@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/keyingProjectionVerification/containerProjectionVerification.js

@@ -1,254 +0,0 @@
-import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, toFingerprint, verifyContainerKekState, } from "../../internal/crypto/index.js";
-import { addBundleByHash } from "./bundleVerification.js";
-import { createProjectionCheckpointContext, finalizeProjectionCheckpoints, observeAccessManifestCheckpoints, observeVerifiedProjectionBundles, } from "./checkpointContext.js";
-import { verifyContainerManifestBundle } from "./containerManifestVerification.js";
-import { verifyContainerManifestPath } from "./containerPathVerification.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { throwKeyingVerificationShapeFailure } from "./error.js";
-import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
-import { verifyProjectionAuthorizationEvidence } from "./projectionAuthorizationEvidence.js";
-import { readContainerKekRecipientTarget, readContainerKeyEpoch, readContainerKeyWrap, } from "./readers.js";
-import { assertProjectionVerificationCurrent, generationGuardedPrincipalPolicyWarmer, withGenerationGuardedPolicyWarmer, } from "./types.js";
-async function collectContainerUserRecipientKeys(input) {
-    const userIds = [
-        ...new Set(input.containerManifest.state.directGrants
-            .filter((grant) => grant.subjectType === "user")
-            .map((grant) => grant.subjectId)),
-    ].sort();
-    const userRecipientKeys = [];
-    for (const userId of userIds) {
-        const userKey = await input.resolveUserKey(userId);
-        if (!userKey) {
-            throw new ProjectionDependencyUnavailableError(`Container writer projection recipient key could not be resolved for ${userId}`);
-        }
-        const recipientKeyFingerprint = await toFingerprint(userKey.encapsulationPublicKey);
-        userRecipientKeys.push({
-            userId,
-            recipientKeyEpochId: `user:${userId}:encapsulation:${recipientKeyFingerprint}`,
-            recipientKeyFingerprint,
-        });
-    }
-    return userRecipientKeys;
-}
-function containerKekManifestHistory(input) {
-    const historyByHash = new Map();
-    for (const manifest of input.history) {
-        if (manifest.state.containerId === input.verifiedManifest.state.containerId &&
-            manifest.manifestHash !== input.verifiedManifest.manifestHash) {
-            historyByHash.set(manifest.manifestHash, manifest);
-        }
-    }
-    return [...historyByHash.values()];
-}
-async function verifyContainerKekProjection(input) {
-    if (input.verifiedManifest.state.parentContainerId && !input.parentKekState) {
-        throw new Error(`${input.label} requires verified parent KEK state`);
-    }
-    const keyEpoch = readContainerKeyEpoch(input.kek.keyEpoch, `${input.label} key epoch`);
-    const wraps = input.kek.wraps.map((wrap, index) => readContainerKeyWrap(wrap, `${input.label} wrap[${index}]`));
-    const userRecipientKeys = await collectContainerUserRecipientKeys({
-        containerManifest: input.verifiedManifest,
-        resolveUserKey: input.resolveUserKey,
-    });
-    const verifiedKekManifestHistory = containerKekManifestHistory({
-        history: input.verifiedManifestHistory,
-        verifiedManifest: input.verifiedManifest,
-    });
-    const verified = await verifyContainerKekState({
-        allowHistoricalParentEpoch: true,
-        containerManifest: input.verifiedManifest,
-        containerManifestHistory: verifiedKekManifestHistory,
-        parentManifestHistory: input.parentManifestHistory,
-        keyEpoch,
-        parentKekState: input.parentKekState,
-        principalPolicies: input.authorizationEvidence,
-        userRecipientKeys,
-        wraps,
-    });
-    if (!verified.ok) {
-        throw new Error(`${input.label} KEK verification failed`);
-    }
-    const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);
-    if (keyEpochHash !== input.kek.keyEpochHash) {
-        throw new Error(`${input.label} key epoch hash mismatch`);
-    }
-    const recipientTargets = input.kek.recipientTargets.map((target, index) => readContainerKekRecipientTarget(target, `${input.label} recipient target[${index}]`));
-    const keyTargetHash = await computeContainerKekRecipientTargetHash(recipientTargets);
-    if (keyTargetHash !== input.kek.keyTargetHash ||
-        keyTargetHash !== verified.value.keyTargetHash) {
-        throw new Error(`${input.label} target hash mismatch`);
-    }
-    if (verified.value.containerKeyEpochId !== input.kek.containerKeyEpochId ||
-        verified.value.containerKeyEpoch !== input.kek.containerKeyEpoch ||
-        verified.value.accessManifestHash !== input.kek.accessManifestHash ||
-        verified.value.parentContainerKeyEpochId !==
-            input.kek.parentContainerKeyEpochId) {
-        throw new Error(`${input.label} identity mismatch`);
-    }
-    return verified.value;
-}
-export function verifiedContainerManifestsForBundles(bundlesByHash, verifiedByHash) {
-    return [...bundlesByHash.keys()].flatMap((manifestHash) => {
-        const verified = verifiedByHash.get(manifestHash);
-        return verified ? [verified] : [];
-    });
-}
-function collectContainerProjectionBundles(projection) {
-    const bundlesByHash = new Map();
-    addContainerWriterProjectionBundles(bundlesByHash, projection, "Container writer projection");
-    return bundlesByHash;
-}
-export async function verifyContainerWriterProjectionWithContext(input, checkpointContext) {
-    if (input.projection.path.length !== input.projection.containerKeks.length) {
-        throw new Error("Container writer projection path and KEKs are inconsistent");
-    }
-    const bundlesByHash = collectContainerProjectionBundles(input.projection);
-    const verifiedByHash = input.verifiedByHash ?? new Map();
-    const principalPolicyCache = input.principalPolicyCache ?? new Map();
-    const verification = {
-        checkpointContext,
-        principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    };
-    const authorizationEvidence = input.authorizationEvidence ??
