@tearleads/client-sdk 0.1.62 → 0.1.64

package/data/keyingProjectionVerification/containerManifestVerification.js

@@ -1,285 +0,0 @@
-import { KeyingVerificationError, principalPolicyMatchesReference, verifyContainerAccessManifest, } from "../../internal/crypto/index.js";
-import { readCanonicalJson, readCanonicalRecord, } from "../keying/canonicalJson.js";
-import { assertCanonicalEqual, verifyAccessEventBundle, } from "./bundleVerification.js";
-import { assertCitedAncestorsDoNotRegress, resolveCitedAncestorPath, } from "./containerAncestorCitations.js";
-import { readKeyingVerificationShape } from "./error.js";
-import { loadManifestCheckpointVerification, verifyCachedManifestCheckpoint, } from "./manifestCheckpointVerification.js";
-import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
-import { readAccessManifest, readRecordNullableString } from "./readers.js";
-async function collectManifestAuthorizationPolicies(input) {
-    const missingPrincipalHeads = input.referencedPrincipalHeads.filter((reference) => !input.authorizationEvidence.some((policy) => principalPolicyMatchesReference({ policy, reference })));
-    if (input.requireAuthorizationEvidence && missingPrincipalHeads.length > 0) {
-        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
-    }
-    if (input.requireAuthorizationEvidence)
-        return [...input.authorizationEvidence];
-    return [
-        ...input.authorizationEvidence,
-        ...(await collectReferencedPrincipalPolicies({
-            checkpointContext: input.checkpointContext,
-            organizationId: input.organizationId,
-            principalPolicyCache: input.principalPolicyCache,
-            references: missingPrincipalHeads,
-            resolveUserKey: input.resolveUserKey,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        })),
-    ];
-}
-export async function verifyContainerManifestBundle(input) {
-    const parentPath = await resolveContainerManifestVerificationParentPath(input);
-    const cached = input.verifiedByHash.get(input.bundle.manifestHash);
-    if (cached) {
-        assertContainerParentPathMatches({
-            label: input.label,
-            parentPath,
-            verifiedManifest: cached,
-        });
-        if (input.enforceLocalCheckpoint) {
-            await verifyCachedManifestCheckpoint({
-                current: cached,
-                execSql: input.checkpointContext.execSql,
-                localCheckpoints: input.checkpointContext.localCheckpoints,
-                verifiedManifests: input.verifiedByHash,
-            });
-        }
-        return cached;
-    }
-    const verifying = input.verifying ?? new Set();
-    if (verifying.has(input.bundle.manifestHash)) {
-        throw new KeyingVerificationError("object_mismatch", `${input.label} refers back to a manifest whose verification it is part of`);
-    }
-    verifying.add(input.bundle.manifestHash);
-    try {
-        return await verifyFreshContainerManifestBundle({ ...input, verifying }, parentPath);
-    }
-    finally {
-        verifying.delete(input.bundle.manifestHash);
-    }
-}
-async function verifyFreshContainerManifestBundle(input, parentPath) {
-    const event = await verifyAccessEventBundle(input);
-    const manifest = readAccessManifest(input.bundle.manifest, `${input.label} manifest`);
-    const authorization = await resolveContainerManifestAuthorization(input, event, parentPath);
-    const { citedAncestors, previousManifest, sourceAncestors } = authorization;
-    const principalPolicies = await collectManifestAuthorizationPolicies({
-        authorizationEvidence: input.authorizationEvidence ?? [],
-        checkpointContext: input.checkpointContext,
-        organizationId: event.event.organizationId,
-        principalPolicyCache: input.principalPolicyCache,
-        referencedPrincipalHeads: [
-            ...authorization.referencedPrincipalHeads,
-            ...manifest.referencedPrincipalHeads,
-        ],
-        requireAuthorizationEvidence: input.requireAuthorizationEvidence ?? false,
-        resolveUserKey: input.resolveUserKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const checkpointVerification = input.enforceLocalCheckpoint
-        ? await loadManifestCheckpointVerification({
-            current: manifest,
-            execSql: input.checkpointContext.execSql,
-            localCheckpoints: input.checkpointContext.localCheckpoints,
-            verifiedManifests: input.verifiedByHash,
-        })
-        : null;
-    const verified = await verifyContainerAccessManifest({
-        // Served manifests were committed under their signed policy references.
-        // Current membership still gates new writes in the API verifier.
-        authorizationMembership: input.authorizationMembership ?? "referenced",
-        destinationParentContainerPath: citedAncestors,
-        event,
-        expectedManifestHash: input.bundle.manifestHash,
-        manifest,
-        parentContainerPath: citedAncestors,
-        principalPolicies,
-        ...(checkpointVerification ?? {}),
-        ...(previousManifest
-            ? {
-                previousContainerPath: [...sourceAncestors, previousManifest],
-                previousManifest,
-            }
-            : { previousManifest: null }),
-    });
-    if (!verified.ok) {
-        throw new KeyingVerificationError(verified.error.code, `${input.label} manifest verification failed: ${verified.error.message}`);
-    }
-    assertCanonicalEqual({
-        actual: input.bundle.state,
-        expected: readCanonicalJson(verified.value.state, `${input.label} state`),
-        label: `${input.label} state`,
-    });
-    input.verifiedByHash.set(input.bundle.manifestHash, verified.value);
-    return verified.value;
-}
-/**
- * The paths a container event is authorized against: its previous manifest
- * and the ancestor heads its signed event cites, root to parent.
