@tearleads/client-sdk 0.1.62 → 0.1.64

package/data/keyingProjectionVerification/documentManifestVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentManifestVerification.js","sourceRoot":"","sources":["documentManifestVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EAIvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EACL,wCAAwC,EACxC,oCAAoC,GAErC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAS5E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAuBlD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,8BAA8B,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;gBACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,MAAM,CAAC,QAAQ,EACrB,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACF,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;QAC1D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,oBAAoB;QACtD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,2BAA2B,CACtC,KAAK,CAAC,IAAI,EACV,GAAG,KAAK,CAAC,KAAK,aAAa,CAC5B,CAAC;IACF,MAAM,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GACrD,0BAA0B,CAAC;QACzB,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QAC9D,kBAAkB,EAAE,IAAI,CAAC,qBAAqB;KAC/C,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,wCAAwC,CAAC;QACvE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,KAAK,EAAE,CAAC,GAAG,wBAAwB,EAAE,mBAAmB,CAAC;QACzD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB;QACzD,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YAC1D,iBAAiB,EAAE,KAAK,CAAC,cAAc;SACxC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,YAAY;QACtE,yBAAyB,EAAE,wBAAwB;QACnD,KAAK;QACL,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ;QACR,gBAAgB;QAChB,iBAAiB;QACjB,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,GAAG,KAAK,CAAC,KAAK,kCAAkC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,oCAAoC,CAAC;QACnC,KAAK,EAAE,CAAC,GAAG,wBAAwB,EAAE,mBAAmB,CAAC;QACzD,IAAI,EAAE,KAAK,CAAC,sBAAsB;KACnC,CAAC,CAAC;IACH,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ,CAAC;QACzE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,QAAQ;KAC9B,CAAC,CAAC;IACH,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpE,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAO6D;IAE7D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,eAAe,CACb,aAAa,EACb,KAAK,CAAC,UAAU,CAAC,gBAAgB,EACjC,qCAAqC,CACtC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC;IACzD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,eAAe,CACb,aAAa,EACb,MAAM,EACN,+CAA+C,KAAK,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,oCAAoC;IACpC,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,YAAY,CACzE,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,KAAK,cAAc,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,4BAA4B,CAAC;YACjC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,4BAA4B,EAAE,IAAI;YAClC,MAAM;YACN,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,+CAA+C,KAAK,GAAG;YAC9D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;QACtD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;QACzC,aAAa;QACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,sBAAsB,EAAE,IAAI;QAC5B,KAAK,EAAE,4BAA4B;QACnC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n  type VerifiedDocumentLinkSetManifest,\n  type VerifiedDocumentLinkSetSnapshot,\n  verifyDocumentLinkSetManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { readCanonicalJson } from \"../keying/canonicalJson\";\nimport {\n  addBundleByHash,\n  assertCanonicalEqual,\n  verifyAccessEventBundle,\n} from \"./bundleVerification\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { resolveEventContainerPaths } from \"./documentDependencyPaths\";\nimport {\n  collectDocumentManifestPrincipalPolicies,\n  recordUsedDocumentContainerManifests,\n  type UsedDocumentContainerManifests,\n} from \"./documentManifestPolicies\";\nimport { requireVerifiedDocumentPredecessor } from \"./documentManifestPredecessor\";\nimport {\n  loadManifestCheckpointVerification,\n  verifyCachedManifestCheckpoint,\n} from \"./manifestCheckpointVerification\";\nimport { readAccessManifest, readDocumentAccessEventBody } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\ntype PolicyWarmer = ReferencedPrincipalPolicyWarmer | undefined;\n\nexport async function verifyDocumentManifestBundle(input: {\n  readonly authorizationMembership?: \"current\" | \"referenced\" | undefined;\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly enforceLocalCheckpoint: boolean;\n  readonly label: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly trustedPredecessorByHash?:\n    | ReadonlyMap<string, VerifiedDocumentLinkSetSnapshot>\n    | undefined;\n  readonly usedContainerManifests?: UsedDocumentContainerManifests | undefined;\n  readonly verifiedByHash: Map<string, VerifiedDocumentLinkSetManifest>;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}): Promise<VerifiedDocumentLinkSetManifest> {\n  const cached = input.verifiedByHash.get(input.bundle.manifestHash);\n  if (cached) {\n    if (input.enforceLocalCheckpoint) {\n      await verifyCachedManifestCheckpoint({\n        current: cached,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      });\n    }\n    return cached;\n  }\n\n  const event = await verifyAccessEventBundle(input);\n  const manifest = readAccessManifest(\n    input.bundle.manifest,\n    `${input.label} manifest`,\n  );\n  const previousManifest = requireVerifiedDocumentPredecessor({\n    label: input.label,\n    previousManifestHash: event.event.previousManifestHash,\n    trustedPredecessorByHash: input.trustedPredecessorByHash,\n    verifiedByHash: input.verifiedByHash,\n  });\n  const body = readDocumentAccessEventBody(\n    event.body,\n    `${input.label} event body`,\n  );\n  const { dependencyContainerPaths, targetContainerPath } =\n    resolveEventContainerPaths({\n      containerPathByManifestHash: input.containerPathByManifestHash,\n      dependencyManifestHashes: event.event.dependencyManifestHashes,\n      targetManifestHash: body.containerManifestHash,\n    });\n  const principalPolicies = await collectDocumentManifestPrincipalPolicies({\n    authorizationEvidence: input.authorizationEvidence,\n    checkpointContext: input.checkpointContext,\n    organizationId: event.event.organizationId,\n    paths: [...dependencyContainerPaths, targetContainerPath],\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: input.requireAuthorizationEvidence,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const checkpointVerification = input.enforceLocalCheckpoint\n    ? await loadManifestCheckpointVerification({\n        current: manifest,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: input.verifiedByHash,\n      })\n    : null;\n  const verified = await verifyDocumentLinkSetManifest({\n    // Served heads and history were committed under the group membership their\n    // cited container heads referenced; a signer removed since must still\n    // verify on a cold device. The API verifier gates new writes at current.\n    authorizationMembership: input.authorizationMembership ?? \"referenced\",\n    authorizingContainerPaths: dependencyContainerPaths,\n    event,\n    expectedManifestHash: input.bundle.manifestHash,\n    manifest,\n    previousManifest,\n    principalPolicies,\n    ...(checkpointVerification ?? {}),\n    ...(targetContainerPath ? { targetContainerPath } : {}),\n  });\n  if (!verified.ok) {\n    throw new KeyingVerificationError(\n      verified.error.code,\n      `${input.label} manifest verification failed: ${verified.error.message}`,\n    );\n  }\n\n  recordUsedDocumentContainerManifests({\n    paths: [...dependencyContainerPaths, targetContainerPath],\n    used: input.usedContainerManifests,\n  });\n  assertCanonicalEqual({\n    actual: input.bundle.state,\n    expected: readCanonicalJson(verified.value.state, `${input.label} state`),\n    label: `${input.label} state`,\n  });\n  input.verifiedByHash.set(input.bundle.manifestHash, verified.value);\n\n  return verified.value;\n}\n\nexport async function verifyDocumentProjectionManifests(\n  input: Omit<\n    Parameters<typeof verifyDocumentManifestBundle>[0],\n    | \"bundle\"\n    | \"bundlesByHash\"\n    | \"enforceLocalCheckpoint\"\n    | \"label\"\n    | \"verifiedByHash\"\n  > & { readonly projection: DocumentWriterProjectionResponse },\n) {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addBundleByHash(\n    bundlesByHash,\n    input.projection.documentManifest,\n    \"Document writer projection manifest\",\n  );\n  const history = input.projection.documentManifestHistory;\n  for (const [index, bundle] of history.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document writer projection manifest history[${index}]`,\n    );\n  }\n  // An honest API never lists the head in its own history (it seeds the walk\n  // with the head), so a repeat is a malformed or tampered projection and is\n  // refused as such, rather than letting the head reach its verification\n  // through the history cache and relying on the cached branch to re-run\n  // every check the fresh path would.\n  if (\n    history.some(\n      (bundle) =>\n        bundle.manifestHash === input.projection.documentManifest.manifestHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"duplicate_entry\",\n      \"Document writer projection history repeats the current head\",\n    );\n  }\n\n  const verifiedByHash = new Map<string, VerifiedDocumentLinkSetManifest>();\n  for (let index = history.length - 1; index >= 0; index -= 1) {\n    const bundle = history[index];\n    if (!bundle) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        `Document writer projection manifest history[${index}] is missing`,\n      );\n    }\n    await verifyDocumentManifestBundle({\n      authorizationEvidence: input.authorizationEvidence,\n      requireAuthorizationEvidence: true,\n      bundle,\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      containerPathByManifestHash: input.containerPathByManifestHash,\n      enforceLocalCheckpoint: false,\n      label: `Document writer projection manifest history[${index}]`,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  }\n\n  const headManifest = await verifyDocumentManifestBundle({\n    authorizationEvidence: input.authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    bundle: input.projection.documentManifest,\n    bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    containerPathByManifestHash: input.containerPathByManifestHash,\n    enforceLocalCheckpoint: true,\n    label: \"Document writer projection\",\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  return { headManifest, verifiedByHash };\n}\n"]}