-        (await verifyProjectionAuthorizationEvidence({
-            ...verification,
-            bundles: [...bundlesByHash.values()],
-            policyEvidence: input.projection.policyEvidence,
-            organizationId: input.projection.organizationId,
-            stillCurrent: input.stillCurrent,
-        }));
-    const verifiedPath = await verifyContainerManifestPath({
-        ...verification,
-        authorizationEvidence,
-        requireAuthorizationEvidence: true,
-        servedAsCurrent: true,
-        bundlesByHash,
-        enforceLocalCheckpoints: true,
-        label: "Container writer projection path",
-        path: input.projection.path,
-        verifiedByHash,
-    });
-    const verifiedKekStates = [];
-    for (const [index, kek] of input.projection.containerKeks.entries()) {
-        const verifiedManifest = verifiedPath[index];
-        if (!verifiedManifest) {
-            throw new Error(`Container writer projection KEK[${index}] is missing`);
-        }
-        const verifiedManifestHistory = [];
-        for (const [historyIndex, bundle,] of kek.containerManifestHistory.entries()) {
-            verifiedManifestHistory.push(await verifyContainerManifestBundle({
-                ...verification,
-                authorizationEvidence,
-                requireAuthorizationEvidence: true,
-                bundle,
-                bundlesByHash,
-                enforceLocalCheckpoint: false,
-                label: `Container writer projection KEK[${index}] history[${historyIndex}]`,
-                parentPath: verifiedPath.slice(0, index),
-                verifiedByHash,
-            }));
-        }
-        const verifiedKekState = await verifyContainerKekProjection({
-            authorizationEvidence,
-            kek,
-            label: `Container writer projection KEK[${index}]`,
-            parentKekState: index > 0 ? (verifiedKekStates[index - 1] ?? null) : null,
-            resolveUserKey: input.resolveUserKey,
-            verifiedManifest,
-            verifiedManifestHistory,
-            parentManifestHistory: [...verifiedByHash.values()],
-        });
-        verifiedKekStates.push(verifiedKekState);
-    }
-    observeAccessManifestCheckpoints(checkpointContext, {
-        verifiedHeads: verifiedPath,
-        verifiedManifests: verifiedContainerManifestsForBundles(bundlesByHash, verifiedByHash),
-    });
-    checkpointContext.heldContainerHeads.push(...verifiedPath);
-    return verifiedPath;
-}
-export async function verifyContainerWriterProjection(input) {
-    try {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const verifiedByHash = input.verifiedByHash ??
-            new Map();
-        const guardedInput = {
-            ...withGenerationGuardedPolicyWarmer(input),
-            verifiedByHash,
-        };
-        const checkpointContext = createProjectionCheckpointContext({
-            execSql: input.execSql,
-            organizationId: input.projection.organizationId,
-        });
-        const verifiedPath = await verifyContainerWriterProjectionWithContext(guardedInput, checkpointContext);
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        observeVerifiedProjectionBundles(checkpointContext, collectContainerProjectionBundles(input.projection), verifiedByHash);
-        await finalizeProjectionCheckpoints(checkpointContext, input);
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        return verifiedPath;
-    }
-    catch (error) {
-        throwKeyingVerificationShapeFailure(error);
-    }
-}
-export async function collectContainerWriterProjectionPrincipalPolicies(input) {
-    try {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const warmReferencedPrincipalPolicies = generationGuardedPrincipalPolicyWarmer(input.warmReferencedPrincipalPolicies, input.stillCurrent);
-        const principalPolicyCache = input.principalPolicyCache ?? new Map();
-        const verifiedByHash = input.verifiedByHash ??
-            new Map();
-        const checkpointContext = createProjectionCheckpointContext({
-            execSql: input.execSql,
-            organizationId: input.projection.organizationId,
-        });
-        const verifiedPath = await verifyContainerWriterProjectionWithContext({
-            principalPolicyCache,
-            projection: input.projection,
-            verifiedByHash,
-            resolveUserKey: input.resolveUserKey,
-            warmReferencedPrincipalPolicies,
-        }, checkpointContext);
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const policies = await collectPrincipalPoliciesForContainerPaths({
-            checkpointContext,
-            organizationId: input.projection.organizationId,
-            paths: [verifiedPath],
-            principalPolicyCache,
-            resolveUserKey: input.resolveUserKey,
-            warmReferencedPrincipalPolicies,
-        });
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        observeVerifiedProjectionBundles(checkpointContext, collectContainerProjectionBundles(input.projection), verifiedByHash);
-        await finalizeProjectionCheckpoints(checkpointContext, input);
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        return policies;
-    }
-    catch (error) {
-        throwKeyingVerificationShapeFailure(error);
-    }
-}
-export function addContainerWriterProjectionBundles(bundlesByHash, projection, label) {
-    for (const [index, bundle] of projection.path.entries()) {
-        addBundleByHash(bundlesByHash, bundle, `${label} path[${index}]`);
-    }
-    for (const [kekIndex, kek] of projection.containerKeks.entries()) {
-        for (const [historyIndex, bundle,] of kek.containerManifestHistory.entries()) {
-            addBundleByHash(bundlesByHash, bundle, `${label} KEK[${kekIndex}] history[${historyIndex}]`);
-        }
-    }
-}
-async function collectPrincipalPoliciesForContainerPaths(input) {
-    const referencedPrincipalHeads = input.paths.flatMap((path) => (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads));
-    return collectReferencedPrincipalPolicies({
-        checkpointContext: input.checkpointContext,
-        organizationId: input.organizationId,
-        principalPolicyCache: input.principalPolicyCache,
-        references: referencedPrincipalHeads,
-        resolveUserKey: input.resolveUserKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-}
-//# sourceMappingURL=containerProjectionVerification.js.map

