@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.0

package/packages/public-runtime/src/gtm-migration/types.ts

@@ -0,0 +1,86 @@
+/**
+ * Inert typed model of a GTM (Google Tag Manager) container export, format v2.
+ *
+ * Every value here is DATA. Fields that in a live GTM runtime would be code — a
+ * Custom HTML tag's `html`, a Custom Template's `templateData` /
+ * `sandboxedJsForServer`, a Custom JavaScript variable's `javascript` — are
+ * captured as opaque inert strings inside each record's `raw` bag and are NEVER
+ * executed, evaluated, or interpreted by this package.
+ */
+
+import type { GtmViolation } from "./bounds.js";
+
+/**
+ * One inert record from a GTM collection (a tag, trigger, variable, …).
+ *
+ * `id`, `name`, and `type` are convenience fields lifted from whatever key GTM
+ * used (e.g. `tagId`/`triggerId`/`variableId`). `raw` is the COMPLETE inert bag
+ * of the record's fields (a null-prototype object, strings bounded/truncated),
+ * so nothing is silently dropped and downstream units can read any field they
+ * need without this package having to model it.
+ */
+export interface GtmInertRecord {
+  readonly id: string | null;
+  readonly name: string | null;
+  readonly type: string | null;
+  /** Null-prototype bag of the record's full field set, captured as inert data. */
+  readonly raw: Record<string, unknown>;
+}
+
+/**
+ * The `containerVersion` object: container metadata plus the known collections.
+ * Every collection is present as an array (empty when the export omitted it).
+ */
+export interface GtmContainerVersion {
+  // Container metadata (lifted from `containerVersion` or its nested `container`).
+  readonly containerId: string | null;
+  readonly path: string | null;
+  readonly publicId: string | null;
+  readonly fingerprint: string | null;
+  readonly name: string | null;
+
+  // Known collections, each a list of inert records.
+  readonly tag: GtmInertRecord[];
+  readonly trigger: GtmInertRecord[];
+  readonly variable: GtmInertRecord[];
+  readonly builtInVariable: GtmInertRecord[];
+  readonly customTemplate: GtmInertRecord[];
+  readonly folder: GtmInertRecord[];
+  readonly zone: GtmInertRecord[];
+  readonly client: GtmInertRecord[];
+  readonly gtagConfig: GtmInertRecord[];
+  readonly transformation: GtmInertRecord[];
+}
+
+/** The top-level v2 export: `{ exportFormatVersion, containerVersion }`. */
+export interface GtmContainer {
+  readonly exportFormatVersion: number;
+  readonly containerVersion: GtmContainerVersion;
+}
+
+/**
+ * Complete object accounting so nothing in the input is silently dropped — a
+ * reviewer and downstream units check that every input object is accounted for.
+ */
+export interface GtmParseAccounting {
+  /** Per modeled collection name → number of records extracted. */
+  readonly counts: Record<string, number>;
+  /** Top-level keys other than `exportFormatVersion` / `containerVersion`. */
+  readonly unknownTopLevelKeys: string[];
+  /** `containerVersion` keys that are neither modeled metadata nor a known collection. */
+  readonly unknownContainerKeys: string[];
+  /** Number of strings truncated to `maxStringLen` during capture. */
+  readonly truncatedStrings: number;
+  /** Number of `__proto__` / `constructor` / `prototype` keys skipped (quarantined). */
+  readonly quarantinedKeys: number;
+  /** Total nodes visited by the bounds walk. */
+  readonly totalNodes: number;
+}
+
+/**
+ * Structured result — the parser NEVER throws on bad input. On success it returns
+ * the inert container plus accounting; on failure a list of violations.
+ */
+export type GtmParseResult =
+  | { ok: true; container: GtmContainer; accounting: GtmParseAccounting }
+  | { ok: false; violations: GtmViolation[] };

package/packages/public-runtime/src/index.ts

@@ -19,6 +19,8 @@ export * from "./checkout.js";
 export * from "./membership.js";
 export * from "./checkout-orders.js";
 export * from "./capabilities.js";
+export * from "./compliance-obligations.js";
+export * from "./evidence.js";
 export * from "./checkout-style.js";
 export * from "./checkout-style-publish.js";
 export * from "./catalog-api.js";
@@ -30,8 +32,10 @@ export * from "./customization-runtime.js";
 export * from "./customization-versioning.js";
 export * from "./customization-scripts.js";
 export * from "./customization-reconcile.js";
+export * from "./chrome.js";
 export * from "./candidate-index.js";
 export * from "./extension-contract.js";
+export * from "./integration-capabilities.js";
 export * from "./raw-html-policy.js";
 export * from "./review-trust-proof.js";
 export * from "./compliance/index.js";
@@ -42,8 +46,19 @@ export * from "./hot-standby-readiness.js";
 export * from "./hash.js";
 export * from "./widget-postmessage.js";
 
-// Operational activity telemetry contract (card D0): the actor×action
+// Versioned public browser-integration contracts (environment, declaration,
+// effective plan, phases, dependencies, lifecycle, config, assurance).
