiedContainerKekState[] = [];\n  for (const [index, kek] of input.projection.containerKeks.entries()) {\n    const verifiedManifest = verifiedPath[index];\n    if (!verifiedManifest) {\n      throw new Error(`Container writer projection KEK[${index}] is missing`);\n    }\n    const verifiedManifestHistory: VerifiedContainerAccessManifest[] = [];\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      verifiedManifestHistory.push(\n        await verifyContainerManifestBundle({\n          authorizationEvidence,\n          requireAuthorizationEvidence: true,\n          bundle,\n          bundlesByHash,\n          checkpointContext,\n          enforceLocalCheckpoint: false,\n          label: `Container writer projection KEK[${index}] history[${historyIndex}]`,\n          parentPath: verifiedPath.slice(0, index),\n          principalPolicyCache,\n          resolveUserKey: input.resolveUserKey,\n          verifiedByHash,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n        }),\n      );\n    }\n\n    const verifiedKekState = await verifyContainerKekProjection({\n      authorizationEvidence,\n      kek,\n      label: `Container writer projection KEK[${index}]`,\n      parentKekState: index > 0 ? (verifiedKekStates[index - 1] ?? null) : null,\n      resolveUserKey: input.resolveUserKey,\n      verifiedManifest,\n      verifiedManifestHistory,\n      parentManifestHistory: [...verifiedByHash.values()],\n    });\n    verifiedKekStates.push(verifiedKekState);\n  }\n\n  observeAccessManifestCheckpoints(checkpointContext, {\n    verifiedHeads: verifiedPath,\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n\n  checkpointContext.heldContainerHeads.push(...verifiedPath);\n  return verifiedPath;\n}\n\nexport async function verifyContainerWriterProjection(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<VerifiedContainerAccessManifest[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const guardedInput = withGenerationGuardedPolicyWarmer(input);\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      guardedInput,\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    retainVerifiedProjectionHistory(input.projection);\n    return verifiedPath;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport async function collectContainerWriterProjectionPrincipalPolicies(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const warmReferencedPrincipalPolicies =\n      generationGuardedPrincipalPolicyWarmer(\n        input.warmReferencedPrincipalPolicies,\n        input.stillCurrent,\n      );\n    const principalPolicyCache: PrincipalPolicyCache =\n      input.principalPolicyCache ?? new Map();\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      {\n        principalPolicyCache,\n        projection: input.projection,\n        verifiedByHash: input.verifiedByHash,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      },\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n\n    const policies = await collectPrincipalPoliciesForContainerPaths({\n      checkpointContext,\n      organizationId: input.projection.organizationId,\n      paths: [verifiedPath],\n      principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    retainVerifiedProjectionHistory(input.projection);\n    return policies;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function addContainerWriterProjectionBundles(\n  bundlesByHash: Map<string, AccessManifestBundleWireResponse>,\n  projection: ContainerWriterProjectionResponse,\n  label: string,\n): void {\n  for (const [index, bundle] of projection.path.entries()) {\n    addBundleByHash(bundlesByHash, bundle, `${label} path[${index}]`);\n  }\n  for (const [kekIndex, kek] of projection.containerKeks.entries()) {\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `${label} KEK[${kekIndex}] history[${historyIndex}]`,\n      );\n    }\n  }\n}\n\nasync function collectPrincipalPoliciesForContainerPaths(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  paths: readonly (readonly VerifiedContainerAccessManifest[] | undefined)[];\n  principalPolicyCache: PrincipalPolicyCache;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const referencedPrincipalHeads = input.paths.flatMap((path) =>\n    (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads),\n  );\n\n  return collectReferencedPrincipalPolicies({\n    checkpointContext: input.checkpointContext,\n    organizationId: input.organizationId,\n    principalPolicyCache: input.principalPolicyCache,\n    references: referencedPrincipalHeads,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}
+{"version":3,"file":"containerProjectionVerification.js","sourceRoot":"","sources":["containerProjectionVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,EAC5B,aAAa,EAGb,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAMnB,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,iCAAiC,CAAC,KAGhD;IACC,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY;aACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CACnC;KACF,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAE1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,oCAAoC,CAC5C,uEAAuE,MAAM,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,GAAG,MAAM,aAAa,CACjD,OAAO,CAAC,sBAAsB,CAC/B,CAAC;QACF,iBAAiB,CAAC,IAAI,CAAC;YACrB,MAAM;YACN,mBAAmB,EAAE,QAAQ,MAAM,kBAAkB,uBAAuB,EAAE;YAC9E,uBAAuB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,2BAA2B,CAAC,KAGpC;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2C,CAAC;IAEzE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,IACE,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW;YACvE,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAC7D,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAS3C;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAClB,GAAG,KAAK,CAAC,KAAK,YAAY,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,oBAAoB,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,SAAS,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,iCAAiC,CAAC;QAChE,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,uBAAuB;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,0BAA0B,EAAE,IAAI;QAChC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,wBAAwB,EAAE,0BAA0B;QACpD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,qBAAqB;QAC9C,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACxE,+BAA+B,CAC7B,MAAM,EACN,GAAG,KAAK,CAAC,KAAK,qBAAqB,KAAK,GAAG,CAC5C,CACF,CAAC;IACF,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,IACE,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa;QACzC,aAAa,KAAK,QAAQ,CAAC,KAAK,CAAC,aAAa,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,GAAG,CAAC,mBAAmB;QACpE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,GAAG,CAAC,iBAAiB;QAChE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,GAAG,CAAC,kBAAkB;QAClE,QAAQ,CAAC,KAAK,CAAC,yBAAyB;YACtC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAiBD,MAAM,UAAU,oCAAoC,CAClD,aAAoE,EACpE,cAAoE;IAEpE,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iCAAiC,CACxC,UAA6C;IAE7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,mCAAmC,CACjC,aAAa,EACb,UAAU,EACV,6BAA6B,CAC9B,CAAC;IACF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,KAEC,EACD,iBAA8C;IAE9C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE1E,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,IAAI,GAAG,EAA2C,CAAC;IAC7E,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG;QACnB,iBAAiB;QACjB,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC;IACF,MAAM,qBAAqB,GACzB,KAAK,CAAC,qBAAqB;QAC3B,CAAC,MAAM,qCAAqC,CAAC;YAC3C,GAAG,YAAY;YACf,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,CAAC;IACN,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,GAAG,YAAY;QACf,qBAAqB;QACrB,4BAA4B,EAAE,IAAI;QAClC,eAAe,EAAE,IAAI;QACrB,aAAa;QACb,uBAAuB,EAAE,IAAI;QAC7B,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,cAAc,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,uBAAuB,GAAsC,EAAE,CAAC;QACtE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,uBAAuB,CAAC,IAAI,CAC1B,MAAM,6BAA6B,CAAC;gBAClC,GAAG,YAAY;gBACf,qBAAqB;gBACrB,4BAA4B,EAAE,IAAI;gBAClC,MAAM;gBACN,aAAa;gBACb,sBAAsB,EAAE,KAAK;gBAC7B,KAAK,EAAE,mCAAmC,KAAK,aAAa,YAAY,GAAG;gBAC3E,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,cAAc;aACf,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC;YAC1D,qBAAqB;YACrB,GAAG;YACH,KAAK,EAAE,mCAAmC,KAAK,GAAG;YAClD,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;YAChB,uBAAuB;YACvB,qBAAqB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC,CAAC,iBAAiB,EAAE;QAClD,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IAEH,iBAAiB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iDAAiD,CACrE,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE;YACE,oBAAoB;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,EACD,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAAC;YAC/D,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,oBAAoB;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,aAA4D,EAC5D,UAA6C,EAC7C,KAAa;IAEb,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,eAAe,CACb,aAAa,EACb,MAAM,EACN,GAAG,KAAK,QAAQ,QAAQ,aAAa,YAAY,GAAG,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yCAAyC,CAAC,KAOxD;IACC,MAAM,wBAAwB,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5D,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAC5E,CAAC;IAEF,OAAO,kCAAkC,CAAC;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { retainVerifiedProjectionHistory } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  type ContainerUserRecipientKey,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  toFingerprint,\n  type VerifiedContainerAccessManifest,\n  type VerifiedContainerKekState,\n  verifyContainerKekState,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"./bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeAccessManifestCheckpoints,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestBundle } from \"./containerManifestVerification\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { throwKeyingVerificationShapeFailure } from \"./error\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport {\n  readContainerKekRecipientTarget,\n  readContainerKeyEpoch,\n  readContainerKeyWrap,\n} from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n  withGenerationGuardedPolicyWarmer,\n} from \"./types\";\n\nasync function collectContainerUserRecipientKeys(input: {\n  readonly containerManifest: VerifiedContainerAccessManifest;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<ContainerUserRecipientKey[]> {\n  const userIds = [\n    ...new Set(\n      input.containerManifest.state.directGrants\n        .filter((grant) => grant.subjectType === \"user\")\n        .map((grant) => grant.subjectId),\n    ),\n  ].sort();\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n\n  for (const userId of userIds) {\n    const userKey = await input.resolveUserKey(userId);\n    if (!userKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `Container writer projection recipient key could not be resolved for ${userId}`,\n      );\n    }\n    const recipientKeyFingerprint = await toFingerprint(\n      userKey.encapsulationPublicKey,\n    );\n    userRecipientKeys.push({\n      userId,\n      recipientKeyEpochId: `user:${userId}:encapsulation:${recipientKeyFingerprint}`,\n      recipientKeyFingerprint,\n    });\n  }\n\n  return userRecipientKeys;\n}\n\nfunction containerKekManifestHistory(input: {\n  readonly history: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n}): VerifiedContainerAccessManifest[] {\n  const historyByHash = new Map<string, VerifiedContainerAccessManifest>();\n\n  for (const manifest of input.history) {\n    if (\n      manifest.state.containerId === input.verifiedManifest.state.containerId &&\n      manifest.manifestHash !