@tearleads/client-sdk 0.1.14 → 0.1.16

package/data/documents/blob/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmCA,MAAM,CAAC,MAAM,mCAAmC,GAC9C,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,8BAA8B,GACzC,mCAAmC,CAAC;AACtC,MAAM,CAAC,MAAM,wCAAwC,GACnD,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,gCAAgC,GAC3C,qCAAqC,CAAC;AACxC,MAAM,CAAC,MAAM,6BAA6B,GACxC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC","sourcesContent":["import type {\n  RequestFailureKind,\n  UploadMultipartBlobPartBytesRequest,\n} from \"@tearleads/api-client\";\nimport type {\n  BlobContentKeyTarget,\n  BlobEnvelopeHeaderRecord,\n  BlobEnvelopeRecord,\n  WriteHeader,\n} from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentBindRequest,\n  BlobAttachmentDetachRequest,\n  BlobContentKeyBundleRequest,\n  CompleteMultipartBlobStageRequest,\n  InitiateMultipartBlobStageRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  BlobAttachmentBindResponse,\n  BlobAttachmentDetachResponse,\n  BlobAttachmentSummary,\n  CompleteMultipartBlobStageResponse,\n  DocumentWriterProjectionResponse,\n  InitiateMultipartBlobStageResponse,\n  MultipartBlobStageStatusResponse,\n  UploadMultipartBlobPartResponse,\n} from \"@tearleads/validators/response\";\nimport type { BlobByteSourceInput, BlobBytes } from \"../../../blobContracts\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../sqlite/sqlSchema\";\nimport type { DocumentCreateAuthor } from \"../../shared/types\";\n\nexport const BLOB_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.blob.content-record-key-info\";\nexport const BLOB_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.blob.content-record-aad\";\nexport const BLOB_CONTENT_RECORD_METADATA_HASH_DOMAIN =\n  \"tearleads.blob.content-record-metadata\";\nexport const BLOB_CONTENT_RECORD_NONCE_DOMAIN =\n  \"tearleads.blob.content-record-nonce\";\nexport const BLOB_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.blob.content-record-hkdf-salt\");\nexport const TEXT_ENCODER = new TextEncoder();\n\nexport interface BlobAttachmentRequestOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n}\n\nexport interface BlobAttachmentApi {\n  bindBlobAttachment(\n    blobId: string,\n    input: BlobAttachmentBindRequest,\n    options?: BlobAttachmentRequestOptions,\n  ): Promise<BlobAttachmentBindResponse | null>;\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getRequestFailure?(input: {\n    method: \"DELETE\" | \"GET\" | \"POST\" | \"PUT\";\n    path: string;\n  }): {\n    readonly code?: string | undefined;\n    readonly kind: RequestFailureKind;\n    readonly message: string;\n    readonly status: number | null;\n  } | null;\n  completeMultipartBlobStage(\n    stageId: string,\n    input: CompleteMultipartBlobStageRequest,\n  ): Promise<CompleteMultipartBlobStageResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getMultipartBlobStage(\n    stageId: string,\n  ): Promise<MultipartBlobStageStatusResponse | null>;\n  initiateMultipartBlobStage(\n    input: InitiateMultipartBlobStageRequest,\n  ): Promise<InitiateMultipartBlobStageResponse | null>;\n  uploadMultipartBlobPartBytes(\n    stageId: string,\n    partNumber: number,\n    input: UploadMultipartBlobPartBytesRequest,\n  ): Promise<UploadMultipartBlobPartResponse | null>;\n}\n\nexport interface BlobAttachmentDetachApi {\n  detachBlobAttachment(\n    blobId: string,\n    bindingId: string,\n    input: BlobAttachmentDetachRequest,\n    options?: BlobAttachmentRequestOptions,\n  ): Promise<BlobAttachmentDetachResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n}\n\nexport type { BlobContentKeyTarget };\n\n/**\n * Aliases of the crypto parser's own types. The parser is shared with the API,\n * so restating these shapes here would let the two drift apart silently.\n */\nexport type BlobEncryptedBytesRecord = BlobEnvelopeRecord;\n\n/**\n * The envelope as the header establishes it. Streaming readers hold this\n * before any ciphertext is read, so it has no `chunks`: an empty array there\n * would read as an empty object rather than an unread one.\n */\nexport type BlobEncryptedBytesHeader = BlobEnvelopeHeaderRecord;\n\nexport type BlobEncryptedChunk = BlobEnvelopeRecord[\"chunks\"][number];\n\nexport interface BlobSourceSnapshot {\n  readonly byteLength: number;\n  readonly chunkSha256: readonly string[];\n  readonly chunkSize: number;\n  readonly sha256: string;\n}\n\nexport interface BlobEncryptionPlan {\n  readonly byteLength: number;\n  readonly chunkSize: number;\n  readonly metadataHash: string;\n  readonly partCount: number;\n  readonly plaintextByteLength: number;\n  readonly plaintextSha256: string;\n  readonly sha256: string;\n  encryptPart(index: number): Promise<BlobBytes>;\n  getPartByteLength(index: number): number;\n}\n\nexport interface DocumentManifestIdentity {\n  documentId: string;\n  manifestHash: string;\n  organizationId: string;\n}\n\nexport interface BlobAttachmentMaterial {\n  blobAccessManifestHash: string;\n  contentKeyBundle: BlobContentKeyBundleRequest;\n  encrypted: BlobEncryptionPlan;\n  manifestIdentity: DocumentManifestIdentity;\n  targetHash: string;\n  targets: BlobContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\n/**\n * Progress for an in-flight multipart blob upload.\n */\nexport interface MultipartUploadProgress {\n  readonly bytesTotal: number;\n  readonly bytesUploaded: number;\n  readonly partsCompleted: number;\n  readonly partsTotal: number;\n}\n\nexport type MultipartUploadProgressListener = (\n  progress: MultipartUploadProgress,\n) => void;\n\n/**\n * Fires once a multipart stage has been opened (or resumed), with its id and\n * plaintext chunk size. Callers persist both so a later attempt can reproduce\n * the same encrypted parts and resume instead of orphaning the partial upload.\n */\nexport type MultipartStageResolvedListener = (input: {\n  readonly partSize: number;\n  readonly stageId: string;\n}) => void | Promise<void>;\n\nexport interface UploadDocumentAttachmentInput {\n  apiClient: BlobAttachmentApi;\n  author: DocumentCreateAuthor;\n  blobId?: string | undefined;\n  bindingId?: string | undefined;\n  bytes: BlobByteSourceInput;\n  contentKey?: Uint8Array | undefined;\n  contentKeyEpoch?: number | undefined;\n  documentId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  expectedBindingId: string | null;\n  isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n  // A persisted nonce seed. The plaintext digest derives the envelope IV from\n  // it, then each chunk derives a unique IV. Same-source retries reproduce the\n  // encrypted parts; changed bytes cannot reuse their AES-GCM nonces.\n  nonceSeed?: Uint8Array | undefined;\n  multipart?: MultipartBlobUploadOptions | undefined;\n  onMultipartProgress?: MultipartUploadProgressListener | undefined;\n  onStageResolved?: MultipartStageResolvedListener | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  slotId: string;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface MultipartBlobUploadOptions {\n  /** Exactly 5 MiB of plaintext per independently encrypted multipart chunk. */\n  readonly partSize: number;\n  // The id of a previously opened stage to resume. When set, the upload refetches\n  // that stage and skips parts the server already has instead of opening a new\n  // one; if the stage is gone (expired), it falls back to a fresh stage.\n  readonly resumeStageId?: string | undefined;\n  readonly uploadConcurrency?: number | undefined;\n}\n\nexport interface UploadDocumentAttachmentResult {\n  blobId: string;\n  bindingId: string;\n  request: BlobAttachmentBindRequest;\n  response: BlobAttachmentBindResponse;\n  sha256: string;\n  byteLength: number;\n  writeHeader: WriteHeader;\n  writeHeaderHash: string;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DetachDocumentAttachmentInput {\n  apiClient: BlobAttachmentDetachApi;\n  author: DocumentCreateAuthor;\n  bindingId: string;\n  blobId: string;\n  documentId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  slotId: string;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DetachDocumentAttachmentResult {\n  request: BlobAttachmentDetachRequest;\n  response: BlobAttachmentDetachResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DecryptDocumentAttachmentBlobInput {\n  binding: BlobAttachmentSummary;\n  encryptedBytes: BlobBytes;\n  expectedDocumentId: string;\n  expectedSlotId: string;\n  execSql: ExecSql;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  targetSecretKey: Uint8Array;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmCA,MAAM,CAAC,MAAM,mCAAmC,GAC9C,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,8BAA8B,GACzC,mCAAmC,CAAC;AACtC,MAAM,CAAC,MAAM,wCAAwC,GACnD,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,gCAAgC,GAC3C,qCAAqC,CAAC;AACxC,MAAM,CAAC,MAAM,6BAA6B,GACxC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC","sourcesContent":["import type {\n  RequestFailureKind,\n  UploadMultipartBlobPartBytesRequest,\n} from \"@tearleads/api-client\";\nimport type {\n  BlobContentKeyTarget,\n  BlobEnvelopeHeaderRecord,\n  BlobEnvelopeRecord,\n  WriteHeader,\n} from \"@tearleads/crypto\";\nimport type {\n  BlobAttachmentBindRequest,\n  BlobAttachmentDetachRequest,\n  BlobContentKeyBundleRequest,\n  CompleteMultipartBlobStageRequest,\n  InitiateMultipartBlobStageRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  BlobAttachmentBindResponse,\n  BlobAttachmentDetachResponse,\n  BlobAttachmentSummary,\n  CompleteMultipartBlobStageResponse,\n  DocumentWriterProjectionResponse,\n  InitiateMultipartBlobStageResponse,\n  MultipartBlobStageStatusResponse,\n  UploadMultipartBlobPartResponse,\n} from \"@tearleads/validators/response\";\nimport type { BlobByteSourceInput, BlobBytes } from \"../../../blobContracts\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../sqlite/sqlSchema\";\nimport type { DocumentCreateAuthor } from \"../../shared/types\";\n\nexport const BLOB_CONTENT_RECORD_KEY_INFO_DOMAIN =\n  \"tearleads.blob.content-record-key-info\";\nexport const BLOB_CONTENT_RECORD_AAD_DOMAIN =\n  \"tearleads.blob.content-record-aad\";\nexport const BLOB_CONTENT_RECORD_METADATA_HASH_DOMAIN =\n  \"tearleads.blob.content-record-metadata\";\nexport const BLOB_CONTENT_RECORD_NONCE_DOMAIN =\n  \"tearleads.blob.content-record-nonce\";\nexport const BLOB_CONTENT_RECORD_HKDF_SALT: Uint8Array<ArrayBuffer> =\n  new TextEncoder().encode(\"tearleads.blob.content-record-hkdf-salt\");\nexport const TEXT_ENCODER = new TextEncoder();\n\nexport interface BlobAttachmentRequestOptions {\n  readonly expectedPaymentRequiredOrganizationId?: string | undefined;\n}\n\nexport interface BlobAttachmentApi {\n  bindBlobAttachment(\n    blobId: string,\n    input: BlobAttachmentBindRequest,\n    options?: BlobAttachmentRequestOptions,\n  ): Promise<BlobAttachmentBindResponse | null>;\n  clearWriterProjectionCaches?(): void;\n  evictDocumentWriterProjection?(documentId: string): void;\n  getRequestFailure?(input: {\n    method: \"DELETE\" | \"GET\" | \"POST\" | \"PUT\";\n    path: string;\n  }): {\n    readonly code?: string | undefined;\n    readonly kind: RequestFailureKind;\n    readonly message: string;\n    readonly status: number | null;\n  } | null;\n  completeMultipartBlobStage(\n    stageId: string,\n    input: CompleteMultipartBlobStageRequest,\n  ): Promise<CompleteMultipartBlobStageResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n  getMultipartBlobStage(\n    stageId: string,\n  ): Promise<MultipartBlobStageStatusResponse | null>;\n  initiateMultipartBlobStage(\n    input: InitiateMultipartBlobStageRequest,\n  ): Promise<InitiateMultipartBlobStageResponse | null>;\n  uploadMultipartBlobPartBytes(\n    stageId: string,\n    partNumber: number,\n    input: UploadMultipartBlobPartBytesRequest,\n  ): Promise<UploadMultipartBlobPartResponse | null>;\n}\n\nexport interface BlobAttachmentDetachApi {\n  detachBlobAttachment(\n    blobId: string,\n    bindingId: string,\n    input: BlobAttachmentDetachRequest,\n    options?: BlobAttachmentRequestOptions,\n  ): Promise<BlobAttachmentDetachResponse | null>;\n  getDocumentWriterProjection(\n    documentId: string,\n  ): Promise<DocumentWriterProjectionResponse | null>;\n}\n\nexport type { BlobContentKeyTarget };\n\n/**\n * Aliases of the crypto parser's own types. The parser is shared with the API,\n * so restating these shapes here would let the two drift apart silently.\n */\nexport type BlobEncryptedBytesRecord = BlobEnvelopeRecord;\n\n/**\n * The envelope as the header establishes it. Streaming readers hold this\n * before any ciphertext is read, so it has no `chunks`: an empty array there\n * would read as an empty object rather than an unread one.\n */\nexport type BlobEncryptedBytesHeader = BlobEnvelopeHeaderRecord;\n\nexport type BlobEncryptedChunk = BlobEnvelopeRecord[\"chunks\"][number];\n\nexport interface BlobSourceSnapshot {\n  readonly byteLength: number;\n  readonly chunkSha256: readonly string[];\n  readonly chunkSize: number;\n  readonly sha256: string;\n}\n\nexport interface BlobEncryptionPlan {\n  readonly byteLength: number;\n  readonly chunkSize: number;\n  readonly metadataHash: string;\n  readonly partCount: number;\n  readonly plaintextByteLength: number;\n  readonly plaintextSha256: string;\n  readonly sha256: string;\n  encryptPart(index: number): Promise<BlobBytes>;\n  getPartByteLength(index: number): number;\n}\n\nexport interface DocumentManifestIdentity {\n  documentId: string;\n  manifestHash: string;\n  organizationId: string;\n}\n\nexport interface BlobAttachmentMaterial {\n  blobAccessManifestHash: string;\n  contentKeyBundle: BlobContentKeyBundleRequest;\n  encrypted: BlobEncryptionPlan;\n  manifestIdentity: DocumentManifestIdentity;\n  targetHash: string;\n  targets: BlobContentKeyTarget[];\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\n/**\n * Progress for an in-flight multipart blob upload.\n */\nexport interface MultipartUploadProgress {\n  readonly bytesTotal: number;\n  readonly bytesUploaded: number;\n  readonly partsCompleted: number;\n  readonly partsTotal: number;\n}\n\nexport type MultipartUploadProgressListener = (\n  progress: MultipartUploadProgress,\n) => void;\n\n/**\n * Fires once a multipart stage has been opened (or resumed), with its id and\n * plaintext chunk size. Callers persist both so a later attempt can reproduce\n * the same encrypted parts and resume instead of orphaning the partial upload.\n */\nexport type MultipartStageResolvedListener = (input: {\n  readonly partSize: number;\n  readonly stageId: string;\n}) => void | Promise<void>;\n\nexport interface UploadDocumentAttachmentInput {\n  apiClient: BlobAttachmentApi;\n  author: DocumentCreateAuthor;\n  blobId?: string | undefined;\n  bindingId?: string | undefined;\n  bytes: BlobByteSourceInput;\n  contentKey?: Uint8Array | undefined;\n  contentKeyEpoch?: number | undefined;\n  documentId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  expectedBindingId: string | null;\n  isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n  // A persisted nonce seed. The plaintext digest derives the envelope IV from\n  // it, then each chunk derives a unique IV. Same-source retries reproduce the\n  // encrypted parts; changed bytes cannot reuse their AES-GCM nonces.\n  nonceSeed?: Uint8Array | undefined;\n  multipart?: MultipartBlobUploadOptions | undefined;\n  onMultipartProgress?: MultipartUploadProgressListener | undefined;\n  onStageResolved?: MultipartStageResolvedListener | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  slotId: string;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface MultipartBlobUploadOptions {\n  /** Exactly 5 MiB of plaintext per independently encrypted multipart chunk. */\n  readonly partSize: number;\n  // The id of a previously opened stage to resume. When set, the upload refetches\n  // that stage and skips parts the server already has instead of opening a new\n  // one; if the stage is gone (expired), it falls back to a fresh stage.\n  readonly resumeStageId?: string | undefined;\n  readonly uploadConcurrency?: number | undefined;\n}\n\nexport interface UploadDocumentAttachmentResult {\n  blobId: string;\n  bindingId: string;\n  request: BlobAttachmentBindRequest;\n  response: BlobAttachmentBindResponse;\n  sha256: string;\n  byteLength: number;\n  writeHeader: WriteHeader;\n  writeHeaderHash: string;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DetachDocumentAttachmentInput {\n  apiClient: BlobAttachmentDetachApi;\n  author: DocumentCreateAuthor;\n  bindingId: string;\n  blobId: string;\n  documentId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  isRemoteSyncBlocked?: ((organizationId: string) => boolean) | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  slotId: string;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n  writerProjection?: DocumentWriterProjectionResponse | undefined;\n}\n\nexport interface DetachDocumentAttachmentResult {\n  request: BlobAttachmentDetachRequest;\n  response: BlobAttachmentDetachResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n\nexport interface DecryptDocumentAttachmentBlobInput {\n  binding: BlobAttachmentSummary;\n  encryptedBytes: BlobBytes;\n  expectedDocumentId: string;\n  expectedSlotId: string;\n  execSql: ExecSql;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  targetSecretKey: Uint8Array;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n  writerProjection: DocumentWriterProjectionResponse;\n}\n"]}

