@peerbit/trusted-network 6.0.104 → 6.0.106

package/dist/src/v2-policy-anchor.js

@@ -0,0 +1,990 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+import { deserialize, field, fixedArray, serialize, variant, } from "@dao-xyz/borsh";
+import { PublicSignKey, sha256Sync } from "@peerbit/crypto";
+import { compare, concat, equals } from "uint8arrays";
+import { TrustedNetworkV2PolicyReducer, authenticatePolicySnapshotEntryV2, } from "./v2-policy-engine.js";
+import { NetworkDescriptorV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS, TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES, assertNetworkDescriptorV2, } from "./v2.js";
+/**
+ * Internal crash-safe policy-anchor storage format.
+ *
+ * This module is intentionally absent from the package entry point. Its store
+ * must already be open and scoped to this namespace and descriptor. Exactly
+ * one wrapper may write that scope: this append-only format deliberately does
+ * not pretend that get-then-put is a multi-process compare-and-swap.
+ */
+export const TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER = "peerbit/trusted-network/v2/policy-anchor/v1";
+export const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 4;
+const GENERATION_KEY_PREFIX = `${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/generation/`;
+const FORMAT_VERSION = 1;
+const MAX_U64 = 0xffffffffffffffffn;
+const MAX_UNAVAILABLE_REASON_LENGTH = 512;
+const ZERO_DIGEST = new Uint8Array(32);
+const textEncoder = new TextEncoder();
+const DESCRIPTOR_DIGEST_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/descriptor/v1");
+const GENERATION_CHECKSUM_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/generation/v1");
+const ANCHOR_STATE = Object.freeze({
+    ACTIVE: 1,
+    UNAVAILABLE: 2,
+    FORKED: 3,
+});
+const GENERATION_KIND = Object.freeze({
+    STATE: 1,
+    FORK_OBSERVATION: 2,
+});
+const MAX_STATE_GENERATION_PAYLOAD_BYTES = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 4;
+const MAX_OBSERVATION_GENERATION_PAYLOAD_BYTES = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES + 1024;
+let PolicyAnchorCoreStateRecordV2 = (() => {
+    let _classDecorators = [variant([2, 16, 0])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _state_decorators;
+    let _state_initializers = [];
+    let _state_extraInitializers = [];
+    let _acceptedHeadEntryBytes_decorators;
+    let _acceptedHeadEntryBytes_initializers = [];
+    let _acceptedHeadEntryBytes_extraInitializers = [];
+    let _comparisonCandidateEntryBytes_decorators;
+    let _comparisonCandidateEntryBytes_initializers = [];
+    let _comparisonCandidateEntryBytes_extraInitializers = [];
+    let _acceptedAncestorDigest_decorators;
+    let _acceptedAncestorDigest_initializers = [];
+    let _acceptedAncestorDigest_extraInitializers = [];
+    let _unavailableReason_decorators;
+    let _unavailableReason_initializers = [];
+    let _unavailableReason_extraInitializers = [];
+    let _forkChildEntryBytes0_decorators;
+    let _forkChildEntryBytes0_initializers = [];
+    let _forkChildEntryBytes0_extraInitializers = [];
+    let _forkChildEntryBytes1_decorators;
+    let _forkChildEntryBytes1_initializers = [];
+    let _forkChildEntryBytes1_extraInitializers = [];
+    var PolicyAnchorCoreStateRecordV2 = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _state_decorators = [field({ type: "u8" })];
+            _acceptedHeadEntryBytes_decorators = [field({ type: Uint8Array })];
+            _comparisonCandidateEntryBytes_decorators = [field({ type: Uint8Array })];
+            _acceptedAncestorDigest_decorators = [field({ type: fixedArray("u8", 32) })];
+            _unavailableReason_decorators = [field({ type: "string" })];
+            _forkChildEntryBytes0_decorators = [field({ type: Uint8Array })];
+            _forkChildEntryBytes1_decorators = [field({ type: Uint8Array })];
+            __esDecorate(null, null, _state_decorators, { kind: "field", name: "state", static: false, private: false, access: { has: obj => "state" in obj, get: obj => obj.state, set: (obj, value) => { obj.state = value; } }, metadata: _metadata }, _state_initializers, _state_extraInitializers);
+            __esDecorate(null, null, _acceptedHeadEntryBytes_decorators, { kind: "field", name: "acceptedHeadEntryBytes", static: false, private: false, access: { has: obj => "acceptedHeadEntryBytes" in obj, get: obj => obj.acceptedHeadEntryBytes, set: (obj, value) => { obj.acceptedHeadEntryBytes = value; } }, metadata: _metadata }, _acceptedHeadEntryBytes_initializers, _acceptedHeadEntryBytes_extraInitializers);
+            __esDecorate(null, null, _comparisonCandidateEntryBytes_decorators, { kind: "field", name: "comparisonCandidateEntryBytes", static: false, private: false, access: { has: obj => "comparisonCandidateEntryBytes" in obj, get: obj => obj.comparisonCandidateEntryBytes, set: (obj, value) => { obj.comparisonCandidateEntryBytes = value; } }, metadata: _metadata }, _comparisonCandidateEntryBytes_initializers, _comparisonCandidateEntryBytes_extraInitializers);
+            __esDecorate(null, null, _acceptedAncestorDigest_decorators, { kind: "field", name: "acceptedAncestorDigest", static: false, private: false, access: { has: obj => "acceptedAncestorDigest" in obj, get: obj => obj.acceptedAncestorDigest, set: (obj, value) => { obj.acceptedAncestorDigest = value; } }, metadata: _metadata }, _acceptedAncestorDigest_initializers, _acceptedAncestorDigest_extraInitializers);
+            __esDecorate(null, null, _unavailableReason_decorators, { kind: "field", name: "unavailableReason", static: false, private: false, access: { has: obj => "unavailableReason" in obj, get: obj => obj.unavailableReason, set: (obj, value) => { obj.unavailableReason = value; } }, metadata: _metadata }, _unavailableReason_initializers, _unavailableReason_extraInitializers);