- */
-async function resolveContainerManifestAuthorization(input, event, parentPath) {
-    const previousManifest = event.event.previousManifestHash === null
-        ? null
-        : await verifyPreviousContainerManifest({
-            ...input,
-            parentPath,
-            previousManifestHash: event.event.previousManifestHash,
-        });
-    // Resolve the signed placement lineage, never the server-supplied wire state.
-    // Rotations also resolve their new epoch's exact signed parent citation via
-    // cited-ancestor verification below; that can differ from this previous path.
-    const eventType = event.event.eventType;
-    const { parentContainerId, parentManifestHash } = previousManifest && eventType !== "container.move"
-        ? previousManifest.state
-        : readContainerEventBodyParentReference(event, input.label);
-    if (previousManifest === null &&
-        parentManifestHash !== null &&
-        !event.event.dependencyManifestHashes.includes(parentManifestHash)) {
-        throw new KeyingVerificationError("missing_dependency", `${input.label} does not cite the parent manifest it was created under`);
-    }
-    const lineage = {
-        bundlesByHash: input.bundlesByHash,
-        label: input.label,
-        verifiedByHash: input.verifiedByHash,
-    };
-    const citedAncestors = await resolveCitedAncestors(input, event, {
-        parentContainerId,
-    });
-    assertCitedAncestorsDoNotRegress({
-        ...lineage,
-        citedAncestors,
-        previousManifest,
-    });
-    // A move's source path leads to the previous manifest's parent, and the
-    // move event cites that path too; the destination path is the one above.
-    // The source path is held to the same no-regression rule.
-    const sourceAncestors = eventType === "container.move" && previousManifest
-        ? await resolveCitedAncestors(input, event, {
-            parentContainerId: previousManifest.state.parentContainerId,
-        })
-        : citedAncestors;
-    if (sourceAncestors !== citedAncestors) {
-        assertCitedAncestorsDoNotRegress({
-            ...lineage,
-            citedAncestors: sourceAncestors,
-            previousManifest,
-        });
-    }
-    const ancestors = [
-        ...parentPath,
-        ...citedAncestors,
-        ...(sourceAncestors === citedAncestors ? [] : sourceAncestors),
-    ];
-    return {
-        citedAncestors,
-        previousManifest,
-        referencedPrincipalHeads: [
-            ...ancestors.flatMap((ancestor) => ancestor.state.referencedPrincipalHeads),
-            ...(previousManifest?.state.referencedPrincipalHeads ?? []),
-        ],
-        sourceAncestors,
-    };
-}
-function citedAncestorResolutionInput(input) {
-    return {
-        bundlesByHash: input.bundlesByHash,
-        label: input.label,
-        verifiedByHash: input.verifiedByHash,
-        // A cited head older than the served one is history: authorize it at the
-        // membership it referenced, as the previous manifest is.
-        verifyHistoryBundle: (bundle, label) => verifyContainerManifestBundle({
-            ...input,
-            authorizationMembership: "referenced",
-            bundle,
-            enforceLocalCheckpoint: false,
-            label,
-        }),
-    };
-}
-function resolveCitedAncestors(input, event, reference) {
-    return resolveCitedAncestorPath({
-        ...citedAncestorResolutionInput(input),
-        event,
-        parentContainerId: reference.parentContainerId,
-    });
-}
-function assertContainerParentPathMatches(input) {
-    const actualParentManifestHash = input.parentPath.at(-1)?.manifestHash ?? null;
-    if (actualParentManifestHash !== input.verifiedManifest.state.parentManifestHash) {
-        throw new KeyingVerificationError("object_mismatch", `${input.label} parent path mismatch`);
-    }
-}
-function readParentReference(value, label) {
-    return readKeyingVerificationShape(() => {
-        const record = readCanonicalRecord(value, label);
-        return {
-            parentContainerId: readRecordNullableString(record, "parentContainerId", label),
-            parentManifestHash: readRecordNullableString(record, "parentManifestHash", label),
-        };
-    });
-}
-function readContainerManifestParentReference(bundle, label) {
-    return readParentReference(bundle.state, `${label} state`);
-}
-/** The parent a create or move body pins, read from the signed body. */
-function readContainerEventBodyParentReference(event, label) {
-    return readParentReference(event.body, `${label} event body`);
-}
-async function resolveContainerManifestVerificationParentPath(input) {
-    // Descendants keep the parent manifest hash they were created or moved under;
-    // a later parent share/rekey must not require rewriting descendant manifests.
