@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/keyingProjectionVerification/container/containerProjectionVerification.js

@@ -0,0 +1,254 @@
+import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, toFingerprint, verifyContainerKekState, } from "../../../internal/crypto/index.js";
+import { addBundleByHash } from "../checkpoints/bundleVerification.js";
+import { createProjectionCheckpointContext, finalizeProjectionCheckpoints, observeAccessManifestCheckpoints, observeVerifiedProjectionBundles, } from "../checkpoints/checkpointContext.js";
+import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
+import { throwKeyingVerificationShapeFailure } from "../error.js";
+import { collectReferencedPrincipalPolicies } from "../principalPolicy/principalPolicyVerification.js";
+import { verifyProjectionAuthorizationEvidence } from "../principalPolicy/projectionAuthorizationEvidence.js";
+import { readContainerKekRecipientTarget, readContainerKeyEpoch, readContainerKeyWrap, } from "../readers.js";
+import { assertProjectionVerificationCurrent, generationGuardedPrincipalPolicyWarmer, withGenerationGuardedPolicyWarmer, } from "../types.js";
+import { verifyContainerManifestBundle } from "./containerManifestVerification.js";
+import { verifyContainerManifestPath } from "./containerPathVerification.js";
+async function collectContainerUserRecipientKeys(input) {
+    const userIds = [
+        ...new Set(input.containerManifest.state.directGrants
+            .filter((grant) => grant.subjectType === "user")
+            .map((grant) => grant.subjectId)),
+    ].sort();
+    const userRecipientKeys = [];
+    for (const userId of userIds) {
+        const userKey = await input.resolveUserKey(userId);
+        if (!userKey) {
+            throw new ProjectionDependencyUnavailableError(`Container writer projection recipient key could not be resolved for ${userId}`);
+        }
+        const recipientKeyFingerprint = await toFingerprint(userKey.encapsulationPublicKey);
+        userRecipientKeys.push({
+            userId,
+            recipientKeyEpochId: `user:${userId}:encapsulation:${recipientKeyFingerprint}`,
+            recipientKeyFingerprint,
+        });
+    }
+    return userRecipientKeys;
+}
+function containerKekManifestHistory(input) {
+    const historyByHash = new Map();
+    for (const manifest of input.history) {
+        if (manifest.state.containerId === input.verifiedManifest.state.containerId &&
+            manifest.manifestHash !== input.verifiedManifest.manifestHash) {
+            historyByHash.set(manifest.manifestHash, manifest);
+        }
+    }
+    return [...historyByHash.values()];
+}
+async function verifyContainerKekProjection(input) {
+    if (input.verifiedManifest.state.parentContainerId && !input.parentKekState) {
+        throw new Error(`${input.label} requires verified parent KEK state`);
+    }
+    const keyEpoch = readContainerKeyEpoch(input.kek.keyEpoch, `${input.label} key epoch`);
+    const wraps = input.kek.wraps.map((wrap, index) => readContainerKeyWrap(wrap, `${input.label} wrap[${index}]`));
+    const userRecipientKeys = await collectContainerUserRecipientKeys({
+        containerManifest: input.verifiedManifest,
+        resolveUserKey: input.resolveUserKey,
+    });
+    const verifiedKekManifestHistory = containerKekManifestHistory({
+        history: input.verifiedManifestHistory,
+        verifiedManifest: input.verifiedManifest,
+    });
+    const verified = await verifyContainerKekState({
+        allowHistoricalParentEpoch: true,
+        containerManifest: input.verifiedManifest,
+        containerManifestHistory: verifiedKekManifestHistory,
+        parentManifestHistory: input.parentManifestHistory,
+        keyEpoch,
+        parentKekState: input.parentKekState,
+        principalPolicies: input.authorizationEvidence,
+        userRecipientKeys,
+        wraps,
+    });
+    if (!verified.ok) {
+        throw new Error(`${input.label} KEK verification failed`);
+    }
+    const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);
+    if (keyEpochHash !== input.kek.keyEpochHash) {
+        throw new Error(`${input.label} key epoch hash mismatch`);
+    }
+    const recipientTargets = input.kek.recipientTargets.map((target, index) => readContainerKekRecipientTarget(target, `${input.label} recipient target[${index}]`));
+    const keyTargetHash = await computeContainerKekRecipientTargetHash(recipientTargets);
+    if (keyTargetHash !== input.kek.keyTargetHash ||
+        keyTargetHash !== verified.value.keyTargetHash) {
+        throw new Error(`${input.label} target hash mismatch`);
+    }
+    if (verified.value.containerKeyEpochId !== input.kek.containerKeyEpochId ||
+        verified.value.containerKeyEpoch !== input.kek.containerKeyEpoch ||
+        verified.value.accessManifestHash !== input.kek.accessManifestHash ||
+        verified.value.parentContainerKeyEpochId !==
+            input.kek.parentContainerKeyEpochId) {
+        throw new Error(`${input.label} identity mismatch`);
+    }
+    return verified.value;
+}
+export function verifiedContainerManifestsForBundles(bundlesByHash, verifiedByHash) {
+    return [...bundlesByHash.keys()].flatMap((manifestHash) => {
+        const verified = verifiedByHash.get(manifestHash);
+        return verified ? [verified] : [];
+    });
+}
+function collectContainerProjectionBundles(projection) {
+    const bundlesByHash = new Map();
+    addContainerWriterProjectionBundles(bundlesByHash, projection, "Container writer projection");
+    return bundlesByHash;
+}
+export async function verifyContainerWriterProjectionWithContext(input, checkpointContext) {
+    if (input.projection.path.length !== input.projection.containerKeks.length) {
+        throw new Error("Container writer projection path and KEKs are inconsistent");
+    }
+    const bundlesByHash = collectContainerProjectionBundles(input.projection);
+    const verifiedByHash = input.verifiedByHash ?? new Map();
+    const principalPolicyCache = input.principalPolicyCache ?? new Map();
+    const verification = {
+        checkpointContext,
+        principalPolicyCache,
+        resolveUserKey: input.resolveUserKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    };
+    const authorizationEvidence = input.authorizationEvidence ??
