@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/persistence/keyingCheckpointEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyingCheckpointEvidence.js","sourceRoot":"","sources":["keyingCheckpointEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,mFAAmF;AACnF,MAAM,UAAU,wCAAwC,CAAC,KAIxD;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;IACtC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IACE,uBAAuB,CAAC,WAAW,CAAC,UAAU,CAAC;YAC/C,uBAAuB,CAAC,OAAO,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,YAAY,IAAI,YAAY,KAAK,WAAW,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,0DAA0D,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;QACxE,IACE,WAAW,CAAC,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;YAC9C,WAAW,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EACjD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,IACE,eAAe;YACf,WAAW,CAAC,UAAU,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK;YACtD,WAAW,CAAC,YAAY,KAAK,eAAe,CAAC,YAAY,EACzD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n} from \"@tearleads/crypto\";\nimport { accessManifestObjectKey } from \"./keyingCheckpointPersistence\";\n\n/** Structural consistency applies even when local currency prevents acceptance. */\nexport function validateAccessManifestCheckpointEvidence(input: {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n  readonly localCheckpoint: AccessManifestCheckpoint | null;\n}): void {\n  const current = input.head.checkpoint;\n  const { predecessors, localCheckpoint } = input;\n  const hashByEpoch = new Map<number, string>();\n  for (const predecessor of predecessors) {\n    if (\n      accessManifestObjectKey(predecessor.checkpoint) !==\n      accessManifestObjectKey(current)\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"access manifest checkpoint evidence belongs to another object\",\n      );\n    }\n    const previousHash = hashByEpoch.get(predecessor.checkpoint.epoch);\n    if (previousHash && previousHash !== predecessor.manifestHash) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `access manifest checkpoint evidence conflicts at epoch ${predecessor.checkpoint.epoch}`,\n      );\n    }\n    hashByEpoch.set(predecessor.checkpoint.epoch, predecessor.manifestHash);\n    if (\n      predecessor.checkpoint.epoch === current.epoch &&\n      predecessor.manifestHash !== current.manifestHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"access manifest checkpoint evidence conflicts with the declared head\",\n      );\n    }\n    if (\n      localCheckpoint &&\n      predecessor.checkpoint.epoch === localCheckpoint.epoch &&\n      predecessor.manifestHash !== localCheckpoint.manifestHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"access manifest checkpoint evidence conflicts with the local checkpoint\",\n      );\n    }\n    if (predecessor.checkpoint.epoch > current.epoch) {\n      throw new KeyingVerificationError(\n        \"stale_predecessor\",\n        \"access manifest checkpoint evidence is newer than the declared head\",\n      );\n    }\n  }\n}\n"]}

package/data/persistence/keyingCheckpointPersistence.js

@@ -0,0 +1,133 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { accessManifestCheckpoints, keyingCheckpointTables, principalPolicyCheckpoints, } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { recordPrincipalPolicyOrganizationInTransaction } from "./principalPolicyOrganizationPersistence.js";
+/** One key format per checkpoint identity, shared by every batch validator. */
+export function accessManifestObjectKey(identity) {
+    return JSON.stringify([
+        identity.objectKind,
+        identity.organizationId,
+        identity.objectId,
+    ]);
+}
+export function principalPolicyKey(identity) {
+    return JSON.stringify([identity.principalType, identity.principalId]);
+}
+async function loadAccessManifestCheckpointRow(handle, identity) {
+    const rows = await handle
+        .select({
+        epoch: accessManifestCheckpoints.epoch,
+        manifestHash: accessManifestCheckpoints.manifestHash,
+    })
+        .from(accessManifestCheckpoints)
+        .where(and(eq(accessManifestCheckpoints.objectKind, identity.objectKind), eq(accessManifestCheckpoints.organizationId, identity.organizationId), eq(accessManifestCheckpoints.objectId, identity.objectId)))
+        .limit(1);
+    return rows[0] ?? null;
+}
+async function loadPrincipalPolicyCheckpointRow(handle, identity) {
+    const rows = await handle
+        .select({
+        version: principalPolicyCheckpoints.version,
+        stateHash: principalPolicyCheckpoints.stateHash,
+    })
+        .from(principalPolicyCheckpoints)
+        .where(and(eq(principalPolicyCheckpoints.principalType, identity.principalType), eq(principalPolicyCheckpoints.principalId, identity.principalId)))
+        .limit(1);
+    return rows[0] ?? null;
+}
+/**
+ * A loaded checkpoint row merged back with the identity it was looked up by —
+ * the full checkpoint shape every comparison consumes.
