@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/keyingProjectionVerification/checkpointContext.js

@@ -1,120 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { rememberVerifiedContainerHeads } from "../containers/shared/heldContainerHeads.js";
-import { PrincipalAuthorizationCheckpointUnavailableError } from "../persistence/principalAuthorizationCheckpoints.js";
-import { enforceAccessManifestCheckpoints, validateAccessManifestCheckpoints, } from "./accessManifestCheckpointEnforcement.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { projectionLifetimeGuard } from "./projectionLifetimes.js";
-import { assertProjectionVerificationCurrent } from "./types.js";
-export function createProjectionCheckpointContext(input) {
-    if (typeof input.execSql !== "function") {
-        throw new KeyingVerificationError("missing_dependency", "Projection verification requires durable keying checkpoint storage");
-    }
-    return {
-        heldContainerHeads: [],
-        execSql: input.execSql,
-        localCheckpoints: new Map(),
-        organizationId: input.organizationId,
-        policies: [],
-        authorizationPolicies: [],
-        verifiedBundles: [],
-        verifiedHeads: [],
-        verifiedManifests: [],
-    };
-}
-export function observeAccessManifestCheckpoints(context, input) {
-    context.verifiedHeads.push(...input.verifiedHeads);
-    context.verifiedManifests.push(...input.verifiedManifests);
-}
-/**
- * Records each served bundle whose manifest this verification produced, so
- * the transaction finalizing the checkpoints also stores it for later
- * citation. A bundle the projection carried but verification never reached
- * is skipped.
- */
-export function observeVerifiedProjectionBundles(context, bundlesByHash, verifiedByHash) {
-    for (const [manifestHash, bundle] of bundlesByHash) {
-        const verified = verifiedByHash.get(manifestHash);
-        if (verified)
-            context.verifiedBundles.push({ bundle, checkpoint: verified.checkpoint });
-    }
-}
-export function observePrincipalPolicy(context, policy, organizationId) {
-    if (organizationId !== undefined &&
-        context.organizationId !== undefined &&
-        context.organizationId !== organizationId) {
-        throw new KeyingVerificationError("object_mismatch", "projection checkpoint batch crosses organization ownership");
-    }
-    context.organizationId ??= organizationId;
-    context.policies.push(policy);
-}
-export async function commitProjectionCheckpoints(context, input) {
-    input = {
-        ...input,
-        stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),
-    };
-    assertProjectionVerificationCurrent(input?.stillCurrent);
-    await enforceAccessManifestCheckpoints({
-        documentPurgeCheckpoint: input?.documentPurgeCheckpoint,
-        execSql: input?.execSql ?? context.execSql,
-        organizationId: context.organizationId,
-        policies: context.policies,
-        authorizationPolicies: context.authorizationPolicies,
-        stillCurrent: input?.stillCurrent,
-        verifiedBundles: context.verifiedBundles,
-        verifiedHeads: context.verifiedHeads,
-        verifiedManifests: context.verifiedManifests,
-    }).catch((error) => {
-        if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)
-            throw new ProjectionDependencyUnavailableError(error.message);
-        throw error;
-    });
-    assertProjectionVerificationCurrent(input?.stillCurrent);
-}
-/** Validates against the latest durable pins without persisting new heads. */
-async function validateProjectionCheckpoints(context, input) {
-    input = {
-        ...input,
-        stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),
-    };
-    assertProjectionVerificationCurrent(input?.stillCurrent);
-    await validateAccessManifestCheckpoints({
-        execSql: input?.execSql ?? context.execSql,
-        policies: context.policies,
-        authorizationPolicies: context.authorizationPolicies,
-        stillCurrent: input?.stillCurrent,
-        verifiedBundles: context.verifiedBundles,
-        verifiedHeads: context.verifiedHeads,
-        verifiedManifests: context.verifiedManifests,
-    }).catch((error) => {
-        if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)
-            throw new ProjectionDependencyUnavailableError(error.message);
-        throw error;
-    });
-    assertProjectionVerificationCurrent(input?.stillCurrent);
-}
-export async function finalizeProjectionCheckpoints(context, input) {
-    if (input.persistVerificationCheckpoints === false) {
-        await validateProjectionCheckpoints(context, input);
-        return;
-    }
-    await commitProjectionCheckpoints(context, input);
-    if (input.stillCurrent?.() === false)
-        return;
-    const organizationId = context.organizationId ??
-        context.heldContainerHeads[0]?.state.organizationId;
-    if (organizationId === undefined)
-        return;
-    try {
-        rememberVerifiedContainerHeads({
-            organizationId,
-            execSql: input.execSql ?? context.execSql,
-            heads: context.heldContainerHeads,
-            policies: context.policies,
-        });
-    }
-    catch {
-        // Checkpoints are already committed. Optional re-citation evidence must
-        // never change successful verification into a caller-visible refusal.
