@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/keyingProjectionVerification/checkpoints/accessManifestCheckpointEnforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessManifestCheckpointEnforcement.js","sourceRoot":"","sources":["accessManifestCheckpointEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,wEAAwE,CAAC;AAKhF,SAAS,SAAS,CAAC,QAAkD;IACnE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAGzC;IACC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,6DAA6D,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAUvD;IACC,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAYtD;IACC,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { DocumentPurgeCheckpoint } from \"../../persistence/keyingCheckpoints/documentPurgeCheckpointPersistence\";\nimport {\n  type AccessManifestCheckpointAdvance,\n  advanceKeyingCheckpointsAtomically,\n  validateKeyingCheckpointsAtomically,\n} from \"../../persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport type { VerifiedManifestBundle } from \"../../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\nfunction objectKey(manifest: VerifiedAccessManifestCheckpointEvidence): string {\n  const { objectKind, organizationId, objectId } = manifest.checkpoint;\n  return JSON.stringify([objectKind, organizationId, objectId]);\n}\n\nfunction manifestsByObject(\n  manifests: readonly VerifiedAccessManifestCheckpointEvidence[],\n): Map<string, Map<string, VerifiedAccessManifestCheckpointEvidence>> {\n  const byObject = new Map<\n    string,\n    Map<string, VerifiedAccessManifestCheckpointEvidence>\n  >();\n  for (const manifest of manifests) {\n    const key = objectKey(manifest);\n    let byHash = byObject.get(key);\n    if (!byHash) {\n      byHash = new Map();\n      byObject.set(key, byHash);\n    }\n    byHash.set(manifest.manifestHash, manifest);\n  }\n  return byObject;\n}\n\nfunction accessManifestCheckpointAdvances(input: {\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): AccessManifestCheckpointAdvance[] {\n  const evidenceByObject = manifestsByObject(input.verifiedManifests);\n  const headsByObject = manifestsByObject(input.verifiedHeads);\n  const advances: AccessManifestCheckpointAdvance[] = [];\n\n  for (const [key, headsByHash] of headsByObject) {\n    if (headsByHash.size !== 1) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares conflicting access manifest heads for ${key}`,\n      );\n    }\n    const head = headsByHash.values().next().value;\n    if (!head) {\n      continue;\n    }\n    const predecessors = [\n      ...(evidenceByObject.get(key)?.values() ?? []),\n    ].filter((manifest) => manifest.manifestHash !== head.manifestHash);\n    advances.push({ head, predecessors });\n  }\n\n  return advances;\n}\n\nexport async function validateAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await validateKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    execSql: input.execSql,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n\nexport async function enforceAccessManifestCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n  readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n}): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: accessManifestCheckpointAdvances(input),\n    documentPurgeCheckpoint: input.documentPurgeCheckpoint,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: input.policies,\n    authorizationPolicies: input.authorizationPolicies,\n    stillCurrent: input.stillCurrent,\n    verifiedBundles: input.verifiedBundles,\n  });\n}\n"]}

package/data/keyingProjectionVerification/checkpoints/bundleVerification.js

@@ -0,0 +1,61 @@
+import { KeyingVerificationError, verifySignedAccessEvent, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString, readCanonicalJson, readCanonicalRecord, } from "../../keying/canonicalJson.js";
+import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
+import { readKeyingVerificationShape } from "../error.js";
+import { readAccessEvent, readRecordString, readRequiredRecordValue, } from "../readers.js";
+function canonicalBundleJson(value, label) {
+    return readKeyingVerificationShape(() => canonicalKeyingJsonString(value, label));
+}
+export function assertCanonicalEqual(input) {
+    if (canonicalBundleJson(input.actual, `${input.label} actual`) !==
+        canonicalBundleJson(input.expected, `${input.label} expected`)) {
+        throw new KeyingVerificationError("hash_mismatch", `${input.label} mismatch`);
+    }
+}
+export function addBundleByHash(bundlesByHash, bundle, label) {
+    const existing = bundlesByHash.get(bundle.manifestHash);
+    if (!existing) {
+        bundlesByHash.set(bundle.manifestHash, bundle);
+        return;
+    }
+    if (canonicalBundleJson(existing, `${label} existing`) !==
+        canonicalBundleJson(bundle, `${label} duplicate`)) {
+        throw new KeyingVerificationError("hash_mismatch", `Writer projection has equivocal manifest bundle ${bundle.manifestHash}`);
+    }
+}
+function readStandaloneEventBundle(bundle, label) {
+    return readKeyingVerificationShape(() => {
+        const eventBundle = readCanonicalRecord(bundle, `${label} event bundle`);
+        const eventHash = readRecordString(eventBundle, "eventHash", `${label} event bundle`);
+        const event = readAccessEvent(readRequiredRecordValue(eventBundle, "event", `${label} event bundle`), `${label} signed event`);
+        const body = readCanonicalJson(readRequiredRecordValue(eventBundle, "body", `${label} event bundle`), `${label} event body`);
+        return { eventHash, event, body };
+    });
+}
+export async function verifyStandaloneAccessEventBundle(input) {
+    const { eventHash, event, body } = readStandaloneEventBundle(input.bundle, input.label);
+    const userKey = await input.resolveUserKey(event.signerUserId);
+    if (!userKey) {
+        throw new ProjectionDependencyUnavailableError(`${input.label} signer public key could not be resolved for ${event.signerUserId}`);
+    }
+    const verified = await verifySignedAccessEvent({
+        body,
+        event,
+        signerPublicKey: userKey.signingPublicKey,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    if (verified.value.eventHash !== eventHash) {
+        throw new KeyingVerificationError("hash_mismatch", `${input.label} event hash mismatch`);
+    }
+    return verified.value;
+}
+export function verifyAccessEventBundle(input) {
+    return verifyStandaloneAccessEventBundle({
+        bundle: input.bundle.event,
+        label: input.label,
+        resolveUserKey: input.resolveUserKey,
+    });
+}
+//# sourceMappingURL=bundleVerification.js.map

