@peerbit/trusted-network 6.0.124 → 6.0.126

package/src/v2-policy-anchor.ts

@@ -58,6 +58,7 @@ export const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES =
 	MAX_CHECKPOINT_PAYLOAD_FRAMING_BYTES_V2;
 const MAX_QUEUED_POLICY_INPUT_BYTES_V2 =
 	TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2;
+const MAX_TIMER_DELAY_MS_V2 = 0x7fffffff;
 const ZERO_DIGEST = new Uint8Array(32);
 const textEncoder = new TextEncoder();
 const CHECKPOINT_SCOPE_DOMAIN = textEncoder.encode(
@@ -69,6 +70,20 @@ const ANCHOR_STATE = Object.freeze({
 	FORKED: 3,
 } as const);
 
+const isAbortSignalV2 = (value: unknown): value is AbortSignal => {
+	if (value === null || typeof value !== "object") return false;
+	try {
+		const signal = value as AbortSignal;
+		return (
+			typeof signal.aborted === "boolean" &&
+			typeof signal.addEventListener === "function" &&
+			typeof signal.removeEventListener === "function"
+		);
+	} catch {
+		return false;
+	}
+};
+
 export type CrashSafePolicyAnchorStoreV2 = CrashSafeAtomicReplaceStore;
 
 type DurableReducerOptionsV2 = {
@@ -88,6 +103,14 @@ export type TrustedNetworkV2DurablePolicyReducerOptions =
 export type PolicyLeaseReferenceV2 = {
 	sequence: bigint;
 	digest: Uint8Array;
+	/** Maximum number of authenticated parent edges traversed for this lease. */
+	maxSteps?: number;
+	/** Absolute wall-clock deadline, in milliseconds since the Unix epoch. */
+	deadline?: number;
+	/** Relative deadline measured from the call, including operation-queue wait. */
+	timeoutMs?: number;
+	/** Cancels acquisition of this lease without halting the durable reducer. */
+	signal?: AbortSignal;
 };
 
 export type AcceptedPolicyLeaseV2 = {
@@ -865,10 +888,23 @@ export class TrustedNetworkV2DurablePolicyReducer {
 		return this.published.roles.get(keyId(subject)) ?? 0;
 	}
 
+	/**
+	 * Whether the last durable policy projection is ACTIVE with no replacement
+	 * publication in flight.
+	 *
+	 * This is the subject-independent form of the publication fence used by
+	 * `isAuthorized()`. Internal resource reducers use it to stop serving an
+	 * otherwise ACTIVE resource while a policy replacement is in flight or the
+	 * policy anchor has failed closed. It does not prove complete external-log
+	 * replay or global freshness.
+	 */
+	isUsable(): boolean {
+		return this.authorizationFences === 0 && this.state === "ACTIVE";
+	}
+
 	isAuthorized(subject: PublicSignKey, roles: number): boolean {
 		if (
-			this.authorizationFences !== 0 ||
-			this.state !== "ACTIVE" ||
+			!this.isUsable() ||
 			!Number.isInteger(roles) ||
 			roles === 0 ||
 			(roles & ~TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS) !== 0
@@ -991,6 +1027,9 @@ export class TrustedNetworkV2DurablePolicyReducer {
 
 		let sequence: bigint;
 		let suppliedDigest: Uint8Array;
+		let maxSteps: number | undefined;
+		let deadline: number | undefined;
+		let signal: AbortSignal | undefined;
 		try {
 			sequence = reference.sequence;
 			if (
@@ -1010,6 +1049,54 @@ export class TrustedNetworkV2DurablePolicyReducer {
 					reason: "Policy reference digest must contain exactly 32 bytes",
 				});
 			}
+			maxSteps = reference.maxSteps;
+			if (
+				maxSteps !== undefined &&
+				(!Number.isSafeInteger(maxSteps) || maxSteps < 0)
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Policy lease maxSteps must be a non-negative safe integer",
+				});
+			}
+			const suppliedDeadline = reference.deadline;
+			if (
+				suppliedDeadline !== undefined &&
+				(!Number.isSafeInteger(suppliedDeadline) || suppliedDeadline < 0)
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Policy lease deadline must be a non-negative safe integer",
+				});
+			}
+			const timeoutMs = reference.timeoutMs;
+			if (
+				timeoutMs !== undefined &&
+				(!Number.isSafeInteger(timeoutMs) || timeoutMs < 0)
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Policy lease timeoutMs must be a non-negative safe integer",
+				});
+			}
+			const requestedAt = Date.now();
+			const relativeDeadline =
+				timeoutMs === undefined
+					? undefined
+					: Math.min(Number.MAX_SAFE_INTEGER, requestedAt + timeoutMs);
+			deadline =
+				suppliedDeadline === undefined
+					? relativeDeadline
+					: relativeDeadline === undefined
+						? suppliedDeadline
+						: Math.min(suppliedDeadline, relativeDeadline);
+			signal = reference.signal;
+			if (signal !== undefined && !isAbortSignalV2(signal)) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Policy lease signal must be an AbortSignal",
+				});
+			}
 		} catch {
 			return Promise.resolve({
 				status: "rejected",
@@ -1041,20 +1128,120 @@ export class TrustedNetworkV2DurablePolicyReducer {
 			});
 		}
 