-    }
-}
-//# sourceMappingURL=checkpointContext.js.map

package/data/keyingProjectionVerification/checkpointContext.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"checkpointContext.js","sourceRoot":"","sources":["checkpointContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAEzF,OAAO,EAAE,gDAAgD,EAAE,MAAM,kDAAkD,CAAC;AAIpH,OAAO,EACL,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAgB9D,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,EAAE;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,EAAE;QACzB,eAAe,EAAE,EAAE;QACnB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,KAGC;IAED,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAoC,EACpC,aAAoE,EACpE,cAGC;IAED,KAAK,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ;YACV,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoC,EACpC,MAAyC,EACzC,cAAmC;IAEnC,IACE,cAAc,KAAK,SAAS;QAC5B,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,cAAc,KAAK,cAAc,EACzC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC,EACpC,KAIC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,gCAAgC,CAAC;QACrC,uBAAuB,EAAE,KAAK,EAAE,uBAAuB;QACvD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,6BAA6B,CAC1C,OAAoC,EACpC,KAGC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC;KACpE,CAAC;IACF,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,iCAAiC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,KAAK,EAAE,YAAY;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,IAAI,KAAK,YAAY,gDAAgD;YACnE,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAoC,EACpC,KAIC;IAED,IAAI,KAAK,CAAC,8BAA8B,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;YACzC,KAAK,EAAE,OAAO,CAAC,kBAAkB;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { rememberVerifiedContainerHeads } from \"../containers/shared/heldContainerHeads\";\nimport type { DocumentPurgeCheckpoint } from \"../persistence/documentPurgeCheckpointPersistence\";\nimport { PrincipalAuthorizationCheckpointUnavailableError } from \"../persistence/principalAuthorizationCheckpoints\";\nimport type { VerifiedManifestBundle } from \"../persistence/verifiedManifestBundlePersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  enforceAccessManifestCheckpoints,\n  validateAccessManifestCheckpoints,\n} from \"./accessManifestCheckpointEnforcement\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { projectionLifetimeGuard } from \"./projectionLifetimes\";\nimport { assertProjectionVerificationCurrent } from \"./types\";\n\nexport interface ProjectionCheckpointContext {\n  readonly heldContainerHeads: VerifiedContainerAccessManifest[];\n  readonly execSql: ExecSql;\n  // Local checkpoints read during this verification, one read per object.\n  readonly localCheckpoints: Map<string, AccessManifestCheckpoint | null>;\n  organizationId?: string | undefined;\n  readonly policies: PrincipalPolicyCheckpointEvidence[];\n  readonly authorizationPolicies: VerifiedPrincipalPolicySelection[];\n  // Served bundles whose manifests verified, stored at finalization.\n  readonly verifiedBundles: VerifiedManifestBundle[];\n  readonly verifiedHeads: VerifiedAccessManifestCheckpointEvidence[];\n  readonly verifiedManifests: VerifiedAccessManifestCheckpointEvidence[];\n}\n\nexport function createProjectionCheckpointContext(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n}): ProjectionCheckpointContext {\n  if (typeof input.execSql !== \"function\") {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection verification requires durable keying checkpoint storage\",\n    );\n  }\n\n  return {\n    heldContainerHeads: [],\n    execSql: input.execSql,\n    localCheckpoints: new Map(),\n    organizationId: input.organizationId,\n    policies: [],\n    authorizationPolicies: [],\n    verifiedBundles: [],\n    verifiedHeads: [],\n    verifiedManifests: [],\n  };\n}\n\nexport function observeAccessManifestCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly verifiedHeads: readonly VerifiedAccessManifestCheckpointEvidence[];\n    readonly verifiedManifests: readonly VerifiedAccessManifestCheckpointEvidence[];\n  },\n): void {\n  context.verifiedHeads.push(...input.verifiedHeads);\n  context.verifiedManifests.push(...input.verifiedManifests);\n}\n\n/**\n * Records each served bundle whose manifest this verification produced, so\n * the transaction finalizing the checkpoints also stores it for later\n * citation. A bundle the projection carried but verification never reached\n * is skipped.\n */\nexport function observeVerifiedProjectionBundles(\n  context: ProjectionCheckpointContext,\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<\n    string,\n    { readonly checkpoint: AccessManifestCheckpoint }\n  >,\n): void {\n  for (const [manifestHash, bundle] of bundlesByHash) {\n    const verified = verifiedByHash.get(manifestHash);\n    if (verified)\n      context.verifiedBundles.push({ bundle, checkpoint: verified.checkpoint });\n  }\n}\n\nexport function observePrincipalPolicy(\n  context: ProjectionCheckpointContext,\n  policy: PrincipalPolicyCheckpointEvidence,\n  organizationId?: string | undefined,\n): void {\n  if (\n    organizationId !== undefined &&\n    context.organizationId !== undefined &&\n    context.organizationId !== organizationId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"projection checkpoint batch crosses organization ownership\",\n    );\n  }\n  context.organizationId ??