@peerbit/trusted-network 6.0.128 → 6.0.130

package/dist/src/v2-policy-anchor.d.ts

@@ -18,6 +18,7 @@ export type CrashSafePolicyAnchorStoreV2 = CrashSafeAtomicReplaceStore;
 type DurableReducerOptionsV2 = {
     descriptor: NetworkDescriptorV2;
     resolvePolicyEntry: PolicySnapshotResolverV2;
+    resolvePolicyEntryByCid?: PolicyEntryCidResolverV2;
     resolveTimeoutMs?: number;
     signal?: AbortSignal;
     maxPending?: number;
@@ -26,6 +27,21 @@ type DurableReducerOptionsV2 = {
 export type TrustedNetworkV2DurablePolicyReducerOptions = DurableReducerOptionsV2 & {
     store: CrashSafePolicyAnchorStoreV2;
 };
+export type PolicyEntryCidResolverV2 = (policyEntryCid: string, options: {
+    signal: AbortSignal;
+}) => Uint8Array | undefined | Promise<Uint8Array | undefined>;
+export type ExactPolicyHeadRequirementV2 = {
+    policyEntryCid: string;
+    maxAncestrySteps?: number;
+    /** Queue-inclusive relative deadline; callers may only shorten the 10s cap. */
+    timeoutMs?: number;
+    deadline?: number;
+    signal?: AbortSignal;
+};
+export type ExactPolicyHeadLeaseV2 = {
+    policyEntryCid: string;
+    policy: PolicyHeadProjectionV2;
+};
 export type PolicyLeaseReferenceV2 = {
     sequence: bigint;
     digest: Uint8Array;
@@ -62,6 +78,11 @@ export declare class TrustedNetworkV2DurablePolicyReducer {
     private checkpoint?;
     private core;
     private published;
+    private readonly descriptor;
+    private readonly resolvePolicyEntryByCid?;
+    private readonly leaseLifecycleController;
+    private readonly disposeLifecycleObservation;
+    private exactAuthenticationInFlight?;
     private durableCoreIdentityBytes?;
     private operationTail;
     private authorizationFences;
@@ -106,6 +127,18 @@ export declare class TrustedNetworkV2DurablePolicyReducer {
      * throw/rejection is propagated unchanged, but never halts the policy anchor.
      */
     withAcceptedPolicyLease<T>(reference: PolicyLeaseReferenceV2, use: (lease: AcceptedPolicyLeaseV2) => T | Promise<T>): Promise<PolicyLeaseResultV2<T>>;
+    /**
+     * Run one callback while a CID-addressed policy wrapper is authenticated and
+     * its policy-body identity is the stable durable current head.
+     *
+     * Exact fetch, prepared admission, crash-safe publication, and callback share
+     * one bounded budget and serialized queue slot. No digest-resolver fallback is
+     * allowed when the CID resolver is absent or unavailable.
