@zhin.js/workroom 0.0.0 → 0.0.2

package/lib/data-governance/encrypted-database-payload-vault.js

@@ -0,0 +1,236 @@
+import { canonicalWorkroomJson, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue as digest, } from './canonical-value.js';
+import { PayloadVaultIntegrityError, openEncryptedPayloadVaultEnvelope, readEncryptedPayloadVaultAudit, resolveEncryptedPayloadVaultLifecycleObject, sealEncryptedPayloadVaultEnvelope, } from './encrypted-file-payload-vault.js';
+/** Root-private Database adapter. Only governed materializers receive its narrow ports. */
+export class EncryptedDatabasePayloadVault {
+    #database;
+    #objectModel;
+    #auditModel;
+    #generation;
+    #cryptography;
+    #storage = {
+        locationIdPrefix: 'vault-database',
+        authorityDigest: '',
+    };
+    constructor(options) {
+        this.#database = options.database;
+        this.#objectModel = options.objectModel;
+        this.#auditModel = options.auditModel;
+        this.#generation = positiveInteger(options.generation, 'generation');
+        this.#cryptography = options.cryptography;
+        const repositoryIdentity = required(options.repositoryIdentity, 'repositoryIdentity');
+        this.#storage = deepFreeze({
+            locationIdPrefix: 'vault-database',
+            authorityDigest: digest({
+                version: 1,
+                adapter: 'encrypted-database-payload-vault',
+                repositoryIdentityDigest: digest({ repositoryIdentity }),
+            }),
+        });
+    }
+    putSource(input, signal) {
+        return this.#put(input, signal);
+    }
+    putDerived(input, signal) {
+        return this.#put(input, signal);
+    }
+    async readExact(input, signal) {
+        signal.throwIfAborted();
+        const envelope = await this.#readEnvelope(input.handle);
+        const plaintext = await openEncryptedPayloadVaultEnvelope({
+            generation: this.#generation,
+            cryptography: this.#cryptography,
+            envelope,
+            input,
+            signal,
+        });
+        await this.#appendAudit(readEncryptedPayloadVaultAudit(this.#generation, input), signal);
+        return plaintext;
+    }
+    async resolveLifecycleObject(handle, signal) {
+        signal.throwIfAborted();
+        const rows = await this.#objectModel.select().where({ vault_object_id: handle.vaultObjectId });
+        if (rows.length === 0)
+            return undefined;
+        return resolveEncryptedPayloadVaultLifecycleObject(parseObjectRow(rows, handle), handle);
+    }
+    async #put(input, signal) {
+        signal.throwIfAborted();
+        const sealed = await sealEncryptedPayloadVaultEnvelope({
+            generation: this.#generation,
+            cryptography: this.#cryptography,
+            storage: this.#storage,
+            input,
+            signal,
+        });
+        try {
+            return await this.#database.transaction(async (transaction) => {
+                signal.throwIfAborted();
+                const rows = await transaction.select('payload_vault_objects').where({
+                    vault_object_id: sealed.handle.vaultObjectId,
+                });
+                if (rows.length > 0) {
+                    const winner = parseObjectRow(rows, sealed.handle);
+                    await insertAudit(transaction, sealed.audit);
+                    return winner.handle;
+                }
+                await transaction.insertMany('payload_vault_objects', [objectRow(sealed)]);
+                await insertAudit(transaction, sealed.audit);
+                return sealed.handle;
+            }, { isolationLevel: 'SERIALIZABLE' });
+        }
+        catch (error) {
+            if (!isDatabaseCasLoser(error))
+                throw error;
+            const winner = await this.#readEnvelope(sealed.handle);
+            await this.#appendAudit(sealed.audit, signal);
+            return winner.handle;
+        }
+    }
+    async #readEnvelope(handle) {
+        const rows = await this.#objectModel.select().where({ vault_object_id: handle.vaultObjectId });
+        return parseObjectRow(rows, handle);