-    const { parentContainerId, parentManifestHash } = readContainerManifestParentReference(input.bundle, input.label);
-    if (parentContainerId === null || parentManifestHash === null) {
-        return [];
-    }
-    const parentPathIndex = input.parentPath.findIndex((manifest) => manifest.state.containerId === parentContainerId &&
-        manifest.manifestHash === parentManifestHash);
-    if (parentPathIndex >= 0) {
-        return input.parentPath.slice(0, parentPathIndex + 1);
-    }
-    const parentBundle = input.bundlesByHash.get(parentManifestHash);
-    if (!parentBundle) {
-        return input.parentPath;
-    }
-    const parentParentPath = await resolveContainerManifestVerificationParentPath({
-        ...input,
-        bundle: parentBundle,
-        label: `${input.label} parent manifest`,
-    });
-    const verifiedParent = await verifyContainerManifestBundle({
-        ...input,
-        bundle: parentBundle,
-        enforceLocalCheckpoint: false,
-        label: `${input.label} parent manifest`,
-        parentPath: parentParentPath,
-    });
-    if (verifiedParent.state.containerId !== parentContainerId) {
-        throw new KeyingVerificationError("object_mismatch", `${input.label} parent manifest container mismatch`);
-    }
-    return [...parentParentPath, verifiedParent];
-}
-async function verifyPreviousContainerManifest(input) {
-    const previousBundle = input.bundlesByHash.get(input.previousManifestHash);
-    if (!previousBundle) {
-        throw new KeyingVerificationError("missing_dependency", `${input.label} previous manifest ${input.previousManifestHash} is missing`);
-    }
-    const parentPath = await resolveContainerManifestVerificationParentPath({
-        ...input,
-        bundle: previousBundle,
-    });
-    return verifyContainerManifestBundle({
-        authorizationMembership: "referenced",
-        authorizationEvidence: input.authorizationEvidence,
-        bundle: previousBundle,
-        bundlesByHash: input.bundlesByHash,
-        checkpointContext: input.checkpointContext,
-        enforceLocalCheckpoint: false,
-        label: `${input.label} previous manifest`,
-        parentPath,
-        principalPolicyCache: input.principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
-        requireAuthorizationEvidence: input.requireAuthorizationEvidence,
-        verifiedByHash: input.verifiedByHash,
-        verifying: input.verifying,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-}
-//# sourceMappingURL=containerManifestVerification.js.map

package/data/keyingProjectionVerification/containerManifestVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerManifestVerification.js","sourceRoot":"","sources":["containerManifestVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAE/B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gCAAgC,EAEhC,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAOzE,KAAK,UAAU,oCAAoC,CAAC,KAanD;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,wBAAwB,CAAC,MAAM,CACjE,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACF,IAAI,KAAK,CAAC,4BAA4B,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B;QACpC,OAAO,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,KAAK,CAAC,qBAAqB;QAC9B,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU,EAAE,qBAAqB;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAuBnD;IACC,MAAM,UAAU,GACd,MAAM,8CAA8C,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,CAAC;QACX,gCAAgC,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU;YACV,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,8BAA8B,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;gBACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,GAAG,EAAU,CAAC;IACvD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,6DAA6D,CAC5E,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,kCAAkC,CAC7C,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EACvB,UAAU,CACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAID,KAAK,UAAU,kCAAkC,CAC/C,KAAyB,EACzB,UAAsD;IAEtD,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,MAAM,CAAC,QAAQ,EACrB,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,qCAAqC,CAC/D,KAAK,EACL,KAAK,EACL,UAAU,CACX,CAAC;IACF,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC;IAC5E,MAAM,iBAAiB,GAAG,MAAM,oCAAoC,CAAC;QACnE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE;QACxD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,wBAAwB,EAAE;YACxB,GAAG,aAAa,CAAC,wBAAwB;YACzC,GAAG,QAAQ,CAAC,wBAAwB;SACrC;QACD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B,IAAI,KAAK;QACzE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB;QACzD,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;SACxC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,wEAAwE;QACxE,iEAAiE;QACjE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,YAAY;QACtE,8BAA8B,EAAE,cAAc;QAC9C,KAAK;QACL,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ;QACR,mBAAmB,EAAE,cAAc;QACnC,iBAAiB;QACjB,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB;YAClB,CAAC,CAAC;gBACE,qBAAqB,EAAE,CAAC,GAAG,eAAe,EAAE,gBAAgB,CAAC;gBAC7D,gBAAgB;aACjB;YACH,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,GAAG,KAAK,CAAC,KAAK,kCAAkC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ,CAAC;QACzE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ;KAC9B,CAAC,CAAC;IACH,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpE,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qCAAqC,CAClD,KAAyB,EACzB,KAA+C,EAC/C,UAAsD;IAEtD,MAAM,gBAAgB,GACpB,KAAK,CAAC,KAAK,CAAC,oBAAoB,KAAK,IAAI;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,+BAA+B,CAAC;YACpC,GAAG,KAAK;YACR,UAAU;YACV,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,oBAAoB;SACvD,CAAC,CAAC;IACT,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAC7C,gBAAgB,IAAI,SAAS,KAAK,gBAAgB;QAChD,CAAC,CAAC,gBAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,qCAAqC,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,IACE,gBAAgB,KAAK,IAAI;QACzB,kBAAkB,KAAK,IAAI;QAC3B,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAClE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,yDAAyD,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAsB;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE;QAC/D,iBAAiB;KAClB,CAAC,CAAC;IACH,gCAAgC,CAAC;QAC/B,GAAG,OAAO;QACV,cAAc;QACd,gBAAgB;KACjB,CAAC,CAAC;IACH,wEAAwE;IACxE,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,eAAe,GACnB,SAAS,KAAK,gBAAgB,IAAI,gBAAgB;QAChD,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE;YACxC,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,iBAAiB;SAC5D,CAAC;QACJ,CAAC,CAAC,cAAc,CAAC;IACrB,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;QACvC,gCAAgC,CAAC;YAC/B,GAAG,OAAO;YACV,cAAc,EAAE,eAAe;YAC/B,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,GAAG,UAAU;QACb,GAAG,cAAc;QACjB,GAAG,CAAC,eAAe,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;KAC/D,CAAC;IACF,OAAO;QACL,cAAc;QACd,gBAAgB;QAChB,wBAAwB,EAAE;YACxB,GAAG,SAAS,CAAC,OAAO,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD;YACD,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;SAC5D;QACD,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAyB;IAC7D,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,yEAAyE;QACzE,yDAAyD;QACzD,mBAAmB,EAAE,CACnB,MAAwC,EACxC,KAAa,EACb,EAAE,CACF,6BAA6B,CAAC;YAC5B,GAAG,KAAK;YACR,uBAAuB,EAAE,YAAY;YACrC,MAAM;YACN,sBAAsB,EAAE,KAAK;YAC7B,KAAK;SACN,CAAC;KACL,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAyB,EACzB,KAA+C,EAC/C,SAAwD;IAExD,OAAO,wBAAwB,CAAC;QAC9B,GAAG,4BAA4B,CAAC,KAAK,CAAC;QACtC,KAAK;QACL,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,MAAM,wBAAwB,GAC5B,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;IAChD,IACE,wBAAwB,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,EAC5E,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,uBAAuB,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,mBAAmB,CAC1B,KAAc,EACd,KAAa;IAEb,OAAO,2BAA2B,CAAC,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO;YACL,iBAAiB,EAAE,wBAAwB,CACzC,MAAM,EACN,mBAAmB,EACnB,KAAK,CACN;YACD,kBAAkB,EAAE,wBAAwB,CAC1C,MAAM,EACN,oBAAoB,EACpB,KAAK,CACN;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oCAAoC,CAC3C,MAAwC,EACxC,KAAa;IAEb,OAAO,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,wEAAwE;AACxE,SAAS,qCAAqC,CAC5C,KAA+C,EAC/C,KAAa;IAEb,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAe7D;IACC,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAC7C,oCAAoC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,iBAAiB,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAChD,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QAChD,QAAQ,CAAC,YAAY,KAAK,kBAAkB,CAC/C,CAAC;IACF,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8CAA8C,CAC3E;QACE,GAAG,KAAK;QACR,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB;KACxC,CACF,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,6BAA6B,CAAC;QACzD,GAAG,KAAK;QACR,MAAM,EAAE,YAAY;QACpB,sBAAsB,EAAE,KAAK;QAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB;QACvC,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,KAAK,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,qCAAqC,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAiB9C;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,sBAAsB,KAAK,CAAC,oBAAoB,aAAa,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,8CAA8C,CAAC;QACtE,GAAG,KAAK;QACR,MAAM,EAAE,cAAc;KACvB,CAAC,CAAC;IAEH,OAAO,6BAA6B,CAAC;QACnC,uBAAuB,EAAE,YAAY;QACrC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,MAAM,EAAE,cAAc;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,sBAAsB,EAAE,KAAK;QAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,oBAAoB;QACzC,UAAU;QACV,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type VerifiedContainerAccessManifest,\n  verifyContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../keying/canonicalJson\";\nimport {\n  assertCanonicalEqual,\n  verifyAccessEventBundle,\n} from \"./bundleVerification\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport {\n  assertCitedAncestorsDoNotRegress,\n  type CitedLineageInput,\n  resolveCitedAncestorPath,\n} from \"./containerAncestorCitations\";\nimport { readKeyingVerificationShape } from \"./error\";\nimport {\n  loadManifestCheckpointVerification,\n  