+            __esDecorate(null, null, _forkChildEntryBytes0_decorators, { kind: "field", name: "forkChildEntryBytes0", static: false, private: false, access: { has: obj => "forkChildEntryBytes0" in obj, get: obj => obj.forkChildEntryBytes0, set: (obj, value) => { obj.forkChildEntryBytes0 = value; } }, metadata: _metadata }, _forkChildEntryBytes0_initializers, _forkChildEntryBytes0_extraInitializers);
+            __esDecorate(null, null, _forkChildEntryBytes1_decorators, { kind: "field", name: "forkChildEntryBytes1", static: false, private: false, access: { has: obj => "forkChildEntryBytes1" in obj, get: obj => obj.forkChildEntryBytes1, set: (obj, value) => { obj.forkChildEntryBytes1 = value; } }, metadata: _metadata }, _forkChildEntryBytes1_initializers, _forkChildEntryBytes1_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            PolicyAnchorCoreStateRecordV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        state = __runInitializers(this, _state_initializers, void 0);
+        acceptedHeadEntryBytes = (__runInitializers(this, _state_extraInitializers), __runInitializers(this, _acceptedHeadEntryBytes_initializers, void 0));
+        comparisonCandidateEntryBytes = (__runInitializers(this, _acceptedHeadEntryBytes_extraInitializers), __runInitializers(this, _comparisonCandidateEntryBytes_initializers, void 0));
+        acceptedAncestorDigest = (__runInitializers(this, _comparisonCandidateEntryBytes_extraInitializers), __runInitializers(this, _acceptedAncestorDigest_initializers, void 0));
+        unavailableReason = (__runInitializers(this, _acceptedAncestorDigest_extraInitializers), __runInitializers(this, _unavailableReason_initializers, void 0));
+        forkChildEntryBytes0 = (__runInitializers(this, _unavailableReason_extraInitializers), __runInitializers(this, _forkChildEntryBytes0_initializers, void 0));
+        forkChildEntryBytes1 = (__runInitializers(this, _forkChildEntryBytes0_extraInitializers), __runInitializers(this, _forkChildEntryBytes1_initializers, void 0));
+        constructor(properties) {
+            __runInitializers(this, _forkChildEntryBytes1_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+    return PolicyAnchorCoreStateRecordV2 = _classThis;
+})();
+let PolicyAnchorStateGenerationPayloadV2 = (() => {
+    let _classDecorators = [variant([2, 16, 3])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _coreState_decorators;
+    let _coreState_initializers = [];
+    let _coreState_extraInitializers = [];
+    var PolicyAnchorStateGenerationPayloadV2 = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _coreState_decorators = [field({ type: PolicyAnchorCoreStateRecordV2 })];
+            __esDecorate(null, null, _coreState_decorators, { kind: "field", name: "coreState", static: false, private: false, access: { has: obj => "coreState" in obj, get: obj => obj.coreState, set: (obj, value) => { obj.coreState = value; } }, metadata: _metadata }, _coreState_initializers, _coreState_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            PolicyAnchorStateGenerationPayloadV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        coreState = __runInitializers(this, _coreState_initializers, void 0);
+        constructor(properties) {
+            __runInitializers(this, _coreState_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+    return PolicyAnchorStateGenerationPayloadV2 = _classThis;
+})();
+let PolicyAnchorObservationGenerationPayloadV2 = (() => {
+    let _classDecorators = [variant([2, 16, 4])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _entryBytes_decorators;
+    let _entryBytes_initializers = [];
+    let _entryBytes_extraInitializers = [];
+    var PolicyAnchorObservationGenerationPayloadV2 = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _entryBytes_decorators = [field({ type: Uint8Array })];
+            __esDecorate(null, null, _entryBytes_decorators, { kind: "field", name: "entryBytes", static: false, private: false, access: { has: obj => "entryBytes" in obj, get: obj => obj.entryBytes, set: (obj, value) => { obj.entryBytes = value; } }, metadata: _metadata }, _entryBytes_initializers, _entryBytes_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            PolicyAnchorObservationGenerationPayloadV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        entryBytes = __runInitializers(this, _entryBytes_initializers, void 0);
+        constructor(properties) {
+            __runInitializers(this, _entryBytes_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+    return PolicyAnchorObservationGenerationPayloadV2 = _classThis;
+})();
+let PolicyAnchorGenerationBodyV2 = (() => {
+    let _classDecorators = [variant([2, 16, 1])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _formatVersion_decorators;
+    let _formatVersion_initializers = [];
+    let _formatVersion_extraInitializers = [];
+    let _generation_decorators;
+    let _generation_initializers = [];
+    let _generation_extraInitializers = [];
+    let _descriptorDigest_decorators;
+    let _descriptorDigest_initializers = [];
+    let _descriptorDigest_extraInitializers = [];
+    let _previousGenerationChecksum_decorators;
+    let _previousGenerationChecksum_initializers = [];
+    let _previousGenerationChecksum_extraInitializers = [];
+    let _kind_decorators;
+    let _kind_initializers = [];
+    let _kind_extraInitializers = [];
+    let _payloadBytes_decorators;
+    let _payloadBytes_initializers = [];
+    let _payloadBytes_extraInitializers = [];
+    var PolicyAnchorGenerationBodyV2 = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _formatVersion_decorators = [field({ type: "u8" })];
+            _generation_decorators = [field({ type: "u64" })];
+            _descriptorDigest_decorators = [field({ type: fixedArray("u8", 32) })];
+            _previousGenerationChecksum_decorators = [field({ type: fixedArray("u8", 32) })];
+            _kind_decorators = [field({ type: "u8" })];
+            _payloadBytes_decorators = [field({ type: Uint8Array })];
+            __esDecorate(null, null, _formatVersion_decorators, { kind: "field", name: "formatVersion", static: false, private: false, access: { has: obj => "formatVersion" in obj, get: obj => obj.formatVersion, set: (obj, value) => { obj.formatVersion = value; } }, metadata: _metadata }, _formatVersion_initializers, _formatVersion_extraInitializers);