== input.verifiedManifest.manifestHash\n    ) {\n      historyByHash.set(manifest.manifestHash, manifest);\n    }\n  }\n\n  return [...historyByHash.values()];\n}\n\nasync function verifyContainerKekProjection(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly kek: ContainerWriterProjectionResponse[\"containerKeks\"][number];\n  readonly label: string;\n  readonly parentKekState: VerifiedContainerKekState | null;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n  readonly verifiedManifestHistory: readonly VerifiedContainerAccessManifest[];\n  readonly parentManifestHistory: readonly VerifiedContainerAccessManifest[];\n}): Promise<VerifiedContainerKekState> {\n  if (input.verifiedManifest.state.parentContainerId && !input.parentKekState) {\n    throw new Error(`${input.label} requires verified parent KEK state`);\n  }\n\n  const keyEpoch = readContainerKeyEpoch(\n    input.kek.keyEpoch,\n    `${input.label} key epoch`,\n  );\n  const wraps = input.kek.wraps.map((wrap, index) =>\n    readContainerKeyWrap(wrap, `${input.label} wrap[${index}]`),\n  );\n  const userRecipientKeys = await collectContainerUserRecipientKeys({\n    containerManifest: input.verifiedManifest,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verifiedKekManifestHistory = containerKekManifestHistory({\n    history: input.verifiedManifestHistory,\n    verifiedManifest: input.verifiedManifest,\n  });\n  const verified = await verifyContainerKekState({\n    allowHistoricalParentEpoch: true,\n    containerManifest: input.verifiedManifest,\n    containerManifestHistory: verifiedKekManifestHistory,\n    parentManifestHistory: input.parentManifestHistory,\n    keyEpoch,\n    parentKekState: input.parentKekState,\n    principalPolicies: input.authorizationEvidence,\n    userRecipientKeys,\n    wraps,\n  });\n  if (!verified.ok) {\n    throw new Error(`${input.label} KEK verification failed`);\n  }\n\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  if (keyEpochHash !== input.kek.keyEpochHash) {\n    throw new Error(`${input.label} key epoch hash mismatch`);\n  }\n  const recipientTargets = input.kek.recipientTargets.map((target, index) =>\n    readContainerKekRecipientTarget(\n      target,\n      `${input.label} recipient target[${index}]`,\n    ),\n  );\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  if (\n    keyTargetHash !== input.kek.keyTargetHash ||\n    keyTargetHash !== verified.value.keyTargetHash\n  ) {\n    throw new Error(`${input.label} target hash mismatch`);\n  }\n  if (\n    verified.value.containerKeyEpochId !== input.kek.containerKeyEpochId ||\n    verified.value.containerKeyEpoch !== input.kek.containerKeyEpoch ||\n    verified.value.accessManifestHash !== input.kek.accessManifestHash ||\n    verified.value.parentContainerKeyEpochId !==\n      input.kek.parentContainerKeyEpochId\n  ) {\n    throw new Error(`${input.label} identity mismatch`);\n  }\n\n  return verified.value;\n}\n\ninterface ContainerWriterProjectionVerificationInput {\n  readonly execSql: ExecSql;\n  readonly persistVerificationCheckpoints?: boolean | undefined;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedByHash?:\n    | Map<string, VerifiedContainerAccessManifest>\n    | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport function verifiedContainerManifestsForBundles(\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): VerifiedContainerAccessManifest[] {\n  return [...bundlesByHash.keys()].flatMap((manifestHash) => {\n    const verified = verifiedByHash.get(manifestHash);\n    return verified ? [verified] : [];\n  });\n}\n\nfunction collectContainerProjectionBundles(\n  projection: ContainerWriterProjectionResponse,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addContainerWriterProjectionBundles(\n    bundlesByHash,\n    projection,\n    \"Container writer projection\",\n  );\n  return bundlesByHash;\n}\n\nexport async function verifyContainerWriterProjectionWithContext(\n  input: Omit<ContainerWriterProjectionVerificationInput, \"execSql\"> & {\n    readonly authorizationEvidence?: readonly PrincipalPolicyAuthorization[];\n  },\n  checkpointContext: ProjectionCheckpointContext,\n): Promise<VerifiedContainerAccessManifest[]> {\n  if (input.projection.path.length !== input.projection.containerKeks.length) {\n    throw new Error(\n      \"Container writer projection path and KEKs are inconsistent\",\n    );\n  }\n\n  const bundlesByHash = collectContainerProjectionBundles(input.projection);\n\n  const verifiedByHash =\n    input.verifiedByHash ?? new Map<string, VerifiedContainerAccessManifest>();\n  const principalPolicyCache: PrincipalPolicyCache =\n    input.principalPolicyCache ?? new Map();\n  const verification = {\n    checkpointContext,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  };\n  const authorizationEvidence =\n    input.authorizationEvidence ??\n    (await verifyProjectionAuthorizationEvidence({\n      ...verification,\n      bundles: [...bundlesByHash.values()],\n      policyEvidence: input.projection.policyEvidence,\n      organizationId: input.projection.organizationId,\n      stillCurrent: input.stillCurrent,\n    }));\n  const verifiedPath = await verifyContainerManifestPath({\n    ...verification,\n    authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    servedAsCurrent: true,\n    bundlesByHash,\n    enforceLocalCheckpoints: true,\n    label: \"Container writer projection path\",\n    path: input.projection.path,\n    verifiedByHash,\n  });\n\n  const verifiedKekStates: VerifiedContainerKekState[] = [];\n  for (const [index, kek] of input.projection.containerKeks.entries()) {\n    const verifiedManifest = verifiedPath[index];\n    if (!verifiedManifest) {\n      throw new Error(`Container writer projection KEK[${index}] is missing`);\n    }\n    const verifiedManifestHistory: VerifiedContainerAccessManifest[] = [];\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      verifiedManifestHistory.push(\n        await verifyContainerManifestBundle({\n          ...verification,\n          authorizationEvidence,\n          requireAuthorizationEvidence: true,\n          bundle,\n          bundlesByHash,\n          enforceLocalCheckpoint: false,\n          label: `Container writer projection KEK[${index}] history[${historyIndex}]`,\n          parentPath: verifiedPath.slice(0, index),\n          verifiedByHash,\n        }),\n      );\n    }\n\n    const verifiedKekState = await verifyContainerKekProjection({\n      authorizationEvidence,\n      kek,\n      label: `Container writer projection KEK[${index}]`,\n      parentKekState: index > 0 ? (verifiedKekStates[index - 1] ?? null) : null,\n      resolveUserKey: input.resolveUserKey,\n      verifiedManifest,\n      verifiedManifestHistory,\n      parentManifestHistory: [...verifiedByHash.values()],\n    });\n    verifiedKekStates.push(verifiedKekState);\n  }\n\n  observeAccessManifestCheckpoints(checkpointContext, {\n    verifiedHeads: verifiedPath,\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n\n  checkpointContext.heldContainerHeads.push(...verifiedPath);\n  return verifiedPath;\n}\n\nexport async function verifyContainerWriterProjection(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<VerifiedContainerAccessManifest[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const guardedInput = withGenerationGuardedPolicyWarmer(input);\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      guardedInput,\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    retainVerifiedProjectionHistory(input.projection);\n    return verifiedPath;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport async function collectContainerWriterProjectionPrincipalPolicies(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const warmReferencedPrincipalPolicies =\n      generationGuardedPrincipalPolicyWarmer(\n        input.warmReferencedPrincipalPolicies,\n        input.stillCurrent,\n      );\n    const principalPolicyCache: PrincipalPolicyCache =\n      input.principalPolicyCache ?? new Map();\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      {\n        principalPolicyCache,\n        projection: input.projection,\n        verifiedByHash: input.verifiedByHash,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      },\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n\n    const policies = await collectPrincipalPoliciesForContainerPaths({\n      checkpointContext,\n      organizationId: input.projection.organizationId,\n      paths: [verifiedPath],\n      principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    retainVerifiedProjectionHistory(input.projection);\n    return policies;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function addContainerWriterProjectionBundles(\n  bundlesByHash: Map<string, AccessManifestBundleWireResponse>,\n  projection: ContainerWriterProjectionResponse,\n  label: string,\n): void {\n  for (const [index, bundle] of projection.path.entries()) {\n    addBundleByHash(bundlesByHash, bundle, `${label} path[${index}]`);\n  }\n  for (const [kekIndex, kek] of projection.containerKeks.entries()) {\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `${label} KEK[${kekIndex}] history[${historyIndex}]`,\n      );\n    }\n  }\n}\n\nasync function collectPrincipalPoliciesForContainerPaths(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  paths: readonly (readonly VerifiedContainerAccessManifest[] | undefined)[];\n  principalPolicyCache: PrincipalPolicyCache;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const referencedPrincipalHeads = input.paths.flatMap((path) =>\n    (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads),\n  );\n\n  return collectReferencedPrincipalPolicies({\n    checkpointContext: input.checkpointContext,\n    organizationId: input.organizationId,\n    principalPolicyCache: input.principalPolicyCache,\n    references: referencedPrincipalHeads,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/documentManifestPolicies.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentManifestPolicies.js","sourceRoot":"","sources":["documentManifestPolicies.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAYnF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAgB9D;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;SAC3B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD,CACF;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,IAAI,KAAK,CAAC,4BAA4B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B;QAAE,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,qBAAqB;QACxB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAMpD;IACC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nexport type UsedDocumentContainerManifests = Map<\n  string,\n  VerifiedContainerAccessManifest\n>;\n\nexport async function collectDocumentManifestPrincipalPolicies(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyCheckpointEvidence[]\n    | undefined;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<PrincipalPolicyCheckpointEvidence[]> {\n  const authorizationEvidence = input.authorizationEvidence ?? [];\n  const references = input.paths\n    .flatMap((path) =>\n      (path ?? []).flatMap(\n        (manifest) => manifest.state.referencedPrincipalHeads,\n      ),\n    )\n    .filter(\n      (reference) =>\n        !authorizationEvidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  if (input.requireAuthorizationEvidence && references.length > 0) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  }\n  if (input.requireAuthorizationEvidence) return [...authorizationEvidence];\n  return [\n    ...authorizationEvidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport function recordUsedDocumentContainerManifests(input: {\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly used?: UsedDocumentContainerManifests | undefined;\n}): void {\n  for (const path of input.paths) {\n    for (const manifest of path ?? []) {\n      input.used?.set(manifest.manifestHash, manifest);\n    }\n  }\n}\n"]}