verifyCachedManifestCheckpoint,\n} from \"./manifestCheckpointVerification\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { readAccessManifest, readRecordNullableString } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nasync function collectManifestAuthorizationPolicies(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly referencedPrincipalHeads: Parameters<\n    typeof principalPolicyMatchesReference\n  >[0][\"reference\"][];\n  readonly requireAuthorizationEvidence: boolean;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}) {\n  const missingPrincipalHeads = input.referencedPrincipalHeads.filter(\n    (reference) =>\n      !input.authorizationEvidence.some((policy) =>\n        principalPolicyMatchesReference({ policy, reference }),\n      ),\n  );\n  if (input.requireAuthorizationEvidence && missingPrincipalHeads.length > 0) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  }\n  if (input.requireAuthorizationEvidence)\n    return [...input.authorizationEvidence];\n  return [\n    ...input.authorizationEvidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references: missingPrincipalHeads,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport async function verifyContainerManifestBundle(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoint: boolean;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  // Manifest hashes whose verification is in progress up the call stack.\n  // Previous manifests, pinned parents, and cited ancestors all recurse\n  // before a bundle's own hash is checked, so served bundles that refer to\n  // each other under claimed hashes would otherwise recurse without end.\n  readonly verifying?: Set<string> | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest> {\n  const parentPath =\n    await resolveContainerManifestVerificationParentPath(input);\n  const cached = input.verifiedByHash.get(input.bundle.manifestHash);\n  if (cached) {\n    assertContainerParentPathMatches({\n      label: input.label,\n      parentPath,\n      verifiedManifest: cached,\n    });\n    if (input.enforceLocalCheckpoint) {\n      await verifyCachedManifestCheckpoint({\n        current: cached,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      });\n    }\n    return cached;\n  }\n\n  const verifying = input.verifying ?? new Set<string>();\n  if (verifying.has(input.bundle.manifestHash)) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} refers back to a manifest whose verification it is part of`,\n    );\n  }\n  verifying.add(input.bundle.manifestHash);\n  try {\n    return await verifyFreshContainerManifestBundle(\n      { ...input, verifying },\n      parentPath,\n    );\n  } finally {\n    verifying.delete(input.bundle.manifestHash);\n  }\n}\n\ntype CitedAncestorInput = Parameters<typeof verifyContainerManifestBundle>[0];\n\nasync function verifyFreshContainerManifestBundle(\n  input: CitedAncestorInput,\n  parentPath: readonly VerifiedContainerAccessManifest[],\n): Promise<VerifiedContainerAccessManifest> {\n  const event = await verifyAccessEventBundle(input);\n  const manifest = readAccessManifest(\n    input.bundle.manifest,\n    `${input.label} manifest`,\n  );\n  const authorization = await resolveContainerManifestAuthorization(\n    input,\n    event,\n    parentPath,\n  );\n  const { citedAncestors, previousManifest, sourceAncestors } = authorization;\n  const principalPolicies = await collectManifestAuthorizationPolicies({\n    authorizationEvidence: input.authorizationEvidence ?? [],\n    checkpointContext: input.checkpointContext,\n    organizationId: event.event.organizationId,\n    principalPolicyCache: input.principalPolicyCache,\n    referencedPrincipalHeads: [\n      ...authorization.referencedPrincipalHeads,\n      ...manifest.referencedPrincipalHeads,\n    ],\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence ?? false,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const checkpointVerification = input.enforceLocalCheckpoint\n    ? await loadManifestCheckpointVerification({\n        current: manifest,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      })\n    : null;\n\n  const verified = await verifyContainerAccessManifest({\n    // Served manifests were committed under their signed policy references.\n    // Current membership still gates new writes in the API verifier.\n    authorizationMembership: input.authorizationMembership ?? \"referenced\",\n    destinationParentContainerPath: citedAncestors,\n    event,\n    expectedManifestHash: input.bundle.manifestHash,\n    manifest,\n    parentContainerPath: citedAncestors,\n    principalPolicies,\n    ...(checkpointVerification ?? {}),\n    ...(previousManifest\n      ? {\n          previousContainerPath: [...sourceAncestors, previousManifest],\n          previousManifest,\n        }\n      : { previousManifest: null }),\n  });\n  if (!verified.ok) {\n    throw new KeyingVerificationError(\n      verified.error.code,\n      `${input.label} manifest verification failed: ${verified.error.message}`,\n    );\n  }\n\n  assertCanonicalEqual({\n    actual: input.bundle.state,\n    expected: readCanonicalJson(verified.value.state, `${input.label} state`),\n    label: `${input.label} state`,\n  });\n  input.verifiedByHash.set(input.bundle.manifestHash, verified.value);\n\n  return verified.value;\n}\n\n/**\n * The paths a container event is authorized against: its previous manifest\n * and the ancestor heads its signed event cites, root to parent.