+            __esDecorate(null, null, _generation_decorators, { kind: "field", name: "generation", static: false, private: false, access: { has: obj => "generation" in obj, get: obj => obj.generation, set: (obj, value) => { obj.generation = value; } }, metadata: _metadata }, _generation_initializers, _generation_extraInitializers);
+            __esDecorate(null, null, _descriptorDigest_decorators, { kind: "field", name: "descriptorDigest", static: false, private: false, access: { has: obj => "descriptorDigest" in obj, get: obj => obj.descriptorDigest, set: (obj, value) => { obj.descriptorDigest = value; } }, metadata: _metadata }, _descriptorDigest_initializers, _descriptorDigest_extraInitializers);
+            __esDecorate(null, null, _previousGenerationChecksum_decorators, { kind: "field", name: "previousGenerationChecksum", static: false, private: false, access: { has: obj => "previousGenerationChecksum" in obj, get: obj => obj.previousGenerationChecksum, set: (obj, value) => { obj.previousGenerationChecksum = value; } }, metadata: _metadata }, _previousGenerationChecksum_initializers, _previousGenerationChecksum_extraInitializers);
+            __esDecorate(null, null, _kind_decorators, { kind: "field", name: "kind", static: false, private: false, access: { has: obj => "kind" in obj, get: obj => obj.kind, set: (obj, value) => { obj.kind = value; } }, metadata: _metadata }, _kind_initializers, _kind_extraInitializers);
+            __esDecorate(null, null, _payloadBytes_decorators, { kind: "field", name: "payloadBytes", static: false, private: false, access: { has: obj => "payloadBytes" in obj, get: obj => obj.payloadBytes, set: (obj, value) => { obj.payloadBytes = value; } }, metadata: _metadata }, _payloadBytes_initializers, _payloadBytes_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            PolicyAnchorGenerationBodyV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        formatVersion = __runInitializers(this, _formatVersion_initializers, void 0);
+        generation = (__runInitializers(this, _formatVersion_extraInitializers), __runInitializers(this, _generation_initializers, void 0));
+        descriptorDigest = (__runInitializers(this, _generation_extraInitializers), __runInitializers(this, _descriptorDigest_initializers, void 0));
+        previousGenerationChecksum = (__runInitializers(this, _descriptorDigest_extraInitializers), __runInitializers(this, _previousGenerationChecksum_initializers, void 0));
+        kind = (__runInitializers(this, _previousGenerationChecksum_extraInitializers), __runInitializers(this, _kind_initializers, void 0));
+        payloadBytes = (__runInitializers(this, _kind_extraInitializers), __runInitializers(this, _payloadBytes_initializers, void 0));
+        constructor(properties) {
+            __runInitializers(this, _payloadBytes_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+    return PolicyAnchorGenerationBodyV2 = _classThis;
+})();
+let PolicyAnchorGenerationRecordV2 = (() => {
+    let _classDecorators = [variant([2, 16, 2])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _body_decorators;
+    let _body_initializers = [];
+    let _body_extraInitializers = [];
+    let _checksum_decorators;
+    let _checksum_initializers = [];
+    let _checksum_extraInitializers = [];
+    var PolicyAnchorGenerationRecordV2 = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _body_decorators = [field({ type: PolicyAnchorGenerationBodyV2 })];
+            _checksum_decorators = [field({ type: fixedArray("u8", 32) })];
+            __esDecorate(null, null, _body_decorators, { kind: "field", name: "body", static: false, private: false, access: { has: obj => "body" in obj, get: obj => obj.body, set: (obj, value) => { obj.body = value; } }, metadata: _metadata }, _body_initializers, _body_extraInitializers);
+            __esDecorate(null, null, _checksum_decorators, { kind: "field", name: "checksum", static: false, private: false, access: { has: obj => "checksum" in obj, get: obj => obj.checksum, set: (obj, value) => { obj.checksum = value; } }, metadata: _metadata }, _checksum_initializers, _checksum_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            PolicyAnchorGenerationRecordV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        body = __runInitializers(this, _body_initializers, void 0);
+        checksum = (__runInitializers(this, _body_extraInitializers), __runInitializers(this, _checksum_initializers, void 0));
+        constructor(properties) {
+            __runInitializers(this, _checksum_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+    return PolicyAnchorGenerationRecordV2 = _classThis;
+})();
+const copyBytes = (bytes) => Uint8Array.from(bytes);
+const bytesKey = (bytes) => {
+    let key = "";
+    for (const byte of bytes)
+        key += byte.toString(16).padStart(2, "0");
+    return key;
+};
+const copyBinding = (binding) => deserialize(serialize(binding), PolicySubjectBindingV2);
+const copyHead = (head) => head === undefined
+    ? undefined
+    : {
+        sequence: head.sequence,
+        digest: copyBytes(head.digest),
+        bindings: head.bindings.map(copyBinding),
+    };
+const copyForkEvidence = (evidence) => evidence === undefined
+    ? undefined
+    : {
+        commonParent: copyHead(evidence.commonParent),
+        children: [
+            {
+                sequence: evidence.children[0].sequence,
+                digest: copyBytes(evidence.children[0].digest),
+                entryBytes: copyBytes(evidence.children[0].entryBytes),
+            },
+            {
+                sequence: evidence.children[1].sequence,
+                digest: copyBytes(evidence.children[1].digest),
+                entryBytes: copyBytes(evidence.children[1].entryBytes),
+            },
+        ],
+    };
+const keyId = (key) => bytesKey(serialize(key));
+const descriptorDigest = (descriptor) => sha256Sync(concat([DESCRIPTOR_DIGEST_DOMAIN, serialize(descriptor)]));