= organizationId;\n  context.policies.push(policy);\n}\n\nexport async function commitProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await enforceAccessManifestCheckpoints({\n    documentPurgeCheckpoint: input?.documentPurgeCheckpoint,\n    execSql: input?.execSql ?? context.execSql,\n    organizationId: context.organizationId,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\n/** Validates against the latest durable pins without persisting new heads. */\nasync function validateProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input?: {\n    readonly execSql?: ExecSql | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  input = {\n    ...input,\n    stillCurrent: projectionLifetimeGuard(context, input?.stillCurrent),\n  };\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n  await validateAccessManifestCheckpoints({\n    execSql: input?.execSql ?? context.execSql,\n    policies: context.policies,\n    authorizationPolicies: context.authorizationPolicies,\n    stillCurrent: input?.stillCurrent,\n    verifiedBundles: context.verifiedBundles,\n    verifiedHeads: context.verifiedHeads,\n    verifiedManifests: context.verifiedManifests,\n  }).catch((error: unknown) => {\n    if (error instanceof PrincipalAuthorizationCheckpointUnavailableError)\n      throw new ProjectionDependencyUnavailableError(error.message);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(input?.stillCurrent);\n}\n\nexport async function finalizeProjectionCheckpoints(\n  context: ProjectionCheckpointContext,\n  input: {\n    readonly execSql?: ExecSql | undefined;\n    readonly persistVerificationCheckpoints?: boolean | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<void> {\n  if (input.persistVerificationCheckpoints === false) {\n    await validateProjectionCheckpoints(context, input);\n    return;\n  }\n  await commitProjectionCheckpoints(context, input);\n  if (input.stillCurrent?.() === false) return;\n  const organizationId =\n    context.organizationId ??\n    context.heldContainerHeads[0]?.state.organizationId;\n  if (organizationId === undefined) return;\n  try {\n    rememberVerifiedContainerHeads({\n      organizationId,\n      execSql: input.execSql ?? context.execSql,\n      heads: context.heldContainerHeads,\n      policies: context.policies,\n    });\n  } catch {\n    // Checkpoints are already committed. Optional re-citation evidence must\n    // never change successful verification into a caller-visible refusal.\n  }\n}\n"]}

package/data/keyingProjectionVerification/containerAncestorCitations.js

@@ -1,164 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { readCanonicalRecord } from "../keying/canonicalJson.js";
-import { readKeyingVerificationShape } from "./error.js";
-import { readRecordNullableString } from "./readers.js";
-function bundleContainerId(bundle, label) {
-    return readKeyingVerificationShape(() => readRecordNullableString(readCanonicalRecord(bundle.state, `${label} state`), "containerId", `${label} state`));
-}
-function citedContainerId(input, manifestHash) {
-    const verified = input.verifiedByHash.get(manifestHash);
-    if (verified)
-        return verified.state.containerId;
-    const bundle = input.bundlesByHash.get(manifestHash);
-    return bundle ? bundleContainerId(bundle, input.label) : null;
-}
-function citedManifestHashForContainer(input, cited, containerId) {
-    const hashes = cited.filter((manifestHash) => citedContainerId(input, manifestHash) === containerId);
-    const [manifestHash] = hashes;
-    if (manifestHash === undefined) {
-        throw new KeyingVerificationError("missing_dependency", `${input.label} does not cite a served head of its parent container ${containerId}`);
-    }
-    if (hashes.length > 1) {
-        throw new KeyingVerificationError("duplicate_entry", `${input.label} cites more than one head of container ${containerId}`);
-    }
-    return manifestHash;
-}
-async function resolveCitedManifest(input, manifestHash, containerId) {
-    const verified = input.verifiedByHash.get(manifestHash);
-    if (verified)
-        return verified;
-    const bundle = input.bundlesByHash.get(manifestHash);
-    if (!bundle) {
-        throw new KeyingVerificationError("missing_dependency", `${input.label} cites a head of container ${containerId} that the projection does not serve`);
-    }
-    return input.verifyHistoryBundle(bundle, `${input.label} cited ancestor ${containerId}`);
-}
-/**
- * The ancestor path, root first, that a container event cites, ending at the
- * head of `parentContainerId`. Empty for a root container.
- */
-export async function resolveCitedAncestorPath(input) {
-    const cited = input.event.event.dependencyManifestHashes;
-    const chain = [];
-    const seen = new Set();
-    let containerId = input.parentContainerId;
-    while (containerId !== null) {
-        if (seen.has(containerId)) {
-            throw new KeyingVerificationError("object_mismatch", `${input.label} cited ancestors form a cycle at ${containerId}`);
-        }
-        seen.add(containerId);
-        const ancestor = await resolveCitedManifest(input, citedManifestHashForContainer(input, cited, containerId), containerId);
-        chain.unshift(ancestor);
-        containerId = ancestor.state.parentContainerId;
-    }
-    return chain;
-}
-/**
- * The verified head of `containerId` among the cited hashes, if any. Reads
- * verified manifests only: a cited hash the pass has not verified is not a
- * head to reason about, and every caller runs after the cited ancestor path
- * resolved and verified the chain. An event cites one head per container,
- * so a second verified one is a served citation set that was tampered with,
- * not a choice to make.