package/data/keyingProjectionVerification/checkpoints/bundleVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleVerification.js","sourceRoot":"","sources":["bundleVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAGpB,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,OAAO,2BAA2B,CAAC,GAAG,EAAE,CACtC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,IACE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,SAAS,CAAC;QAC1D,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,WAAW,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,KAAK,CAAC,KAAK,WAAW,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,aAA4D,EAC5D,MAAwC,EACxC,KAAa;IAEb,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IACE,mBAAmB,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAClD,mBAAmB,CAAC,MAAM,EAAE,GAAG,KAAK,YAAY,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mDAAmD,MAAM,CAAC,YAAY,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAqC,EACrC,KAAa;IAEb,OAAO,2BAA2B,CAAC,GAAG,EAAE;QACtC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,gBAAgB,CAChC,WAAW,EACX,WAAW,EACX,GAAG,KAAK,eAAe,CACxB,CAAC;QACF,MAAM,KAAK,GAAG,eAAe,CAC3B,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,eAAe,CAAC,EACtE,GAAG,KAAK,eAAe,CACxB,CAAC;QACF,MAAM,IAAI,GAAG,iBAAiB,CAC5B,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,eAAe,CAAC,EACrE,GAAG,KAAK,aAAa,CACtB,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAIvD;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,yBAAyB,CAC1D,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,oCAAoC,CAC5C,GAAG,KAAK,CAAC,KAAK,gDAAgD,KAAK,CAAC,YAAY,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,IAAI;QACJ,KAAK;QACL,eAAe,EAAE,OAAO,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,KAAK,CAAC,KAAK,sBAAsB,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,OAAO,iCAAiC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  verifySignedAccessEvent,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport type { AccessEventBundleWireResponse } from \"@tearleads/validators/util\";\nimport {\n  canonicalKeyingJsonString,\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../keying/canonicalJson\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { readKeyingVerificationShape } from \"../error\";\nimport {\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n} from \"../readers\";\nimport type { ProjectionUserKeyResolver } from \"../types\";\n\nfunction canonicalBundleJson(value: unknown, label: string): string {\n  return readKeyingVerificationShape(() =>\n    canonicalKeyingJsonString(value, label),\n  );\n}\n\nexport function assertCanonicalEqual(input: {\n  readonly actual: unknown;\n  readonly expected: unknown;\n  readonly label: string;\n}): void {\n  if (\n    canonicalBundleJson(input.actual, `${input.label} actual`) !==\n    canonicalBundleJson(input.expected, `${input.label} expected`)\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      `${input.label} mismatch`,\n    );\n  }\n}\n\nexport function addBundleByHash(\n  bundlesByHash: Map<string, AccessManifestBundleWireResponse>,\n  bundle: AccessManifestBundleWireResponse,\n  label: string,\n): void {\n  const existing = bundlesByHash.get(bundle.manifestHash);\n  if (!existing) {\n    bundlesByHash.set(bundle.manifestHash, bundle);\n    return;\n  }\n\n  if (\n    canonicalBundleJson(existing, `${label} existing`) !==\n    canonicalBundleJson(bundle, `${label} duplicate`)\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      `Writer projection has equivocal manifest bundle ${bundle.manifestHash}`,\n    );\n  }\n}\n\nfunction readStandaloneEventBundle(\n  bundle: AccessEventBundleWireResponse,\n  label: string,\n) {\n  return readKeyingVerificationShape(() => {\n    const eventBundle = readCanonicalRecord(bundle, `${label} event bundle`);\n    const eventHash = readRecordString(\n      eventBundle,\n      \"eventHash\",\n      `${label} event bundle`,\n    );\n    const event = readAccessEvent(\n      readRequiredRecordValue(eventBundle, \"event\", `${label} event bundle`),\n      `${label} signed event`,\n    );\n    const body = readCanonicalJson(\n      readRequiredRecordValue(eventBundle, \"body\", `${label} event bundle`),\n      `${label} event body`,\n    );\n    return { eventHash, event, body };\n  });\n}\n\nexport async function verifyStandaloneAccessEventBundle(input: {\n  readonly bundle: AccessEventBundleWireResponse;\n  readonly label: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}) {\n  const { eventHash, event, body } = readStandaloneEventBundle(\n    input.bundle,\n    input.label,\n  );\n  const userKey = await input.resolveUserKey(event.signerUserId);\n  if (!userKey) {\n    throw new ProjectionDependencyUnavailableError(\n      `${input.label} signer public key could not be resolved for ${event.signerUserId}`,\n    );\n  }\n\n  const verified = await verifySignedAccessEvent({\n    body,\n    event,\n    signerPublicKey: userKey.signingPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (verified.value.eventHash !== eventHash) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      `${input.label} event hash mismatch`,\n    );\n  }\n\n  return verified.value;\n}\n\nexport function verifyAccessEventBundle(input: {\n  readonly bundle: AccessManifestBundleWireResponse;\n  readonly label: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}) {\n  return verifyStandaloneAccessEventBundle({\n    bundle: input.bundle.event,\n    label: input.label,\n    resolveUserKey: input.resolveUserKey,\n  });\n}\n"]}

package/data/keyingProjectionVerification/checkpoints/checkpointContext.d.ts

@@ -0,0 +1,45 @@
+import { type AccessManifestCheckpoint, type VerifiedAccessManifestCheckpointEvidence, type VerifiedContainerAccessManifest, type VerifiedPrincipalPolicySelection } from "../../../internal/crypto/index.js";
+import type { AccessManifestBundleWireResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentPurgeCheckpoint } from "../../persistence/keyingCheckpoints/documentPurgeCheckpointPersistence.js";
+import type { VerifiedManifestBundle } from "../../persistence/verifiedManifestBundlePersistence.js";
+import type { PrincipalPolicyCheckpointEvidence } from "../../principals/principalPolicyEvidence.js";
+import type { ExecSql } from "../../sqlite/sqlSchema.js";
+export interface ProjectionCheckpointContext {
+    readonly heldContainerHeads: VerifiedContainerAccessManifest[];
+    readonly execSql: ExecSql;
+    readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;
+    organizationId?: string | undefined;
+    readonly policies: PrincipalPolicyCheckpointEvidence[];
+    readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];
+    readonly verifiedBundles: VerifiedManifestBundle[];
+    readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];
+    readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];
+}
+export declare function createProjectionCheckpointContext(input: {
+    readonly execSql: ExecSql;
+    readonly organizationId?: string | undefined;
+}): ProjectionCheckpointContext;
+export declare function observeAccessManifestCheckpoints(context: ProjectionCheckpointContext, input: {
+    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];
+    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];
+}): void;
+/**
+ * Records each served bundle whose manifest this verification produced, so
+ * the transaction finalizing the checkpoints also stores it for later
+ * citation. A bundle the projection carried but verification never reached
+ * is skipped.
+ */
+export declare function observeVerifiedProjectionBundles(context: ProjectionCheckpointContext, bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>, verifiedByHash: ReadonlyMap<string, {
+    readonly checkpoint: AccessManifestCheckpoint;
+}>): void;
+export declare function observePrincipalPolicy(context: ProjectionCheckpointContext, policy: PrincipalPolicyCheckpointEvidence, organizationId?: string | undefined): void;
+export declare function commitProjectionCheckpoints(context: ProjectionCheckpointContext, input?: {
+    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;
+    readonly execSql?: ExecSql | undefined;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<void>;
+export declare function finalizeProjectionCheckpoints(context: ProjectionCheckpointContext, input: {
+    readonly execSql?: ExecSql | undefined;
+    readonly persistVerificationCheckpoints?: boolean | undefined;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<void>;