+// See ./integration/index.ts.
+export * from "./integration/index.js";
+
+// Operational activity telemetry contract: the actor×action
 // ActivityEvent envelope, the allowlisted action catalog, and the default-deny
 // redaction contract. Pure types + pure functions; the store decision + cost
 // model live in the repo-root DECISIONS.md §8. See ./activity/README.md.
 export * from "./activity/index.js";
+
+// GTM container-export migration: the SAFE, non-executing parser that turns an
+// untrusted GTM export into an inert typed model + complete accounting. Pure
+// data-in/data-out; never executes any part of the export. See
+// ./gtm-migration/parse.ts for the full security contract.
+export * from "./gtm-migration/index.js";

package/packages/public-runtime/src/integration/assurance-decision.ts

@@ -0,0 +1,259 @@
+/**
+ * Assurance enforcement — the decision layer over a validated
+ * {@link ComplianceAssuranceRecord} (ADR 0014 G1/G2, ADR 0023 Q2 legal gate).
+ *
+ * A record is the tenant-scoped audit of an elevated integration's declared
+ * effects. `validateComplianceAssuranceRecord` proves its shape and that it
+ * carries no secret; this module decides whether the audited state is actually
+ * approvable and whether a prior approval still holds. The two are separate
+ * concerns: a well-formed record can still be denied because the regulated
+ * floor is non-waivable, the vendor tried to approve its own code, the
+ * acknowledgement expired, the outside-guarantee wording is not yet wired, or
+ * the served integration no longer matches what was acknowledged.
+ *
+ * Invariants:
+ *   - G1: the regulated shared-runtime floor is non-waivable. No acknowledgement
+ *     path — no `eligibleForOutsideGuarantee` on a regulated surface — reduces it.
+ *   - Outside-guarantee is a full-parent (`elevated-parent`) posture accepted
+ *     ONLY on the eligible unregulated-marketing surface, and only once the Q2
+ *     counsel wording is wired (`outsideGuaranteeEnabled`, default off).
+ *   - G2: a regulated elevated-parent integration needs a green certification
+ *     (`certifiedImmutable`, default off), never a mere acknowledgement.
+ *   - The vendor cannot self-approve: the approver is a tenant owner or platform
+ *     operator whose identity is not the integration's own.
+ *   - A material change to the integration's code, version, scopes, CSP, or
+ *     consent invalidates the prior approval; re-acknowledgement is required.
+ */
+import {
+  type ComplianceAssuranceRecord,
+  type AssuranceActorRole,
+  ASSURANCE_ACTOR_ROLES,
+  validateComplianceAssuranceRecord,
+} from "./assurance.js";
+import type { ExecutionTier } from "./phases.js";
+
+/**
+ * The roles authorized to acknowledge an elevated integration (charter
+ * responsibility matrix: the vendor "Cannot self-approve"). The vendor role is
+ * structurally absent from the record's actor enum; this constant is the
+ * decision-layer restatement so the authorization test reads against one name.
+ */
+export const AUTHORIZED_APPROVER_ROLES: readonly AssuranceActorRole[] = ASSURANCE_ACTOR_ROLES;
+
+/**
+ * The bound, material state an acknowledgement covers. A change to any field
+ * invalidates a prior approval. It is the integration reference plus the
+ * declared effects (scopes, consent purposes, CSP origins, data classes) — the
+ * exact things the operator reviewed.