- */
-export function verifiedCitedHead(input) {
-    let found;
-    for (const manifestHash of input.cited) {
-        const verified = input.verifiedByHash.get(manifestHash);
-        if (verified?.state.containerId !== input.containerId)
-            continue;
-        if (found && found.manifestHash !== verified.manifestHash) {
-            throw new KeyingVerificationError("duplicate_entry", `${input.label} cites more than one head of container ${input.containerId}`);
-        }
-        found = verified;
-    }
-    return found;
-}
-/**
- * Whether `head` is `floor` or descends from it through verified
- * predecessors. Epochs alone would let a same-epoch fork signed under an
- * older head pass; lineage cannot be forged without the chain. Every
- * predecessor of a verified manifest was verified with it, so a hop that is
- * not in the verified set means the chain was not served.
- */
-function descendsFrom(verifiedByHash, head, floor) {
-    let current = head;
-    while (current && current.state.epoch >= floor.state.epoch) {
-        if (current.manifestHash === floor.manifestHash)
-            return true;
-        const previousHash = current.state.previousManifestHash;
-        current =
-            previousHash === null ? undefined : verifiedByHash.get(previousHash);
-    }
-    return false;
-}
-/** The cited head must be the established head or descend from it. */
-function assertCitedHeadDescendsFrom(input, cited, floor) {
-    if (descendsFrom(input.verifiedByHash, cited, floor))
-        return;
-    throw new KeyingVerificationError("rollback", `${input.label} cites a head of container ${cited.state.containerId} that does not descend from the head an earlier signed statement already proved current`);
-}
-/**
- * A head must not cite a head of any ancestor that does not descend from the
- * head an earlier signed statement already established: the manifest before
- * it cited that ancestor, the previous manifest's own pin when this is its
- * parent, or a cited child of that ancestor was created or moved under it and
- * cited it. Ancestors no statement establishes are skipped.
- */
-export function assertCitedAncestorsDoNotRegress(input) {
-    const previous = input.previousManifest;
-    const previousCited = previous?.event.event.dependencyManifestHashes ?? [];
-    input.citedAncestors.forEach((ancestor, index) => {
-        const containerId = ancestor.state.containerId;
-        const citedChild = input.citedAncestors[index + 1] ?? previous;
-        const floors = [
-            verifiedCitedHead({
-                cited: previousCited,
-                containerId,
-                label: input.label,
-                verifiedByHash: input.verifiedByHash,
-            }),
-            ...(citedChild
-                ? [
-                    input.verifiedByHash.get(citedChild.state.parentManifestHash ?? ""),
-                    verifiedCitedHead({
-                        cited: citedChild.event.event.dependencyManifestHashes,
-                        containerId,
-                        label: input.label,
-                        verifiedByHash: input.verifiedByHash,
-                    }),
-                ]
-                : []),
-        ];
-        for (const floor of floors) {
-            if (floor && floor.state.containerId === containerId) {
-                assertCitedHeadDescendsFrom(input, ancestor, floor);
-            }
-        }
-    });
-}
-/**
- * Every served current ancestor head must be, or descend through verified
- * predecessors from, the head of that container the head's signed event
- * cites. A served head older than the cited one, or a same-epoch fork of it,
- * is a rollback the signature proves: the cited head exists. A served head
- * newer than the cited one is the ordinary lag of a descendant behind its
- * ancestors, and an ancestor the head does not cite at all joined the path
- * when an ancestor between them moved; neither is refused.