package/data/keyingProjectionVerification/accessManifestCheckpointEnforcement.js

@@ -41,6 +41,7 @@ export async function validateAccessManifestCheckpoints(input) {
         access: accessManifestCheckpointAdvances(input),
         execSql: input.execSql,
         policies: input.policies,
+        authorizationPolicies: input.authorizationPolicies,
         stillCurrent: input.stillCurrent,
     });
 }
@@ -51,6 +52,7 @@ export async function enforceAccessManifestCheckpoints(input) {
         execSql: input.execSql,
         organizationId: input.organizationId,
         policies: input.policies,
+        authorizationPolicies: input.authorizationPolicies,
         stillCurrent: input.stillCurrent,
     });
 }

package/data/keyingProjectionVerification/accessManifestCheckpointEnforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessManifestCheckpointEnforcement.js","sourceRoot":"","sources":["accessManifestCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,mDAAmD,CAAC;AAI3D,SAAS,SAAS,CAAC,QAAkD;IACnE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,6DAA6D,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IACC,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAQtD;IACC,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport {\n  type AccessManifestCheckpointAdvance,\n  advanceKeyingCheckpointsAtomically,\n  validateKeyingCheckpointsAtomically,\n} from \"../persistence/keyingCheckpointAdvancePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\nfunction objectKey(manifest: VerifiedAccessManifestCheckpointEvidence): string {\n  const { objectKind, organizationId, objectId } = manifest.checkpoint;\n  return JSON.stringify([objectKind, organizationId, objectId]);\n}\n\nfunction manifestsByObject(\n  manifests: readonly VerifiedAccessManifestCheckpointEvidence[],\n): Map<string, Map<string, VerifiedAccessManifestCheckpointEvidence>> {\n  const byObject = new Map<\n    string,\n    Map<string, VerifiedAccessManifestCheckpointEvidence>\n  >();\n  for (const manifest of manifests) {\n    const key = objectKey(manifest);\n    let byHash = byObject.get(key);\n    if (!byHash) {\n      byHash = new Map();\n      byObject.set(key, byHash);\n    }\n    byHash.set(manifest.manifestHash, manifest);\n  }\n  return byObject;\n}\n\nfunction accessManifestCheckpointAdvances(input: {\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): AccessManifestCheckpointAdvance[] {\n  const evidenceByObject = manifestsByObject(input.verifiedManifests);\n  const headsByObject = manifestsByObject(input.verifiedHeads);\n  const advances: AccessManifestCheckpointAdvance[] = [];\n\n  for (const [key, headsByHash] of headsByObject) {\n    if (headsByHash.size !== 1) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares conflicting access manifest heads for ${key}`,\n      );\n    }\n    const head = headsByHash.values().next().value;\n    if (!head) {\n      continue;\n    }\n    const predecessors = [\n      ...(evidenceByObject.get(key)?.values() ?? []),\n    ].filter((manifest) => manifest.manifestHash !== head.manifestHash);\n    advances.push({ head, predecessors });\n  }\n\n  return advances;\n}\n\nexport async function validateAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await validateKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    execSql: input.execSql,\n    policies: input.policies,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function enforceAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    documentPurgeCheckpoint: input.documentPurgeCheckpoint,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: input.policies,\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}
+{"version":3,"file":"accessManifestCheckpointEnforcement.js","sourceRoot":"","sources":["accessManifestCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,mDAAmD,CAAC;AAI3D,SAAS,SAAS,CAAC,QAAkD;IACnE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,6DAA6D,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KASvD;IACC,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAWtD;IACC,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport {\n  type AccessManifestCheckpointAdvance,\n  advanceKeyingCheckpointsAtomically,\n  validateKeyingCheckpointsAtomically,\n} from \"../persistence/keyingCheckpointAdvancePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\nfunction objectKey(manifest: VerifiedAccessManifestCheckpointEvidence): string {\n  const { objectKind, organizationId, objectId } = manifest.checkpoint;\n  return JSON.stringify([objectKind, organizationId, objectId]);\n}\n\nfunction manifestsByObject(\n  manifests: readonly VerifiedAccessManifestCheckpointEvidence[],\n): Map<string, Map<string, VerifiedAccessManifestCheckpointEvidence>> {\n  const byObject = new Map<\n    string,\n    Map<string, VerifiedAccessManifestCheckpointEvidence>\n  >();\n  for (const manifest of manifests) {\n    const key = objectKey(manifest);\n    let byHash = byObject.get(key);\n    if (!byHash) {\n      byHash = new Map();\n      byObject.set(key, byHash);\n    }\n    byHash.set(manifest.manifestHash, manifest);\n  }\n  return byObject;\n}\n\nfunction accessManifestCheckpointAdvances(input: {\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): AccessManifestCheckpointAdvance[] {\n  const evidenceByObject = manifestsByObject(input.verifiedManifests);\n  const headsByObject = manifestsByObject(input.verifiedHeads);\n  const advances: AccessManifestCheckpointAdvance[] = [];\n\n  for (const [key, headsByHash] of headsByObject) {\n    if (headsByHash.size !== 1) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares conflicting access manifest heads for ${key}`,\n      );\n    }\n    const head = headsByHash.values().next().value;\n    if (!head) {\n      continue;\n    }\n    const predecessors = [\n      ...(evidenceByObject.get(key)?.values() ?? []),\n    ].filter((manifest) => manifest.manifestHash !== head.manifestHash);\n    advances.push({ head, predecessors });\n  }\n\n  return advances;\n}\n\nexport async function validateAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await validateKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    execSql: input.execSql,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function enforceAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    documentPurgeCheckpoint: input.documentPurgeCheckpoint,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/data/keyingProjectionVerification/checkpointContext.d.ts