package/data/keyingProjectionVerification/containerProjectionVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"containerProjectionVerification.js","sourceRoot":"","sources":["containerProjectionVerification.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,EAC5B,aAAa,EAGb,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,gCAAgC,EAChC,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAMnB,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,iCAAiC,CAAC,KAGhD;IACC,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY;aACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CACnC;KACF,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAE1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,oCAAoC,CAC5C,uEAAuE,MAAM,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,GAAG,MAAM,aAAa,CACjD,OAAO,CAAC,sBAAsB,CAC/B,CAAC;QACF,iBAAiB,CAAC,IAAI,CAAC;YACrB,MAAM;YACN,mBAAmB,EAAE,QAAQ,MAAM,kBAAkB,uBAAuB,EAAE;YAC9E,uBAAuB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,2BAA2B,CAAC,KAGpC;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2C,CAAC;IAEzE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,IACE,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW;YACvE,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAC7D,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAS3C;IACC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAClB,GAAG,KAAK,CAAC,KAAK,YAAY,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,oBAAoB,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,SAAS,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,iCAAiC,CAAC;QAChE,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,uBAAuB;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,0BAA0B,EAAE,IAAI;QAChC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,wBAAwB,EAAE,0BAA0B;QACpD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,qBAAqB;QAC9C,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACxE,+BAA+B,CAC7B,MAAM,EACN,GAAG,KAAK,CAAC,KAAK,qBAAqB,KAAK,GAAG,CAC5C,CACF,CAAC;IACF,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,IACE,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa;QACzC,aAAa,KAAK,QAAQ,CAAC,KAAK,CAAC,aAAa,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,GAAG,CAAC,mBAAmB;QACpE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,GAAG,CAAC,iBAAiB;QAChE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,GAAG,CAAC,kBAAkB;QAClE,QAAQ,CAAC,KAAK,CAAC,yBAAyB;YACtC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAiBD,MAAM,UAAU,oCAAoC,CAClD,aAAoE,EACpE,cAAoE;IAEpE,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iCAAiC,CACxC,UAA6C;IAE7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,mCAAmC,CACjC,aAAa,EACb,UAAU,EACV,6BAA6B,CAC9B,CAAC;IACF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,KAEC,EACD,iBAA8C;IAE9C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE1E,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,IAAI,GAAG,EAA2C,CAAC;IAC7E,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG;QACnB,iBAAiB;QACjB,oBAAoB;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC;IACF,MAAM,qBAAqB,GACzB,KAAK,CAAC,qBAAqB;QAC3B,CAAC,MAAM,qCAAqC,CAAC;YAC3C,GAAG,YAAY;YACf,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,CAAC;IACN,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,GAAG,YAAY;QACf,qBAAqB;QACrB,4BAA4B,EAAE,IAAI;QAClC,eAAe,EAAE,IAAI;QACrB,aAAa;QACb,uBAAuB,EAAE,IAAI;QAC7B,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,cAAc,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,uBAAuB,GAAsC,EAAE,CAAC;QACtE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,uBAAuB,CAAC,IAAI,CAC1B,MAAM,6BAA6B,CAAC;gBAClC,GAAG,YAAY;gBACf,qBAAqB;gBACrB,4BAA4B,EAAE,IAAI;gBAClC,MAAM;gBACN,aAAa;gBACb,sBAAsB,EAAE,KAAK;gBAC7B,KAAK,EAAE,mCAAmC,KAAK,aAAa,YAAY,GAAG;gBAC3E,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,cAAc;aACf,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC;YAC1D,qBAAqB;YACrB,GAAG;YACH,KAAK,EAAE,mCAAmC,KAAK,GAAG;YAClD,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;YAChB,uBAAuB;YACvB,qBAAqB,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC,CAAC,iBAAiB,EAAE;QAClD,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IAEH,iBAAiB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc;YACpB,IAAI,GAAG,EAA2C,CAAC;QACrD,MAAM,YAAY,GAAG;YACnB,GAAG,iCAAiC,CAAC,KAAK,CAAC;YAC3C,cAAc;SACf,CAAC;QACF,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,gCAAgC,CAC9B,iBAAiB,EACjB,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,EACnD,cAAc,CACf,CAAC;QACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iDAAiD,CACrE,KAAiD;IAEjD,IAAI,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc;YACpB,IAAI,GAAG,EAA2C,CAAC;QACrD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,0CAA0C,CACnE;YACE,oBAAoB;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc;YACd,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,EACD,iBAAiB,CAClB,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAAC;YAC/D,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,oBAAoB;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B;SAChC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,gCAAgC,CAC9B,iBAAiB,EACjB,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,EACnD,cAAc,CACf,CAAC;QACF,MAAM,6BAA6B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,aAA4D,EAC5D,UAA6C,EAC7C,KAAa;IAEb,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,KAAK,MAAM,CACT,YAAY,EACZ,MAAM,EACP,IAAI,GAAG,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,eAAe,CACb,aAAa,EACb,MAAM,EACN,GAAG,KAAK,QAAQ,QAAQ,aAAa,YAAY,GAAG,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yCAAyC,CAAC,KAOxD;IACC,MAAM,wBAAwB,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5D,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAC5E,CAAC;IAEF,OAAO,kCAAkC,CAAC;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  type ContainerUserRecipientKey,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  toFingerprint,\n  type VerifiedContainerAccessManifest,\n  type VerifiedContainerKekState,\n  verifyContainerKekState,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"./bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  finalizeProjectionCheckpoints,\n  observeAccessManifestCheckpoints,\n  observeVerifiedProjectionBundles,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { verifyContainerManifestBundle } from \"./containerManifestVerification\";\nimport { verifyContainerManifestPath } from \"./containerPathVerification\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { throwKeyingVerificationShapeFailure } from \"./error\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { verifyProjectionAuthorizationEvidence } from \"./projectionAuthorizationEvidence\";\nimport {\n  readContainerKekRecipientTarget,\n  readContainerKeyEpoch,\n  readContainerKeyWrap,\n} from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n  withGenerationGuardedPolicyWarmer,\n} from \"./types\";\n\nasync function