- */
-export function assertServedAncestorsDescendFromCitations(input) {
-    const citations = input.head.event.event.dependencyManifestHashes;
-    for (const served of input.servedAncestors) {
-        const containerId = served.state.containerId;
-        const cited = verifiedCitedHead({
-            cited: citations,
-            containerId,
-            label: input.label,
-            verifiedByHash: input.verifiedByHash,
-        });
-        if (!cited || descendsFrom(input.verifiedByHash, served, cited))
-            continue;
-        throw new KeyingVerificationError("rollback", `${input.label} cites a head of ancestor container ${containerId} that the served current head does not descend from`);
-    }
-}
-//# sourceMappingURL=containerAncestorCitations.js.map

package/data/keyingProjectionVerification/containerAncestorCitations.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerAncestorCitations.js","sourceRoot":"","sources":["containerAncestorCitations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAuCrD,SAAS,iBAAiB,CACxB,MAAwC,EACxC,KAAa;IAEb,OAAO,2BAA2B,CAAC,GAAG,EAAE,CACtC,wBAAwB,CACtB,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,EACnD,aAAa,EACb,GAAG,KAAK,QAAQ,CACjB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAwB,EACxB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAmC,EACnC,KAAwB,EACxB,WAAmB;IAEnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CACzB,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,WAAW,CACxE,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;IAC9B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,wDAAwD,WAAW,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,0CAA0C,WAAW,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAmC,EACnC,YAAoB,EACpB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,GAAG,KAAK,CAAC,KAAK,8BAA8B,WAAW,qCAAqC,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,mBAAmB,CAC9B,MAAM,EACN,GAAG,KAAK,CAAC,KAAK,mBAAmB,WAAW,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAGC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACzD,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1C,OAAO,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,oCAAoC,WAAW,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,KAAK,EACL,6BAA6B,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,EACxD,WAAW,CACZ,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAKjC;IACC,IAAI,KAAkD,CAAC;IACvD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,SAAS;QAChE,IAAI,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,0CAA0C,KAAK,CAAC,WAAW,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,QAAQ,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,cAAoE,EACpE,IAAqC,EACrC,KAAsC;IAEtC,IAAI,OAAO,GAAgD,IAAI,CAAC;IAChE,OAAO,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,YAAY,GAAkB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACvE,OAAO;YACL,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,SAAS,2BAA2B,CAClC,KAAwB,EACxB,KAAsC,EACtC,KAAsC;IAEtC,IAAI,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO;IAC7D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,GAAG,KAAK,CAAC,KAAK,8BAA8B,KAAK,CAAC,KAAK,CAAC,WAAW,yFAAyF,CAC7J,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACxC,MAAM,aAAa,GAAG,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAC3E,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC/D,MAAM,MAAM,GAAG;YACb,iBAAiB,CAAC;gBAChB,KAAK,EAAE,aAAa;gBACpB,WAAW;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;YACF,GAAG,CAAC,UAAU;gBACZ,CAAC,CAAC;oBACE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACnE,iBAAiB,CAAC;wBAChB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB;wBACtD,WAAW;wBACX,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;qBACrC,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACrD,2BAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yCAAyC,CAAC,KAKzD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAC7C,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,KAAK,EAAE,SAAS;YAChB,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC;YAAE,SAAS;QAC1E,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,GAAG,KAAK,CAAC,KAAK,uCAAuC,WAAW,qDAAqD,CACtH,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedAccessEvent,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { AccessManifestBundleWireResponse } from \"@tearleads/validators/response\";\nimport { readCanonicalRecord } from \"../keying/canonicalJson\";\nimport { readKeyingVerificationShape } from \"./error\";\nimport { readRecordNullableString } from \"./readers\";\n\n/**\n * A container manifest pins the parent manifest it was created or moved\n * under, and successors inherit that pin, so the pin says nothing about the\n * ancestor heads a later grant, revoke, or rekey was actually authorized\n * under. Those heads are in the event: every container event signs the\n * manifest hashes of the path it was committed against, and the API refuses\n * an event whose citations are not the current heads at commit time. So a\n * head's authorization path is rebuilt here from its citations, root to\n * parent, and the signer is checked against those heads rather than against\n * whatever path the server pairs with the manifest.\n *\n * A head must also cite, for every ancestor, a head that is or descends from\n * the head an earlier signed statement already established, so an ancestor\n * head one signed statement established can never be rolled back or forked\n * away for a later one.\n *\n * As with principal policies, a successor new to a device need not cite the\n * authority's served current head. An honest server serves a\n * child head citing the ancestor head that was current when it was\n * committed, signed by a member since revoked at that ancestor, and refusing\n * that shape would leave every device holding the child unable to supersede\n * it. What can be refused is the opposite disagreement: a served current\n * ancestor head that does not descend from a head the child's signed event\n * proves exists is a stale or forked ancestor, whatever the server calls\n * current.