@peerbit/trusted-network 6.0.104 → 6.0.105

package/dist/src/v2-policy-engine.d.ts

@@ -1,5 +1,4 @@
 import { PublicSignKey } from "@peerbit/crypto";
-import { EntryV0 } from "@peerbit/log";
 import { NetworkDescriptorV2, PolicySnapshotBodyV2, PolicySubjectBindingV2 } from "./v2.js";
 type ValidatedPolicySnapshotV2 = {
     body: PolicySnapshotBodyV2;
@@ -8,7 +7,9 @@ type ValidatedPolicySnapshotV2 = {
     entryBytes: Uint8Array;
     accountedBytes: number;
 };
-export type PolicySnapshotResolverV2 = (digest: Uint8Array) => EntryV0<Uint8Array> | undefined | Promise<EntryV0<Uint8Array> | undefined>;
+export type PolicySnapshotResolverV2 = (digest: Uint8Array, options: {
+    signal: AbortSignal;
+}) => Uint8Array | undefined | Promise<Uint8Array | undefined>;
 export type PolicyParentFetchHintV2 = {
     kind: "policy-parent";
     digest: Uint8Array;
@@ -37,12 +38,16 @@ export type PolicyAdmissionResultV2 = {
     pendingBytes: number;
     evictedPolicyDigests?: Uint8Array[];
 };
-export declare const authenticatePolicySnapshotEntryV2: (entry: unknown, descriptor: NetworkDescriptorV2) => Promise<ValidatedPolicySnapshotV2>;
+export declare const authenticatePolicySnapshotEntryV2: (entryBytes: Uint8Array, descriptor: NetworkDescriptorV2) => Promise<ValidatedPolicySnapshotV2>;
 export declare class TrustedNetworkV2PolicyReducer {
     private readonly descriptor;
     private readonly resolvePolicyEntry;
+    private readonly resolveTimeoutMs;
     private readonly maxPending;
     private readonly maxPendingPolicyBytes;
+    private readonly lifecycleController;
+    private externalSignal?;
+    private externalAbortListener?;
     private acceptedHead?;
     private projectedRoles;
     private readonly pending;
@@ -52,10 +57,12 @@ export declare class TrustedNetworkV2PolicyReducer {
     constructor(properties: {
         descriptor: NetworkDescriptorV2;
         resolvePolicyEntry: PolicySnapshotResolverV2;
+        resolveTimeoutMs?: number;
+        signal?: AbortSignal;
         maxPending?: number;
         maxPendingPolicyBytes?: number;
     });
-    get state(): "EMPTY" | "ACTIVE" | "UNAVAILABLE" | "FORKED";
+    get state(): "EMPTY" | "ACTIVE" | "UNAVAILABLE" | "FORKED" | "HALTED";
     get head(): PolicyHeadProjectionV2 | undefined;
     get forkEvidence(): PolicyForkEvidenceV2 | undefined;
     get pendingCount(): number;
@@ -63,15 +70,19 @@ export declare class TrustedNetworkV2PolicyReducer {
     get pendingDigests(): Uint8Array[];
     rolesFor(subject: PublicSignKey): number;
     isAuthorized(subject: PublicSignKey, roles: number): boolean;
+    abort(): void;
     private fetchHints;
     private result;
     private forkedResult;
+    private haltedResult;
     private unavailableResult;
     private completedDrainResult;
     private project;
     private retainCanonicalHeadEntry;
+    private resolveExternalSnapshot;
     private resolveSnapshot;
     private parentOf;
+    private candidateAncestryResult;
     private acceptedAncestryUnavailable;
     private evaluate;
     private setFork;
@@ -81,7 +92,7 @@ export declare class TrustedNetworkV2PolicyReducer {