+     */
+    withExactPolicyHead<T>(requirement: ExactPolicyHeadRequirementV2, use: (lease: ExactPolicyHeadLeaseV2) => T | Promise<T>): Promise<PolicyLeaseResultV2<T>>;
+    private withSerializedPolicyLease;
+    private resolveExactPolicyEntry;
+    private authenticateExactPolicyEntry;
     private forkFailStopResult;
     private lifecycleHaltedResult;
     private immediateLeaseHaltedResult;

package/dist/src/v2-policy-anchor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v2-policy-anchor.d.ts","sourceRoot":"","sources":["../../src/v2-policy-anchor.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAc,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EACX,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EAEtB,wBAAwB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EACN,mBAAmB,EAKnB,MAAM,SAAS,CAAC;AAEjB;;;;;;;GAOG;AAEH,uEAAuE;AACvE,eAAO,MAAM,4CAA4C,gDACX,CAAC;AAW/C,4EAA4E;AAC5E,eAAO,MAAM,6DAA6D,QAElC,CAAC;AA6BzC,MAAM,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAEvE,KAAK,uBAAuB,GAAG;IAC9B,UAAU,EAAE,mBAAmB,CAAC;IAChC,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,2CAA2C,GACtD,uBAAuB,GAAG;IACzB,KAAK,EAAE,4BAA4B,CAAC;CACpC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,mEAAmE;IACnE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,4EAA4E;IAC5E,YAAY,EAAE,sBAAsB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC9B;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACjC;IACA,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;CACd,CAAC;AA4lBL;;;;;;GAMG;AACH,qBAAa,oCAAoC;IAChD,OAAO,CAAC,UAAU,CAAC,CAA6B;IAChD,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,wBAAwB,CAAC,CAAa;IAC9C,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,2BAA2B,CAAK;IACxC,OAAO,CAAC,aAAa,CAAC,CAAQ;IAE9B,OAAO;WAcM,IAAI,CAChB,OAAO,EAAE,2CAA2C,GAClD,OAAO,CAAC,oCAAoC,CAAC;IA+EhD,IAAI,KAAK,IAAI,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAOpE;IAED,IAAI,IAAI,IAAI,sBAAsB,GAAG,SAAS,CAE7C;IAED,IAAI,YAAY,IAAI,oBAAoB,GAAG,SAAS,CAEnD;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,cAAc,IAAI,UAAU,EAAE,CAIjC;IAED,uEAAuE;IACvE,IAAI,sBAAsB,IAAI,MAAM,CAEnC;IAED,+EAA+E;IAC/E,IAAI,sBAAsB,IAAI,MAAM,CAEnC;IAED,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM;IAIxC;;;;;;;;;OASG;IACH,QAAQ,IAAI,OAAO;IAInB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAY5D,KAAK,IAAI,IAAI;IAIb,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA2DhE,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAiCpD;;;;;;;OAOG;IACH,uBAAuB,CAAC,CAAC,EACxB,SAAS,EAAE,sBAAsB,EACjC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAgQlC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,0BAA0B;IAsBlC,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,gBAAgB;IAaxB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,OAAO;IAuBf,OAAO,CAAC,IAAI;YAYE,sBAAsB;CAoEpC"}
+{"version":3,"file":"v2-policy-anchor.d.ts","sourceRoot":"","sources":["../../src/v2-policy-anchor.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAc,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EACX,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EAEtB,wBAAwB,EAExB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EACN,mBAAmB,EAKnB,MAAM,SAAS,CAAC;AAEjB;;;;;;;GAOG;AAEH,uEAAuE;AACvE,eAAO,MAAM,4CAA4C,gDACX,CAAC;AAW/C,4EAA4E;AAC5E,eAAO,MAAM,6DAA6D,QAElC,CAAC;AAsCzC,MAAM,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAEvE,KAAK,uBAAuB,GAAG;IAC9B,UAAU,EAAE,mBAAmB,CAAC;IAChC,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,2CAA2C,GACtD,uBAAuB,GAAG;IACzB,KAAK,EAAE,4BAA4B,CAAC;CACpC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CACtC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,KAC5B,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IAC1C,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,sBAAsB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,mEAAmE;IACnE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,4EAA4E;IAC5E,YAAY,EAAE,sBAAsB