+ */
+export interface ApprovedIntegrationState {
+  appId: string;
+  version: string;
+  digest: string;
+  executionTier: ExecutionTier;
+  capabilities: readonly string[];
+  consentPurposes: readonly string[];
+  cspOrigins: readonly string[];
+  dataClasses: readonly string[];
+}
+
+/** The material state an assurance record acknowledges. */
+export function assuredStateOfRecord(record: ComplianceAssuranceRecord): ApprovedIntegrationState {
+  return {
+    appId: record.integration.appId,
+    version: record.integration.version,
+    digest: record.integration.digest,
+    executionTier: record.integration.executionTier,
+    capabilities: record.declaredEffects.capabilities,
+    consentPurposes: record.declaredEffects.consentPurposes,
+    cspOrigins: record.declaredEffects.cspOrigins,
+    dataClasses: record.declaredEffects.dataClasses,
+  };
+}
+
+/**
+ * A stable, order-independent fingerprint of the material integration state.
+ * Two states with the same code/version/tier/scopes/CSP/consent fingerprint
+ * identically regardless of array ordering; any difference changes the digest.
+ */
+export function assuranceFingerprint(state: ApprovedIntegrationState): string {
+  const canonical = {
+    appId: state.appId,
+    version: state.version,
+    digest: state.digest,
+    executionTier: state.executionTier,
+    capabilities: [...state.capabilities].sort(),
+    consentPurposes: [...state.consentPurposes].sort(),
+    cspOrigins: [...state.cspOrigins].sort(),
+    dataClasses: [...state.dataClasses].sort(),
+  };
+  return JSON.stringify(canonical);
+}
+
+/**
+ * True when the currently-resolved integration state differs materially from
+ * what the record acknowledged — a new digest, version, tier, capability,
+ * consent purpose, CSP origin, or data class. Such a change invalidates the
+ * prior approval and requires re-acknowledgement.
+ */
+export function hasMaterialChange(
+  record: ComplianceAssuranceRecord,
+  current: ApprovedIntegrationState,
+): boolean {
+  return assuranceFingerprint(assuredStateOfRecord(record)) !== assuranceFingerprint(current);
+}
+
+export interface AssuranceDecisionContext {
+  /** Wall clock for expiry evaluation (ISO 8601). */
+  now: string;
+  /**
+   * Q2: the outside-guarantee acknowledgement wording is wired with the counsel
+   * language and eligibility. Defaults off — the tier stays gated until it is.
+   */
+  outsideGuaranteeEnabled?: boolean;
+  /**
+   * G2: a green capability-specific certification exists for this pinned,
+   * immutable regulated integration. Defaults off — regulated elevated-parent
+   * stays disabled until it is present.
+   */
+  certifiedImmutable?: boolean;
+  /**
+   * The integration's own publisher/vendor identity, when known server-side.
+   * An acknowledgement by this identity is a self-approval and is rejected even
+   * if it carries an operator role.
+   */
+  vendorActorId?: string;
+  /**
+   * The currently-resolved material integration state. When supplied, a
+   * material difference from the acknowledged state invalidates the approval.
+   */
+  current?: ApprovedIntegrationState;
+}
+
+export type AssuranceDenialReason =
+  | "invalid-record"
+  | "regulated-floor-waiver-attempt"
+  | "outside-guarantee-surface-ineligible"
+  | "outside-guarantee-not-eligible"
+  | "outside-guarantee-counsel-pending"
+  | "regulated-cert-missing"
+  | "elevated-parent-prohibited"
+  | "unauthorized-approver"
+  | "vendor-self-approval"
+  | "approval-expired"
+  | "material-change";
+
+export interface AssuranceDenial {
+  reason: AssuranceDenialReason;
+  /** The offending value (surface, actor id, tier, or a timestamp), when one applies. */
+  subject?: string;
+}
+
+export type AssuranceDecision =
+  | { ok: true; record: ComplianceAssuranceRecord; outsideGuarantee: boolean }
+  | { ok: false; denials: AssuranceDenial[] };
+
+/**
+ * Whether a record's surface/tier combination is the outside-guarantee posture:
+ * full parent authority moved onto the one eligible unregulated-marketing
+ * surface. It is never regulated (that would waive the floor) and never
+ * commerce (parent code is prohibited there).
+ */
+function isOutsideGuaranteePosture(record: ComplianceAssuranceRecord): boolean {
+  return (
+    record.integration.executionTier === "elevated-parent" &&
+    record.surface === "unregulated-marketing"
+  );
+}
+
+/**
+ * Decide whether an assurance record approves the audited integration. Validates
+ * the record shape first (a malformed or secret-bearing payload is `invalid-record`),
+ * then applies the floor, eligibility, authorization, expiry, and material-change
+ * rules. Fail-closed: every failed rule is reported and `ok` is false unless the
+ * record clears all of them.