     private enterUnavailable;
     private drainPending;
     private enqueueAdmission;
-    ingest(entry: unknown): Promise<PolicyAdmissionResultV2>;
+    ingest(entryBytes: Uint8Array): Promise<PolicyAdmissionResultV2>;
     retryUnavailable(): Promise<PolicyAdmissionResultV2>;
     private ingestOne;
     private retryUnavailableOne;

package/dist/src/v2-policy-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v2-policy-engine.d.ts","sourceRoot":"","sources":["../../src/v2-policy-engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,aAAa,EAAU,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAS,OAAO,EAAe,MAAM,cAAc,CAAC;AAE3D,OAAO,EACN,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EAKtB,MAAM,SAAS,CAAC;AAgCjB,KAAK,yBAAyB,GAAG;IAChC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACvB,CAAC;AA0BF,MAAM,MAAM,wBAAwB,GAAG,CACtC,MAAM,EAAE,UAAU,KACd,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,CAAC;AAEhF,MAAM,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,YAAY,EAAE,sBAAsB,CAAC;IACrC,QAAQ,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAChC,UAAU,GACV,WAAW,GACX,SAAS,GACT,aAAa,GACb,UAAU,GACV,UAAU,GACV,QAAQ,GACR,QAAQ,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,uBAAuB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,sBAAsB,CAAC;IAC9B,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACpC,CAAC;AAmDF,eAAO,MAAM,iCAAiC,GAC7C,OAAO,OAAO,EACd,YAAY,mBAAmB,KAC7B,OAAO,CAAC,yBAAyB,CA8DnC,CAAC;AAsDF,qBAAa,6BAA6B;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,YAAY,CAAC,CAA4B;IACjD,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAGtE,OAAO,CAAC,WAAW,CAAC,CAAgC;IACpD,OAAO,CAAC,IAAI,CAAC,CAAuB;IACpC,OAAO,CAAC,aAAa,CAAoC;gBAE7C,UAAU,EAAE;QACvB,UAAU,EAAE,mBAAmB,CAAC;QAChC,kBAAkB,EAAE,wBAAwB,CAAC;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B;IAuBD,IAAI,KAAK,IAAI,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAIzD;IAED,IAAI,IAAI,IAAI,sBAAsB,GAAG,SAAS,CAI7C;IAED,IAAI,YAAY,IAAI,oBAAoB,GAAG,SAAS,CAEnD;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,YAAY,IAAI,MAAM,CAMzB;IAED,IAAI,cAAc,IAAI,UAAU,EAAE,CAIjC;IAED,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM;IAIxC,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAY5D,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,MAAM;IAmBd,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,iBAAiB;IAqBzB,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,wBAAwB;YASlB,eAAe;YA8Bf,QAAQ;IAwCtB,OAAO,CAAC,2BAA2B;YAarB,QAAQ;IA2EtB,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,wBAAwB;IAuBhC,OAAO,CAAC,gBAAgB;IAgBxB,OAAO,CAAC,UAAU;IA2ClB,OAAO,CAAC,gBAAgB;YAaV,YAAY;IAsC1B,OAAO,CAAC,gBAAgB;IAWxB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIxD,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,CAAC;YAItC,SAAS;YA2ET,mBAAmB;CA2DjC"}