+        (await verifyProjectionAuthorizationEvidence({
+            ...verification,
+            bundles: [...bundlesByHash.values()],
+            policyEvidence: input.projection.policyEvidence,
+            organizationId: input.projection.organizationId,
+            stillCurrent: input.stillCurrent,
+        }));
+    const verifiedPath = await verifyContainerManifestPath({
+        ...verification,
+        authorizationEvidence,
+        requireAuthorizationEvidence: true,
+        servedAsCurrent: true,
+        bundlesByHash,
+        enforceLocalCheckpoints: true,
+        label: "Container writer projection path",
+        path: input.projection.path,
+        verifiedByHash,
+    });
+    const verifiedKekStates = [];
+    for (const [index, kek] of input.projection.containerKeks.entries()) {
+        const verifiedManifest = verifiedPath[index];
+        if (!verifiedManifest) {
+            throw new Error(`Container writer projection KEK[${index}] is missing`);
+        }
+        const verifiedManifestHistory = [];
+        for (const [historyIndex, bundle,] of kek.containerManifestHistory.entries()) {
+            verifiedManifestHistory.push(await verifyContainerManifestBundle({
+                ...verification,
+                authorizationEvidence,
+                requireAuthorizationEvidence: true,
+                bundle,
+                bundlesByHash,
+                enforceLocalCheckpoint: false,
+                label: `Container writer projection KEK[${index}] history[${historyIndex}]`,
+                parentPath: verifiedPath.slice(0, index),
+                verifiedByHash,
+            }));
+        }
+        const verifiedKekState = await verifyContainerKekProjection({
+            authorizationEvidence,
+            kek,
+            label: `Container writer projection KEK[${index}]`,
+            parentKekState: index > 0 ? (verifiedKekStates[index - 1] ?? null) : null,
+            resolveUserKey: input.resolveUserKey,
+            verifiedManifest,
+            verifiedManifestHistory,
+            parentManifestHistory: [...verifiedByHash.values()],
+        });
+        verifiedKekStates.push(verifiedKekState);
+    }
+    observeAccessManifestCheckpoints(checkpointContext, {
+        verifiedHeads: verifiedPath,
+        verifiedManifests: verifiedContainerManifestsForBundles(bundlesByHash, verifiedByHash),
+    });
+    checkpointContext.heldContainerHeads.push(...verifiedPath);
+    return verifiedPath;
+}
+export async function verifyContainerWriterProjection(input) {
+    try {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const verifiedByHash = input.verifiedByHash ??
+            new Map();
+        const guardedInput = {
+            ...withGenerationGuardedPolicyWarmer(input),
+            verifiedByHash,
+        };
+        const checkpointContext = createProjectionCheckpointContext({
+            execSql: input.execSql,
+            organizationId: input.projection.organizationId,
+        });
+        const verifiedPath = await verifyContainerWriterProjectionWithContext(guardedInput, checkpointContext);
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        observeVerifiedProjectionBundles(checkpointContext, collectContainerProjectionBundles(input.projection), verifiedByHash);
+        await finalizeProjectionCheckpoints(checkpointContext, input);
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        return verifiedPath;
+    }
+    catch (error) {
+        throwKeyingVerificationShapeFailure(error);
+    }
+}
+export async function collectContainerWriterProjectionPrincipalPolicies(input) {
+    try {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const warmReferencedPrincipalPolicies = generationGuardedPrincipalPolicyWarmer(input.warmReferencedPrincipalPolicies, input.stillCurrent);
+        const principalPolicyCache = input.principalPolicyCache ?? new Map();
+        const verifiedByHash = input.verifiedByHash ??
+            new Map();
+        const checkpointContext = createProjectionCheckpointContext({
+            execSql: input.execSql,
+            organizationId: input.projection.organizationId,
+        });
+        const verifiedPath = await verifyContainerWriterProjectionWithContext({
+            principalPolicyCache,
+            projection: input.projection,
+            verifiedByHash,
+            resolveUserKey: input.resolveUserKey,
+            warmReferencedPrincipalPolicies,
+        }, checkpointContext);
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const policies = await collectPrincipalPoliciesForContainerPaths({
+            checkpointContext,
+            organizationId: input.projection.organizationId,
+            paths: [verifiedPath],
+            principalPolicyCache,
+            resolveUserKey: input.resolveUserKey,
+            warmReferencedPrincipalPolicies,
+        });
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        observeVerifiedProjectionBundles(checkpointContext, collectContainerProjectionBundles(input.projection), verifiedByHash);
+        await finalizeProjectionCheckpoints(checkpointContext, input);
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        return policies;
+    }
+    catch (error) {
+        throwKeyingVerificationShapeFailure(error);
+    }
+}
+export function addContainerWriterProjectionBundles(bundlesByHash, projection, label) {
+    for (const [index, bundle] of projection.path.entries()) {
+        addBundleByHash(bundlesByHash, bundle, `${label} path[${index}]`);
+    }
+    for (const [kekIndex, kek] of projection.containerKeks.entries()) {
+        for (const [historyIndex, bundle,] of kek.containerManifestHistory.entries()) {
+            addBundleByHash(bundlesByHash, bundle, `${label} KEK[${kekIndex}] history[${historyIndex}]`);
+        }
+    }
+}
+async function collectPrincipalPoliciesForContainerPaths(input) {
+    const referencedPrincipalHeads = input.paths.flatMap((path) => (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads));
+    return collectReferencedPrincipalPolicies({
+        checkpointContext: input.checkpointContext,
+        organizationId: input.organizationId,
+        principalPolicyCache: input.principalPolicyCache,
+        references: referencedPrincipalHeads,
+        resolveUserKey: input.resolveUserKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+}
+//# sourceMappingURL=containerProjectionVerification.js.map

