@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/principals/externalAdminPolicy.js

@@ -0,0 +1,176 @@
+import { KeyingVerificationError, verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
+import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { parseOrganizationAuthorityDescriptor, previousStatesIncludeHead, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { organizationAdminExternalAuthority, organizationAdminSignerUserIds, principalPolicyReferenceFromBundle, verifyOrganizationAdminPolicy, } from "../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "./policyVerification.js";
+export function externalAdminPolicyPersistenceEntries(authority) {
+    return [
+        { bundle: authority.bundle, policy: authority.policy },
+        { bundle: authority.adminBundle, policy: authority.adminPolicy },
+    ];
+}
+function assertAdminsPolicyShape(policy) {
+    if ((policy.history ?? [{ projection: policy.projection }]).some((entry) => entry.projection.length === 0 ||
+        entry.projection.some((member) => member.role !== "admin"))) {
+        throw new KeyingVerificationError("invalid_shape", "reserved Admins policy must contain only direct admin users");
+    }
+}
+/**
+ * A signer the caller cannot resolve is a cache miss, but a resolved signer
+ * whose trusted key differs from the one the policy signed with is a
+ * verification failure, as on every other policy path (#2365 finding 23).
+ */
+function signerKeyLoadFailure(error) {
+    if (error === "fingerprint-mismatch") {
+        throw new KeyingVerificationError("signer_mismatch", "external admin policy signer key fingerprint mismatch");
+    }
+    return null;
+}
+async function verifyOrganizationPolicy(input) {
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "organization", input.organizationId);
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: input.bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        return signerKeyLoadFailure(signerPublicKeys.error);
+    }
+    const verified = await verifyOrganizationAdminPolicy({
+        bundle: input.bundle,
+        localCheckpoint,
+        organizationId: input.organizationId,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    return verified.value;
+}
+function parseScopedAuthorityDescriptor(bundle, organizationId) {
+    let descriptor;
+    try {
+        descriptor = parseOrganizationAuthorityDescriptor(bundle.currentPayload.ciphertext);
+    }
+    catch {
+        throw new KeyingVerificationError("invalid_shape", "organization authority descriptor is invalid");
+    }
+    if (descriptor.organizationId !== organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "organization authority descriptor scope does not match");
+    }
+    return descriptor;
+}
+/**
+ * The organization and its Admins group are separate reads, so an honest
+ * Admins commit between them serves a chain that extends the head the
+ * directory cites: a stale directory, not tampering (#2365 finding 22). The
+ * claim is checked before any signer is trusted, so it is unverified and buys
+ * only one organization refetch; a disagreement after that is an incident.
+ */
+class AdminsHeadAdvanced extends Error {
+}
+async function loadVerifiedAdminsPolicy(input) {
+    const bundle = await input.getCurrentPrincipalPolicy("group", input.adminGroupId);
+    if (!bundle) {
+        return null;
+    }
+    if (!principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), input.expectedHead)) {
+        if (input.mayRefetchDirectory &&
+            previousStatesIncludeHead(bundle, input.expectedHead)) {
+            throw new AdminsHeadAdvanced();
+        }
+        throw new KeyingVerificationError("hash_mismatch", "reserved Admins policy does not match the signed organization directory");
+    }
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", input.adminGroupId);
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        return signerKeyLoadFailure(signerPublicKeys.error);
+    }
+    const verified = await verifyPrincipalPolicyBundle({
+        bundle,
+        expectedReference: input.expectedHead,
+        localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    if (verified.value.principalType !== "group" ||
+        verified.value.principalId !== input.adminGroupId) {
+        throw new KeyingVerificationError("object_mismatch", "reserved Admins policy target does not match");
+    }
+    assertAdminsPolicyShape(verified.value);
+    return { bundle, policy: verified.value };
+}
+async function loadExternalAdminPolicyOnce(input, organizationId, mayRefetchDirectory) {
+    const bundle = await input.getCurrentPrincipalPolicy("organization", organizationId);
+    if (!bundle) {
+        return null;
+    }
+    const policy = await verifyOrganizationPolicy({
+        bundle,
+        execSql: input.execSql,
+        organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if (!policy) {
+        return null;
+    }
+    const descriptor = parseScopedAuthorityDescriptor(bundle, organizationId);
+    const admin = await loadVerifiedAdminsPolicy({
+        adminGroupId: descriptor.adminGroupId,
+        mayRefetchDirectory,
+        expectedHead: requireOrganizationGroupHead(descriptor, descriptor.adminGroupId),
+        execSql: input.execSql,
+        getCurrentPrincipalPolicy: input.getCurrentPrincipalPolicy,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if (!admin) {
+        return null;
+    }
+    const verified = {
+        adminBundle: admin.bundle,
+        adminGroupId: descriptor.adminGroupId,
+        adminPolicy: admin.policy,
+        bundle,
+        descriptor,
+        externalAuthority: organizationAdminExternalAuthority(admin.policy),
+        memberGroupId: descriptor.memberGroupId,
+        policy,
+        signerUserIds: organizationAdminSignerUserIds(admin.policy),
+    };
+    await persistVerifiedPrincipalPolicyBundlesAtomically({
+        entries: externalAdminPolicyPersistenceEntries(verified),
+        execSql: input.execSql,
+        organizationId,
+        stillCurrent: input.stillCurrent,
+        updatedAt: new Date().toISOString(),
+    });
+    return verified;
+}
+export async function loadOrganizationExternalAdminPolicy(input) {
+    const { organizationId } = input;
+    if (!organizationId) {
+        return null;
+    }
+    try {
+        try {
+            return await loadExternalAdminPolicyOnce(input, organizationId, true);
+        }
+        catch (error) {
+            if (!(error instanceof AdminsHeadAdvanced))
+                throw error;
+            return await loadExternalAdminPolicyOnce(input, organizationId, false);
+        }
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError) {
+            throw error;
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=externalAdminPolicy.js.map