+    }
+    async #appendAudit(value, signal) {
+        signal.throwIfAborted();
+        const candidate = auditRow(value);
+        try {
+            await this.#database.transaction(async (transaction) => {
+                signal.throwIfAborted();
+                const rows = await transaction.select('payload_vault_audit').where({ id: candidate.id });
+                if (rows.length > 0) {
+                    assertAuditRows(rows, candidate);
+                    return;
+                }
+                await transaction.insertMany('payload_vault_audit', [candidate]);
+            }, { isolationLevel: 'SERIALIZABLE' });
+        }
+        catch (error) {
+            if (!isDatabaseCasLoser(error))
+                throw error;
+            assertAuditRows(await this.#auditModel.select().where({ id: candidate.id }), candidate);
+        }
+    }
+}
+export const ENCRYPTED_PAYLOAD_VAULT_OBJECT_MODEL = {
+    id: { type: 'text', primary: true, nullable: false },
+    vault_object_id: { type: 'text', nullable: false },
+    tenant_id: { type: 'text', nullable: false },
+    project_id: { type: 'text', nullable: false },
+    object_id: { type: 'text', nullable: false },
+    payload_hash: { type: 'text', nullable: false },
+    descriptor_digest: { type: 'text', nullable: false },
+    location_manifest_digest: { type: 'text', nullable: false },
+    envelope_digest: { type: 'text', nullable: false },
+    envelope_json: { type: 'text', nullable: false },
+};
+export const ENCRYPTED_PAYLOAD_VAULT_AUDIT_MODEL = {
+    id: { type: 'text', primary: true, nullable: false },
+    vault_object_id: { type: 'text', nullable: false },
+    operation: { type: 'text', nullable: false },
+    audit_digest: { type: 'text', nullable: false },
+    audit_json: { type: 'text', nullable: false },
+};
+export function defineEncryptedPayloadVaultDatabaseModels(database) {
+    database.define('payload_vault_objects', ENCRYPTED_PAYLOAD_VAULT_OBJECT_MODEL);
+    database.define('payload_vault_audit', ENCRYPTED_PAYLOAD_VAULT_AUDIT_MODEL);
+}
+function objectRow(sealed) {
+    return {
+        id: sealed.handle.vaultObjectId,
+        vault_object_id: sealed.handle.vaultObjectId,
+        tenant_id: sealed.handle.tenantId,
+        project_id: sealed.handle.projectId,
+        object_id: sealed.handle.objectId,
+        payload_hash: sealed.handle.payloadHash,
+        descriptor_digest: sealed.handle.descriptorDigest,
+        location_manifest_digest: sealed.handle.locationManifestDigest,
+        envelope_digest: sealed.envelope.digest,
+        envelope_json: canonicalWorkroomJson(sealed.envelope),
+    };
+}
+function parseObjectRow(rows, handle) {
+    if (rows.length !== 1) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database object is absent or duplicated');
+    }
+    const row = rows[0];
+    exactKeys(row, [
+        'id', 'vault_object_id', 'tenant_id', 'project_id', 'object_id', 'payload_hash',
+        'descriptor_digest', 'location_manifest_digest', 'envelope_digest', 'envelope_json',
+    ], 'object');
+    if (row.id !== handle.vaultObjectId || row.vault_object_id !== handle.vaultObjectId
+        || row.tenant_id !== handle.tenantId || row.project_id !== handle.projectId
+        || row.object_id !== handle.objectId || row.payload_hash !== handle.payloadHash
+        || row.descriptor_digest !== handle.descriptorDigest
+        || row.location_manifest_digest !== handle.locationManifestDigest
+        || typeof row.envelope_json !== 'string') {
+        throw new PayloadVaultIntegrityError('Payload Vault Database row authority binding mismatch');
+    }
+    let envelope;
+    try {
+        envelope = JSON.parse(row.envelope_json);
+    }
+    catch (error) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database envelope is malformed', { cause: error });
+    }
+    if (canonicalWorkroomJson(envelope) !== row.envelope_json
+        || row.envelope_digest !== envelope.digest) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database envelope row digest mismatch');
+    }
+    // The shared assertion binds full handle, AAD, manifest and envelope digest.