+ */
+export async function loadStoredAccessManifestCheckpoint(handle, checkpoint) {
+    const row = await loadAccessManifestCheckpointRow(handle, checkpoint);
+    return row ? { ...checkpoint, ...row } : null;
+}
+export async function loadStoredPrincipalPolicyCheckpoint(handle, identity) {
+    const row = await loadPrincipalPolicyCheckpointRow(handle, identity);
+    return row
+        ? {
+            principalType: identity.principalType,
+            principalId: identity.principalId,
+            ...row,
+        }
+        : null;
+}
+export async function upsertAccessManifestCheckpointInTransaction(tx, checkpoint, updatedAt) {
+    const row = { ...checkpoint, updatedAt };
+    await tx
+        .insert(accessManifestCheckpoints)
+        .values(row)
+        .onConflictDoUpdate({
+        target: [
+            accessManifestCheckpoints.objectKind,
+            accessManifestCheckpoints.organizationId,
+            accessManifestCheckpoints.objectId,
+        ],
+        set: row,
+    })
+        .run();
+}
+export async function upsertPrincipalPolicyCheckpointInTransaction(tx, checkpoint, updatedAt, organizationId) {
+    await recordPrincipalPolicyOrganizationInTransaction(tx, {
+        organizationId,
+        principalId: checkpoint.principalId,
+        principalType: checkpoint.principalType,
+    });
+    const row = { ...checkpoint, updatedAt };
+    await tx
+        .insert(principalPolicyCheckpoints)
+        .values(row)
+        .onConflictDoUpdate({
+        target: [
+            principalPolicyCheckpoints.principalType,
+            principalPolicyCheckpoints.principalId,
+        ],
+        set: row,
+    })
+        .run();
+}
+// Lazily create the checkpoint tables on first access. Every load/save below
+// calls this, so the tables exist on demand; it is intentionally module-private
+// (no caller outside this file needs it, and exporting it tripped knip).
+async function ensureKeyingCheckpointTables(execSql) {
+    await ensureSqlTables(execSql, keyingCheckpointTables);
+}
+export async function loadAccessManifestCheckpoint(execSql, objectKind, organizationId, objectId) {
+    await ensureKeyingCheckpointTables(execSql);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const row = await loadAccessManifestCheckpointRow(db, {
+        objectKind,
+        organizationId,
+        objectId,
+    });
+    return row ? { objectKind, objectId, organizationId, ...row } : null;
+}
+export async function loadPrincipalPolicyCheckpoint(execSql, principalType, principalId) {
+    await ensureKeyingCheckpointTables(execSql);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const row = await loadPrincipalPolicyCheckpointRow(db, {
+        principalType,
+        principalId,
+    });
+    return row ? { principalType, principalId, ...row } : null;
+}
+/**
+ * The shared shape/ownership guard every checkpoint comparison runs before
+ * trusting a durable pin: the pin must belong to the compared principal and
+ * carry a well-formed version and hash.
+ */
+export function assertPrincipalPolicyCheckpointShape(checkpoint, head) {
+    if (checkpoint.principalType !== head.principalType ||
+        checkpoint.principalId !== head.principalId) {
+        throw new KeyingVerificationError("object_mismatch", "principal policy checkpoint belongs to another principal");
+    }
+    if (!Number.isInteger(checkpoint.version) ||
+        checkpoint.version < 1 ||
+        checkpoint.stateHash.length === 0) {
+        throw new KeyingVerificationError("invalid_shape", "principal policy checkpoint is malformed");
+    }
+}
+//# sourceMappingURL=keyingCheckpointPersistence.js.map

package/data/persistence/keyingCheckpointPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyingCheckpointPersistence.js","sourceRoot":"","sources":["keyingCheckpointPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAc1G,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,QAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAwB,EACxB,QAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,KAAK,EAAE,yBAAyB,CAAC,KAAK;QACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;KACrD,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC7D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAwB,EACxB,QAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,0BAA0B,CAAC,OAAO;QAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACjE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwB,EACxB,UAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,QAA2C;IAE3C,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,GAAG;QACR,CAAC,CAAC;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,GAAG;SACP;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,EAAgC,EAChC,UAAoC,EACpC,SAAiB;IAEjB,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,yBAAyB,CAAC,UAAU;YACpC,yBAAyB,CAAC,cAAc;YACxC,yBAAyB,CAAC,QAAQ;SACnC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,UAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,0BAA0B,CAAC,aAAa;YACxC,0BAA0B,CAAC,WAAW;SACvC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,KAAK,UAAU,4BAA4B,CAAC,OAAgB;IAC1D,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,UAA4B,EAC5B,cAAsB,EACtB,QAAgB;IAEhB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE;QACpD,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,aAAmC,EACnC,WAAmB;IAEnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE;QACrD,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAAqC,EACrC,IAAuC;IAEvC,IACE,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC/C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  AccessManifestCheckpoint,\n  AccessObjectKind,\n  ManagedPrincipalKind,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  accessManifestCheckpoints,\n  keyingCheckpointTables,\n  principalPolicyCheckpoints,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { recordPrincipalPolicyOrganizationInTransaction } from \"./principalPolicyOrganizationPersistence\";\n\ntype CheckpointHandle = ClientSQLiteDatabase | ClientSQLiteTransactionScope;\n\ntype AccessManifestCheckpointIdentity = Pick<\n  AccessManifestCheckpoint,\n  \"objectKind\" | \"organizationId\" | \"objectId\"\n>;\n\ntype PrincipalPolicyCheckpointIdentity = Pick<\n  PrincipalPolicyCheckpoint,\n  \"principalType\" | \"principalId\"\n>;\n\n/** One key format per checkpoint identity, shared by every batch validator. */\nexport function accessManifestObjectKey(\n  identity: AccessManifestCheckpointIdentity,\n): string {\n  return JSON.stringify([\n    identity.objectKind,\n    identity.organizationId,\n    identity.objectId,\n  ]);\n}\n\nexport function principalPolicyKey(\n  identity: PrincipalPolicyCheckpointIdentity,\n): string {\n  return JSON.stringify([identity.principalType, identity.principalId]);\n}\n\nasync function loadAccessManifestCheckpointRow(\n  handle: CheckpointHandle,\n  identity: AccessManifestCheckpointIdentity,\n): Promise<Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\"> | null> {\n  const rows = await handle\n    .select({\n      epoch: accessManifestCheckpoints.epoch,\n      manifestHash: accessManifestCheckpoints.manifestHash,\n    })\n    .from(accessManifestCheckpoints)\n    .where(\n      and(\n        eq(accessManifestCheckpoints.objectKind, identity.objectKind),\n        eq(accessManifestCheckpoints.organizationId, identity.organizationId),\n        eq(accessManifestCheckpoints.objectId, identity.objectId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\nasync function loadPrincipalPolicyCheckpointRow(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<Pick<PrincipalPolicyCheckpoint, \"version\" | \"stateHash\"> | null> {\n  const rows = await handle\n    .select({\n      version: principalPolicyCheckpoints.version,\n      stateHash: principalPolicyCheckpoints.stateHash,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, identity.principalType),\n        eq(principalPolicyCheckpoints.principalId, identity.principalId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\n/**\n * A loaded checkpoint row merged back with the identity it was looked up by —\n * the full checkpoint shape every comparison consumes.\n */\nexport async function loadStoredAccessManifestCheckpoint(\n  handle: CheckpointHandle,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<AccessManifestCheckpoint | null> {\n  const row = await loadAccessManifestCheckpointRow(handle, checkpoint);\n  return row ? { ...checkpoint, ...row } : null;\n}\n\nexport async function loadStoredPrincipalPolicyCheckpoint(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  const row = await loadPrincipalPolicyCheckpointRow(handle, identity);\n  return row\n    ? {\n        principalType: identity.principalType,\n        principalId: identity.principalId,\n        ...row,\n      }\n    : null;\n}\n\nexport async function upsertAccessManifestCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(accessManifestCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        accessManifestCheckpoints.objectKind,\n        accessManifestCheckpoints.organizationId,\n        accessManifestCheckpoints.objectId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\nexport async function upsertPrincipalPolicyCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: PrincipalPolicyCheckpoint,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: checkpoint.principalId,\n    principalType: checkpoint.principalType,\n  });\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(principalPolicyCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        principalPolicyCheckpoints.principalType,\n        principalPolicyCheckpoints.principalId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\n// Lazily create the checkpoint tables on first access. Every load/save below\n// calls this, so the tables exist on demand; it is intentionally module-private\n// (no caller outside this file needs it, and exporting it tripped knip).\nasync function ensureKeyingCheckpointTables(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n}\n\nexport async function loadAccessManifestCheckpoint(\n  execSql: ExecSql,\n  objectKind: AccessObjectKind,\n  organizationId: string,\n  objectId: string,\n): Promise<AccessManifestCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadAccessManifestCheckpointRow(db, {\n    objectKind,\n    organizationId,\n    objectId,\n  });\n\n  return row ? { objectKind, objectId, organizationId, ...row } : null;\n}\n\nexport async function loadPrincipalPolicyCheckpoint(\n  execSql: ExecSql,\n  principalType: ManagedPrincipalKind,\n  principalId: string,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadPrincipalPolicyCheckpointRow(db, {\n    principalType,\n    principalId,\n  });\n\n  return row ? { principalType, principalId, ...row } : null;\n}\n/**\n * The shared shape/ownership guard every checkpoint comparison runs before\n * trusting a durable pin: the pin must belong to the compared principal and\n * carry a well-formed version and hash.\n */\nexport function assertPrincipalPolicyCheckpointShape(\n  checkpoint: PrincipalPolicyCheckpoint,\n  head: PrincipalPolicyCheckpointIdentity,\n): void {\n  if (\n    checkpoint.principalType !== head.principalType ||\n    checkpoint.principalId !== head.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy checkpoint belongs to another principal\",\n    );\n  }\n  if (\n    !Number.isInteger(checkpoint.version) ||\n    checkpoint.version < 1 ||\n    checkpoint.stateHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy checkpoint is malformed\",\n    );\n  }\n}\n"]}

package/data/persistence/latestTimestamp.js

@@ -0,0 +1,15 @@
+/**
+ * Picks the later of two ISO-8601 timestamps, defaulting a fully absent pair
+ * to now. Canonical ISO-8601 strings order by code unit, so the plain string
+ * comparison is the chronological comparison.