package/workflows/principals/externalAdminPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"externalAdminPolicy.js","sourceRoot":"","sources":["externalAdminPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,+CAA+C,EAAE,MAAM,2DAA2D,CAAC;AAC5H,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAEL,oCAAoC,EACpC,yBAAyB,EACzB,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,kCAAkC,EAClC,6BAA6B,GAC9B,MAAM,mDAAmD,CAAC;AAG3D,OAAO,EACL,sCAAsC,GAEvC,MAAM,sBAAsB,CAAC;AAc9B,MAAM,UAAU,qCAAqC,CACnD,SAAsC;IAKtC,OAAO;QACL,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QACtD,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,IACE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAkD;IAElD,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAKvC;IACC,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAqC,EACrC,cAAsB;IAEtB,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,oCAAoC,CAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAmB,SAAQ,KAAK;CAAG;AAEzC,KAAK,UAAU,wBAAwB,CAAC,KAUvC;IAIC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAClD,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,IACE,KAAK,CAAC,mBAAmB;YACzB,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;QACxC,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,EACjD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAaD,KAAK,UAAU,2BAA2B,CACxC,KAA+B,EAC/B,cAAsB,EACtB,mBAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAClD,cAAc,EACd,cAAc,CACf,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,8BAA8B,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC;QAC3C,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,mBAAmB;QACnB,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAgC;QAC5C,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,MAAM;QACN,UAAU;QACV,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,MAAM;QACN,aAAa,EAAE,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC;KAC5D,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,qCAAqC,CAAC,QAAQ,CAAC;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA+B;IAE/B,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IACjC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,2BAA2B,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,OAAO,MAAM,2BAA2B,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  previousStatesIncludeHead,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  organizationAdminSignerUserIds,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n} from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"./policyVerification\";\n\nexport interface VerifiedExternalAdminPolicy {\n  readonly adminBundle: PrincipalPolicyBundleResponse;\n  readonly adminGroupId: string;\n  readonly adminPolicy: VerifiedPrincipalPolicy;\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly memberGroupId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority;\n  readonly signerUserIds: readonly string[];\n}\n\nexport function externalAdminPolicyPersistenceEntries(\n  authority: VerifiedExternalAdminPolicy,\n): ReadonlyArray<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}> {\n  return [\n    { bundle: authority.bundle, policy: authority.policy },\n    { bundle: authority.adminBundle, policy: authority.adminPolicy },\n  ];\n}\n\nfunction assertAdminsPolicyShape(policy: VerifiedPrincipalPolicy): void {\n  if (\n    (policy.history ?? [{ projection: policy.projection }]).some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\n/**\n * A signer the caller cannot resolve is a cache miss, but a resolved signer\n * whose trusted key differs from the one the policy signed with is a\n * verification failure, as on every other policy path (#2365 finding 23).\n */\nfunction signerKeyLoadFailure(\n  error: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): null {\n  if (error === \"fingerprint-mismatch\") {\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"external admin policy signer key fingerprint mismatch\",\n    );\n  }\n  return null;\n}\n\nasync function verifyOrganizationPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<VerifiedPrincipalPolicy | null> {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: input.bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    return signerKeyLoadFailure(signerPublicKeys.error);\n  }\n  const verified = await verifyOrganizationAdminPolicy({\n    bundle: input.bundle,\n    localCheckpoint,\n    organizationId: input.organizationId,\n    signerPublicKeys: signerPublicKeys.signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  return verified.value;\n}\n\nfunction parseScopedAuthorityDescriptor(\n  bundle: PrincipalPolicyBundleResponse,\n  organizationId: string,\n): OrganizationAuthorityDescriptor {\n  let descriptor: OrganizationAuthorityDescriptor;\n  try {\n    descriptor = parseOrganizationAuthorityDescriptor(\n      bundle.currentPayload.ciphertext,\n    );\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"organization authority descriptor is invalid\",\n    );\n  }\n  if (descriptor.organizationId !== organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"organization authority descriptor scope does not match\",\n    );\n  }\n  return descriptor;\n}\n\n/**\n * The organization and its Admins group are separate reads, so an honest\n * Admins commit between them serves a chain that extends the head the\n * directory cites: a stale directory, not tampering (#2365 finding 22). The\n * claim is checked before any signer is trusted, so it is unverified and buys\n * only one organization refetch; a disagreement after that is an incident.\n */\nclass AdminsHeadAdvanced extends Error {}\n\nasync function loadVerifiedAdminsPolicy(input: {\n  readonly adminGroupId: string;\n  readonly expectedHead: ReturnType<typeof requireOrganizationGroupHead>;\n  readonly mayRefetchDirectory: boolean;\n  readonly execSql: ExecSql;\n  readonly getCurrentPrincipalPolicy: (\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n  ) => Promise<PrincipalPolicyBundleResponse | null>;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n} | null> {\n  const bundle = await input.getCurrentPrincipalPolicy(\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!bundle) {\n    return null;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedHead,\n    )\n  ) {\n    if (\n      input.mayRefetchDirectory &&\n      previousStatesIncludeHead(bundle, input.expectedHead)\n    ) {\n      throw new AdminsHeadAdvanced();\n    }\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"reserved Admins policy does not match the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    return signerKeyLoadFailure(signerPublicKeys.error);\n  }\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint,\n    signerPublicKeys: signerPublicKeys.signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (\n    verified.value.principalType !== \"group\" ||\n    verified.value.principalId !== input.adminGroupId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"reserved Admins policy target does not match\",\n    );\n  }\n  assertAdminsPolicyShape(verified.value);\n  return { bundle, policy: verified.value };\n}\n\ninterface ExternalAdminPolicyInput {\n  readonly execSql: ExecSql;\n  readonly getCurrentPrincipalPolicy: (\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n  ) => Promise<PrincipalPolicyBundleResponse | null>;\n  readonly organizationId: string | null | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nasync function loadExternalAdminPolicyOnce(\n  input: ExternalAdminPolicyInput,\n  organizationId: string,\n  mayRefetchDirectory: boolean,\n): Promise<VerifiedExternalAdminPolicy | null> {\n  const bundle = await input.getCurrentPrincipalPolicy(\n    \"organization\",\n    organizationId,\n  );\n  if (!bundle) {\n    return null;\n  }\n  const policy = await verifyOrganizationPolicy({\n    bundle,\n    execSql: input.execSql,\n    organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!policy) {\n    return null;\n  }\n  const descriptor = parseScopedAuthorityDescriptor(bundle, organizationId);\n  const admin = await loadVerifiedAdminsPolicy({\n    adminGroupId: descriptor.adminGroupId,\n    mayRefetchDirectory,\n    expectedHead: requireOrganizationGroupHead(\n      descriptor,\n      descriptor.adminGroupId,\n    ),\n    execSql: input.execSql,\n    getCurrentPrincipalPolicy: input.getCurrentPrincipalPolicy,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!admin) {\n    return null;\n  }\n\n  const verified: VerifiedExternalAdminPolicy = {\n    adminBundle: admin.bundle,\n    adminGroupId: descriptor.adminGroupId,\n    adminPolicy: admin.policy,\n    bundle,\n    descriptor,\n    externalAuthority: organizationAdminExternalAuthority(admin.policy),\n    memberGroupId: descriptor.memberGroupId,\n    policy,\n    signerUserIds: organizationAdminSignerUserIds(admin.policy),\n  };\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: externalAdminPolicyPersistenceEntries(verified),\n    execSql: input.execSql,\n    organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return verified;\n}\n\nexport async function loadOrganizationExternalAdminPolicy(\n  input: ExternalAdminPolicyInput,\n): Promise<VerifiedExternalAdminPolicy | null> {\n  const { organizationId } = input;\n  if (!organizationId) {\n    return null;\n  }\n  try {\n    try {\n      return await loadExternalAdminPolicyOnce(input, organizationId, true);\n    } catch (error) {\n      if (!(error instanceof AdminsHeadAdvanced)) throw error;\n      return await loadExternalAdminPolicyOnce(input, organizationId, false);\n    }\n  } catch (error) {\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n"]}