package/data/keyingProjectionVerification/documentProjectionVerification.d.ts

@@ -1,24 +0,0 @@
-import type { PrincipalPolicyAuthorization, VerifiedContainerAccessManifest, VerifiedDocumentLinkSetManifest } from "../../internal/crypto/index.js";
-import type { DocumentWriterProjectionResponse } from "../../internal/validators/response/index.js";
-import type { ExecSql } from "../sqlite/sqlSchema.js";
-import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "./types.js";
-type VerifiedManifestMap = Map<string, VerifiedContainerAccessManifest>;
-type PolicyWarmer = ReferencedPrincipalPolicyWarmer | undefined;
-interface DocumentWriterProjectionVerificationInput {
-    readonly execSql: ExecSql;
-    readonly persistVerificationCheckpoints?: boolean | undefined;
-    readonly principalPolicyCache?: PrincipalPolicyCache | undefined;
-    readonly projection: DocumentWriterProjectionResponse;
-    readonly resolveUserKey: ProjectionUserKeyResolver;
-    readonly stillCurrent?: (() => boolean) | undefined;
-    readonly verifiedByHash?: VerifiedManifestMap | undefined;
-    readonly warmReferencedPrincipalPolicies?: PolicyWarmer;
-}
-export interface DocumentWriterProjectionAuthorization {
-    readonly containerPathByManifestHash: ReadonlyMap<string, readonly VerifiedContainerAccessManifest[]>;
-    readonly documentManifestByHash: ReadonlyMap<string, VerifiedDocumentLinkSetManifest>;
-    readonly principalPolicies: readonly PrincipalPolicyAuthorization[];
-}
-export declare function verifyDocumentWriterProjection(input: DocumentWriterProjectionVerificationInput): Promise<VerifiedDocumentLinkSetManifest>;
-export declare function verifyDocumentWriterProjectionAuthorization(input: DocumentWriterProjectionVerificationInput): Promise<DocumentWriterProjectionAuthorization>;
-export {};

package/data/keyingProjectionVerification/documentProjectionVerification.js

@@ -1,172 +0,0 @@
-import { addBundleByHash } from "./bundleVerification.js";
-import { createProjectionCheckpointContext, finalizeProjectionCheckpoints, observeAccessManifestCheckpoints, observeVerifiedProjectionBundles, } from "./checkpointContext.js";
-import { verifyContainerManifestPath } from "./containerPathVerification.js";
-import { addContainerWriterProjectionBundles, verifiedContainerManifestsForBundles, verifyContainerWriterProjectionWithContext, } from "./containerProjectionVerification.js";
-import { documentContainerProjections } from "./documentContainerProjections.js";
-import { verifyDocumentProjectionManifests } from "./documentManifestVerification.js";
-import { rejectPurgedDocumentProjection } from "./documentPurgeCheckpointEnforcement.js";
-import { throwKeyingVerificationShapeFailure } from "./error.js";
-import { verifyProjectionAuthorizationEvidence } from "./projectionAuthorizationEvidence.js";
-import { readAccessManifest } from "./readers.js";
-import { withGenerationGuardedPolicyWarmer } from "./types.js";
-function readDocumentProjectionContainerPaths(projection) {
-    return [
-        ...projection.documentManifestContainerPaths,
-        ...projection.authorizingContainerPaths.map((path) => path.path),
-    ];
-}
-function collectDocumentProjectionContainerBundles(projection) {
-    const bundlesByHash = new Map();
-    for (const [index, authorizing] of documentContainerProjections(projection).entries()) {
-        addContainerWriterProjectionBundles(bundlesByHash, authorizing, `Document writer projection authorizing path[${index}]`);
-    }
-    for (const [index, path] of readDocumentProjectionContainerPaths(projection).entries()) {
-        for (const [pathIndex, bundle] of path.entries()) {
-            addBundleByHash(bundlesByHash, bundle, `Document writer projection dependency path[${index}][${pathIndex}]`);
-        }
-    }
-    for (const [index, bundle,] of projection.documentContainerManifestHistory.entries()) {
-        addBundleByHash(bundlesByHash, bundle, `Document writer projection container history[${index}]`);
-    }
-    return bundlesByHash;
-}
-async function verifyProjectionContainerPaths(input) {
-    const bundlesByHash = collectDocumentProjectionContainerBundles(input.projection);
-    const containerPathByManifestHash = new Map();
-    // Reuse a caller-supplied cache when provided so a later unwrap pass over the
-    // same authorizing container paths does not re-verify identical manifests.
-    const verifiedByHash = input.verifiedByHash ?? new Map();
-    for (const projection of documentContainerProjections(input.projection)) {
-        const path = await verifyContainerWriterProjectionWithContext({
-            authorizationEvidence: input.authorizationEvidence,
-            principalPolicyCache: input.principalPolicyCache,
-            projection,
-            resolveUserKey: input.resolveUserKey,
-            verifiedByHash,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        }, input.checkpointContext);
-        const leaf = path.at(-1);
-        if (leaf) {
-            containerPathByManifestHash.set(leaf.manifestHash, path);
-        }
-        for (const manifest of path) {
-            verifiedByHash.set(manifest.manifestHash, manifest);
-        }
-    }
-    // Grouping supplies evidence only; each signed artifact selects its citations.
-    for (const [index, path,] of input.projection.documentManifestContainerPaths.entries()) {
-        // Historical dependency evidence is verified without current checkpoint
-        // enforcement. Its grouping cannot substitute an uncited ancestor into
-        // document or content-write authorization.
-        const verifiedPath = await verifyContainerManifestPath({
-            authorizationEvidence: input.authorizationEvidence,
-            requireAuthorizationEvidence: true,
-            servedAsCurrent: false,
-            authorizationMembership: "referenced",
-            bundlesByHash,
-            checkpointContext: input.checkpointContext,
-            enforceLocalCheckpoints: false,
-            label: `Document writer projection dependency path[${index}]`,
-            path,
-            principalPolicyCache: input.principalPolicyCache,
-            resolveUserKey: input.resolveUserKey,
-            verifiedByHash,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-        // The authorizing path recorded for the same leaf takes precedence.
-        const leaf = verifiedPath.at(-1);
-        if (leaf && !containerPathByManifestHash.has(leaf.manifestHash)) {
-            containerPathByManifestHash.set(leaf.manifestHash, verifiedPath);
-        }
-    }
-    // Keep every verified head as evidence. Events and content headers select
-    // their own signed paths through resolveEventContainerPaths.
-    for (const [hash, manifest] of verifiedByHash) {
-        if (!containerPathByManifestHash.has(hash))
-            containerPathByManifestHash.set(hash, [manifest]);
-    }
-    observeAccessManifestCheckpoints(input.checkpointContext, {
-        verifiedHeads: [],
-        verifiedManifests: verifiedContainerManifestsForBundles(bundlesByHash, verifiedByHash),
-    });
-    return containerPathByManifestHash;
-}
-async function verifyDocumentWriterProjectionWithContext(input, checkpointContext) {
-    const principalPolicyCache = input.principalPolicyCache ?? new Map();
-    const authorizationEvidence = await verifyProjectionAuthorizationEvidence({
-        bundles: [
-            input.projection.documentManifest,
-            ...input.projection.documentManifestHistory,
-            ...collectDocumentProjectionContainerBundles(input.projection).values(),
-        ],
-        checkpointContext,
-        policyEvidence: input.projection.policyEvidence,
-        organizationId: readAccessManifest(input.projection.documentManifest.manifest, "Document projection manifest").organizationId,
-        principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const containerPathByManifestHash = await verifyProjectionContainerPaths({
-        authorizationEvidence,
-        checkpointContext,
-        principalPolicyCache,
-        projection: input.projection,
-        resolveUserKey: input.resolveUserKey,
-        verifiedByHash: input.verifiedByHash,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const { headManifest, verifiedByHash } = await verifyDocumentProjectionManifests({
-        authorizationEvidence,
-        checkpointContext,
-        containerPathByManifestHash,
-        principalPolicyCache,
-        projection: input.projection,
-        resolveUserKey: input.resolveUserKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    await rejectPurgedDocumentProjection(headManifest.state.documentId, checkpointContext.execSql);
-    observeAccessManifestCheckpoints(checkpointContext, {
-        verifiedHeads: [headManifest],
-        verifiedManifests: [...verifiedByHash.values()],
-    });
-    return {
-        authorization: {
-            containerPathByManifestHash,
-            documentManifestByHash: verifiedByHash,
-            principalPolicies: authorizationEvidence,
-        },
-        headManifest,
-    };
-}
-/** Each served bundle, document and container, whose manifest verified. */
-function observeVerifiedDocumentProjectionBundles(checkpointContext, projection, authorization) {
-    observeVerifiedProjectionBundles(checkpointContext, new Map([projection.documentManifest, ...projection.documentManifestHistory].map((bundle) => [bundle.manifestHash, bundle])), authorization.documentManifestByHash);
-    observeVerifiedProjectionBundles(checkpointContext, collectDocumentProjectionContainerBundles(projection), new Map([...authorization.containerPathByManifestHash.values()]
-        .flat()
-        .map((manifest) => [manifest.manifestHash, manifest])));
-}
-export async function verifyDocumentWriterProjection(input) {
-    const checkpointContext = createProjectionCheckpointContext({
-        execSql: input.execSql,
-    });
-    const verified = await verifyDocumentWriterProjectionWithContext(withGenerationGuardedPolicyWarmer(input), checkpointContext);
-    observeVerifiedDocumentProjectionBundles(checkpointContext, input.projection, verified.authorization);
-    await finalizeProjectionCheckpoints(checkpointContext, input);
-    return verified.headManifest;
-}
-export async function verifyDocumentWriterProjectionAuthorization(input) {
-    try {
-        const checkpointContext = createProjectionCheckpointContext({
-            execSql: input.execSql,
-        });
-        const verified = await verifyDocumentWriterProjectionWithContext(withGenerationGuardedPolicyWarmer(input), checkpointContext);
-        observeVerifiedDocumentProjectionBundles(checkpointContext, input.projection, verified.authorization);
-        await finalizeProjectionCheckpoints(checkpointContext, input);
-        return verified.authorization;
-    }
-    catch (error) {
-        throwKeyingVerificationShapeFailure(error);
-    }
-}
-//# sourceMappingURL=documentProjectionVerification.js.map