+    resolveEncryptedPayloadVaultLifecycleObject(envelope, handle);
+    return deepFreeze(structuredClone(envelope));
+}
+async function insertAudit(transaction, value) {
+    const candidate = auditRow(value);
+    const rows = await transaction.select('payload_vault_audit').where({ id: candidate.id });
+    if (rows.length > 0) {
+        assertAuditRows(rows, candidate);
+        return;
+    }
+    await transaction.insertMany('payload_vault_audit', [candidate]);
+}
+function auditRow(value) {
+    const body = deepFreeze(structuredClone(value));
+    const auditDigest = digest(body);
+    const content = deepFreeze({ ...body, digest: auditDigest });
+    const vaultObjectId = required(body.vaultObjectId, 'audit.vaultObjectId');
+    const operation = required(body.operation, 'audit.operation');
+    return {
+        id: digest(content),
+        vault_object_id: vaultObjectId,
+        operation,
+        audit_digest: auditDigest,
+        audit_json: canonicalWorkroomJson(content),
+    };
+}
+function assertAuditRows(rows, expected) {
+    if (rows.length !== 1)
+        throw new PayloadVaultIntegrityError('Payload Vault Database audit is absent or duplicated');
+    exactKeys(rows[0], ['id', 'vault_object_id', 'operation', 'audit_digest', 'audit_json'], 'audit');
+    if (canonicalWorkroomJson(rows[0]) !== canonicalWorkroomJson(expected)) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database audit replay drift');
+    }
+}
+function exactKeys(value, expected, label) {
+    if (canonicalWorkroomJson(Object.keys(value).sort()) !== canonicalWorkroomJson([...expected].sort())) {
+        throw new PayloadVaultIntegrityError(`Payload Vault Database ${label} row shape drift`);
+    }
+}
+function required(value, label) {
+    if (typeof value !== 'string' || value.trim() !== value || value.length === 0) {
+        throw new PayloadVaultIntegrityError(`Payload Vault Database ${label} is invalid`);
+    }
+    return value;
+}
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new PayloadVaultIntegrityError(`Payload Vault Database ${label} must be positive`);
+    }
+    return value;
+}
+function isDatabaseCasLoser(error) {
+    return error instanceof Error
+        && ('code' in error && ['23505', 'SQLITE_CONSTRAINT', 'ER_DUP_ENTRY'].includes(String(error.code))
+            || /unique|duplicate|constraint/iu.test(error.message));
+}
+//# sourceMappingURL=encrypted-database-payload-vault.js.map

package/lib/data-governance/encrypted-database-payload-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-database-payload-vault.js","sourceRoot":"","sources":["../../src/data-governance/encrypted-database-payload-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,IAAI,MAAM,GACvC,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,2CAA2C,EAC3C,iCAAiC,GAKlC,MAAM,mCAAmC,CAAC;AAiC3C,2FAA2F;AAC3F,MAAM,OAAO,6BAA6B;IAC/B,SAAS,CAAgC;IACzC,YAAY,CAAqC;IACjD,WAAW,CAAqC;IAChD,WAAW,CAAS;IACpB,aAAa,CAA+B;IAC5C,QAAQ,GAAG;QAClB,gBAAgB,EAAE,gBAAgB;QAClC,eAAe,EAAE,EAAE;KACpB,CAAC;IAEF,YAAY,OAA6C;QACvD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YACzB,gBAAgB,EAAE,gBAAgB;YAClC,eAAe,EAAE,MAAM,CAAC;gBACtB,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,kCAAkC;gBAC3C,wBAAwB,EAAE,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;aACzD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,KAAmC,EACnC,MAAmB;QAEnB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,UAAU,CACR,KAAoC,EACpC,MAAmB;QAEnB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAA4B,EAAE,MAAmB;QAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC;YACxD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ;YACR,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,8BAA8B,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACzF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,MAAgC,EAChC,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,2CAA2C,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAAmE,EACnE,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC;YACrD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBAC1D,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC;oBACnE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;iBAC7C,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;gBACvB,CAAC;gBACD,MAAM,WAAW,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC3E,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAgC;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/F,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAwC,EAAE,MAAmB;QAC9E,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBACnD,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACjC,OAAO;gBACT,CAAC;gBACD,MAAM,WAAW,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACnE,CAAC,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,eAAe,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,EAAE,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC7D,eAAe,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACtD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,YAAY,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACxD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC7D,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACpE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC3D,aAAa,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;CAC1D,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,EAAE,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC7D,eAAe,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,YAAY,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACxD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;CACvD,CAAC;AAEF,MAAM,UAAU,yCAAyC,CACvD,QAAuE;IAEvE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,MAAgC;IACjD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;QAC/B,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;QAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QACjC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;QACvC