collectContainerUserRecipientKeys(input: {\n  readonly containerManifest: VerifiedContainerAccessManifest;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<ContainerUserRecipientKey[]> {\n  const userIds = [\n    ...new Set(\n      input.containerManifest.state.directGrants\n        .filter((grant) => grant.subjectType === \"user\")\n        .map((grant) => grant.subjectId),\n    ),\n  ].sort();\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n\n  for (const userId of userIds) {\n    const userKey = await input.resolveUserKey(userId);\n    if (!userKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `Container writer projection recipient key could not be resolved for ${userId}`,\n      );\n    }\n    const recipientKeyFingerprint = await toFingerprint(\n      userKey.encapsulationPublicKey,\n    );\n    userRecipientKeys.push({\n      userId,\n      recipientKeyEpochId: `user:${userId}:encapsulation:${recipientKeyFingerprint}`,\n      recipientKeyFingerprint,\n    });\n  }\n\n  return userRecipientKeys;\n}\n\nfunction containerKekManifestHistory(input: {\n  readonly history: readonly VerifiedContainerAccessManifest[];\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n}): VerifiedContainerAccessManifest[] {\n  const historyByHash = new Map<string, VerifiedContainerAccessManifest>();\n\n  for (const manifest of input.history) {\n    if (\n      manifest.state.containerId === input.verifiedManifest.state.containerId &&\n      manifest.manifestHash !== input.verifiedManifest.manifestHash\n    ) {\n      historyByHash.set(manifest.manifestHash, manifest);\n    }\n  }\n\n  return [...historyByHash.values()];\n}\n\nasync function verifyContainerKekProjection(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly kek: ContainerWriterProjectionResponse[\"containerKeks\"][number];\n  readonly label: string;\n  readonly parentKekState: VerifiedContainerKekState | null;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly verifiedManifest: VerifiedContainerAccessManifest;\n  readonly verifiedManifestHistory: readonly VerifiedContainerAccessManifest[];\n  readonly parentManifestHistory: readonly VerifiedContainerAccessManifest[];\n}): Promise<VerifiedContainerKekState> {\n  if (input.verifiedManifest.state.parentContainerId && !input.parentKekState) {\n    throw new Error(`${input.label} requires verified parent KEK state`);\n  }\n\n  const keyEpoch = readContainerKeyEpoch(\n    input.kek.keyEpoch,\n    `${input.label} key epoch`,\n  );\n  const wraps = input.kek.wraps.map((wrap, index) =>\n    readContainerKeyWrap(wrap, `${input.label} wrap[${index}]`),\n  );\n  const userRecipientKeys = await collectContainerUserRecipientKeys({\n    containerManifest: input.verifiedManifest,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verifiedKekManifestHistory = containerKekManifestHistory({\n    history: input.verifiedManifestHistory,\n    verifiedManifest: input.verifiedManifest,\n  });\n  const verified = await verifyContainerKekState({\n    allowHistoricalParentEpoch: true,\n    containerManifest: input.verifiedManifest,\n    containerManifestHistory: verifiedKekManifestHistory,\n    parentManifestHistory: input.parentManifestHistory,\n    keyEpoch,\n    parentKekState: input.parentKekState,\n    principalPolicies: input.authorizationEvidence,\n    userRecipientKeys,\n    wraps,\n  });\n  if (!verified.ok) {\n    throw new Error(`${input.label} KEK verification failed`);\n  }\n\n  const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n  if (keyEpochHash !== input.kek.keyEpochHash) {\n    throw new Error(`${input.label} key epoch hash mismatch`);\n  }\n  const recipientTargets = input.kek.recipientTargets.map((target, index) =>\n    readContainerKekRecipientTarget(\n      target,\n      `${input.label} recipient target[${index}]`,\n    ),\n  );\n  const keyTargetHash =\n    await computeContainerKekRecipientTargetHash(recipientTargets);\n  if (\n    keyTargetHash !== input.kek.keyTargetHash ||\n    keyTargetHash !== verified.value.keyTargetHash\n  ) {\n    throw new Error(`${input.label} target hash mismatch`);\n  }\n  if (\n    verified.value.containerKeyEpochId !== input.kek.containerKeyEpochId ||\n    verified.value.containerKeyEpoch !== input.kek.containerKeyEpoch ||\n    verified.value.accessManifestHash !== input.kek.accessManifestHash ||\n    verified.value.parentContainerKeyEpochId !==\n      input.kek.parentContainerKeyEpochId\n  ) {\n    throw new Error(`${input.label} identity mismatch`);\n  }\n\n  return verified.value;\n}\n\ninterface ContainerWriterProjectionVerificationInput {\n  readonly execSql: ExecSql;\n  readonly persistVerificationCheckpoints?: boolean | undefined;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly verifiedByHash?:\n    | Map<string, VerifiedContainerAccessManifest>\n    | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nexport function verifiedContainerManifestsForBundles(\n  bundlesByHash: ReadonlyMap<string, AccessManifestBundleWireResponse>,\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): VerifiedContainerAccessManifest[] {\n  return [...bundlesByHash.keys()].flatMap((manifestHash) => {\n    const verified = verifiedByHash.get(manifestHash);\n    return verified ? [verified] : [];\n  });\n}\n\nfunction collectContainerProjectionBundles(\n  projection: ContainerWriterProjectionResponse,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  addContainerWriterProjectionBundles(\n    bundlesByHash,\n    projection,\n    \"Container writer projection\",\n  );\n  return bundlesByHash;\n}\n\nexport async function verifyContainerWriterProjectionWithContext(\n  input: Omit<ContainerWriterProjectionVerificationInput, \"execSql\"> & {\n    readonly authorizationEvidence?: readonly PrincipalPolicyAuthorization[];\n  },\n  checkpointContext: ProjectionCheckpointContext,\n): Promise<VerifiedContainerAccessManifest[]> {\n  if (input.projection.path.length !== input.projection.containerKeks.length) {\n    throw new Error(\n      \"Container writer projection path and KEKs are inconsistent\",\n    );\n  }\n\n  const bundlesByHash = collectContainerProjectionBundles(input.projection);\n\n  const verifiedByHash =\n    input.verifiedByHash ?? new Map<string, VerifiedContainerAccessManifest>();\n  const principalPolicyCache: PrincipalPolicyCache =\n    input.principalPolicyCache ?? new Map();\n  const verification = {\n    checkpointContext,\n    principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  };\n  const authorizationEvidence =\n    input.authorizationEvidence ??