package/data/keyingProjectionVerification/checkpoints/checkpointContext.js

@@ -0,0 +1,120 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { rememberVerifiedContainerHeads } from "../../containers/shared/heldContainerHeads.js";
+import { PrincipalAuthorizationCheckpointUnavailableError } from "../../persistence/keyingCheckpoints/principalAuthorizationCheckpoints.js";
+import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
+import { projectionLifetimeGuard } from "../projectionLifetimes.js";
+import { assertProjectionVerificationCurrent } from "../types.js";
+import { enforceAccessManifestCheckpoints, validateAccessManifestCheckpoints, } from "./accessManifestCheckpointEnforcement.js";
+export function createProjectionCheckpointContext(input) {
+    if (typeof input.execSql !== "function") {
+        throw new KeyingVerificationError("missing_dependency", "Projection verification requires durable keying checkpoint storage");
+    }
+    return {
+        heldContainerHeads: [],
+        execSql: input.execSql,
+        localCheckpoints: new Map(),
+        organizationId: input.organizationId,
+        policies: [],
+        authorizationPolicies: [],
+        verifiedBundles: [],
+        verifiedHeads: [],
+        verifiedManifests: [],
+    };
+}
+export function observeAccessManifestCheckpoints(context, input) {
+    context.verifiedHeads.push(...input.verifiedHeads);
+    context.verifiedManifests.push(...input.verifiedManifests);
+}
+/**
+ * Records each served bundle whose manifest this verification produced, so
+ * the transaction finalizing the checkpoints also stores it for later
+ * citation. A bundle the projection carried but verification never reached
+ * is skipped.
+ */
+export function observeVerifiedProjectionBundles(context, bundlesByHash, verifiedByHash) {
+    for (const [manifestHash, bundle] of bundlesByHash) {
+        const verified = verifiedByHash.get(manifestHash);
+        if (verified)
+            context.verifiedBundles.push({ bundle, checkpoint: verified.checkpoint });
+    }
+}
+export function observePrincipalPolicy(context, policy, organizationId) {
+    if (organizationId !== undefined &&
+        context.organizationId !== undefined &&
+        context.organizationId !== organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "projection checkpoint batch crosses organization ownership");
+    }
+    context.organizationId ??= organizationId;
+    context.policies.push(policy);
+}
+export async function commitProjectionCheckpoints(context, input) {
+    input = {
+        ...input,
+        stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),
+    };
+    assertProjectionVerificationCurrent(input?.stillCurrent);
+    await enforceAccessManifestCheckpoints({
+        documentPurgeCheckpoint: input?.documentPurgeCheckpoint,
+        execSql: input?.execSql ?? context.execSql,
+        organizationId: context.organizationId,
+        policies: context.policies,
+        authorizationPolicies: context.authorizationPolicies,
+        stillCurrent: input?.stillCurrent,
+        verifiedBundles: context.verifiedBundles,
+        verifiedHeads: context.verifiedHeads,
+        verifiedManifests: context.verifiedManifests,
+    }).catch((error) => {
+        if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)
+            throw new ProjectionDependencyUnavailableError(error.message);
+        throw error;
+    });
+    assertProjectionVerificationCurrent(input?.stillCurrent);
+}
+/** Validates against the latest durable pins without persisting new heads. */
+async function validateProjectionCheckpoints(context, input) {
+    input = {
+        ...input,
+        stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),
+    };
+    assertProjectionVerificationCurrent(input?.stillCurrent);
+    await validateAccessManifestCheckpoints({
+        execSql: input?.execSql ?? context.execSql,
+        policies: context.policies,
+        authorizationPolicies: context.authorizationPolicies,
+        stillCurrent: input?.stillCurrent,
+        verifiedBundles: context.verifiedBundles,
+        verifiedHeads: context.verifiedHeads,
+        verifiedManifests: context.verifiedManifests,
+    }).catch((error) => {
+        if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)
+            throw new ProjectionDependencyUnavailableError(error.message);
+        throw error;
+    });
+    assertProjectionVerificationCurrent(input?.stillCurrent);
+}
+export async function finalizeProjectionCheckpoints(context, input) {
+    if (input.persistVerificationCheckpoints === false) {
+        await validateProjectionCheckpoints(context, input);
+        return;
+    }
+    await commitProjectionCheckpoints(context, input);
+    if (input.stillCurrent?.() === false)
+        return;
+    const organizationId = context.organizationId ??
+        context.heldContainerHeads[0]?.state.organizationId;
+    if (organizationId === undefined)
+        return;
+    try {
+        rememberVerifiedContainerHeads({
+            organizationId,
+            execSql: input.execSql ?? context.execSql,
+            heads: context.heldContainerHeads,
+            policies: context.policies,
+        });
+    }
+    catch {
+        // Checkpoints are already committed. Optional re-citation evidence must
+        // never change successful verification into a caller-visible refusal.
+    }
+}
+//# sourceMappingURL=checkpointContext.js.map