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC9B;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACjC;IACA,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;CACd,CAAC;AAqmBL;;;;;;GAMG;AACH,qBAAa,oCAAoC;IAChD,OAAO,CAAC,UAAU,CAAC,CAA6B;IAChD,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAA2B;IACpE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAkB;IAC3D,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAa;IACzD,OAAO,CAAC,2BAA2B,CAAC,CAA0C;IAC9E,OAAO,CAAC,wBAAwB,CAAC,CAAa;IAC9C,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,2BAA2B,CAAK;IACxC,OAAO,CAAC,aAAa,CAAC,CAAQ;IAE9B,OAAO;WAqBM,IAAI,CAChB,OAAO,EAAE,2CAA2C,GAClD,OAAO,CAAC,oCAAoC,CAAC;IA4FhD,IAAI,KAAK,IAAI,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAOpE;IAED,IAAI,IAAI,IAAI,sBAAsB,GAAG,SAAS,CAE7C;IAED,IAAI,YAAY,IAAI,oBAAoB,GAAG,SAAS,CAEnD;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,cAAc,IAAI,UAAU,EAAE,CAIjC;IAED,uEAAuE;IACvE,IAAI,sBAAsB,IAAI,MAAM,CAEnC;IAED,+EAA+E;IAC/E,IAAI,sBAAsB,IAAI,MAAM,CAEnC;IAED,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM;IAIxC;;;;;;;;;OASG;IACH,QAAQ,IAAI,OAAO;IAInB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAY5D,KAAK,IAAI,IAAI;IAKb,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA2DhE,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAiCpD;;;;;;;OAOG;IACH,uBAAuB,CAAC,CAAC,EACxB,SAAS,EAAE,sBAAsB,EACjC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IA0HlC;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAAC,EACpB,WAAW,EAAE,4BAA4B,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACpD,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IA+IlC,OAAO,CAAC,yBAAyB;YAmKnB,uBAAuB;IA8HrC,OAAO,CAAC,4BAA4B;IAWpC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,0BAA0B;IAsBlC,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,gBAAgB;IAaxB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,OAAO;IAuBf,OAAO,CAAC,IAAI;YAYE,sBAAsB;CAwEpC"}

package/dist/src/v2-policy-anchor.js

@@ -36,7 +36,7 @@ import { deserialize, field, fixedArray, serialize, variant, vec, } from "@dao-x
 import { CrashSafeTwoSlotCheckpoint } from "@peerbit/any-store/checkpoint";
 import { PublicSignKey, sha256Sync } from "@peerbit/crypto";
 import { compare, concat, equals } from "uint8arrays";
-import { TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES, TrustedNetworkV2PolicyReducer, authenticatePolicySnapshotEntryV2, } from "./v2-policy-engine.js";
+import { TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES, TrustedNetworkV2PolicyReducer, authenticatePolicySnapshotEntryV2, captureCanonicalPolicyEntryCidV2, observeAbortSignalV2, } from "./v2-policy-engine.js";
 import { NetworkDescriptorV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS, TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES, assertNetworkDescriptorV2, } from "./v2.js";
 /**
  * Internal crash-safe policy-anchor storage format.
@@ -62,6 +62,8 @@ export const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES = (MA
     MAX_CHECKPOINT_PAYLOAD_FRAMING_BYTES_V2;
 const MAX_QUEUED_POLICY_INPUT_BYTES_V2 = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2;
 const MAX_TIMER_DELAY_MS_V2 = 0x7fffffff;
+const DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2 = 10 * 1000;
+const DEFAULT_EXACT_POLICY_HEAD_MAX_ANCESTRY_STEPS_V2 = TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES;
 const ZERO_DIGEST = new Uint8Array(32);
 const textEncoder = new TextEncoder();
 const CHECKPOINT_SCOPE_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/checkpoint/v1\0");
@@ -83,6 +85,7 @@ const isAbortSignalV2 = (value) => {
         return false;
     }
 };
+const boundedDependencyReasonV2 = (error) => (error instanceof Error ? error.message : String(error)).slice(0, MAX_UNAVAILABLE_REASON_LENGTH);
 /**
  * One self-contained application snapshot. The enclosing generic checkpoint
  * supplies generation, scope, predecessor, and checksum authentication.