package/workflows/principals/index.d.ts

@@ -0,0 +1,3 @@
+export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
+export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./principalHistoryRecoveryTypes.js";
+export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";

package/workflows/principals/index.js

@@ -0,0 +1,4 @@
+export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
+export { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
+export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+//# sourceMappingURL=index.js.map

package/workflows/principals/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC","sourcesContent":["export {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n"]}

package/workflows/principals/policyCache.d.ts

@@ -0,0 +1,19 @@
+import type { PrincipalPolicyBundleResponse, ReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
+import type { SecurityIncidentReporter } from "../../data/securityIncidents.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
+export interface CacheReferencedPrincipalPoliciesOptions {
+    execSql: ExecSql;
+    getCurrentPrincipalPolicy: (principalType: "group" | "organization", principalId: string) => Promise<PrincipalPolicyBundleResponse | null>;
+    log?: (message: string) => void;
+    organizationId: string;
+    reportSecurityIncident: SecurityIncidentReporter;
+    references: ReadonlyArray<ReferencedPrincipalStateResponse> | undefined;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    stillCurrent?: (() => boolean) | undefined;
+}
+export interface CachePrincipalPolicyBundlesOptions extends Omit<CacheReferencedPrincipalPoliciesOptions, "references"> {
+    bundles: ReadonlyArray<PrincipalPolicyBundleResponse> | undefined;
+}
+export declare function cacheReferencedPrincipalPolicies(input: CacheReferencedPrincipalPoliciesOptions): Promise<void>;
+export declare function cachePrincipalPolicyBundles({ bundles, execSql, getCurrentPrincipalPolicy, log, organizationId, reportSecurityIncident, resolveTrustedUserIdentity, stillCurrent, }: CachePrincipalPolicyBundlesOptions): Promise<void>;