+ */
+export function getLatestTimestamp(left, right) {
+    if (!left) {
+        return right ?? new Date().toISOString();
+    }
+    if (!right) {
+        return left;
+    }
+    return left >= right ? left : right;
+}
+//# sourceMappingURL=latestTimestamp.js.map

package/data/persistence/latestTimestamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"latestTimestamp.js","sourceRoot":"","sources":["latestTimestamp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA+B,EAC/B,KAAgC;IAEhC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Picks the later of two ISO-8601 timestamps, defaulting a fully absent pair\n * to now. Canonical ISO-8601 strings order by code unit, so the plain string\n * comparison is the chronological comparison.\n */\nexport function getLatestTimestamp(\n  left: string | null | undefined,\n  right: string | null | undefined,\n): string {\n  if (!left) {\n    return right ?? new Date().toISOString();\n  }\n  if (!right) {\n    return left;\n  }\n\n  return left >= right ? left : right;\n}\n"]}

package/data/persistence/locallyAcknowledgedCheckpointPersistence.d.ts

@@ -0,0 +1,53 @@
+import { type AccessManifest, type AccessManifestCheckpoint, type PrincipalPolicyCheckpoint, type VerifiedPrincipalPolicy } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+import { type AcknowledgedPrincipalGrantRetirements } from "./principalGrantRetirementPersistence.js";
+export interface LocallyAcknowledgedAccessManifestHead {
+    readonly checkpoint: AccessManifestCheckpoint;
+    readonly previousManifestHash: string | null;
+}
+export declare function locallyAuthoredAccessManifestHead(plan: {
+    readonly manifest: AccessManifest;
+    readonly manifestHash: string;
+}): LocallyAcknowledgedAccessManifestHead;
+/**
+ * Commits only heads authored and signed by this client after an exact remote
+ * acknowledgement check. Every non-initial head must directly extend the
+ * latest durable pin; arbitrary remote projections must use the verified
+ * projection checkpoint path instead.
+ */
+export declare function advanceLocallyAcknowledgedAccessManifestHeadsAtomically(input: {
+    readonly execSql: ExecSql;
+    readonly heads: readonly LocallyAcknowledgedAccessManifestHead[];
+    /** Optional optimistic read dependencies, checked inside the write transaction. */
+    readonly expectedAccessManifestCheckpoints?: readonly AccessManifestCheckpoint[];
+    readonly expectedPrincipalPolicyCheckpoints?: readonly PrincipalPolicyCheckpoint[];
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<boolean>;
+interface LocallyAcknowledgedPrincipalPolicyBundle {
+    readonly bundle: PrincipalPolicyBundleResponse;
+    readonly policy: VerifiedPrincipalPolicy;
+}
+/** Atomically pins and caches exact full policy bundles acknowledged by the API. */
+export declare function persistLocallyAcknowledgedPrincipalPolicyBundles(input: {
+    readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];
+    readonly execSql: ExecSql;
+    readonly organizationId?: string | undefined;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly updatedAt: string;
+}): Promise<void>;
+export declare function persistLocallyAcknowledgedPrincipalPolicyBundle(input: LocallyAcknowledgedPrincipalPolicyBundle & {
+    readonly execSql: ExecSql;
+    readonly organizationId?: string | undefined;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly updatedAt: string;
+}): Promise<void>;
+export declare function retainLocallyAcknowledgedPrincipalPolicyBundles(input: {
+    readonly retiredContainers?: AcknowledgedPrincipalGrantRetirements | undefined;
+    readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];
+    readonly execSql: ExecSql;
+    readonly organizationId?: string | undefined;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly updatedAt: string;
+}): Promise<void>;
+export {};

package/data/persistence/locallyAcknowledgedCheckpointPersistence.js

@@ -0,0 +1,167 @@
+import { accessManifestCheckpointFromManifest, KeyingVerificationError, verifyAccessManifestLocalCheckpoint, verifyPrincipalPolicyCheckpoint, } from "../../internal/crypto/index.js";
+import { keyingCheckpointTables, principalPolicyTables, } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { accessManifestObjectKey, loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertAccessManifestCheckpointInTransaction, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
+import { assertContainerNotRetired, storePrincipalGrantRetirements, } from "./principalGrantRetirementPersistence.js";
+import { retainPrincipalPolicyBundleInTransaction, writePrincipalPolicyBundleInTransaction, } from "./principalPolicyPersistence.js";
+import { assertBundleMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyBundle.js";
+export function locallyAuthoredAccessManifestHead(plan) {
+    return {
+        checkpoint: accessManifestCheckpointFromManifest({
+            manifest: plan.manifest,
+            manifestHash: plan.manifestHash,
+        }),
+        previousManifestHash: plan.manifest.previousManifestHash,
+    };
+}
+function validateAcknowledgedHead(head, localCheckpoint) {
+    if (!localCheckpoint) {
+        if (head.checkpoint.epoch !== 1 || head.previousManifestHash !== null) {