package/data/keyingProjectionVerification/checkpoints/checkpointContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpointContext.js","sourceRoot":"","sources":["checkpointContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAE5F,OAAO,EAAE,gDAAgD,EAAE,MAAM,uEAAuE,CAAC;AAIzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAgB/C,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,EAAE;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,EAAE;QACzB,eAAe,EAAE,EAAE;QACnB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,KAGC;IAED,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,aAAoE,EACpE,cAGC;IAED,KAAK,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ;YACV,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoC,EACpC,MAAyC,EACzC,cAAmC;IAEnC,IACE,cAAc,KAAK,SAAS;QAC5B,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,cAAc,KAAK,cAAc,EACzC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC,EACpC,KAIC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,gCAAgC,CAAC;QACrC,uBAAuB,EAAE,KAAK,EAAE,uBAAuB;QACvD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,6BAA6B,CAC1C,OAAoC,EACpC,KAGC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,iCAAiC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAoC,EACpC,KAIC;IAED,IAAI,KAAK,CAAC,8BAA8B,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;YACzC,KAAK,EAAE,OAAO,CAAC,kBAAkB;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { rememberVerifiedContainerHeads } from \"../../containers/shared/heldContainerHeads\";\nimport type { DocumentPurgeCheckpoint } from \"../../persistence/keyingCheckpoints/documentPurgeCheckpointPersistence\";\nimport { PrincipalAuthorizationCheckpointUnavailableError } from \"../../persistence/keyingCheckpoints/principalAuthorizationCheckpoints\";\nimport type { VerifiedManifestBundle } from \"../../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { projectionLifetimeGuard } from \"../projectionLifetimes\";\nimport { assertProjectionVerificationCurrent } from \"../types\";\nimport {\n  enforceAccessManifestCheckpoints,\n  validateAccessManifestCheckpoints,\n} from \"./accessManifestCheckpointEnforcement\";\n\nexport interface ProjectionCheckpointContext {\n  readonly heldContainerHeads: VerifiedContainerAccessManifest[];\n  readonly execSql: ExecSql;\n  // Local checkpoints read during this verification, one read per object.\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  organizationId?: string | undefined;\n  readonly policies: PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];\n  // Served bundles whose manifests verified, stored at finalization.\n  readonly verifiedBundles: VerifiedManifestBundle[];\n  readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];\n}\n\nexport function createProjectionCheckpointContext(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n}): ProjectionCheckpointContext {\n  if (typeof input.execSql !== \"function\") {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection verification requires durable keying checkpoint storage\",\n    );\n  }\n\n  return {\n    heldContainerHeads: [],\n    execSql: input.execSql,\n    localCheckpoints: new Map(),\n    organizationId: input.organizationId,\n    policies: [],\n    authorizationPolicies: [],\n    verifiedBundles: [],\n    verifiedHeads: [],\n    verifiedManifests: [],\n  };\n}\n\nexport function observeAccessManifestCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n  },\n): void {\n  context.verifiedHeads.push(...input.verifiedHeads);\n  context.verifiedManifests.push(...input.verifiedManifests);\n}\n\n/**\n * Records each served bundle whose manifest this verification produced, so\n * the transaction finalizing the checkpoints also stores it for later\n * citation. A bundle the projection carried but verification never reached\n * is skipped.\n */\nexport function observeVerifiedProjectionBundles(\n  context: ProjectionCheckpointContext,\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<\n    string,\n    { readonly checkpoint: AccessManifestCheckpoint }\n  >,\n): void {\n  for (const [manifestHash, bundle] of bundlesByHash) {\n    const verified = verifiedByHash.get(manifestHash);\n    if (verified)\n      context.verifiedBundles.push({ bundle, checkpoint: verified.checkpoint });\n  }\n}\n\nexport function observePrincipalPolicy(\n  context: ProjectionCheckpointContext,\n  policy: PrincipalPolicyCheckpointEvidence,\n  organizationId?: string | undefined,\n): void {\n  if (\n    organizationId !== undefined &&\n    context.organizationId !== undefined &&\n    context.organizationId !== organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"projection checkpoint batch crosses organization ownership\",\n    );\n  }\n  context.organizationId ??= organizationId;\n  context.policies.push(policy);\n}\n\nexport async function commitProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await enforceAccessManifestCheckpoints({\n    documentPurgeCheckpoint: input?.documentPurgeCheckpoint,\n    execSql: input?.execSql ?? context.execSql,\n    organizationId: context.organizationId,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\n/** Validates against the latest durable pins without persisting new heads. */\nasync function validateProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await validateAccessManifestCheckpoints({\n    execSql: input?.execSql ?? context.execSql,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\nexport async function finalizeProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly execSql?: ExecSql | undefined;\n    readonly persistVerificationCheckpoints?: boolean | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  if (input.persistVerificationCheckpoints === false) {\n    await validateProjectionCheckpoints(context, input);\n    return;\n  }\n  await commitProjectionCheckpoints(context, input);\n  if (input.stillCurrent?.() === false) return;\n  const organizationId =\n    context.organizationId ??\n    context.heldContainerHeads[0]?.state.organizationId;\n  if (organizationId === undefined) return;\n  try {\n    rememberVerifiedContainerHeads({\n      organizationId,\n      execSql: input.execSql ?? context.execSql,\n      heads: context.heldContainerHeads,\n      policies: context.policies,\n    });\n  } catch {\n    // Checkpoints are already committed. Optional re-citation evidence must\n    // never change successful verification into a caller-visible refusal.\n  }\n}\n"]}

package/data/keyingProjectionVerification/checkpoints/manifestCheckpointVerification.js

@@ -0,0 +1,64 @@
+import { verifyAccessManifestLocalCheckpoint, } from "../../../internal/crypto/index.js";
+import { loadAccessManifestCheckpoint } from "../../persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
+/**
+ * The local checkpoint for one object, read once per verification: every
+ * checkpoint-enforced element of a served path reads its own checkpoint,
+ * and the atomic advance re-validates every checkpoint at commit.
+ */
+async function loadLocalAccessManifestCheckpoint(input) {
+    const key = JSON.stringify([
+        input.objectKind,
+        input.organizationId,
+        input.objectId,
+    ]);
+    const cached = input.localCheckpoints.get(key);
+    if (cached !== undefined)
+        return cached;
+    const loaded = await loadAccessManifestCheckpoint(input.execSql, input.objectKind, input.organizationId, input.objectId);
+    input.localCheckpoints.set(key, loaded);
+    return loaded;
+}
+function isCheckpointPredecessor(input) {
+    const candidate = input.candidate.checkpoint;
+    return (candidate.objectKind === input.current.objectKind &&
+        candidate.organizationId === input.current.organizationId &&
+        candidate.objectId === input.current.objectId &&
+        candidate.epoch > input.localCheckpoint.epoch &&
+        candidate.epoch < input.current.epoch);
+}
+export async function loadManifestCheckpointVerification(input) {
+    const localCheckpoint = await loadLocalAccessManifestCheckpoint({
+        execSql: input.execSql,
+        localCheckpoints: input.localCheckpoints,
+        objectId: input.current.objectId,
+        objectKind: input.current.objectKind,
+        organizationId: input.current.organizationId,
+    });
+    const checkpointPredecessors = localCheckpoint
+        ? [...input.verifiedManifests.values()]
+            .filter((candidate) => isCheckpointPredecessor({
+            candidate,
+            current: input.current,
+            localCheckpoint,
+        }))
+            .sort((left, right) => left.checkpoint.epoch - right.checkpoint.epoch)
+        : [];
+    return { checkpointPredecessors, localCheckpoint };
+}
+export async function verifyCachedManifestCheckpoint(input) {
+    const checkpoint = await loadManifestCheckpointVerification({
+        current: input.current.manifest,
+        execSql: input.execSql,
+        localCheckpoints: input.localCheckpoints,
+        verifiedManifests: input.verifiedManifests,
+    });
+    verifyAccessManifestLocalCheckpoint({
+        checkpointPredecessors: checkpoint.checkpointPredecessors,
+        current: {
+            ...input.current.checkpoint,
+            previousManifestHash: input.current.manifest.previousManifestHash,
+        },
+        localCheckpoint: checkpoint.localCheckpoint,
+    });
+}
+//# sourceMappingURL=manifestCheckpointVerification.js.map