+{"version":3,"file":"documentManifestPolicies.js","sourceRoot":"","sources":["documentManifestPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAYnF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAgB9D;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;SAC3B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD,CACF;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,IAAI,KAAK,CAAC,4BAA4B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B;QAAE,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,qBAAqB;QACxB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAMpD;IACC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nexport type UsedDocumentContainerManifests = Map<\n  string,\n  VerifiedContainerAccessManifest\n>;\n\nexport async function collectDocumentManifestPrincipalPolicies(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<PrincipalPolicyAuthorization[]> {\n  const authorizationEvidence = input.authorizationEvidence ?? [];\n  const references = input.paths\n    .flatMap((path) =>\n      (path ?? []).flatMap(\n        (manifest) => manifest.state.referencedPrincipalHeads,\n      ),\n    )\n    .filter(\n      (reference) =>\n        !authorizationEvidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  if (input.requireAuthorizationEvidence && references.length > 0) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  }\n  if (input.requireAuthorizationEvidence) return [...authorizationEvidence];\n  return [\n    ...authorizationEvidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport function recordUsedDocumentContainerManifests(input: {\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly used?: UsedDocumentContainerManifests | undefined;\n}): void {\n  for (const path of input.paths) {\n    for (const manifest of path ?? []) {\n      input.used?.set(manifest.manifestHash, manifest);\n    }\n  }\n}\n"]}

package/data/keyingProjectionVerification/documentManifestVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentManifestVerification.js","sourceRoot":"","sources":["documentManifestVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAIvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EACL,wCAAwC,EACxC,oCAAoC,GAErC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAS5E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAuBlD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,8BAA8B,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;gBACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,MAAM,CAAC,QAAQ,EACrB,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACF,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;QAC1D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,oBAAoB;QACtD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,2BAA2B,CACtC,KAAK,CAAC,IAAI,EACV,GAAG,KAAK,CAAC,KAAK,aAAa,CAC5B,CAAC;IACF,MAAM,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GACrD,0BAA0B,CAAC;QACzB,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QAC9D,kBAAkB,EAAE,IAAI,CAAC,qBAAqB;KAC/C,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,wCAAwC,CAAC;QACvE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,KAAK,EAAE,CAAC,GAAG,wBAAwB,EAAE,mBAAmB,CAAC;QACzD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB;QACzD,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;SACxC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,YAAY;QACtE,yBAAyB,EAAE,wBAAwB;QACnD,KAAK;QACL,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ;QACR,gBAAgB;QAChB,iBAAiB;QACjB,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,GAAG,KAAK,CAAC,KAAK,kCAAkC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,oCAAoC,CAAC;QACnC,KAAK,EAAE,CAAC,GAAG,wBAAwB,EAAE,mBAAmB,CAAC;QACzD,IAAI,EAAE,KAAK,CAAC,sBAAsB;KACnC,CAAC,CAAC;IACH,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ,CAAC;QACzE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ;KAC9B,CAAC,CAAC;IACH,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpE,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAO6D;IAE7D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,eAAe,CACb,aAAa,EACb,KAAK,CAAC,UAAU,CAAC,gBAAgB,EACjC,qCAAqC,CACtC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC;IACzD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,eAAe,CACb,aAAa,EACb,MAAM,EACN,+CAA+C,KAAK,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,oCAAoC;IACpC,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzE,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,KAAK,cAAc,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,4BAA4B,CAAC;YACjC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,4BAA4B,EAAE,IAAI;YAClC,MAAM;YACN,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,+CAA+C,KAAK,GAAG;YAC9D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;QACtD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;QACzC,aAAa;QACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,sBAAsB,EAAE,IAAI;QAC5B,KAAK,EAAE,4BAA4B;QACnC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n  type VerifiedDocumentLinkSetManifest,\n  type VerifiedDocumentLinkSetSnapshot,\n  verifyDocumentLinkSetManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { readCanonicalJson } from \"../keyingCanonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport {\n  addBundleByHash,\n  assertCanonicalEqual,\n  verifyAccessEventBundle,\n} from \"./bundleVerification\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { resolveEventContainerPaths } from \"./documentDependencyPaths\";\nimport {\n  collectDocumentManifestPrincipalPolicies,\n  recordUsedDocumentContainerManifests,\n  type UsedDocumentContainerManifests,\n} from \"./documentManifestPolicies\";\nimport { requireVerifiedDocumentPredecessor } from \"./documentManifestPredecessor\";\nimport {\n  loadManifestCheckpointVerification,\n  verifyCachedManifestCheckpoint,\n} from \"./manifestCheckpointVerification\";\nimport { readAccessManifest, readDocumentAccessEventBody } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\ntype PolicyWarmer = ReferencedPrincipalPolicyWarmer | undefined;\n\nexport async function verifyDocumentManifestBundle(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyCheckpointEvidence[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoint: boolean;\n  readonly label: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly trustedPredecessorByHash?:\n    | ReadonlyMap<string, VerifiedDocumentLinkSetSnapshot>\n    | undefined;\n  readonly usedContainerManifests?: UsedDocumentContainerManifests | undefined;\n  readonly verifiedByHash: Map<string, VerifiedDocumentLinkSetManifest>;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}): Promise<VerifiedDocumentLinkSetManifest> {\n  const cached = input.verifiedByHash.get(input.bundle.manifestHash);\n  if (cached) {\n    if (input.enforceLocalCheckpoint) {\n      await verifyCachedManifestCheckpoint({\n        current: cached,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      });\n    }\n    return cached;\n  }\n\n  const event = await verifyAccessEventBundle(input);\n  const manifest = readAccessManifest(\n    input.bundle.manifest,\n    `${input.label} manifest`,\n  );\n  const previousManifest = requireVerifiedDocumentPredecessor({\n    label: input.label,\n    previousManifestHash: event.event.previousManifestHash,\n    trustedPredecessorByHash: input.trustedPredecessorByHash,\n    verifiedByHash: input.verifiedByHash,\n  });\n  const body = readDocumentAccessEventBody(\n    event.body,\n    `${input.label} event body`,\n  );\n  const { dependencyContainerPaths, targetContainerPath } =\n    resolveEventContainerPaths({\n      containerPathByManifestHash: input.containerPathByManifestHash,\n      dependencyManifestHashes: event.event.dependencyManifestHashes,\n      targetManifestHash: body.containerManifestHash,\n    });\n  const principalPolicies = await collectDocumentManifestPrincipalPolicies({\n    authorizationEvidence: input.authorizationEvidence,\n    checkpointContext: input.checkpointContext,\n    organizationId: event.event.organizationId,\n    paths: [...dependencyContainerPaths, targetContainerPath],\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const checkpointVerification = input.enforceLocalCheckpoint\n    ? await loadManifestCheckpointVerification({\n        current: manifest,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      })\n    : null;\n  const verified = await verifyDocumentLinkSetManifest({\n    // Served heads and history were committed under the group membership their\n    // cited container heads referenced; a signer removed since must still\n    // verify on a cold device. The API verifier gates new writes at current.\n    authorizationMembership: input.authorizationMembership ?? \"referenced\",\n    authorizingContainerPaths: dependencyContainerPaths,\n    event,\n    expectedManifestHash: input.bundle.manifestHash,\n    manifest,\n    previousManifest,\n    principalPolicies,\n    ...(checkpointVerification ?? {}),\n    ...(targetContainerPath ? { targetContainerPath } : {}),\n  });\n  if (!verified.ok) {\n    throw new KeyingVerificationError(\n      verified.error.code,\n      `${input.label} manifest verification failed: ${verified.error.message}`,\n    );\n  }\n\n  recordUsedDocumentContainerManifests({\n    paths: [...dependencyContainerPaths, targetContainerPath],\n    used: input.usedContainerManifests,\n  });\n  assertCanonicalEqual({\n    actual: input.bundle.state,\n    expected: readCanonicalJson(verified.value.state, `${input.label} state`),\n    label: `${input.label} state`,\n  });\n  input.verifiedByHash.set(input.bundle.manifestHash, verified.value);\n\n  return verified.value;\n}\n\nexport async function verifyDocumentProjectionManifests(\n  input: Omit<\n    Parameters<typeof verifyDocumentManifestBundle>[0],\n    | \"bundle\"\n    | \"bundlesByHash\"\n    | \"enforceLocalCheckpoint\"\n    | \"label\"\n    | \"verifiedByHash\"\n  > & { readonly projection: DocumentWriterProjectionResponse },\n) {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addBundleByHash(\n    bundlesByHash,\n    input.projection.documentManifest,\n    \"Document writer projection manifest\",\n  );\n  const history = input.projection.documentManifestHistory;\n  for (const [index, bundle] of history.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document writer projection manifest history[${index}]`,\n    );\n  }\n  // An honest API never lists the head in its own history (it seeds the walk\n  // with the head), so a repeat is a malformed or tampered projection and is\n  // refused as such, rather than letting the head reach its verification\n  // through the history cache and relying on the cached branch to re-run\n  // every check the fresh path would.\n  if (\n    history.some(\n      (bundle) =>\n        bundle.manifestHash === input.projection.documentManifest.manifestHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"duplicate_entry\",\n      \"Document writer projection history repeats the current head\",\n    );\n  }\n\n  const verifiedByHash = new Map<string, VerifiedDocumentLinkSetManifest>();\n  for (let index = history.length - 1; index >= 0; index -= 1) {\n    const bundle = history[index];\n    if (!bundle) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        `Document writer projection manifest history[${index}] is missing`,\n      );\n    }\n    await verifyDocumentManifestBundle({\n      authorizationEvidence: input.authorizationEvidence,\n      requireAuthorizationEvidence: true,\n      bundle,\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      containerPathByManifestHash: input.containerPathByManifestHash,\n      enforceLocalCheckpoint: false,\n      label: `Document writer projection manifest history[${index}]`,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  }\n\n  const headManifest = await verifyDocumentManifestBundle({\n    authorizationEvidence: input.authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    bundle: input.projection.documentManifest,\n    bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    containerPathByManifestHash: input.containerPathByManifestHash,\n    enforceLocalCheckpoint: true,\n    label: \"Document writer projection\",\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  return { headManifest, verifiedByHash };\n}\n"]}