-		const result: Promise<PolicyLeaseResultV2<T>> = this.operationTail.then(
-			async () => {
+		let queueAcquired = false;
+		let callbackAcquired = false;
+		let preAcquisitionResult: PolicyLeaseResultV2<T> | undefined;
+		let resolveEarly!: (result: PolicyLeaseResultV2<T>) => void;
+		const earlyResult = new Promise<PolicyLeaseResultV2<T>>((resolve) => {
+			resolveEarly = resolve;
+		});
+		let deadlineTimer: ReturnType<typeof setTimeout> | undefined;
+		let signalListenerInstalled = false;
+
+		const abortBeforeAcquisition = (): void => {
+			settleBeforeAcquisition({
+				status: "unavailable",
+				reason: "Policy lease acquisition was aborted by the caller",
+			});
+		};
+		const cleanupWakeups = (): void => {
+			if (deadlineTimer !== undefined) {
+				clearTimeout(deadlineTimer);
+				deadlineTimer = undefined;
+			}
+			if (signalListenerInstalled) {
+				signalListenerInstalled = false;
+				try {
+					signal?.removeEventListener("abort", abortBeforeAcquisition);
+				} catch {
+					// A structurally valid hostile signal must not break queue cleanup.
+				}
+			}
+		};
+		function settleBeforeAcquisition(result: PolicyLeaseResultV2<T>): void {
+			if (
+				queueAcquired ||
+				callbackAcquired ||
+				preAcquisitionResult !== undefined
+			) {
+				return;
+			}
+			preAcquisitionResult = result;
+			cleanupWakeups();
+			resolveEarly(result);
+		}
+		const armDeadlineWakeup = (): void => {
+			if (
+				deadline === undefined ||
+				queueAcquired ||
+				callbackAcquired ||
+				preAcquisitionResult !== undefined
+			) {
+				return;
+			}
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) {
+				settleBeforeAcquisition({
+					status: "unavailable",
+					reason: "Policy lease acquisition deadline elapsed",
+				});
+				return;
+			}
+			try {
+				deadlineTimer = setTimeout(
+					() => {
+						deadlineTimer = undefined;
+						armDeadlineWakeup();
+					},
+					Math.min(remaining, MAX_TIMER_DELAY_MS_V2),
+				);
+			} catch {
+				settleBeforeAcquisition({
+					status: "unavailable",
+					reason: "Policy lease acquisition deadline could not be scheduled",
+				});
+			}
+		};
+
+		const queuedResult: Promise<PolicyLeaseResultV2<T>> =
+			this.operationTail.then(async () => {
+				if (preAcquisitionResult !== undefined) {
+					return preAcquisitionResult;
+				}
+				queueAcquired = true;
+				cleanupWakeups();
 				const queuedHalt = this.immediateLeaseHaltedResult();
 				if (queuedHalt !== undefined) return queuedHalt;
-				const resolution = await this.core.resolveAcceptedPolicyPrefix({
-					sequence,
-					digest,
-				});
+				const resolution = await this.core.resolveAcceptedPolicyPrefix(
+					{
+						sequence,
+						digest,
+					},
+					{ maxSteps, deadline, signal },
+				);
+				if (preAcquisitionResult !== undefined) {
+					return preAcquisitionResult;
+				}
 				if (resolution.status !== "resolved") return resolution;
 				// Lifecycle abort before callback invocation loses acquisition. There is
 				// no await between this check and invoking user code, which is the lease's
 				// linearization point.
 				const resolvedHalt = this.immediateLeaseHaltedResult();
 				if (resolvedHalt !== undefined) return resolvedHalt;
+				if (signal?.aborted) {
+					return {
+						status: "unavailable",
+						reason: "Policy lease acquisition was aborted by the caller",
+					};
+				}
+				if (deadline !== undefined && Date.now() >= deadline) {
+					return {
+						status: "unavailable",
+						reason: "Policy lease acquisition deadline elapsed",
+					};
+				}
+				callbackAcquired = true;
+				cleanupWakeups();
 				const value = await use({
 					// The core created these two projections independently and retains
 					// neither, including when the requested policy is the current head.
@@ -1062,15 +1249,32 @@ export class TrustedNetworkV2DurablePolicyReducer {
 					acceptedHead: resolution.acceptedHead,
 				});
 				return { status: "completed", value };
-			},
-		);
-		this.operationTail = result.then(
+			});
+		const retainedResult = queuedResult.finally(() => {
+			cleanupWakeups();
+			this.releaseOperation(retainedReferenceBytes);
+		});
+		this.operationTail = retainedResult.then(
 			(): void => {},
 			(): void => {},
 		);
-		return result.finally(() => {
-			this.releaseOperation(retainedReferenceBytes);
-		});
+
+		if (signal !== undefined) {
+			signalListenerInstalled = true;
+			try {
+				signal.addEventListener("abort", abortBeforeAcquisition, {
+					once: true,
+				});
+			} catch {
+				settleBeforeAcquisition({
+					status: "rejected",
+					reason: "Policy lease signal could not be observed",
+				});
+			}
+			if (signal.aborted) abortBeforeAcquisition();
+		}
+		armDeadlineWakeup();
+		return Promise.race([retainedResult, earlyResult]);
 	}
 