package/data/keyingProjectionVerification/container/containerProjectionVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerProjectionVerification.js","sourceRoot":"","sources":["containerProjectionVerification.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,EAC5B,aAAa,EAGb,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,EAChC,gCAAgC,GAEjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,mCAAmC,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACpG,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAC3G,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAE1E,KAAK,UAAU,iCAAiC,CAAC,KAGhD;IACC,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY;aACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CACnC;KACF,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAE1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,oCAAoC,CAC5C,uEAAuE,MAAM,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,GAAG,MAAM,aAAa,CACjD,OAAO,CAAC,sBAAsB,CAC/B,CAAC;QACF,iBAAiB,CAAC,IAAI,CAAC;YACrB,MAAM;YACN,mBAAmB,EAAE,QAAQ,MAAM,kBAAkB,uBAAuB,EAAE;YAC9E,uBAAuB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,2BAA2B,CAAC,KAGpC;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2C,CAAC;IAEzE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,IACE,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW;YACvE,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAC7D,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAS3C;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAClB,GAAG,KAAK,CAAC,KAAK,YAAY,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,oBAAoB,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,SAAS,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,iCAAiC,CAAC;QAChE,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,uBAAuB;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,0BAA0B,EAAE,IAAI;QAChC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,wBAAwB,EAAE,0BAA0B;QACpD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,qBAAqB;QAC9C,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACxE,+BAA+B,CAC7B,MAAM,EACN,GAAG,KAAK,CAAC,KAAK,qBAAqB,KAAK,GAAG,CAC5C,CACF,CAAC;IACF,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,IACE,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa;QACzC,aAAa,KAAK,QAAQ,CAAC,KAAK,CAAC,aAAa,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,GAAG,CAAC,mBAAmB;QACpE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,GAAG,CAAC,iBAAiB;QAChE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,GAAG,CAAC,kBAAkB;QAClE,QAAQ,CAAC,KAAK,CAAC,yBAAyB;YACtC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAiBD,MAAM,UAAU,oCAAoC,CAClD,aAAoE,EACpE,cAAoE;IAEpE,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iCAAiC,CACxC,UAA6C;IAE7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,mCAAmC,CACjC,aAAa,EACb,UAAU,EACV,6BAA6B,CAC9B,CAAC;IACF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,KAEC,EACD,iBAA8C;IAE9C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE1E,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,IAAI,GAAG,EAA2C,CAAC;IAC7E,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG;QACnB,iBAAiB;QACjB,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC;IACF,MAAM,qBAAqB,GACzB,KAAK,CAAC,qBAAqB;QAC3B,CAAC,MAAM,qCAAqC,CAAC;YAC3C,GAAG,YAAY;YACf,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,CAAC;IACN,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,GAAG,YAAY;QACf,qBAAqB;QACrB,4BAA4B,EAAE,IAAI;QAClC,eAAe,EAAE,IAAI;QACrB,aAAa;QACb,uBAAuB,EAAE,IAAI;QAC7B,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,cAAc,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,uBAAuB,GAAsC,EAAE,CAAC;QACtE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,uBAAuB,CAAC,IAAI,CAC1B,MAAM,6BAA6B,CAAC;gBAClC,GAAG,YAAY;gBACf,qBAAqB;gBACrB,4BAA4B,EAAE,IAAI;gBAClC,MAAM;gBACN,aAAa;gBACb,sBAAsB,EAAE,KAAK;gBAC7B,KAAK,EAAE,mCAAmC,KAAK,aAAa,YAAY,GAAG;gBAC3E,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,cAAc;aACf,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC;YAC1D,qBAAqB;YACrB,GAAG;YACH,KAAK,EAAE,mCAAmC,KAAK,GAAG;YAClD,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;YAChB,uBAAuB;YACvB,qBAAqB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC,CAAC,iBAAiB,EAAE;QAClD,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IAEH,iBAAiB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc;YACpB,IAAI,GAAG,EAA2C,CAAC;QACrD,MAAM,YAAY,GAAG;YACnB,GAAG,iCAAiC,CAAC,KAAK,CAAC;YAC3C,cAAc;SACf,CAAC;QACF,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,gCAAgC,CAC9B,iBAAiB,EACjB,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,EACnD,cAAc,CACf,CAAC;QACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iDAAiD,CACrE,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc;YACpB,IAAI,GAAG,EAA2C,CAAC;QACrD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE;YACE,oBAAoB;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc;YACd,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,EACD,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAAC;YAC/D,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,oBAAoB;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,gCAAgC,CAC9B,iBAAiB,EACjB,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,EACnD,cAAc,CACf,CAAC;QACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,aAA4D,EAC5D,UAA6C,EAC7C,KAAa;IAEb,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,eAAe,CACb,aAAa,EACb,MAAM,EACN,GAAG,KAAK,QAAQ,QAAQ,aAAa,YAAY,GAAG,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yCAAyC,CAAC,KAOxD;IACC,MAAM,wBAAwB,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5D,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAC5E,CAAC;IAEF,OAAO,kCAAkC,CAAC;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  type ContainerUserRecipientKey,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  toFingerprint,\n  type VerifiedContainerAccessManifest,\n  type VerifiedContainerKekState,\n  verifyContainerKekState,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"../checkpoints/bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeAccessManifestCheckpoints,\n  observeVerifiedProjectionBundles,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { throwKeyingVerificationShapeFailure } from \"../error\";\nimport { collectReferencedPrincipalPolicies } from \"../principalPolicy/principalPolicyVerification\";\nimport { verifyProjectionAuthorizationEvidence } from \"../principalPolicy/projectionAuthorizationEvidence\";\nimport {\n  