package/data/keyingProjectionVerification/checkpoints/manifestCheckpointVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestCheckpointVerification.js","sourceRoot":"","sources":["manifestCheckpointVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,iEAAiE,CAAC;AAG/G;;;;GAIG;AACH,KAAK,UAAU,iCAAiC,CAAC,KAMhD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;IAC7C,OAAO,CACL,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO,CAAC,UAAU;QACjD,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QACzD,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK;QAC7C,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAEtD,KAKD;IACC,MAAM,eAAe,GAAG,MAAM,iCAAiC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;KAC7C,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,eAAe;QAC5C,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,uBAAuB,CAAC;YACtB,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe;SAChB,CAAC,CACH;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAQpD;IACC,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IACH,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU;YAC3B,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;SAClE;QACD,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  type VerifiedAccessManifestCheckpointEvidence,\n  verifyAccessManifestLocalCheckpoint,\n} from \"@tearleads/crypto\";\nimport { loadAccessManifestCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/**\n * The local checkpoint for one object, read once per verification: every\n * checkpoint-enforced element of a served path reads its own checkpoint,\n * and the atomic advance re-validates every checkpoint at commit.\n */\nasync function loadLocalAccessManifestCheckpoint(input: {\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly objectId: string;\n  readonly objectKind: AccessManifest[\"objectKind\"];\n  readonly organizationId: string;\n}): Promise<AccessManifestCheckpoint | null> {\n  const key = JSON.stringify([\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  ]);\n  const cached = input.localCheckpoints.get(key);\n  if (cached !== undefined) return cached;\n  const loaded = await loadAccessManifestCheckpoint(\n    input.execSql,\n    input.objectKind,\n    input.organizationId,\n    input.objectId,\n  );\n  input.localCheckpoints.set(key, loaded);\n  return loaded;\n}\n\ninterface ManifestCheckpointVerificationInput<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n> {\n  readonly checkpointPredecessors: readonly TManifest[];\n  readonly localCheckpoint: AccessManifestCheckpoint | null;\n}\n\nfunction isCheckpointPredecessor(input: {\n  readonly candidate: VerifiedAccessManifestCheckpointEvidence;\n  readonly current: AccessManifest;\n  readonly localCheckpoint: AccessManifestCheckpoint;\n}): boolean {\n  const candidate = input.candidate.checkpoint;\n  return (\n    candidate.objectKind === input.current.objectKind &&\n    candidate.organizationId === input.current.organizationId &&\n    candidate.objectId === input.current.objectId &&\n    candidate.epoch > input.localCheckpoint.epoch &&\n    candidate.epoch < input.current.epoch\n  );\n}\n\nexport async function loadManifestCheckpointVerification<\n  TManifest extends VerifiedAccessManifestCheckpointEvidence,\n>(input: {\n  readonly current: AccessManifest;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<string, TManifest>;\n}): Promise<ManifestCheckpointVerificationInput<TManifest>> {\n  const localCheckpoint = await loadLocalAccessManifestCheckpoint({\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    objectId: input.current.objectId,\n    objectKind: input.current.objectKind,\n    organizationId: input.current.organizationId,\n  });\n  const checkpointPredecessors = localCheckpoint\n    ? [...input.verifiedManifests.values()]\n        .filter((candidate) =>\n          isCheckpointPredecessor({\n            candidate,\n            current: input.current,\n            localCheckpoint,\n          }),\n        )\n        .sort((left, right) => left.checkpoint.epoch - right.checkpoint.epoch)\n    : [];\n  return { checkpointPredecessors, localCheckpoint };\n}\n\nexport async function verifyCachedManifestCheckpoint(input: {\n  readonly current: VerifiedAccessManifestCheckpointEvidence;\n  readonly execSql: ExecSql;\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  readonly verifiedManifests: ReadonlyMap<\n    string,\n    VerifiedAccessManifestCheckpointEvidence\n  >;\n}): Promise<void> {\n  const checkpoint = await loadManifestCheckpointVerification({\n    current: input.current.manifest,\n    execSql: input.execSql,\n    localCheckpoints: input.localCheckpoints,\n    verifiedManifests: input.verifiedManifests,\n  });\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: checkpoint.checkpointPredecessors,\n    current: {\n      ...input.current.checkpoint,\n      previousManifestHash: input.current.manifest.previousManifestHash,\n    },\n    localCheckpoint: checkpoint.localCheckpoint,\n  });\n}\n"]}

package/data/keyingProjectionVerification/container/containerAncestorCitations.js