@@ -1,4 +1,4 @@
-import { type AccessManifestCheckpoint, type VerifiedAccessManifestCheckpointEvidence, type VerifiedContainerAccessManifest } from "../../internal/crypto/index.js";
+import { type AccessManifestCheckpoint, type VerifiedAccessManifestCheckpointEvidence, type VerifiedContainerAccessManifest, type VerifiedPrincipalPolicySelection } from "../../internal/crypto/index.js";
 import type { DocumentPurgeCheckpoint } from "../persistence/documentPurgeCheckpointPersistence.js";
 import type { PrincipalPolicyCheckpointEvidence } from "../principals/principalPolicyEvidence.js";
 import type { ExecSql } from "../sqlite/sqlSchema.js";
@@ -8,6 +8,7 @@ export interface ProjectionCheckpointContext {
     readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;
     organizationId?: string | undefined;
     readonly policies: PrincipalPolicyCheckpointEvidence[];
+    readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];
     readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];
     readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];
 }

package/data/keyingProjectionVerification/checkpointContext.js

@@ -1,6 +1,9 @@
 import { KeyingVerificationError, } from "../../internal/crypto/index.js";
 import { rememberVerifiedContainerHeads } from "../containers/shared/heldContainerHeads.js";
+import { PrincipalAuthorizationCheckpointUnavailableError } from "../persistence/principalAuthorizationCheckpoints.js";
 import { enforceAccessManifestCheckpoints, validateAccessManifestCheckpoints, } from "./accessManifestCheckpointEnforcement.js";
+import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
+import { projectionLifetimeGuard } from "./projectionLifetimes.js";
 import { assertProjectionVerificationCurrent } from "./types.js";
 export function createProjectionCheckpointContext(input) {
     if (typeof input.execSql !== "function") {
@@ -12,6 +15,7 @@ export function createProjectionCheckpointContext(input) {
         localCheckpoints: new Map(),
         organizationId: input.organizationId,
         policies: [],
+        authorizationPolicies: [],
         verifiedHeads: [],
         verifiedManifests: [],
     };
@@ -30,27 +34,45 @@ export function observePrincipalPolicy(context, policy, organizationId) {
     context.policies.push(policy);
 }
 export async function commitProjectionCheckpoints(context, input) {
+    input = {
+        ...input,
+        stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),
+    };
     assertProjectionVerificationCurrent(input?.stillCurrent);
     await enforceAccessManifestCheckpoints({
         documentPurgeCheckpoint: input?.documentPurgeCheckpoint,
         execSql: input?.execSql ?? context.execSql,
         organizationId: context.organizationId,
         policies: context.policies,
+        authorizationPolicies: context.authorizationPolicies,
         stillCurrent: input?.stillCurrent,
         verifiedHeads: context.verifiedHeads,
         verifiedManifests: context.verifiedManifests,
+    }).catch((error) => {
+        if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)
+            throw new ProjectionDependencyUnavailableError(error.message);
+        throw error;
     });
     assertProjectionVerificationCurrent(input?.stillCurrent);
 }
 /** Validates against the latest durable pins without persisting new heads. */
 async function validateProjectionCheckpoints(context, input) {
+    input = {
+        ...input,
+        stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),
+    };
     assertProjectionVerificationCurrent(input?.stillCurrent);
     await validateAccessManifestCheckpoints({
         execSql: input?.execSql ?? context.execSql,
         policies: context.policies,
+        authorizationPolicies: context.authorizationPolicies,
         stillCurrent: input?.stillCurrent,
         verifiedHeads: context.verifiedHeads,
         verifiedManifests: context.verifiedManifests,
+    }).catch((error) => {
+        if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)
+            throw new ProjectionDependencyUnavailableError(error.message);
+        throw error;
     });
     assertProjectionVerificationCurrent(input?.stillCurrent);
 }

package/data/keyingProjectionVerification/checkpointContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkpointContext.js","sourceRoot":"","sources":["checkpointContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAIzF,OAAO,EACL,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAa9D,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,EAAE;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,KAGC;IAED,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoC,EACpC,MAAyC,EACzC,cAAmC;IAEnC,IACE,cAAc,KAAK,SAAS;QAC5B,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,cAAc,KAAK,cAAc,EACzC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC,EACpC,KAIC;IAED,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,gCAAgC,CAAC;QACrC,uBAAuB,EAAE,KAAK,EAAE,uBAAuB;QACvD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,6BAA6B,CAC1C,OAAoC,EACpC,KAGC;IAED,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,iCAAiC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAoC,EACpC,KAIC;IAED,IAAI,KAAK,CAAC,8BAA8B,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;YACzC,KAAK,EAAE,OAAO,CAAC,kBAAkB;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberVerifiedContainerHeads } from \"../containers/shared/heldContainerHeads\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  enforceAccessManifestCheckpoints,\n  validateAccessManifestCheckpoints,\n} from \"./accessManifestCheckpointEnforcement\";\nimport { assertProjectionVerificationCurrent } from \"./types\";\n\nexport interface ProjectionCheckpointContext {\n  readonly heldContainerHeads: VerifiedContainerAccessManifest[];\n  readonly execSql: ExecSql;\n  // Local checkpoints read during this verification, one read per object.\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  organizationId?: string | undefined;\n  readonly policies: PrincipalPolicyCheckpointEvidence[];\n  readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];\n}\n\nexport function createProjectionCheckpointContext(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n}): ProjectionCheckpointContext {\n  if (typeof input.execSql !== \"function\") {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection verification requires durable keying checkpoint storage\",\n    );\n  }\n\n  return {\n    heldContainerHeads: [],\n    execSql: input.execSql,\n    localCheckpoints: new Map(),\n    organizationId: input.organizationId,\n    policies: [],\n    verifiedHeads: [],\n    verifiedManifests: [],\n  };\n}\n\nexport function observeAccessManifestCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n  },\n): void {\n  context.verifiedHeads.push(...input.verifiedHeads);\n  context.verifiedManifests.push(...input.verifiedManifests);\n}\n\nexport function observePrincipalPolicy(\n  context: ProjectionCheckpointContext,\n  policy: PrincipalPolicyCheckpointEvidence,\n  organizationId?: string | undefined,\n): void {\n  if (\n    organizationId !== undefined &&\n    context.organizationId !== undefined &&\n    context.organizationId !== organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"projection checkpoint batch crosses organization ownership\",\n    );\n  }\n  context.organizationId ??= organizationId;\n  context.policies.push(policy);\n}\n\nexport async function commitProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await enforceAccessManifestCheckpoints({\n    documentPurgeCheckpoint: input?.documentPurgeCheckpoint,\n    execSql: input?.execSql ?? context.execSql,\n    organizationId: context.organizationId,\n    policies: context.policies,\n    stillCurrent: input?.stillCurrent,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\n/** Validates against the latest durable pins without persisting new heads. */\nasync function validateProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await validateAccessManifestCheckpoints({\n    execSql: input?.execSql ?? context.execSql,\n    policies: context.policies,\n    stillCurrent: input?.stillCurrent,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\nexport async function finalizeProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly execSql?: ExecSql | undefined;\n    readonly persistVerificationCheckpoints?: boolean | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  if (input.persistVerificationCheckpoints === false) {\n    await validateProjectionCheckpoints(context, input);\n    return;\n  }\n  await commitProjectionCheckpoints(context, input);\n  if (input.stillCurrent?.() === false) return;\n  const organizationId =\n    context.organizationId ??\n    context.heldContainerHeads[0]?.state.organizationId;\n  if (organizationId === undefined) return;\n  try {\n    rememberVerifiedContainerHeads({\n      organizationId,\n      execSql: input.execSql ?? context.execSql,\n      heads: context.heldContainerHeads,\n      policies: context.policies,\n    });\n  } catch {\n    // Checkpoints are already committed. Optional re-citation evidence must\n    // never change successful verification into a caller-visible refusal.\n  }\n}\n"]}
+{"version":3,"file":"checkpointContext.js","sourceRoot":"","sources":["checkpointContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAEzF,OAAO,EAAE,gDAAgD,EAAE,MAAM,kDAAkD,CAAC;AAGpH,OAAO,EACL,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAc9D,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,EAAE;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,EAAE;QACzB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,KAGC;IAED,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoC,EACpC,MAAyC,EACzC,cAAmC;IAEnC,IACE,cAAc,KAAK,SAAS;QAC5B,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,cAAc,KAAK,cAAc,EACzC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC,EACpC,KAIC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,gCAAgC,CAAC;QACrC,uBAAuB,EAAE,KAAK,EAAE,uBAAuB;QACvD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,6BAA6B,CAC1C,OAAoC,EACpC,KAGC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,iCAAiC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAoC,EACpC,KAIC;IAED,IAAI,KAAK,CAAC,8BAA8B,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;YACzC,KAAK,EAAE,OAAO,CAAC,kBAAkB;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport { rememberVerifiedContainerHeads } from \"../containers/shared/heldContainerHeads\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport { PrincipalAuthorizationCheckpointUnavailableError } from \"../persistence/principalAuthorizationCheckpoints\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  enforceAccessManifestCheckpoints,\n  validateAccessManifestCheckpoints,\n} from \"./accessManifestCheckpointEnforcement\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { projectionLifetimeGuard } from \"./projectionLifetimes\";\nimport { assertProjectionVerificationCurrent } from \"./types\";\n\nexport interface ProjectionCheckpointContext {\n  readonly heldContainerHeads: VerifiedContainerAccessManifest[];\n  readonly execSql: ExecSql;\n  // Local checkpoints read during this verification, one read per object.\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  organizationId?: string | undefined;\n  readonly policies: PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];\n  readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];\n}\n\nexport function createProjectionCheckpointContext(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n}): ProjectionCheckpointContext {\n  if (typeof input.execSql !== \"function\") {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection verification requires durable keying checkpoint storage\",\n    );\n  }\n\n  return {\n    heldContainerHeads: [],\n    execSql: input.execSql,\n    localCheckpoints: new Map(),\n    organizationId: input.organizationId,\n    policies: [],\n    authorizationPolicies: [],\n    verifiedHeads: [],\n    verifiedManifests: [],\n  };\n}\n\nexport function observeAccessManifestCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n  },\n): void {\n  context.verifiedHeads.push(...input.verifiedHeads);\n  context.verifiedManifests.push(...input.verifiedManifests);\n}\n\nexport function observePrincipalPolicy(\n  context: ProjectionCheckpointContext,\n  policy: PrincipalPolicyCheckpointEvidence,\n  organizationId?: string | undefined,\n): void {\n  if (\n    organizationId !== undefined &&\n    context.organizationId !== undefined &&\n    context.organizationId !== organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"projection checkpoint batch crosses organization ownership\",\n    );\n  }\n  context.organizationId ??= organizationId;\n  context.policies.push(policy);\n}\n\nexport async function commitProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await enforceAccessManifestCheckpoints({\n    documentPurgeCheckpoint: input?.documentPurgeCheckpoint,\n    execSql: input?.execSql ?? context.execSql,\n    organizationId: context.organizationId,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\n/** Validates against the latest durable pins without persisting new heads. */\nasync function validateProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await validateAccessManifestCheckpoints({\n    execSql: input?.execSql ?? context.execSql,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\nexport async function finalizeProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly execSql?: ExecSql | undefined;\n    readonly persistVerificationCheckpoints?: boolean | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  if (input.persistVerificationCheckpoints === false) {\n    await validateProjectionCheckpoints(context, input);\n    return;\n  }\n  await commitProjectionCheckpoints(context, input);\n  if (input.stillCurrent?.() === false) return;\n  const organizationId =\n    context.organizationId ??\n    context.heldContainerHeads[0]?.state.organizationId;\n  if (organizationId === undefined) return;\n  try {\n    rememberVerifiedContainerHeads({\n      organizationId,\n      execSql: input.execSql ?? context.execSql,\n      heads: context.heldContainerHeads,\n      policies: context.policies,\n    });\n  } catch {\n    // Checkpoints are already committed. Optional re-citation evidence must\n    // never change successful verification into a caller-visible refusal.\n  }\n}\n"]}