package/data/keyingProjectionVerification/documentProjectionVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentProjectionVerification.js","sourceRoot":"","sources":["documentProjectionVerification.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,EAChC,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAM/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,SAAS,CAAC;AAK5D,SAAS,oCAAoC,CAC3C,UAA4C;IAE5C,OAAO;QACL,GAAG,UAAU,CAAC,8BAA8B;QAC5C,GAAG,UAAU,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,yCAAyC,CAChD,UAA4C;IAE5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,4BAA4B,CAC7D,UAAU,CACX,CAAC,OAAO,EAAE,EAAE,CAAC;QACZ,mCAAmC,CACjC,aAAa,EACb,WAAW,EACX,+CAA+C,KAAK,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,oCAAoC,CAC9D,UAAU,CACX,CAAC,OAAO,EAAE,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,eAAe,CACb,aAAa,EACb,MAAM,EACN,8CAA8C,KAAK,KAAK,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CACT,KAAK,EACL,MAAM,EACP,IAAI,UAAU,CAAC,gCAAgC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,eAAe,CACb,aAAa,EACb,MAAM,EACN,gDAAgD,KAAK,GAAG,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAQ7C;IACC,MAAM,aAAa,GAAG,yCAAyC,CAC7D,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,2BAA2B,GAAG,IAAI,GAAG,EAGxC,CAAC;IACJ,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,IAAI,GAAG,EAA2C,CAAC;IAC7E,KAAK,MAAM,UAAU,IAAI,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D;YACE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,EACD,KAAK,CAAC,iBAAiB,CACxB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,EAAE,CAAC;YACT,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5B,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,KAAK,MAAM,CACT,KAAK,EACL,IAAI,EACL,IAAI,KAAK,CAAC,UAAU,CAAC,8BAA8B,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;YACrD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,4BAA4B,EAAE,IAAI;YAClC,eAAe,EAAE,KAAK;YACtB,uBAAuB,EAAE,YAAY;YACrC,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,KAAK;YAC9B,KAAK,EAAE,8CAA8C,KAAK,GAAG;YAC7D,IAAI;YACJ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;QACH,oEAAoE;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC;YACxC,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxD,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IAEH,OAAO,2BAA2B,CAAC;AACrC,CAAC;AA6BD,KAAK,UAAU,yCAAyC,CACtD,KAAiE,EACjE,iBAA8C;IAE9C,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAmC,CAAC;IAC3E,MAAM,qBAAqB,GAAG,MAAM,qCAAqC,CAAC;QACxE,OAAO,EAAE;YACP,KAAK,CAAC,UAAU,CAAC,gBAAgB;YACjC,GAAG,KAAK,CAAC,UAAU,CAAC,uBAAuB;YAC3C,GAAG,yCAAyC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE;SACxE;QACD,iBAAiB;QACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,cAAc,EAAE,kBAAkB,CAChC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,EAC1C,8BAA8B,CAC/B,CAAC,cAAc;QAChB,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,2BAA2B,GAAG,MAAM,8BAA8B,CAAC;QACvE,qBAAqB;QACrB,iBAAiB;QACjB,oBAAoB;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GACpC,MAAM,iCAAiC,CAAC;QACtC,qBAAqB;QACrB,iBAAiB;QACjB,2BAA2B;QAC3B,oBAAoB;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,MAAM,8BAA8B,CAClC,YAAY,CAAC,KAAK,CAAC,UAAU,EAC7B,iBAAiB,CAAC,OAAO,CAC1B,CAAC;IAEF,gCAAgC,CAAC,iBAAiB,EAAE;QAClD,aAAa,EAAE,CAAC,YAAY,CAAC;QAC7B,iBAAiB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE;YACb,2BAA2B;YAC3B,sBAAsB,EAAE,cAAc;YACtC,iBAAiB,EAAE,qBAAqB;SACzC;QACD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,wCAAwC,CAC/C,iBAA8C,EAC9C,UAA4C,EAC5C,aAAoD;IAEpD,gCAAgC,CAC9B,iBAAiB,EACjB,IAAI,GAAG,CACL,CAAC,UAAU,CAAC,gBAAgB,EAAE,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC,GAAG,CACtE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAC1C,CACF,EACD,aAAa,CAAC,sBAAsB,CACrC,CAAC;IACF,gCAAgC,CAC9B,iBAAiB,EACjB,yCAAyC,CAAC,UAAU,CAAC,EACrD,IAAI,GAAG,CACL,CAAC,GAAG,aAAa,CAAC,2BAA2B,CAAC,MAAM,EAAE,CAAC;SACpD,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CACxD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAgD;IAEhD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,iCAAiC,CAAC,KAAK,CAAC,EACxC,iBAAiB,CAClB,CAAC;IACF,wCAAwC,CACtC,iBAAiB,EACjB,KAAK,CAAC,UAAU,EAChB,QAAQ,CAAC,aAAa,CACvB,CAAC;IACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,KAAgD;IAEhD,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,iCAAiC,CAAC,KAAK,CAAC,EACxC,iBAAiB,CAClB,CAAC;QACF,wCAAwC,CACtC,iBAAiB,EACjB,KAAK,CAAC,UAAU,EAChB,QAAQ,CAAC,aAAa,CACvB,CAAC;QACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC","sourcesContent":["import type {\n  PrincipalPolicyAuthorization,\n  VerifiedContainerAccessManifest,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"./bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeAccessManifestCheckpoints,\n  observeVerifiedProjectionBundles,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport {\n  addContainerWriterProjectionBundles,\n  verifiedContainerManifestsForBundles,\n  verifyContainerWriterProjectionWithContext,\n} from \"./containerProjectionVerification\";\nimport { documentContainerProjections } from \"./documentContainerProjections\";\nimport { verifyDocumentProjectionManifests } from \"./documentManifestVerification\";\nimport { rejectPurgedDocumentProjection } from \"./documentPurgeCheckpointEnforcement\";\nimport { throwKeyingVerificationShapeFailure } from \"./error\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport { readAccessManifest } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport { withGenerationGuardedPolicyWarmer } from \"./types\";\n\ntype VerifiedManifestMap = Map<string, VerifiedContainerAccessManifest>;\ntype PolicyWarmer = ReferencedPrincipalPolicyWarmer | undefined;\n\nfunction readDocumentProjectionContainerPaths(\n  projection: DocumentWriterProjectionResponse,\n): AccessManifestBundleWireResponse[][] {\n  return [\n    ...projection.documentManifestContainerPaths,\n    ...projection.authorizingContainerPaths.map((path) => path.path),\n  ];\n}\n\nfunction collectDocumentProjectionContainerBundles(\n  projection: DocumentWriterProjectionResponse,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  for (const [index, authorizing] of documentContainerProjections(\n    projection,\n  ).entries()) {\n    addContainerWriterProjectionBundles(\n      bundlesByHash,\n      authorizing,\n      `Document writer projection authorizing path[${index}]`,\n    );\n  }\n  for (const [index, path] of readDocumentProjectionContainerPaths(\n    projection,\n  ).entries()) {\n    for (const [pathIndex, bundle] of path.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `Document writer projection dependency path[${index}][${pathIndex}]`,\n      );\n    }\n  }\n  for (const [\n    index,\n    bundle,\n  ] of projection.documentContainerManifestHistory.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document writer projection container history[${index}]`,\n    );\n  }\n  return bundlesByHash;\n}\n\nasync function verifyProjectionContainerPaths(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly projection: DocumentWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedByHash?: VerifiedManifestMap | undefined;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}): Promise<Map<string, readonly VerifiedContainerAccessManifest[]>> {\n  const bundlesByHash = collectDocumentProjectionContainerBundles(\n    input.projection,\n  );\n  const containerPathByManifestHash = new Map<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >();\n  // Reuse a caller-supplied cache when provided so a later unwrap pass over the\n  // same authorizing container paths does not re-verify identical manifests.