\n    (await verifyProjectionAuthorizationEvidence({\n      ...verification,\n      bundles: [...bundlesByHash.values()],\n      policyEvidence: input.projection.policyEvidence,\n      organizationId: input.projection.organizationId,\n      stillCurrent: input.stillCurrent,\n    }));\n  const verifiedPath = await verifyContainerManifestPath({\n    ...verification,\n    authorizationEvidence,\n    requireAuthorizationEvidence: true,\n    servedAsCurrent: true,\n    bundlesByHash,\n    enforceLocalCheckpoints: true,\n    label: \"Container writer projection path\",\n    path: input.projection.path,\n    verifiedByHash,\n  });\n\n  const verifiedKekStates: VerifiedContainerKekState[] = [];\n  for (const [index, kek] of input.projection.containerKeks.entries()) {\n    const verifiedManifest = verifiedPath[index];\n    if (!verifiedManifest) {\n      throw new Error(`Container writer projection KEK[${index}] is missing`);\n    }\n    const verifiedManifestHistory: VerifiedContainerAccessManifest[] = [];\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      verifiedManifestHistory.push(\n        await verifyContainerManifestBundle({\n          ...verification,\n          authorizationEvidence,\n          requireAuthorizationEvidence: true,\n          bundle,\n          bundlesByHash,\n          enforceLocalCheckpoint: false,\n          label: `Container writer projection KEK[${index}] history[${historyIndex}]`,\n          parentPath: verifiedPath.slice(0, index),\n          verifiedByHash,\n        }),\n      );\n    }\n\n    const verifiedKekState = await verifyContainerKekProjection({\n      authorizationEvidence,\n      kek,\n      label: `Container writer projection KEK[${index}]`,\n      parentKekState: index > 0 ? (verifiedKekStates[index - 1] ?? null) : null,\n      resolveUserKey: input.resolveUserKey,\n      verifiedManifest,\n      verifiedManifestHistory,\n      parentManifestHistory: [...verifiedByHash.values()],\n    });\n    verifiedKekStates.push(verifiedKekState);\n  }\n\n  observeAccessManifestCheckpoints(checkpointContext, {\n    verifiedHeads: verifiedPath,\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n\n  checkpointContext.heldContainerHeads.push(...verifiedPath);\n  return verifiedPath;\n}\n\nexport async function verifyContainerWriterProjection(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<VerifiedContainerAccessManifest[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const verifiedByHash =\n      input.verifiedByHash ??\n      new Map<string, VerifiedContainerAccessManifest>();\n    const guardedInput = {\n      ...withGenerationGuardedPolicyWarmer(input),\n      verifiedByHash,\n    };\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      guardedInput,\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    observeVerifiedProjectionBundles(\n      checkpointContext,\n      collectContainerProjectionBundles(input.projection),\n      verifiedByHash,\n    );\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    return verifiedPath;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport async function collectContainerWriterProjectionPrincipalPolicies(\n  input: ContainerWriterProjectionVerificationInput,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n  try {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const warmReferencedPrincipalPolicies =\n      generationGuardedPrincipalPolicyWarmer(\n        input.warmReferencedPrincipalPolicies,\n        input.stillCurrent,\n      );\n    const principalPolicyCache: PrincipalPolicyCache =\n      input.principalPolicyCache ?? new Map();\n    const verifiedByHash =\n      input.verifiedByHash ??\n      new Map<string, VerifiedContainerAccessManifest>();\n    const checkpointContext = createProjectionCheckpointContext({\n      execSql: input.execSql,\n      organizationId: input.projection.organizationId,\n    });\n    const verifiedPath = await verifyContainerWriterProjectionWithContext(\n      {\n        principalPolicyCache,\n        projection: input.projection,\n        verifiedByHash,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      },\n      checkpointContext,\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n\n    const policies = await collectPrincipalPoliciesForContainerPaths({\n      checkpointContext,\n      organizationId: input.projection.organizationId,\n      paths: [verifiedPath],\n      principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    observeVerifiedProjectionBundles(\n      checkpointContext,\n      collectContainerProjectionBundles(input.projection),\n      verifiedByHash,\n    );\n    await finalizeProjectionCheckpoints(checkpointContext, input);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    return policies;\n  } catch (error) {\n    throwKeyingVerificationShapeFailure(error);\n  }\n}\n\nexport function addContainerWriterProjectionBundles(\n  bundlesByHash: Map<string, AccessManifestBundleWireResponse>,\n  projection: ContainerWriterProjectionResponse,\n  label: string,\n): void {\n  for (const [index, bundle] of projection.path.entries()) {\n    addBundleByHash(bundlesByHash, bundle, `${label} path[${index}]`);\n  }\n  for (const [kekIndex, kek] of projection.containerKeks.entries()) {\n    for (const [\n      historyIndex,\n      bundle,\n    ] of kek.containerManifestHistory.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `${label} KEK[${kekIndex}] history[${historyIndex}]`,\n      );\n    }\n  }\n}\n\nasync function collectPrincipalPoliciesForContainerPaths(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  paths: readonly (readonly VerifiedContainerAccessManifest[] | undefined)[];\n  principalPolicyCache: PrincipalPolicyCache;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const referencedPrincipalHeads = input.paths.flatMap((path) =>\n    (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads),\n  );\n\n  return collectReferencedPrincipalPolicies({\n    checkpointContext: input.checkpointContext,\n    organizationId: input.organizationId,\n    principalPolicyCache: input.principalPolicyCache,\n    references: referencedPrincipalHeads,\n    resolveUserKey: input.resolveUserKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/documentDependencyPaths.d.ts

@@ -1,17 +0,0 @@
-import { type VerifiedContainerAccessManifest } from "../../internal/crypto/index.js";
-/**
- * Rebuild historical authorization from the event's signed heads, not from
- * creation-time parent pins or the server's grouping of dependency paths.
- * Paths in the evidence index only supply verified manifests. Authorization
- * uses exactly the ancestor heads this event signed, regardless of grouping.
- * Prefix paths are evidence too; crypto authorization admits only leaves named
- * by the signed document link set or committed content target set.