+ */
+export function decideAssurance(
+  input: unknown,
+  context: AssuranceDecisionContext,
+): AssuranceDecision {
+  const validation = validateComplianceAssuranceRecord(input);
+  if (!validation.ok) {
+    return { ok: false, denials: [{ reason: "invalid-record" }] };
+  }
+  const record = validation.value;
+  const denials: AssuranceDenial[] = [];
+
+  const { surface, compliance, integration, acknowledgement } = record;
+  const elevated = integration.executionTier === "elevated-parent";
+
+  // G1 — the regulated shared-runtime floor is non-waivable. An
+  // outside-guarantee eligibility claim on a regulated surface is an attempt to
+  // move regulated execution outside the guarantee; it is rejected, never honored.
+  if (surface === "regulated" && compliance.eligibleForOutsideGuarantee) {
+    denials.push({ reason: "regulated-floor-waiver-attempt", subject: surface });
+  }
+
+  // Outside-guarantee is claimable only in its one posture. On any other
+  // surface/tier combination the eligibility flag is an ineligible claim.
+  if (
+    compliance.eligibleForOutsideGuarantee &&
+    surface !== "regulated" &&
+    !isOutsideGuaranteePosture(record)
+  ) {
+    denials.push({ reason: "outside-guarantee-surface-ineligible", subject: surface });
+  }
+
+  // Elevated-parent (full parent authority) gating, by surface.
+  if (elevated) {
+    switch (surface) {
+      case "unregulated-marketing":
+        if (!compliance.eligibleForOutsideGuarantee) {
+          denials.push({ reason: "outside-guarantee-not-eligible", subject: surface });
+        }
+        // Q2: the tier stays gated off until the counsel wording is wired.
+        if (!context.outsideGuaranteeEnabled) {
+          denials.push({ reason: "outside-guarantee-counsel-pending", subject: surface });
+        }
+        break;
+      case "regulated":
+        // G2: proof, never acknowledgement. The floor is not waived here.
+        if (!context.certifiedImmutable) {
+          denials.push({ reason: "regulated-cert-missing", subject: surface });
+        }
+        break;
+      case "commerce":
+        denials.push({ reason: "elevated-parent-prohibited", subject: surface });
+        break;
+    }
+  }
+
+  // The vendor cannot self-approve. The approver holds an operator role and is
+  // not the integration's own publisher identity.
+  if (!AUTHORIZED_APPROVER_ROLES.includes(acknowledgement.actorRole)) {
+    denials.push({ reason: "unauthorized-approver", subject: acknowledgement.actorRole });
+  }
+  if (
+    acknowledgement.actorId === integration.appId ||
+    (context.vendorActorId !== undefined && acknowledgement.actorId === context.vendorActorId)
+  ) {
+    denials.push({ reason: "vendor-self-approval", subject: acknowledgement.actorId });
+  }
+
+  // Expiry / re-review. A window that has passed — or one that never opened
+  // (expiry at or before the acknowledgement) — is expired.
+  const recordedAt = Date.parse(acknowledgement.recordedAt);
+  const expiresAt = Date.parse(acknowledgement.expiresAt);
+  const now = Date.parse(context.now);
+  if (Number.isNaN(now) || expiresAt <= recordedAt || now >= expiresAt) {
+    denials.push({ reason: "approval-expired", subject: acknowledgement.expiresAt });
+  }
+
+  // A material change to the served integration invalidates the approval.
+  if (context.current && hasMaterialChange(record, context.current)) {
+    denials.push({ reason: "material-change", subject: integration.digest });
+  }
+
+  if (denials.length > 0) return { ok: false, denials };
+  return { ok: true, record, outsideGuarantee: isOutsideGuaranteePosture(record) };
+}

package/packages/public-runtime/src/integration/assurance.ts

@@ -0,0 +1,228 @@
+/**
+ * Compliance assurance metadata (ADR 0014 G1 `integration-regulated-floor-
+ * nonwaivable`, G2, and ADR 0023 legal release gates).
+ *
+ * An assurance record is the tenant-scoped audit of an elevated integration's
+ * declared effects, the operator acknowledgement, and the known-good rollback
+ * target. It carries no secret and no authorization token. The regulated
+ * shared-runtime floor is non-waivable: `regulatedSharedRuntimeWaiver` must be
+ * `false` — a `true` is rejected, never honored.