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB;QACjD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB;QAC9D,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QACvC,aAAa,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAwC,EACxC,MAAgC;IAEhC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,0BAA0B,CAAC,uDAAuD,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACrB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc;QAC/E,mBAAmB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,eAAe;KACpF,EAAE,QAAQ,CAAC,CAAC;IACb,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,aAAa;WAC9E,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;WACxE,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,WAAW;WAC5E,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,gBAAgB;WACjD,GAAG,CAAC,wBAAwB,KAAK,MAAM,CAAC,sBAAsB;WAC9D,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,0BAA0B,CAAC,uDAAuD,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAwB,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,aAAa;WACpD,GAAG,CAAC,eAAe,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,0BAA0B,CAAC,qDAAqD,CAAC,CAAC;IAC9F,CAAC;IACD,6EAA6E;IAC7E,2CAA2C,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,WAAqD,EACrD,KAAwC;IAExC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,WAAW,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC9D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;QACnB,eAAe,EAAE,aAAa;QAC9B,SAAS;QACT,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAwC,EACxC,QAAiC;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,sDAAsD,CAAC,CAAC;IACpH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;IACnG,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,KAAa;IAC3F,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,qBAAqB,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,KAAK,kBAAkB,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,KAAK,aAAa,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,KAAK,mBAAmB,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK;WACxB,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;eAC7F,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/lib/data-governance/encrypted-file-payload-vault.d.ts

@@ -0,0 +1,117 @@
+import type { ConfidentialityClass, DataDescriptor } from './data-governance.js';
+import type { PayloadVaultDerivedWriteInput, PayloadVaultObjectHandle, PayloadVaultPort, PayloadVaultReadInput } from './disclosure-manifest.js';
+import { type PayloadLifecycleObjectAuthority, type PayloadLocationManifest } from './payload-lifecycle.js';
+export interface PayloadVaultWrappedKey {
+    readonly keyId: string;
+    /** Provider-opaque wrapped DEK. It must never be the raw key encoding. */
+    readonly wrappedKey: string;
+}
+export interface PayloadVaultCryptographyContext {
+    readonly version: 1;
+    readonly generation: number;
+    readonly tenantId: string;
+    readonly projectId: string;
+    readonly objectId: string;
+    readonly descriptorDigest: string;
+    readonly aadDigest: string;
+}
+/** Trusted Root-only crypto/KMS seam. KEK bytes never leave the provider. */
+export interface PayloadVaultCryptographyPort {
+    wrap(request: PayloadVaultCryptographyContext & Readonly<{
+        dataKey: Uint8Array;
+    }>, signal: AbortSignal): PayloadVaultWrappedKey | null | Promise<PayloadVaultWrappedKey | null>;
+    unwrap(request: PayloadVaultCryptographyContext & PayloadVaultWrappedKey, signal: AbortSignal): Uint8Array | null | Promise<Uint8Array | null>;
+}
+export interface PayloadVaultSourceWriteInput {
+    /** Complete canonical descriptor; loose classification fields are forbidden. */
+    readonly descriptor: DataDescriptor;
+    readonly descriptorDigest: string;
+    readonly payload: Uint8Array;
+    readonly sourceBindingDigest: string;
+}
+export declare class PayloadVaultCryptographyUnavailableError extends Error {
+    readonly tenantId: string;
+    readonly projectId: string;
+    readonly keyId?: string | undefined;
+    constructor(tenantId: string, projectId: string, keyId?: string | undefined);
+}
+export declare class PayloadVaultIntegrityError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export interface VaultObjectEnvelope {
+    readonly version: 1;
+    readonly handle: PayloadVaultObjectHandle;
+    readonly aad: Readonly<{
+        version: 1;
+        issuedGeneration: number;
+        objectId: string;
+        payloadHash: string;
+        descriptorDigest: string;
+        tenantId: string;
+        projectId: string;
+        confidentiality: Exclude<ConfidentialityClass, 'unknown'>;
+        categories: readonly string[];
+        subjectDigests: readonly string[];
+        lineage: Readonly<{
+            sourceObjectIds: readonly string[];
+            transformRef?: string;
+            sourceBindingDigest?: string;
+        }>;
+        retention: DataDescriptor['retention'];
+        locationManifest: PayloadLocationManifest;
+    }>;
+    readonly encryption: Readonly<{
+        algorithm: 'aes-256-gcm';
+        keyId: string;
+        payloadIv: string;
+        payloadTag: string;
+        wrappedKey: string;
+    }>;
+    readonly ciphertext: string;
+    readonly digest: string;
+}
+export interface EncryptedFilePayloadVaultOptions {
+    /** Repository leaf; its parent must already exist. */
+    readonly directory: string;
+    readonly generation: number;
+    readonly cryptography: PayloadVaultCryptographyPort;
+}
+export interface EncryptedPayloadVaultStorageAuthority {
+    readonly locationIdPrefix: string;
+    readonly authorityDigest: string;
+}
+export interface SealedPayloadVaultObject {
+    readonly handle: PayloadVaultObjectHandle;
+    readonly envelope: VaultObjectEnvelope;
+    readonly audit: Readonly<Record<string, unknown>>;
+}
+/**
+ * Immutable AES-256-GCM envelope Vault. Every object receives a random DEK;
+ * only a KeyProvider-wrapped DEK is persisted. Handles reveal no path or key id.