package/data/keyingProjectionVerification/containerDestinationVerification.js

@@ -1,7 +1,9 @@
-import { createProjectionCheckpointContext } from "./checkpointContext.js";
+import { createProjectionCheckpointContext, finalizeProjectionCheckpoints, } from "./checkpointContext.js";
 import { verifyContainerManifestPath } from "./containerPathVerification.js";
 import { addContainerWriterProjectionBundles } from "./containerProjectionVerification.js";
 import { verifyProjectionAuthorizationEvidence } from "./projectionAuthorizationEvidence.js";
+import { projectionLifetimeGuard } from "./projectionLifetimes.js";
+import { assertProjectionVerificationCurrent } from "./types.js";
 /** Authenticate immutable destination roles without advancing write-authority pins. */
 export async function verifyContainerDestinationProjection(input) {
     const bundlesByHash = new Map();
@@ -19,6 +21,8 @@ export async function verifyContainerDestinationProjection(input) {
         organizationId: input.projection.organizationId,
         principalPolicyCache,
         resolveUserKey: input.resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
     });
     const path = await verifyContainerManifestPath({
         authorizationEvidence,
@@ -34,6 +38,12 @@ export async function verifyContainerDestinationProjection(input) {
         resolveUserKey: input.resolveUserKey,
         verifiedByHash,
     });
+    const current = projectionLifetimeGuard(checkpointContext, input.stillCurrent);
+    await finalizeProjectionCheckpoints(checkpointContext, {
+        stillCurrent: current,
+        persistVerificationCheckpoints: false,
+    });
+    assertProjectionVerificationCurrent(current);
     return { path, verifiedByHash };
 }
 //# sourceMappingURL=containerDestinationVerification.js.map

package/data/keyingProjectionVerification/containerDestinationVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerDestinationVerification.js","sourceRoot":"","sources":["containerDestinationVerification.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAG1F,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAI1D;IAKC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,mCAAmC,CACjC,aAAa,EACb,KAAK,CAAC,UAAU,EAChB,uBAAuB,CACxB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;KAChD,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAE,CAAC;IACvC,MAAM,qBAAqB,GAAG,MAAM,qCAAqC,CAAC;QACxE,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QACpC,iBAAiB;QACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC;QAC7C,qBAAqB;QACrB,4BAA4B,EAAE,IAAI;QAClC,uBAAuB,EAAE,YAAY;QACrC,aAAa;QACb,iBAAiB;QACjB,uBAAuB,EAAE,KAAK;QAC9B,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;KACf,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { createProjectionCheckpointContext } from \"./checkpointContext\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport { addContainerWriterProjectionBundles } from \"./containerProjectionVerification\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\n/** Authenticate immutable destination roles without advancing write-authority pins. */\nexport async function verifyContainerDestinationProjection(input: {\n  readonly execSql: ExecSql;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<{\n  readonly path: VerifiedContainerAccessManifest[];\n  /** Every manifest verified on the way, including each head's lineage. */\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addContainerWriterProjectionBundles(\n    bundlesByHash,\n    input.projection,\n    \"Container destination\",\n  );\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n    organizationId: input.projection.organizationId,\n  });\n  const principalPolicyCache = new Map();\n  const authorizationEvidence = await verifyProjectionAuthorizationEvidence({\n    bundles: [...bundlesByHash.values()],\n    checkpointContext,\n    policyEvidence: input.projection.policyEvidence,\n    organizationId: input.projection.organizationId,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const path = await verifyContainerManifestPath({\n    authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    authorizationMembership: \"referenced\",\n    bundlesByHash,\n    checkpointContext,\n    enforceLocalCheckpoints: false,\n    servedAsCurrent: false,\n    label: \"Container destination\",\n    path: input.projection.path,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash,\n  });\n  return { path, verifiedByHash };\n}\n"]}
+{"version":3,"file":"containerDestinationVerification.js","sourceRoot":"","sources":["containerDestinationVerification.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,iCAAiC,EACjC,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAKhE,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IAKC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,mCAAmC,CACjC,aAAa,EACb,KAAK,CAAC,UAAU,EAChB,uBAAuB,CACxB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;KAChD,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAE,CAAC;IACvC,MAAM,qBAAqB,GAAG,MAAM,qCAAqC,CAAC;QACxE,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QACpC,iBAAiB;QACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC;QAC7C,qBAAqB;QACrB,4BAA4B,EAAE,IAAI;QAClC,uBAAuB,EAAE,YAAY;QACrC,aAAa;QACb,iBAAiB;QACjB,uBAAuB,EAAE,KAAK;QAC9B,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CACrC,iBAAiB,EACjB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE;QACrD,YAAY,EAAE,OAAO;QACrB,8BAA8B,EAAE,KAAK;KACtC,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport { addContainerWriterProjectionBundles } from \"./containerProjectionVerification\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport { projectionLifetimeGuard } from \"./projectionLifetimes\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport { assertProjectionVerificationCurrent } from \"./types\";\n\n/** Authenticate immutable destination roles without advancing write-authority pins. */\nexport async function verifyContainerDestinationProjection(input: {\n  readonly execSql: ExecSql;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<{\n  readonly path: VerifiedContainerAccessManifest[];\n  /** Every manifest verified on the way, including each head's lineage. */\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addContainerWriterProjectionBundles(\n    bundlesByHash,\n    input.projection,\n    \"Container destination\",\n  );\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n    organizationId: input.projection.organizationId,\n  });\n  const principalPolicyCache = new Map();\n  const authorizationEvidence = await verifyProjectionAuthorizationEvidence({\n    bundles: [...bundlesByHash.values()],\n    checkpointContext,\n    policyEvidence: input.projection.policyEvidence,\n    organizationId: input.projection.organizationId,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const path = await verifyContainerManifestPath({\n    authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    authorizationMembership: \"referenced\",\n    bundlesByHash,\n    checkpointContext,\n    enforceLocalCheckpoints: false,\n    servedAsCurrent: false,\n    label: \"Container destination\",\n    path: input.projection.path,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash,\n  });\n  const current = projectionLifetimeGuard(\n    checkpointContext,\n    input.stillCurrent,\n  );\n  await finalizeProjectionCheckpoints(checkpointContext, {\n    stillCurrent: current,\n    persistVerificationCheckpoints: false,\n  });\n  assertProjectionVerificationCurrent(current);\n  return { path, verifiedByHash };\n}\n"]}