+{"version":3,"file":"v2-policy-engine.d.ts","sourceRoot":"","sources":["../../src/v2-policy-engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,aAAa,EAAU,MAAM,iBAAiB,CAAC;AAGxE,OAAO,EACN,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EAMtB,MAAM,SAAS,CAAC;AAsCjB,KAAK,yBAAyB,GAAG;IAChC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACvB,CAAC;AA0BF,MAAM,MAAM,wBAAwB,GAAG,CACtC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,KAC5B,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,YAAY,EAAE,sBAAsB,CAAC;IACrC,QAAQ,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAChC,UAAU,GACV,WAAW,GACX,SAAS,GACT,aAAa,GACb,UAAU,GACV,UAAU,GACV,QAAQ,GACR,QAAQ,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,uBAAuB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,sBAAsB,CAAC;IAC9B,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACpC,CAAC;AAmJF,eAAO,MAAM,iCAAiC,GAC7C,YAAY,UAAU,EACtB,YAAY,mBAAmB,KAC7B,OAAO,CAAC,yBAAyB,CAMnC,CAAC;AAsDF,qBAAa,6BAA6B;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyB;IAC7D,OAAO,CAAC,cAAc,CAAC,CAAc;IACrC,OAAO,CAAC,qBAAqB,CAAC,CAAa;IAC3C,OAAO,CAAC,YAAY,CAAC,CAA4B;IACjD,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAGtE,OAAO,CAAC,WAAW,CAAC,CAAgC;IACpD,OAAO,CAAC,IAAI,CAAC,CAAuB;IACpC,OAAO,CAAC,aAAa,CAAoC;gBAE7C,UAAU,EAAE;QACvB,UAAU,EAAE,mBAAmB,CAAC;QAChC,kBAAkB,EAAE,wBAAwB,CAAC;QAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B;IAsDD,IAAI,KAAK,IAAI,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAKpE;IAED,IAAI,IAAI,IAAI,sBAAsB,GAAG,SAAS,CAI7C;IAED,IAAI,YAAY,IAAI,oBAAoB,GAAG,SAAS,CAEnD;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,YAAY,IAAI,MAAM,CAMzB;IAED,IAAI,cAAc,IAAI,UAAU,EAAE,CAIjC;IAED,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM;IAIxC,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAY5D,KAAK,IAAI,IAAI;IAeb,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,MAAM;IAmBd,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,iBAAiB;IAqBzB,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,wBAAwB;YASlB,uBAAuB;YAkFvB,eAAe;YAmBf,QAAQ;IAwCtB,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,2BAA2B;YAerB,QAAQ;IAiFtB,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,wBAAwB;IAuBhC,OAAO,CAAC,gBAAgB;IAgBxB,OAAO,CAAC,UAAU;IA2ClB,OAAO,CAAC,gBAAgB;YAaV,YAAY;IA4C1B,OAAO,CAAC,gBAAgB;IAmBxB,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAgBhE,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,CAAC;YAItC,SAAS;YA+ET,mBAAmB;CA6DjC"}

package/dist/src/v2-policy-engine.js

@@ -2,7 +2,7 @@ import { deserialize, serialize } from "@dao-xyz/borsh";
 import { DecryptedThing, PublicSignKey, verify } from "@peerbit/crypto";
 import { Entry, EntryV0, NO_ENCODING } from "@peerbit/log";
 import { compare, equals } from "uint8arrays";
-import { NetworkDescriptorV2, PolicySnapshotBodyV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS, assertNetworkDescriptorV2, decodePolicySnapshotBodyV2, digestPolicySnapshotBodyV2, } from "./v2.js";
+import { NetworkDescriptorV2, PolicySnapshotBodyV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS, TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES, assertNetworkDescriptorV2, decodePolicySnapshotBodyV2, digestPolicySnapshotBodyV2, } from "./v2.js";
 /**
  * Internal policy reducer for the non-activatable TrustedNetwork v2 scaffold.
  *
@@ -12,8 +12,12 @@ import { NetworkDescriptorV2, PolicySnapshotBodyV2, PolicySubjectBindingV2, TRUS
  * resolver instead of being accumulated in memory.