@@ -543,6 +546,11 @@ export class TrustedNetworkV2DurablePolicyReducer {
     checkpoint;
     core;
     published;
+    descriptor;
+    resolvePolicyEntryByCid;
+    leaseLifecycleController;
+    disposeLifecycleObservation;
+    exactAuthenticationInFlight;
     durableCoreIdentityBytes;
     operationTail = Promise.resolve();
     authorizationFences = 0;
@@ -553,6 +561,10 @@ export class TrustedNetworkV2DurablePolicyReducer {
         this.checkpoint = properties.checkpoint;
         this.core = properties.core;
         this.published = publishedFromReducer(this.core);
+        this.descriptor = properties.descriptor;
+        this.resolvePolicyEntryByCid = properties.resolvePolicyEntryByCid;
+        this.leaseLifecycleController = properties.lifecycle[0];
+        this.disposeLifecycleObservation = properties.lifecycle[1];
         this.durableCoreIdentityBytes =
             properties.durableCoreIdentityBytes === undefined
                 ? undefined
@@ -560,8 +572,13 @@ export class TrustedNetworkV2DurablePolicyReducer {
     }
     static async open(options) {
         assertNetworkDescriptorV2(options.descriptor);
+        if (options.resolvePolicyEntryByCid !== undefined &&
+            typeof options.resolvePolicyEntryByCid !== "function") {
+            throw new TypeError("Policy CID resolver must be a function");
+        }
         const descriptor = deserialize(serialize(options.descriptor), NetworkDescriptorV2);
-        const signal = options.signal;
+        const lifecycle = observeAbortSignalV2(options.signal);
+        const signal = lifecycle[0].signal;
         const store = options.store;
         const coreProperties = {
             descriptor,
@@ -571,32 +588,35 @@ export class TrustedNetworkV2DurablePolicyReducer {
             maxPending: options.maxPending,
             maxPendingPolicyBytes: options.maxPendingPolicyBytes,
         };
-        assertOpenNotAborted(signal);
-        const checkpoint = await CrashSafeTwoSlotCheckpoint.open({
-            store,
-            scope: checkpointScope(descriptor),
-            maxPayloadBytes: TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES,
-        });
-        assertOpenNotAborted(signal);
-        // Never let the old append-only format look like an empty or newer
-        // checkpoint. It was internal and never activated, so migration or fallback
-        // would add rollback surface without preserving a public compatibility need.
-        for await (const [key] of store.iterator()) {
-            assertOpenNotAborted(signal);
-            if (key === TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER ||
-                key.startsWith(`${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/`)) {
-                throw new Error("Legacy append-only policy-anchor records are not supported; reset the dedicated store");
-            }
-        }
-        assertOpenNotAborted(signal);
-        const current = checkpoint.current;
         let core;
         try {
+            assertOpenNotAborted(signal);
+            const checkpoint = await CrashSafeTwoSlotCheckpoint.open({
+                store,
+                scope: checkpointScope(descriptor),
+                maxPayloadBytes: TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES,
+            });
+            assertOpenNotAborted(signal);
+            // Never let the old append-only format look like an empty or newer
+            // checkpoint. It was internal and never activated, so migration or fallback
+            // would add rollback surface without preserving a public compatibility need.
+            for await (const [key] of store.iterator()) {
+                assertOpenNotAborted(signal);
+                if (key === TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER ||
+                    key.startsWith(`${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/`)) {
+                    throw new Error("Legacy append-only policy-anchor records are not supported; reset the dedicated store");
+                }
+            }
+            assertOpenNotAborted(signal);
+            const current = checkpoint.current;
             if (current === undefined) {
                 core = new TrustedNetworkV2PolicyReducer(coreProperties);
                 return new TrustedNetworkV2DurablePolicyReducer({
                     checkpoint,
                     core,
+                    descriptor,
+                    resolvePolicyEntryByCid: options.resolvePolicyEntryByCid,
+                    lifecycle,
                 });
             }
             const payload = decodeCanonicalCheckpointPayload(current.payload);
@@ -614,11 +634,15 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 // storage, so release that potentially 8.78 MiB snapshot immediately.