 	private forkFailStopResult(): PolicyAdmissionResultV2 {

package/src/v2-policy-engine.ts

@@ -47,6 +47,20 @@ const TYPED_ARRAY_TAG = Object.getOwnPropertyDescriptor(
 const ARRAY_BUFFER_IS_VIEW = ArrayBuffer.isView;
 const UINT8_ARRAY_SET = Uint8Array.prototype.set;
 
+const isAbortSignalV2 = (value: unknown): value is AbortSignal => {
+	if (value === null || typeof value !== "object") return false;
+	try {
+		const signal = value as AbortSignal;
+		return (
+			typeof signal.aborted === "boolean" &&
+			typeof signal.addEventListener === "function" &&
+			typeof signal.removeEventListener === "function"
+		);
+	} catch {
+		return false;
+	}
+};
+
 const exactUint8ArrayByteLength = (input: unknown): number => {
 	if (
 		!ARRAY_BUFFER_IS_VIEW(input) ||
@@ -162,6 +176,16 @@ export type AcceptedPolicyPrefixResolutionV2 =
 			reason: string;
 	  };
 
+/** Per-call bounds for the internal accepted-prefix history walk. */
+export type AcceptedPolicyPrefixTraversalV2 = {
+	/** Maximum number of authenticated parent edges that may be resolved. */
+	maxSteps?: number;
+	/** Absolute wall-clock deadline, in milliseconds since the Unix epoch. */
+	deadline?: number;
+	/** Cancels this resolution without halting the reducer. */
+	signal?: AbortSignal;
+};
+
 export type PolicyForkChildProofV2 = {
 	sequence: bigint;
 	digest: Uint8Array;
@@ -751,12 +775,16 @@ export class TrustedNetworkV2PolicyReducer {
 	 * users of this internal class. Historical snapshots remain resolver-backed;
 	 * this walk retains only one authenticated cursor at a time.
 	 */
-	resolveAcceptedPolicyPrefix(reference: {
-		sequence: bigint;
-		digest: Uint8Array;
-	}): Promise<AcceptedPolicyPrefixResolutionV2> {
+	resolveAcceptedPolicyPrefix(
+		reference: {
+			sequence: bigint;
+			digest: Uint8Array;
+		},
+		traversal?: AcceptedPolicyPrefixTraversalV2,
+	): Promise<AcceptedPolicyPrefixResolutionV2> {
 		let capturedSequence: bigint;
 		let capturedDigest: Uint8Array;
+		let capturedTraversal: AcceptedPolicyPrefixTraversalV2;
 		try {
 			capturedSequence = reference.sequence;
 			if (
@@ -774,6 +802,34 @@ export class TrustedNetworkV2PolicyReducer {
 				throw new Error("invalid digest");
 			}
 			capturedDigest = copyBytes(suppliedDigest);
+			const maxSteps = traversal?.maxSteps;
+			if (
+				maxSteps !== undefined &&
+				(!Number.isSafeInteger(maxSteps) || maxSteps < 0)
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Policy prefix maxSteps must be a non-negative safe integer",
+				});
+			}
+			const deadline = traversal?.deadline;
+			if (
+				deadline !== undefined &&
+				(!Number.isSafeInteger(deadline) || deadline < 0)
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Policy prefix deadline must be a non-negative safe integer",
+				});
+			}
+			const signal = traversal?.signal;
+			if (signal !== undefined && !isAbortSignalV2(signal)) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Policy prefix signal must be an AbortSignal",
+				});
+			}
+			capturedTraversal = { maxSteps, deadline, signal };
 		} catch {
 			return Promise.resolve({
 				status: "rejected",
@@ -781,10 +837,13 @@ export class TrustedNetworkV2PolicyReducer {
 			});
 		}
 		const result = this.admissionTail.then(() =>
-			this.resolveAcceptedPolicyPrefixOne({
-				sequence: capturedSequence,
-				digest: capturedDigest,
-			}),
+			this.resolveAcceptedPolicyPrefixOne(
+				{
+					sequence: capturedSequence,
+					digest: capturedDigest,
+				},
+				capturedTraversal,
+			),
 		);
 		this.admissionTail = result.then(
 			(): void => {},
@@ -808,19 +867,15 @@ export class TrustedNetworkV2PolicyReducer {
 		this.lifecycleController.abort();
 	}
 