  */
 const DEFAULT_MAX_PENDING_POLICIES_V2 = 64;
-const DEFAULT_MAX_PENDING_POLICY_BYTES_V2 = 256 * 1024;
 const PENDING_POLICY_ACCOUNTING_OVERHEAD_V2 = 64;
+const MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2 = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2 +
+    PENDING_POLICY_ACCOUNTING_OVERHEAD_V2;
+const DEFAULT_MAX_PENDING_POLICY_BYTES_V2 = MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2;
+const DEFAULT_POLICY_RESOLUTION_TIMEOUT_MS_V2 = 10 * 1000;
+const MAX_TIMER_DELAY_MS_V2 = 0x7fffffff;
 const MAX_UNAVAILABLE_REASON_LENGTH_V2 = 512;
 const copyBytes = (bytes) => Uint8Array.from(bytes);
 const bytesKey = (bytes) => {
@@ -44,29 +48,47 @@ const copySnapshot = (snapshot) => ({
 });
 const validationMessage = (error) => error instanceof Error ? error.message : String(error);
 const boundedUnavailableReason = (reason) => reason.slice(0, MAX_UNAVAILABLE_REASON_LENGTH_V2);
-export const authenticatePolicySnapshotEntryV2 = async (entry, descriptor) => {
-    assertNetworkDescriptorV2(descriptor);
-    if (!(entry instanceof EntryV0)) {
+class PolicyDependencyUnavailableErrorV2 extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PolicyDependencyUnavailableErrorV2";
+    }
+}
+const capturePolicySnapshotEntryBytesV2 = (entryBytes) => {
+    if (!(entryBytes instanceof Uint8Array)) {
+        throw new Error("Policy snapshot must use canonical EntryV0 bytes");
+    }
+    if (entryBytes.byteLength === 0) {
+        throw new Error("Policy snapshot must use EntryV0");
+    }
+    if (entryBytes.byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES) {
+        throw new Error(`Policy snapshot entry must contain 1-${TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES} bytes`);
+    }
+    // Apply the protocol byte ceiling before this first copy, decode, or crypto
+    // operation. The retained copy also prevents caller mutation during awaits.
+    return copyBytes(entryBytes);
+};
+const authenticateCapturedPolicySnapshotEntryV2 = async (canonicalEntryBytes, descriptor) => {
+    const authenticatedEntry = deserialize(canonicalEntryBytes, Entry);
+    if (!(authenticatedEntry instanceof EntryV0)) {
         throw new Error("Policy snapshot must use EntryV0");
     }
-    if (!(entry._meta instanceof DecryptedThing)) {
+    if (!equals(canonicalEntryBytes, serialize(authenticatedEntry))) {
+        throw new Error("Policy snapshot entry encoding is not canonical");
+    }
+    if (!(authenticatedEntry._meta instanceof DecryptedThing)) {
         throw new Error("Policy snapshot metadata must be public");
     }
-    if (!(entry._payload instanceof DecryptedThing)) {
+    if (!(authenticatedEntry._payload instanceof DecryptedThing)) {
         throw new Error("Policy snapshot payload must be public");
     }
-    if (entry._signatures === undefined ||
-        entry._signatures.signatures.length !== 1) {
+    if (authenticatedEntry._signatures === undefined ||
+        authenticatedEntry._signatures.signatures.length !== 1) {
         throw new Error("Policy snapshot must contain exactly one signature");
     }
-    if (!(entry._signatures.signatures[0] instanceof DecryptedThing)) {
+    if (!(authenticatedEntry._signatures.signatures[0] instanceof DecryptedThing)) {
         throw new Error("Policy snapshot signature must be public");
     }
-    const entryBytes = serialize(entry);
-    const authenticatedEntry = deserialize(entryBytes, Entry);
-    if (!(authenticatedEntry instanceof EntryV0)) {
-        throw new Error("Policy snapshot must decode as EntryV0");
-    }
     authenticatedEntry.init({ encoding: NO_ENCODING });
     const signatures = await authenticatedEntry.getSignatures();
     if (signatures.length !== 1) {
@@ -89,12 +111,16 @@ export const authenticatePolicySnapshotEntryV2 = async (entry, descriptor) => {
         body: copyBody(body),
         digest: copyBytes(digest),
         digestKey: bytesKey(digest),
-        entryBytes,
-        accountedBytes: entryBytes.byteLength +
+        entryBytes: canonicalEntryBytes,
+        accountedBytes: canonicalEntryBytes.byteLength +
             serialize(body).byteLength +
             PENDING_POLICY_ACCOUNTING_OVERHEAD_V2,
     };
 };
+export const authenticatePolicySnapshotEntryV2 = async (entryBytes, descriptor) => {
+    assertNetworkDescriptorV2(descriptor);
+    return authenticateCapturedPolicySnapshotEntryV2(capturePolicySnapshotEntryBytesV2(entryBytes), descriptor);
+};
 const projectionFromSnapshot = (snapshot) => ({
     sequence: snapshot.body.sequence,