                 checkpoint: forked ? undefined : checkpoint,
                 core,
+                descriptor,
+                resolvePolicyEntryByCid: options.resolvePolicyEntryByCid,
+                lifecycle,
                 durableCoreIdentityBytes: decoded.coreIdentityBytes,
             });
         }
         catch (error) {
             core?.abort();
+            lifecycle[1]();
             throw error;
         }
     }
@@ -685,6 +709,7 @@ export class TrustedNetworkV2DurablePolicyReducer {
     }
     abort() {
         this.core.abort();
+        this.disposeLifecycleObservation();
     }
     ingest(entryBytes) {
         if (this.terminalError !== undefined) {
@@ -842,37 +867,190 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 reason: "Policy lease callback must be a function",
             });
         }
-        const retainedReferenceBytes = 32;
-        if (!this.reserveOperation(retainedReferenceBytes)) {
+        let digest;
+        try {
+            digest = copyBytes(suppliedDigest);
+        }
+        catch {
+            return Promise.resolve({
+                status: "rejected",
+                reason: "Policy reference digest must contain exactly 32 bytes",
+            });
+        }
+        return this.withSerializedPolicyLease(32, deadline, signal, async (leaseSignal) => {
+            const resolution = await this.core.resolveAcceptedPolicyPrefix({ sequence, digest }, { maxSteps, deadline, signal: leaseSignal });
+            return resolution.status === "resolved"
+                ? {
+                    status: "resolved",
+                    lease: {
+                        policy: resolution.policy,
+                        acceptedHead: resolution.acceptedHead,
+                    },
+                }
+                : resolution;
+        }, use);
+    }
+    /**
+     * Run one callback while a CID-addressed policy wrapper is authenticated and
+     * its policy-body identity is the stable durable current head.
+     *
+     * Exact fetch, prepared admission, crash-safe publication, and callback share
+     * one bounded budget and serialized queue slot. No digest-resolver fallback is
+     * allowed when the CID resolver is absent or unavailable.
+     */
+    withExactPolicyHead(requirement, use) {
+        const halted = this.immediateLeaseHaltedResult();
+        if (halted !== undefined)
+            return Promise.resolve(halted);
+        let policyEntryCid;
+        let maxAncestrySteps;
+        let deadline;
+        let signal;
+        try {
+            policyEntryCid = captureCanonicalPolicyEntryCidV2(requirement.policyEntryCid);
+            maxAncestrySteps =
+                requirement.maxAncestrySteps ??
+                    DEFAULT_EXACT_POLICY_HEAD_MAX_ANCESTRY_STEPS_V2;
+            if (!Number.isSafeInteger(maxAncestrySteps) ||
+                maxAncestrySteps < 0 ||
+                maxAncestrySteps > TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES) {
+                return Promise.resolve({
+                    status: "rejected",
+                    reason: `Exact policy maxAncestrySteps must be between 0 and ${TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES}`,
+                });
+            }
+            const suppliedDeadline = requirement.deadline;
+            if (suppliedDeadline !== undefined &&
+                (!Number.isSafeInteger(suppliedDeadline) || suppliedDeadline < 0)) {
+                return Promise.resolve({
+                    status: "rejected",
+                    reason: "Exact policy deadline must be a non-negative safe integer",
+                });
+            }
+            const timeoutMs = requirement.timeoutMs ?? DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2;
+            if (!Number.isSafeInteger(timeoutMs) ||
+                timeoutMs < 0 ||
+                timeoutMs > DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2) {
+                return Promise.resolve({
+                    status: "rejected",
+                    reason: `Exact policy timeoutMs must be between 0 and ${DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2}`,
+                });
+            }
+            const relativeDeadline = Math.min(Number.MAX_SAFE_INTEGER, Date.now() + timeoutMs);
+            deadline =
+                suppliedDeadline === undefined
+                    ? relativeDeadline
+                    : Math.min(suppliedDeadline, relativeDeadline);
+            signal = requirement.signal;
+            if (signal !== undefined && !isAbortSignalV2(signal)) {
+                return Promise.resolve({
+                    status: "rejected",
+                    reason: "Exact policy signal must be an AbortSignal",
+                });
+            }
+        }
+        catch {
+            return Promise.resolve({
+                status: "rejected",
+                reason: "Exact policy-head requirement is invalid",
+            });
+        }
+        if (typeof use !== "function") {
+            return Promise.resolve({
+                status: "rejected",
+                reason: "Exact policy-head callback must be a function",
+            });
+        }
+        return this.withSerializedPolicyLease(textEncoder.encode(policyEntryCid).byteLength, deadline, signal, async (leaseSignal, mutationCompleted) => {
+            const exact = await this.resolveExactPolicyEntry(policyEntryCid, deadline, leaseSignal);
+            if (exact.status !== "resolved")
+                return exact;
+            this.authorizationFences += 1;
+            try {
+                const admission = await this.core.ingestPreparedExactPolicy(exact.lease, {
+                    maxParentEdges: maxAncestrySteps,
+                    deadline,
+                    signal: leaseSignal,
+                });
+                // Core admission may now be mutated. From here through checkpoint
+                // settlement, cancellation may settle outward but cannot release the slot.