+{"version":3,"file":"documentManifestVerification.js","sourceRoot":"","sources":["documentManifestVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EAIvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EACL,wCAAwC,EACxC,oCAAoC,GAErC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAS5E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAuBlD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,8BAA8B,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;gBACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,MAAM,CAAC,QAAQ,EACrB,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACF,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;QAC1D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,oBAAoB;QACtD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,2BAA2B,CACtC,KAAK,CAAC,IAAI,EACV,GAAG,KAAK,CAAC,KAAK,aAAa,CAC5B,CAAC;IACF,MAAM,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GACrD,0BAA0B,CAAC;QACzB,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QAC9D,kBAAkB,EAAE,IAAI,CAAC,qBAAqB;KAC/C,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,wCAAwC,CAAC;QACvE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,KAAK,EAAE,CAAC,GAAG,wBAAwB,EAAE,mBAAmB,CAAC;QACzD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB;QACzD,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;SACxC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,YAAY;QACtE,yBAAyB,EAAE,wBAAwB;QACnD,KAAK;QACL,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ;QACR,gBAAgB;QAChB,iBAAiB;QACjB,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,GAAG,KAAK,CAAC,KAAK,kCAAkC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,oCAAoC,CAAC;QACnC,KAAK,EAAE,CAAC,GAAG,wBAAwB,EAAE,mBAAmB,CAAC;QACzD,IAAI,EAAE,KAAK,CAAC,sBAAsB;KACnC,CAAC,CAAC;IACH,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ,CAAC;QACzE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ;KAC9B,CAAC,CAAC;IACH,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpE,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAO6D;IAE7D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,eAAe,CACb,aAAa,EACb,KAAK,CAAC,UAAU,CAAC,gBAAgB,EACjC,qCAAqC,CACtC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC;IACzD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,eAAe,CACb,aAAa,EACb,MAAM,EACN,+CAA+C,KAAK,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,oCAAoC;IACpC,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzE,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,KAAK,cAAc,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,4BAA4B,CAAC;YACjC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,4BAA4B,EAAE,IAAI;YAClC,MAAM;YACN,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,+CAA+C,KAAK,GAAG;YAC9D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;QACtD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;QACzC,aAAa;QACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,sBAAsB,EAAE,IAAI;QAC5B,KAAK,EAAE,4BAA4B;QACnC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n  type VerifiedDocumentLinkSetManifest,\n  type VerifiedDocumentLinkSetSnapshot,\n  verifyDocumentLinkSetManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { readCanonicalJson } from \"../keyingCanonicalJson\";\nimport {\n  addBundleByHash,\n  assertCanonicalEqual,\n  verifyAccessEventBundle,\n} from \"./bundleVerification\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { resolveEventContainerPaths } from \"./documentDependencyPaths\";\nimport {\n  collectDocumentManifestPrincipalPolicies,\n  recordUsedDocumentContainerManifests,\n  type UsedDocumentContainerManifests,\n} from \"./documentManifestPolicies\";\nimport { requireVerifiedDocumentPredecessor } from \"./documentManifestPredecessor\";\nimport {\n  loadManifestCheckpointVerification,\n  verifyCachedManifestCheckpoint,\n} from \"./manifestCheckpointVerification\";\nimport { readAccessManifest, readDocumentAccessEventBody } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\ntype PolicyWarmer = ReferencedPrincipalPolicyWarmer | undefined;\n\nexport async function verifyDocumentManifestBundle(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoint: boolean;\n  readonly label: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly trustedPredecessorByHash?:\n    | ReadonlyMap<string, VerifiedDocumentLinkSetSnapshot>\n    | undefined;\n  readonly usedContainerManifests?: UsedDocumentContainerManifests | undefined;\n  readonly verifiedByHash: Map<string, VerifiedDocumentLinkSetManifest>;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}): Promise<VerifiedDocumentLinkSetManifest> {\n  const cached = input.verifiedByHash.get(input.bundle.manifestHash);\n  if (cached) {\n    if (input.enforceLocalCheckpoint) {\n      await verifyCachedManifestCheckpoint({\n        current: cached,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      });\n    }\n    return cached;\n  }\n\n  const event = await verifyAccessEventBundle(input);\n  const manifest = readAccessManifest(\n    input.bundle.manifest,\n    `${input.label} manifest`,\n  );\n  const previousManifest = requireVerifiedDocumentPredecessor({\n    label: input.label,\n    previousManifestHash: event.event.previousManifestHash,\n    trustedPredecessorByHash: input.trustedPredecessorByHash,\n    verifiedByHash: input.verifiedByHash,\n  });\n  const body = readDocumentAccessEventBody(\n    event.body,\n    `${input.label} event body`,\n  );\n  const { dependencyContainerPaths, targetContainerPath } =\n    resolveEventContainerPaths({\n      containerPathByManifestHash: input.containerPathByManifestHash,\n      dependencyManifestHashes: event.event.dependencyManifestHashes,\n      targetManifestHash: body.containerManifestHash,\n    });\n  const principalPolicies = await collectDocumentManifestPrincipalPolicies({\n    authorizationEvidence: input.authorizationEvidence,\n    checkpointContext: input.checkpointContext,\n    organizationId: event.event.organizationId,\n    paths: [...dependencyContainerPaths, targetContainerPath],\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const checkpointVerification = input.enforceLocalCheckpoint\n    ? await loadManifestCheckpointVerification({\n        current: manifest,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      })\n    : null;\n  const verified = await verifyDocumentLinkSetManifest({\n    // Served heads and history were committed under the group membership their\n    // cited container heads referenced; a signer removed since must still\n    // verify on a cold device. The API verifier gates new writes at current.\n    authorizationMembership: input.authorizationMembership ?? \"referenced\",\n    authorizingContainerPaths: dependencyContainerPaths,\n    event,\n    expectedManifestHash: input.bundle.manifestHash,\n    manifest,\n    previousManifest,\n    principalPolicies,\n    ...(checkpointVerification ?? {}),\n    ...(targetContainerPath ? { targetContainerPath } : {}),\n  });\n  if (!verified.ok) {\n    throw new KeyingVerificationError(\n      verified.error.code,\n      `${input.label} manifest verification failed: ${verified.error.message}`,\n    );\n  }\n\n  recordUsedDocumentContainerManifests({\n    paths: [...dependencyContainerPaths, targetContainerPath],\n    used: input.usedContainerManifests,\n  });\n  assertCanonicalEqual({\n    actual: input.bundle.state,\n    expected: readCanonicalJson(verified.value.state, `${input.label} state`),\n    label: `${input.label} state`,\n  });\n  input.verifiedByHash.set(input.bundle.manifestHash, verified.value);\n\n  return verified.value;\n}\n\nexport async function verifyDocumentProjectionManifests(\n  input: Omit<\n    Parameters<typeof verifyDocumentManifestBundle>[0],\n    | \"bundle\"\n    | \"bundlesByHash\"\n    | \"enforceLocalCheckpoint\"\n    | \"label\"\n    | \"verifiedByHash\"\n  > & { readonly projection: DocumentWriterProjectionResponse },\n) {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addBundleByHash(\n    bundlesByHash,\n    input.projection.documentManifest,\n    \"Document writer projection manifest\",\n  );\n  const history = input.projection.documentManifestHistory;\n  for (const [index, bundle] of history.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document writer projection manifest history[${index}]`,\n    );\n  }\n  // An honest API never lists the head in its own history (it seeds the walk\n  // with the head), so a repeat is a malformed or tampered projection and is\n  // refused as such, rather than letting the head reach its verification\n  // through the history cache and relying on the cached branch to re-run\n  // every check the fresh path would.\n  if (\n    history.some(\n      (bundle) =>\n        bundle.manifestHash === input.projection.documentManifest.manifestHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"duplicate_entry\",\n      \"Document writer projection history repeats the current head\",\n    );\n  }\n\n  const verifiedByHash = new Map<string, VerifiedDocumentLinkSetManifest>();\n  for (let index = history.length - 1; index >= 0; index -= 1) {\n    const bundle = history[index];\n    if (!bundle) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        `Document writer projection manifest history[${index}] is missing`,\n      );\n    }\n    await verifyDocumentManifestBundle({\n      authorizationEvidence: input.authorizationEvidence,\n      requireAuthorizationEvidence: true,\n      bundle,\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      containerPathByManifestHash: input.containerPathByManifestHash,\n      enforceLocalCheckpoint: false,\n      label: `Document writer projection manifest history[${index}]`,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  }\n\n  const headManifest = await verifyDocumentManifestBundle({\n    authorizationEvidence: input.authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    bundle: input.projection.documentManifest,\n    bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    containerPathByManifestHash: input.containerPathByManifestHash,\n    enforceLocalCheckpoint: true,\n    label: \"Document writer projection\",\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  return { headManifest, verifiedByHash };\n}\n"]}

package/data/keyingProjectionVerification/documentProjectionVerification.d.ts

@@ -1,6 +1,5 @@
-import type { VerifiedContainerAccessManifest, VerifiedDocumentLinkSetManifest } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyAuthorization, VerifiedContainerAccessManifest, VerifiedDocumentLinkSetManifest } from "../../internal/crypto/index.js";