- */
-export declare function resolveEventContainerPaths(input: {
-    readonly containerPathByManifestHash: ReadonlyMap<string, readonly VerifiedContainerAccessManifest[]>;
-    readonly dependencyManifestHashes: readonly string[];
-    readonly targetManifestHash?: string;
-}): {
-    dependencyContainerPaths: VerifiedContainerAccessManifest[][];
-    targetContainerPath: readonly VerifiedContainerAccessManifest[] | undefined;
-};

package/data/keyingProjectionVerification/documentDependencyPaths.js

@@ -1,70 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { MAX_CONTAINER_PATH_LENGTH } from "../../internal/validators/util/index.js";
-import { assertCitedAncestorsDoNotRegress } from "./containerAncestorCitations.js";
-/**
- * Rebuild historical authorization from the event's signed heads, not from
- * creation-time parent pins or the server's grouping of dependency paths.
- * Paths in the evidence index only supply verified manifests. Authorization
- * uses exactly the ancestor heads this event signed, regardless of grouping.
- * Prefix paths are evidence too; crypto authorization admits only leaves named
- * by the signed document link set or committed content target set.
- */
-export function resolveEventContainerPaths(input) {
-    const manifests = new Map();
-    for (const path of input.containerPathByManifestHash.values()) {
-        for (const manifest of path) {
-            manifests.set(manifest.manifestHash, manifest);
-        }
-    }
-    const cited = new Map();
-    for (const hash of input.dependencyManifestHashes) {
-        const manifest = manifests.get(hash);
-        if (!manifest) {
-            throw new KeyingVerificationError("missing_dependency", "Document event cites an unavailable container manifest");
-        }
-        if (cited.has(manifest.state.containerId)) {
-            throw new KeyingVerificationError("duplicate_entry", "Document event cites two heads of one container");
-        }
-        cited.set(manifest.state.containerId, manifest);
-    }
-    const dependencyContainerPaths = [...cited.values()].map((leaf) => {
-        const reversed = [];
-        const seen = new Set();
-        let containerId = leaf.state.containerId;
-        while (containerId !== null) {
-            if (seen.has(containerId) ||
-                reversed.length >= MAX_CONTAINER_PATH_LENGTH) {
-                throw new KeyingVerificationError("object_mismatch", "Document event cited container path is cyclic or too deep");
-            }
-            seen.add(containerId);
-            const ancestor = cited.get(containerId);
-            if (!ancestor) {
-                throw new KeyingVerificationError("missing_dependency", `Document event does not cite ancestor ${containerId}`);
-            }
-            if (ancestor.state.organizationId !== leaf.state.organizationId) {
-                throw new KeyingVerificationError("object_mismatch", "Document event cited container path crosses organizations");
-            }
-            reversed.push(ancestor);
-            containerId = ancestor.state.parentContainerId;
-        }
-        const path = reversed.reverse();
-        // The cited descendant is itself an earlier signed statement. Its own
-        // citations establish floors for every ancestor, even when the server
-        // supplied these verified manifests in separate projection paths.
-        assertCitedAncestorsDoNotRegress({
-            bundlesByHash: new Map(),
-            label: "Document event",
-            verifiedByHash: manifests,
-            citedAncestors: path.slice(0, -1),
-            previousManifest: leaf,
-        });
-        return path;
-    });
-    return {
-        dependencyContainerPaths,
-        targetContainerPath: input.targetManifestHash === undefined
-            ? undefined
-            : dependencyContainerPaths.find((path) => path.at(-1)?.manifestHash === input.targetManifestHash),
-    };
-}
-//# sourceMappingURL=documentDependencyPaths.js.map

package/data/keyingProjectionVerification/documentDependencyPaths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentDependencyPaths.js","sourceRoot":"","sources":["documentDependencyPaths.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAO1C;IAIC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,2BAA2B,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2C,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,wBAAwB,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChE,MAAM,QAAQ,GAAsC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,WAAW,GAAkB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACxD,OAAO,WAAW,KAAK,IAAI,EAAE,CAAC;YAC5B,IACE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;gBACrB,QAAQ,CAAC,MAAM,IAAI,yBAAyB,EAC5C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yCAAyC,WAAW,EAAE,CACvD,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,gCAAgC,CAAC;YAC/B,aAAa,EAAE,IAAI,GAAG,EAAE;YACxB,KAAK,EAAE,gBAAgB;YACvB,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO;QACL,wBAAwB;QACxB,mBAAmB,EACjB,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,KAAK,CAAC,kBAAkB,CACjE;KACR,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { MAX_CONTAINER_PATH_LENGTH } from \"@tearleads/validators/util\";\nimport { assertCitedAncestorsDoNotRegress } from \"./containerAncestorCitations\";\n\n/**\n * Rebuild historical authorization from the event's signed heads, not from\n * creation-time parent pins or the server's grouping of dependency paths.\n * Paths in the evidence index only supply verified manifests. Authorization\n * uses exactly the ancestor heads this event signed, regardless of grouping.\n * Prefix paths are evidence too; crypto authorization admits only leaves named\n * by the signed document link set or committed content target set.