package/workflows/principals/policyCache.js

@@ -0,0 +1,242 @@
+import { errorMessage } from "../../data/errorMessage.js";
+import { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification.js";
+import { reportAndRethrowKeyingVerificationError, rethrowKeyingVerificationError, } from "../../data/keyingProjectionVerification/error.js";
+import { dedupeReferencedPrincipalStates } from "../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { ensurePrincipalPolicyTables } from "../../data/persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../data/persistence/principalPolicyReferencePersistence.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "./externalAdminPolicy.js";
+import { persistPrincipalPolicyCacheEntries, retryPrincipalPolicyCacheAdvance, } from "./principalPolicyCacheAdvance.js";
+import { scopeReferencedPolicyForCache } from "./principalPolicyCacheScope.js";
+import { validatePrincipalPolicyBundleForCache } from "./principalPolicyCacheValidation.js";
+import { createPolicyDirectoryLoader, directoryBindsGroupReference, } from "./principalPolicyOrganizationScope.js";
+function getReferencedPrincipalKey(reference) {
+    return `${reference.principalType}:${reference.principalId}`;
+}
+function getBundlePrincipalKey(bundle) {
+    return `${bundle.currentState.principalType}:${bundle.currentState.principalId}`;
+}
+function dedupePrincipalPolicyBundles(bundles) {
+    const bundlesByPrincipal = new Map();
+    for (const bundle of bundles) {
+        const key = getBundlePrincipalKey(bundle);
+        const previous = bundlesByPrincipal.get(key);
+        if (!previous ||
+            bundle.currentState.version > previous.currentState.version) {
+            bundlesByPrincipal.set(key, bundle);
+        }
+    }
+    return Array.from(bundlesByPrincipal.values());
+}
+async function cacheReferencedPrincipalPolicy(execSql, getCurrentPrincipalPolicy, reference, resolveTrustedUserIdentity, log, loadExternalAdminPolicy, organizationId, stillCurrent, loadDirectory, fresh) {
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, reference.principalType, reference.principalId);
+    // Only null is a recoverable local miss. Integrity failures remain typed and
+    // must escape rather than being hidden by a canonical network retry.
+    const cachedBundle = fresh
+        ? null
+        : await loadPrincipalPolicyBundleForReference(execSql, reference, localCheckpoint);
+    let bundle = cachedBundle ??
+        (await getCurrentPrincipalPolicy(reference.principalType, reference.principalId));
+    if (!bundle) {
+        log?.(`Principal policy cache: failed to fetch ${getReferencedPrincipalKey(reference)}`);
+        return [];
+    }
+    let validation = await validatePrincipalPolicyBundleForCache({
+        bundle,
+        loadExternalAdminPolicy,
+        localCheckpoint,
+        reference,
+        resolveTrustedUserIdentity,
+    });
+    if (!validation.ok) {
+        throw validation.error;
+    }
+    const scoped = await scopeReferencedPolicyForCache({
+        bundle,
+        validation,
+        validationInput: {
+            loadExternalAdminPolicy,
+            localCheckpoint,
+            reference,
+            resolveTrustedUserIdentity,
+        },
+        loadDirectory,
+        organizationId,
+        reloadBundle: cachedBundle
+            ? () => getCurrentPrincipalPolicy("group", reference.principalId)
+            : null,
+    });
+    if (!scoped) {
+        log?.(`Principal policy cache: signed organization directory does not cover ${getReferencedPrincipalKey(reference)}`);
+        return [];
+    }
+    bundle = scoped.bundle;
+    validation = scoped.validation;
+    const directory = scoped.directory;
+    const externalEntries = validation.externalAdminPolicy
+        ? externalAdminPolicyPersistenceEntries(validation.externalAdminPolicy).filter((entry) => !directory || entry.policy.principalType !== "organization")
+        : [];
+    const directoryEntries = directory
+        ? [{ bundle: directory.bundle, policy: directory.policy }]
+        : [];
+    await persistPrincipalPolicyCacheEntries({
+        entries: [
+            ...externalEntries,
+            ...directoryEntries,
+            { bundle, policy: validation.policy },
+        ],
+        execSql,
+        organizationId,
+        updatedAt: new Date().toISOString(),
+        stillCurrent,
+    });
+    return [...externalEntries.map(({ policy }) => policy), validation.policy];
+}
+async function cachePrincipalPolicyBundle(input) {
+    const reference = principalPolicyReferenceFromBundle(input.bundle);
+    // The API supplied this bundle after rejecting a write, but local storage is
+    // only updated after normal signature, signer, and checkpoint verification.
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, reference.principalType, reference.principalId);
+    const validation = await validatePrincipalPolicyBundleForCache({
+        bundle: input.bundle,
+        loadExternalAdminPolicy: input.loadExternalAdminPolicy,
+        localCheckpoint,
+        reference,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if (!validation.ok) {
+        throw validation.error;
+    }
+    let directory = null;
+    if (reference.principalType === "group") {
+        directory = await input.loadDirectory(false);
+        if (!directoryBindsGroupReference(directory, validation.policy, reference))
+            directory = await input.loadDirectory(true);
+        if (!directoryBindsGroupReference(directory, validation.policy, reference)) {
+            input.log?.("Principal policy cache: signed organization directory does not cover supplied group");
+            return [];
+        }
+    }
+    else if (reference.principalId !== input.organizationId) {
+        return [];
+    }
+    const externalEntries = validation.externalAdminPolicy
+        ? externalAdminPolicyPersistenceEntries(validation.externalAdminPolicy).filter((entry) => !directory || entry.policy.principalType !== "organization")
+        : [];
+    const directoryEntries = directory
+        ? [{ bundle: directory.bundle, policy: directory.policy }]
+        : [];
+    await persistPrincipalPolicyCacheEntries({
+        entries: [
+            ...externalEntries,
+            ...directoryEntries,
+            { bundle: input.bundle, policy: validation.policy },
+        ],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        updatedAt: new Date().toISOString(),
+        stillCurrent: input.stillCurrent,
+    });
+    return [...externalEntries.map(({ policy }) => policy), validation.policy];
+}
+async function runPrincipalPolicyCache(input) {
+    if (!input.items || input.items.length === 0) {
+        return [];
+    }
+    try {
+        await ensurePrincipalPolicyTables(input.execSql);
+        const uniqueItems = input.dedupe(input.items);
+        const loadDirectory = createPolicyDirectoryLoader(input);
+        let externalAdminPolicy = null;
+        const loadExternalAdminPolicy = () => {
+            externalAdminPolicy ??= loadOrganizationExternalAdminPolicy({
+                execSql: input.execSql,
+                getCurrentPrincipalPolicy: input.getCurrentPrincipalPolicy,
+                organizationId: input.organizationId,
+                resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+                stillCurrent: input.stillCurrent,
+            });
+            return externalAdminPolicy;
+        };
+        const results = await Promise.all(uniqueItems.map(async (item) => {
+            try {
+                return await retryPrincipalPolicyCacheAdvance((fresh) => {
+                    const reloadDirectory = createPolicyDirectoryLoader(input);
+                    let reloadedAuthority = null;
+                    return input.cacheItem(item, fresh
+                        ? () => (reloadedAuthority ??=
+                            loadOrganizationExternalAdminPolicy(input))
+                        : loadExternalAdminPolicy, fresh ? () => reloadDirectory(true) : loadDirectory, fresh);
+                });
+            }
+            catch (error) {
+                if (isProjectionVerificationCancelledError(error))
+                    return [];
+                await reportAndRethrowKeyingVerificationError(error, input.reportSecurityIncident, {
+                    objectId: input.itemKey(item),
+                    objectKind: "principal",
+                    operation: "principal.policy.cache",
+                    organizationId: input.organizationId,
+                });
+                const message = errorMessage(error);
+                input.log?.(`Principal policy cache: failed to store ${input.itemKey(item)}: ${message}`);
+                return [];
+            }
+        }));
+        return results.flat();
+    }
+    catch (error) {
+        if (isProjectionVerificationCancelledError(error))
+            return [];
+        // Per-item verification failures were reported above before reaching this
+        // initialization/aggregation boundary.
+        rethrowKeyingVerificationError(error);
+        const message = errorMessage(error);
+        input.log?.(`Principal policy cache: failed to initialize cache: ${message}`);
+        return [];
+    }
+}
+async function loadReferencedPrincipalPolicies({ execSql, getCurrentPrincipalPolicy, log, organizationId, reportSecurityIncident, references, resolveTrustedUserIdentity, stillCurrent, }) {
+    return runPrincipalPolicyCache({
+        cacheItem: (reference, loadExternalAdminPolicy, loadDirectory, fresh) => cacheReferencedPrincipalPolicy(execSql, getCurrentPrincipalPolicy, reference, resolveTrustedUserIdentity, log, loadExternalAdminPolicy, organizationId, stillCurrent, loadDirectory, fresh),
+        dedupe: dedupeReferencedPrincipalStates,
+        execSql,
+        getCurrentPrincipalPolicy,
+        itemKey: getReferencedPrincipalKey,
+        items: references,
+        log,
+        organizationId,
+        reportSecurityIncident,
+        resolveTrustedUserIdentity,
+        stillCurrent,
+    });
+}
+export async function cacheReferencedPrincipalPolicies(input) {
+    await loadReferencedPrincipalPolicies(input);
+}
+export async function cachePrincipalPolicyBundles({ bundles, execSql, getCurrentPrincipalPolicy, log, organizationId, reportSecurityIncident, resolveTrustedUserIdentity, stillCurrent, }) {
+    await runPrincipalPolicyCache({
+        cacheItem: (bundle, loadExternalAdminPolicy, loadDirectory) => cachePrincipalPolicyBundle({
+            bundle,
+            execSql,
+            loadExternalAdminPolicy,
+            loadDirectory,
+            log,
+            organizationId,
+            resolveTrustedUserIdentity,
+            stillCurrent,
+        }),
+        dedupe: dedupePrincipalPolicyBundles,
+        execSql,
+        getCurrentPrincipalPolicy,
+        itemKey: getBundlePrincipalKey,
+        items: bundles,
+        log,
+        organizationId,
+        reportSecurityIncident,
+        resolveTrustedUserIdentity,
+        stillCurrent,
+    });
+}
+//# sourceMappingURL=policyCache.js.map