 import type { DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { PrincipalPolicyCheckpointEvidence } from "../principals/principalPolicyEvidence.js";
 import type { ExecSql } from "../sqlite/sqlSchema.js";
 import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "./types.js";
 type VerifiedManifestMap = Map<string, VerifiedContainerAccessManifest>;
@@ -18,7 +17,7 @@ interface DocumentWriterProjectionVerificationInput {
 export interface DocumentWriterProjectionAuthorization {
     readonly containerPathByManifestHash: ReadonlyMap<string, readonly VerifiedContainerAccessManifest[]>;
     readonly documentManifestByHash: ReadonlyMap<string, VerifiedDocumentLinkSetManifest>;
-    readonly principalPolicies: readonly PrincipalPolicyCheckpointEvidence[];
+    readonly principalPolicies: readonly PrincipalPolicyAuthorization[];
 }
 export declare function verifyDocumentWriterProjection(input: DocumentWriterProjectionVerificationInput): Promise<VerifiedDocumentLinkSetManifest>;
 export declare function verifyDocumentWriterProjectionAuthorization(input: DocumentWriterProjectionVerificationInput): Promise<DocumentWriterProjectionAuthorization>;

package/data/keyingProjectionVerification/documentProjectionVerification.js

@@ -96,6 +96,8 @@ async function verifyDocumentWriterProjectionWithContext(input, checkpointContex
     const principalPolicyCache = input.principalPolicyCache ?? new Map();
     const authorizationEvidence = await verifyProjectionAuthorizationEvidence({
         bundles: [
+            input.projection.documentManifest,
+            ...input.projection.documentManifestHistory,
             ...collectDocumentProjectionContainerBundles(input.projection).values(),
         ],
         checkpointContext,
@@ -103,6 +105,8 @@ async function verifyDocumentWriterProjectionWithContext(input, checkpointContex
         organizationId: readAccessManifest(input.projection.documentManifest.manifest, "Document projection manifest").organizationId,
         principalPolicyCache,
         resolveUserKey: input.resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
     });
     const containerPathByManifestHash = await verifyProjectionContainerPaths({
         authorizationEvidence,

package/data/keyingProjectionVerification/documentProjectionVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentProjectionVerification.js","sourceRoot":"","sources":["documentProjectionVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAYxE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAM/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,SAAS,CAAC;AAK5D,SAAS,oCAAoC,CAC3C,UAA4C;IAE5C,OAAO;QACL,GAAG,UAAU,CAAC,8BAA8B;QAC5C,GAAG,UAAU,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,yCAAyC,CAChD,UAA4C;IAE5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,4BAA4B,CAC7D,UAAU,CACX,CAAC,OAAO,EAAE,EAAE,CAAC;QACZ,mCAAmC,CACjC,aAAa,EACb,WAAW,EACX,+CAA+C,KAAK,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,oCAAoC,CAC9D,UAAU,CACX,CAAC,OAAO,EAAE,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,eAAe,CACb,aAAa,EACb,MAAM,EACN,8CAA8C,KAAK,KAAK,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CACT,KAAK,EACL,MAAM,EACP,IAAI,UAAU,CAAC,gCAAgC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,eAAe,CACb,aAAa,EACb,MAAM,EACN,gDAAgD,KAAK,GAAG,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAQ7C;IACC,MAAM,aAAa,GAAG,yCAAyC,CAC7D,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,2BAA2B,GAAG,IAAI,GAAG,EAGxC,CAAC;IACJ,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,IAAI,GAAG,EAA2C,CAAC;IAC7E,KAAK,MAAM,UAAU,IAAI,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D;YACE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,EACD,KAAK,CAAC,iBAAiB,CACxB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,EAAE,CAAC;YACT,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5B,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,KAAK,MAAM,CACT,KAAK,EACL,IAAI,EACL,IAAI,KAAK,CAAC,UAAU,CAAC,8BAA8B,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;YACrD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,4BAA4B,EAAE,IAAI;YAClC,eAAe,EAAE,KAAK;YACtB,uBAAuB,EAAE,YAAY;YACrC,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,KAAK;YAC9B,KAAK,EAAE,8CAA8C,KAAK,GAAG;YAC7D,IAAI;YACJ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,oEAAoE;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC;YACxC,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxD,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IAEH,OAAO,2BAA2B,CAAC;AACrC,CAAC;AA6BD,KAAK,UAAU,yCAAyC,CACtD,KAAiE,EACjE,iBAA8C;IAE9C,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAmC,CAAC;IAC3E,MAAM,qBAAqB,GAAG,MAAM,qCAAqC,CAAC;QACxE,OAAO,EAAE;YACP,GAAG,yCAAyC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE;SACxE;QACD,iBAAiB;QACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,cAAc,EAAE,kBAAkB,CAChC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,EAC1C,8BAA8B,CAC/B,CAAC,cAAc;QAChB,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,2BAA2B,GAAG,MAAM,8BAA8B,CAAC;QACvE,qBAAqB;QACrB,iBAAiB;QACjB,oBAAoB;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GACpC,MAAM,iCAAiC,CAAC;QACtC,qBAAqB;QACrB,iBAAiB;QACjB,2BAA2B;QAC3B,oBAAoB;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,MAAM,8BAA8B,CAClC,YAAY,CAAC,KAAK,CAAC,UAAU,EAC7B,iBAAiB,CAAC,OAAO,CAC1B,CAAC;IAEF,gCAAgC,CAAC,iBAAiB,EAAE;QAClD,aAAa,EAAE,CAAC,YAAY,CAAC;QAC7B,iBAAiB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE;YACb,2BAA2B;YAC3B,sBAAsB,EAAE,cAAc;YACtC,iBAAiB,EAAE,qBAAqB;SACzC;QACD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAgD;IAEhD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,iCAAiC,CAAC,KAAK,CAAC,EACxC,iBAAiB,CAClB,CAAC;IACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC9D,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,KAAgD;IAEhD,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,iCAAiC,CAAC,KAAK,CAAC,EACxC,iBAAiB,CAClB,CAAC;QACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC","sourcesContent":["import { retainVerifiedProjectionHistory } from \"@tearleads/api-client\";\nimport type {\n  VerifiedContainerAccessManifest,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"./bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeAccessManifestCheckpoints,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport {\n  addContainerWriterProjectionBundles,\n  verifiedContainerManifestsForBundles,\n  verifyContainerWriterProjectionWithContext,\n} from \"./containerProjectionVerification\";\nimport { documentContainerProjections } from \"./documentContainerProjections\";\nimport { verifyDocumentProjectionManifests } from \"./documentManifestVerification\";\nimport { rejectPurgedDocumentProjection } from \"./documentPurgeCheckpointEnforcement\";\nimport { throwKeyingVerificationShapeFailure } from \"./error\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport { readAccessManifest } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport { withGenerationGuardedPolicyWarmer } from \"./types\";\n\ntype VerifiedManifestMap = Map<string, VerifiedContainerAccessManifest>;\ntype PolicyWarmer = ReferencedPrincipalPolicyWarmer | undefined;\n\nfunction readDocumentProjectionContainerPaths(\n  projection: DocumentWriterProjectionResponse,\n): AccessManifestBundleWireResponse[][] {\n  return [\n    ...projection.documentManifestContainerPaths,\n    ...projection.authorizingContainerPaths.map((path) => path.path),\n  ];\n}\n\nfunction collectDocumentProjectionContainerBundles(\n  projection: DocumentWriterProjectionResponse,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  for (const [index, authorizing] of documentContainerProjections(\n    projection,\n  ).entries()) {\n    addContainerWriterProjectionBundles(\n      bundlesByHash,\n      authorizing,\n      `Document writer projection authorizing path[${index}]`,\n    );\n  }\n  for (const [index, path] of readDocumentProjectionContainerPaths(\n    projection,\n  ).entries()) {\n    for (const [pathIndex, bundle] of path.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `Document writer projection dependency path[${index}][${pathIndex}]`,\n      );\n    }\n  }\n  for (const [\n    index,\n    bundle,\n  ] of projection.documentContainerManifestHistory.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document writer projection container history[${index}]`,\n    );\n  }\n  return bundlesByHash;\n}\n\nasync function verifyProjectionContainerPaths(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly projection: DocumentWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedByHash?: VerifiedManifestMap | undefined;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}): Promise<Map<string, readonly VerifiedContainerAccessManifest[]>> {\n  const bundlesByHash = collectDocumentProjectionContainerBundles(\n    input.projection,\n  );\n  const containerPathByManifestHash = new Map<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >();\n  // Reuse a caller-supplied cache when provided so a later unwrap pass over the\n  // same authorizing container paths does not re-verify identical manifests.\n  const verifiedByHash =\n    input.verifiedByHash ?? new Map<string, VerifiedContainerAccessManifest>();\n  for (const projection of documentContainerProjections(input.projection)) {\n    const path = await verifyContainerWriterProjectionWithContext(\n      {\n        authorizationEvidence: input.authorizationEvidence,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveUserKey,\n        verifiedByHash,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      input.checkpointContext,\n    );\n    const leaf = path.at(-1);\n    if (leaf) {\n      containerPathByManifestHash.set(leaf.manifestHash, path);\n    }\n    for (const manifest of path) {\n      verifiedByHash.set(manifest.manifestHash, manifest);\n    }\n  }\n  // Grouping supplies evidence only; each signed artifact selects its citations.\n  for (const [\n    index,\n    path,\n  ] of input.projection.documentManifestContainerPaths.entries()) {\n    // Historical dependency evidence is verified without current checkpoint\n    // enforcement. Its grouping cannot substitute an uncited ancestor into\n    // document or content-write authorization.\n    const verifiedPath = await verifyContainerManifestPath({\n      authorizationEvidence: input.authorizationEvidence,\n      requireAuthorizationEvidence: true,\n      servedAsCurrent: false,\n      authorizationMembership: \"referenced\",\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoints: false,\n      label: `Document writer projection dependency path[${index}]`,\n      path,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    // The authorizing path recorded for the same leaf takes precedence.\n    const leaf = verifiedPath.at(-1);\n    if (leaf && !containerPathByManifestHash.has(leaf.manifestHash)) {\n      containerPathByManifestHash.set(leaf.manifestHash, verifiedPath);\n    }\n  }\n\n  // Keep every verified head as evidence. Events and content headers select\n  // their own signed paths through resolveEventContainerPaths.