\n */\nexport function resolveEventContainerPaths(input: {\n  readonly containerPathByManifestHash: ReadonlyMap<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >;\n  readonly dependencyManifestHashes: readonly string[];\n  readonly targetManifestHash?: string;\n}): {\n  dependencyContainerPaths: VerifiedContainerAccessManifest[][];\n  targetContainerPath: readonly VerifiedContainerAccessManifest[] | undefined;\n} {\n  const manifests = new Map<string, VerifiedContainerAccessManifest>();\n  for (const path of input.containerPathByManifestHash.values()) {\n    for (const manifest of path) {\n      manifests.set(manifest.manifestHash, manifest);\n    }\n  }\n  const cited = new Map<string, VerifiedContainerAccessManifest>();\n  for (const hash of input.dependencyManifestHashes) {\n    const manifest = manifests.get(hash);\n    if (!manifest) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Document event cites an unavailable container manifest\",\n      );\n    }\n    if (cited.has(manifest.state.containerId)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        \"Document event cites two heads of one container\",\n      );\n    }\n    cited.set(manifest.state.containerId, manifest);\n  }\n  const dependencyContainerPaths = [...cited.values()].map((leaf) => {\n    const reversed: VerifiedContainerAccessManifest[] = [];\n    const seen = new Set<string>();\n    let containerId: string | null = leaf.state.containerId;\n    while (containerId !== null) {\n      if (\n        seen.has(containerId) ||\n        reversed.length >= MAX_CONTAINER_PATH_LENGTH\n      ) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Document event cited container path is cyclic or too deep\",\n        );\n      }\n      seen.add(containerId);\n      const ancestor = cited.get(containerId);\n      if (!ancestor) {\n        throw new KeyingVerificationError(\n          \"missing_dependency\",\n          `Document event does not cite ancestor ${containerId}`,\n        );\n      }\n      if (ancestor.state.organizationId !== leaf.state.organizationId) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Document event cited container path crosses organizations\",\n        );\n      }\n      reversed.push(ancestor);\n      containerId = ancestor.state.parentContainerId;\n    }\n    const path = reversed.reverse();\n    // The cited descendant is itself an earlier signed statement. Its own\n    // citations establish floors for every ancestor, even when the server\n    // supplied these verified manifests in separate projection paths.\n    assertCitedAncestorsDoNotRegress({\n      bundlesByHash: new Map(),\n      label: \"Document event\",\n      verifiedByHash: manifests,\n      citedAncestors: path.slice(0, -1),\n      previousManifest: leaf,\n    });\n    return path;\n  });\n  return {\n    dependencyContainerPaths,\n    targetContainerPath:\n      input.targetManifestHash === undefined\n        ? undefined\n        : dependencyContainerPaths.find(\n            (path) => path.at(-1)?.manifestHash === input.targetManifestHash,\n          ),\n  };\n}\n"]}

package/data/keyingProjectionVerification/documentManifestPolicies.js

@@ -1,32 +0,0 @@
-import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
-import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
-export async function collectDocumentManifestPrincipalPolicies(input) {
-    const authorizationEvidence = input.authorizationEvidence ?? [];
-    const references = input.paths
-        .flatMap((path) => (path ?? []).flatMap((manifest) => manifest.state.referencedPrincipalHeads))
-        .filter((reference) => !authorizationEvidence.some((policy) => principalPolicyMatchesReference({ policy, reference })));
-    if (input.requireAuthorizationEvidence && references.length > 0) {
-        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
-    }
-    if (input.requireAuthorizationEvidence)
-        return [...authorizationEvidence];
-    return [
-        ...authorizationEvidence,
-        ...(await collectReferencedPrincipalPolicies({
-            checkpointContext: input.checkpointContext,
-            organizationId: input.organizationId,
-            principalPolicyCache: input.principalPolicyCache,
-            references,
-            resolveUserKey: input.resolveUserKey,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        })),
-    ];
-}
-export function recordUsedDocumentContainerManifests(input) {
-    for (const path of input.paths) {
-        for (const manifest of path ?? []) {
-            input.used?.set(manifest.manifestHash, manifest);
-        }
-    }
-}
-//# sourceMappingURL=documentManifestPolicies.js.map

package/data/keyingProjectionVerification/documentManifestPolicies.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentManifestPolicies.js","sourceRoot":"","sources":["documentManifestPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAYnF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAgB9D;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;SAC3B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CACtD,CACF;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,IAAI,KAAK,CAAC,4BAA4B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B;QAAE,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,qBAAqB;QACxB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAMpD;IACC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\nexport type UsedDocumentContainerManifests = Map<\n  string,\n  VerifiedContainerAccessManifest\n>;\n\nexport async function collectDocumentManifestPrincipalPolicies(input: {\n  readonly authorizationEvidence?:\n    | readonly PrincipalPolicyAuthorization[]\n    | undefined;\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly requireAuthorizationEvidence?: boolean | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<PrincipalPolicyAuthorization[]> {\n  const authorizationEvidence = input.authorizationEvidence ?? [];\n  const references = input.paths\n    .flatMap((path) =>\n      (path ?? []).flatMap(\n        (manifest) => manifest.state.referencedPrincipalHeads,\n      ),\n    )\n    .filter(\n      (reference) =>\n        !authorizationEvidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  if (input.requireAuthorizationEvidence && references.length > 0) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  }\n  if (input.requireAuthorizationEvidence) return [...authorizationEvidence];\n  return [\n    ...authorizationEvidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport function recordUsedDocumentContainerManifests(input: {\n  readonly paths: readonly (\n    | readonly VerifiedContainerAccessManifest[]\n    | undefined\n  )[];\n  readonly used?: UsedDocumentContainerManifests | undefined;\n}): void {\n  for (const path of input.paths) {\n    for (const manifest of path ?? []) {\n      input.used?.set(manifest.manifestHash, manifest);\n    }\n  }\n}\n"]}

package/data/keyingProjectionVerification/documentManifestPredecessor.js

@@ -1,12 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-export function requireVerifiedDocumentPredecessor(input) {
-    if (input.previousManifestHash === null)
-        return null;
-    const previousManifest = input.verifiedByHash.get(input.previousManifestHash) ??
