chainlesschain 0.166.22 → 0.166.25

package/src/lib/evolution/evolution-ledger.js

@@ -2,9 +2,15 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { types as utilTypes } from "node:util";
+import { readBoundedDescriptor } from "./bounded-descriptor-read.js";
 import { getHomeDir } from "../paths.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../secure-fs.js";
 import { withFileLock } from "../with-file-lock.js";
+import {
+  assertKnowledgeWikiSourceAdmission,
+  WIKI_SOURCE_ADMISSION_INVALID_CODE,
+  WIKI_SOURCE_REVOKED_CODE,
+} from "./knowledge-wiki-source-admission.js";
 
 export const EVOLUTION_LEDGER_EVENT_SCHEMA =
   "chainlesschain.evolution-event/v2";
@@ -461,6 +467,7 @@ const REQUIRED_FS_METHODS = Object.freeze([
   "mkdirSync",
   "openSync",
   "readFileSync",
+  "readSync",
   "readdirSync",
   "realpathSync",
   "renameSync",
@@ -2806,7 +2813,21 @@ export class EvolutionLedger {
           `${label} changed while it was opened`,
         );
       }
-      const bytes = this.#fs.readFileSync(descriptor);
+      let bytes;
+      try {
+        bytes = readBoundedDescriptor(
+          this.#fs,
+          descriptor,
+          opened.size,
+          maximum,
+        );
+      } catch (cause) {
+        throw ledgerError(
+          "CC_EVOLUTION_LEDGER_CORRUPT",
+          `${label} changed during bounded read`,
+          { cause },
+        );
+      }
       const after = this.#fs.fstatSync(descriptor);
       if (
         after.nlink !== 1 ||
@@ -3365,7 +3386,12 @@ export class EvolutionLedger {
       ) {
         return false;
       }
-      const bytes = this.#fs.readFileSync(descriptor);
+      const bytes = readBoundedDescriptor(
+        this.#fs,
+        descriptor,
+        opened.size,
+        EVOLUTION_LEDGER_MAX_EVENT_BYTES,
+      );
       const after = this.#fs.fstatSync(descriptor);
       return (
         after.nlink === 1 &&
@@ -4427,6 +4453,44 @@ export class EvolutionLedger {
             "evolution ledger capacity is exhausted",
           );
         }
+        // Mandatory Wiki admission is inside the genuine Ledger write lock,
+        // after current-state authentication and before any event is signed or
+        // persisted. Raw domain append callers and adapters share this fence.
+        if (domainEvent && normalized.type === "wiki.revision.committed") {
+          try {
+            assertKnowledgeWikiSourceAdmission({
+              input: normalized,
+              events: current.events,
+              resolveSubject: (entry) => {
+                const evidence = this.#resolveArtifactEvidence(
+                  { ...entry, sourceRefs: [] },
+                  current.identity,
+                  { includeBytes: true },
+                );
+                const subject = evidence.artifacts.find(
+                  (artifact) =>
+                    artifact.artifactRef.ref === entry.subjectRef.ref &&
+                    artifact.artifactRef.digest === entry.subjectRef.digest,
+                );
+                if (!subject)
+                  throw ledgerError(
+                    WIKI_SOURCE_ADMISSION_INVALID_CODE,
+                    "Wiki admission subject was not resolved",
+                  );
+                return Buffer.from(subject.bytesBase64, "base64");
+              },
+            });
+          } catch (cause) {
+            if (cause instanceof EvolutionLedgerError) throw cause;
+            throw ledgerError(
+              cause?.code === WIKI_SOURCE_REVOKED_CODE
+                ? WIKI_SOURCE_REVOKED_CODE
+                : WIKI_SOURCE_ADMISSION_INVALID_CODE,
+              "Wiki source admission rejected the proposed revision",
+              { cause },
+            );
+          }
+        }
         const artifactValidationDigest = this.#resolveArtifacts(
           normalized,
           current.identity,

package/src/lib/evolution/evolution-raw-crypto-shred.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { capturePruningData } from "./governed-wiki-pruning-journal.js";
 
 export const EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA =
   "chainlesschain.evolution-raw-crypto-shred/v1";
@@ -80,6 +81,26 @@ function verifyPruningCall(call, tenantId) {
   return request;
 }
 
+export function buildEvolutionRawCryptoShredRequest(call, tenantId) {
+  const request = verifyPruningCall(capturePruningData(call), tenantId);
+  const target = request.payload;
+  const core = {
+    schema: EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA,
+    tenantId,
+    planDigest: request.planDigest,
+    wikiStateDigest: request.wikiStateDigest,
+    evidenceRef: target.evidenceRef,
+    rawArtifactRef: target.rawArtifactRef,
+    rawCipherDigest: target.rawCipherDigest,
+    keyRef: target.keyRef,
+    deletionReceiptDigest: target.receiptDigest,
+  };
+  return freeze({
+    ...core,
+    requestDigest: hash(EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA, core),
+  });
+}
+
 export class EvolutionRawCryptoShred {
   constructor({ tenantId, ports } = {}) {
     this.tenantId = string(tenantId, "tenantId");
@@ -87,9 +108,11 @@ export class EvolutionRawCryptoShred {
     this._destroyKey = capture(ports, "destroyKey");
     this._confirmKeyDestroyed = capture(ports, "confirmKeyDestroyed");
     this._retainTombstone = capture(ports, "retainTombstone");
+    Object.freeze(this);
   }
 
   async shred(call) {
+    call = capturePruningData(call);
     const request = verifyPruningCall(call, this.tenantId);
     const target = request.payload;
     const deletion = await this._verifyDeletionReceipt({
@@ -109,21 +132,10 @@ export class EvolutionRawCryptoShred {
       deletion.keyRef !== target.keyRef
     )
       throw new Error("Raw deletion receipt was substituted");
-    const destructionCore = {
-      schema: EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA,
-      tenantId: this.tenantId,
-      planDigest: request.planDigest,
-      wikiStateDigest: request.wikiStateDigest,
-      evidenceRef: target.evidenceRef,
-      rawArtifactRef: target.rawArtifactRef,
-      rawCipherDigest: target.rawCipherDigest,
-      keyRef: target.keyRef,
-      deletionReceiptDigest: target.receiptDigest,
-    };
-    const destructionRequest = freeze({
-      ...destructionCore,
-      requestDigest: hash(EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA, destructionCore),
-    });
+    const destructionRequest = buildEvolutionRawCryptoShredRequest(
+      call,
+      this.tenantId,
+    );
     const destroyed = await this._destroyKey(destructionRequest);
     if (
       destroyed?.authenticated !== true ||
@@ -183,3 +195,5 @@ export class EvolutionRawCryptoShred {
     });
   }
 }
+
+Object.freeze(EvolutionRawCryptoShred.prototype);