+            throw new KeyingVerificationError("stale_predecessor", "locally acknowledged access manifest does not begin at epoch 1");
+        }
+        return;
+    }
+    verifyAccessManifestLocalCheckpoint({
+        checkpointPredecessors: [],
+        current: {
+            ...head.checkpoint,
+            previousManifestHash: head.previousManifestHash,
+        },
+        localCheckpoint,
+    });
+}
+async function validateAcknowledgedHeads(tx, heads) {
+    const pending = new Map();
+    for (const head of heads) {
+        await assertContainerNotRetired(tx, head.checkpoint);
+        const key = accessManifestObjectKey(head.checkpoint);
+        if (pending.has(key)) {
+            throw new KeyingVerificationError("equivocation", `locally acknowledged batch contains multiple heads for ${key}`);
+        }
+        validateAcknowledgedHead(head, await loadStoredAccessManifestCheckpoint(tx, head.checkpoint));
+        pending.set(key, head.checkpoint);
+    }
+    return pending;
+}
+async function writeAcknowledgedHeads(tx, pending, updatedAt) {
+    for (const checkpoint of pending.values()) {
+        await upsertAccessManifestCheckpointInTransaction(tx, checkpoint, updatedAt);
+    }
+}
+/**
+ * Commits only heads authored and signed by this client after an exact remote
+ * acknowledgement check. Every non-initial head must directly extend the
+ * latest durable pin; arbitrary remote projections must use the verified
+ * projection checkpoint path instead.
+ */
+export async function advanceLocallyAcknowledgedAccessManifestHeadsAtomically(input) {
+    await ensureSqlTables(input.execSql, keyingCheckpointTables);
+    const updatedAt = new Date().toISOString();
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const acknowledge = async (tx) => {
+        for (const expected of input.expectedAccessManifestCheckpoints ?? []) {
+            const current = await loadStoredAccessManifestCheckpoint(tx, expected);
+            if (current?.epoch !== expected.epoch ||
+                current.manifestHash !== expected.manifestHash) {
+                throw new KeyingVerificationError("stale_predecessor", "A re-citation container checkpoint changed before acknowledgement");
+            }
+        }
+        for (const expected of input.expectedPrincipalPolicyCheckpoints ?? []) {
+            const current = await loadStoredPrincipalPolicyCheckpoint(tx, expected);
+            if (current?.version !== expected.version ||
+                current.stateHash !== expected.stateHash) {
+                throw new KeyingVerificationError("stale_predecessor", "A re-citation principal policy checkpoint changed before acknowledgement");
+            }
+        }
+        const pending = await validateAcknowledgedHeads(tx, input.heads);
+        await writeAcknowledgedHeads(tx, pending, updatedAt);
+    };
+    if (input.stillCurrent) {
+        return (await runtime.guardedTransaction(acknowledge, input.stillCurrent, {
+            behavior: "immediate",
+        })).committed;
+    }
+    await runtime.transaction(acknowledge, { behavior: "immediate" });
+    return true;
+}
+function validateAcknowledgedPolicy(policy, checkpoint) {
+    verifyPrincipalPolicyCheckpoint({
+        chain: policy.history ?? [],
+        currentState: policy.state,
+        localCheckpoint: checkpoint,
+    });
+    if (!checkpoint && policy.version !== 1) {
+        throw new KeyingVerificationError("stale_predecessor", "locally acknowledged principal policy does not begin at version 1");
+    }
+    if (checkpoint && policy.version > checkpoint.version + 1) {
+        throw new KeyingVerificationError("stale_predecessor", "locally acknowledged principal policy does not directly extend the durable checkpoint");
+    }
+}
+function assertUniqueAcknowledgedPolicies(entries) {
+    const seen = new Set();
+    for (const { policy } of entries) {
+        const key = principalPolicyKey(policy);
+        if (seen.has(key)) {
+            throw new KeyingVerificationError("duplicate_entry", `locally acknowledged policy batch repeats ${key}`);
+        }
+        seen.add(key);
+    }
+}
+async function storeAcknowledgedPrincipalPolicyBundles(input) {
+    assertUniqueAcknowledgedPolicies(input.entries);
+    await Promise.all(input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)));
+    await ensureSqlTables(input.execSql, [
+        ...principalPolicyTables,
+        ...keyingCheckpointTables,
+    ]);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const store = async (tx) => {
+        for (const { policy } of input.entries) {
+            validateAcknowledgedPolicy(policy, await loadStoredPrincipalPolicyCheckpoint(tx, policy));
+        }
+        if (input.retiredContainers)
+            await storePrincipalGrantRetirements(tx, input.retiredContainers, input.entries.map(({ policy }) => policy), input.organizationId);
+        for (const entry of input.entries) {
+            if (input.placement === "current") {
+                await writePrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
+            }
+            else {
+                await retainPrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
+            }
+        }
+        for (const { policy } of input.entries) {