     digest: copyBytes(snapshot.digest),
@@ -131,8 +157,12 @@ const copyForkEvidence = (evidence) => ({
 export class TrustedNetworkV2PolicyReducer {
     descriptor;
     resolvePolicyEntry;
+    resolveTimeoutMs;
     maxPending;
     maxPendingPolicyBytes;
+    lifecycleController = new AbortController();
+    externalSignal;
+    externalAbortListener;
     acceptedHead;
     projectedRoles = new Map();
     pending = new Map();
@@ -149,15 +179,37 @@ export class TrustedNetworkV2PolicyReducer {
         }
         const maxPendingPolicyBytes = properties.maxPendingPolicyBytes ?? DEFAULT_MAX_PENDING_POLICY_BYTES_V2;
         if (!Number.isSafeInteger(maxPendingPolicyBytes) ||
-            maxPendingPolicyBytes < 1) {
-            throw new Error("maxPendingPolicyBytes must be a positive safe integer");
+            maxPendingPolicyBytes < 1 ||
+            maxPendingPolicyBytes > MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2) {
+            throw new Error(`maxPendingPolicyBytes must be a positive safe integer no greater than ${MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2}`);
+        }
+        const resolveTimeoutMs = properties.resolveTimeoutMs ?? DEFAULT_POLICY_RESOLUTION_TIMEOUT_MS_V2;
+        if (!Number.isSafeInteger(resolveTimeoutMs) ||
+            resolveTimeoutMs < 1 ||
+            resolveTimeoutMs > MAX_TIMER_DELAY_MS_V2) {
+            throw new Error(`resolveTimeoutMs must be a positive safe integer no greater than ${MAX_TIMER_DELAY_MS_V2}`);
         }
         this.descriptor = deserialize(serialize(properties.descriptor), NetworkDescriptorV2);
         this.resolvePolicyEntry = properties.resolvePolicyEntry;
+        this.resolveTimeoutMs = resolveTimeoutMs;
         this.maxPending = maxPending;
         this.maxPendingPolicyBytes = maxPendingPolicyBytes;
+        if (properties.signal?.aborted) {
+            this.lifecycleController.abort();
+        }
+        else if (properties.signal !== undefined) {
+            this.externalSignal = properties.signal;
+            this.externalAbortListener = () => {
+                this.externalSignal = undefined;
+                this.externalAbortListener = undefined;
+                this.lifecycleController.abort();
+            };
+            this.externalSignal.addEventListener("abort", this.externalAbortListener, { once: true });
+        }
     }
     get state() {
+        if (this.lifecycleController.signal.aborted)
+            return "HALTED";
         if (this.fork !== undefined)
             return "FORKED";
         if (this.unavailable !== undefined)
@@ -199,6 +251,15 @@ export class TrustedNetworkV2PolicyReducer {
         }
         return (this.rolesFor(subject) & roles) === roles;
     }
+    abort() {
+        if (this.externalSignal !== undefined &&
+            this.externalAbortListener !== undefined) {
+            this.externalSignal.removeEventListener("abort", this.externalAbortListener);
+        }
+        this.externalSignal = undefined;
+        this.externalAbortListener = undefined;
+        this.lifecycleController.abort();
+    }
     fetchHints() {
         const unique = new Map();
         for (const { missingParentDigest } of this.pending.values()) {
@@ -230,6 +291,9 @@ export class TrustedNetworkV2PolicyReducer {
     forkedResult() {
         return this.result("forked", "Policy authority signed competing children");
     }
+    haltedResult() {
+        return this.result("halted", "Policy reducer lifecycle is aborted");
+    }
     unavailableResult(retention) {
         const blockedCandidateRetained = this.unavailable !== undefined &&
             this.pending.has(this.unavailable.candidateDigestKey);
@@ -244,6 +308,8 @@ export class TrustedNetworkV2PolicyReducer {
     completedDrainResult(outcome) {
         if (outcome?.status === "forked")
             return this.forkedResult();
+        if (outcome?.status === "halted")
+            return this.haltedResult();
         return outcome?.status === "unavailable"
             ? this.unavailableResult(outcome)
             : undefined;
@@ -261,6 +327,67 @@ export class TrustedNetworkV2PolicyReducer {
             this.acceptedHead = copySnapshot(snapshot);
         }
     }
+    async resolveExternalSnapshot(digest) {
+        if (this.lifecycleController.signal.aborted) {
+            throw new PolicyDependencyUnavailableErrorV2("Policy resolver lifecycle is aborted");
+        }
+        const attemptController = new AbortController();
+        let timedOut = false;