\n */\n\ninterface CitedAncestorResolutionInput {\n  readonly bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>;\n  readonly label: string;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n  readonly verifyHistoryBundle: (\n    bundle: AccessManifestBundleWireResponse,\n    label: string,\n  ) => Promise<VerifiedContainerAccessManifest>;\n}\n\nfunction bundleContainerId(\n  bundle: AccessManifestBundleWireResponse,\n  label: string,\n): string | null {\n  return readKeyingVerificationShape(() =>\n    readRecordNullableString(\n      readCanonicalRecord(bundle.state, `${label} state`),\n      \"containerId\",\n      `${label} state`,\n    ),\n  );\n}\n\nfunction citedContainerId(\n  input: CitedLineageInput,\n  manifestHash: string,\n): string | null {\n  const verified = input.verifiedByHash.get(manifestHash);\n  if (verified) return verified.state.containerId;\n  const bundle = input.bundlesByHash.get(manifestHash);\n  return bundle ? bundleContainerId(bundle, input.label) : null;\n}\n\nfunction citedManifestHashForContainer(\n  input: CitedAncestorResolutionInput,\n  cited: readonly string[],\n  containerId: string,\n): string {\n  const hashes = cited.filter(\n    (manifestHash) => citedContainerId(input, manifestHash) === containerId,\n  );\n  const [manifestHash] = hashes;\n  if (manifestHash === undefined) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} does not cite a served head of its parent container ${containerId}`,\n    );\n  }\n  if (hashes.length > 1) {\n    throw new KeyingVerificationError(\n      \"duplicate_entry\",\n      `${input.label} cites more than one head of container ${containerId}`,\n    );\n  }\n  return manifestHash;\n}\n\nasync function resolveCitedManifest(\n  input: CitedAncestorResolutionInput,\n  manifestHash: string,\n  containerId: string,\n): Promise<VerifiedContainerAccessManifest> {\n  const verified = input.verifiedByHash.get(manifestHash);\n  if (verified) return verified;\n  const bundle = input.bundlesByHash.get(manifestHash);\n  if (!bundle) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      `${input.label} cites a head of container ${containerId} that the projection does not serve`,\n    );\n  }\n  return input.verifyHistoryBundle(\n    bundle,\n    `${input.label} cited ancestor ${containerId}`,\n  );\n}\n\n/**\n * The ancestor path, root first, that a container event cites, ending at the\n * head of `parentContainerId`. Empty for a root container.\n */\nexport async function resolveCitedAncestorPath(\n  input: CitedAncestorResolutionInput & {\n    readonly event: VerifiedAccessEvent;\n    readonly parentContainerId: string | null;\n  },\n): Promise<VerifiedContainerAccessManifest[]> {\n  const cited = input.event.event.dependencyManifestHashes;\n  const chain: VerifiedContainerAccessManifest[] = [];\n  const seen = new Set<string>();\n  let containerId = input.parentContainerId;\n  while (containerId !== null) {\n    if (seen.has(containerId)) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `${input.label} cited ancestors form a cycle at ${containerId}`,\n      );\n    }\n    seen.add(containerId);\n    const ancestor = await resolveCitedManifest(\n      input,\n      citedManifestHashForContainer(input, cited, containerId),\n      containerId,\n    );\n    chain.unshift(ancestor);\n    containerId = ancestor.state.parentContainerId;\n  }\n  return chain;\n}\n\n/** What the lineage rules read: the served and the verified bundles. */\nexport type CitedLineageInput = Pick<\n  CitedAncestorResolutionInput,\n  \"bundlesByHash\" | \"label\" | \"verifiedByHash\"\n>;\n\n/**\n * The verified head of `containerId` among the cited hashes, if any. Reads\n * verified manifests only: a cited hash the pass has not verified is not a\n * head to reason about, and every caller runs after the cited ancestor path\n * resolved and verified the chain. An event cites one head per container,\n * so a second verified one is a served citation set that was tampered with,\n * not a choice to make.\n */\nexport function verifiedCitedHead(input: {\n  readonly cited: readonly string[];\n  readonly containerId: string;\n  readonly label: string;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): VerifiedContainerAccessManifest | undefined {\n  let found: VerifiedContainerAccessManifest | undefined;\n  for (const manifestHash of input.cited) {\n    const verified = input.verifiedByHash.get(manifestHash);\n    if (verified?.state.containerId !== input.containerId) continue;\n    if (found && found.manifestHash !== verified.manifestHash) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `${input.label} cites more than one head of container ${input.containerId}`,\n      );\n    }\n    found = verified;\n  }\n  return found;\n}\n\n/**\n * Whether `head` is `floor` or descends from it through verified\n * predecessors. Epochs alone would let a same-epoch fork signed under an\n * older head pass; lineage cannot be forged without the chain. Every\n * predecessor of a verified manifest was verified with it, so a hop that is\n * not in the verified set means the chain was not served.\n */\nfunction descendsFrom(\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n  head: VerifiedContainerAccessManifest,\n  floor: VerifiedContainerAccessManifest,\n): boolean {\n  let current: VerifiedContainerAccessManifest | undefined = head;\n  while (current && current.state.epoch >= floor.state.epoch) {\n    if (current.manifestHash === floor.manifestHash) return true;\n    const previousHash: string | null = current.state.previousManifestHash;\n    current =\n      previousHash === null ? undefined : verifiedByHash.get(previousHash);\n  }\n  return false;\n}\n\n/** The cited head must be the established head or descend from it. */\nfunction assertCitedHeadDescendsFrom(\n  input: CitedLineageInput,\n  cited: VerifiedContainerAccessManifest,\n  floor: VerifiedContainerAccessManifest,\n): void {\n  if (descendsFrom(input.verifiedByHash, cited, floor)) return;\n  throw new KeyingVerificationError(\n    \"rollback\",\n    `${input.label} cites a head of container ${cited.state.containerId} that does not descend from the head an earlier signed statement already proved current`,\n  );\n}\n\n/**\n * A head must not cite a head of any ancestor that does not descend from the\n * head an earlier signed statement already established: the manifest before\n * it cited that ancestor, the previous manifest's own pin when this is its\n * parent, or a cited child of that ancestor was created or moved under it and\n * cited it. Ancestors no statement establishes are skipped.