\n  const verifiedByHash =\n    input.verifiedByHash ?? new Map<string, VerifiedContainerAccessManifest>();\n  for (const projection of documentContainerProjections(input.projection)) {\n    const path = await verifyContainerWriterProjectionWithContext(\n      {\n        authorizationEvidence: input.authorizationEvidence,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveUserKey,\n        verifiedByHash,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      input.checkpointContext,\n    );\n    const leaf = path.at(-1);\n    if (leaf) {\n      containerPathByManifestHash.set(leaf.manifestHash, path);\n    }\n    for (const manifest of path) {\n      verifiedByHash.set(manifest.manifestHash, manifest);\n    }\n  }\n  // Grouping supplies evidence only; each signed artifact selects its citations.\n  for (const [\n    index,\n    path,\n  ] of input.projection.documentManifestContainerPaths.entries()) {\n    // Historical dependency evidence is verified without current checkpoint\n    // enforcement. Its grouping cannot substitute an uncited ancestor into\n    // document or content-write authorization.\n    const verifiedPath = await verifyContainerManifestPath({\n      authorizationEvidence: input.authorizationEvidence,\n      requireAuthorizationEvidence: true,\n      servedAsCurrent: false,\n      authorizationMembership: \"referenced\",\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoints: false,\n      label: `Document writer projection dependency path[${index}]`,\n      path,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      verifiedByHash,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n    // The authorizing path recorded for the same leaf takes precedence.\n    const leaf = verifiedPath.at(-1);\n    if (leaf && !containerPathByManifestHash.has(leaf.manifestHash)) {\n      containerPathByManifestHash.set(leaf.manifestHash, verifiedPath);\n    }\n  }\n\n  // Keep every verified head as evidence. Events and content headers select\n  // their own signed paths through resolveEventContainerPaths.\n  for (const [hash, manifest] of verifiedByHash) {\n    if (!containerPathByManifestHash.has(hash))\n      containerPathByManifestHash.set(hash, [manifest]);\n  }\n\n  observeAccessManifestCheckpoints(input.checkpointContext, {\n    verifiedHeads: [],\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n\n  return containerPathByManifestHash;\n}\n\ninterface DocumentWriterProjectionVerificationInput {\n  readonly execSql: ExecSql;\n  readonly persistVerificationCheckpoints?: boolean | undefined;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly projection: DocumentWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedByHash?: VerifiedManifestMap | undefined;\n  readonly warmReferencedPrincipalPolicies?: PolicyWarmer;\n}\nexport interface DocumentWriterProjectionAuthorization {\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly documentManifestByHash: ReadonlyMap<\n    string,\n    VerifiedDocumentLinkSetManifest\n  >;\n  readonly principalPolicies: readonly PrincipalPolicyAuthorization[];\n}\n\ninterface VerifiedDocumentWriterProjectionResult {\n  readonly authorization: DocumentWriterProjectionAuthorization;\n  readonly headManifest: VerifiedDocumentLinkSetManifest;\n}\n\nasync function verifyDocumentWriterProjectionWithContext(\n  input: Omit<DocumentWriterProjectionVerificationInput, \"execSql\">,\n  checkpointContext: ProjectionCheckpointContext,\n): Promise<VerifiedDocumentWriterProjectionResult> {\n  const principalPolicyCache =\n    input.principalPolicyCache ?? new Map<string, VerifiedPrincipalPolicy>();\n  const authorizationEvidence = await verifyProjectionAuthorizationEvidence({\n    bundles: [\n      input.projection.documentManifest,\n      ...input.projection.documentManifestHistory,\n      ...collectDocumentProjectionContainerBundles(input.projection).values(),\n    ],\n    checkpointContext,\n    policyEvidence: input.projection.policyEvidence,\n    organizationId: readAccessManifest(\n      input.projection.documentManifest.manifest,\n      \"Document projection manifest\",\n    ).organizationId,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const containerPathByManifestHash = await verifyProjectionContainerPaths({\n    authorizationEvidence,\n    checkpointContext,\n    principalPolicyCache,\n    projection: input.projection,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash: input.verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const { headManifest, verifiedByHash } =\n    await verifyDocumentProjectionManifests({\n      authorizationEvidence,\n      checkpointContext,\n      containerPathByManifestHash,\n      principalPolicyCache,\n      projection: input.projection,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  await rejectPurgedDocumentProjection(\n    headManifest.state.documentId,\n    checkpointContext.execSql,\n  );\n\n  observeAccessManifestCheckpoints(checkpointContext, {\n    verifiedHeads: [headManifest],\n    verifiedManifests: [...verifiedByHash.values()],\n  });\n\n  return {\n    authorization: {\n      containerPathByManifestHash,\n      documentManifestByHash: verifiedByHash,\n      principalPolicies: authorizationEvidence,\n    },\n    headManifest,\n  };\n}\n\n/** Each served bundle, document and container, whose manifest verified. */\nfunction observeVerifiedDocumentProjectionBundles(\n  checkpointContext: ProjectionCheckpointContext,\n  projection: DocumentWriterProjectionResponse,\n  authorization: DocumentWriterProjectionAuthorization,\n): void {\n  observeVerifiedProjectionBundles(\n    checkpointContext,\n    new Map(\n      [projection.documentManifest, ...projection.documentManifestHistory].map(\n        (bundle) => [bundle.manifestHash, bundle],\n      ),\n    ),\n    authorization.documentManifestByHash,\n  );\n  observeVerifiedProjectionBundles(\n    checkpointContext,\n    collectDocumentProjectionContainerBundles(projection),\n    new Map(\n      [...authorization.containerPathByManifestHash.values()]\n        .flat()\n        .map((manifest) => [manifest.manifestHash, manifest]),\n    ),\n  );\n}\n\nexport async function verifyDocumentWriterProjection(\n  input: DocumentWriterProjectionVerificationInput,\n): Promise<VerifiedDocumentLinkSetManifest> {\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n  });\n  const verified = await verifyDocumentWriterProjectionWithContext(\n    withGenerationGuardedPolicyWarmer(input),\n    checkpointContext,\n  );\n  observeVerifiedDocumentProjectionBundles(\n    checkpointContext,\n    input.projection,\n    verified.authorization,\n  );\n  await finalizeProjectionCheckpoints(checkpointContext, input);\n  return verified.headManifest;\n}\n\nexport async function verifyDocumentWriterProjectionAuthorization(\n  input: DocumentWriterProjectionVerificationInput,\n): Promise<DocumentWriterProjectionAuthorization> {\n  try {\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n    });\n    const verified = await verifyDocumentWriterProjectionWithContext(\n      withGenerationGuardedPolicyWarmer(input),\n      checkpointContext,\n    );\n    observeVerifiedDocumentProjectionBundles(\n      checkpointContext,\n      input.projection,\n      verified.authorization,\n    );\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    return verified.authorization;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n"]}