package/workflows/principals/policyCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyCache.js","sourceRoot":"","sources":["policyCache.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AACjG,OAAO,EACL,uCAAuC,EACvC,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,8DAA8D,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AACnH,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAIvG,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAG7B,MAAM,oCAAoC,CAAC;AAqB5C,SAAS,yBAAyB,CAChC,SAA2C;IAE3C,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAqC;IAClE,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,4BAA4B,CACnC,OAAqD;IAErD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE5E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IACE,CAAC,QAAQ;YACT,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAC3D,CAAC;YACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAgB,EAChB,yBAA+F,EAC/F,SAA2C,EAC3C,0BAAuD,EACvD,GAA4C,EAC5C,uBAA0E,EAC1E,cAAsB,EACtB,YAAyC,EACzC,aAAoC,EACpC,KAAc;IAEd,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,OAAO,EACP,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,YAAY,GAAG,KAAK;QACxB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,qCAAqC,CACzC,OAAO,EACP,SAAS,EACT,eAAe,CAChB,CAAC;IACN,IAAI,MAAM,GACR,YAAY;QACZ,CAAC,MAAM,yBAAyB,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,EAAE,CACH,2CAA2C,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAClF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC3D,MAAM;QACN,uBAAuB;QACvB,eAAe;QACf,SAAS;QACT,0BAA0B;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,MAAM;QACN,UAAU;QACV,eAAe,EAAE;YACf,uBAAuB;YACvB,eAAe;YACf,SAAS;YACT,0BAA0B;SAC3B;QACD,aAAa;QACb,cAAc;QACd,YAAY,EAAE,YAAY;YACxB,CAAC,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC;YACjE,CAAC,CAAC,IAAI;KACT,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,EAAE,CACH,wEAAwE,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAC/G,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACvB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,eAAe,GAAG,UAAU,CAAC,mBAAmB;QACpD,CAAC,CAAC,qCAAqC,CACnC,UAAU,CAAC,mBAAmB,CAC/B,CAAC,MAAM,CACN,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,cAAc,CACvE;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,SAAS;QAChC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE;YACP,GAAG,eAAe;YAClB,GAAG,gBAAgB;YACnB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;SACtC;QACD,OAAO;QACP,cAAc;QACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;KACb,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KASzC;IACC,MAAM,SAAS,GAAG,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe;QACf,SAAS;QACT,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,IAAI,SAAS,GAAmC,IAAI,CAAC;IACrD,IAAI,SAAS,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACxC,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC;YACxE,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9C,IACE,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EACtE,CAAC;YACD,KAAK,CAAC,GAAG,EAAE,CACT,qFAAqF,CACtF,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,GAAG,UAAU,CAAC,mBAAmB;QACpD,CAAC,CAAC,qCAAqC,CACnC,UAAU,CAAC,mBAAmB,CAC/B,CAAC,MAAM,CACN,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,cAAc,CACvE;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,SAAS;QAChC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE;YACP,GAAG,eAAe;YAClB,GAAG,gBAAgB;YACnB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;SACpD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAe,KAiBpD;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,mBAAmB,GACrB,IAAI,CAAC;QACP,MAAM,uBAAuB,GAAG,GAAG,EAAE;YACnC,mBAAmB,KAAK,mCAAmC,CAAC;gBAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;gBAC1D,cAAc,EAAE,KAAK,CAAC,cAAc;gBAEpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;gBAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;YACH,OAAO,mBAAmB,CAAC;QAC7B,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,OAAO,MAAM,gCAAgC,CAAC,CAAC,KAAK,EAAE,EAAE;oBACtD,MAAM,eAAe,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;oBAC3D,IAAI,iBAAiB,GACnB,IAAI,CAAC;oBACP,OAAO,KAAK,CAAC,SAAS,CACpB,IAAI,EACJ,KAAK;wBACH,CAAC,CAAC,GAAG,EAAE,CACH,CAAC,iBAAiB;4BAChB,mCAAmC,CAAC,KAAK,CAAC,CAAC;wBACjD,CAAC,CAAC,uBAAuB,EAC3B,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EACnD,KAAK,CACN,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAC;gBAC7D,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;oBACE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC7B,UAAU,EAAE,WAAW;oBACvB,SAAS,EAAE,wBAAwB;oBACnC,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CACF,CAAC;gBACF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpC,KAAK,CAAC,GAAG,EAAE,CACT,2CAA2C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAC7E,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7D,0EAA0E;QAC1E,uCAAuC;QACvC,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,CAAC,GAAG,EAAE,CACT,uDAAuD,OAAO,EAAE,CACjE,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,EAC7C,OAAO,EACP,yBAAyB,EACzB,GAAG,EACH,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,0BAA0B,EAC1B,YAAY,GAC4B;IAGxC,OAAO,uBAAuB,CAAC;QAC7B,SAAS,EAAE,CAAC,SAAS,EAAE,uBAAuB,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CACtE,8BAA8B,CAC5B,OAAO,EACP,yBAAyB,EACzB,SAAS,EACT,0BAA0B,EAC1B,GAAG,EACH,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,KAAK,CACN;QACH,MAAM,EAAE,+BAA+B;QACvC,OAAO;QACP,yBAAyB;QACzB,OAAO,EAAE,yBAAyB;QAClC,KAAK,EAAE,UAAU;QACjB,GAAG;QACH,cAAc;QAEd,sBAAsB;QACtB,0BAA0B;QAC1B,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA8C;IAE9C,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,OAAO,EACP,OAAO,EACP,yBAAyB,EACzB,GAAG,EACH,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,YAAY,GACuB;IACnC,MAAM,uBAAuB,CAAC;QAC5B,SAAS,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,EAAE,CAC5D,0BAA0B,CAAC;YACzB,MAAM;YACN,OAAO;YACP,uBAAuB;YACvB,aAAa;YACb,GAAG;YACH,cAAc;YACd,0BAA0B;YAC1B,YAAY;SACb,CAAC;QACJ,MAAM,EAAE,4BAA4B;QACpC,OAAO;QACP,yBAAyB;QACzB,OAAO,EAAE,qBAAqB;QAC9B,KAAK,EAAE,OAAO;QACd,GAAG;QACH,cAAc;QAEd,sBAAsB;QACtB,0BAA0B;QAC1B,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { errorMessage } from \"../../data/errorMessage\";\nimport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification\";\nimport {\n  reportAndRethrowKeyingVerificationError,\n  rethrowKeyingVerificationError,\n} from \"../../data/keyingProjectionVerification/error\";\nimport { dedupeReferencedPrincipalStates } from \"../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { ensurePrincipalPolicyTables } from \"../../data/persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../data/persistence/principalPolicyReferencePersistence\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"./externalAdminPolicy\";\nimport {\n  persistPrincipalPolicyCacheEntries,\n  retryPrincipalPolicyCacheAdvance,\n} from \"./principalPolicyCacheAdvance\";\nimport { scopeReferencedPolicyForCache } from \"./principalPolicyCacheScope\";\nimport { validatePrincipalPolicyBundleForCache } from \"./principalPolicyCacheValidation\";\nimport {\n  createPolicyDirectoryLoader,\n  directoryBindsGroupReference,\n  type PolicyDirectoryLoader,\n  type VerifiedPolicyDirectory,\n} from \"./principalPolicyOrganizationScope\";\n\nexport interface CacheReferencedPrincipalPoliciesOptions {\n  execSql: ExecSql;\n  getCurrentPrincipalPolicy: (\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n  ) => Promise<PrincipalPolicyBundleResponse | null>;\n  log?: (message: string) => void;\n  organizationId: string;\n  reportSecurityIncident: SecurityIncidentReporter;\n  references: ReadonlyArray<ReferencedPrincipalStateResponse> | undefined;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface CachePrincipalPolicyBundlesOptions\n  extends Omit<CacheReferencedPrincipalPoliciesOptions, \"references\"> {\n  bundles: ReadonlyArray<PrincipalPolicyBundleResponse> | undefined;\n}\n\nfunction getReferencedPrincipalKey(\n  reference: ReferencedPrincipalStateResponse,\n): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nfunction getBundlePrincipalKey(bundle: PrincipalPolicyBundleResponse): string {\n  return `${bundle.currentState.principalType}:${bundle.currentState.principalId}`;\n}\n\nfunction dedupePrincipalPolicyBundles(\n  bundles: ReadonlyArray<PrincipalPolicyBundleResponse>,\n): PrincipalPolicyBundleResponse[] {\n  const bundlesByPrincipal = new Map<string, PrincipalPolicyBundleResponse>();\n\n  for (const bundle of bundles) {\n    const key = getBundlePrincipalKey(bundle);\n    const previous = bundlesByPrincipal.get(key);\n    if (\n      !previous ||\n      bundle.currentState.version > previous.currentState.version\n    ) {\n      bundlesByPrincipal.set(key, bundle);\n    }\n  }\n\n  return Array.from(bundlesByPrincipal.values());\n}\n\nasync function cacheReferencedPrincipalPolicy(\n  execSql: ExecSql,\n  getCurrentPrincipalPolicy: CacheReferencedPrincipalPoliciesOptions[\"getCurrentPrincipalPolicy\"],\n  reference: ReferencedPrincipalStateResponse,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  log: ((message: string) => void) | undefined,\n  loadExternalAdminPolicy: () => Promise<VerifiedExternalAdminPolicy | null>,\n  organizationId: string,\n  stillCurrent: (() => boolean) | undefined,\n  loadDirectory: PolicyDirectoryLoader,\n  fresh: boolean,\n): Promise<VerifiedPrincipalPolicy[]> {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    reference.principalType,\n    reference.principalId,\n  );\n  // Only null is a recoverable local miss. Integrity failures remain typed and\n  // must escape rather than being hidden by a canonical network retry.\n  const cachedBundle = fresh\n    ? null\n    : await loadPrincipalPolicyBundleForReference(\n        execSql,\n        reference,\n        localCheckpoint,\n      );\n  let bundle =\n    cachedBundle ??\n    (await getCurrentPrincipalPolicy(\n      reference.principalType,\n      reference.principalId,\n    ));\n  if (!bundle) {\n    log?.(\n      `Principal policy cache: failed to fetch ${getReferencedPrincipalKey(reference)}`,\n    );\n    return [];\n  }\n\n  let validation = await validatePrincipalPolicyBundleForCache({\n    bundle,\n    loadExternalAdminPolicy,\n    localCheckpoint,\n    reference,\n    resolveTrustedUserIdentity,\n  });\n  if (!validation.ok) {\n    throw validation.error;\n  }\n\n  const scoped = await scopeReferencedPolicyForCache({\n    bundle,\n    validation,\n    validationInput: {\n      loadExternalAdminPolicy,\n      localCheckpoint,\n      reference,\n      resolveTrustedUserIdentity,\n    },\n    loadDirectory,\n    organizationId,\n    reloadBundle: cachedBundle\n      ? () => getCurrentPrincipalPolicy(\"group\", reference.principalId)\n      : null,\n  });\n  if (!scoped) {\n    log?.(\n      `Principal policy cache: signed organization directory does not cover ${getReferencedPrincipalKey(reference)}`,\n    );\n    return [];\n  }\n  bundle = scoped.bundle;\n  validation = scoped.validation;\n  const directory = scoped.directory;\n  const externalEntries = validation.externalAdminPolicy\n    ? externalAdminPolicyPersistenceEntries(\n        validation.externalAdminPolicy,\n      ).filter(\n        (entry) => !directory || entry.policy.principalType !== \"organization\",\n      )\n    : [];\n  const directoryEntries = directory\n    ? [{ bundle: directory.bundle, policy: directory.policy }]\n    : [];\n  await persistPrincipalPolicyCacheEntries({\n    entries: [\n      ...externalEntries,\n      ...directoryEntries,\n      { bundle, policy: validation.policy },\n    ],\n    execSql,\n    organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent,\n  });\n  return [...externalEntries.map(({ policy }) => policy), validation.policy];\n}\n\nasync function cachePrincipalPolicyBundle(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly loadExternalAdminPolicy: () => Promise<VerifiedExternalAdminPolicy | null>;\n  readonly log: ((message: string) => void) | undefined;\n  readonly loadDirectory: PolicyDirectoryLoader;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const reference = principalPolicyReferenceFromBundle(input.bundle);\n  // The API supplied this bundle after rejecting a write, but local storage is\n  // only updated after normal signature, signer, and checkpoint verification.\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    reference.principalType,\n    reference.principalId,\n  );\n  const validation = await validatePrincipalPolicyBundleForCache({\n    bundle: input.bundle,\n    loadExternalAdminPolicy: input.loadExternalAdminPolicy,\n    localCheckpoint,\n    reference,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!validation.ok) {\n    throw validation.error;\n  }\n\n  let directory: VerifiedPolicyDirectory | null = null;\n  if (reference.principalType === \"group\") {\n    directory = await input.loadDirectory(false);\n    if (!directoryBindsGroupReference(directory, validation.policy, reference))\n      directory = await input.loadDirectory(true);\n    if (\n      !directoryBindsGroupReference(directory, validation.policy, reference)\n    ) {\n      input.log?.