\n */\nasync function resolveContainerManifestAuthorization(\n  input: CitedAncestorInput,\n  event: VerifiedContainerAccessManifest[\"event\"],\n  parentPath: readonly VerifiedContainerAccessManifest[],\n) {\n  const previousManifest =\n    event.event.previousManifestHash === null\n      ? null\n      : await verifyPreviousContainerManifest({\n          ...input,\n          parentPath,\n          previousManifestHash: event.event.previousManifestHash,\n        });\n  // Resolve the signed placement lineage, never the server-supplied wire state.\n  // Rotations also resolve their new epoch's exact signed parent citation via\n  // cited-ancestor verification below; that can differ from this previous path.\n  const eventType = event.event.eventType;\n  const { parentContainerId, parentManifestHash } =\n    previousManifest && eventType !== \"container.move\"\n      ? previousManifest.state\n      : readContainerEventBodyParentReference(event, input.label);\n  if (\n    previousManifest === null &&\n    parentManifestHash !== null &&\n    !event.event.dependencyManifestHashes.includes(parentManifestHash)\n  ) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} does not cite the parent manifest it was created under`,\n    );\n  }\n  const lineage: CitedLineageInput = {\n    bundlesByHash: input.bundlesByHash,\n    label: input.label,\n    verifiedByHash: input.verifiedByHash,\n  };\n  const citedAncestors = await resolveCitedAncestors(input, event, {\n    parentContainerId,\n  });\n  assertCitedAncestorsDoNotRegress({\n    ...lineage,\n    citedAncestors,\n    previousManifest,\n  });\n  // A move's source path leads to the previous manifest's parent, and the\n  // move event cites that path too; the destination path is the one above.\n  // The source path is held to the same no-regression rule.\n  const sourceAncestors =\n    eventType === \"container.move\" && previousManifest\n      ? await resolveCitedAncestors(input, event, {\n          parentContainerId: previousManifest.state.parentContainerId,\n        })\n      : citedAncestors;\n  if (sourceAncestors !== citedAncestors) {\n    assertCitedAncestorsDoNotRegress({\n      ...lineage,\n      citedAncestors: sourceAncestors,\n      previousManifest,\n    });\n  }\n  const ancestors = [\n    ...parentPath,\n    ...citedAncestors,\n    ...(sourceAncestors === citedAncestors ? [] : sourceAncestors),\n  ];\n  return {\n    citedAncestors,\n    previousManifest,\n    referencedPrincipalHeads: [\n      ...ancestors.flatMap(\n        (ancestor) => ancestor.state.referencedPrincipalHeads,\n      ),\n      ...(previousManifest?.state.referencedPrincipalHeads ?? []),\n    ],\n    sourceAncestors,\n  };\n}\n\nfunction citedAncestorResolutionInput(input: CitedAncestorInput) {\n  return {\n    bundlesByHash: input.bundlesByHash,\n    label: input.label,\n    verifiedByHash: input.verifiedByHash,\n    // A cited head older than the served one is history: authorize it at the\n    // membership it referenced, as the previous manifest is.\n    verifyHistoryBundle: (\n      bundle: AccessManifestBundleWireResponse,\n      label: string,\n    ) =>\n      verifyContainerManifestBundle({\n        ...input,\n        authorizationMembership: \"referenced\",\n        bundle,\n        enforceLocalCheckpoint: false,\n        label,\n      }),\n  };\n}\n\nfunction resolveCitedAncestors(\n  input: CitedAncestorInput,\n  event: VerifiedContainerAccessManifest[\"event\"],\n  reference: { readonly parentContainerId: string | null },\n): Promise<VerifiedContainerAccessManifest[]> {\n  return resolveCitedAncestorPath({\n    ...citedAncestorResolutionInput(input),\n    event,\n    parentContainerId: reference.parentContainerId,\n  });\n}\n\nfunction assertContainerParentPathMatches(input: {\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n}): void {\n  const actualParentManifestHash =\n    input.parentPath.at(-1)?.manifestHash ?? null;\n  if (\n    actualParentManifestHash !