-	private async resolveAcceptedPolicyPrefixOne(reference: {
-		sequence: bigint;
-		digest: Uint8Array;
-	}): Promise<AcceptedPolicyPrefixResolutionV2> {
-		if (this.lifecycleController.signal.aborted || this.fork !== undefined) {
-			return {
-				status: "halted",
-				reason:
-					this.fork === undefined
-						? "Policy reducer lifecycle is aborted"
-						: "Policy reducer is halted by authority equivocation",
-			};
-		}
+	private async resolveAcceptedPolicyPrefixOne(
+		reference: {
+			sequence: bigint;
+			digest: Uint8Array;
+		},
+		traversal: AcceptedPolicyPrefixTraversalV2,
+	): Promise<AcceptedPolicyPrefixResolutionV2> {
+		const interrupted = this.acceptedPrefixInterruption(traversal);
+		if (interrupted !== undefined) return interrupted;
 		if (this.unavailable !== undefined) {
 			return {
 				status: "unavailable",
@@ -843,7 +898,10 @@ export class TrustedNetworkV2PolicyReducer {
 		// The admission queue owns the core for this complete walk, so the internal
 		// accepted snapshot cannot change until the resolution settles.
 		let cursor = this.acceptedHead;
+		let steps = 0;
 		while (cursor.body.sequence > reference.sequence) {
+			const loopInterruption = this.acceptedPrefixInterruption(traversal);
+			if (loopInterruption !== undefined) return loopInterruption;
 			if (
 				cursor.body.sequence === reference.sequence + 1n &&
 				!equals(cursor.body.previousPolicyDigest, reference.digest)
@@ -853,13 +911,16 @@ export class TrustedNetworkV2PolicyReducer {
 					reason: "Policy reference is not an accepted prefix",
 				};
 			}
-			const parent = await this.parentOf(cursor);
-			if (this.lifecycleController.signal.aborted) {
+			if (traversal.maxSteps !== undefined && steps >= traversal.maxSteps) {
 				return {
-					status: "halted",
-					reason: "Policy reducer lifecycle is aborted",
+					status: "unavailable",
+					reason: "Accepted policy prefix traversal reached maxSteps",
 				};
 			}
+			steps += 1;
+			const parent = await this.parentOf(cursor, undefined, traversal);
+			const resolutionInterruption = this.acceptedPrefixInterruption(traversal);
+			if (resolutionInterruption !== undefined) return resolutionInterruption;
 			if (parent.status !== "found") {
 				return {
 					status: "unavailable",
@@ -868,6 +929,8 @@ export class TrustedNetworkV2PolicyReducer {
 			}
 			cursor = parent.parent;
 		}
+		const completedInterruption = this.acceptedPrefixInterruption(traversal);
+		if (completedInterruption !== undefined) return completedInterruption;
 
 		if (!equals(cursor.digest, reference.digest)) {
 			return {
@@ -882,6 +945,38 @@ export class TrustedNetworkV2PolicyReducer {
 		};
 	}
 