+        const abortFromLifecycle = () => attemptController.abort();
+        this.lifecycleController.signal.addEventListener("abort", abortFromLifecycle, { once: true });
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            attemptController.abort();
+        }, this.resolveTimeoutMs);
+        const abortError = () => new PolicyDependencyUnavailableErrorV2(timedOut
+            ? `Policy resolver timed out after ${this.resolveTimeoutMs} ms`
+            : "Policy resolver attempt was aborted");
+        let rejectOnAbort;
+        const abortPromise = new Promise((_resolve, reject) => {
+            rejectOnAbort = () => {
+                reject(abortError());
+            };
+            attemptController.signal.addEventListener("abort", rejectOnAbort, {
+                once: true,
+            });
+        });
+        const resolution = Promise.resolve().then(async () => {
+            if (attemptController.signal.aborted)
+                throw abortError();
+            const entryBytes = await this.resolvePolicyEntry(copyBytes(digest), {
+                signal: attemptController.signal,
+            });
+            // A resolver may ignore cancellation. Do not spend decode or signature
+            // verification work on bytes that arrive after this attempt expired.
+            if (attemptController.signal.aborted)
+                throw abortError();
+            if (entryBytes === undefined)
+                return undefined;
+            const snapshot = await authenticatePolicySnapshotEntryV2(entryBytes, this.descriptor);
+            if (!equals(snapshot.digest, digest)) {
+                throw new Error("Policy resolver returned the wrong body digest");
+            }
+            return snapshot;
+        });
+        // Promise.race installs handlers, but this explicit observer documents and
+        // preserves consumption if the resolver settles after its deadline.
+        void resolution.then(() => undefined, () => undefined);
+        try {
+            return await Promise.race([resolution, abortPromise]);
+        }
+        catch (error) {
+            if (error instanceof PolicyDependencyUnavailableErrorV2)
+                throw error;
+            throw new PolicyDependencyUnavailableErrorV2(`Policy resolver dependency is unavailable: ${validationMessage(error)}`);
+        }
+        finally {
+            clearTimeout(timeout);
+            this.lifecycleController.signal.removeEventListener("abort", abortFromLifecycle);
+            if (rejectOnAbort !== undefined) {
+                attemptController.signal.removeEventListener("abort", rejectOnAbort);
+            }
+        }
+    }
     async resolveSnapshot(digest, cache) {
         const digestKey = bytesKey(digest);
         if (this.acceptedHead?.digestKey === digestKey) {
@@ -271,16 +398,7 @@ export class TrustedNetworkV2PolicyReducer {
             return copySnapshot(pending.snapshot);
         let resolution = cache?.get(digestKey);
         if (resolution === undefined) {
-            resolution = (async () => {
-                const entry = await this.resolvePolicyEntry(copyBytes(digest));
-                if (entry === undefined)
-                    return undefined;
-                const snapshot = await authenticatePolicySnapshotEntryV2(entry, this.descriptor);
-                if (!equals(snapshot.digest, digest)) {
-                    throw new Error("Policy resolver returned the wrong body digest");
-                }
-                return snapshot;
-            })();
+            resolution = this.resolveExternalSnapshot(digest);
             cache?.set(digestKey, resolution);
         }
         const snapshot = await resolution;
@@ -300,9 +418,9 @@ export class TrustedNetworkV2PolicyReducer {
         }
         catch (error) {
             return {
-                status: "reject",
+                status: "unavailable",
                 digest: copyBytes(child.body.previousPolicyDigest),
-                reason: `Policy parent validation failed: ${validationMessage(error)}`,
+                reason: `Policy parent dependency is unavailable: ${validationMessage(error)}`,
             };
         }
         if (parent === undefined) {
@@ -320,13 +438,24 @@ export class TrustedNetworkV2PolicyReducer {
         }
         return { status: "found", parent };
     }
+    candidateAncestryResult(resolution) {
+        return resolution.status === "unavailable"
+            ? {
+                status: "missing",