+const generationChecksum = (body) => sha256Sync(concat([GENERATION_CHECKSUM_DOMAIN, serialize(body)]));
+const observationContentHash = (entryBytes) => sha256Sync(entryBytes);
+const generationKey = (generation) => `${GENERATION_KEY_PREFIX}${generation.toString().padStart(20, "0")}`;
+const assertOpenNotAborted = (signal) => {
+    if (signal?.aborted) {
+        throw new Error("TrustedNetwork v2 durable policy open was aborted");
+    }
+};
+const assertEntryBytes = (bytes, label) => {
+    if (!(bytes instanceof Uint8Array) ||
+        bytes.byteLength === 0 ||
+        bytes.byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES) {
+        throw new Error(`${label} must contain 1-${TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES} bytes`);
+    }
+};
+const retainCanonicalForkChild = (children, candidate) => {
+    const existingIndex = children.findIndex(({ digest }) => equals(digest, candidate.digest));
+    if (existingIndex >= 0) {
+        if (compare(candidate.entryBytes, children[existingIndex].entryBytes) >= 0) {
+            return;
+        }
+        children.splice(existingIndex, 1);
+    }
+    children.push({
+        digest: copyBytes(candidate.digest),
+        entryBytes: copyBytes(candidate.entryBytes),
+    });
+    children.sort((left, right) => {
+        const digestOrder = compare(left.digest, right.digest);
+        return digestOrder === 0
+            ? compare(left.entryBytes, right.entryBytes)
+            : digestOrder;
+    });
+    if (children.length > 2)
+        children.length = 2;
+};
+const assertEmptyBytes = (bytes, label) => {
+    if (!(bytes instanceof Uint8Array) || bytes.byteLength !== 0) {
+        throw new Error(`${label} must be empty`);
+    }
+};
+const coreRecordFromState = (state) => {
+    if (state.state === "ACTIVE") {
+        return new PolicyAnchorCoreStateRecordV2({
+            state: ANCHOR_STATE.ACTIVE,
+            acceptedHeadEntryBytes: copyBytes(state.acceptedHeadEntryBytes),
+            comparisonCandidateEntryBytes: new Uint8Array(0),
+            acceptedAncestorDigest: copyBytes(ZERO_DIGEST),
+            unavailableReason: "",
+            forkChildEntryBytes0: new Uint8Array(0),
+            forkChildEntryBytes1: new Uint8Array(0),
+        });
+    }
+    if (state.state === "UNAVAILABLE") {
+        return new PolicyAnchorCoreStateRecordV2({
+            state: ANCHOR_STATE.UNAVAILABLE,
+            acceptedHeadEntryBytes: copyBytes(state.acceptedHeadEntryBytes),
+            comparisonCandidateEntryBytes: copyBytes(state.comparisonCandidateEntryBytes),
+            acceptedAncestorDigest: copyBytes(state.acceptedAncestorDigest),
+            unavailableReason: state.reason,
+            forkChildEntryBytes0: new Uint8Array(0),
+            forkChildEntryBytes1: new Uint8Array(0),
+        });
+    }
+    return new PolicyAnchorCoreStateRecordV2({
+        state: ANCHOR_STATE.FORKED,
+        acceptedHeadEntryBytes: copyBytes(state.commonParentEntryBytes),
+        comparisonCandidateEntryBytes: new Uint8Array(0),
+        acceptedAncestorDigest: copyBytes(ZERO_DIGEST),
+        unavailableReason: "",
+        forkChildEntryBytes0: copyBytes(state.childEntryBytes[0]),
+        forkChildEntryBytes1: copyBytes(state.childEntryBytes[1]),
+    });
+};
+const durableStateFromCoreRecord = (record) => {
+    assertEntryBytes(record.acceptedHeadEntryBytes, "accepted head entry");
+    if (record.state === ANCHOR_STATE.ACTIVE) {
+        assertEmptyBytes(record.comparisonCandidateEntryBytes, "active comparison candidate");
+        if (!equals(record.acceptedAncestorDigest, ZERO_DIGEST)) {
+            throw new Error("Active accepted-ancestor digest must be zero");
+        }
+        if (record.unavailableReason !== "") {
+            throw new Error("Active unavailable reason must be empty");
+        }
+        assertEmptyBytes(record.forkChildEntryBytes0, "active fork child 0");
+        assertEmptyBytes(record.forkChildEntryBytes1, "active fork child 1");
+        return {
+            formatVersion: FORMAT_VERSION,
+            state: "ACTIVE",
+            acceptedHeadEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
+        };
+    }
+    if (record.state === ANCHOR_STATE.UNAVAILABLE) {
+        assertEntryBytes(record.comparisonCandidateEntryBytes, "unavailable comparison candidate");
+        if (record.acceptedAncestorDigest.byteLength !== 32) {
+            throw new Error("Unavailable accepted-ancestor digest must be 32 bytes");
+        }
+        if (record.unavailableReason.length === 0 ||
+            record.unavailableReason.length > MAX_UNAVAILABLE_REASON_LENGTH) {
+            throw new Error("Unavailable reason is empty or exceeds its character ceiling");
+        }
+        assertEmptyBytes(record.forkChildEntryBytes0, "unavailable fork child 0");
+        assertEmptyBytes(record.forkChildEntryBytes1, "unavailable fork child 1");
+        return {
+            formatVersion: FORMAT_VERSION,
+            state: "UNAVAILABLE",
+            acceptedHeadEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
+            comparisonCandidateEntryBytes: copyBytes(record.comparisonCandidateEntryBytes),
+            acceptedAncestorDigest: copyBytes(record.acceptedAncestorDigest),
+            reason: record.unavailableReason,
+        };
+    }
+    if (record.state === ANCHOR_STATE.FORKED) {
+        assertEmptyBytes(record.comparisonCandidateEntryBytes, "forked comparison candidate");
+        if (!equals(record.acceptedAncestorDigest, ZERO_DIGEST)) {
+            throw new Error("Forked accepted-ancestor digest must be zero");
+        }
+        if (record.unavailableReason !== "") {
+            throw new Error("Forked unavailable reason must be empty");
+        }
+        assertEntryBytes(record.forkChildEntryBytes0, "fork child 0");
+        assertEntryBytes(record.forkChildEntryBytes1, "fork child 1");
+        return {
+            formatVersion: FORMAT_VERSION,
+            state: "FORKED",