+            await upsertPrincipalPolicyCheckpointInTransaction(tx, policy.checkpoint, input.updatedAt, input.organizationId);
+        }
+    };
+    if (input.stillCurrent) {
+        await runtime.guardedTransaction(store, input.stillCurrent, {
+            behavior: "immediate",
+        });
+        return;
+    }
+    await runtime.transaction(store, { behavior: "immediate" });
+}
+/** Atomically pins and caches exact full policy bundles acknowledged by the API. */
+export function persistLocallyAcknowledgedPrincipalPolicyBundles(input) {
+    return storeAcknowledgedPrincipalPolicyBundles({
+        ...input,
+        placement: "current",
+    });
+}
+export function persistLocallyAcknowledgedPrincipalPolicyBundle(input) {
+    return persistLocallyAcknowledgedPrincipalPolicyBundles({
+        entries: [input],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        stillCurrent: input.stillCurrent,
+        updatedAt: input.updatedAt,
+    });
+}
+export function retainLocallyAcknowledgedPrincipalPolicyBundles(input) {
+    return storeAcknowledgedPrincipalPolicyBundles({
+        ...input,
+        placement: "history",
+    });
+}
+//# sourceMappingURL=locallyAcknowledgedCheckpointPersistence.js.map

package/data/persistence/locallyAcknowledgedCheckpointPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locallyAcknowledgedCheckpointPersistence.js","sourceRoot":"","sources":["locallyAcknowledgedCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oCAAoC,EACpC,uBAAuB,EAGvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAOpF,MAAM,UAAU,iCAAiC,CAAC,IAGjD;IACC,OAAO;QACL,UAAU,EAAE,oCAAoC,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAA2C,EAC3C,eAAgD;IAEhD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,EAAE;QAC1B,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,UAAU;YAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD;QACD,eAAe;KAChB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAAgC,EAChC,KAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,0DAA0D,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,wBAAwB,CACtB,IAAI,EACJ,MAAM,kCAAkC,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAC9D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAsD,EACtD,SAAiB;IAEjB,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uDAAuD,CAAC,KAO7E;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC7D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,EAAE,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvE,IACE,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK;gBACjC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAC9C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,kCAAkC,IAAI,EAAE,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACxE,IACE,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EACxC,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,0EAA0E,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CACL,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE;YAChE,QAAQ,EAAE,WAAW;SACtB,CAAC,CACH,CAAC,SAAS,CAAC;IACd,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,MAA+B,EAC/B,UAA4C;IAE5C,+BAA+B,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC3B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,uFAAuF,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,gCAAgC,CACvC,OAA4D;IAE5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,GAAG,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uCAAuC,CAAC,KAUtD;IACC,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACvD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,0BAA0B,CACxB,MAAM,EACN,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB;YACzB,MAAM,8BAA8B,CAClC,EAAE,EACF,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EACzC,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,wCAAwC,CAC5C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;YAC1D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gDAAgD,CAAC,KAMhE;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAC7D,KAKC;IAED,OAAO,gDAAgD,CAAC;QACtD,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAAC,KAS/D;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  accessManifestCheckpointFromManifest,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type VerifiedPrincipalPolicy,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport {\n  type AcknowledgedPrincipalGrantRetirements,\n  assertContainerNotRetired,\n  storePrincipalGrantRetirements,\n} from \"./principalGrantRetirementPersistence\";\nimport {\n  retainPrincipalPolicyBundleInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\nexport interface LocallyAcknowledgedAccessManifestHead {\n  readonly checkpoint: AccessManifestCheckpoint;\n  readonly previousManifestHash: string | null;\n}\n\nexport function locallyAuthoredAccessManifestHead(plan: {\n  readonly manifest: AccessManifest;\n  readonly manifestHash: string;\n}): LocallyAcknowledgedAccessManifestHead {\n  return {\n    checkpoint: accessManifestCheckpointFromManifest({\n      manifest: plan.manifest,\n      manifestHash: plan.manifestHash,\n    }),\n    previousManifestHash: plan.manifest.previousManifestHash,\n  };\n}\n\nfunction validateAcknowledgedHead(\n  head: LocallyAcknowledgedAccessManifestHead,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): void {\n  if (!localCheckpoint) {\n    if (head.checkpoint.epoch !