+                digest: copyBytes(resolution.digest),
+                reason: resolution.reason,
+            }
+            : resolution;
+    }
     acceptedAncestryUnavailable(resolution) {
         return {
             status: "unavailable",
             digest: copyBytes(resolution.digest),
             reason: resolution.status === "missing"
                 ? "Accepted policy ancestry is unavailable from the resolver"
-                : `Accepted policy ancestry validation failed: ${resolution.reason}`,
+                : resolution.status === "unavailable"
+                    ? `Accepted policy ancestry is unavailable: ${resolution.reason}`
+                    : `Accepted policy ancestry validation failed: ${resolution.reason}`,
         };
     }
     async evaluate(candidate) {
@@ -335,8 +464,9 @@ export class TrustedNetworkV2PolicyReducer {
             let cursor = candidate;
             while (cursor.body.sequence !== 0n) {
                 const parent = await this.parentOf(cursor, resolutionCache);
-                if (parent.status !== "found")
-                    return parent;
+                if (parent.status !== "found") {
+                    return this.candidateAncestryResult(parent);
+                }
                 cursor = parent.parent;
             }
             return { status: "accept" };
@@ -348,8 +478,9 @@ export class TrustedNetworkV2PolicyReducer {
         while (candidateCursor.body.sequence > acceptedCursor.body.sequence) {
             candidateChild = candidateCursor;
             const parent = await this.parentOf(candidateCursor, resolutionCache);
-            if (parent.status !== "found")
-                return parent;
+            if (parent.status !== "found") {
+                return this.candidateAncestryResult(parent);
+            }
             candidateCursor = parent.parent;
         }
         while (acceptedCursor.body.sequence > candidateCursor.body.sequence) {
@@ -377,8 +508,9 @@ export class TrustedNetworkV2PolicyReducer {
             if (acceptedParent.status !== "found") {
                 return this.acceptedAncestryUnavailable(acceptedParent);
             }
-            if (candidateParent.status !== "found")
-                return candidateParent;
+            if (candidateParent.status !== "found") {
+                return this.candidateAncestryResult(candidateParent);
+            }
             candidateCursor = candidateParent.parent;
             acceptedCursor = acceptedParent.parent;
         }
@@ -490,6 +622,9 @@ export class TrustedNetworkV2PolicyReducer {
         return retention;
     }
     async drainPending() {
+        if (this.lifecycleController.signal.aborted) {
+            return { status: "halted" };
+        }
         let accepted = false;
         let progress = true;
         while (progress &&
@@ -502,6 +637,9 @@ export class TrustedNetworkV2PolicyReducer {
                 if (!this.pending.has(pending.snapshot.digestKey))
                     continue;
                 const evaluation = await this.evaluate(pending.snapshot);
+                if (this.lifecycleController.signal.aborted) {
+                    return { status: "halted" };
+                }
                 if (evaluation.status === "missing") {
                     pending.missingParentDigest = copyBytes(evaluation.digest);
                     continue;
@@ -525,24 +663,47 @@ export class TrustedNetworkV2PolicyReducer {
         return accepted ? { status: "accepted" } : undefined;
     }
     enqueueAdmission(operation) {
-        const result = this.admissionTail.then(operation);
+        const result = this.admissionTail.then(async () => {
+            if (this.lifecycleController.signal.aborted) {
+                return this.haltedResult();
+            }
+            const admission = await operation();
+            return this.lifecycleController.signal.aborted
+                ? this.haltedResult()
+                : admission;
+        });
         this.admissionTail = result.then(() => { }, (_reason) => { });
         return result;
     }
-    ingest(entry) {
-        return this.enqueueAdmission(() => this.ingestOne(entry));
+    ingest(entryBytes) {
+        if (this.lifecycleController.signal.aborted) {
+            return Promise.resolve(this.haltedResult());
+        }
+        let capturedEntryBytes;
+        try {
+            // Capture at the API boundary, before this admission waits behind earlier
+            // work. Otherwise a caller could mutate a queued entry before validation.