package/data/keyingProjectionVerification/documentPurgeCheckpointCurrency.js

@@ -1,100 +0,0 @@
-import { validateAccessManifestCheckpointEvidence } from "../persistence/keyingCheckpointEvidence.js";
-import { accessManifestObjectKey, loadAccessManifestCheckpoint, } from "../persistence/keyingCheckpointPersistence.js";
-import { PrincipalAuthorizationCheckpointUnavailableError, validatePrincipalAuthorizationCheckpoints, } from "../persistence/principalAuthorizationCheckpoints.js";
-import { ensurePrincipalPolicyTables } from "../persistence/principalPolicyPersistence.js";
-import { registerClientSQLiteCommitGuard } from "../sqlite/sqliteCommitGuards.js";
-import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
-import { runSerializedSqlMutation } from "../sqlite/sqlSchema.js";
-import { validateAccessManifestCheckpoints } from "./accessManifestCheckpointEnforcement.js";
-import { commitProjectionCheckpoints, } from "./checkpointContext.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { admitDocumentPurgePolicyCheckpoints } from "./documentPurgePolicyCheckpoints.js";
-import { projectionLifetimeGuard } from "./projectionLifetimes.js";
-import { assertProjectionVerificationCurrent } from "./types.js";
-/** All artifacts must already be authenticated before currency is considered. */
-async function currentContainerHeads(input) {
-    const current = [];
-    let superseded = false;
-    for (const head of input.context.verifiedHeads) {
-        const checkpoint = head.checkpoint;
-        const local = checkpoint.objectKind === "container"
-            ? await loadAccessManifestCheckpoint(input.execSql, "container", checkpoint.organizationId, checkpoint.objectId)
-            : null;
-        if (!local || checkpoint.epoch >= local.epoch) {
-            current.push(head);
-            continue;
-        }
-        // A newer head does not order this separately signed purge event. Still
-        // reject signed forks visible in the supplied evidence before deferring.
-        const key = accessManifestObjectKey(checkpoint);
-        validateAccessManifestCheckpointEvidence({
-            head,
-            localCheckpoint: local,
-            predecessors: input.context.verifiedManifests.filter((evidence) => accessManifestObjectKey(evidence.checkpoint) === key &&
-                evidence.manifestHash !== head.manifestHash),
-        });
-        superseded = true;
-    }
-    return { current, superseded };
-}
-async function checkPurgeCheckpointCurrency(input, documentPurgeCheckpoint) {
-    // Keep comparison and optional advancement in the same immediate transaction.
-    // Pass the locked executor through nested readers and checkpoint commits.
-    await runSerializedSqlMutation(input.execSql, async (execSql) => {
-        await getClientSQLitePersistenceRuntime(execSql).transaction(async (transaction) => {
-            const stillCurrent = projectionLifetimeGuard(input.context);
-            registerClientSQLiteCommitGuard(execSql, () => assertProjectionVerificationCurrent(stillCurrent));
-            const { current, superseded } = await currentContainerHeads({
-                ...input,
-                execSql,
-            });
-            // An older container must not conceal a document fork, a policy fork, or
-            // conflicting current evidence for another container in the same proof.
-            await validateAccessManifestCheckpoints({
-                execSql,
-                policies: [],
-                verifiedHeads: current,
-                verifiedManifests: input.context.verifiedManifests,
-            });
-            if (input.currencyPolicies.length) {
-                await ensurePrincipalPolicyTables(execSql);
-                await validatePrincipalAuthorizationCheckpoints(transaction, input.currencyPolicies);
-            }
-            if (superseded) {
-                throw new ProjectionDependencyUnavailableError("Document purge cannot be ordered against a newer container checkpoint");
-            }
-            if (documentPurgeCheckpoint) {
-                // Only the complete authenticated terminal proof admits these public
-                // observations. Page recovery and baseline verification never pin.
-                await admitDocumentPurgePolicyCheckpoints({
-                    transaction,
-                    organizationId: input.context.organizationId,
-                    policies: input.principalPolicies,
-                    heads: input.observedPrincipalHeads,
-                });
-                assertProjectionVerificationCurrent(stillCurrent);
-                await commitProjectionCheckpoints({
-                    ...input.context,
-                    policies: [],
-                    // Currency was rechecked above in this same transaction. Private
-                    // ancestry bridges must never become newly admitted purge heads.
-                    authorizationPolicies: [],
-                }, {
-                    documentPurgeCheckpoint,
-                    execSql,
-                });
-            }
-        }, { behavior: "immediate" });
-    }).catch((error) => {
-        if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)
-            throw new ProjectionDependencyUnavailableError(error.message);
-        throw error;
-    });
-}
-export function validateDocumentPurgeCheckpoints(input) {
-    return checkPurgeCheckpointCurrency(input);
-}
-export function commitDocumentPurgeCheckpoints(input) {
-    return checkPurgeCheckpointCurrency(input, input.documentPurgeCheckpoint);
-}
-//# sourceMappingURL=documentPurgeCheckpointCurrency.js.map

package/data/keyingProjectionVerification/documentPurgeCheckpointCurrency.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentPurgeCheckpointCurrency.js","sourceRoot":"","sources":["documentPurgeCheckpointCurrency.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,gDAAgD,EAChD,yCAAyC,GAC1C,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EACL,2BAA2B,GAE5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAU9D,iFAAiF;AACjF,KAAK,UAAU,qBAAqB,CAAC,KAA2B;IAC9D,MAAM,OAAO,GAA+C,EAAE,CAAC;IAC/D,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,KAAK,GACT,UAAU,CAAC,UAAU,KAAK,WAAW;YACnC,CAAC,CAAC,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,WAAW,EACX,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,QAAQ,CACpB;YACH,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,GAAG,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAChD,wCAAwC,CAAC;YACvC,IAAI;YACJ,eAAe,EAAE,KAAK;YACtB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAClD,CAAC,QAAQ,EAAE,EAAE,CACX,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG;gBACpD,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAC9C;SACF,CAAC,CAAC;QACH,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAA2B,EAC3B,uBAAiD;IAEjD,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9D,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAC1D,KAAK,EAAE,WAAW,EAAE,EAAE;YACpB,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5D,+BAA+B,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5C,mCAAmC,CAAC,YAAY,CAAC,CAClD,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,qBAAqB,CAAC;gBAC1D,GAAG,KAAK;gBACR,OAAO;aACR,CAAC,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,iCAAiC,CAAC;gBACtC,OAAO;gBACP,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,OAAO;gBACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;aACnD,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;gBAC3C,MAAM,yCAAyC,CAC7C,WAAW,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,oCAAoC,CAC5C,uEAAuE,CACxE,CAAC;YACJ,CAAC;YACD,IAAI,uBAAuB,EAAE,CAAC;gBAC5B,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,mCAAmC,CAAC;oBACxC,WAAW;oBACX,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;oBAC5C,QAAQ,EAAE,KAAK,CAAC,iBAAiB;oBACjC,KAAK,EAAE,KAAK,CAAC,sBAAsB;iBACpC,CAAC,CAAC;gBACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;gBAClD,MAAM,2BAA2B,CAC/B;oBACE,GAAG,KAAK,CAAC,OAAO;oBAChB,QAAQ,EAAE,EAAE;oBACZ,iEAAiE;oBACjE,iEAAiE;oBACjE,qBAAqB,EAAE,EAAE;iBAC1B,EACD;oBACE,uBAAuB;oBACvB,OAAO;iBACR,CACF,CAAC;YACJ,CAAC;QACH,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA2B;IAE3B,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,KAEC;IAED,OAAO,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import type {\n  ReferencedPrincipalHead,\n  VerifiedAccessManifestCheckpointEvidence,\n  VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"../persistence/keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadAccessManifestCheckpoint,\n} from \"../persistence/keyingCheckpointPersistence\";\nimport {\n  PrincipalAuthorizationCheckpointUnavailableError,\n  validatePrincipalAuthorizationCheckpoints,\n} from \"../persistence/principalAuthorizationCheckpoints\";\nimport { ensurePrincipalPolicyTables } from \"../persistence/principalPolicyPersistence\";\nimport { registerClientSQLiteCommitGuard } from \"../sqlite/sqliteCommitGuards\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, runSerializedSqlMutation } from \"../sqlite/sqlSchema\";\nimport { validateAccessManifestCheckpoints } from \"./accessManifestCheckpointEnforcement\";\nimport {\n  commitProjectionCheckpoints,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { admitDocumentPurgePolicyCheckpoints } from \"./documentPurgePolicyCheckpoints\";\nimport type { PurgePolicyCurrencyEvidence } from \"./documentPurgePolicyCurrency\";\nimport { projectionLifetimeGuard } from \"./projectionLifetimes\";\nimport { assertProjectionVerificationCurrent } from \"./types\";\n\ninterface PurgeCheckpointInput {\n  readonly context: ProjectionCheckpointContext;\n  readonly execSql: ExecSql;\n  readonly principalPolicies: readonly VerifiedPrincipalPolicySelection[];\n  readonly currencyPolicies: readonly PurgePolicyCurrencyEvidence[];\n  readonly observedPrincipalHeads: readonly ReferencedPrincipalHead[];\n}\n\n/** All artifacts must already be authenticated before currency is considered. */\nasync function currentContainerHeads(input: PurgeCheckpointInput) {\n  const current: VerifiedAccessManifestCheckpointEvidence[] = [];\n  let superseded = false;\n  for (const head of input.context.verifiedHeads) {\n    const checkpoint = head.checkpoint;\n    const local =\n      checkpoint.objectKind === \"container\"\n        ? await loadAccessManifestCheckpoint(\n            input.execSql,\n            \"container\",\n            checkpoint.organizationId,\n            checkpoint.objectId,\n          )\n        : null;\n    if (!local || checkpoint.epoch >= local.epoch) {\n      current.push(head);\n      continue;\n    }\n    // A newer head does not order this separately signed purge event. Still\n    // reject signed forks visible in the supplied evidence before deferring.\n    const key = accessManifestObjectKey(checkpoint);\n    validateAccessManifestCheckpointEvidence({\n      head,\n      localCheckpoint: local,\n      predecessors: input.context.verifiedManifests.filter(\n        (evidence) =>\n          accessManifestObjectKey(evidence.checkpoint) === key &&\n          evidence.manifestHash !== head.manifestHash,\n      ),\n    });\n    superseded = true;\n  }\n  return { current, superseded };\n}\n\nasync function checkPurgeCheckpointCurrency(\n  input: PurgeCheckpointInput,\n  documentPurgeCheckpoint?: DocumentPurgeCheckpoint,\n): Promise<void> {\n  // Keep comparison and optional advancement in the same immediate transaction.\n  // Pass the locked executor through nested readers and checkpoint commits.\n  await runSerializedSqlMutation(input.execSql, async (execSql) => {\n    await getClientSQLitePersistenceRuntime(execSql).transaction(\n      async (transaction) => {\n        const stillCurrent = projectionLifetimeGuard(input.context);\n        registerClientSQLiteCommitGuard(execSql, () =>\n          assertProjectionVerificationCurrent(stillCurrent),\n        );\n        const { current, superseded } = await currentContainerHeads({\n          ...input,\n          execSql,\n        });\n        // An older container must not conceal a document fork, a policy fork, or\n        // conflicting current evidence for another container in the same proof.\n        await validateAccessManifestCheckpoints({\n          execSql,\n          policies: [],\n          verifiedHeads: current,\n          verifiedManifests: input.context.verifiedManifests,\n        });\n        if (input.currencyPolicies.length) {\n          await ensurePrincipalPolicyTables(execSql);\n          await validatePrincipalAuthorizationCheckpoints(\n            transaction,\n            input.currencyPolicies,\n          );\n        }\n        if (superseded) {\n          throw new ProjectionDependencyUnavailableError(\n            \"Document purge cannot be ordered against a newer container checkpoint\",\n          );\n        }\n        if (documentPurgeCheckpoint) {\n          // Only the complete authenticated terminal proof admits these public\n          // observations. Page recovery and baseline verification never pin.\n          await admitDocumentPurgePolicyCheckpoints({\n            transaction,\n            organizationId: input.context.organizationId,\n            policies: input.principalPolicies,\n            heads: input.observedPrincipalHeads,\n          });\n          assertProjectionVerificationCurrent(stillCurrent);\n          await commitProjectionCheckpoints(\n            {\n              ...input.context,\n              policies: [],\n              // Currency was rechecked above in this same transaction. Private\n              // ancestry bridges must never become newly admitted purge heads.\n              authorizationPolicies: [],\n            },\n            {\n              documentPurgeCheckpoint,\n              execSql,\n            },\n          );\n        }\n      },\n      { behavior: \"immediate\" },\n    );\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n}\n\nexport function validateDocumentPurgeCheckpoints(\n  input: PurgeCheckpointInput,\n): Promise<void> {\n  return checkPurgeCheckpointCurrency(input);\n}\n\nexport function commitDocumentPurgeCheckpoints(\n  input: PurgeCheckpointInput & {\n    readonly documentPurgeCheckpoint: DocumentPurgeCheckpoint;\n  },\n): Promise<void> {\n  return checkPurgeCheckpointCurrency(input, input.documentPurgeCheckpoint);\n}\n"]}