\n */\nexport function assertCitedAncestorsDoNotRegress(\n  input: CitedLineageInput & {\n    readonly citedAncestors: readonly VerifiedContainerAccessManifest[];\n    readonly previousManifest: VerifiedContainerAccessManifest | null;\n  },\n): void {\n  const previous = input.previousManifest;\n  const previousCited = previous?.event.event.dependencyManifestHashes ?? [];\n  input.citedAncestors.forEach((ancestor, index) => {\n    const containerId = ancestor.state.containerId;\n    const citedChild = input.citedAncestors[index + 1] ?? previous;\n    const floors = [\n      verifiedCitedHead({\n        cited: previousCited,\n        containerId,\n        label: input.label,\n        verifiedByHash: input.verifiedByHash,\n      }),\n      ...(citedChild\n        ? [\n            input.verifiedByHash.get(citedChild.state.parentManifestHash ?? \"\"),\n            verifiedCitedHead({\n              cited: citedChild.event.event.dependencyManifestHashes,\n              containerId,\n              label: input.label,\n              verifiedByHash: input.verifiedByHash,\n            }),\n          ]\n        : []),\n    ];\n    for (const floor of floors) {\n      if (floor && floor.state.containerId === containerId) {\n        assertCitedHeadDescendsFrom(input, ancestor, floor);\n      }\n    }\n  });\n}\n\n/**\n * Every served current ancestor head must be, or descend through verified\n * predecessors from, the head of that container the head's signed event\n * cites. A served head older than the cited one, or a same-epoch fork of it,\n * is a rollback the signature proves: the cited head exists. A served head\n * newer than the cited one is the ordinary lag of a descendant behind its\n * ancestors, and an ancestor the head does not cite at all joined the path\n * when an ancestor between them moved; neither is refused.\n */\nexport function assertServedAncestorsDescendFromCitations(input: {\n  readonly head: VerifiedContainerAccessManifest;\n  readonly label: string;\n  readonly servedAncestors: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): void {\n  const citations = input.head.event.event.dependencyManifestHashes;\n  for (const served of input.servedAncestors) {\n    const containerId = served.state.containerId;\n    const cited = verifiedCitedHead({\n      cited: citations,\n      containerId,\n      label: input.label,\n      verifiedByHash: input.verifiedByHash,\n    });\n    if (!cited || descendsFrom(input.verifiedByHash, served, cited)) continue;\n    throw new KeyingVerificationError(\n      \"rollback\",\n      `${input.label} cites a head of ancestor container ${containerId} that the served current head does not descend from`,\n    );\n  }\n}\n"]}

package/data/keyingProjectionVerification/containerCreateManifest.js

@@ -1,28 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-/**
- * Walk a verified head back to its epoch-1 `container.create`. Head
- * verification already verified every predecessor it cites (a head is only
- * accepted once its previous manifest verified), so the lineage is present in
- * `verifiedByHash`; a gap means the served projection was incomplete.
- */
-export function verifiedContainerCreateManifest(input) {
-    let current = input.head;
-    const visited = new Set();
-    while (current.state.previousManifestHash !== null) {
-        if (visited.has(current.manifestHash)) {
-            throw new KeyingVerificationError("invalid_shape", `${input.label} manifest lineage is cyclic`);
-        }
-        visited.add(current.manifestHash);
-        const previous = input.verifiedByHash.get(current.state.previousManifestHash);
-        if (!previous || previous.state.containerId !== current.state.containerId) {
-            throw new KeyingVerificationError("missing_dependency", `${input.label} lineage does not reach its container.create`);
-        }
-        current = previous;
-    }
-    if (current.state.epoch !== 1 ||
-        current.event.event.eventType !== "container.create") {
-        throw new KeyingVerificationError("invalid_shape", `${input.label} lineage does not start with container.create`);
-    }
-    return current;
-}
-//# sourceMappingURL=containerCreateManifest.js.map

package/data/keyingProjectionVerification/containerDestinationVerification.js

@@ -1,51 +0,0 @@
-import { createProjectionCheckpointContext, finalizeProjectionCheckpoints, observeVerifiedProjectionBundles, } from "./checkpointContext.js";
-import { verifyContainerManifestPath } from "./containerPathVerification.js";
-import { addContainerWriterProjectionBundles } from "./containerProjectionVerification.js";
-import { verifyProjectionAuthorizationEvidence } from "./projectionAuthorizationEvidence.js";
-import { projectionLifetimeGuard } from "./projectionLifetimes.js";
-import { assertProjectionVerificationCurrent } from "./types.js";
-/** Authenticate immutable destination roles without advancing write-authority pins. */
-export async function verifyContainerDestinationProjection(input) {
-    const bundlesByHash = new Map();
-    addContainerWriterProjectionBundles(bundlesByHash, input.projection, "Container destination");
-    const verifiedByHash = new Map();
-    const checkpointContext = createProjectionCheckpointContext({
-        execSql: input.execSql,
-        organizationId: input.projection.organizationId,
-    });
-    const principalPolicyCache = new Map();
-    const authorizationEvidence = await verifyProjectionAuthorizationEvidence({
-        bundles: [...bundlesByHash.values()],
-        checkpointContext,
-        policyEvidence: input.projection.policyEvidence,
-        organizationId: input.projection.organizationId,
-        principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const path = await verifyContainerManifestPath({
-        authorizationEvidence,
-        requireAuthorizationEvidence: true,
-        authorizationMembership: "referenced",
-        bundlesByHash,
-        checkpointContext,
-        enforceLocalCheckpoints: false,
-        servedAsCurrent: false,
-        label: "Container destination",
-        path: input.projection.path,
-        principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
-        verifiedByHash,
-    });
-    const current = projectionLifetimeGuard(checkpointContext, input.stillCurrent);
-    // Authenticated bytes, not authority: a later read may cite them.