\n  for (const [hash, manifest] of verifiedByHash) {\n    if (!containerPathByManifestHash.has(hash))\n      containerPathByManifestHash.set(hash, [manifest]);\n  }\n\n  observeAccessManifestCheckpoints(input.checkpointContext, {\n    verifiedHeads: [],\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n\n  return containerPathByManifestHash;\n}\n\ninterface DocumentWriterProjectionVerificationInput {\n  readonly execSql: ExecSql;\n  readonly persistVerificationCheckpoints?: boolean | undefined;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly projection: DocumentWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedByHash?: VerifiedManifestMap | undefined;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}\nexport interface DocumentWriterProjectionAuthorization {\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly documentManifestByHash: ReadonlyMap<\n    string,\n    VerifiedDocumentLinkSetManifest\n  >;\n  readonly principalPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n}\n\ninterface VerifiedDocumentWriterProjectionResult {\n  readonly authorization: DocumentWriterProjectionAuthorization;\n  readonly headManifest: VerifiedDocumentLinkSetManifest;\n}\n\nasync function verifyDocumentWriterProjectionWithContext(\n  input: Omit<DocumentWriterProjectionVerificationInput, \"execSql\">,\n  checkpointContext: ProjectionCheckpointContext,\n): Promise<VerifiedDocumentWriterProjectionResult> {\n  const principalPolicyCache =\n    input.principalPolicyCache ?? new Map<string, VerifiedPrincipalPolicy>();\n  const authorizationEvidence = await verifyProjectionAuthorizationEvidence({\n    bundles: [\n      ...collectDocumentProjectionContainerBundles(input.projection).values(),\n    ],\n    checkpointContext,\n    policyEvidence: input.projection.policyEvidence,\n    organizationId: readAccessManifest(\n      input.projection.documentManifest.manifest,\n      \"Document projection manifest\",\n    ).organizationId,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const containerPathByManifestHash = await verifyProjectionContainerPaths({\n    authorizationEvidence,\n    checkpointContext,\n    principalPolicyCache,\n    projection: input.projection,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash: input.verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const { headManifest, verifiedByHash } =\n    await verifyDocumentProjectionManifests({\n      authorizationEvidence,\n      checkpointContext,\n      containerPathByManifestHash,\n      principalPolicyCache,\n      projection: input.projection,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  await rejectPurgedDocumentProjection(\n    headManifest.state.documentId,\n    checkpointContext.execSql,\n  );\n\n  observeAccessManifestCheckpoints(checkpointContext, {\n    verifiedHeads: [headManifest],\n    verifiedManifests: [...verifiedByHash.values()],\n  });\n\n  return {\n    authorization: {\n      containerPathByManifestHash,\n      documentManifestByHash: verifiedByHash,\n      principalPolicies: authorizationEvidence,\n    },\n    headManifest,\n  };\n}\n\nexport async function verifyDocumentWriterProjection(\n  input: DocumentWriterProjectionVerificationInput,\n): Promise<VerifiedDocumentLinkSetManifest> {\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n  });\n  const verified = await verifyDocumentWriterProjectionWithContext(\n    withGenerationGuardedPolicyWarmer(input),\n    checkpointContext,\n  );\n  await finalizeProjectionCheckpoints(checkpointContext, input);\n  retainVerifiedProjectionHistory(input.projection);\n  return verified.headManifest;\n}\n\nexport async function verifyDocumentWriterProjectionAuthorization(\n  input: DocumentWriterProjectionVerificationInput,\n): Promise<DocumentWriterProjectionAuthorization> {\n  try {\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n    });\n    const verified = await verifyDocumentWriterProjectionWithContext(\n      withGenerationGuardedPolicyWarmer(input),\n      checkpointContext,\n    );\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    retainVerifiedProjectionHistory(input.projection);\n    return verified.authorization;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n"]}
+{"version":3,"file":"documentProjectionVerification.js","sourceRoot":"","sources":["documentProjectionVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAYxE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAM/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,SAAS,CAAC;AAK5D,SAAS,oCAAoC,CAC3C,UAA4C;IAE5C,OAAO;QACL,GAAG,UAAU,CAAC,8BAA8B;QAC5C,GAAG,UAAU,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,yCAAyC,CAChD,UAA4C;IAE5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,4BAA4B,CAC7D,UAAU,CACX,CAAC,OAAO,EAAE,EAAE,CAAC;QACZ,mCAAmC,CACjC,aAAa,EACb,WAAW,EACX,+CAA+C,KAAK,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,oCAAoC,CAC9D,UAAU,CACX,CAAC,OAAO,EAAE,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,eAAe,CACb,aAAa,EACb,MAAM,EACN,8CAA8C,KAAK,KAAK,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CACT,KAAK,EACL,MAAM,EACP,IAAI,UAAU,CAAC,gCAAgC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,eAAe,CACb,aAAa,EACb,MAAM,EACN,gDAAgD,KAAK,GAAG,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAQ7C;IACC,MAAM,aAAa,GAAG,yCAAyC,CAC7D,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,2BAA2B,GAAG,IAAI,GAAG,EAGxC,CAAC;IACJ,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,IAAI,GAAG,EAA2C,CAAC;IAC7E,KAAK,MAAM,UAAU,IAAI,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D;YACE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,EACD,KAAK,CAAC,iBAAiB,CACxB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,EAAE,CAAC;YACT,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5B,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,KAAK,MAAM,CACT,KAAK,EACL,IAAI,EACL,IAAI,KAAK,CAAC,UAAU,CAAC,8BAA8B,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;YACrD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,4BAA4B,EAAE,IAAI;YAClC,eAAe,EAAE,KAAK;YACtB,uBAAuB,EAAE,YAAY;YACrC,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,KAAK;YAC9B,KAAK,EAAE,8CAA8C,KAAK,GAAG;YAC7D,IAAI;YACJ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,oEAAoE;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC;YACxC,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxD,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IAEH,OAAO,2BAA2B,CAAC;AACrC,CAAC;AA6BD,KAAK,UAAU,yCAAyC,CACtD,KAAiE,EACjE,iBAA8C;IAE9C,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAmC,CAAC;IAC3E,MAAM,qBAAqB,GAAG,MAAM,qCAAqC,CAAC;QACxE,OAAO,EAAE;YACP,KAAK,CAAC,UAAU,CAAC,gBAAgB;YACjC,GAAG,KAAK,CAAC,UAAU,CAAC,uBAAuB;YAC3C,GAAG,yCAAyC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE;SACxE;QACD,iBAAiB;QACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,cAAc,EAAE,kBAAkB,CAChC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,EAC1C,8BAA8B,CAC/B,CAAC,cAAc;QAChB,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,2BAA2B,GAAG,MAAM,8BAA8B,CAAC;QACvE,qBAAqB;QACrB,iBAAiB;QACjB,oBAAoB;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GACpC,MAAM,iCAAiC,CAAC;QACtC,qBAAqB;QACrB,iBAAiB;QACjB,2BAA2B;QAC3B,oBAAoB;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,MAAM,8BAA8B,CAClC,YAAY,CAAC,KAAK,CAAC,UAAU,EAC7B,iBAAiB,CAAC,OAAO,CAC1B,CAAC;IAEF,gCAAgC,CAAC,iBAAiB,EAAE;QAClD,aAAa,EAAE,CAAC,YAAY,CAAC;QAC7B,iBAAiB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE;YACb,2BAA2B;YAC3B,sBAAsB,EAAE,cAAc;YACtC,iBAAiB,EAAE,qBAAqB;SACzC;QACD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAgD;IAEhD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,iCAAiC,CAAC,KAAK,CAAC,EACxC,iBAAiB,CAClB,CAAC;IACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC9D,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,KAAgD;IAEhD,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,iCAAiC,CAAC,KAAK,CAAC,EACxC,iBAAiB,CAClB,CAAC;QACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC","sourcesContent":["import { retainVerifiedProjectionHistory } from \"@tearleads/api-client\";\nimport type {\n  PrincipalPolicyAuthorization,\n  VerifiedContainerAccessManifest,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"./bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeAccessManifestCheckpoints,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport {\n  addContainerWriterProjectionBundles,\n  verifiedContainerManifestsForBundles,\n  verifyContainerWriterProjectionWithContext,\n} from \"./containerProjectionVerification\";\nimport { documentContainerProjections } from \"./documentContainerProjections\";\nimport { verifyDocumentProjectionManifests } from \"./documentManifestVerification\";\nimport { rejectPurgedDocumentProjection } from \"./documentPurgeCheckpointEnforcement\";\nimport { throwKeyingVerificationShapeFailure } from \"./error\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport { readAccessManifest } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport { withGenerationGuardedPolicyWarmer } from \"./types\";\n\ntype VerifiedManifestMap = Map<string, VerifiedContainerAccessManifest>;\ntype PolicyWarmer = ReferencedPrincipalPolicyWarmer | undefined;\n\nfunction readDocumentProjectionContainerPaths(\n  projection: DocumentWriterProjectionResponse,\n): AccessManifestBundleWireResponse[][] {\n  return [\n    ...projection.documentManifestContainerPaths,\n    ...projection.authorizingContainerPaths.map((path) => path.path),\n  ];\n}\n\nfunction collectDocumentProjectionContainerBundles(\n  projection: DocumentWriterProjectionResponse,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  for (const [index, authorizing] of documentContainerProjections(\n    projection,\n  ).entries()) {\n    addContainerWriterProjectionBundles(\n      bundlesByHash,\n      authorizing,\n      `Document writer projection authorizing path[${index}]`,\n    );\n  }\n  for (const [index, path] of readDocumentProjectionContainerPaths(\n    projection,\n  ).entries()) {\n    for (const [pathIndex, bundle] of path.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `Document writer projection dependency path[${index}][${pathIndex}]`,\n      );\n    }\n  }\n  for (const [\n    index,\n    bundle,\n  ] of projection.documentContainerManifestHistory.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document writer projection container history[${index}]`,\n    );\n  }\n  return bundlesByHash;\n}\n\nasync function verifyProjectionContainerPaths(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly projection: DocumentWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedByHash?: VerifiedManifestMap | undefined;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}): Promise<Map<string, readonly VerifiedContainerAccessManifest[]>> {\n  const bundlesByHash = collectDocumentProjectionContainerBundles(\n    input.projection,\n  );\n  const containerPathByManifestHash = new Map<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >();\n  // Reuse a caller-supplied cache when provided so a later unwrap pass over the\n  // same authorizing container paths does not re-verify identical manifests.\n  const verifiedByHash =\n    input.verifiedByHash ?? new Map<string, VerifiedContainerAccessManifest>();\n  for (const projection of documentContainerProjections(input.projection)) {\n    const path = await verifyContainerWriterProjectionWithContext(\n      {\n        authorizationEvidence: input.authorizationEvidence,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveUserKey,\n        verifiedByHash,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      input.checkpointContext,\n    );\n    const leaf = path.at(-1);\n    if (leaf) {\n      containerPathByManifestHash.set(leaf.manifestHash, path);\n    }\n    for (const manifest of path) {\n      verifiedByHash.set(manifest.manifestHash, manifest);\n    }\n  }\n  // Grouping supplies evidence only; each signed artifact selects its citations.\n  for (const [\n    index,\n    path,\n  ] of input.projection.documentManifestContainerPaths.entries()) {\n    // Historical dependency evidence is verified without current checkpoint\n    // enforcement. Its grouping cannot substitute an uncited ancestor into\n    // document or content-write authorization.