package/data/keyingProjectionVerification/documentPurgeCheckpointEnforcement.js

@@ -1,8 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { loadDocumentPurgeCheckpoint } from "../persistence/documentPurgeCheckpointPersistence.js";
-export async function rejectPurgedDocumentProjection(documentId, execSql) {
-    if (await loadDocumentPurgeCheckpoint(execSql, documentId)) {
-        throw new KeyingVerificationError("rollback", "Document writer projection targets a permanently purged document");
-    }
-}
-//# sourceMappingURL=documentPurgeCheckpointEnforcement.js.map

package/data/keyingProjectionVerification/documentPurgeCheckpointEnforcement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentPurgeCheckpointEnforcement.js","sourceRoot":"","sources":["documentPurgeCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAGhG,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,UAAkB,EAClB,OAAgB;IAEhB,IAAI,MAAM,2BAA2B,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,kEAAkE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { loadDocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\nexport async function rejectPurgedDocumentProjection(\n  documentId: string,\n  execSql: ExecSql,\n): Promise<void> {\n  if (await loadDocumentPurgeCheckpoint(execSql, documentId)) {\n    throw new KeyingVerificationError(\n      \"rollback\",\n      \"Document writer projection targets a permanently purged document\",\n    );\n  }\n}\n"]}

package/data/keyingProjectionVerification/documentPurgeDocumentChainVerification.js

@@ -1,177 +0,0 @@
-import { KeyingVerificationError, verifyDocumentLinkSetSnapshot, } from "../../internal/crypto/index.js";
-import { readCanonicalJson } from "../keying/canonicalJson.js";
-import { addBundleByHash, assertCanonicalEqual, verifyAccessEventBundle, } from "./bundleVerification.js";
-import { observeAccessManifestCheckpoints, } from "./checkpointContext.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { verifyDocumentManifestBundle } from "./documentManifestVerification.js";
-import { loadManifestCheckpointVerification } from "./manifestCheckpointVerification.js";
-import { readAccessManifest, readDocumentAccessEventBody } from "./readers.js";
-async function verifyPinnedChainEndpoint(input) {
-    const manifest = readAccessManifest(input.bundle.manifest, "Document purge predecessor endpoint manifest");
-    const checkpointVerification = await loadManifestCheckpointVerification({
-        current: manifest,
-        execSql: input.checkpointContext.execSql,
-        localCheckpoints: input.checkpointContext.localCheckpoints,
-        verifiedManifests: new Map(),
-    });
-    const localCheckpoint = checkpointVerification.localCheckpoint;
-    if (!localCheckpoint) {
-        throw new ProjectionDependencyUnavailableError("Document purge history needs a local checkpoint or signed genesis");
-    }
-    if (localCheckpoint.epoch !== manifest.epoch ||
-        localCheckpoint.manifestHash !== input.bundle.manifestHash) {
-        throw new KeyingVerificationError(localCheckpoint.epoch > manifest.epoch ? "rollback" : "stale_predecessor", "Document purge predecessor chain does not start at the local checkpoint");
-    }
-    const verified = await verifyDocumentLinkSetSnapshot({
-        ...checkpointVerification,
-        expectedManifestHash: input.bundle.manifestHash,
-        manifest,
-        state: input.bundle.state,
-    });
-    if (!verified.ok)
-        throw verified.error;
-    assertCanonicalEqual({
-        actual: input.bundle.state,
-        expected: readCanonicalJson(verified.value.state, "Document purge predecessor endpoint state"),
-        label: "Document purge predecessor endpoint state",
-    });
-    return verified.value;
-}
-async function recordSnapshotContainerEvidence(input) {
-    if (!input.usedContainerManifests)
-        return;
-    const event = await verifyAccessEventBundle({
-        bundle: input.proof.documentManifest,
-        label: "Document purge manifest snapshot",
-        resolveUserKey: input.resolveUserKey,
-    });
-    if (event.eventHash !== input.manifest.manifest.eventHash) {
-        throw new KeyingVerificationError("hash_mismatch", "Document purge manifest snapshot event is not bound to its manifest");
-    }
-    const body = readDocumentAccessEventBody(event.body, "Document purge manifest snapshot event body");
-    const manifestHashes = [
-        ...event.event.dependencyManifestHashes,
-        body.containerManifestHash,
-    ];
-    for (const manifestHash of manifestHashes) {
-        for (const containerManifest of input.containerPathByManifestHash.get(manifestHash) ?? []) {
-            input.usedContainerManifests.set(containerManifest.manifestHash, containerManifest);
-        }
-    }
-}
-async function verifyPurgeChainEndpoint(input) {
-    const endpointManifest = readAccessManifest(input.endpoint.manifest, "Document purge chain endpoint");
-    if (endpointManifest.previousManifestHash === null) {
-        await verifyDocumentManifestBundle({
-            ...input,
-            authorizationMembership: "referenced",
-            bundle: input.endpoint,
-            enforceLocalCheckpoint: false,
-            label: "Document purge genesis",
-            requireAuthorizationEvidence: true,
-        });
-        return null;
-    }
-    if (!input.enforceLocalCheckpoints) {
-        throw new KeyingVerificationError("missing_dependency", "Initial document purge history does not reach signed genesis");
-    }
-    return verifyPinnedChainEndpoint({
-        bundle: input.endpoint,
-        checkpointContext: input.checkpointContext,
-    });
-}
-async function verifySignedPurgeDocumentManifestChain(input) {
-    const bundlesByHash = new Map();
-    addBundleByHash(bundlesByHash, input.proof.documentManifest, "Document purge manifest");
-    for (const [index, bundle,] of input.proof.documentManifestPredecessors.entries()) {
-        addBundleByHash(bundlesByHash, bundle, `Document purge predecessor[${index}]`);
-    }
-    const endpoint = input.proof.documentManifestPredecessors.at(-1) ??
-        input.proof.documentManifest;
-    const verifiedByHash = new Map();
-    const trustedPredecessorByHash = new Map();
-    const verifiedEndpoint = await verifyPurgeChainEndpoint({
-        ...input,
-        endpoint,
-        bundlesByHash,
-        verifiedByHash,
-    });
-    if (verifiedEndpoint) {
-        trustedPredecessorByHash.set(verifiedEndpoint.manifestHash, verifiedEndpoint);
-    }
-    const verificationInput = {
-        ...input,
-        authorizationMembership: "referenced",
-        bundlesByHash,
-        requireAuthorizationEvidence: true,
-        trustedPredecessorByHash,
-        verifiedByHash,
-    };
-    for (let index = input.proof.documentManifestPredecessors.length - 2; index >= 0; index -= 1) {
-        const bundle = input.proof.documentManifestPredecessors[index];
-        if (!bundle) {
-            throw new KeyingVerificationError("missing_dependency", `Document purge predecessor[${index}] is missing`);
-        }
-        await verifyDocumentManifestBundle({
-            ...verificationInput,
-            bundle,
-            enforceLocalCheckpoint: false,
-            label: `Document purge predecessor[${index}]`,
-        });
-    }
-    const head = await verifyDocumentManifestBundle({
-        ...verificationInput,
-        bundle: input.proof.documentManifest,
-        enforceLocalCheckpoint: input.enforceLocalCheckpoints,
-        label: "Document purge manifest",
-    });
-    observeAccessManifestCheckpoints(input.checkpointContext, {
-        verifiedHeads: [head],
-        verifiedManifests: [...verifiedByHash.values()],
-    });
-    return head;
-}
-export async function verifyPurgeDocumentManifest(input) {
-    const verifiedByHash = new Map();
-    const manifest = readAccessManifest(input.proof.documentManifest.manifest, "Document purge manifest snapshot");
-    const checkpointVerification = input.enforceLocalCheckpoints
-        ? await loadManifestCheckpointVerification({
-            current: manifest,
-            execSql: input.checkpointContext.execSql,
-            localCheckpoints: input.checkpointContext.localCheckpoints,
-            verifiedManifests: verifiedByHash,
-        })
-        : undefined;
-    const localCheckpoint = checkpointVerification?.localCheckpoint;
-    const isPinnedHead = localCheckpoint?.epoch === manifest.epoch &&
-        localCheckpoint.manifestHash === input.proof.documentManifest.manifestHash;
-    // Baseline inspection may read a hash-only snapshot. Committing a purge
-    // requires an exact existing pin or verified signed transitions from
-    // that pin (or signed genesis for a fresh device).
-    if (input.proof.documentManifestPredecessors.length > 0 ||
-        (input.enforceLocalCheckpoints && !isPinnedHead)) {
-        return verifySignedPurgeDocumentManifestChain(input);
-    }
-    const verified = await verifyDocumentLinkSetSnapshot({
-        ...(checkpointVerification ?? {}),
-        expectedManifestHash: input.proof.documentManifest.manifestHash,
-        manifest,
-        state: input.proof.documentManifest.state,
-    });
-    if (!verified.ok)
-        throw verified.error;
-    const documentManifest = verified.value;
-    await recordSnapshotContainerEvidence({
-        containerPathByManifestHash: input.containerPathByManifestHash,
-        manifest: documentManifest,
-        proof: input.proof,
-        resolveUserKey: input.resolveUserKey,
-        usedContainerManifests: input.usedContainerManifests,
-    });
-    observeAccessManifestCheckpoints(input.checkpointContext, {
-        verifiedHeads: [documentManifest],
-        verifiedManifests: [...verifiedByHash.values()],
-    });
-    return documentManifest;
-}
-//# sourceMappingURL=documentPurgeDocumentChainVerification.js.map