+	private acceptedPrefixInterruption(
+		traversal: AcceptedPolicyPrefixTraversalV2,
+	):
+		| Exclude<AcceptedPolicyPrefixResolutionV2, { status: "resolved" }>
+		| undefined {
+		if (this.lifecycleController.signal.aborted) {
+			return {
+				status: "halted",
+				reason: "Policy reducer lifecycle is aborted",
+			};
+		}
+		if (this.fork !== undefined) {
+			return {
+				status: "halted",
+				reason: "Policy reducer is halted by authority equivocation",
+			};
+		}
+		if (traversal.signal?.aborted) {
+			return {
+				status: "unavailable",
+				reason: "Policy prefix resolution was aborted by the caller",
+			};
+		}
+		if (traversal.deadline !== undefined && Date.now() >= traversal.deadline) {
+			return {
+				status: "unavailable",
+				reason: "Policy prefix resolution deadline elapsed",
+			};
+		}
+		return undefined;
+	}
+
 	private fetchHints(): PolicyParentFetchHintV2[] {
 		const unique = new Map<string, Uint8Array>();
 		for (const { missingParentDigest } of this.pending.values()) {
@@ -994,69 +1089,111 @@ export class TrustedNetworkV2PolicyReducer {
 
 	private async resolveExternalSnapshot(
 		digest: Uint8Array,
+		traversal?: AcceptedPolicyPrefixTraversalV2,
 	): Promise<ValidatedPolicySnapshotV2 | undefined> {
 		if (this.lifecycleController.signal.aborted) {
 			throw new PolicyDependencyUnavailableErrorV2(
 				"Policy resolver lifecycle is aborted",
 			);
 		}
+		if (traversal?.signal?.aborted) {
+			throw new PolicyDependencyUnavailableErrorV2(
+				"Policy resolver attempt was aborted by the caller",
+			);
+		}
+		const deadlineRemaining =
+			traversal?.deadline === undefined
+				? undefined
+				: traversal.deadline - Date.now();
+		const deadlineLimitsAttempt =
+			deadlineRemaining !== undefined &&
+			deadlineRemaining <= this.resolveTimeoutMs;
+		const remaining =
+			deadlineRemaining === undefined
+				? this.resolveTimeoutMs
+				: Math.min(this.resolveTimeoutMs, deadlineRemaining);
+		if (remaining <= 0) {
+			throw new PolicyDependencyUnavailableErrorV2(
+				"Policy resolver deadline elapsed",
+			);
+		}
 
 		const attemptController = new AbortController();
 		let timedOut = false;
+		let callerAborted = false;
 		const abortFromLifecycle = (): void => attemptController.abort();
+		const abortFromCaller = (): void => {
+			callerAborted = true;
+			attemptController.abort();
+		};
 		this.lifecycleController.signal.addEventListener(
 			"abort",
 			abortFromLifecycle,
 			{ once: true },
 		);
+		traversal?.signal?.addEventListener("abort", abortFromCaller, {
+			once: true,
+		});
 		const timeout = setTimeout(() => {
 			timedOut = true;
 			attemptController.abort();
-		}, this.resolveTimeoutMs);
+		}, remaining);
 		const abortError = (): PolicyDependencyUnavailableErrorV2 =>
 			new PolicyDependencyUnavailableErrorV2(
-				timedOut
-					? `Policy resolver timed out after ${this.resolveTimeoutMs} ms`
-					: "Policy resolver attempt was aborted",
+				callerAborted
+					? "Policy resolver attempt was aborted by the caller"
+					: timedOut && deadlineLimitsAttempt
+						? "Policy resolver deadline elapsed"
+						: timedOut
+							? `Policy resolver timed out after ${this.resolveTimeoutMs} ms`
+							: "Policy resolver attempt was aborted",
 			);
 