@@ -0,0 +1,164 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { readCanonicalRecord } from "../../keying/canonicalJson.js";
+import { readKeyingVerificationShape } from "../error.js";
+import { readRecordNullableString } from "../readers.js";
+function bundleContainerId(bundle, label) {
+    return readKeyingVerificationShape(() => readRecordNullableString(readCanonicalRecord(bundle.state, `${label} state`), "containerId", `${label} state`));
+}
+function citedContainerId(input, manifestHash) {
+    const verified = input.verifiedByHash.get(manifestHash);
+    if (verified)
+        return verified.state.containerId;
+    const bundle = input.bundlesByHash.get(manifestHash);
+    return bundle ? bundleContainerId(bundle, input.label) : null;
+}
+function citedManifestHashForContainer(input, cited, containerId) {
+    const hashes = cited.filter((manifestHash) => citedContainerId(input, manifestHash) === containerId);
+    const [manifestHash] = hashes;
+    if (manifestHash === undefined) {
+        throw new KeyingVerificationError("missing_dependency", `${input.label} does not cite a served head of its parent container ${containerId}`);
+    }
+    if (hashes.length > 1) {
+        throw new KeyingVerificationError("duplicate_entry", `${input.label} cites more than one head of container ${containerId}`);
+    }
+    return manifestHash;
+}
+async function resolveCitedManifest(input, manifestHash, containerId) {
+    const verified = input.verifiedByHash.get(manifestHash);
+    if (verified)
+        return verified;
+    const bundle = input.bundlesByHash.get(manifestHash);
+    if (!bundle) {
+        throw new KeyingVerificationError("missing_dependency", `${input.label} cites a head of container ${containerId} that the projection does not serve`);
+    }
+    return input.verifyHistoryBundle(bundle, `${input.label} cited ancestor ${containerId}`);
+}
+/**
+ * The ancestor path, root first, that a container event cites, ending at the
+ * head of `parentContainerId`. Empty for a root container.
+ */
+export async function resolveCitedAncestorPath(input) {
+    const cited = input.event.event.dependencyManifestHashes;
+    const chain = [];
+    const seen = new Set();
+    let containerId = input.parentContainerId;
+    while (containerId !== null) {
+        if (seen.has(containerId)) {
+            throw new KeyingVerificationError("object_mismatch", `${input.label} cited ancestors form a cycle at ${containerId}`);
+        }
+        seen.add(containerId);
+        const ancestor = await resolveCitedManifest(input, citedManifestHashForContainer(input, cited, containerId), containerId);
+        chain.unshift(ancestor);
+        containerId = ancestor.state.parentContainerId;
+    }
+    return chain;
+}
+/**
+ * The verified head of `containerId` among the cited hashes, if any. Reads
+ * verified manifests only: a cited hash the pass has not verified is not a
+ * head to reason about, and every caller runs after the cited ancestor path
+ * resolved and verified the chain. An event cites one head per container,
+ * so a second verified one is a served citation set that was tampered with,
+ * not a choice to make.
+ */
+export function verifiedCitedHead(input) {
+    let found;
+    for (const manifestHash of input.cited) {
+        const verified = input.verifiedByHash.get(manifestHash);
+        if (verified?.state.containerId !== input.containerId)
+            continue;
+        if (found && found.manifestHash !== verified.manifestHash) {
+            throw new KeyingVerificationError("duplicate_entry", `${input.label} cites more than one head of container ${input.containerId}`);
+        }
+        found = verified;
+    }
+    return found;
+}
+/**
+ * Whether `head` is `floor` or descends from it through verified
+ * predecessors. Epochs alone would let a same-epoch fork signed under an
+ * older head pass; lineage cannot be forged without the chain. Every
+ * predecessor of a verified manifest was verified with it, so a hop that is
+ * not in the verified set means the chain was not served.
+ */
+function descendsFrom(verifiedByHash, head, floor) {
+    let current = head;
+    while (current && current.state.epoch >= floor.state.epoch) {
+        if (current.manifestHash === floor.manifestHash)
+            return true;
+        const previousHash = current.state.previousManifestHash;
+        current =
+            previousHash === null ? undefined : verifiedByHash.get(previousHash);
+    }
+    return false;
+}
+/** The cited head must be the established head or descend from it. */
+function assertCitedHeadDescendsFrom(input, cited, floor) {
+    if (descendsFrom(input.verifiedByHash, cited, floor))
+        return;
+    throw new KeyingVerificationError("rollback", `${input.label} cites a head of container ${cited.state.containerId} that does not descend from the head an earlier signed statement already proved current`);
+}
+/**
+ * A head must not cite a head of any ancestor that does not descend from the
+ * head an earlier signed statement already established: the manifest before
+ * it cited that ancestor, the previous manifest's own pin when this is its
+ * parent, or a cited child of that ancestor was created or moved under it and
+ * cited it. Ancestors no statement establishes are skipped.
+ */
+export function assertCitedAncestorsDoNotRegress(input) {
+    const previous = input.previousManifest;
+    const previousCited = previous?.event.event.dependencyManifestHashes ?? [];
+    input.citedAncestors.forEach((ancestor, index) => {
+        const containerId = ancestor.state.containerId;
+        const citedChild = input.citedAncestors[index + 1] ?? previous;
+        const floors = [
+            verifiedCitedHead({
+                cited: previousCited,
+                containerId,
+                label: input.label,
+                verifiedByHash: input.verifiedByHash,
+            }),
+            ...(citedChild
+                ? [
+                    input.verifiedByHash.get(citedChild.state.parentManifestHash ?? ""),
+                    verifiedCitedHead({
+                        cited: citedChild.event.event.dependencyManifestHashes,
+                        containerId,
+                        label: input.label,
+                        verifiedByHash: input.verifiedByHash,
+                    }),
+                ]
+                : []),
+        ];
+        for (const floor of floors) {
+            if (floor && floor.state.containerId === containerId) {
+                assertCitedHeadDescendsFrom(input, ancestor, floor);
+            }
+        }
+    });
+}
+/**
+ * Every served current ancestor head must be, or descend through verified
+ * predecessors from, the head of that container the head's signed event
+ * cites. A served head older than the cited one, or a same-epoch fork of it,
+ * is a rollback the signature proves: the cited head exists. A served head
+ * newer than the cited one is the ordinary lag of a descendant behind its
+ * ancestors, and an ancestor the head does not cite at all joined the path
+ * when an ancestor between them moved; neither is refused.
+ */
+export function assertServedAncestorsDescendFromCitations(input) {
+    const citations = input.head.event.event.dependencyManifestHashes;
+    for (const served of input.servedAncestors) {
+        const containerId = served.state.containerId;
+        const cited = verifiedCitedHead({
+            cited: citations,
+            containerId,
+            label: input.label,
+            verifiedByHash: input.verifiedByHash,
+        });
+        if (!cited || descendsFrom(input.verifiedByHash, served, cited))
+            continue;
+        throw new KeyingVerificationError("rollback", `${input.label} cites a head of ancestor container ${containerId} that the served current head does not descend from`);
+    }
+}
+//# sourceMappingURL=containerAncestorCitations.js.map