+            commonParentEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
+            childEntryBytes: [
+                copyBytes(record.forkChildEntryBytes0),
+                copyBytes(record.forkChildEntryBytes1),
+            ],
+        };
+    }
+    throw new Error("Unknown durable policy-anchor state");
+};
+const decodeCanonicalPayload = (input, type, maxBytes, label) => {
+    if (!(input instanceof Uint8Array) ||
+        input.byteLength === 0 ||
+        input.byteLength > maxBytes) {
+        throw new Error(`${label} exceeds its byte ceiling`);
+    }
+    const bytes = copyBytes(input);
+    const payload = deserialize(bytes, type);
+    if (!equals(bytes, serialize(payload))) {
+        throw new Error(`${label} is not canonical`);
+    }
+    return payload;
+};
+const decodeGenerationPayload = (body) => {
+    if (body.kind === GENERATION_KIND.STATE) {
+        const payload = decodeCanonicalPayload(body.payloadBytes, PolicyAnchorStateGenerationPayloadV2, MAX_STATE_GENERATION_PAYLOAD_BYTES, "Policy-anchor state payload");
+        return {
+            kind: "state",
+            payload,
+            durableState: durableStateFromCoreRecord(payload.coreState),
+        };
+    }
+    if (body.kind === GENERATION_KIND.FORK_OBSERVATION) {
+        const payload = decodeCanonicalPayload(body.payloadBytes, PolicyAnchorObservationGenerationPayloadV2, MAX_OBSERVATION_GENERATION_PAYLOAD_BYTES, "Policy fork-observation payload");
+        assertEntryBytes(payload.entryBytes, "fork observation entry");
+        return { kind: "fork-observation", payload };
+    }
+    throw new Error("Unknown policy-anchor generation kind");
+};
+const decodeGenerationRecord = (input) => {
+    if (!(input instanceof Uint8Array) ||
+        input.byteLength === 0 ||
+        input.byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
+        throw new Error("Policy-anchor generation record exceeds its byte ceiling");
+    }
+    const bytes = copyBytes(input);
+    const record = deserialize(bytes, PolicyAnchorGenerationRecordV2);
+    if (!equals(bytes, serialize(record))) {
+        throw new Error("Policy-anchor generation record is not canonical");
+    }
+    if (record.body.formatVersion !== FORMAT_VERSION) {
+        throw new Error("Unsupported policy-anchor generation format");
+    }
+    if (!equals(record.checksum, generationChecksum(record.body))) {
+        throw new Error("Policy-anchor generation checksum mismatch");
+    }
+    return { record, payload: decodeGenerationPayload(record.body) };
+};
+const publishedFromReducer = (reducer) => {
+    if (reducer.state === "HALTED") {
+        throw new Error("Cannot publish a halted policy reducer");
+    }
+    const head = copyHead(reducer.head);
+    const roles = new Map();
+    for (const binding of head?.bindings ?? []) {
+        roles.set(keyId(binding.signingKey), binding.roles);
+    }
+    return {
+        state: reducer.state,
+        head,
+        forkEvidence: copyForkEvidence(reducer.forkEvidence),
+        roles,
+    };
+};
+const assertCanonicalCoreRestore = (reducer, storedCoreBytes) => {
+    const restoredState = reducer.exportDurableState();
+    if (restoredState.state === "EMPTY") {
+        throw new Error("Restored policy-anchor state is unexpectedly empty");
+    }
+    const restoredCoreBytes = serialize(coreRecordFromState(restoredState));
+    if (!equals(restoredCoreBytes, storedCoreBytes)) {
+        throw new Error("Restored policy-anchor state is not canonical");
+    }
+};
+/**
+ * Crash-safe publication wrapper for the internal v2 reducer.
+ *
+ * The mutable reducer is never exposed. Authorization reads use only the last
+ * projection published after the store barrier. An admission places a
+ * fail-closed fence around both reducer mutation and durable publication.
+ */
+export class TrustedNetworkV2DurablePolicyReducer {
+    store;
+    durability;
+    descriptor;
+    descriptorHash;
+    core;
+    published;
+    generation = 0n;
+    previousGenerationChecksum = copyBytes(ZERO_DIGEST);
+    durableCoreBytes;
+    observedHashes = new Set();
+    operationTail = Promise.resolve();
+    authorizationFences = 0;
+    terminalError;
+    constructor(properties) {
+        this.store = properties.store;
+        this.durability = properties.durability;
+        this.descriptor = deserialize(serialize(properties.descriptor), NetworkDescriptorV2);
+        this.descriptorHash = descriptorDigest(this.descriptor);
+        this.core = properties.core;
+        this.published = publishedFromReducer(this.core);
+        this.generation = properties.generation ?? 0n;
+        this.previousGenerationChecksum = copyBytes(properties.previousGenerationChecksum ?? ZERO_DIGEST);
+        this.durableCoreBytes =
+            properties.durableCoreBytes === undefined
+                ? undefined
+                : copyBytes(properties.durableCoreBytes);
+        this.observedHashes = new Set(properties.observedHashes);
+    }
+    static async open(options) {
+        assertNetworkDescriptorV2(options.descriptor);
+        const descriptor = deserialize(serialize(options.descriptor), NetworkDescriptorV2);
+        const signal = options.signal;
+        const store = options.store;
+        const coreProperties = {
+            descriptor,
+            resolvePolicyEntry: options.resolvePolicyEntry,
+            resolveTimeoutMs: options.resolveTimeoutMs,
+            signal,
+            maxPending: options.maxPending,
+            maxPendingPolicyBytes: options.maxPendingPolicyBytes,
+        };
+        assertOpenNotAborted(signal);
+        const durability = store?.crashSafeDurability;
+        if (durability?.crashSafe !== true ||
+            typeof durability.barrier !== "function") {
+            throw new Error("TrustedNetwork v2 durable policy requires a crash-safe store barrier");
+        }
+        // A successful fresh barrier is required on every open, including an empty
+        // store; a generic flush acknowledgement is not this physical fence.