== input.verifiedManifest.state.parentManifestHash\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} parent path mismatch`,\n    );\n  }\n}\n\ninterface ContainerParentReference {\n  parentContainerId: string | null;\n  parentManifestHash: string | null;\n}\n\nfunction readParentReference(\n  value: unknown,\n  label: string,\n): ContainerParentReference {\n  return readKeyingVerificationShape(() => {\n    const record = readCanonicalRecord(value, label);\n\n    return {\n      parentContainerId: readRecordNullableString(\n        record,\n        \"parentContainerId\",\n        label,\n      ),\n      parentManifestHash: readRecordNullableString(\n        record,\n        \"parentManifestHash\",\n        label,\n      ),\n    };\n  });\n}\n\nfunction readContainerManifestParentReference(\n  bundle: AccessManifestBundleWireResponse,\n  label: string,\n): ContainerParentReference {\n  return readParentReference(bundle.state, `${label} state`);\n}\n\n/** The parent a create or move body pins, read from the signed body. */\nfunction readContainerEventBodyParentReference(\n  event: VerifiedContainerAccessManifest[\"event\"],\n  label: string,\n): ContainerParentReference {\n  return readParentReference(event.body, `${label} event body`);\n}\n\nasync function resolveContainerManifestVerificationParentPath(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<readonly VerifiedContainerAccessManifest[]> {\n  // Descendants keep the parent manifest hash they were created or moved under;\n  // a later parent share/rekey must not require rewriting descendant manifests.\n  const { parentContainerId, parentManifestHash } =\n    readContainerManifestParentReference(input.bundle, input.label);\n  if (parentContainerId === null || parentManifestHash === null) {\n    return [];\n  }\n\n  const parentPathIndex = input.parentPath.findIndex(\n    (manifest) =>\n      manifest.state.containerId === parentContainerId &&\n      manifest.manifestHash === parentManifestHash,\n  );\n  if (parentPathIndex >= 0) {\n    return input.parentPath.slice(0, parentPathIndex + 1);\n  }\n\n  const parentBundle = input.bundlesByHash.get(parentManifestHash);\n  if (!parentBundle) {\n    return input.parentPath;\n  }\n\n  const parentParentPath = await resolveContainerManifestVerificationParentPath(\n    {\n      ...input,\n      bundle: parentBundle,\n      label: `${input.label} parent manifest`,\n    },\n  );\n  const verifiedParent = await verifyContainerManifestBundle({\n    ...input,\n    bundle: parentBundle,\n    enforceLocalCheckpoint: false,\n    label: `${input.label} parent manifest`,\n    parentPath: parentParentPath,\n  });\n  if (verifiedParent.state.containerId !== parentContainerId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      `${input.label} parent manifest container mismatch`,\n    );\n  }\n\n  return [...parentParentPath, verifiedParent];\n}\n\nasync function verifyPreviousContainerManifest(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly label: string;\n  readonly parentPath: readonly VerifiedContainerAccessManifest[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly previousManifestHash: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly verifying?: Set<string> | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest> {\n  const previousBundle = input.bundlesByHash.get(input.previousManifestHash);\n  if (!previousBundle) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} previous manifest ${input.previousManifestHash} is missing`,\n    );\n  }\n  const parentPath = await resolveContainerManifestVerificationParentPath({\n    ...input,\n    bundle: previousBundle,\n  });\n\n  return verifyContainerManifestBundle({\n    authorizationMembership: \"referenced\",\n    authorizationEvidence: input.authorizationEvidence,\n    bundle: previousBundle,\n    bundlesByHash: input.bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    enforceLocalCheckpoint: false,\n    label: `${input.label} previous manifest`,\n    parentPath,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n    verifiedByHash: input.verifiedByHash,\n    verifying: input.verifying,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/containerPathVerification.js

@@ -1,51 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { assertServedAncestorsDescendFromCitations } from "./containerAncestorCitations.js";
-import { verifyContainerManifestBundle } from "./containerManifestVerification.js";
-import { rememberRootBoundOrganizationFounder } from "./organizationFounderBinding.js";
-export async function verifyContainerManifestPath(input) {
-    // Historical signer membership and current-path freshness are independent:
-    // current heads may have been signed before a group member was removed.
-    const verifiedPath = [];
-    for (const [index, bundle] of input.path.entries()) {
-        const label = `${input.label}[${index}]`;
-        const verified = await verifyContainerManifestBundle({
-            authorizationMembership: input.authorizationMembership,
-            authorizationEvidence: input.authorizationEvidence,
-            bundle,
-            bundlesByHash: input.bundlesByHash,
-            checkpointContext: input.checkpointContext,
-            enforceLocalCheckpoint: input.enforceLocalCheckpoints,
-            label,
-            parentPath: verifiedPath,
-            principalPolicyCache: input.principalPolicyCache,
-            resolveUserKey: input.resolveUserKey,
-            requireAuthorizationEvidence: input.requireAuthorizationEvidence,
-            verifiedByHash: input.verifiedByHash,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        // Access along a path is the union of its elements' grants, so a served
-        // path must be a genuine root-to-leaf ancestor chain: each element is the
-        // parent of the next, and the first is a root.