package/data/keyingProjectionVerification/container/containerAncestorCitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerAncestorCitations.js","sourceRoot":"","sources":["containerAncestorCitations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAuCtD,SAAS,iBAAiB,CACxB,MAAwC,EACxC,KAAa;IAEb,OAAO,2BAA2B,CAAC,GAAG,EAAE,CACtC,wBAAwB,CACtB,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,EACnD,aAAa,EACb,GAAG,KAAK,QAAQ,CACjB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAwB,EACxB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAmC,EACnC,KAAwB,EACxB,WAAmB;IAEnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CACzB,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,WAAW,CACxE,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;IAC9B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,wDAAwD,WAAW,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,0CAA0C,WAAW,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAmC,EACnC,YAAoB,EACpB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,8BAA8B,WAAW,qCAAqC,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,mBAAmB,CAC9B,MAAM,EACN,GAAG,KAAK,CAAC,KAAK,mBAAmB,WAAW,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAGC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACzD,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1C,OAAO,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,oCAAoC,WAAW,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,KAAK,EACL,6BAA6B,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,EACxD,WAAW,CACZ,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAKjC;IACC,IAAI,KAAkD,CAAC;IACvD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,SAAS;QAChE,IAAI,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,0CAA0C,KAAK,CAAC,WAAW,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,QAAQ,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,cAAoE,EACpE,IAAqC,EACrC,KAAsC;IAEtC,IAAI,OAAO,GAAgD,IAAI,CAAC;IAChE,OAAO,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,YAAY,GAAkB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACvE,OAAO;YACL,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,SAAS,2BAA2B,CAClC,KAAwB,EACxB,KAAsC,EACtC,KAAsC;IAEtC,IAAI,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO;IAC7D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,GAAG,KAAK,CAAC,KAAK,8BAA8B,KAAK,CAAC,KAAK,CAAC,WAAW,yFAAyF,CAC7J,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACxC,MAAM,aAAa,GAAG,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAC3E,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC/D,MAAM,MAAM,GAAG;YACb,iBAAiB,CAAC;gBAChB,KAAK,EAAE,aAAa;gBACpB,WAAW;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;YACF,GAAG,CAAC,UAAU;gBACZ,CAAC,CAAC;oBACE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACnE,iBAAiB,CAAC;wBAChB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB;wBACtD,WAAW;wBACX,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;qBACrC,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACrD,2BAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yCAAyC,CAAC,KAKzD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAC7C,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,KAAK,EAAE,SAAS;YAChB,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC;YAAE,SAAS;QAC1E,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,GAAG,KAAK,CAAC,KAAK,uCAAuC,WAAW,qDAAqD,CACtH,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessEvent,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { readCanonicalRecord } from \"../../keying/canonicalJson\";\nimport { readKeyingVerificationShape } from \"../error\";\nimport { readRecordNullableString } from \"../readers\";\n\n/**\n * A container manifest pins the parent manifest it was created or moved\n * under, and successors inherit that pin, so the pin says nothing about the\n * ancestor heads a later grant, revoke, or rekey was actually authorized\n * under. Those heads are in the event: every container event signs the\n * manifest hashes of the path it was committed against, and the API refuses\n * an event whose citations are not the current heads at commit time. So a\n * head's authorization path is rebuilt here from its citations, root to\n * parent, and the signer is checked against those heads rather than against\n * whatever path the server pairs with the manifest.\n *\n * A head must also cite, for every ancestor, a head that is or descends from\n * the head an earlier signed statement already established, so an ancestor\n * head one signed statement established can never be rolled back or forked\n * away for a later one.\n *\n * As with principal policies, a successor new to a device need not cite the\n * authority's served current head. An honest server serves a\n * child head citing the ancestor head that was current when it was\n * committed, signed by a member since revoked at that ancestor, and refusing\n * that shape would leave every device holding the child unable to supersede\n * it. What can be refused is the opposite disagreement: a served current\n * ancestor head that does not descend from a head the child's signed event\n * proves exists is a stale or forked ancestor, whatever the server calls\n * current.\n */\n\ninterface CitedAncestorResolutionInput {\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly label: string;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n  readonly verifyHistoryBundle: (\n    bundle: AccessManifestBundleWireResponse,\n    label: string,\n  ) => Promise<VerifiedContainerAccessManifest>;\n}\n\nfunction bundleContainerId(\n  bundle: AccessManifestBundleWireResponse,\n  label: string,\n): string | null {\n  return readKeyingVerificationShape(() =>\n    readRecordNullableString(\n      readCanonicalRecord(bundle.state, `${label} state`),\n      \"containerId\",\n      `${label} state`,\n    ),\n  );\n}\n\nfunction citedContainerId(\n  input: CitedLineageInput,\n  manifestHash: string,\n): string | null {\n  const verified = input.verifiedByHash.get(manifestHash);\n  if (verified) return verified.state.containerId;\n  const bundle = input.bundlesByHash.get(manifestHash);\n  return bundle ? bundleContainerId(bundle, input.label) : null;\n}\n\nfunction citedManifestHashForContainer(\n  input: CitedAncestorResolutionInput,\n  cited: readonly string[],\n  containerId: string,\n): string {\n  const hashes = cited.filter(\n    (manifestHash) => citedContainerId(input, manifestHash) === containerId,\n  );\n  const [manifestHash] = hashes;\n  if (manifestHash === undefined) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} does not cite a served head of its parent container ${containerId}`,\n    );\n  }\n  if (hashes.length > 1) {\n    throw new KeyingVerificationError(\n      \"duplicate_entry\",\n      `${input.label} cites more than one head of container ${containerId}`,\n    );\n  }\n  return manifestHash;\n}\n\nasync function resolveCitedManifest(\n  input: CitedAncestorResolutionInput,\n  manifestHash: string,\n  containerId: string,\n): Promise<VerifiedContainerAccessManifest> {\n  const verified = input.verifiedByHash.get(manifestHash);\n  if (verified) return verified;\n  const bundle = input.bundlesByHash.get(manifestHash);\n  if (!bundle) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} cites a head of container ${containerId} that the projection does not serve`,\n    );\n  }\n  return input.verifyHistoryBundle(\n    bundle,\n    `${input.label} cited ancestor ${containerId}`,\n  );\n}\n\n/**\n * The ancestor path, root first, that a container event cites, ending at the\n * head of `parentContainerId`. Empty for a root container.\n */\nexport async function resolveCitedAncestorPath(\n  input: CitedAncestorResolutionInput & {\n    readonly event: VerifiedAccessEvent;\n    readonly parentContainerId: string | null;\n  },\n): Promise<VerifiedContainerAccessManifest[]> {\n  const cited = input.event.event.dependencyManifestHashes;\n  const chain: VerifiedContainerAccessManifest[] = [];\n  const seen = new Set<string>();\n  let containerId = input.parentContainerId;\n  while (containerId !== null) {\n    if (seen.has(containerId)) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `${input.label} cited ancestors form a cycle at ${containerId}`,\n      );\n    }\n    seen.add(containerId);\n    const ancestor = await resolveCitedManifest(\n      input,\n      citedManifestHashForContainer(input, cited, containerId),\n      containerId,\n    );\n    chain.unshift(ancestor);\n    containerId = ancestor.state.parentContainerId;\n  }\n  return chain;\n}\n\n/** What the lineage rules read: the served and the verified bundles. */\nexport type CitedLineageInput = Pick<\n  CitedAncestorResolutionInput,\n  \"bundlesByHash\" | \"label\" | \"verifiedByHash\"\n>;\n\n/**\n * The verified head of `containerId` among the cited hashes, if any. Reads\n * verified manifests only: a cited hash the pass has not verified is not a\n * head to reason about, and every caller runs after the cited ancestor path\n * resolved and verified the chain. An event cites one head per container,\n * so a second verified one is a served citation set that was tampered with,\n * not a choice to make.\n */\nexport function verifiedCitedHead(input: {\n  readonly cited: readonly string[];\n  readonly containerId: string;\n  readonly label: string;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): VerifiedContainerAccessManifest | undefined {\n  let found: VerifiedContainerAccessManifest | undefined;\n  for (const manifestHash of input.cited) {\n    const verified = input.verifiedByHash.get(manifestHash);\n    if (verified?.state.containerId !== input.containerId) continue;\n    if (found && found.manifestHash !== verified.manifestHash) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `${input.label} cites more than one head of container ${input.containerId}`,\n      );\n    }\n    found = verified;\n  }\n  return found;\n}\n\n/**\n * Whether `head` is `floor` or descends from it through verified\n * predecessors. Epochs alone would let a same-epoch fork signed under an\n * older head pass; lineage cannot be forged without the chain. Every\n * predecessor of a verified manifest was verified with it, so a hop that is\n * not in the verified set means the chain was not served.\n */\nfunction descendsFrom(\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n  head: VerifiedContainerAccessManifest,\n  floor: VerifiedContainerAccessManifest,\n): boolean {\n  let current: VerifiedContainerAccessManifest | undefined = head;\n  while (current && current.state.epoch >= floor.state.epoch) {\n    if (current.manifestHash === floor.manifestHash) return true;\n    const previousHash: string | null = current.state.previousManifestHash;\n    current =\n      previousHash === null ? undefined : verifiedByHash.get(previousHash);\n  }\n  return false;\n}\n\n/** The cited head must be the established head or descend from it. */\nfunction assertCitedHeadDescendsFrom(\n  input: CitedLineageInput,\n  cited: VerifiedContainerAccessManifest,\n  floor: VerifiedContainerAccessManifest,\n): void {\n  if (descendsFrom(input.verifiedByHash, cited, floor)) return;\n  throw new KeyingVerificationError(\n    \"rollback\",\n    `${input.label} cites a head of container ${cited.state.containerId} that does not descend from the head an earlier signed statement already proved current`,\n  );\n}\n\n/**\n * A head must not cite a head of any ancestor that does not descend from the\n * head an earlier signed statement already established: the manifest before\n * it cited that ancestor, the previous manifest's own pin when this is its\n * parent, or a cited child of that ancestor was created or moved under it and\n * cited it. Ancestors no statement establishes are skipped.\n */\nexport function assertCitedAncestorsDoNotRegress(\n  input: CitedLineageInput & {\n    readonly citedAncestors: readonly VerifiedContainerAccessManifest[];\n    readonly previousManifest: VerifiedContainerAccessManifest | null;\n  },\n): void {\n  const previous = input.previousManifest;\n  const previousCited = previous?.event.event.dependencyManifestHashes ?? [];\n  input.citedAncestors.forEach((ancestor, index) => {\n    const containerId = ancestor.state.containerId;\n    const citedChild = input.citedAncestors[index + 1] ?? previous;\n    const floors = [\n      verifiedCitedHead({\n        cited: previousCited,\n        containerId,\n        label: input.label,\n        verifiedByHash: input.verifiedByHash,\n      }),\n      ...(citedChild\n        ? [\n            input.verifiedByHash.get(citedChild.state.parentManifestHash ?? \"\"),\n            verifiedCitedHead({\n              cited: citedChild.event.event.dependencyManifestHashes,\n              containerId,\n              label: input.label,\n              verifiedByHash: input.verifiedByHash,\n            }),\n          ]\n        : []),\n    ];\n    for (const floor of floors) {\n      if (floor && floor.state.containerId === containerId) {\n        assertCitedHeadDescendsFrom(input, ancestor, floor);\n      }\n    }\n  });\n}\n\n/**\n * Every served current ancestor head must be, or descend through verified\n * predecessors from, the head of that container the head's signed event\n * cites. A served head older than the cited one, or a same-epoch fork of it,\n * is a rollback the signature proves: the cited head exists. A served head\n * newer than the cited one is the ordinary lag of a descendant behind its\n * ancestors, and an ancestor the head does not cite at all joined the path\n * when an ancestor between them moved; neither is refused.\n */\nexport function assertServedAncestorsDescendFromCitations(input: {\n  readonly head: VerifiedContainerAccessManifest;\n  readonly label: string;\n  readonly servedAncestors: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): void {\n  const citations = input.head.event.event.dependencyManifestHashes;\n  for (const served of input.servedAncestors) {\n    const containerId = served.state.containerId;\n    const cited = verifiedCitedHead({\n      cited: citations,\n      containerId,\n      label: input.label,\n      verifiedByHash: input.verifiedByHash,\n    });\n    if (!cited || descendsFrom(input.verifiedByHash, served, cited)) continue;\n    throw new KeyingVerificationError(\n      \"rollback\",\n      `${input.label} cites a head of ancestor container ${containerId} that the served current head does not descend from`,\n    );\n  }\n}\n"]}