(\n        \"Principal policy cache: signed organization directory does not cover supplied group\",\n      );\n      return [];\n    }\n  } else if (reference.principalId !== input.organizationId) {\n    return [];\n  }\n  const externalEntries = validation.externalAdminPolicy\n    ? externalAdminPolicyPersistenceEntries(\n        validation.externalAdminPolicy,\n      ).filter(\n        (entry) => !directory || entry.policy.principalType !== \"organization\",\n      )\n    : [];\n  const directoryEntries = directory\n    ? [{ bundle: directory.bundle, policy: directory.policy }]\n    : [];\n  await persistPrincipalPolicyCacheEntries({\n    entries: [\n      ...externalEntries,\n      ...directoryEntries,\n      { bundle: input.bundle, policy: validation.policy },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent: input.stillCurrent,\n  });\n  return [...externalEntries.map(({ policy }) => policy), validation.policy];\n}\n\nasync function runPrincipalPolicyCache<Item, Result>(input: {\n  readonly cacheItem: (\n    item: Item,\n    loadExternalAdminPolicy: () => Promise<VerifiedExternalAdminPolicy | null>,\n    loadDirectory: PolicyDirectoryLoader,\n    fresh: boolean,\n  ) => Promise<readonly Result[]>;\n  readonly dedupe: (items: ReadonlyArray<Item>) => Item[];\n  readonly execSql: ExecSql;\n  readonly getCurrentPrincipalPolicy: CacheReferencedPrincipalPoliciesOptions[\"getCurrentPrincipalPolicy\"];\n  readonly itemKey: (item: Item) => string;\n  readonly items: ReadonlyArray<Item> | undefined;\n  readonly log: ((message: string) => void) | undefined;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<Result[]> {\n  if (!input.items || input.items.length === 0) {\n    return [];\n  }\n\n  try {\n    await ensurePrincipalPolicyTables(input.execSql);\n    const uniqueItems = input.dedupe(input.items);\n    const loadDirectory = createPolicyDirectoryLoader(input);\n    let externalAdminPolicy: Promise<VerifiedExternalAdminPolicy | null> | null =\n      null;\n    const loadExternalAdminPolicy = () => {\n      externalAdminPolicy ??= loadOrganizationExternalAdminPolicy({\n        execSql: input.execSql,\n        getCurrentPrincipalPolicy: input.getCurrentPrincipalPolicy,\n        organizationId: input.organizationId,\n\n        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n        stillCurrent: input.stillCurrent,\n      });\n      return externalAdminPolicy;\n    };\n\n    const results = await Promise.all(\n      uniqueItems.map(async (item) => {\n        try {\n          return await retryPrincipalPolicyCacheAdvance((fresh) => {\n            const reloadDirectory = createPolicyDirectoryLoader(input);\n            let reloadedAuthority: Promise<VerifiedExternalAdminPolicy | null> | null =\n              null;\n            return input.cacheItem(\n              item,\n              fresh\n                ? () =>\n                    (reloadedAuthority ??=\n                      loadOrganizationExternalAdminPolicy(input))\n                : loadExternalAdminPolicy,\n              fresh ? () => reloadDirectory(true) : loadDirectory,\n              fresh,\n            );\n          });\n        } catch (error) {\n          if (isProjectionVerificationCancelledError(error)) return [];\n          await reportAndRethrowKeyingVerificationError(\n            error,\n            input.reportSecurityIncident,\n            {\n              objectId: input.itemKey(item),\n              objectKind: \"principal\",\n              operation: \"principal.policy.cache\",\n              organizationId: input.organizationId,\n            },\n          );\n          const message = errorMessage(error);\n          input.log?.(\n            `Principal policy cache: failed to store ${input.itemKey(item)}: ${message}`,\n          );\n          return [];\n        }\n      }),\n    );\n    return results.flat();\n  } catch (error) {\n    if (isProjectionVerificationCancelledError(error)) return [];\n    // Per-item verification failures were reported above before reaching this\n    // initialization/aggregation boundary.\n    rethrowKeyingVerificationError(error);\n    const message = errorMessage(error);\n    input.log?.(\n      `Principal policy cache: failed to initialize cache: ${message}`,\n    );\n    return [];\n  }\n}\n\nasync function loadReferencedPrincipalPolicies({\n  execSql,\n  getCurrentPrincipalPolicy,\n  log,\n  organizationId,\n  reportSecurityIncident,\n  references,\n  resolveTrustedUserIdentity,\n  stillCurrent,\n}: CacheReferencedPrincipalPoliciesOptions): Promise<\n  VerifiedPrincipalPolicy[]\n> {\n  return runPrincipalPolicyCache({\n    cacheItem: (reference, loadExternalAdminPolicy, loadDirectory, fresh) =>\n      cacheReferencedPrincipalPolicy(\n        execSql,\n        getCurrentPrincipalPolicy,\n        reference,\n        resolveTrustedUserIdentity,\n        log,\n        loadExternalAdminPolicy,\n        organizationId,\n        stillCurrent,\n        loadDirectory,\n        fresh,\n      ),\n    dedupe: dedupeReferencedPrincipalStates,\n    execSql,\n    getCurrentPrincipalPolicy,\n    itemKey: getReferencedPrincipalKey,\n    items: references,\n    log,\n    organizationId,\n\n    reportSecurityIncident,\n    resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n}\n\nexport async function cacheReferencedPrincipalPolicies(\n  input: CacheReferencedPrincipalPoliciesOptions,\n): Promise<void> {\n  await loadReferencedPrincipalPolicies(input);\n}\n\nexport async function cachePrincipalPolicyBundles({\n  bundles,\n  execSql,\n  getCurrentPrincipalPolicy,\n  log,\n  organizationId,\n  reportSecurityIncident,\n  resolveTrustedUserIdentity,\n  stillCurrent,\n}: CachePrincipalPolicyBundlesOptions): Promise<void> {\n  await runPrincipalPolicyCache({\n    cacheItem: (bundle, loadExternalAdminPolicy, loadDirectory) =>\n      cachePrincipalPolicyBundle({\n        bundle,\n        execSql,\n        loadExternalAdminPolicy,\n        loadDirectory,\n        log,\n        organizationId,\n        resolveTrustedUserIdentity,\n        stillCurrent,\n      }),\n    dedupe: dedupePrincipalPolicyBundles,\n    execSql,\n    getCurrentPrincipalPolicy,\n    itemKey: getBundlePrincipalKey,\n    items: bundles,\n    log,\n    organizationId,\n\n    reportSecurityIncident,\n    resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n}\n"]}