readContainerKekRecipientTarget,\n  readContainerKeyEpoch,\n  readContainerKeyWrap,\n} from \"../readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n  withGenerationGuardedPolicyWarmer,\n} from \"../types\";\nimport { verifyContainerManifestBundle } from \"./containerManifestVerification\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\n\nasync function collectContainerUserRecipientKeys(input: {\n  readonly containerManifest: VerifiedContainerAccessManifest;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<ContainerUserRecipientKey[]> {\n  const userIds = [\n    ...new Set(\n      input.containerManifest.state.directGrants\n        .filter((grant) => grant.subjectType === \"user\")\n        .map((grant) => grant.subjectId),\n    ),\n  ].sort();\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n\n  for (const userId of userIds) {\n    const userKey = await input.resolveUserKey(userId);\n    if (!userKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `Container writer projection recipient key could not be resolved for ${userId}`,\n      );\n    }\n    const recipientKeyFingerprint = await toFingerprint(\n      userKey.encapsulationPublicKey,\n    );\n    userRecipientKeys.push({\n      userId,\n      recipientKeyEpochId: `user:${userId}:encapsulation:${recipientKeyFingerprint}`,\n      recipientKeyFingerprint,\n    });\n  }\n\n  return userRecipientKeys;\n}\n\nfunction containerKekManifestHistory(input: {\n  readonly history: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n}): VerifiedContainerAccessManifest[] {\n  const historyByHash = new Map<string, VerifiedContainerAccessManifest>();\n\n  for (const manifest of input.history) {\n    if (\n      manifest.state.containerId === input.verifiedManifest.state.containerId &&\n      manifest.manifestHash !== input.verifiedManifest.manifestHash\n    ) {\n      historyByHash.set(manifest.manifestHash, manifest);\n    }\n  }\n\n  return [...historyByHash.values()];\n}\n\nasync function verifyContainerKekProjection(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly kek: ContainerWriterProjectionResponse[\"containerKeks\"][number];\n  readonly label: string;\n  readonly parentKekState: VerifiedContainerKekState | null;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n  readonly verifiedManifestHistory: readonly VerifiedContainerAccessManifest[];\n  readonly parentManifestHistory: readonly VerifiedContainerAccessManifest[];\n}): Promise<VerifiedContainerKekState> {\n  if (input.verifiedManifest.state.parentContainerId && !input.parentKekState) {\n    throw new Error(`${input.label} requires verified parent KEK state`);\n  }\n\n  const keyEpoch = readContainerKeyEpoch(\n    input.kek.keyEpoch,\n    `${input.label} key epoch`,\n  );\n  const wraps = input.kek.wraps.map((wrap, index) =>\n    readContainerKeyWrap(wrap, `${input.label} wrap[${index}]`),\n  );\n  const userRecipientKeys = await collectContainerUserRecipientKeys({\n    containerManifest: input.verifiedManifest,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verifiedKekManifestHistory = containerKekManifestHistory({\n    history: input.verifiedManifestHistory,\n    verifiedManifest: input.verifiedManifest,\n  });\n  const verified = await verifyContainerKekState({\n    allowHistoricalParentEpoch: true,\n    containerManifest: input.verifiedManifest,\n    containerManifestHistory: verifiedKekManifestHistory,\n    parentManifestHistory: input.parentManifestHistory,\n    keyEpoch,\n    parentKekState: input.parentKekState,\n    principalPolicies: input.authorizationEvidence,\n    userRecipientKeys,\n    wraps,\n  });\n  if (!verified.ok) {\n    throw new Error(`${input.label} KEK verification failed`);\n  }\n\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  if (keyEpochHash !== input.kek.keyEpochHash) {\n    throw new Error(`${input.label} key epoch hash mismatch`);\n  }\n  const recipientTargets = input.kek.recipientTargets.map((target, index) =>\n    readContainerKekRecipientTarget(\n      target,\n      `${input.label} recipient target[${index}]`,\n    ),\n  );\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  if (\n    keyTargetHash !== input.kek.keyTargetHash ||\n    keyTargetHash !== verified.value.keyTargetHash\n  ) {\n    throw new Error(`${input.label} target hash mismatch`);\n  }\n  if (\n    verified.value.containerKeyEpochId !== input.kek.containerKeyEpochId ||\n    verified.value.containerKeyEpoch !== input.kek.containerKeyEpoch ||\n    verified.value.accessManifestHash !== input.kek.accessManifestHash ||\n    verified.value.parentContainerKeyEpochId !==\n      input.kek.parentContainerKeyEpochId\n  ) {\n    throw new Error(`${input.label} identity mismatch`);\n  }\n\n  return verified.value;\n}\n\ninterface ContainerWriterProjectionVerificationInput {\n  readonly execSql: ExecSql;\n  readonly persistVerificationCheckpoints?: boolean | undefined;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedByHash?:\n    | Map<string, VerifiedContainerAccessManifest>\n    | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport function verifiedContainerManifestsForBundles(\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): VerifiedContainerAccessManifest[] {\n  return [...bundlesByHash.keys()].flatMap((manifestHash) => {\n    const verified = verifiedByHash.get(manifestHash);\n    return verified ? [verified] : [];\n  });\n}\n\nfunction collectContainerProjectionBundles(\n  projection: ContainerWriterProjectionResponse,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addContainerWriterProjectionBundles(\n    bundlesByHash,\n    projection,\n    \"Container writer projection\",\n  );\n  return bundlesByHash;\n}\n\nexport async function verifyContainerWriterProjectionWithContext(\n  input: Omit<ContainerWriterProjectionVerificationInput, \"execSql\"> & {\n    readonly authorizationEvidence?: readonly PrincipalPolicyAuthorization[];\n  },\n  checkpointContext: ProjectionCheckpointContext,\n): Promise<VerifiedContainerAccessManifest[]> {\n  if (input.projection.path.length !== input.projection.containerKeks.length) {\n    throw new Error(\n      \"Container writer projection path and KEKs are inconsistent\",\n    );\n  }\n\n  const bundlesByHash = collectContainerProjectionBundles(input.projection);\n\n  const verifiedByHash =\n    input.verifiedByHash ?? new Map<string, VerifiedContainerAccessManifest>();\n  const principalPolicyCache: PrincipalPolicyCache =\n    input.principalPolicyCache ?? new Map();\n  const verification = {\n    checkpointContext,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  };\n  const authorizationEvidence =\n    input.authorizationEvidence ??