+            capturedEntryBytes = capturePolicySnapshotEntryBytesV2(entryBytes);
+        }
+        catch (error) {
+            const reason = validationMessage(error);
+            return this.enqueueAdmission(async () => this.result("rejected", reason));
+        }
+        return this.enqueueAdmission(() => this.ingestOne(capturedEntryBytes));
     }
     retryUnavailable() {
         return this.enqueueAdmission(() => this.retryUnavailableOne());
     }
-    async ingestOne(entry) {
+    async ingestOne(entryBytes) {
         let snapshot;
         try {
-            snapshot = await authenticatePolicySnapshotEntryV2(entry, this.descriptor);
+            snapshot = await authenticateCapturedPolicySnapshotEntryV2(entryBytes, this.descriptor);
         }
         catch (error) {
             return this.result("rejected", validationMessage(error));
         }
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (this.fork !== undefined) {
             this.observeAfterFork(snapshot);
             return this.result("halted", "Policy reducer is halted by authority equivocation");
@@ -566,6 +727,8 @@ export class TrustedNetworkV2PolicyReducer {
             return this.result("pending", "Policy snapshot is already pending");
         }
         const evaluation = await this.evaluate(snapshot);
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (evaluation.status === "reject") {
             return this.result("rejected", evaluation.reason);
         }
@@ -583,7 +746,7 @@ export class TrustedNetworkV2PolicyReducer {
         if (evaluation.status === "missing") {
             const pending = this.addPending(snapshot, evaluation.digest);
             return this.result(pending.retained ? "pending" : "capacity", pending.retained
-                ? "Policy parent is missing"
+                ? (evaluation.reason ?? "Policy parent is missing")
                 : "Policy pending capacity did not retain this candidate", pending.evictedPolicyDigests);
         }
         this.project(snapshot);
@@ -591,6 +754,8 @@ export class TrustedNetworkV2PolicyReducer {
             this.result("accepted"));
     }
     async retryUnavailableOne() {
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (this.fork !== undefined) {
             return this.result("halted", "Policy reducer is halted by authority equivocation");
         }
@@ -603,6 +768,8 @@ export class TrustedNetworkV2PolicyReducer {
             return this.result("capacity", "Unavailable comparison candidate is not retained; re-ingest it before retrying");
         }
         const evaluation = await this.evaluate(pending.snapshot);
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (evaluation.status === "unavailable") {
             pending.missingParentDigest = copyBytes(evaluation.digest);
             this.unavailable = {
@@ -618,7 +785,7 @@ export class TrustedNetworkV2PolicyReducer {
         if (evaluation.status === "missing") {
             pending.missingParentDigest = copyBytes(evaluation.digest);
             status = "pending";
-            reason = "Policy parent is missing";
+            reason = evaluation.reason ?? "Policy parent is missing";
         }
         else {
             this.pending.delete(pending.snapshot.digestKey);