+ */
+import type { ContractResult } from "./result.js";
+import {
+  Violations,
+  reqObject,
+  childObject,
+  reqEnum,
+  reqLiteral,
+  reqString,
+  reqBool,
+  reqStringArray,
+  reqIsoTimestamp,
+  rejectUnknownKeys,
+} from "./result.js";
+import { ASSURANCE_RECORD_SCHEMA_VERSION } from "./version.js";
+import { INTEGRATION_ENVIRONMENTS } from "./environment.js";
+import type { IntegrationEnvironment } from "./environment.js";
+import {
+  EXECUTION_TIERS,
+  type ExecutionTier,
+} from "./phases.js";
+import {
+  ASSURANCE_CLASSIFICATIONS,
+  type AssuranceClassification,
+} from "./manifest.js";
+import { validateOriginList } from "./csp.js";
+import { findForbiddenFields } from "./secrets.js";
+import type { Surface } from "../integration-capabilities.js";
+
+/**
+ * The compliance-authority axis: the canonical {@link Surface} taxonomy projected
+ * so `checkout-payment` shares `commerce` authority (it is a strictly-more-protected
+ * sub-surface of commerce, but carries the same tenant authority tier). The
+ * `satisfies` binding is a compile-time proof that every authority surface is a
+ * canonical surface — the two vocabularies cannot drift. Use `surfaceAuthority`
+ * to project a surface onto this axis.
+ */
+export const ASSURANCE_SURFACES = [
+  "unregulated-marketing",
+  "commerce",
+  "regulated",
+] as const satisfies readonly Surface[];
+export type AssuranceSurface = (typeof ASSURANCE_SURFACES)[number];
+
+// Compile-time proof the authority axis is exactly the canonical surfaces minus
+// the `checkout-payment` sub-surface — no authority distinction is lost or invented.
+type _AssuranceSurfaceIsSurfaceMinusCheckout = Surface extends AssuranceSurface | "checkout-payment"
+  ? AssuranceSurface extends Exclude<Surface, "checkout-payment">
+    ? true
+    : never
+  : never;
+const _assuranceSurfaceExhaustive: _AssuranceSurfaceIsSurfaceMinusCheckout = true;
+void _assuranceSurfaceExhaustive;
+
+/**
+ * Project a surface onto its compliance-authority tier. `checkout-payment` folds
+ * into `commerce` (same authority, stricter capability floor enforced by the
+ * surface × tenant-tier matrix); every other surface is its own authority tier.
+ */
+export function surfaceAuthority(surface: Surface): AssuranceSurface {
+  return surface === "checkout-payment" ? "commerce" : surface;
+}
+
+export const ASSURANCE_ACTOR_ROLES = ["tenant-owner", "platform-operator"] as const;
+export type AssuranceActorRole = (typeof ASSURANCE_ACTOR_ROLES)[number];
+
+export interface AssuranceDeclaredEffects {
+  capabilities: string[];
+  consentPurposes: string[];
+  cspOrigins: string[];
+  dataClasses: string[];
+}
+
+export interface AssuranceCompliance {
+  /** The regulated floor is non-waivable; this is always false. */
+  regulatedSharedRuntimeWaiver: false;
+  configuredObligations: string[];
+  eligibleForOutsideGuarantee: boolean;
+  protectedSurfaceEvidence: string;
+}
+
+export interface AssuranceAcknowledgement {
+  actorId: string;
+  actorRole: AssuranceActorRole;
+  reason: string;
+  recordedAt: string;
+  expiresAt: string;
+}
+
+export interface AssuranceIntegrationRef {
+  appId: string;
+  version: string;
+  digest: string;
+  executionTier: ExecutionTier;
+}
+
+export interface AssuranceRollback {
+  knownGoodVersion: string;
+  knownGoodRevision: string;
+}
+
+export interface ComplianceAssuranceRecord {
+  schemaVersion: typeof ASSURANCE_RECORD_SCHEMA_VERSION;
+  recordId: string;
+  tenantPublicId: string;
+  environment: IntegrationEnvironment;
+  surface: AssuranceSurface;
+  classification: AssuranceClassification;
+  integration: AssuranceIntegrationRef;
+  declaredEffects: AssuranceDeclaredEffects;
+  compliance: AssuranceCompliance;
+  acknowledgement: AssuranceAcknowledgement;
+  rollback: AssuranceRollback;
+}
+
+export function validateComplianceAssuranceRecord(