-        const expectedParentId = verifiedPath.at(-1)?.state.containerId ?? null;
-        if (verified.state.parentContainerId !== expectedParentId) {
-            throw new KeyingVerificationError("object_mismatch", `${label} parent container does not precede it in the path`);
-        }
-        if (input.servedAsCurrent) {
-            assertServedAncestorsDescendFromCitations({
-                head: verified,
-                label,
-                servedAncestors: verifiedPath,
-                verifiedByHash: input.verifiedByHash,
-            });
-        }
-        verifiedPath.push(verified);
-    }
-    await rememberRootBoundOrganizationFounder({
-        execSql: input.checkpointContext.execSql,
-        policies: input.authorizationEvidence,
-        root: verifiedPath[0],
-        verifiedByHash: input.verifiedByHash,
-    });
-    return verifiedPath;
-}
-//# sourceMappingURL=containerPathVerification.js.map

package/data/keyingProjectionVerification/containerPathVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerPathVerification.js","sourceRoot":"","sources":["containerPathVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AAOpF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAkBjD;IACC,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,YAAY,GAAsC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,sBAAsB,EAAE,KAAK,CAAC,uBAAuB;YACrD,KAAK;YACL,UAAU,EAAE,YAAY;YACxB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;YAChE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,wEAAwE;QACxE,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;QACxE,IAAI,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,mDAAmD,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,yCAAyC,CAAC;gBACxC,IAAI,EAAE,QAAQ;gBACd,KAAK;gBACL,eAAe,EAAE,YAAY;gBAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;QACL,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,oCAAoC,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;QACxC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { assertServedAncestorsDescendFromCitations } from \"./containerAncestorCitations\";\nimport { verifyContainerManifestBundle } from \"./containerManifestVerification\";\nimport { rememberRootBoundOrganizationFounder } from \"./organizationFounderBinding\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nexport async function verifyContainerManifestPath(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoints: boolean;\n  readonly servedAsCurrent: boolean;\n  readonly label: string;\n  readonly path: readonly AccessManifestBundleWireResponse[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly verifiedByHash: Map<string, VerifiedContainerAccessManifest>;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<VerifiedContainerAccessManifest[]> {\n  // Historical signer membership and current-path freshness are independent:\n  // current heads may have been signed before a group member was removed.\n  const verifiedPath: VerifiedContainerAccessManifest[] = [];\n  for (const [index, bundle] of input.path.entries()) {\n    const label = `${input.label}[${index}]`;\n    const verified = await verifyContainerManifestBundle({\n      authorizationMembership: input.authorizationMembership,\n      authorizationEvidence: input.authorizationEvidence,\n      bundle,\n      bundlesByHash: input.bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoint: input.enforceLocalCheckpoints,\n      label,\n      parentPath: verifiedPath,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n      verifiedByHash: input.verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    // Access along a path is the union of its elements' grants, so a served\n    // path must be a genuine root-to-leaf ancestor chain: each element is the\n    // parent of the next, and the first is a root.\n    const expectedParentId = verifiedPath.at(-1)?.state.containerId ?? null;\n    if (verified.state.parentContainerId !== expectedParentId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `${label} parent container does not precede it in the path`,\n      );\n    }\n    if (input.servedAsCurrent) {\n      assertServedAncestorsDescendFromCitations({\n        head: verified,\n        label,\n        servedAncestors: verifiedPath,\n        verifiedByHash: input.verifiedByHash,\n      });\n    }\n    verifiedPath.push(verified);\n  }\n\n  await rememberRootBoundOrganizationFounder({\n    execSql: input.checkpointContext.execSql,\n    policies: input.authorizationEvidence,\n    root: verifiedPath[0],\n    verifiedByHash: input.verifiedByHash,\n  });\n  return verifiedPath;\n}\n"]}

package/data/keyingProjectionVerification/containerProjectionVerification.d.ts

@@ -1,25 +0,0 @@
-import type { PrincipalPolicyAuthorization } from "../../internal/crypto/index.js";
-import { type VerifiedContainerAccessManifest } from "../../internal/crypto/index.js";
-import type { AccessManifestBundleWireResponse, ContainerWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { PrincipalPolicyCurrentEvidence } from "../principals/principalPolicyEvidence.js";
-import type { ExecSql } from "../sqlite/sqlSchema.js";
-import { type ProjectionCheckpointContext } from "./checkpointContext.js";
-import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "./types.js";
-interface ContainerWriterProjectionVerificationInput {
-    readonly execSql: ExecSql;
-    readonly persistVerificationCheckpoints?: boolean | undefined;
-    readonly principalPolicyCache?: PrincipalPolicyCache | undefined;
-    readonly projection: ContainerWriterProjectionResponse;
-    readonly resolveUserKey: ProjectionUserKeyResolver;
-    readonly stillCurrent?: (() => boolean) | undefined;
-    readonly verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;
-    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}
-export declare function verifiedContainerManifestsForBundles(bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>, verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>): VerifiedContainerAccessManifest[];
-export declare function verifyContainerWriterProjectionWithContext(input: Omit<ContainerWriterProjectionVerificationInput, "execSql"> & {
-    readonly authorizationEvidence?: readonly PrincipalPolicyAuthorization[];
-}, checkpointContext: ProjectionCheckpointContext): Promise<VerifiedContainerAccessManifest[]>;
-export declare function verifyContainerWriterProjection(input: ContainerWriterProjectionVerificationInput): Promise<VerifiedContainerAccessManifest[]>;
-export declare function collectContainerWriterProjectionPrincipalPolicies(input: ContainerWriterProjectionVerificationInput): Promise<PrincipalPolicyCurrentEvidence[]>;
-export declare function addContainerWriterProjectionBundles(bundlesByHash: Map<string, AccessManifestBundleWireResponse>, projection: ContainerWriterProjectionResponse, label: string): void;
-export {};