== 1 || head.previousManifestHash !== null) {\n      throw new KeyingVerificationError(\n        \"stale_predecessor\",\n        \"locally acknowledged access manifest does not begin at epoch 1\",\n      );\n    }\n    return;\n  }\n\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: [],\n    current: {\n      ...head.checkpoint,\n      previousManifestHash: head.previousManifestHash,\n    },\n    localCheckpoint,\n  });\n}\n\nasync function validateAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  heads: readonly LocallyAcknowledgedAccessManifestHead[],\n): Promise<Map<string, AccessManifestCheckpoint>> {\n  const pending = new Map<string, AccessManifestCheckpoint>();\n  for (const head of heads) {\n    await assertContainerNotRetired(tx, head.checkpoint);\n    const key = accessManifestObjectKey(head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `locally acknowledged batch contains multiple heads for ${key}`,\n      );\n    }\n    validateAcknowledgedHead(\n      head,\n      await loadStoredAccessManifestCheckpoint(tx, head.checkpoint),\n    );\n    pending.set(key, head.checkpoint);\n  }\n  return pending;\n}\n\nasync function writeAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, AccessManifestCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const checkpoint of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\n/**\n * Commits only heads authored and signed by this client after an exact remote\n * acknowledgement check. Every non-initial head must directly extend the\n * latest durable pin; arbitrary remote projections must use the verified\n * projection checkpoint path instead.\n */\nexport async function advanceLocallyAcknowledgedAccessManifestHeadsAtomically(input: {\n  readonly execSql: ExecSql;\n  readonly heads: readonly LocallyAcknowledgedAccessManifestHead[];\n  /** Optional optimistic read dependencies, checked inside the write transaction. */\n  readonly expectedAccessManifestCheckpoints?: readonly AccessManifestCheckpoint[];\n  readonly expectedPrincipalPolicyCheckpoints?: readonly PrincipalPolicyCheckpoint[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  await ensureSqlTables(input.execSql, keyingCheckpointTables);\n  const updatedAt = new Date().toISOString();\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const acknowledge = async (tx: ClientSQLiteTransactionScope) => {\n    for (const expected of input.expectedAccessManifestCheckpoints ?? []) {\n      const current = await loadStoredAccessManifestCheckpoint(tx, expected);\n      if (\n        current?.epoch !== expected.epoch ||\n        current.manifestHash !== expected.manifestHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation container checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    for (const expected of input.expectedPrincipalPolicyCheckpoints ?? []) {\n      const current = await loadStoredPrincipalPolicyCheckpoint(tx, expected);\n      if (\n        current?.version !== expected.version ||\n        current.stateHash !== expected.stateHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation principal policy checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    const pending = await validateAcknowledgedHeads(tx, input.heads);\n    await writeAcknowledgedHeads(tx, pending, updatedAt);\n  };\n  if (input.stillCurrent) {\n    return (\n      await runtime.guardedTransaction(acknowledge, input.stillCurrent, {\n        behavior: \"immediate\",\n      })\n    ).committed;\n  }\n  await runtime.transaction(acknowledge, { behavior: \"immediate\" });\n  return true;\n}\n\nfunction validateAcknowledgedPolicy(\n  policy: VerifiedPrincipalPolicy,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): void {\n  verifyPrincipalPolicyCheckpoint({\n    chain: policy.history ?? [],\n    currentState: policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (!checkpoint && policy.version !== 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not begin at version 1\",\n    );\n  }\n  if (checkpoint && policy.version > checkpoint.version + 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not directly extend the durable checkpoint\",\n    );\n  }\n}\n\ninterface LocallyAcknowledgedPrincipalPolicyBundle {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nfunction assertUniqueAcknowledgedPolicies(\n  entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[],\n): void {\n  const seen = new Set<string>();\n  for (const { policy } of entries) {\n    const key = principalPolicyKey(policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `locally acknowledged policy batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n}\n\nasync function storeAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly placement: \"current\" | \"history\";\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  assertUniqueAcknowledgedPolicies(input.entries);\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const store = async (tx: ClientSQLiteTransactionScope) => {\n    for (const { policy } of input.entries) {\n      validateAcknowledgedPolicy(\n        policy,\n        await loadStoredPrincipalPolicyCheckpoint(tx, policy),\n      );\n    }\n    if (input.retiredContainers)\n      await storePrincipalGrantRetirements(\n        tx,\n        input.retiredContainers,\n        