+                mutationCompleted();
+                await this.persistCorePublication(admission);
+                const halted = this.immediateLeaseHaltedResult();
+                if (halted !== undefined)
+                    return halted;
+                if (admission.status !== "accepted" &&
+                    admission.status !== "duplicate") {
+                    return {
+                        status: admission.status === "rejected" ||
+                            admission.status === "capacity"
+                            ? admission.status
+                            : "unavailable",
+                        reason: admission.reason ?? "Exact policy admission is unavailable",
+                    };
+                }
+                const head = this.published.head;
+                if (this.published.state !== "ACTIVE" ||
+                    head === undefined ||
+                    head.sequence !== exact.lease.policy.sequence ||
+                    !equals(head.digest, exact.lease.policy.digest)) {
+                    return {
+                        status: "unavailable",
+                        reason: "Exact policy entry is not the durable current policy head",
+                    };
+                }
+                return {
+                    status: "resolved",
+                    lease: { policyEntryCid, policy: copyHead(head) },
+                };
+            }
+            catch (error) {
+                throw this.halt(error);
+            }
+            finally {
+                this.authorizationFences -= 1;
+            }
+        }, use);
+    }
+    withSerializedPolicyLease(retainedInputBytes, deadline, signal, acquire, use) {
+        if (!this.reserveOperation(retainedInputBytes)) {
             return Promise.resolve({
                 status: "capacity",
                 reason: "Durable policy operation queue is at its fixed capacity",
             });
         }
-        let digest;
+        let observedSignal;
         try {
-            digest = copyBytes(suppliedDigest);
+            observedSignal = observeAbortSignalV2(signal);
         }
         catch {
-            this.releaseOperation(retainedReferenceBytes);
+            this.releaseOperation(retainedInputBytes);
             return Promise.resolve({
                 status: "rejected",
-                reason: "Policy reference digest must contain exactly 32 bytes",
+                reason: "Policy lease signal could not be observed",
             });
         }
         let queueAcquired = false;
         let callbackAcquired = false;
+        let mutationCompleted = false;
+        const acquisitionController = observedSignal[0];
+        const interruptionSignal = AbortSignal.any([
+            acquisitionController.signal,
+            this.leaseLifecycleController.signal,
+        ]);
         let preAcquisitionResult;
         let resolveEarly;
         const earlyResult = new Promise((resolve) => {
             resolveEarly = resolve;
         });
         let deadlineTimer;
-        let signalListenerInstalled = false;
-        const abortBeforeAcquisition = () => {
+        const interruptBeforeAcquisition = () => {
+            const halted = this.leaseLifecycleController.signal.aborted;
             settleBeforeAcquisition({
-                status: "unavailable",
-                reason: "Policy lease acquisition was aborted by the caller",
+                status: halted ? "halted" : "unavailable",
+                reason: halted
+                    ? "Policy reducer lifecycle is aborted"
+                    : "Policy lease acquisition was aborted by the caller",
             });
         };
         const cleanupWakeups = () => {
@@ -880,29 +1058,26 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 clearTimeout(deadlineTimer);
                 deadlineTimer = undefined;
             }
-            if (signalListenerInstalled) {
-                signalListenerInstalled = false;
-                try {
-                    signal?.removeEventListener("abort", abortBeforeAcquisition);
-                }
-                catch {
-                    // A structurally valid hostile signal must not break queue cleanup.