package/data/keyingProjectionVerification/documentPurgeDocumentChainVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentPurgeDocumentChainVerification.js","sourceRoot":"","sources":["documentPurgeDocumentChainVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAMvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAG5E,KAAK,UAAU,yBAAyB,CAAC,KAGxC;IACC,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,MAAM,CAAC,QAAQ,EACrB,8CAA8C,CAC/C,CAAC;IACF,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;QACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;QAC1D,iBAAiB,EAAE,IAAI,GAAG,EAAE;KAC7B,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,sBAAsB,CAAC,eAAe,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oCAAoC,CAC5C,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IACE,eAAe,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QACxC,eAAe,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,YAAY,EAC1D,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,EACzE,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,GAAG,sBAAsB;QACzB,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,oBAAoB,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,QAAQ,EAAE,iBAAiB,CACzB,QAAQ,CAAC,KAAK,CAAC,KAAK,EACpB,2CAA2C,CAC5C;QACD,KAAK,EAAE,2CAA2C;KACnD,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAW9C;IACC,IAAI,CAAC,KAAK,CAAC,sBAAsB;QAAE,OAAO;IAC1C,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;QACpC,KAAK,EAAE,kCAAkC;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,2BAA2B,CACtC,KAAK,CAAC,IAAI,EACV,6CAA6C,CAC9C,CAAC;IACF,MAAM,cAAc,GAAG;QACrB,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB;QACvC,IAAI,CAAC,qBAAqB;KAC3B,CAAC;IACF,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;QAC1C,KAAK,MAAM,iBAAiB,IAAI,KAAK,CAAC,2BAA2B,CAAC,GAAG,CACnE,YAAY,CACb,IAAI,EAAE,EAAE,CAAC;YACR,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAC9B,iBAAiB,CAAC,YAAY,EAC9B,iBAAiB,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAOC;IAED,MAAM,gBAAgB,GAAG,kBAAkB,CACzC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EACvB,+BAA+B,CAChC,CAAC;IACF,IAAI,gBAAgB,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,4BAA4B,CAAC;YACjC,GAAG,KAAK;YACR,uBAAuB,EAAE,YAAY;YACrC,MAAM,EAAE,KAAK,CAAC,QAAQ;YACtB,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,wBAAwB;YAC/B,4BAA4B,EAAE,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,yBAAyB,CAAC;QAC/B,MAAM,EAAE,KAAK,CAAC,QAAQ;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAcrD;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,eAAe,CACb,aAAa,EACb,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAC5B,yBAAyB,CAC1B,CAAC;IACF,KAAK,MAAM,CACT,KAAK,EACL,MAAM,EACP,IAAI,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,eAAe,CACb,aAAa,EACb,MAAM,EACN,8BAA8B,KAAK,GAAG,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAGrC,CAAC;IACJ,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC;QACtD,GAAG,KAAK;QACR,QAAQ;QACR,aAAa;QACb,cAAc;KACf,CAAC,CAAC;IACH,IAAI,gBAAgB,EAAE,CAAC;QACrB,wBAAwB,CAAC,GAAG,CAC1B,gBAAgB,CAAC,YAAY,EAC7B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG;QACxB,GAAG,KAAK;QACR,uBAAuB,EAAE,YAAqB;QAC9C,aAAa;QACb,4BAA4B,EAAE,IAAI;QAClC,wBAAwB;QACxB,cAAc;KACf,CAAC;IACF,KACE,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAC/D,KAAK,IAAI,CAAC,EACV,KAAK,IAAI,CAAC,EACV,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8BAA8B,KAAK,cAAc,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,4BAA4B,CAAC;YACjC,GAAG,iBAAiB;YACpB,MAAM;YACN,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,8BAA8B,KAAK,GAAG;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC;QAC9C,GAAG,iBAAiB;QACpB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;QACpC,sBAAsB,EAAE,KAAK,CAAC,uBAAuB;QACrD,KAAK,EAAE,yBAAyB;KACjC,CAAC,CAAC;IACH,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxD,aAAa,EAAE,CAAC,IAAI,CAAC;QACrB,iBAAiB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAcjD;IACC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0C,CAAC;IACzE,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EACrC,kCAAkC,CACnC,CAAC;IACF,MAAM,sBAAsB,GAAG,KAAK,CAAC,uBAAuB;QAC1D,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YAC1D,iBAAiB,EAAE,cAAc;SAClC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,eAAe,GAAG,sBAAsB,EAAE,eAAe,CAAC;IAChE,MAAM,YAAY,GAChB,eAAe,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK;QACzC,eAAe,CAAC,YAAY,KAAK,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC7E,wEAAwE;IACxE,qEAAqE;IACrE,mDAAmD;IACnD,IACE,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC;QACnD,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,YAAY,CAAC,EAChD,CAAC;QACD,OAAO,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACjC,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY;QAC/D,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC;IACxC,MAAM,+BAA+B,CAAC;QACpC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC,CAAC;IACH,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxD,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,iBAAiB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC;AAC1B,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyAuthorization,\n  type VerifiedAccessManifestSnapshot,\n  type VerifiedContainerAccessManifest,\n  type VerifiedDocumentLinkSetManifest,\n  type VerifiedDocumentLinkSetSnapshot,\n  verifyDocumentLinkSetSnapshot,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentPurgeProofResponse,\n} from \"@tearleads/validators/response\";\nimport { readCanonicalJson } from \"../keying/canonicalJson\";\nimport {\n  addBundleByHash,\n  assertCanonicalEqual,\n  verifyAccessEventBundle,\n} from \"./bundleVerification\";\nimport {\n  observeAccessManifestCheckpoints,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { verifyDocumentManifestBundle } from \"./documentManifestVerification\";\nimport { loadManifestCheckpointVerification } from \"./manifestCheckpointVerification\";\nimport { readAccessManifest, readDocumentAccessEventBody } from \"./readers\";\nimport type { PrincipalPolicyCache, ProjectionUserKeyResolver } from \"./types\";\n\nasync function verifyPinnedChainEndpoint(input: {\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly checkpointContext: ProjectionCheckpointContext;\n}): Promise<VerifiedDocumentLinkSetSnapshot> {\n  const manifest = readAccessManifest(\n    input.bundle.manifest,\n    \"Document purge predecessor endpoint manifest\",\n  );\n  const checkpointVerification = await loadManifestCheckpointVerification({\n    current: manifest,\n    execSql: input.checkpointContext.execSql,\n    localCheckpoints: input.checkpointContext.localCheckpoints,\n    verifiedManifests: new Map(),\n  });\n  const localCheckpoint = checkpointVerification.localCheckpoint;\n  if (!localCheckpoint) {\n    throw new ProjectionDependencyUnavailableError(\n      \"Document purge history needs a local checkpoint or signed genesis\",\n    );\n  }\n  if (\n    localCheckpoint.epoch !== manifest.epoch ||\n    localCheckpoint.manifestHash !