+        await durability.barrier();
+        assertOpenNotAborted(signal);
+        const expectedDescriptorHash = descriptorDigest(descriptor);
+        // Keep only immutable keys while discovering the history, then use get()
+        // to decode one record at a time. This avoids retaining the raw log and its
+        // decoded payloads together during restore.
+        const generationKeys = [];
+        for await (const [key, input] of store.iterator()) {
+            assertOpenNotAborted(signal);
+            if (key.startsWith(GENERATION_KEY_PREFIX)) {
+                const suffix = key.slice(GENERATION_KEY_PREFIX.length);
+                if (!/^\d{20}$/.test(suffix)) {
+                    throw new Error("Malformed policy-anchor generation key");
+                }
+                if (!(input instanceof Uint8Array) ||
+                    input.byteLength === 0 ||
+                    input.byteLength >
+                        TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
+                    throw new Error("Policy-anchor generation record exceeds its byte ceiling");
+                }
+                const generation = BigInt(suffix);
+                if (generation === 0n || generation > MAX_U64) {
+                    throw new Error("Policy-anchor generation key is outside u64");
+                }
+                generationKeys.push(key);
+                continue;
+            }
+            if (key === TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER ||
+                key.startsWith(`${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/`)) {
+                throw new Error("Unknown policy-anchor record in the owned namespace");
+            }
+        }
+        assertOpenNotAborted(signal);
+        generationKeys.sort();
+        let previousChecksum = copyBytes(ZERO_DIGEST);
+        let latestCoreBytes;
+        let latestDurableState;
+        let core;
+        let durableCoreBytes;
+        let forkEvidence;
+        const observedHashes = new Set();
+        const authenticatedEvidenceEntryByHash = new Map();
+        const canonicalChildren = [];
+        try {
+            for (let index = 0; index < generationKeys.length; index++) {
+                assertOpenNotAborted(signal);
+                const key = generationKeys[index];
+                const expectedGeneration = BigInt(index + 1);
+                const keyedGeneration = BigInt(key.slice(GENERATION_KEY_PREFIX.length));
+                if (keyedGeneration !== expectedGeneration) {
+                    throw new Error("Policy-anchor generation history is gapped");
+                }
+                const input = await store.get(key);
+                assertOpenNotAborted(signal);
+                if (input === undefined) {
+                    throw new Error("Policy-anchor generation disappeared during restore");
+                }
+                const { record, payload } = decodeGenerationRecord(input);
+                if (record.body.generation !== keyedGeneration ||
+                    generationKey(record.body.generation) !== key) {
+                    throw new Error("Policy-anchor generation key does not match record");
+                }
+                if (!equals(record.body.descriptorDigest, expectedDescriptorHash)) {
+                    throw new Error("Policy-anchor generation belongs to another descriptor");
+                }
+                if (!equals(record.body.previousGenerationChecksum, previousChecksum)) {
+                    throw new Error("Policy-anchor generation checksum chain is broken");
+                }
+                if (payload.kind === "state") {
+                    if (latestDurableState?.state === "FORKED") {
+                        throw new Error("A FORKED policy anchor may only append observation deltas");
+                    }
+                    latestCoreBytes = serialize(payload.payload.coreState);
+                    latestDurableState = payload.durableState;
+                    if (latestDurableState.state === "FORKED") {
+                        core = await TrustedNetworkV2PolicyReducer.restore({
+                            ...coreProperties,
+                            durableState: latestDurableState,
+                        });
+                        assertOpenNotAborted(signal);
+                        assertCanonicalCoreRestore(core, latestCoreBytes);
+                        durableCoreBytes = copyBytes(latestCoreBytes);
+                        forkEvidence = core.forkEvidence;
+                        if (forkEvidence === undefined) {
+                            throw new Error("Restored forked policy anchor has no fork evidence");
+                        }
+                        for (const child of forkEvidence.children) {
+                            const hashKey = bytesKey(observationContentHash(child.entryBytes));
+                            const retained = authenticatedEvidenceEntryByHash.get(hashKey);
+                            if (retained !== undefined &&
+                                !equals(retained, child.entryBytes)) {
+                                throw new Error("Policy fork-observation content hash collision");
+                            }
+                            authenticatedEvidenceEntryByHash.set(hashKey, child.entryBytes);
+                            observedHashes.add(hashKey);
+                            retainCanonicalForkChild(canonicalChildren, child);
+                        }
+                    }
+                }
+                else {
+                    if (latestDurableState?.state !== "FORKED" ||
+                        core === undefined ||
+                        forkEvidence === undefined) {
+                        throw new Error("Policy fork-observation delta requires a preceding FORKED state");
+                    }
+                    const entryBytes = payload.payload.entryBytes;
+                    const hashKey = bytesKey(observationContentHash(entryBytes));
+                    if (observedHashes.has(hashKey)) {
+                        const evidenceEntry = authenticatedEvidenceEntryByHash.get(hashKey);
+                        if (evidenceEntry !== undefined &&
+                            !equals(evidenceEntry, entryBytes)) {
+                            throw new Error("Policy fork-observation content hash collision");
+                        }
+                    }
+                    else {
+                        const authenticated = await authenticatePolicySnapshotEntryV2(entryBytes, descriptor);
+                        assertOpenNotAborted(signal);
+                        if (authenticated.body.sequence !==
+                            forkEvidence.commonParent.sequence + 1n ||
+                            !equals(authenticated.body.previousPolicyDigest, forkEvidence.commonParent.digest)) {
+                            throw new Error("Stored policy fork observation is not a direct child of the common parent");
+                        }
+                        observedHashes.add(hashKey);
+                        retainCanonicalForkChild(canonicalChildren, {