package/data/keyingProjectionVerification/containerManifestVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerManifestVerification.js","sourceRoot":"","sources":["containerManifestVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAE/B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gCAAgC,EAEhC,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAOzE,KAAK,UAAU,oCAAoC,CAAC,KAanD;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,wBAAwB,CAAC,MAAM,CACjE,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACF,IAAI,KAAK,CAAC,4BAA4B,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B;QACpC,OAAO,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,KAAK,CAAC,qBAAqB;QAC9B,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU,EAAE,qBAAqB;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAuBnD;IACC,MAAM,UAAU,GACd,MAAM,8CAA8C,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,CAAC;QACX,gCAAgC,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU;YACV,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,8BAA8B,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;gBACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,GAAG,EAAU,CAAC;IACvD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,6DAA6D,CAC5E,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,kCAAkC,CAC7C,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EACvB,UAAU,CACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAID,KAAK,UAAU,kCAAkC,CAC/C,KAAyB,EACzB,UAAsD;IAEtD,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,MAAM,CAAC,QAAQ,EACrB,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,qCAAqC,CAC/D,KAAK,EACL,KAAK,EACL,UAAU,CACX,CAAC;IACF,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC;IAC5E,MAAM,iBAAiB,GAAG,MAAM,oCAAoC,CAAC;QACnE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE;QACxD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE;YACxB,GAAG,aAAa,CAAC,wBAAwB;YACzC,GAAG,QAAQ,CAAC,wBAAwB;SACrC;QACD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B,IAAI,KAAK;QACzE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB;QACzD,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;SACxC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,wEAAwE;QACxE,iEAAiE;QACjE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,YAAY;QACtE,8BAA8B,EAAE,cAAc;QAC9C,KAAK;QACL,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ;QACR,mBAAmB,EAAE,cAAc;QACnC,iBAAiB;QACjB,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB;YAClB,CAAC,CAAC;gBACE,qBAAqB,EAAE,CAAC,GAAG,eAAe,EAAE,gBAAgB,CAAC;gBAC7D,gBAAgB;aACjB;YACH,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,GAAG,KAAK,CAAC,KAAK,kCAAkC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ,CAAC;QACzE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ;KAC9B,CAAC,CAAC;IACH,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpE,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qCAAqC,CAClD,KAAyB,EACzB,KAA+C,EAC/C,UAAsD;IAEtD,MAAM,gBAAgB,GACpB,KAAK,CAAC,KAAK,CAAC,oBAAoB,KAAK,IAAI;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,+BAA+B,CAAC;YACpC,GAAG,KAAK;YACR,UAAU;YACV,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,oBAAoB;SACvD,CAAC,CAAC;IACT,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAC7C,gBAAgB,IAAI,SAAS,KAAK,gBAAgB;QAChD,CAAC,CAAC,gBAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,qCAAqC,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,IACE,gBAAgB,KAAK,IAAI;QACzB,kBAAkB,KAAK,IAAI;QAC3B,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAClE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,yDAAyD,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAsB;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE;QAC/D,iBAAiB;KAClB,CAAC,CAAC;IACH,gCAAgC,CAAC;QAC/B,GAAG,OAAO;QACV,cAAc;QACd,gBAAgB;KACjB,CAAC,CAAC;IACH,wEAAwE;IACxE,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,eAAe,GACnB,SAAS,KAAK,gBAAgB,IAAI,gBAAgB;QAChD,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE;YACxC,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,iBAAiB;SAC5D,CAAC;QACJ,CAAC,CAAC,cAAc,CAAC;IACrB,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;QACvC,gCAAgC,CAAC;YAC/B,GAAG,OAAO;YACV,cAAc,EAAE,eAAe;YAC/B,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,GAAG,UAAU;QACb,GAAG,cAAc;QACjB,GAAG,CAAC,eAAe,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;KAC/D,CAAC;IACF,OAAO;QACL,cAAc;QACd,gBAAgB;QAChB,wBAAwB,EAAE;YACxB,GAAG,SAAS,CAAC,OAAO,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD;YACD,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;SAC5D;QACD,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAyB;IAC7D,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,yEAAyE;QACzE,yDAAyD;QACzD,mBAAmB,EAAE,CACnB,MAAwC,EACxC,KAAa,EACb,EAAE,CACF,6BAA6B,CAAC;YAC5B,GAAG,KAAK;YACR,uBAAuB,EAAE,YAAY;YACrC,MAAM;YACN,sBAAsB,EAAE,KAAK;YAC7B,KAAK;SACN,CAAC;KACL,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAyB,EACzB,KAA+C,EAC/C,SAAwD;IAExD,OAAO,wBAAwB,CAAC;QAC9B,GAAG,4BAA4B,CAAC,KAAK,CAAC;QACtC,KAAK;QACL,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,MAAM,wBAAwB,GAC5B,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;IAChD,IACE,wBAAwB,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,EAC5E,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,uBAAuB,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,mBAAmB,CAC1B,KAAc,EACd,KAAa;IAEb,OAAO,2BAA2B,CAAC,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO;YACL,iBAAiB,EAAE,wBAAwB,CACzC,MAAM,EACN,mBAAmB,EACnB,KAAK,CACN;YACD,kBAAkB,EAAE,wBAAwB,CAC1C,MAAM,EACN,oBAAoB,EACpB,KAAK,CACN;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oCAAoC,CAC3C,MAAwC,EACxC,KAAa;IAEb,OAAO,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,wEAAwE;AACxE,SAAS,qCAAqC,CAC5C,KAA+C,EAC/C,KAAa;IAEb,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAe7D;IACC,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAC7C,oCAAoC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,iBAAiB,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAChD,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QAChD,QAAQ,CAAC,YAAY,KAAK,kBAAkB,CAC/C,CAAC;IACF,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8CAA8C,CAC3E;QACE,GAAG,KAAK;QACR,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB;KACxC,CACF,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,6BAA6B,CAAC;QACzD,GAAG,KAAK;QACR,MAAM,EAAE,YAAY;QACpB,sBAAsB,EAAE,KAAK;QAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB;QACvC,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,KAAK,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,qCAAqC,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAiB9C;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,sBAAsB,KAAK,CAAC,oBAAoB,aAAa,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,8CAA8C,CAAC;QACtE,GAAG,KAAK;QACR,MAAM,EAAE,cAAc;KACvB,CAAC,CAAC;IAEH,OAAO,6BAA6B,CAAC;QACnC,uBAAuB,EAAE,YAAY;QACrC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,MAAM,EAAE,cAAc;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,sBAAsB,EAAE,KAAK;QAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,oBAAoB;QACzC,UAAU;QACV,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type VerifiedContainerAccessManifest,\n  verifyContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { readCanonicalJson, readCanonicalRecord } from \"../keyingCanonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport {\n  assertCanonicalEqual,\n  verifyAccessEventBundle,\n} from \"./bundleVerification\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport {\n  assertCitedAncestorsDoNotRegress,\n  type CitedLineageInput,\n  resolveCitedAncestorPath,\n} from \"./containerAncestorCitations\";\nimport { readKeyingVerificationShape } from \"./error\";\nimport {\n  loadManifestCheckpointVerification,\n  verifyCachedManifestCheckpoint,\n} from \"./manifestCheckpointVerification\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { readAccessManifest, readRecordNullableString } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nasync function collectManifestAuthorizationPolicies(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly referencedPrincipalHeads: Parameters<\n    typeof principalPolicyMatchesReference\n  >[0][\"reference\"][];\n  readonly requireAuthorizationEvidence: boolean;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}) {\n  const missingPrincipalHeads = input.referencedPrincipalHeads.filter(\n    (reference) =>\n      !input.authorizationEvidence.some((policy) =>\n        principalPolicyMatchesReference({ policy, reference }),\n      ),\n  );\n  if (input.requireAuthorizationEvidence && missingPrincipalHeads.length > 0) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  }\n  if (input.requireAuthorizationEvidence)\n    return [...input.authorizationEvidence];\n  return [\n    ...input.authorizationEvidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references: missingPrincipalHeads,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport async function verifyContainerManifestBundle(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyCheckpointEvidence[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoint: boolean;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  // Manifest hashes whose verification is in progress up the call stack.\n  // Previous manifests, pinned parents, and cited ancestors all recurse\n  // before a bundle's own hash is checked, so served bundles that refer to\n  // each other under claimed hashes would otherwise recurse without end.\n  readonly verifying?: Set<string> | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest> {\n  const parentPath =\n    await resolveContainerManifestVerificationParentPath(input);\n  const cached = input.verifiedByHash.get(input.bundle.manifestHash);\n  if (cached) {\n    assertContainerParentPathMatches({\n      label: input.label,\n      parentPath,\n      verifiedManifest: cached,\n    });\n    if (input.enforceLocalCheckpoint) {\n      await verifyCachedManifestCheckpoint({\n        current: cached,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      });\n    }\n    return cached;\n  }\n\n  const verifying = input.verifying ?? new Set<string>();\n  if (verifying.has(input.bundle.manifestHash)) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} refers back to a manifest whose verification it is part of`,\n    );\n  }\n  verifying.add(input.bundle.manifestHash);\n  try {\n    return await verifyFreshContainerManifestBundle(\n      { ...input, verifying },\n      parentPath,\n    );\n  } finally {\n    verifying.delete(input.bundle.manifestHash);\n  }\n}\n\ntype CitedAncestorInput = Parameters<typeof verifyContainerManifestBundle>[0];\n\nasync function verifyFreshContainerManifestBundle(\n  input: CitedAncestorInput,\n  parentPath: readonly VerifiedContainerAccessManifest[],\n): Promise<VerifiedContainerAccessManifest> {\n  const event = await verifyAccessEventBundle(input);\n  const manifest = readAccessManifest(\n    input.bundle.manifest,\n    `${input.label} manifest`,\n  );\n  const authorization = await resolveContainerManifestAuthorization(\n    input,\n    event,\n    parentPath,\n  );\n  const { citedAncestors, previousManifest, sourceAncestors } = authorization;\n  const principalPolicies = await collectManifestAuthorizationPolicies({\n    authorizationEvidence: input.authorizationEvidence ?? [],\n    checkpointContext: input.checkpointContext,\n    organizationId: event.event.organizationId,\n    principalPolicyCache: input.principalPolicyCache,\n    referencedPrincipalHeads: [\n      ...authorization.referencedPrincipalHeads,\n      ...manifest.referencedPrincipalHeads,\n    ],\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence ?? false,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const checkpointVerification = input.enforceLocalCheckpoint\n    ? await loadManifestCheckpointVerification({\n        current: manifest,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      })\n    : null;\n\n  const verified = await verifyContainerAccessManifest({\n    // Served manifests were committed under their signed policy references.\n    // Current membership still gates new writes in the API verifier.\n    authorizationMembership: input.authorizationMembership ?? \"referenced\",\n    destinationParentContainerPath: citedAncestors,\n    event,\n    expectedManifestHash: input.bundle.manifestHash,\n    manifest,\n    parentContainerPath: citedAncestors,\n    principalPolicies,\n    ...(checkpointVerification ?? {}),\n    ...(previousManifest\n      ? {\n          previousContainerPath: [...sourceAncestors, previousManifest],\n          previousManifest,\n        }\n      : { previousManifest: null }),\n  });\n  if (!verified.ok) {\n    throw new KeyingVerificationError(\n      verified.error.code,\n      `${input.label} manifest verification failed: ${verified.error.message}`,\n    );\n  }\n\n  assertCanonicalEqual({\n    actual: input.bundle.state,\n    expected: readCanonicalJson(verified.value.state, `${input.label} state`),\n    label: `${input.label} state`,\n  });\n  input.verifiedByHash.set(input.bundle.manifestHash, verified.value);\n\n  return verified.value;\n}\n\n/**\n * The paths a container event is authorized against: its previous manifest\n * and the ancestor heads its signed event cites, root to parent.\n */\nasync function resolveContainerManifestAuthorization(\n  input: CitedAncestorInput,\n  event: VerifiedContainerAccessManifest[\"event\"],\n  parentPath: readonly VerifiedContainerAccessManifest[],\n) {\n  const previousManifest =\n    event.event.previousManifestHash === null\n      ? null\n      : await verifyPreviousContainerManifest({\n          ...input,\n          parentPath,\n          previousManifestHash: event.event.previousManifestHash,\n        });\n  // Resolve the signed placement lineage, never the server-supplied wire state.\n  // Rotations also resolve their new epoch's exact signed parent citation via\n  // cited-ancestor verification below; that can differ from this previous path.\n  const eventType = event.event.eventType;\n  const { parentContainerId, parentManifestHash } =\n    previousManifest && eventType !== \"container.move\"\n      ? previousManifest.state\n      : readContainerEventBodyParentReference(event, input.label);\n  if (\n    previousManifest === null &&\n    parentManifestHash !== null &&\n    !event.event.dependencyManifestHashes.includes(parentManifestHash)\n  ) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} does not cite the parent manifest it was created under`,\n    );\n  }\n  const lineage: CitedLineageInput = {\n    bundlesByHash: input.bundlesByHash,\n    label: input.label,\n    verifiedByHash: input.verifiedByHash,\n  };\n  const citedAncestors = await resolveCitedAncestors(input, event, {\n    parentContainerId,\n  });\n  assertCitedAncestorsDoNotRegress({\n    ...lineage,\n    citedAncestors,\n    previousManifest,\n  });\n  // A move's source path leads to the previous manifest's parent, and the\n  // move event cites that path too; the destination path is the one above.\n  // The source path is held to the same no-regression rule.\n  const sourceAncestors =\n    eventType === \"container.move\" && previousManifest\n      ? await resolveCitedAncestors(input, event, {\n          parentContainerId: previousManifest.state.parentContainerId,\n        })\n      : citedAncestors;\n  if (sourceAncestors !== citedAncestors) {\n    assertCitedAncestorsDoNotRegress({\n      ...lineage,\n      citedAncestors: sourceAncestors,\n      previousManifest,\n    });\n  }\n  const ancestors = [\n    ...parentPath,\n    ...citedAncestors,\n    ...(sourceAncestors === citedAncestors ? [] : sourceAncestors),\n  ];\n  return {\n    citedAncestors,\n    previousManifest,\n    referencedPrincipalHeads: [\n      ...ancestors.flatMap(\n        (ancestor) => ancestor.state.referencedPrincipalHeads,\n      ),\n      ...(previousManifest?.state.referencedPrincipalHeads ?? []),\n    ],\n    sourceAncestors,\n  };\n}\n\nfunction citedAncestorResolutionInput(input: CitedAncestorInput) {\n  return {\n    bundlesByHash: input.bundlesByHash,\n    label: input.label,\n    verifiedByHash: input.verifiedByHash,\n    // A cited head older than the served one is history: authorize it at the\n    // membership it referenced, as the previous manifest is.