== input.bundle.manifestHash\n  ) {\n    throw new KeyingVerificationError(\n      localCheckpoint.epoch > manifest.epoch ? \"rollback\" : \"stale_predecessor\",\n      \"Document purge predecessor chain does not start at the local checkpoint\",\n    );\n  }\n  const verified = await verifyDocumentLinkSetSnapshot({\n    ...checkpointVerification,\n    expectedManifestHash: input.bundle.manifestHash,\n    manifest,\n    state: input.bundle.state,\n  });\n  if (!verified.ok) throw verified.error;\n  assertCanonicalEqual({\n    actual: input.bundle.state,\n    expected: readCanonicalJson(\n      verified.value.state,\n      \"Document purge predecessor endpoint state\",\n    ),\n    label: \"Document purge predecessor endpoint state\",\n  });\n  return verified.value;\n}\n\nasync function recordSnapshotContainerEvidence(input: {\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly manifest: VerifiedDocumentLinkSetSnapshot;\n  readonly proof: DocumentPurgeProofResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly usedContainerManifests?:\n    | Map<string, VerifiedContainerAccessManifest>\n    | undefined;\n}): Promise<void> {\n  if (!input.usedContainerManifests) return;\n  const event = await verifyAccessEventBundle({\n    bundle: input.proof.documentManifest,\n    label: \"Document purge manifest snapshot\",\n    resolveUserKey: input.resolveUserKey,\n  });\n  if (event.eventHash !== input.manifest.manifest.eventHash) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Document purge manifest snapshot event is not bound to its manifest\",\n    );\n  }\n  const body = readDocumentAccessEventBody(\n    event.body,\n    \"Document purge manifest snapshot event body\",\n  );\n  const manifestHashes = [\n    ...event.event.dependencyManifestHashes,\n    body.containerManifestHash,\n  ];\n  for (const manifestHash of manifestHashes) {\n    for (const containerManifest of input.containerPathByManifestHash.get(\n      manifestHash,\n    ) ?? []) {\n      input.usedContainerManifests.set(\n        containerManifest.manifestHash,\n        containerManifest,\n      );\n    }\n  }\n}\n\nasync function verifyPurgeChainEndpoint(\n  input: Parameters<typeof verifySignedPurgeDocumentManifestChain>[0] & {\n    readonly endpoint: AccessManifestBundleWireResponse;\n    readonly bundlesByHash: ReadonlyMap<\n      string,\n      AccessManifestBundleWireResponse\n    >;\n    readonly verifiedByHash: Map<string, VerifiedDocumentLinkSetManifest>;\n  },\n): Promise<VerifiedDocumentLinkSetSnapshot | null> {\n  const endpointManifest = readAccessManifest(\n    input.endpoint.manifest,\n    \"Document purge chain endpoint\",\n  );\n  if (endpointManifest.previousManifestHash === null) {\n    await verifyDocumentManifestBundle({\n      ...input,\n      authorizationMembership: \"referenced\",\n      bundle: input.endpoint,\n      enforceLocalCheckpoint: false,\n      label: \"Document purge genesis\",\n      requireAuthorizationEvidence: true,\n    });\n    return null;\n  }\n  if (!input.enforceLocalCheckpoints) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Initial document purge history does not reach signed genesis\",\n    );\n  }\n  return verifyPinnedChainEndpoint({\n    bundle: input.endpoint,\n    checkpointContext: input.checkpointContext,\n  });\n}\n\nasync function verifySignedPurgeDocumentManifestChain(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly enforceLocalCheckpoints: boolean;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly proof: DocumentPurgeProofResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly usedContainerManifests?:\n    | Map<string, VerifiedContainerAccessManifest>\n    | undefined;\n}): Promise<VerifiedDocumentLinkSetManifest> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addBundleByHash(\n    bundlesByHash,\n    input.proof.documentManifest,\n    \"Document purge manifest\",\n  );\n  for (const [\n    index,\n    bundle,\n  ] of input.proof.documentManifestPredecessors.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document purge predecessor[${index}]`,\n    );\n  }\n\n  const endpoint =\n    input.proof.documentManifestPredecessors.at(-1) ??\n    input.proof.documentManifest;\n  const verifiedByHash = new Map<string, VerifiedDocumentLinkSetManifest>();\n  const trustedPredecessorByHash = new Map<\n    string,\n    VerifiedDocumentLinkSetSnapshot\n  >();\n  const verifiedEndpoint = await verifyPurgeChainEndpoint({\n    ...input,\n    endpoint,\n    bundlesByHash,\n    verifiedByHash,\n  });\n  if (verifiedEndpoint) {\n    trustedPredecessorByHash.set(\n      verifiedEndpoint.manifestHash,\n      verifiedEndpoint,\n    );\n  }\n\n  const verificationInput = {\n    ...input,\n    authorizationMembership: \"referenced\" as const,\n    bundlesByHash,\n    requireAuthorizationEvidence: true,\n    trustedPredecessorByHash,\n    verifiedByHash,\n  };\n  for (\n    let index = input.proof.documentManifestPredecessors.length - 2;\n    index >= 0;\n    index -= 1\n  ) {\n    const bundle = input.proof.documentManifestPredecessors[index];\n    if (!bundle) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        `Document purge predecessor[${index}] is missing`,\n      );\n    }\n    await verifyDocumentManifestBundle({\n      ...verificationInput,\n      bundle,\n      enforceLocalCheckpoint: false,\n      label: `Document purge predecessor[${index}]`,\n    });\n  }\n  const head = await verifyDocumentManifestBundle({\n    ...verificationInput,\n    bundle: input.proof.documentManifest,\n    enforceLocalCheckpoint: input.enforceLocalCheckpoints,\n    label: \"Document purge manifest\",\n  });\n  observeAccessManifestCheckpoints(input.checkpointContext, {\n    verifiedHeads: [head],\n    verifiedManifests: [...verifiedByHash.values()],\n  });\n  return head;\n}\n\nexport async function verifyPurgeDocumentManifest(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly enforceLocalCheckpoints: boolean;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly proof: DocumentPurgeProofResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly usedContainerManifests?:\n    | Map<string, VerifiedContainerAccessManifest>\n    | undefined;\n}): Promise<VerifiedDocumentLinkSetManifest | VerifiedDocumentLinkSetSnapshot> {\n  const verifiedByHash = new Map<string, VerifiedAccessManifestSnapshot>();\n  const manifest = readAccessManifest(\n    input.proof.documentManifest.manifest,\n    \"Document purge manifest snapshot\",\n  );\n  const checkpointVerification = input.enforceLocalCheckpoints\n    ? await loadManifestCheckpointVerification({\n        current: manifest,\n        execSql: input.checkpointContext.execSql,\n        localCheckpoints: input.checkpointContext.localCheckpoints,\n        verifiedManifests: verifiedByHash,\n      })\n    : undefined;\n  const localCheckpoint = checkpointVerification?.localCheckpoint;\n  const isPinnedHead =\n    localCheckpoint?.epoch === manifest.epoch &&\n    localCheckpoint.manifestHash === input.proof.documentManifest.manifestHash;\n  // Baseline inspection may read a hash-only snapshot. Committing a purge\n  // requires an exact existing pin or verified signed transitions from\n  // that pin (or signed genesis for a fresh device).\n  if (\n    input.proof.documentManifestPredecessors.length > 0 ||\n    (input.enforceLocalCheckpoints && !isPinnedHead)\n  ) {\n    return verifySignedPurgeDocumentManifestChain(input);\n  }\n  const verified = await verifyDocumentLinkSetSnapshot({\n    ...(checkpointVerification ?? {}),\n    expectedManifestHash: input.proof.documentManifest.manifestHash,\n    manifest,\n    state: input.proof.documentManifest.state,\n  });\n  if (!verified.ok) throw verified.error;\n  const documentManifest = verified.value;\n  await recordSnapshotContainerEvidence({\n    containerPathByManifestHash: input.containerPathByManifestHash,\n    manifest: documentManifest,\n    proof: input.proof,\n    resolveUserKey: input.resolveUserKey,\n    usedContainerManifests: input.usedContainerManifests,\n  });\n  observeAccessManifestCheckpoints(input.checkpointContext, {\n    verifiedHeads: [documentManifest],\n    verifiedManifests: [...verifiedByHash.values()],\n  });\n  return documentManifest;\n}\n"]}