+                            digest: authenticated.digest,
+                            entryBytes,
+                        });
+                    }
+                }
+                previousChecksum = copyBytes(record.checksum);
+            }
+            const highestGeneration = generationKeys.length === 0 ? undefined : BigInt(generationKeys.length);
+            if (highestGeneration !== undefined && latestCoreBytes === undefined) {
+                throw new Error("Policy-anchor history has no durable state generation");
+            }
+            if (core === undefined) {
+                if (highestGeneration === undefined) {
+                    core = new TrustedNetworkV2PolicyReducer(coreProperties);
+                }
+                else {
+                    core = await TrustedNetworkV2PolicyReducer.restore({
+                        ...coreProperties,
+                        durableState: latestDurableState,
+                    });
+                    assertOpenNotAborted(signal);
+                    assertCanonicalCoreRestore(core, latestCoreBytes);
+                    durableCoreBytes = copyBytes(latestCoreBytes);
+                }
+            }
+            if (latestDurableState?.state === "FORKED") {
+                if (forkEvidence === undefined) {
+                    throw new Error("Restored forked policy anchor has no fork evidence");
+                }
+                if (canonicalChildren.length !== 2) {
+                    throw new Error("Stored policy fork evidence has fewer than two distinct children");
+                }
+                const normalizedForkState = {
+                    formatVersion: FORMAT_VERSION,
+                    state: "FORKED",
+                    commonParentEntryBytes: copyBytes(latestDurableState.commonParentEntryBytes),
+                    childEntryBytes: [
+                        copyBytes(canonicalChildren[0].entryBytes),
+                        copyBytes(canonicalChildren[1].entryBytes),
+                    ],
+                };
+                const pairChanged = canonicalChildren.some((child, index) => !equals(child.digest, forkEvidence.children[index].digest) ||
+                    !equals(child.entryBytes, forkEvidence.children[index].entryBytes));
+                if (pairChanged) {
+                    core.abort();
+                    core = await TrustedNetworkV2PolicyReducer.restore({
+                        ...coreProperties,
+                        durableState: normalizedForkState,
+                    });
+                    assertOpenNotAborted(signal);
+                    assertCanonicalCoreRestore(core, serialize(coreRecordFromState(normalizedForkState)));
+                }
+                latestDurableState = normalizedForkState;
+                durableCoreBytes = serialize(coreRecordFromState(normalizedForkState));
+            }
+            else if (observedHashes.size !== 0) {
+                throw new Error("Non-forked policy anchor has fork observations");
+            }
+            return new TrustedNetworkV2DurablePolicyReducer({
+                store,
+                durability,
+                descriptor,
+                core,
+                generation: highestGeneration,
+                previousGenerationChecksum: previousChecksum,
+                durableCoreBytes,
+                observedHashes,
+            });
+        }
+        catch (error) {
+            core?.abort();
+            throw error;
+        }
+    }
+    get state() {
+        if (this.terminalError !== undefined || this.core.state === "HALTED") {
+            return "HALTED";
+        }
+        return this.published.state;
+    }
+    get head() {
+        return copyHead(this.published.head);
+    }
+    get forkEvidence() {
+        return copyForkEvidence(this.published.forkEvidence);
+    }
+    get pendingCount() {
+        return this.core.pendingCount;
+    }
+    get pendingBytes() {
+        return this.core.pendingBytes;
+    }
+    get pendingDigests() {
+        return this.core.pendingDigests.map(copyBytes);
+    }
+    /** Projection query only; use isAuthorized() for the fail-closed gate. */
+    rolesFor(subject) {
+        return this.published.roles.get(keyId(subject)) ?? 0;
+    }
+    isAuthorized(subject, roles) {
+        if (this.authorizationFences !== 0 ||
+            this.state !== "ACTIVE" ||
+            !Number.isInteger(roles) ||
+            roles === 0 ||
+            (roles & ~TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS) !== 0) {
+            return false;
+        }
+        return (this.rolesFor(subject) & roles) === roles;
+    }
+    abort() {
+        this.core.abort();
+    }
+    ingest(entryBytes) {
+        const captured = entryBytes instanceof Uint8Array &&
+            entryBytes.byteLength <= TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES
+            ? copyBytes(entryBytes)
+            : entryBytes;
+        return this.enqueue(async () => {
+            const result = await this.core.ingest(captured);
+            await this.persistCorePublication(result);
+            return result;
+        });
+    }
+    retryUnavailable() {
+        return this.enqueue(async () => {
+            const result = await this.core.retryUnavailable();
+            await this.persistCorePublication(result);
+            return result;
+        });
+    }
+    enqueue(operation) {
+        this.authorizationFences++;
+        const result = this.operationTail.then(async () => {
+            if (this.terminalError !== undefined)
+                throw this.terminalError;
+            try {
+                return await operation();
+            }
+            catch (error) {
+                throw this.halt(error);
+            }
+        });
+        this.operationTail = result.then(() => { }, () => { });
+        return result.finally(() => {
+            this.authorizationFences--;
+        });
+    }
+    halt(error) {
+        if (this.terminalError !== undefined)
+            return this.terminalError;
+        const cause = error instanceof Error ? error : new Error(String(error));
+        const terminal = new Error(`TrustedNetwork v2 durable policy publication is ambiguous and halted: ${cause.message}`);
+        terminal.cause = cause;
+        this.terminalError = terminal;
+        this.core.abort();
+        return terminal;
+    }
+    async persistCorePublication(result) {
+        const durableState = this.core.exportDurableState();
+        if (durableState.state === "EMPTY") {
+            if (this.durableCoreBytes !== undefined) {
+                throw this.halt("Durable policy state cannot return to EMPTY");
+            }
+            return;
+        }
+        const coreRecord = coreRecordFromState(durableState);
+        const coreBytes = serialize(coreRecord);
+        // FORKED is terminal. Once its common-parent anchor exists, later child
+        // proofs are observation deltas even when they change the live canonical
+        // pair; reopen derives that pair from the complete delta history.