\n    verifyHistoryBundle: (\n      bundle: AccessManifestBundleWireResponse,\n      label: string,\n    ) =>\n      verifyContainerManifestBundle({\n        ...input,\n        authorizationMembership: \"referenced\",\n        bundle,\n        enforceLocalCheckpoint: false,\n        label,\n      }),\n  };\n}\n\nfunction resolveCitedAncestors(\n  input: CitedAncestorInput,\n  event: VerifiedContainerAccessManifest[\"event\"],\n  reference: { readonly parentContainerId: string | null },\n): Promise<VerifiedContainerAccessManifest[]> {\n  return resolveCitedAncestorPath({\n    ...citedAncestorResolutionInput(input),\n    event,\n    parentContainerId: reference.parentContainerId,\n  });\n}\n\nfunction assertContainerParentPathMatches(input: {\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n}): void {\n  const actualParentManifestHash =\n    input.parentPath.at(-1)?.manifestHash ?? null;\n  if (\n    actualParentManifestHash !== input.verifiedManifest.state.parentManifestHash\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} parent path mismatch`,\n    );\n  }\n}\n\ninterface ContainerParentReference {\n  parentContainerId: string | null;\n  parentManifestHash: string | null;\n}\n\nfunction readParentReference(\n  value: unknown,\n  label: string,\n): ContainerParentReference {\n  return readKeyingVerificationShape(() => {\n    const record = readCanonicalRecord(value, label);\n\n    return {\n      parentContainerId: readRecordNullableString(\n        record,\n        \"parentContainerId\",\n        label,\n      ),\n      parentManifestHash: readRecordNullableString(\n        record,\n        \"parentManifestHash\",\n        label,\n      ),\n    };\n  });\n}\n\nfunction readContainerManifestParentReference(\n  bundle: AccessManifestBundleWireResponse,\n  label: string,\n): ContainerParentReference {\n  return readParentReference(bundle.state, `${label} state`);\n}\n\n/** The parent a create or move body pins, read from the signed body. */\nfunction readContainerEventBodyParentReference(\n  event: VerifiedContainerAccessManifest[\"event\"],\n  label: string,\n): ContainerParentReference {\n  return readParentReference(event.body, `${label} event body`);\n}\n\nasync function resolveContainerManifestVerificationParentPath(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyCheckpointEvidence[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<readonly VerifiedContainerAccessManifest[]> {\n  // Descendants keep the parent manifest hash they were created or moved under;\n  // a later parent share/rekey must not require rewriting descendant manifests.\n  const { parentContainerId, parentManifestHash } =\n    readContainerManifestParentReference(input.bundle, input.label);\n  if (parentContainerId === null || parentManifestHash === null) {\n    return [];\n  }\n\n  const parentPathIndex = input.parentPath.findIndex(\n    (manifest) =>\n      manifest.state.containerId === parentContainerId &&\n      manifest.manifestHash === parentManifestHash,\n  );\n  if (parentPathIndex >= 0) {\n    return input.parentPath.slice(0, parentPathIndex + 1);\n  }\n\n  const parentBundle = input.bundlesByHash.get(parentManifestHash);\n  if (!parentBundle) {\n    return input.parentPath;\n  }\n\n  const parentParentPath = await resolveContainerManifestVerificationParentPath(\n    {\n      ...input,\n      bundle: parentBundle,\n      label: `${input.label} parent manifest`,\n    },\n  );\n  const verifiedParent = await verifyContainerManifestBundle({\n    ...input,\n    bundle: parentBundle,\n    enforceLocalCheckpoint: false,\n    label: `${input.label} parent manifest`,\n    parentPath: parentParentPath,\n  });\n  if (verifiedParent.state.containerId !== parentContainerId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} parent manifest container mismatch`,\n    );\n  }\n\n  return [...parentParentPath, verifiedParent];\n}\n\nasync function verifyPreviousContainerManifest(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyCheckpointEvidence[]\n    | undefined;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly previousManifestHash: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly verifying?: Set<string> | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest> {\n  const previousBundle = input.bundlesByHash.get(input.previousManifestHash);\n  if (!previousBundle) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} previous manifest ${input.previousManifestHash} is missing`,\n    );\n  }\n  const parentPath = await resolveContainerManifestVerificationParentPath({\n    ...input,\n    bundle: previousBundle,\n  });\n\n  return verifyContainerManifestBundle({\n    authorizationMembership: \"referenced\",\n    authorizationEvidence: input.authorizationEvidence,\n    bundle: previousBundle,\n    bundlesByHash: input.bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    enforceLocalCheckpoint: false,\n    label: `${input.label} previous manifest`,\n    parentPath,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n    verifiedByHash: input.verifiedByHash,\n    verifying: input.verifying,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}
+{"version":3,"file":"containerManifestVerification.js","sourceRoot":"","sources":["containerManifestVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAE/B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gCAAgC,EAEhC,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAOzE,KAAK,UAAU,oCAAoC,CAAC,KAanD;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,wBAAwB,CAAC,MAAM,CACjE,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACF,IAAI,KAAK,CAAC,4BAA4B,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B;QACpC,OAAO,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,KAAK,CAAC,qBAAqB;QAC9B,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU,EAAE,qBAAqB;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAuBnD;IACC,MAAM,UAAU,GACd,MAAM,8CAA8C,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,CAAC;QACX,gCAAgC,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU;YACV,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,8BAA8B,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;gBACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,GAAG,EAAU,CAAC;IACvD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,6DAA6D,CAC5E,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,kCAAkC,CAC7C,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EACvB,UAAU,CACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAID,KAAK,UAAU,kCAAkC,CAC/C,KAAyB,EACzB,UAAsD;IAEtD,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,MAAM,CAAC,QAAQ,EACrB,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,qCAAqC,CAC/D,KAAK,EACL,KAAK,EACL,UAAU,CACX,CAAC;IACF,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC;IAC5E,MAAM,iBAAiB,GAAG,MAAM,oCAAoC,CAAC;QACnE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE;QACxD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE;YACxB,GAAG,aAAa,CAAC,wBAAwB;YACzC,GAAG,QAAQ,CAAC,wBAAwB;SACrC;QACD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B,IAAI,KAAK;QACzE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB;QACzD,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;SACxC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,wEAAwE;QACxE,iEAAiE;QACjE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,YAAY;QACtE,8BAA8B,EAAE,cAAc;QAC9C,KAAK;QACL,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ;QACR,mBAAmB,EAAE,cAAc;QACnC,iBAAiB;QACjB,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB;YAClB,CAAC,CAAC;gBACE,qBAAqB,EAAE,CAAC,GAAG,eAAe,EAAE,gBAAgB,CAAC;gBAC7D,gBAAgB;aACjB;YACH,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,GAAG,KAAK,CAAC,KAAK,kCAAkC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ,CAAC;QACzE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ;KAC9B,CAAC,CAAC;IACH,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpE,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qCAAqC,CAClD,KAAyB,EACzB,KAA+C,EAC/C,UAAsD;IAEtD,MAAM,gBAAgB,GACpB,KAAK,CAAC,KAAK,CAAC,oBAAoB,KAAK,IAAI;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,+BAA+B,CAAC;YACpC,GAAG,KAAK;YACR,UAAU;YACV,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,oBAAoB;SACvD,CAAC,CAAC;IACT,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAC7C,gBAAgB,IAAI,SAAS,KAAK,gBAAgB;QAChD,CAAC,CAAC,gBAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,qCAAqC,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,IACE,gBAAgB,KAAK,IAAI;QACzB,kBAAkB,KAAK,IAAI;QAC3B,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAClE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,yDAAyD,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAsB;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE;QAC/D,iBAAiB;KAClB,CAAC,CAAC;IACH,gCAAgC,CAAC;QAC/B,GAAG,OAAO;QACV,cAAc;QACd,gBAAgB;KACjB,CAAC,CAAC;IACH,wEAAwE;IACxE,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,eAAe,GACnB,SAAS,KAAK,gBAAgB,IAAI,gBAAgB;QAChD,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE;YACxC,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,iBAAiB;SAC5D,CAAC;QACJ,CAAC,CAAC,cAAc,CAAC;IACrB,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;QACvC,gCAAgC,CAAC;YAC/B,GAAG,OAAO;YACV,cAAc,EAAE,eAAe;YAC/B,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,GAAG,UAAU;QACb,GAAG,cAAc;QACjB,GAAG,CAAC,eAAe,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;KAC/D,CAAC;IACF,OAAO;QACL,cAAc;QACd,gBAAgB;QAChB,wBAAwB,EAAE;YACxB,GAAG,SAAS,CAAC,OAAO,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD;YACD,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;SAC5D;QACD,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAyB;IAC7D,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,yEAAyE;QACzE,yDAAyD;QACzD,mBAAmB,EAAE,CACnB,MAAwC,EACxC,KAAa,EACb,EAAE,CACF,6BAA6B,CAAC;YAC5B,GAAG,KAAK;YACR,uBAAuB,EAAE,YAAY;YACrC,MAAM;YACN,sBAAsB,EAAE,KAAK;YAC7B,KAAK;SACN,CAAC;KACL,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAyB,EACzB,KAA+C,EAC/C,SAAwD;IAExD,OAAO,wBAAwB,CAAC;QAC9B,GAAG,4BAA4B,CAAC,KAAK,CAAC;QACtC,KAAK;QACL,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,MAAM,wBAAwB,GAC5B,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;IAChD,IACE,wBAAwB,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,EAC5E,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,uBAAuB,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,mBAAmB,CAC1B,KAAc,EACd,KAAa;IAEb,OAAO,2BAA2B,CAAC,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO;YACL,iBAAiB,EAAE,wBAAwB,CACzC,MAAM,EACN,mBAAmB,EACnB,KAAK,CACN;YACD,kBAAkB,EAAE,wBAAwB,CAC1C,MAAM,EACN,oBAAoB,EACpB,KAAK,CACN;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oCAAoC,CAC3C,MAAwC,EACxC,KAAa;IAEb,OAAO,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,wEAAwE;AACxE,SAAS,qCAAqC,CAC5C,KAA+C,EAC/C,KAAa;IAEb,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAe7D;IACC,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAC7C,oCAAoC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,iBAAiB,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAChD,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QAChD,QAAQ,CAAC,YAAY,KAAK,kBAAkB,CAC/C,CAAC;IACF,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8CAA8C,CAC3E;QACE,GAAG,KAAK;QACR,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB;KACxC,CACF,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,6BAA6B,CAAC;QACzD,GAAG,KAAK;QACR,MAAM,EAAE,YAAY;QACpB,sBAAsB,EAAE,KAAK;QAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB;QACvC,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,KAAK,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,qCAAqC,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAiB9C;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,sBAAsB,KAAK,CAAC,oBAAoB,aAAa,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,8CAA8C,CAAC;QACtE,GAAG,KAAK;QACR,MAAM,EAAE,cAAc;KACvB,CAAC,CAAC;IAEH,OAAO,6BAA6B,CAAC;QACnC,uBAAuB,EAAE,YAAY;QACrC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,MAAM,EAAE,cAAc;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,sBAAsB,EAAE,KAAK;QAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,oBAAoB;QACzC,UAAU;QACV,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type VerifiedContainerAccessManifest,\n  verifyContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { readCanonicalJson, readCanonicalRecord } from \"../keyingCanonicalJson\";\nimport {\n  assertCanonicalEqual,\n  verifyAccessEventBundle,\n} from \"./bundleVerification\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport {\n  assertCitedAncestorsDoNotRegress,\n  type CitedLineageInput,\n  resolveCitedAncestorPath,\n} from \"./containerAncestorCitations\";\nimport { readKeyingVerificationShape } from \"./error\";\nimport {\n  loadManifestCheckpointVerification,\n  verifyCachedManifestCheckpoint,\n} from \"./manifestCheckpointVerification\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { readAccessManifest, readRecordNullableString } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nasync function collectManifestAuthorizationPolicies(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly referencedPrincipalHeads: Parameters<\n    typeof principalPolicyMatchesReference\n  >[0][\"reference\"][];\n  readonly requireAuthorizationEvidence: boolean;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}) {\n  const missingPrincipalHeads = input.referencedPrincipalHeads.filter(\n    (reference) =>\n      !input.authorizationEvidence.some((policy) =>\n        principalPolicyMatchesReference({ policy, reference }),\n      ),\n  );\n  if (input.requireAuthorizationEvidence && missingPrincipalHeads.length > 0) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  }\n  if (input.requireAuthorizationEvidence)\n    return [...input.authorizationEvidence];\n  return [\n    ...input.authorizationEvidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references: missingPrincipalHeads,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport async function verifyContainerManifestBundle(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoint: boolean;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  // Manifest hashes whose verification is in progress up the call stack.\n  // Previous manifests, pinned parents, and cited ancestors all recurse\n  // before a bundle's own hash is checked, so served bundles that refer to\n  // each other under claimed hashes would otherwise recurse without end.\n  readonly verifying?: Set<string> | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest> {\n  const parentPath =\n    await resolveContainerManifestVerificationParentPath(input);\n  const cached = input.verifiedByHash.get(input.bundle.manifestHash);\n  if (cached) {\n    assertContainerParentPathMatches({\n      label: input.label,\n      parentPath,\n      verifiedManifest: cached,\n    });\n    if (input.enforceLocalCheckpoint) {\n      await verifyCachedManifestCheckpoint({\n        current: cached,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      });\n    }\n    return cached;\n  }\n\n  const verifying = input.verifying ?? new Set<string>();\n  if (verifying.has(input.bundle.manifestHash)) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} refers back to a manifest whose verification it is part of`,\n    );\n  }\n  verifying.add(input.bundle.manifestHash);\n  try {\n    return await verifyFreshContainerManifestBundle(\n      { ...input, verifying },\n      parentPath,\n    );\n  } finally {\n    verifying.delete(input.bundle.manifestHash);\n  }\n}\n\ntype CitedAncestorInput = Parameters<typeof verifyContainerManifestBundle>[0];\n\nasync function verifyFreshContainerManifestBundle(\n  input: CitedAncestorInput,\n  parentPath: readonly VerifiedContainerAccessManifest[],\n): Promise<VerifiedContainerAccessManifest> {\n  const event = await verifyAccessEventBundle(input);\n  const manifest = readAccessManifest(\n    input.bundle.manifest,\n    `${input.label} manifest`,\n  );\n  const authorization = await resolveContainerManifestAuthorization(\n    input,\n    event,\n    parentPath,\n  );\n  const { citedAncestors, previousManifest, sourceAncestors } = authorization;\n  const principalPolicies = await collectManifestAuthorizationPolicies({\n    authorizationEvidence: input.authorizationEvidence ?? [],\n    checkpointContext: input.checkpointContext,\n    organizationId: event.event.organizationId,\n    principalPolicyCache: input.principalPolicyCache,\n    referencedPrincipalHeads: [\n      ...authorization.referencedPrincipalHeads,\n      ...manifest.referencedPrincipalHeads,\n    ],\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence ?? false,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const checkpointVerification = input.enforceLocalCheckpoint\n    ? await loadManifestCheckpointVerification({\n        current: manifest,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      })\n    : null;\n\n  const verified = await verifyContainerAccessManifest({\n    // Served manifests were committed under their signed policy references.