package/workflows/principals/policyRepairBudget.d.ts

@@ -0,0 +1,7 @@
+import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+/** Bounded repair of paged stale-policy replies; identical pages never loop. */
+export declare class PrincipalPolicyRepairBudget {
+    private attempts;
+    private readonly seen;
+    take(bundles: readonly PrincipalPolicyBundleResponse[] | undefined): boolean;
+}

package/workflows/principals/policyRepairBudget.js

@@ -0,0 +1,17 @@
+/** Bounded repair of paged stale-policy replies; identical pages never loop. */
+export class PrincipalPolicyRepairBudget {
+    attempts = 0;
+    seen = new Set();
+    take(bundles) {
+        if (!bundles?.length || this.attempts >= 16)
+            return false;
+        const heads = bundles.map(({ currentState }) => `${currentState.principalType}:${currentState.principalId}:${currentState.stateHash}`);
+        if (heads.every((head) => this.seen.has(head)))
+            return false;
+        this.attempts++;
+        for (const head of heads)
+            this.seen.add(head);
+        return true;
+    }
+}
+//# sourceMappingURL=policyRepairBudget.js.map

package/workflows/principals/policyRepairBudget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyRepairBudget.js","sourceRoot":"","sources":["policyRepairBudget.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,MAAM,OAAO,2BAA2B;IAC9B,QAAQ,GAAG,CAAC,CAAC;IACJ,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,IAAI,CAAC,OAA6D;QAChE,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACvB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CACnB,GAAG,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,SAAS,EAAE,CACxF,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\n/** Bounded repair of paged stale-policy replies; identical pages never loop. */\nexport class PrincipalPolicyRepairBudget {\n  private attempts = 0;\n  private readonly seen = new Set<string>();\n\n  take(bundles: readonly PrincipalPolicyBundleResponse[] | undefined): boolean {\n    if (!bundles?.length || this.attempts >= 16) return false;\n    const heads = bundles.map(\n      ({ currentState }) =>\n        `${currentState.principalType}:${currentState.principalId}:${currentState.stateHash}`,\n    );\n    if (heads.every((head) => this.seen.has(head))) return false;\n    this.attempts++;\n    for (const head of heads) this.seen.add(head);\n    return true;\n  }\n}\n"]}

package/workflows/principals/policyVerification.js

@@ -0,0 +1,51 @@
+import { requireTrustedUserIdentityResolver, } from "../../data/trustedUserIdentity/index.js";
+export function principalPolicyStates(bundle) {
+    return [
+        ...bundle.previousStates.map((entry) => entry.state),
+        bundle.currentState,
+    ];
+}
+function signerCacheKey(input) {
+    return `${input.signerUserId}:${input.signingFingerprint}`;
+}
+async function loadTrustedSignerPublicKey(input) {
+    const signerKey = await input.resolveTrustedUserIdentity(input.state.signerUserId);
+    if (!signerKey) {
+        return { error: "not-found" };
+    }
+    if (signerKey.signingKeyFingerprint !== input.state.signerUserKeyFingerprint) {
+        return { error: "fingerprint-mismatch" };
+    }
+    return {
+        signerPublicKey: {
+            userId: input.state.signerUserId,
+            signingKeyFingerprint: input.state.signerUserKeyFingerprint,
+            signingPublicKey: signerKey.signingPublicKey,
+        },
+    };
+}
+export async function collectPrincipalPolicySignerPublicKeys(input) {
+    const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(input.resolveTrustedUserIdentity);
+    const signerPublicKeysByKey = new Map();
+    for (const state of principalPolicyStates(input.bundle)) {
+        const cacheKey = signerCacheKey({
+            signerUserId: state.signerUserId,
+            signingFingerprint: state.signerUserKeyFingerprint,
+        });
+        if (signerPublicKeysByKey.has(cacheKey)) {
+            continue;
+        }
+        const remoteSignerPublicKey = await loadTrustedSignerPublicKey({
+            resolveTrustedUserIdentity,
+            state,
+        });
+        if ("error" in remoteSignerPublicKey) {
+            return { error: remoteSignerPublicKey.error };
+        }
+        signerPublicKeysByKey.set(cacheKey, remoteSignerPublicKey.signerPublicKey);
+    }
+    return {
+        signerPublicKeys: Array.from(signerPublicKeysByKey.values()),
+    };
+}
+//# sourceMappingURL=policyVerification.js.map

package/workflows/principals/policyVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyVerification.js","sourceRoot":"","sources":["policyVerification.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAMxC,MAAM,UAAU,qBAAqB,CACnC,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,MAAM,CAAC,YAAY;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAGvB;IACC,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IAIC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACtD,KAAK,CAAC,KAAK,CAAC,YAAY,CACzB,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,IACE,SAAS,CAAC,qBAAqB,KAAK,KAAK,CAAC,KAAK,CAAC,wBAAwB,EACxE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,eAAe,EAAE;YACf,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC3D,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAG5D;IAIC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,wBAAwB;SACnD,CAAC,CAAC;QACH,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,0BAA0B,CAAC;YAC7D,0BAA0B;YAC1B,KAAK;SACN,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicySignerPublicKey } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\n\nexport type PrincipalPolicySignerPublicKeyLoadErrorCode =\n  | \"fingerprint-mismatch\"\n  | \"not-found\";\n\nexport function principalPolicyStates(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"currentState\"][] {\n  return [\n    ...bundle.previousStates.map((entry) => entry.state),\n    bundle.currentState,\n  ];\n}\n\nfunction signerCacheKey(input: {\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n}): string {\n  return `${input.signerUserId}:${input.signingFingerprint}`;\n}\n\nasync function loadTrustedSignerPublicKey(input: {\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly state: PrincipalPolicyBundleResponse[\"currentState\"];\n}): Promise<\n  | { readonly signerPublicKey: PrincipalPolicySignerPublicKey }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const signerKey = await input.resolveTrustedUserIdentity(\n    input.state.signerUserId,\n  );\n\n  if (!signerKey) {\n    return { error: \"not-found\" };\n  }\n\n  if (\n    signerKey.signingKeyFingerprint !== input.state.signerUserKeyFingerprint\n  ) {\n    return { error: \"fingerprint-mismatch\" };\n  }\n\n  return {\n    signerPublicKey: {\n      userId: input.state.signerUserId,\n      signingKeyFingerprint: input.state.signerUserKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    },\n  };\n}\n\nexport async function collectPrincipalPolicySignerPublicKeys(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<\n  | { readonly signerPublicKeys: PrincipalPolicySignerPublicKey[] }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyStates(input.bundle)) {\n    const cacheKey = signerCacheKey({\n      signerUserId: state.signerUserId,\n      signingFingerprint: state.signerUserKeyFingerprint,\n    });\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const remoteSignerPublicKey = await loadTrustedSignerPublicKey({\n      resolveTrustedUserIdentity,\n      state,\n    });\n    if (\"error\" in remoteSignerPublicKey) {\n      return { error: remoteSignerPublicKey.error };\n    }\n\n    signerPublicKeysByKey.set(cacheKey, remoteSignerPublicKey.signerPublicKey);\n  }\n\n  return {\n    signerPublicKeys: Array.from(signerPublicKeysByKey.values()),\n  };\n}\n"]}