-    observeVerifiedProjectionBundles(checkpointContext, bundlesByHash, verifiedByHash);
-    await finalizeProjectionCheckpoints(checkpointContext, {
-        stillCurrent: current,
-        persistVerificationCheckpoints: false,
-    });
-    assertProjectionVerificationCurrent(current);
-    return { path, verifiedByHash };
-}
-//# sourceMappingURL=containerDestinationVerification.js.map

package/data/keyingProjectionVerification/containerDestinationVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerDestinationVerification.js","sourceRoot":"","sources":["containerDestinationVerification.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAKhE,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IAKC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,mCAAmC,CACjC,aAAa,EACb,KAAK,CAAC,UAAU,EAChB,uBAAuB,CACxB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;KAChD,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAE,CAAC;IACvC,MAAM,qBAAqB,GAAG,MAAM,qCAAqC,CAAC;QACxE,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QACpC,iBAAiB;QACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC/C,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC;QAC7C,qBAAqB;QACrB,4BAA4B,EAAE,IAAI;QAClC,uBAAuB,EAAE,YAAY;QACrC,aAAa;QACb,iBAAiB;QACjB,uBAAuB,EAAE,KAAK;QAC9B,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CACrC,iBAAiB,EACjB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,kEAAkE;IAClE,gCAAgC,CAC9B,iBAAiB,EACjB,aAAa,EACb,cAAc,CACf,CAAC;IACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE;QACrD,YAAY,EAAE,OAAO;QACrB,8BAA8B,EAAE,KAAK;KACtC,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeVerifiedProjectionBundles,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport { addContainerWriterProjectionBundles } from \"./containerProjectionVerification\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport { projectionLifetimeGuard } from \"./projectionLifetimes\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport { assertProjectionVerificationCurrent } from \"./types\";\n\n/** Authenticate immutable destination roles without advancing write-authority pins. */\nexport async function verifyContainerDestinationProjection(input: {\n  readonly execSql: ExecSql;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<{\n  readonly path: VerifiedContainerAccessManifest[];\n  /** Every manifest verified on the way, including each head's lineage. */\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addContainerWriterProjectionBundles(\n    bundlesByHash,\n    input.projection,\n    \"Container destination\",\n  );\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n    organizationId: input.projection.organizationId,\n  });\n  const principalPolicyCache = new Map();\n  const authorizationEvidence = await verifyProjectionAuthorizationEvidence({\n    bundles: [...bundlesByHash.values()],\n    checkpointContext,\n    policyEvidence: input.projection.policyEvidence,\n    organizationId: input.projection.organizationId,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const path = await verifyContainerManifestPath({\n    authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    authorizationMembership: \"referenced\",\n    bundlesByHash,\n    checkpointContext,\n    enforceLocalCheckpoints: false,\n    servedAsCurrent: false,\n    label: \"Container destination\",\n    path: input.projection.path,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    verifiedByHash,\n  });\n  const current = projectionLifetimeGuard(\n    checkpointContext,\n    input.stillCurrent,\n  );\n  // Authenticated bytes, not authority: a later read may cite them.\n  observeVerifiedProjectionBundles(\n    checkpointContext,\n    bundlesByHash,\n    verifiedByHash,\n  );\n  await finalizeProjectionCheckpoints(checkpointContext, {\n    stillCurrent: current,\n    persistVerificationCheckpoints: false,\n  });\n  assertProjectionVerificationCurrent(current);\n  return { path, verifiedByHash };\n}\n"]}