\n    const verifiedPath = await verifyContainerManifestPath({\n      authorizationEvidence: input.authorizationEvidence,\n      requireAuthorizationEvidence: true,\n      servedAsCurrent: false,\n      authorizationMembership: \"referenced\",\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoints: false,\n      label: `Document writer projection dependency path[${index}]`,\n      path,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    // The authorizing path recorded for the same leaf takes precedence.\n    const leaf = verifiedPath.at(-1);\n    if (leaf && !containerPathByManifestHash.has(leaf.manifestHash)) {\n      containerPathByManifestHash.set(leaf.manifestHash, verifiedPath);\n    }\n  }\n\n  // Keep every verified head as evidence. Events and content headers select\n  // their own signed paths through resolveEventContainerPaths.\n  for (const [hash, manifest] of verifiedByHash) {\n    if (!containerPathByManifestHash.has(hash))\n      containerPathByManifestHash.set(hash, [manifest]);\n  }\n\n  observeAccessManifestCheckpoints(input.checkpointContext, {\n    verifiedHeads: [],\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n\n  return containerPathByManifestHash;\n}\n\ninterface DocumentWriterProjectionVerificationInput {\n  readonly execSql: ExecSql;\n  readonly persistVerificationCheckpoints?: boolean | undefined;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly projection: DocumentWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedByHash?: VerifiedManifestMap | undefined;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}\nexport interface DocumentWriterProjectionAuthorization {\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly documentManifestByHash: ReadonlyMap<\n    string,\n    VerifiedDocumentLinkSetManifest\n  >;\n  readonly principalPolicies: readonly PrincipalPolicyAuthorization[];\n}\n\ninterface VerifiedDocumentWriterProjectionResult {\n  readonly authorization: DocumentWriterProjectionAuthorization;\n  readonly headManifest: VerifiedDocumentLinkSetManifest;\n}\n\nasync function verifyDocumentWriterProjectionWithContext(\n  input: Omit<DocumentWriterProjectionVerificationInput, \"execSql\">,\n  checkpointContext: ProjectionCheckpointContext,\n): Promise<VerifiedDocumentWriterProjectionResult> {\n  const principalPolicyCache =\n    input.principalPolicyCache ?? new Map<string, VerifiedPrincipalPolicy>();\n  const authorizationEvidence = await verifyProjectionAuthorizationEvidence({\n    bundles: [\n      input.projection.documentManifest,\n      ...input.projection.documentManifestHistory,\n      ...collectDocumentProjectionContainerBundles(input.projection).values(),\n    ],\n    checkpointContext,\n    policyEvidence: input.projection.policyEvidence,\n    organizationId: readAccessManifest(\n      input.projection.documentManifest.manifest,\n      \"Document projection manifest\",\n    ).organizationId,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const containerPathByManifestHash = await verifyProjectionContainerPaths({\n    authorizationEvidence,\n    checkpointContext,\n    principalPolicyCache,\n    projection: input.projection,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash: input.verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const { headManifest, verifiedByHash } =\n    await verifyDocumentProjectionManifests({\n      authorizationEvidence,\n      checkpointContext,\n      containerPathByManifestHash,\n      principalPolicyCache,\n      projection: input.projection,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  await rejectPurgedDocumentProjection(\n    headManifest.state.documentId,\n    checkpointContext.execSql,\n  );\n\n  observeAccessManifestCheckpoints(checkpointContext, {\n    verifiedHeads: [headManifest],\n    verifiedManifests: [...verifiedByHash.values()],\n  });\n\n  return {\n    authorization: {\n      containerPathByManifestHash,\n      documentManifestByHash: verifiedByHash,\n      principalPolicies: authorizationEvidence,\n    },\n    headManifest,\n  };\n}\n\nexport async function verifyDocumentWriterProjection(\n  input: DocumentWriterProjectionVerificationInput,\n): Promise<VerifiedDocumentLinkSetManifest> {\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n  });\n  const verified = await verifyDocumentWriterProjectionWithContext(\n    withGenerationGuardedPolicyWarmer(input),\n    checkpointContext,\n  );\n  await finalizeProjectionCheckpoints(checkpointContext, input);\n  retainVerifiedProjectionHistory(input.projection);\n  return verified.headManifest;\n}\n\nexport async function verifyDocumentWriterProjectionAuthorization(\n  input: DocumentWriterProjectionVerificationInput,\n): Promise<DocumentWriterProjectionAuthorization> {\n  try {\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n    });\n    const verified = await verifyDocumentWriterProjectionWithContext(\n      withGenerationGuardedPolicyWarmer(input),\n      checkpointContext,\n    );\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    retainVerifiedProjectionHistory(input.projection);\n    return verified.authorization;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n"]}

package/data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js

@@ -1,13 +1,14 @@
 import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { principalHeadMatchesReference } from "../principals/organizationAuthorityDescriptor.js";
 function newer(previous, next) {
     if (!previous)
         return true;
-    if (previous.currentState.principalId !== next.currentState.principalId)
+    if (previous.head.principalId !== next.head.principalId)
         throw new KeyingVerificationError("object_mismatch", "Projection evidence crosses principals");
-    if (previous.currentState.version === next.currentState.version &&
-        previous.currentState.stateHash !== next.currentState.stateHash)
+    if (previous.head.version === next.head.version &&
+        !principalHeadMatchesReference(previous.head, next.head))
         throw new KeyingVerificationError("hash_mismatch", "Projection evidence contains conflicting heads");
-    return previous.currentState.version < next.currentState.version;
+    return previous.head.version < next.head.version;
 }
 /** Combine proof material when locally composing projections; verification follows. */
 export function mergeProjectionPolicyEvidence(evidence) {
@@ -19,19 +20,20 @@ export function mergeProjectionPolicyEvidence(evidence) {
         if (organization && newer(directory?.organization, organization))
             directory = proof;
         for (const payload of proof.organizationPayloads) {
-            const previous = payloads.get(payload.stateHash);
+            const previous = payloads.get(payload.reference.stateHash);
             if (previous &&
-                (previous.principalId !== payload.principalId ||
-                    previous.principalType !== payload.principalType ||
-                    previous.ciphertext !== payload.ciphertext ||
-                    previous.ciphertextHash !== payload.ciphertextHash))
+                (!principalHeadMatchesReference(previous.reference, payload.reference) ||
+                    previous.payload.principalId !== payload.payload.principalId ||
+                    previous.payload.principalType !== payload.payload.principalType ||
+                    previous.payload.ciphertext !== payload.payload.ciphertext ||
+                    previous.payload.ciphertextHash !== payload.payload.ciphertextHash))
                 throw new KeyingVerificationError("hash_mismatch", "Projection evidence contains conflicting directory payloads");
-            payloads.set(payload.stateHash, payload);
+            payloads.set(payload.reference.stateHash, payload);
         }
         for (const group of proof.groups) {
-            const prior = groups.get(group.currentState.principalId);
+            const prior = groups.get(group.head.principalId);
             if (newer(prior, group))
-                groups.set(group.currentState.principalId, group);
+                groups.set(group.head.principalId, group);
         }
     }
     return {

package/data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"mergeProjectionPolicyEvidence.js","sourceRoot":"","sources":["mergeProjectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAO5D,SAAS,KAAK,CACZ,QAA4D,EAC5D,IAAqC;IAErC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW;QACrE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;IACJ,IACE,QAAQ,CAAC,YAAY,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO;QAC3D,QAAQ,CAAC,YAAY,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY,CAAC,SAAS;QAE/D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;AACnE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,QAAqD;IAErD,IAAI,SAAuD,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2C,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,SAAS,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,QAAQ;gBACR,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;oBAC3C,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;oBAChD,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;oBAC1C,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC;gBAErD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,oBAAoB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicySnapshotResponse,\n  PrincipalStatePayloadResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\n\nfunction newer(\n  previous: PrincipalPolicySnapshotResponse | null | undefined,\n  next: PrincipalPolicySnapshotResponse,\n): boolean {\n  if (!previous) return true;\n  if (previous.currentState.principalId !== next.currentState.principalId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Projection evidence crosses principals\",\n    );\n  if (\n    previous.currentState.version === next.currentState.version &&\n    previous.currentState.stateHash !== next.currentState.stateHash\n  )\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Projection evidence contains conflicting heads\",\n    );\n  return previous.currentState.version < next.currentState.version;\n}\n\n/** Combine proof material when locally composing projections; verification follows. */\nexport function mergeProjectionPolicyEvidence(\n  evidence: readonly ProjectionPolicyEvidenceResponse[],\n): ProjectionPolicyEvidenceResponse {\n  let directory: ProjectionPolicyEvidenceResponse | undefined;\n  const groups = new Map<string, PrincipalPolicySnapshotResponse>();\n  const payloads = new Map<string, PrincipalStatePayloadResponse>();\n  for (const proof of evidence) {\n    const organization = proof.organization;\n    if (organization && newer(directory?.organization, organization))\n      directory = proof;\n    for (const payload of proof.organizationPayloads) {\n      const previous = payloads.get(payload.stateHash);\n      if (\n        previous &&\n        (previous.principalId !== payload.principalId ||\n          previous.principalType !== payload.principalType ||\n          previous.ciphertext !== payload.ciphertext ||\n          previous.ciphertextHash !== payload.ciphertextHash)\n      )\n        throw new KeyingVerificationError(\n          \"hash_mismatch\",\n          \"Projection evidence contains conflicting directory payloads\",\n        );\n      payloads.set(payload.stateHash, payload);\n    }\n    for (const group of proof.groups) {\n      const prior = groups.get(group.currentState.principalId);\n      if (newer(prior, group))\n        groups.set(group.currentState.principalId, group);\n    }\n  }\n  return {\n    organization: directory?.organization ?? null,\n    organizationPayloads: [...payloads.values()],\n    groups: [...groups.values()],\n  };\n}\n"]}