\n    // Current membership still gates new writes in the API verifier.\n    authorizationMembership: input.authorizationMembership ?? \"referenced\",\n    destinationParentContainerPath: citedAncestors,\n    event,\n    expectedManifestHash: input.bundle.manifestHash,\n    manifest,\n    parentContainerPath: citedAncestors,\n    principalPolicies,\n    ...(checkpointVerification ?? {}),\n    ...(previousManifest\n      ? {\n          previousContainerPath: [...sourceAncestors, previousManifest],\n          previousManifest,\n        }\n      : { previousManifest: null }),\n  });\n  if (!verified.ok) {\n    throw new KeyingVerificationError(\n      verified.error.code,\n      `${input.label} manifest verification failed: ${verified.error.message}`,\n    );\n  }\n\n  assertCanonicalEqual({\n    actual: input.bundle.state,\n    expected: readCanonicalJson(verified.value.state, `${input.label} state`),\n    label: `${input.label} state`,\n  });\n  input.verifiedByHash.set(input.bundle.manifestHash, verified.value);\n\n  return verified.value;\n}\n\n/**\n * The paths a container event is authorized against: its previous manifest\n * and the ancestor heads its signed event cites, root to parent.\n */\nasync function resolveContainerManifestAuthorization(\n  input: CitedAncestorInput,\n  event: VerifiedContainerAccessManifest[\"event\"],\n  parentPath: readonly VerifiedContainerAccessManifest[],\n) {\n  const previousManifest =\n    event.event.previousManifestHash === null\n      ? null\n      : await verifyPreviousContainerManifest({\n          ...input,\n          parentPath,\n          previousManifestHash: event.event.previousManifestHash,\n        });\n  // Resolve the signed placement lineage, never the server-supplied wire state.\n  // Rotations also resolve their new epoch's exact signed parent citation via\n  // cited-ancestor verification below; that can differ from this previous path.\n  const eventType = event.event.eventType;\n  const { parentContainerId, parentManifestHash } =\n    previousManifest && eventType !== \"container.move\"\n      ? previousManifest.state\n      : readContainerEventBodyParentReference(event, input.label);\n  if (\n    previousManifest === null &&\n    parentManifestHash !== null &&\n    !event.event.dependencyManifestHashes.includes(parentManifestHash)\n  ) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} does not cite the parent manifest it was created under`,\n    );\n  }\n  const lineage: CitedLineageInput = {\n    bundlesByHash: input.bundlesByHash,\n    label: input.label,\n    verifiedByHash: input.verifiedByHash,\n  };\n  const citedAncestors = await resolveCitedAncestors(input, event, {\n    parentContainerId,\n  });\n  assertCitedAncestorsDoNotRegress({\n    ...lineage,\n    citedAncestors,\n    previousManifest,\n  });\n  // A move's source path leads to the previous manifest's parent, and the\n  // move event cites that path too; the destination path is the one above.\n  // The source path is held to the same no-regression rule.\n  const sourceAncestors =\n    eventType === \"container.move\" && previousManifest\n      ? await resolveCitedAncestors(input, event, {\n          parentContainerId: previousManifest.state.parentContainerId,\n        })\n      : citedAncestors;\n  if (sourceAncestors !== citedAncestors) {\n    assertCitedAncestorsDoNotRegress({\n      ...lineage,\n      citedAncestors: sourceAncestors,\n      previousManifest,\n    });\n  }\n  const ancestors = [\n    ...parentPath,\n    ...citedAncestors,\n    ...(sourceAncestors === citedAncestors ? [] : sourceAncestors),\n  ];\n  return {\n    citedAncestors,\n    previousManifest,\n    referencedPrincipalHeads: [\n      ...ancestors.flatMap(\n        (ancestor) => ancestor.state.referencedPrincipalHeads,\n      ),\n      ...(previousManifest?.state.referencedPrincipalHeads ?? []),\n    ],\n    sourceAncestors,\n  };\n}\n\nfunction citedAncestorResolutionInput(input: CitedAncestorInput) {\n  return {\n    bundlesByHash: input.bundlesByHash,\n    label: input.label,\n    verifiedByHash: input.verifiedByHash,\n    // A cited head older than the served one is history: authorize it at the\n    // membership it referenced, as the previous manifest is.\n    verifyHistoryBundle: (\n      bundle: AccessManifestBundleWireResponse,\n      label: string,\n    ) =>\n      verifyContainerManifestBundle({\n        ...input,\n        authorizationMembership: \"referenced\",\n        bundle,\n        enforceLocalCheckpoint: false,\n        label,\n      }),\n  };\n}\n\nfunction resolveCitedAncestors(\n  input: CitedAncestorInput,\n  event: VerifiedContainerAccessManifest[\"event\"],\n  reference: { readonly parentContainerId: string | null },\n): Promise<VerifiedContainerAccessManifest[]> {\n  return resolveCitedAncestorPath({\n    ...citedAncestorResolutionInput(input),\n    event,\n    parentContainerId: reference.parentContainerId,\n  });\n}\n\nfunction assertContainerParentPathMatches(input: {\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n}): void {\n  const actualParentManifestHash =\n    input.parentPath.at(-1)?.manifestHash ?? null;\n  if (\n    actualParentManifestHash !== input.verifiedManifest.state.parentManifestHash\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} parent path mismatch`,\n    );\n  }\n}\n\ninterface ContainerParentReference {\n  parentContainerId: string | null;\n  parentManifestHash: string | null;\n}\n\nfunction readParentReference(\n  value: unknown,\n  label: string,\n): ContainerParentReference {\n  return readKeyingVerificationShape(() => {\n    const record = readCanonicalRecord(value, label);\n\n    return {\n      parentContainerId: readRecordNullableString(\n        record,\n        \"parentContainerId\",\n        label,\n      ),\n      parentManifestHash: readRecordNullableString(\n        record,\n        \"parentManifestHash\",\n        label,\n      ),\n    };\n  });\n}\n\nfunction readContainerManifestParentReference(\n  bundle: AccessManifestBundleWireResponse,\n  label: string,\n): ContainerParentReference {\n  return readParentReference(bundle.state, `${label} state`);\n}\n\n/** The parent a create or move body pins, read from the signed body. */\nfunction readContainerEventBodyParentReference(\n  event: VerifiedContainerAccessManifest[\"event\"],\n  label: string,\n): ContainerParentReference {\n  return readParentReference(event.body, `${label} event body`);\n}\n\nasync function resolveContainerManifestVerificationParentPath(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<readonly VerifiedContainerAccessManifest[]> {\n  // Descendants keep the parent manifest hash they were created or moved under;\n  // a later parent share/rekey must not require rewriting descendant manifests.\n  const { parentContainerId, parentManifestHash } =\n    readContainerManifestParentReference(input.bundle, input.label);\n  if (parentContainerId === null || parentManifestHash === null) {\n    return [];\n  }\n\n  const parentPathIndex = input.parentPath.findIndex(\n    (manifest) =>\n      manifest.state.containerId === parentContainerId &&\n      manifest.manifestHash === parentManifestHash,\n  );\n  if (parentPathIndex >= 0) {\n    return input.parentPath.slice(0, parentPathIndex + 1);\n  }\n\n  const parentBundle = input.bundlesByHash.get(parentManifestHash);\n  if (!parentBundle) {\n    return input.parentPath;\n  }\n\n  const parentParentPath = await resolveContainerManifestVerificationParentPath(\n    {\n      ...input,\n      bundle: parentBundle,\n      label: `${input.label} parent manifest`,\n    },\n  );\n  const verifiedParent = await verifyContainerManifestBundle({\n    ...input,\n    bundle: parentBundle,\n    enforceLocalCheckpoint: false,\n    label: `${input.label} parent manifest`,\n    parentPath: parentParentPath,\n  });\n  if (verifiedParent.state.containerId !== parentContainerId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} parent manifest container mismatch`,\n    );\n  }\n\n  return [...parentParentPath, verifiedParent];\n}\n\nasync function verifyPreviousContainerManifest(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly previousManifestHash: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly verifying?: Set<string> | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest> {\n  const previousBundle = input.bundlesByHash.get(input.previousManifestHash);\n  if (!previousBundle) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} previous manifest ${input.previousManifestHash} is missing`,\n    );\n  }\n  const parentPath = await resolveContainerManifestVerificationParentPath({\n    ...input,\n    bundle: previousBundle,\n  });\n\n  return verifyContainerManifestBundle({\n    authorizationMembership: \"referenced\",\n    authorizationEvidence: input.authorizationEvidence,\n    bundle: previousBundle,\n    bundlesByHash: input.bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    enforceLocalCheckpoint: false,\n    label: `${input.label} previous manifest`,\n    parentPath,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n    verifiedByHash: input.verifiedByHash,\n    verifying: input.verifying,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/containerPathVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerPathVerification.js","sourceRoot":"","sources":["containerPathVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AAOpF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAkBjD;IACC,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,YAAY,GAAsC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,sBAAsB,EAAE,KAAK,CAAC,uBAAuB;YACrD,KAAK;YACL,UAAU,EAAE,YAAY;YACxB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;YAChE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,wEAAwE;QACxE,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;QACxE,IAAI,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,mDAAmD,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,yCAAyC,CAAC;gBACxC,IAAI,EAAE,QAAQ;gBACd,KAAK;gBACL,eAAe,EAAE,YAAY;gBAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;QACL,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,oCAAoC,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;QACxC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { assertServedAncestorsDescendFromCitations } from \"./containerAncestorCitations\";\nimport { verifyContainerManifestBundle } from \"./containerManifestVerification\";\nimport { rememberRootBoundOrganizationFounder } from \"./organizationFounderBinding\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nexport async function verifyContainerManifestPath(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyCheckpointEvidence[]\n    | undefined;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoints: boolean;\n  readonly servedAsCurrent: boolean;\n  readonly label: string;\n  readonly path: readonly AccessManifestBundleWireResponse[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest[]> {\n  // Historical signer membership and current-path freshness are independent:\n  // current heads may have been signed before a group member was removed.\n  const verifiedPath: VerifiedContainerAccessManifest[] = [];\n  for (const [index, bundle] of input.path.entries()) {\n    const label = `${input.label}[${index}]`;\n    const verified = await verifyContainerManifestBundle({\n      authorizationMembership: input.authorizationMembership,\n      authorizationEvidence: input.authorizationEvidence,\n      bundle,\n      bundlesByHash: input.bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoint: input.enforceLocalCheckpoints,\n      label,\n      parentPath: verifiedPath,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n      verifiedByHash: input.verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    // Access along a path is the union of its elements' grants, so a served\n    // path must be a genuine root-to-leaf ancestor chain: each element is the\n    // parent of the next, and the first is a root.\n    const expectedParentId = verifiedPath.at(-1)?.state.containerId ?? null;\n    if (verified.state.parentContainerId !== expectedParentId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `${label} parent container does not precede it in the path`,\n      );\n    }\n    if (input.servedAsCurrent) {\n      assertServedAncestorsDescendFromCitations({\n        head: verified,\n        label,\n        servedAncestors: verifiedPath,\n        verifiedByHash: input.verifiedByHash,\n      });\n    }\n    verifiedPath.push(verified);\n  }\n\n  await rememberRootBoundOrganizationFounder({\n    execSql: input.checkpointContext.execSql,\n    policies: input.authorizationEvidence,\n    root: verifiedPath[0],\n    verifiedByHash: input.verifiedByHash,\n  });\n  return verifiedPath;\n}\n"]}
+{"version":3,"file":"containerPathVerification.js","sourceRoot":"","sources":["containerPathVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AAOpF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAkBjD;IACC,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,YAAY,GAAsC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,sBAAsB,EAAE,KAAK,CAAC,uBAAuB;YACrD,KAAK;YACL,UAAU,EAAE,YAAY;YACxB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;YAChE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,wEAAwE;QACxE,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;QACxE,IAAI,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,mDAAmD,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,yCAAyC,CAAC;gBACxC,IAAI,EAAE,QAAQ;gBACd,KAAK;gBACL,eAAe,EAAE,YAAY;gBAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;QACL,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,oCAAoC,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;QACxC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { assertServedAncestorsDescendFromCitations } from \"./containerAncestorCitations\";\nimport { verifyContainerManifestBundle } from \"./containerManifestVerification\";\nimport { rememberRootBoundOrganizationFounder } from \"./organizationFounderBinding\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nexport async function verifyContainerManifestPath(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoints: boolean;\n  readonly servedAsCurrent: boolean;\n  readonly label: string;\n  readonly path: readonly AccessManifestBundleWireResponse[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest[]> {\n  // Historical signer membership and current-path freshness are independent:\n  // current heads may have been signed before a group member was removed.\n  const verifiedPath: VerifiedContainerAccessManifest[] = [];\n  for (const [index, bundle] of input.path.entries()) {\n    const label = `${input.label}[${index}]`;\n    const verified = await verifyContainerManifestBundle({\n      authorizationMembership: input.authorizationMembership,\n      authorizationEvidence: input.authorizationEvidence,\n      bundle,\n      bundlesByHash: input.bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoint: input.enforceLocalCheckpoints,\n      label,\n      parentPath: verifiedPath,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n      verifiedByHash: input.verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    // Access along a path is the union of its elements' grants, so a served\n    // path must be a genuine root-to-leaf ancestor chain: each element is the\n    // parent of the next, and the first is a root.\n    const expectedParentId = verifiedPath.at(-1)?.state.containerId ?? null;\n    if (verified.state.parentContainerId !== expectedParentId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `${label} parent container does not precede it in the path`,\n      );\n    }\n    if (input.servedAsCurrent) {\n      assertServedAncestorsDescendFromCitations({\n        head: verified,\n        label,\n        servedAncestors: verifiedPath,\n        verifiedByHash: input.verifiedByHash,\n      });\n    }\n    verifiedPath.push(verified);\n  }\n\n  await rememberRootBoundOrganizationFounder({\n    execSql: input.checkpointContext.execSql,\n    policies: input.authorizationEvidence,\n    root: verifiedPath[0],\n    verifiedByHash: input.verifiedByHash,\n  });\n  return verifiedPath;\n}\n"]}