\n    (await verifyProjectionAuthorizationEvidence({\n      ...verification,\n      bundles: [...bundlesByHash.values()],\n      policyEvidence: input.projection.policyEvidence,\n      organizationId: input.projection.organizationId,\n      stillCurrent: input.stillCurrent,\n    }));\n  const verifiedPath = await verifyContainerManifestPath({\n    ...verification,\n    authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    servedAsCurrent: true,\n    bundlesByHash,\n    enforceLocalCheckpoints: true,\n    label: \"Container writer projection path\",\n    path: input.projection.path,\n    verifiedByHash,\n  });\n\n  const verifiedKekStates: VerifiedContainerKekState[] = [];\n  for (const [index, kek] of input.projection.containerKeks.entries()) {\n    const verifiedManifest = verifiedPath[index];\n    if (!verifiedManifest) {\n      throw new Error(`Container writer projection KEK[${index}] is missing`);\n    }\n    const verifiedManifestHistory: VerifiedContainerAccessManifest[] = [];\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      verifiedManifestHistory.push(\n        await verifyContainerManifestBundle({\n          ...verification,\n          authorizationEvidence,\n          requireAuthorizationEvidence: true,\n          bundle,\n          bundlesByHash,\n          enforceLocalCheckpoint: false,\n          label: `Container writer projection KEK[${index}] history[${historyIndex}]`,\n          parentPath: verifiedPath.slice(0, index),\n          verifiedByHash,\n        }),\n      );\n    }\n\n    const verifiedKekState = await verifyContainerKekProjection({\n      authorizationEvidence,\n      kek,\n      label: `Container writer projection KEK[${index}]`,\n      parentKekState: index > 0 ? (verifiedKekStates[index - 1] ?? null) : null,\n      resolveUserKey: input.resolveUserKey,\n      verifiedManifest,\n      verifiedManifestHistory,\n      parentManifestHistory: [...verifiedByHash.values()],\n    });\n    verifiedKekStates.push(verifiedKekState);\n  }\n\n  observeAccessManifestCheckpoints(checkpointContext, {\n    verifiedHeads: verifiedPath,\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n\n  checkpointContext.heldContainerHeads.push(...verifiedPath);\n  return verifiedPath;\n}\n\nexport async function verifyContainerWriterProjection(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<VerifiedContainerAccessManifest[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const verifiedByHash =\n      input.verifiedByHash ??\n      new Map<string, VerifiedContainerAccessManifest>();\n    const guardedInput = {\n      ...withGenerationGuardedPolicyWarmer(input),\n      verifiedByHash,\n    };\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      guardedInput,\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    observeVerifiedProjectionBundles(\n      checkpointContext,\n      collectContainerProjectionBundles(input.projection),\n      verifiedByHash,\n    );\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    return verifiedPath;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport async function collectContainerWriterProjectionPrincipalPolicies(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const warmReferencedPrincipalPolicies =\n      generationGuardedPrincipalPolicyWarmer(\n        input.warmReferencedPrincipalPolicies,\n        input.stillCurrent,\n      );\n    const principalPolicyCache: PrincipalPolicyCache =\n      input.principalPolicyCache ?? new Map();\n    const verifiedByHash =\n      input.verifiedByHash ??\n      new Map<string, VerifiedContainerAccessManifest>();\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      {\n        principalPolicyCache,\n        projection: input.projection,\n        verifiedByHash,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      },\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n\n    const policies = await collectPrincipalPoliciesForContainerPaths({\n      checkpointContext,\n      organizationId: input.projection.organizationId,\n      paths: [verifiedPath],\n      principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    observeVerifiedProjectionBundles(\n      checkpointContext,\n      collectContainerProjectionBundles(input.projection),\n      verifiedByHash,\n    );\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    return policies;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function addContainerWriterProjectionBundles(\n  bundlesByHash: Map<string, AccessManifestBundleWireResponse>,\n  projection: ContainerWriterProjectionResponse,\n  label: string,\n): void {\n  for (const [index, bundle] of projection.path.entries()) {\n    addBundleByHash(bundlesByHash, bundle, `${label} path[${index}]`);\n  }\n  for (const [kekIndex, kek] of projection.containerKeks.entries()) {\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `${label} KEK[${kekIndex}] history[${historyIndex}]`,\n      );\n    }\n  }\n}\n\nasync function collectPrincipalPoliciesForContainerPaths(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  paths: readonly (readonly VerifiedContainerAccessManifest[] | undefined)[];\n  principalPolicyCache: PrincipalPolicyCache;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const referencedPrincipalHeads = input.paths.flatMap((path) =>\n    (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads),\n  );\n\n  return collectReferencedPrincipalPolicies({\n    checkpointContext: input.checkpointContext,\n    organizationId: input.organizationId,\n    principalPolicyCache: input.principalPolicyCache,\n    references: referencedPrincipalHeads,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/document/documentDependencyPaths.d.ts

@@ -0,0 +1,17 @@
+import { type VerifiedContainerAccessManifest } from "../../../internal/crypto/index.js";
+/**
+ * Rebuild historical authorization from the event's signed heads, not from
+ * creation-time parent pins or the server's grouping of dependency paths.
+ * Paths in the evidence index only supply verified manifests. Authorization
+ * uses exactly the ancestor heads this event signed, regardless of grouping.
+ * Prefix paths are evidence too; crypto authorization admits only leaves named
+ * by the signed document link set or committed content target set.