+{"version":3,"file":"mergeProjectionPolicyEvidence.js","sourceRoot":"","sources":["mergeProjectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAK5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,SAAS,KAAK,CACZ,QAAiE,EACjE,IAA0C;IAE1C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;QACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;IACJ,IACE,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;QAC3C,CAAC,6BAA6B,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAExD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,QAAqD;IAErD,IAAI,SAAuD,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,SAAS,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC3D,IACE,QAAQ;gBACR,CAAC,CAAC,6BAA6B,CAC7B,QAAQ,CAAC,SAAS,EAClB,OAAO,CAAC,SAAS,CAClB;oBACC,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW;oBAC5D,QAAQ,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,aAAa;oBAChE,QAAQ,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU;oBAC1D,QAAQ,CAAC,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAErE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,oBAAoB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyHistorySourceResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport { principalHeadMatchesReference } from \"../principals/organizationAuthorityDescriptor\";\n\nfunction newer(\n  previous: PrincipalPolicyHistorySourceResponse | null | undefined,\n  next: PrincipalPolicyHistorySourceResponse,\n): boolean {\n  if (!previous) return true;\n  if (previous.head.principalId !== next.head.principalId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Projection evidence crosses principals\",\n    );\n  if (\n    previous.head.version === next.head.version &&\n    !principalHeadMatchesReference(previous.head, next.head)\n  )\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Projection evidence contains conflicting heads\",\n    );\n  return previous.head.version < next.head.version;\n}\n\n/** Combine proof material when locally composing projections; verification follows. */\nexport function mergeProjectionPolicyEvidence(\n  evidence: readonly ProjectionPolicyEvidenceResponse[],\n): ProjectionPolicyEvidenceResponse {\n  let directory: ProjectionPolicyEvidenceResponse | undefined;\n  const groups = new Map<string, PrincipalPolicyHistorySourceResponse>();\n  const payloads = new Map<\n    string,\n    ProjectionPolicyEvidenceResponse[\"organizationPayloads\"][number]\n  >();\n  for (const proof of evidence) {\n    const organization = proof.organization;\n    if (organization && newer(directory?.organization, organization))\n      directory = proof;\n    for (const payload of proof.organizationPayloads) {\n      const previous = payloads.get(payload.reference.stateHash);\n      if (\n        previous &&\n        (!principalHeadMatchesReference(\n          previous.reference,\n          payload.reference,\n        ) ||\n          previous.payload.principalId !== payload.payload.principalId ||\n          previous.payload.principalType !== payload.payload.principalType ||\n          previous.payload.ciphertext !== payload.payload.ciphertext ||\n          previous.payload.ciphertextHash !== payload.payload.ciphertextHash)\n      )\n        throw new KeyingVerificationError(\n          \"hash_mismatch\",\n          \"Projection evidence contains conflicting directory payloads\",\n        );\n      payloads.set(payload.reference.stateHash, payload);\n    }\n    for (const group of proof.groups) {\n      const prior = groups.get(group.head.principalId);\n      if (newer(prior, group)) groups.set(group.head.principalId, group);\n    }\n  }\n  return {\n    organization: directory?.organization ?? null,\n    organizationPayloads: [...payloads.values()],\n    groups: [...groups.values()],\n  };\n}\n"]}

package/data/keyingProjectionVerification/organizationFounderBinding.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationFounderBinding.js","sourceRoot":"","sources":["organizationFounderBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAG5F,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CACnD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,OAAO,GACX,iBAAiB,IAAI,YAAY;QAC/B,CAAC,CAAC,YAAY,CAAC,eAAe;QAC9B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;QAC1D,OAAO,CAAC,wBAAwB;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberOrganizationFounder } from \"../persistence/organizationFounderPersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { verifiedContainerCreateManifest } from \"./containerCreateManifest\";\n\n/**\n * A directory can cite someone else's public policies. Bind its founder to the\n * verified personal root's creator before trusting it to authorize a rehome.\n * Metadata roots can be created by later admins and cannot establish this pin.\n * This immutable identity anchor survives read-only verification and canceled\n * views; it neither advances nor replaces a current-policy checkpoint.\n */\nexport async function rememberRootBoundOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[] | undefined;\n  readonly root: VerifiedContainerAccessManifest | undefined;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<void> {\n  const { root } = input;\n  if (!root || root.state.systemSlot !== null) return;\n  const organization = input.policies?.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === root.state.organizationId,\n  );\n  if (!organization) return;\n  const entries =\n    \"retainedHistory\" in organization\n      ? organization.retainedHistory\n      : organization.history;\n  if (!entries) return;\n  const genesis = entries.find(({ state }) => state.version === 1)?.state;\n  if (!genesis)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const created = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Organization founder root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  if (\n    genesis?.signerUserId !== created.event.event.signerUserId ||\n    genesis.signerUserKeyFingerprint !==\n      created.event.event.signerKeyFingerprint\n  )\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Organization founder does not match its verified personal root's creator\",\n    );\n  await rememberOrganizationFounder({\n    execSql: input.execSql,\n    organization,\n  });\n}\n"]}
+{"version":3,"file":"organizationFounderBinding.js","sourceRoot":"","sources":["organizationFounderBinding.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAE5F,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CACnD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,OAAO,GACX,iBAAiB,IAAI,YAAY;QAC/B,CAAC,CAAC,YAAY,CAAC,eAAe;QAC9B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;QAC1D,OAAO,CAAC,wBAAwB;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberOrganizationFounder } from \"../persistence/organizationFounderPersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { verifiedContainerCreateManifest } from \"./containerCreateManifest\";\n\n/**\n * A directory can cite someone else's public policies. Bind its founder to the\n * verified personal root's creator before trusting it to authorize a rehome.\n * Metadata roots can be created by later admins and cannot establish this pin.\n * This immutable identity anchor survives read-only verification and canceled\n * views; it neither advances nor replaces a current-policy checkpoint.\n */\nexport async function rememberRootBoundOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyAuthorization[] | undefined;\n  readonly root: VerifiedContainerAccessManifest | undefined;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<void> {\n  const { root } = input;\n  if (!root || root.state.systemSlot !== null) return;\n  const organization = input.policies?.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === root.state.organizationId,\n  );\n  if (!organization) return;\n  const entries =\n    \"retainedHistory\" in organization\n      ? organization.retainedHistory\n      : organization.history;\n  if (!entries) return;\n  const genesis = entries.find(({ state }) => state.version === 1)?.state;\n  if (!genesis)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const created = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Organization founder root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  if (\n    genesis?.signerUserId !== created.event.event.signerUserId ||\n    genesis.signerUserKeyFingerprint !==\n      created.event.event.signerKeyFingerprint\n  )\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Organization founder does not match its verified personal root's creator\",\n    );\n  await rememberOrganizationFounder({\n    execSql: input.execSql,\n    organization,\n  });\n}\n"]}

package/data/keyingProjectionVerification/projectionAuthorizationEvidence.js

@@ -1,5 +1,6 @@
 import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
 import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
+import { observeProjectionLifetime } from "./projectionLifetimes.js";
 import { verifyProjectionPolicyEvidence } from "./projectionPolicyEvidence.js";
 import { readAccessManifest } from "./readers.js";
 /** Locally planned successors may cite an already verified, uncommitted policy. */
@@ -19,18 +20,44 @@ async function resolveProjectionAuthorizationEvidence(input) {
             principalPolicyCache: input.principalPolicyCache,
             references,
             resolveUserKey: input.resolveUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
         })),
     ];
 }
 export async function verifyProjectionAuthorizationEvidence(input) {
+    const sources = [
+        input.policyEvidence.organization,
+        ...input.policyEvidence.groups,
+    ];
+    const known = [...input.principalPolicyCache.values()];
+    const references = input.bundles
+        .flatMap((bundle) => readAccessManifest(bundle.manifest, "Projection manifest")
+        .referencedPrincipalHeads)
+        .filter((reference) => {
+        if (sources.some((source) => source &&
+            source.head.principalType === reference.principalType &&
+            source.head.principalId === reference.principalId &&
+            source.head.version >= reference.version))
+            return true;
+        // Locally planned successors are verified below through the current-policy path.
+        if (known.some((policy) => principalPolicyMatchesReference({ policy, reference })))
+            return false;
+        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
+    });
+    const recovered = await verifyProjectionPolicyEvidence({
+        evidence: input.policyEvidence,
+        organizationId: input.organizationId,
+        references,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (input.policyEvidence.organization)
+        observeProjectionLifetime(input.checkpointContext, recovered.stillCurrent);
+    input.checkpointContext.authorizationPolicies.push(...recovered.policies);
     return resolveProjectionAuthorizationEvidence({
         ...input,
-        evidence: await verifyProjectionPolicyEvidence({
-            evidence: input.policyEvidence,
-            execSql: input.checkpointContext.execSql,
-            organizationId: input.organizationId,
-            resolveUserKey: input.resolveUserKey,
-        }),
+        evidence: recovered.policies,
     });
 }
 //# sourceMappingURL=projectionAuthorizationEvidence.js.map