package/data/keyingProjectionVerification/containerProjectionVerification.d.ts

@@ -1,6 +1,7 @@
+import type { PrincipalPolicyAuthorization } from "../../internal/crypto/index.js";
 import { type VerifiedContainerAccessManifest } from "../../internal/crypto/index.js";
 import type { AccessManifestBundleWireResponse, ContainerWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { PrincipalPolicyCheckpointEvidence, PrincipalPolicyCurrentEvidence } from "../principals/principalPolicyEvidence.js";
+import type { PrincipalPolicyCurrentEvidence } from "../principals/principalPolicyEvidence.js";
 import type { ExecSql } from "../sqlite/sqlSchema.js";
 import { type ProjectionCheckpointContext } from "./checkpointContext.js";
 import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "./types.js";
@@ -16,7 +17,7 @@ interface ContainerWriterProjectionVerificationInput {
 }
 export declare function verifiedContainerManifestsForBundles(bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>, verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>): VerifiedContainerAccessManifest[];
 export declare function verifyContainerWriterProjectionWithContext(input: Omit<ContainerWriterProjectionVerificationInput, "execSql"> & {
-    readonly authorizationEvidence?: readonly PrincipalPolicyCheckpointEvidence[];
+    readonly authorizationEvidence?: readonly PrincipalPolicyAuthorization[];
 }, checkpointContext: ProjectionCheckpointContext): Promise<VerifiedContainerAccessManifest[]>;
 export declare function verifyContainerWriterProjection(input: ContainerWriterProjectionVerificationInput): Promise<VerifiedContainerAccessManifest[]>;
 export declare function collectContainerWriterProjectionPrincipalPolicies(input: ContainerWriterProjectionVerificationInput): Promise<PrincipalPolicyCurrentEvidence[]>;

package/data/keyingProjectionVerification/containerProjectionVerification.js

@@ -106,28 +106,30 @@ export async function verifyContainerWriterProjectionWithContext(input, checkpoi
     const bundlesByHash = collectContainerProjectionBundles(input.projection);
     const verifiedByHash = input.verifiedByHash ?? new Map();
     const principalPolicyCache = input.principalPolicyCache ?? new Map();
+    const verification = {
+        checkpointContext,
+        principalPolicyCache,
+        resolveUserKey: input.resolveUserKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    };
     const authorizationEvidence = input.authorizationEvidence ??
         (await verifyProjectionAuthorizationEvidence({
+            ...verification,
             bundles: [...bundlesByHash.values()],
-            checkpointContext,
             policyEvidence: input.projection.policyEvidence,
             organizationId: input.projection.organizationId,
-            principalPolicyCache,
-            resolveUserKey: input.resolveUserKey,
+            stillCurrent: input.stillCurrent,
         }));
     const verifiedPath = await verifyContainerManifestPath({
+        ...verification,
         authorizationEvidence,
         requireAuthorizationEvidence: true,
         servedAsCurrent: true,
         bundlesByHash,
-        checkpointContext,
         enforceLocalCheckpoints: true,
         label: "Container writer projection path",
         path: input.projection.path,
-        principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
         verifiedByHash,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
     });
     const verifiedKekStates = [];
     for (const [index, kek] of input.projection.containerKeks.entries()) {
@@ -138,18 +140,15 @@ export async function verifyContainerWriterProjectionWithContext(input, checkpoi
         const verifiedManifestHistory = [];
         for (const [historyIndex, bundle,] of kek.containerManifestHistory.entries()) {
             verifiedManifestHistory.push(await verifyContainerManifestBundle({
+                ...verification,
                 authorizationEvidence,
                 requireAuthorizationEvidence: true,
                 bundle,
                 bundlesByHash,
-                checkpointContext,
                 enforceLocalCheckpoint: false,
                 label: `Container writer projection KEK[${index}] history[${historyIndex}]`,
                 parentPath: verifiedPath.slice(0, index),
-                principalPolicyCache,
-                resolveUserKey: input.resolveUserKey,
                 verifiedByHash,
-                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
             }));
         }
         const verifiedKekState = await verifyContainerKekProjection({