+ */
+export declare class EncryptedFilePayloadVault implements PayloadVaultPort {
+    #private;
+    constructor(options: EncryptedFilePayloadVaultOptions);
+    putSource(input: PayloadVaultSourceWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    putDerived(input: PayloadVaultDerivedWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    readExact(input: PayloadVaultReadInput, signal: AbortSignal): Promise<Uint8Array>;
+    /** Trusted Root lifecycle resolver; never publish the Vault itself as a Resource. */
+    resolveLifecycleObject(handle: PayloadVaultObjectHandle, signal: AbortSignal): Promise<PayloadLifecycleObjectAuthority | undefined>;
+}
+export declare function sealEncryptedPayloadVaultEnvelope(options: Readonly<{
+    generation: number;
+    cryptography: PayloadVaultCryptographyPort;
+    storage: EncryptedPayloadVaultStorageAuthority;
+    input: PayloadVaultSourceWriteInput | PayloadVaultDerivedWriteInput;
+    signal: AbortSignal;
+}>): Promise<SealedPayloadVaultObject>;
+export declare function openEncryptedPayloadVaultEnvelope(options: Readonly<{
+    generation: number;
+    cryptography: PayloadVaultCryptographyPort;
+    envelope: VaultObjectEnvelope;
+    input: PayloadVaultReadInput;
+    signal: AbortSignal;
+}>): Promise<Uint8Array>;
+export declare function resolveEncryptedPayloadVaultLifecycleObject(envelope: VaultObjectEnvelope, handle: PayloadVaultObjectHandle): PayloadLifecycleObjectAuthority;
+export declare function readEncryptedPayloadVaultAudit(generation: number, input: PayloadVaultReadInput): Readonly<Record<string, unknown>>;
+//# sourceMappingURL=encrypted-file-payload-vault.d.ts.map

package/lib/data-governance/encrypted-file-payload-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-file-payload-vault.d.ts","sourceRoot":"","sources":["../../src/data-governance/encrypted-file-payload-vault.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAIL,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CACF,OAAO,EAAE,+BAA+B,GAAG,QAAQ,CAAC;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC,EAC5E,MAAM,EAAE,WAAW,GAClB,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC1E,MAAM,CACJ,OAAO,EAAE,+BAA+B,GAAG,sBAAsB,EACjE,MAAM,EAAE,WAAW,GAClB,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,4BAA4B;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,qBAAa,wCAAyC,SAAQ,KAAK;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;gBAArE,QAAQ,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,MAAM,YAAA;CAI3F;AAED,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,OAAO,EAAE,CAAC,CAAC;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC;YAChB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;YACnC,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC,CAAC;QACH,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;QACvC,gBAAgB,EAAE,uBAAuB,CAAC;KAC3C,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5B,SAAS,EAAE,aAAa,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gCAAgC;IAC/C,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;CACrD;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,gBAAgB;;gBASpD,OAAO,EAAE,gCAAgC;IAa/C,SAAS,CACb,KAAK,EAAE,4BAA4B,EACnC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,UAAU,CACd,KAAK,EAAE,6BAA6B,EACpC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,SAAS,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAmBvF,qFAAqF;IAC/E,sBAAsB,CAC1B,MAAM,EAAE,wBAAwB,EAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;CA2FxD;AAED,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,QAAQ,CAAC;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,OAAO,EAAE,qCAAqC,CAAC;IAC/C,KAAK,EAAE,4BAA4B,GAAG,6BAA6B,CAAC;IACpE,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsFrC;AAED,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,QAAQ,CAAC;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAkCvB;AAED,wBAAgB,2CAA2C,CACzD,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,wBAAwB,GAC/B,+BAA+B,CAajC;AAED,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,qBAAqB,GAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEnC"}