+ */
+export declare function resolveEventContainerPaths(input: {
+    readonly containerPathByManifestHash: ReadonlyMap<string, readonly VerifiedContainerAccessManifest[]>;
+    readonly dependencyManifestHashes: readonly string[];
+    readonly targetManifestHash?: string;
+}): {
+    dependencyContainerPaths: VerifiedContainerAccessManifest[][];
+    targetContainerPath: readonly VerifiedContainerAccessManifest[] | undefined;
+};

package/data/keyingProjectionVerification/document/documentDependencyPaths.js

@@ -0,0 +1,70 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { MAX_CONTAINER_PATH_LENGTH } from "../../../internal/validators/util/index.js";
+import { assertCitedAncestorsDoNotRegress } from "../container/containerAncestorCitations.js";
+/**
+ * Rebuild historical authorization from the event's signed heads, not from
+ * creation-time parent pins or the server's grouping of dependency paths.
+ * Paths in the evidence index only supply verified manifests. Authorization
+ * uses exactly the ancestor heads this event signed, regardless of grouping.
+ * Prefix paths are evidence too; crypto authorization admits only leaves named
+ * by the signed document link set or committed content target set.
+ */
+export function resolveEventContainerPaths(input) {
+    const manifests = new Map();
+    for (const path of input.containerPathByManifestHash.values()) {
+        for (const manifest of path) {
+            manifests.set(manifest.manifestHash, manifest);
+        }
+    }
+    const cited = new Map();
+    for (const hash of input.dependencyManifestHashes) {
+        const manifest = manifests.get(hash);
+        if (!manifest) {
+            throw new KeyingVerificationError("missing_dependency", "Document event cites an unavailable container manifest");
+        }
+        if (cited.has(manifest.state.containerId)) {
+            throw new KeyingVerificationError("duplicate_entry", "Document event cites two heads of one container");
+        }
+        cited.set(manifest.state.containerId, manifest);
+    }
+    const dependencyContainerPaths = [...cited.values()].map((leaf) => {
+        const reversed = [];
+        const seen = new Set();
+        let containerId = leaf.state.containerId;
+        while (containerId !== null) {
+            if (seen.has(containerId) ||
+                reversed.length >= MAX_CONTAINER_PATH_LENGTH) {
+                throw new KeyingVerificationError("object_mismatch", "Document event cited container path is cyclic or too deep");
+            }
+            seen.add(containerId);
+            const ancestor = cited.get(containerId);
+            if (!ancestor) {
+                throw new KeyingVerificationError("missing_dependency", `Document event does not cite ancestor ${containerId}`);
+            }
+            if (ancestor.state.organizationId !== leaf.state.organizationId) {
+                throw new KeyingVerificationError("object_mismatch", "Document event cited container path crosses organizations");
+            }
+            reversed.push(ancestor);
+            containerId = ancestor.state.parentContainerId;
+        }
+        const path = reversed.reverse();
+        // The cited descendant is itself an earlier signed statement. Its own
+        // citations establish floors for every ancestor, even when the server
+        // supplied these verified manifests in separate projection paths.
+        assertCitedAncestorsDoNotRegress({
+            bundlesByHash: new Map(),
+            label: "Document event",
+            verifiedByHash: manifests,
+            citedAncestors: path.slice(0, -1),
+            previousManifest: leaf,
+        });
+        return path;
+    });
+    return {
+        dependencyContainerPaths,
+        targetContainerPath: input.targetManifestHash === undefined
+            ? undefined
+            : dependencyContainerPaths.find((path) => path.at(-1)?.manifestHash === input.targetManifestHash),
+    };
+}
+//# sourceMappingURL=documentDependencyPaths.js.map

package/data/keyingProjectionVerification/document/documentDependencyPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentDependencyPaths.js","sourceRoot":"","sources":["documentDependencyPaths.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAO1C;IAIC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,2BAA2B,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2C,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,wBAAwB,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChE,MAAM,QAAQ,GAAsC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,WAAW,GAAkB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACxD,OAAO,WAAW,KAAK,IAAI,EAAE,CAAC;YAC5B,IACE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;gBACrB,QAAQ,CAAC,MAAM,IAAI,yBAAyB,EAC5C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yCAAyC,WAAW,EAAE,CACvD,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,gCAAgC,CAAC;YAC/B,aAAa,EAAE,IAAI,GAAG,EAAE;YACxB,KAAK,EAAE,gBAAgB;YACvB,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO;QACL,wBAAwB;QACxB,mBAAmB,EACjB,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,KAAK,CAAC,kBAAkB,CACjE;KACR,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { MAX_CONTAINER_PATH_LENGTH } from \"@tearleads/validators/util\";\nimport { assertCitedAncestorsDoNotRegress } from \"../container/containerAncestorCitations\";\n\n/**\n * Rebuild historical authorization from the event's signed heads, not from\n * creation-time parent pins or the server's grouping of dependency paths.\n * Paths in the evidence index only supply verified manifests. Authorization\n * uses exactly the ancestor heads this event signed, regardless of grouping.\n * Prefix paths are evidence too; crypto authorization admits only leaves named\n * by the signed document link set or committed content target set.