-        input.trustedPredecessorByHash?.get(input.previousManifestHash);
-    if (!previousManifest) {
-        throw new KeyingVerificationError("missing_dependency", `${input.label} previous manifest ${input.previousManifestHash} is missing`);
-    }
-    return previousManifest;
-}
-//# sourceMappingURL=documentManifestPredecessor.js.map

package/data/keyingProjectionVerification/documentManifestVerification.js

@@ -1,135 +0,0 @@
-import { KeyingVerificationError, verifyDocumentLinkSetManifest, } from "../../internal/crypto/index.js";
-import { readCanonicalJson } from "../keying/canonicalJson.js";
-import { addBundleByHash, assertCanonicalEqual, verifyAccessEventBundle, } from "./bundleVerification.js";
-import { resolveEventContainerPaths } from "./documentDependencyPaths.js";
-import { collectDocumentManifestPrincipalPolicies, recordUsedDocumentContainerManifests, } from "./documentManifestPolicies.js";
-import { requireVerifiedDocumentPredecessor } from "./documentManifestPredecessor.js";
-import { loadManifestCheckpointVerification, verifyCachedManifestCheckpoint, } from "./manifestCheckpointVerification.js";
-import { readAccessManifest, readDocumentAccessEventBody } from "./readers.js";
-export async function verifyDocumentManifestBundle(input) {
-    const cached = input.verifiedByHash.get(input.bundle.manifestHash);
-    if (cached) {
-        if (input.enforceLocalCheckpoint) {
-            await verifyCachedManifestCheckpoint({
-                current: cached,
-                execSql: input.checkpointContext.execSql,
-                localCheckpoints: input.checkpointContext.localCheckpoints,
-                verifiedManifests: input.verifiedByHash,
-            });
-        }
-        return cached;
-    }
-    const event = await verifyAccessEventBundle(input);
-    const manifest = readAccessManifest(input.bundle.manifest, `${input.label} manifest`);
-    const previousManifest = requireVerifiedDocumentPredecessor({
-        label: input.label,
-        previousManifestHash: event.event.previousManifestHash,
-        trustedPredecessorByHash: input.trustedPredecessorByHash,
-        verifiedByHash: input.verifiedByHash,
-    });
-    const body = readDocumentAccessEventBody(event.body, `${input.label} event body`);
-    const { dependencyContainerPaths, targetContainerPath } = resolveEventContainerPaths({
-        containerPathByManifestHash: input.containerPathByManifestHash,
-        dependencyManifestHashes: event.event.dependencyManifestHashes,
-        targetManifestHash: body.containerManifestHash,
-    });
-    const principalPolicies = await collectDocumentManifestPrincipalPolicies({
-        authorizationEvidence: input.authorizationEvidence,
-        checkpointContext: input.checkpointContext,
-        organizationId: event.event.organizationId,
-        paths: [...dependencyContainerPaths, targetContainerPath],
-        principalPolicyCache: input.principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
-        requireAuthorizationEvidence: input.requireAuthorizationEvidence,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const checkpointVerification = input.enforceLocalCheckpoint
-        ? await loadManifestCheckpointVerification({
-            current: manifest,
-            execSql: input.checkpointContext.execSql,
-            localCheckpoints: input.checkpointContext.localCheckpoints,
-            verifiedManifests: input.verifiedByHash,
-        })
-        : null;
-    const verified = await verifyDocumentLinkSetManifest({
-        // Served heads and history were committed under the group membership their
-        // cited container heads referenced; a signer removed since must still
-        // verify on a cold device. The API verifier gates new writes at current.
-        authorizationMembership: input.authorizationMembership ?? "referenced",
-        authorizingContainerPaths: dependencyContainerPaths,
-        event,
-        expectedManifestHash: input.bundle.manifestHash,
-        manifest,
-        previousManifest,
-        principalPolicies,
-        ...(checkpointVerification ?? {}),
-        ...(targetContainerPath ? { targetContainerPath } : {}),
-    });
-    if (!verified.ok) {
-        throw new KeyingVerificationError(verified.error.code, `${input.label} manifest verification failed: ${verified.error.message}`);
-    }
-    recordUsedDocumentContainerManifests({
-        paths: [...dependencyContainerPaths, targetContainerPath],
-        used: input.usedContainerManifests,
-    });
-    assertCanonicalEqual({
-        actual: input.bundle.state,
-        expected: readCanonicalJson(verified.value.state, `${input.label} state`),
-        label: `${input.label} state`,
-    });
-    input.verifiedByHash.set(input.bundle.manifestHash, verified.value);
-    return verified.value;
-}
-export async function verifyDocumentProjectionManifests(input) {
-    const bundlesByHash = new Map();
-    addBundleByHash(bundlesByHash, input.projection.documentManifest, "Document writer projection manifest");
-    const history = input.projection.documentManifestHistory;
-    for (const [index, bundle] of history.entries()) {
-        addBundleByHash(bundlesByHash, bundle, `Document writer projection manifest history[${index}]`);
-    }
-    // An honest API never lists the head in its own history (it seeds the walk
-    // with the head), so a repeat is a malformed or tampered projection and is
-    // refused as such, rather than letting the head reach its verification
-    // through the history cache and relying on the cached branch to re-run
-    // every check the fresh path would.
-    if (history.some((bundle) => bundle.manifestHash === input.projection.documentManifest.manifestHash)) {
-        throw new KeyingVerificationError("duplicate_entry", "Document writer projection history repeats the current head");
-    }
-    const verifiedByHash = new Map();
-    for (let index = history.length - 1; index >= 0; index -= 1) {
-        const bundle = history[index];
-        if (!bundle) {
-            throw new KeyingVerificationError("missing_dependency", `Document writer projection manifest history[${index}] is missing`);
-        }
-        await verifyDocumentManifestBundle({
-            authorizationEvidence: input.authorizationEvidence,
-            requireAuthorizationEvidence: true,
-            bundle,
-            bundlesByHash,
-            checkpointContext: input.checkpointContext,
-            containerPathByManifestHash: input.containerPathByManifestHash,
-            enforceLocalCheckpoint: false,
-            label: `Document writer projection manifest history[${index}]`,
-            principalPolicyCache: input.principalPolicyCache,
-            resolveUserKey: input.resolveUserKey,
-            verifiedByHash,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        });
-    }
-    const headManifest = await verifyDocumentManifestBundle({
-        authorizationEvidence: input.authorizationEvidence,
-        requireAuthorizationEvidence: true,
-        bundle: input.projection.documentManifest,
-        bundlesByHash,
-        checkpointContext: input.checkpointContext,
-        containerPathByManifestHash: input.containerPathByManifestHash,
-        enforceLocalCheckpoint: true,
-        label: "Document writer projection",
-        principalPolicyCache: input.principalPolicyCache,
-        resolveUserKey: input.resolveUserKey,
-        verifiedByHash,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    return { headManifest, verifiedByHash };
-}
-//# sourceMappingURL=documentManifestVerification.js.map