-                }
-            }
+            interruptionSignal.removeEventListener("abort", interruptBeforeAcquisition);
+            observedSignal[1]();
         };
         function settleBeforeAcquisition(result) {
-            if (queueAcquired ||
-                callbackAcquired ||
-                preAcquisitionResult !== undefined) {
+            if (callbackAcquired || preAcquisitionResult !== undefined) {
                 return;
             }
             preAcquisitionResult = result;
+            acquisitionController.abort();
             cleanupWakeups();
-            resolveEarly(result);
+            if (!queueAcquired || mutationCompleted)
+                resolveEarly(result);
         }
+        const completeMutation = () => {
+            mutationCompleted = true;
+            if (preAcquisitionResult !== undefined)
+                resolveEarly(preAcquisitionResult);
+        };
         const armDeadlineWakeup = () => {
             if (deadline === undefined ||
-                queueAcquired ||
                 callbackAcquired ||
                 preAcquisitionResult !== undefined) {
                 return;
@@ -933,26 +1108,22 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 return preAcquisitionResult;
             }
             queueAcquired = true;
-            cleanupWakeups();
             const queuedHalt = this.immediateLeaseHaltedResult();
             if (queuedHalt !== undefined)
                 return queuedHalt;
-            const resolution = await this.core.resolveAcceptedPolicyPrefix({
-                sequence,
-                digest,
-            }, { maxSteps, deadline, signal });
+            const acquisition = await acquire(acquisitionController.signal, completeMutation);
             if (preAcquisitionResult !== undefined) {
                 return preAcquisitionResult;
             }
-            if (resolution.status !== "resolved")
-                return resolution;
+            if (acquisition.status !== "resolved")
+                return acquisition;
             // Lifecycle abort before callback invocation loses acquisition. There is
             // no await between this check and invoking user code, which is the lease's
             // linearization point.
             const resolvedHalt = this.immediateLeaseHaltedResult();
             if (resolvedHalt !== undefined)
                 return resolvedHalt;
-            if (signal?.aborted) {
+            if (acquisitionController.signal.aborted) {
                 return {
                     status: "unavailable",
                     reason: "Policy lease acquisition was aborted by the caller",
@@ -966,37 +1137,138 @@ export class TrustedNetworkV2DurablePolicyReducer {
             }
             callbackAcquired = true;
             cleanupWakeups();
-            const value = await use({
-                // The core created these two projections independently and retains
-                // neither, including when the requested policy is the current head.
-                policy: resolution.policy,
-                acceptedHead: resolution.acceptedHead,
-            });
+            const value = await use(acquisition.lease);
             return { status: "completed", value };
         });
         const retainedResult = queuedResult.finally(() => {
             cleanupWakeups();
-            this.releaseOperation(retainedReferenceBytes);
+            this.releaseOperation(retainedInputBytes);
         });
         this.operationTail = retainedResult.then(() => { }, () => { });
-        if (signal !== undefined) {
-            signalListenerInstalled = true;
+        interruptionSignal.addEventListener("abort", interruptBeforeAcquisition, {
+            once: true,
+        });
+        if (interruptionSignal.aborted)
+            interruptBeforeAcquisition();
+        armDeadlineWakeup();
+        return Promise.race([retainedResult, earlyResult]);
+    }
+    async resolveExactPolicyEntry(policyEntryCid, deadline, callerSignal) {
+        const resolver = this.resolvePolicyEntryByCid;
+        if (resolver === undefined) {
+            return {
+                status: "unavailable",
+                reason: "Exact policy-head readiness has no policy CID resolver",
+            };
+        }
+        if (this.core.state === "HALTED") {
+            return {
+                status: "halted",
+                reason: "Policy reducer lifecycle is aborted",
+            };
+        }
+        if (callerSignal.aborted) {
+            return {
+                status: "unavailable",
+                reason: "Exact policy-head acquisition was aborted by the caller",
+            };
+        }
+        if (Date.now() >= deadline) {
+            return {
+                status: "unavailable",
+                reason: "Exact policy-head acquisition deadline elapsed",
+            };
+        }