\n */\nexport function resolveEventContainerPaths(input: {\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly dependencyManifestHashes: readonly string[];\n  readonly targetManifestHash?: string;\n}): {\n  dependencyContainerPaths: VerifiedContainerAccessManifest[][];\n  targetContainerPath: readonly VerifiedContainerAccessManifest[] | undefined;\n} {\n  const manifests = new Map<string, VerifiedContainerAccessManifest>();\n  for (const path of input.containerPathByManifestHash.values()) {\n    for (const manifest of path) {\n      manifests.set(manifest.manifestHash, manifest);\n    }\n  }\n  const cited = new Map<string, VerifiedContainerAccessManifest>();\n  for (const hash of input.dependencyManifestHashes) {\n    const manifest = manifests.get(hash);\n    if (!manifest) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Document event cites an unavailable container manifest\",\n      );\n    }\n    if (cited.has(manifest.state.containerId)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        \"Document event cites two heads of one container\",\n      );\n    }\n    cited.set(manifest.state.containerId, manifest);\n  }\n  const dependencyContainerPaths = [...cited.values()].map((leaf) => {\n    const reversed: VerifiedContainerAccessManifest[] = [];\n    const seen = new Set<string>();\n    let containerId: string | null = leaf.state.containerId;\n    while (containerId !== null) {\n      if (\n        seen.has(containerId) ||\n        reversed.length >= MAX_CONTAINER_PATH_LENGTH\n      ) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Document event cited container path is cyclic or too deep\",\n        );\n      }\n      seen.add(containerId);\n      const ancestor = cited.get(containerId);\n      if (!ancestor) {\n        throw new KeyingVerificationError(\n          \"missing_dependency\",\n          `Document event does not cite ancestor ${containerId}`,\n        );\n      }\n      if (ancestor.state.organizationId !== leaf.state.organizationId) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Document event cited container path crosses organizations\",\n        );\n      }\n      reversed.push(ancestor);\n      containerId = ancestor.state.parentContainerId;\n    }\n    const path = reversed.reverse();\n    // The cited descendant is itself an earlier signed statement. Its own\n    // citations establish floors for every ancestor, even when the server\n    // supplied these verified manifests in separate projection paths.\n    assertCitedAncestorsDoNotRegress({\n      bundlesByHash: new Map(),\n      label: \"Document event\",\n      verifiedByHash: manifests,\n      citedAncestors: path.slice(0, -1),\n      previousManifest: leaf,\n    });\n    return path;\n  });\n  return {\n    dependencyContainerPaths,\n    targetContainerPath:\n      input.targetManifestHash === undefined\n        ? undefined\n        : dependencyContainerPaths.find(\n            (path) => path.at(-1)?.manifestHash === input.targetManifestHash,\n          ),\n  };\n}\n"]}

package/data/keyingProjectionVerification/document/documentManifestPolicies.js

@@ -0,0 +1,32 @@
+import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../../internal/crypto/index.js";
+import { collectReferencedPrincipalPolicies } from "../principalPolicy/principalPolicyVerification.js";
+export async function collectDocumentManifestPrincipalPolicies(input) {
+    const authorizationEvidence = input.authorizationEvidence ?? [];
+    const references = input.paths
+        .flatMap((path) => (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads))
+        .filter((reference) => !authorizationEvidence.some((policy) => principalPolicyMatchesReference({ policy, reference })));
+    if (input.requireAuthorizationEvidence && references.length > 0) {
+        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
+    }
+    if (input.requireAuthorizationEvidence)
+        return [...authorizationEvidence];
+    return [
+        ...authorizationEvidence,
+        ...(await collectReferencedPrincipalPolicies({
+            checkpointContext: input.checkpointContext,
+            organizationId: input.organizationId,
+            principalPolicyCache: input.principalPolicyCache,
+            references,
+            resolveUserKey: input.resolveUserKey,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        })),
+    ];
+}
+export function recordUsedDocumentContainerManifests(input) {
+    for (const path of input.paths) {
+        for (const manifest of path ?? []) {
+            input.used?.set(manifest.manifestHash, manifest);
+        }
+    }
+}
+//# sourceMappingURL=documentManifestPolicies.js.map

package/data/keyingProjectionVerification/document/documentManifestPolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentManifestPolicies.js","sourceRoot":"","sources":["documentManifestPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAYpG,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAgB9D;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;SAC3B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD,CACF;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,IAAI,KAAK,CAAC,4BAA4B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B;QAAE,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,qBAAqB;QACxB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAMpD;IACC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { ProjectionCheckpointContext } from \"../checkpoints/checkpointContext\";\nimport { collectReferencedPrincipalPolicies } from \"../principalPolicy/principalPolicyVerification\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\n\nexport type UsedDocumentContainerManifests = Map<\n  string,\n  VerifiedContainerAccessManifest\n>;\n\nexport async function collectDocumentManifestPrincipalPolicies(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<PrincipalPolicyAuthorization[]> {\n  const authorizationEvidence = input.authorizationEvidence ?? [];\n  const references = input.paths\n    .flatMap((path) =>\n      (path ?? []).flatMap(\n        (manifest) => manifest.state.referencedPrincipalHeads,\n      ),\n    )\n    .filter(\n      (reference) =>\n        !authorizationEvidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  if (input.requireAuthorizationEvidence && references.length > 0) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  }\n  if (input.requireAuthorizationEvidence) return [...authorizationEvidence];\n  return [\n    ...authorizationEvidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport function recordUsedDocumentContainerManifests(input: {\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly used?: UsedDocumentContainerManifests | undefined;\n}): void {\n  for (const path of input.paths) {\n    for (const manifest of path ?? []) {\n      input.used?.set(manifest.manifestHash, manifest);\n    }\n  }\n}\n"]}

package/data/keyingProjectionVerification/document/documentManifestPredecessor.js

@@ -0,0 +1,12 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+export function requireVerifiedDocumentPredecessor(input) {
+    if (input.previousManifestHash === null)
+        return null;
+    const previousManifest = input.verifiedByHash.get(input.previousManifestHash) ??