+  input: unknown,
+): ContractResult<ComplianceAssuranceRecord> {
+  const v = new Violations();
+  const obj = reqObject(input, v, "");
+  if (!obj) return { ok: false, violations: v.items };
+
+  rejectUnknownKeys(
+    obj,
+    [
+      "schemaVersion",
+      "recordId",
+      "tenantPublicId",
+      "environment",
+      "surface",
+      "classification",
+      "integration",
+      "declaredEffects",
+      "compliance",
+      "acknowledgement",
+      "rollback",
+    ],
+    v,
+    "",
+  );
+
+  reqLiteral(obj, "schemaVersion", ASSURANCE_RECORD_SCHEMA_VERSION, v, "");
+  reqString(obj, "recordId", v, "");
+  reqString(obj, "tenantPublicId", v, "");
+  reqEnum(obj, "environment", INTEGRATION_ENVIRONMENTS, v, "");
+  reqEnum(obj, "surface", ASSURANCE_SURFACES, v, "");
+  reqEnum(obj, "classification", ASSURANCE_CLASSIFICATIONS, v, "");
+
+  const integration = childObject(obj, "integration", v, "");
+  if (integration) {
+    rejectUnknownKeys(integration, ["appId", "version", "digest", "executionTier"], v, "integration");
+    reqString(integration, "appId", v, "integration");
+    reqString(integration, "version", v, "integration");
+    reqString(integration, "digest", v, "integration");
+    reqEnum(integration, "executionTier", EXECUTION_TIERS, v, "integration");
+  }
+
+  const declaredEffects = childObject(obj, "declaredEffects", v, "");
+  if (declaredEffects) {
+    rejectUnknownKeys(
+      declaredEffects,
+      ["capabilities", "consentPurposes", "cspOrigins", "dataClasses"],
+      v,
+      "declaredEffects",
+    );
+    reqStringArray(declaredEffects, "capabilities", v, "declaredEffects");
+    reqStringArray(declaredEffects, "consentPurposes", v, "declaredEffects");
+    const origins = reqStringArray(declaredEffects, "cspOrigins", v, "declaredEffects");
+    if (origins) validateOriginList(origins, v, "declaredEffects.cspOrigins");
+    reqStringArray(declaredEffects, "dataClasses", v, "declaredEffects");
+  }
+
+  const compliance = childObject(obj, "compliance", v, "");
+  if (compliance) {
+    rejectUnknownKeys(
+      compliance,
+      [
+        "regulatedSharedRuntimeWaiver",
+        "configuredObligations",
+        "eligibleForOutsideGuarantee",
+        "protectedSurfaceEvidence",
+      ],
+      v,
+      "compliance",
+    );
+    // The regulated floor is non-waivable: a waiver of true is rejected.
+    reqLiteral(compliance, "regulatedSharedRuntimeWaiver", false, v, "compliance");
+    reqStringArray(compliance, "configuredObligations", v, "compliance");
+    reqBool(compliance, "eligibleForOutsideGuarantee", v, "compliance");
+    reqString(compliance, "protectedSurfaceEvidence", v, "compliance");
+  }
+
+  const acknowledgement = childObject(obj, "acknowledgement", v, "");
+  if (acknowledgement) {
+    rejectUnknownKeys(
+      acknowledgement,
+      ["actorId", "actorRole", "reason", "recordedAt", "expiresAt"],
+      v,
+      "acknowledgement",
+    );
+    reqString(acknowledgement, "actorId", v, "acknowledgement");
+    reqEnum(acknowledgement, "actorRole", ASSURANCE_ACTOR_ROLES, v, "acknowledgement");
+    reqString(acknowledgement, "reason", v, "acknowledgement");
+    reqIsoTimestamp(acknowledgement, "recordedAt", v, "acknowledgement");
+    reqIsoTimestamp(acknowledgement, "expiresAt", v, "acknowledgement");
+  }
+
+  const rollback = childObject(obj, "rollback", v, "");
+  if (rollback) {
+    rejectUnknownKeys(rollback, ["knownGoodVersion", "knownGoodRevision"], v, "rollback");
+    reqString(rollback, "knownGoodVersion", v, "rollback");
+    reqString(rollback, "knownGoodRevision", v, "rollback");
+  }
+
+  for (const violation of findForbiddenFields(obj)) v.items.push(violation);
+
+  if (!v.ok) return { ok: false, violations: v.items };
+  return { ok: true, value: input as ComplianceAssuranceRecord };
+}