package/data/keyingProjectionVerification/container/containerCreateManifest.js

@@ -0,0 +1,28 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+/**
+ * Walk a verified head back to its epoch-1 `container.create`. Head
+ * verification already verified every predecessor it cites (a head is only
+ * accepted once its previous manifest verified), so the lineage is present in
+ * `verifiedByHash`; a gap means the served projection was incomplete.
+ */
+export function verifiedContainerCreateManifest(input) {
+    let current = input.head;
+    const visited = new Set();
+    while (current.state.previousManifestHash !== null) {
+        if (visited.has(current.manifestHash)) {
+            throw new KeyingVerificationError("invalid_shape", `${input.label} manifest lineage is cyclic`);
+        }
+        visited.add(current.manifestHash);
+        const previous = input.verifiedByHash.get(current.state.previousManifestHash);
+        if (!previous || previous.state.containerId !== current.state.containerId) {
+            throw new KeyingVerificationError("missing_dependency", `${input.label} lineage does not reach its container.create`);
+        }
+        current = previous;
+    }
+    if (current.state.epoch !== 1 ||
+        current.event.event.eventType !== "container.create") {
+        throw new KeyingVerificationError("invalid_shape", `${input.label} lineage does not start with container.create`);
+    }
+    return current;
+}
+//# sourceMappingURL=containerCreateManifest.js.map