+        input.trustedPredecessorByHash?.get(input.previousManifestHash);
+    if (!previousManifest) {
+        throw new KeyingVerificationError("missing_dependency", `${input.label} previous manifest ${input.previousManifestHash} is missing`);
+    }
+    return previousManifest;
+}
+//# sourceMappingURL=documentManifestPredecessor.js.map

package/data/keyingProjectionVerification/document/documentManifestVerification.js

@@ -0,0 +1,135 @@
+import { KeyingVerificationError, verifyDocumentLinkSetManifest, } from "../../../internal/crypto/index.js";
+import { readCanonicalJson } from "../../keying/canonicalJson.js";
+import { addBundleByHash, assertCanonicalEqual, verifyAccessEventBundle, } from "../checkpoints/bundleVerification.js";
+import { loadManifestCheckpointVerification, verifyCachedManifestCheckpoint, } from "../checkpoints/manifestCheckpointVerification.js";
+import { readAccessManifest, readDocumentAccessEventBody } from "../readers.js";
+import { resolveEventContainerPaths } from "./documentDependencyPaths.js";
+import { collectDocumentManifestPrincipalPolicies, recordUsedDocumentContainerManifests, } from "./documentManifestPolicies.js";
+import { requireVerifiedDocumentPredecessor } from "./documentManifestPredecessor.js";
+export async function verifyDocumentManifestBundle(input) {
+    const cached = input.verifiedByHash.get(input.bundle.manifestHash);
+    if (cached) {
+        if (input.enforceLocalCheckpoint) {
+            await verifyCachedManifestCheckpoint({
+                current: cached,
+                execSql: input.checkpointContext.execSql,
+                localCheckpoints: input.checkpointContext.localCheckpoints,
+                verifiedManifests: input.verifiedByHash,
+            });
+        }
+        return cached;
+    }
+    const event = await verifyAccessEventBundle(input);
+    const manifest = readAccessManifest(input.bundle.manifest, `${input.label} manifest`);
+    const previousManifest = requireVerifiedDocumentPredecessor({
+        label: input.label,
+        previousManifestHash: event.event.previousManifestHash,
+        trustedPredecessorByHash: input.trustedPredecessorByHash,
+        verifiedByHash: input.verifiedByHash,
+    });
+    const body = readDocumentAccessEventBody(event.body, `${input.label} event body`);
+    const { dependencyContainerPaths, targetContainerPath } = resolveEventContainerPaths({
+        containerPathByManifestHash: input.containerPathByManifestHash,
+        dependencyManifestHashes: event.event.dependencyManifestHashes,
+        targetManifestHash: body.containerManifestHash,
+    });
+    const principalPolicies = await collectDocumentManifestPrincipalPolicies({
+        authorizationEvidence: input.authorizationEvidence,
+        checkpointContext: input.checkpointContext,
+        organizationId: event.event.organizationId,
+        paths: [...dependencyContainerPaths, targetContainerPath],
+        principalPolicyCache: input.principalPolicyCache,
+        resolveUserKey: input.resolveUserKey,
+        requireAuthorizationEvidence: input.requireAuthorizationEvidence,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    const checkpointVerification = input.enforceLocalCheckpoint
+        ? await loadManifestCheckpointVerification({
+            current: manifest,
+            execSql: input.checkpointContext.execSql,
+            localCheckpoints: input.checkpointContext.localCheckpoints,
+            verifiedManifests: input.verifiedByHash,
+        })
+        : null;
+    const verified = await verifyDocumentLinkSetManifest({
+        // Served heads and history were committed under the group membership their
+        // cited container heads referenced; a signer removed since must still
+        // verify on a cold device. The API verifier gates new writes at current.
+        authorizationMembership: input.authorizationMembership ?? "referenced",
+        authorizingContainerPaths: dependencyContainerPaths,
+        event,
+        expectedManifestHash: input.bundle.manifestHash,
+        manifest,
+        previousManifest,
+        principalPolicies,
+        ...(checkpointVerification ?? {}),
+        ...(targetContainerPath ? { targetContainerPath } : {}),
+    });
+    if (!verified.ok) {
+        throw new KeyingVerificationError(verified.error.code, `${input.label} manifest verification failed: ${verified.error.message}`);
+    }
+    recordUsedDocumentContainerManifests({
+        paths: [...dependencyContainerPaths, targetContainerPath],
+        used: input.usedContainerManifests,
+    });
+    assertCanonicalEqual({
+        actual: input.bundle.state,
+        expected: readCanonicalJson(verified.value.state, `${input.label} state`),
+        label: `${input.label} state`,
+    });
+    input.verifiedByHash.set(input.bundle.manifestHash, verified.value);
+    return verified.value;
+}
+export async function verifyDocumentProjectionManifests(input) {
+    const bundlesByHash = new Map();
+    addBundleByHash(bundlesByHash, input.projection.documentManifest, "Document writer projection manifest");
+    const history = input.projection.documentManifestHistory;
+    for (const [index, bundle] of history.entries()) {
+        addBundleByHash(bundlesByHash, bundle, `Document writer projection manifest history[${index}]`);
+    }
+    // An honest API never lists the head in its own history (it seeds the walk
+    // with the head), so a repeat is a malformed or tampered projection and is
+    // refused as such, rather than letting the head reach its verification
+    // through the history cache and relying on the cached branch to re-run
+    // every check the fresh path would.
+    if (history.some((bundle) => bundle.manifestHash === input.projection.documentManifest.manifestHash)) {
+        throw new KeyingVerificationError("duplicate_entry", "Document writer projection history repeats the current head");
+    }
+    const verifiedByHash = new Map();
+    for (let index = history.length - 1; index >= 0; index -= 1) {
+        const bundle = history[index];
+        if (!bundle) {
+            throw new KeyingVerificationError("missing_dependency", `Document writer projection manifest history[${index}] is missing`);
+        }
+        await verifyDocumentManifestBundle({
+            authorizationEvidence: input.authorizationEvidence,
+            requireAuthorizationEvidence: true,
+            bundle,
+            bundlesByHash,
+            checkpointContext: input.checkpointContext,
+            containerPathByManifestHash: input.containerPathByManifestHash,
+            enforceLocalCheckpoint: false,
+            label: `Document writer projection manifest history[${index}]`,
+            principalPolicyCache: input.principalPolicyCache,
+            resolveUserKey: input.resolveUserKey,
+            verifiedByHash,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        });
+    }
+    const headManifest = await verifyDocumentManifestBundle({
+        authorizationEvidence: input.authorizationEvidence,
+        requireAuthorizationEvidence: true,
+        bundle: input.projection.documentManifest,
+        bundlesByHash,
+        checkpointContext: input.checkpointContext,
+        containerPathByManifestHash: input.containerPathByManifestHash,
+        enforceLocalCheckpoint: true,
+        label: "Document writer projection",
+        principalPolicyCache: input.principalPolicyCache,
+        resolveUserKey: input.resolveUserKey,
+        verifiedByHash,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    return { headManifest, verifiedByHash };
+}
+//# sourceMappingURL=documentManifestVerification.js.map