+        const stateChanged = !(this.published.state === "FORKED" && durableState.state === "FORKED") &&
+            (this.durableCoreBytes === undefined ||
+                !equals(this.durableCoreBytes, coreBytes));
+        const suppliedObservations = new Map();
+        for (const proof of result.forkObservations ?? []) {
+            const contentHash = observationContentHash(proof.entryBytes);
+            const hashKey = bytesKey(contentHash);
+            const retained = suppliedObservations.get(hashKey);
+            if (retained !== undefined && !equals(retained, proof.entryBytes)) {
+                throw this.halt("Policy fork-observation content hash collision");
+            }
+            suppliedObservations.set(hashKey, copyBytes(proof.entryBytes));
+        }
+        if (durableState.state !== "FORKED") {
+            if (suppliedObservations.size !== 0 || this.observedHashes.size !== 0) {
+                throw this.halt("Only a forked policy anchor may contain observations");
+            }
+        }
+        else {
+            for (const entryBytes of durableState.childEntryBytes) {
+                const hashKey = bytesKey(observationContentHash(entryBytes));
+                if (stateChanged)
+                    suppliedObservations.delete(hashKey);
+                else if (!this.observedHashes.has(hashKey) &&
+                    !suppliedObservations.has(hashKey)) {
+                    throw this.halt("Published fork state is missing a canonical observation");
+                }
+            }
+        }
+        for (const hashKey of this.observedHashes) {
+            suppliedObservations.delete(hashKey);
+        }
+        const observationEntries = [...suppliedObservations.entries()]
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([hashKey, entryBytes]) => ({ hashKey, entryBytes }));
+        const recordCount = (stateChanged ? 1 : 0) + observationEntries.length;
+        if (recordCount === 0)
+            return;
+        if (BigInt(recordCount) > MAX_U64 - this.generation) {
+            throw this.halt("Policy-anchor generation exhausted u64");
+        }
+        let nextGeneration = this.generation;
+        let previousChecksum = copyBytes(this.previousGenerationChecksum);
+        const stagedObservedHashes = new Set(this.observedHashes);
+        const drafts = [];
+        if (stateChanged) {
+            const payloadBytes = serialize(new PolicyAnchorStateGenerationPayloadV2({ coreState: coreRecord }));
+            if (payloadBytes.byteLength > MAX_STATE_GENERATION_PAYLOAD_BYTES) {
+                throw this.halt("Policy-anchor state payload exceeds its byte ceiling");
+            }
+            drafts.push({ kind: GENERATION_KIND.STATE, payloadBytes });
+        }
+        for (const { hashKey, entryBytes } of observationEntries) {
+            const payloadBytes = serialize(new PolicyAnchorObservationGenerationPayloadV2({
+                entryBytes: copyBytes(entryBytes),
+            }));
+            if (payloadBytes.byteLength > MAX_OBSERVATION_GENERATION_PAYLOAD_BYTES) {
+                throw this.halt("Policy fork-observation payload exceeds its byte ceiling");
+            }
+            drafts.push({
+                kind: GENERATION_KIND.FORK_OBSERVATION,
+                payloadBytes,
+                applyObservationHash: hashKey,
+            });
+        }
+        for (const draft of drafts) {
+            nextGeneration += 1n;
+            if (draft.kind === GENERATION_KIND.STATE) {
+                if (durableState.state === "FORKED") {
+                    for (const entryBytes of durableState.childEntryBytes) {
+                        stagedObservedHashes.add(bytesKey(observationContentHash(entryBytes)));
+                    }
+                }
+            }
+            else {
+                stagedObservedHashes.add(draft.applyObservationHash);
+            }
+            const body = new PolicyAnchorGenerationBodyV2({
+                formatVersion: FORMAT_VERSION,
+                generation: nextGeneration,
+                descriptorDigest: copyBytes(this.descriptorHash),
+                previousGenerationChecksum: copyBytes(previousChecksum),
+                kind: draft.kind,
+                payloadBytes: copyBytes(draft.payloadBytes),
+            });
+            const record = new PolicyAnchorGenerationRecordV2({
+                body,
+                checksum: generationChecksum(body),
+            });
+            const recordBytes = serialize(record);
+            if (recordBytes.byteLength >
+                TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
+                throw this.halt("Policy-anchor generation record exceeds its byte ceiling");
+            }
+            const key = generationKey(nextGeneration);
+            if ((await this.store.get(key)) !== undefined) {
+                throw this.halt("Policy-anchor generation must never be overwritten");
+            }
+            await this.store.put(key, copyBytes(recordBytes));
+            // Each immutable generation gets one physical fence. The projection is
+            // published only after every state/observation delta is fenced.
+            await this.durability.barrier();
+            previousChecksum = copyBytes(record.checksum);
+        }
+        this.generation = nextGeneration;
+        this.previousGenerationChecksum = previousChecksum;
+        this.durableCoreBytes = copyBytes(coreBytes);
+        this.observedHashes = stagedObservedHashes;
+        try {
+            this.published = publishedFromReducer(this.core);
+        }
+        catch (error) {
+            throw this.halt(error);
+        }
+    }
+}
+//# sourceMappingURL=v2-policy-anchor.js.map