+        const interrupted = new Promise((_resolve, reject) => {
+            callerSignal.addEventListener("abort", () => reject(new Error("Exact policy-head resolution interrupted")), { once: true });
+        });
+        const interruptionFailure = () => {
+            const halted = this.immediateLeaseHaltedResult();
+            if (halted !== undefined)
+                return halted;
+            if (callerSignal.aborted) {
+                return {
+                    status: "unavailable",
+                    reason: "Exact policy-head acquisition was aborted by the caller",
+                };
+            }
+            if (Date.now() >= deadline) {
+                return {
+                    status: "unavailable",
+                    reason: "Exact policy-head acquisition deadline elapsed",
+                };
+            }
+            return undefined;
+        };
+        const priorAuthentication = this.exactAuthenticationInFlight;
+        if (priorAuthentication !== undefined) {
             try {
-                signal.addEventListener("abort", abortBeforeAcquisition, {
-                    once: true,
-                });
+                await Promise.race([
+                    priorAuthentication.catch(() => { }),
+                    interrupted,
+                ]);
             }
             catch {
-                settleBeforeAcquisition({
-                    status: "rejected",
-                    reason: "Policy lease signal could not be observed",
+                return (interruptionFailure() ?? {
+                    status: "unavailable",
+                    reason: "Exact policy authentication slot is unavailable",
                 });
             }
-            if (signal.aborted)
-                abortBeforeAcquisition();
+            const interruptedResult = interruptionFailure();
+            if (interruptedResult !== undefined)
+                return interruptedResult;
         }
-        armDeadlineWakeup();
-        return Promise.race([retainedResult, earlyResult]);
+        let entryBytes;
+        try {
+            entryBytes = await Promise.race([
+                Promise.resolve().then(() => resolver(policyEntryCid, { signal: callerSignal })),
+                interrupted,
+            ]);
+        }
+        catch (error) {
+            const interruptedResult = interruptionFailure();
+            if (interruptedResult !== undefined)
+                return interruptedResult;
+            return {
+                status: "unavailable",
+                reason: `Policy CID resolver dependency is unavailable: ${boundedDependencyReasonV2(error)}`,
+            };
+        }
+        if (entryBytes === undefined) {
+            return {
+                status: "unavailable",
+                reason: "Exact policy entry is unavailable from its CID resolver",
+            };
+        }
+        const authentication = Promise.resolve().then(() => this.authenticateExactPolicyEntry({
+            policyEntryCid,
+            entryBytes,
+            descriptor: this.descriptor,
+        }));
+        this.exactAuthenticationInFlight = authentication;
+        const clearAuthentication = () => {
+            if (this.exactAuthenticationInFlight === authentication) {
+                this.exactAuthenticationInFlight = undefined;
+            }
+        };
+        void authentication.then(clearAuthentication, clearAuthentication);
+        try {
+            const authenticated = await Promise.race([authentication, interrupted]);
+            const completedInterruption = interruptionFailure();
+            return (completedInterruption ?? { status: "resolved", lease: authenticated });
+        }
+        catch (error) {
+            const interruptedResult = interruptionFailure();
+            if (interruptedResult !== undefined)
+                return interruptedResult;
+            return {
+                status: "rejected",
+                reason: `Exact policy entry is invalid: ${boundedDependencyReasonV2(error)}`,
+            };
+        }
+    }
+    authenticateExactPolicyEntry(properties) {
+        return this.core.prepareExactPolicyEntry(properties.policyEntryCid, properties.entryBytes);
     }
     forkFailStopResult() {
         return {
@@ -1125,6 +1397,11 @@ export class TrustedNetworkV2DurablePolicyReducer {
             throw new Error("Policy-anchor checkpoint is unavailable");
         }
         await checkpoint.commit(payloadBytes);
+        // Atomic replacement is not cancellable. A lifecycle that ended while it
+        // was in flight may leave durable recovery state, but cannot publish it into
+        // the stale in-memory instance.
+        if (this.core.state === "HALTED")
+            return;
         this.durableCoreIdentityBytes = nextDurableCoreIdentityBytes;
         this.published = nextPublished;
         if (durableState.state === "FORKED") {