 		let rejectOnAbort: (() => void) | undefined;
-		const abortPromise = new Promise<never>((_resolve, reject) => {
-			rejectOnAbort = (): void => {
-				reject(abortError());
-			};
-			attemptController.signal.addEventListener("abort", rejectOnAbort, {
-				once: true,
-			});
-		});
-
-		const resolution = Promise.resolve().then(async () => {
-			if (attemptController.signal.aborted) throw abortError();
-			const entryBytes = await this.resolvePolicyEntry(copyBytes(digest), {
-				signal: attemptController.signal,
-			});
-			// A resolver may ignore cancellation. Do not spend decode or signature
-			// verification work on bytes that arrive after this attempt expired.
-			if (attemptController.signal.aborted) throw abortError();
-			if (entryBytes === undefined) return undefined;
-			const snapshot = await authenticatePolicySnapshotEntryV2(
-				entryBytes,
-				this.descriptor,
-			);
-			if (!equals(snapshot.digest, digest)) {
-				throw new Error("Policy resolver returned the wrong body digest");
-			}
-			return snapshot;
-		});
-		// Promise.race installs handlers, but this explicit observer documents and
-		// preserves consumption if the resolver settles after its deadline.
-		void resolution.then(
-			(): void => undefined,
-			(): void => undefined,
-		);
 
 		try {
-			return await Promise.race([resolution, abortPromise]);
+			return await new Promise<ValidatedPolicySnapshotV2 | undefined>(
+				(resolve, reject) => {
+					let settled = false;
+					const settle = (complete: () => void): void => {
+						if (settled) return;
+						settled = true;
+						complete();
+					};
+					rejectOnAbort = (): void => settle(() => reject(abortError()));
+					attemptController.signal.addEventListener("abort", rejectOnAbort, {
+						once: true,
+					});
+					void Promise.resolve()
+						.then(async () => {
+							if (attemptController.signal.aborted) throw abortError();
+							const entryBytes = await this.resolvePolicyEntry(
+								copyBytes(digest),
+								{
+									signal: attemptController.signal,
+								},
+							);
+							// A resolver may ignore cancellation. Do not spend decode or signature
+							// verification work on bytes that arrive after this attempt expired.
+							if (attemptController.signal.aborted) throw abortError();
+							if (entryBytes === undefined) return undefined;
+							const snapshot = await authenticatePolicySnapshotEntryV2(
+								entryBytes,
+								this.descriptor,
+							);
+							if (!equals(snapshot.digest, digest)) {
+								throw new Error(
+									"Policy resolver returned the wrong body digest",
+								);
+							}
+							return snapshot;
+						})
+						.then(
+							(value) => settle(() => resolve(value)),
+							(error: unknown) => settle(() => reject(error)),
+						);
+				},
+			);
 		} catch (error) {
 			if (error instanceof PolicyDependencyUnavailableErrorV2) throw error;
 			throw new PolicyDependencyUnavailableErrorV2(
@@ -1068,6 +1205,7 @@ export class TrustedNetworkV2PolicyReducer {
 				"abort",
 				abortFromLifecycle,
 			);
+			traversal?.signal?.removeEventListener("abort", abortFromCaller);
 			if (rejectOnAbort !== undefined) {
 				attemptController.signal.removeEventListener("abort", rejectOnAbort);
 			}
@@ -1077,6 +1215,7 @@ export class TrustedNetworkV2PolicyReducer {
 	private async resolveSnapshot(
 		digest: Uint8Array,
 		cache?: SnapshotResolutionCacheV2,
+		traversal?: AcceptedPolicyPrefixTraversalV2,
 	): Promise<ValidatedPolicySnapshotV2 | undefined> {
 		const digestKey = bytesKey(digest);
 		if (this.acceptedHead?.digestKey === digestKey) {
@@ -1086,7 +1225,7 @@ export class TrustedNetworkV2PolicyReducer {
 		if (pending !== undefined) return copySnapshot(pending.snapshot);
 		let resolution = cache?.get(digestKey);
 		if (resolution === undefined) {
-			resolution = this.resolveExternalSnapshot(digest);
+			resolution = this.resolveExternalSnapshot(digest, traversal);
 			cache?.set(digestKey, resolution);
 		}
 		const snapshot = await resolution;
@@ -1096,6 +1235,7 @@ export class TrustedNetworkV2PolicyReducer {
 	private async parentOf(
 		child: ValidatedPolicySnapshotV2,
 		cache?: SnapshotResolutionCacheV2,
+		traversal?: AcceptedPolicyPrefixTraversalV2,
 	): Promise<ParentResolutionV2> {
 		if (child.body.sequence === 0n) {
 			return {
@@ -1109,6 +1249,7 @@ export class TrustedNetworkV2PolicyReducer {
 			parent = await this.resolveSnapshot(
 				child.body.previousPolicyDigest,
 				cache,
+				traversal,
 			);
 		} catch (error) {
 			return {