input.entries.map(({ policy }) => policy),\n        input.organizationId,\n      );\n    for (const entry of input.entries) {\n      if (input.placement === \"current\") {\n        await writePrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      } else {\n        await retainPrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      }\n    }\n    for (const { policy } of input.entries) {\n      await upsertPrincipalPolicyCheckpointInTransaction(\n        tx,\n        policy.checkpoint,\n        input.updatedAt,\n        input.organizationId,\n      );\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(store, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(store, { behavior: \"immediate\" });\n}\n\n/** Atomically pins and caches exact full policy bundles acknowledged by the API. */\nexport function persistLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"current\",\n  });\n}\n\nexport function persistLocallyAcknowledgedPrincipalPolicyBundle(\n  input: LocallyAcknowledgedPrincipalPolicyBundle & {\n    readonly execSql: ExecSql;\n    readonly organizationId?: string | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly updatedAt: string;\n  },\n): Promise<void> {\n  return persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [input],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: input.updatedAt,\n  });\n}\n\nexport function retainLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"history\",\n  });\n}\n"]}

package/data/persistence/organizationFounderPersistence.js

@@ -0,0 +1,58 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { eq } from "drizzle-orm";
+import { organizationFounders } from "../sqlite/organizationFounderSchema.js";
+import { keyingCheckpointTables } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+function assertSameFounder(stored, founder) {
+    if (stored.userId !== founder.userId ||
+        stored.signingKeyFingerprint !== founder.signingKeyFingerprint ||
+        stored.genesisStateHash !== founder.genesisStateHash)
+        throw new KeyingVerificationError("equivocation", "Organization founder conflicts with its durable genesis binding");
+}
+export async function loadOrganizationFounder(execSql, organizationId) {
+    await ensureSqlTables(execSql, keyingCheckpointTables);
+    const runtime = getClientSQLitePersistenceRuntime(execSql);
+    const [stored] = await runtime.db
+        .select()
+        .from(organizationFounders)
+        .where(eq(organizationFounders.organizationId, organizationId))
+        .limit(1);
+    return stored ?? null;
+}
+/** Pin verified genesis, never a later administrator or a folder's creator. */
+export async function rememberOrganizationFounder(input) {
+    const genesis = input.organization.history?.find(({ state }) => state.version === 1)?.state;
+    if (genesis?.principalType !== "organization" ||
+        genesis.prevStateHash !== null)
+        throw new KeyingVerificationError("missing_dependency", "Organization founder requires verified genesis");
+    const founder = {
+        organizationId: genesis.principalId,
+        userId: genesis.signerUserId,
+        signingKeyFingerprint: genesis.signerUserKeyFingerprint,
+        genesisStateHash: genesis.stateHash,
+    };
+    const held = await loadOrganizationFounder(input.execSql, founder.organizationId);
+    if (held) {
+        assertSameFounder(held, founder);
+        return;
+    }
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    await runtime.transaction(async (tx) => {
+        const [stored] = await tx
+            .select()
+            .from(organizationFounders)
+            .where(eq(organizationFounders.organizationId, founder.organizationId))
+            .limit(1);
+        if (stored) {
+            assertSameFounder(stored, founder);
+            return;
+        }
+        await tx
+            .insert(organizationFounders)
+            .values(founder)
+            .onConflictDoNothing()
+            .run();
+    }, { behavior: "immediate" });
+}
+//# sourceMappingURL=organizationFounderPersistence.js.map

package/data/persistence/organizationFounderPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationFounderPersistence.js","sourceRoot":"","sources":["organizationFounderPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEpE,SAAS,iBAAiB,CACxB,MAAgD,EAChD,OAAiD;IAEjD,IACE,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAChC,MAAM,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;QAC9D,MAAM,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB;QAEpD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,iEAAiE,CAClE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,cAAsB;IAEtB,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SAC9B,MAAM,EAAE;SACR,IAAI,CAAC,oBAAoB,CAAC;SAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SAC9D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAGjD;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAC9C,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CACnC,EAAE,KAAK,CAAC;IACT,IACE,OAAO,EAAE,aAAa,KAAK,cAAc;QACzC,OAAO,CAAC,aAAa,KAAK,IAAI;QAE9B,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,OAAO,CAAC,WAAW;QACnC,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,qBAAqB,EAAE,OAAO,CAAC,wBAAwB;QACvD,gBAAgB,EAAE,OAAO,CAAC,SAAS;KACpC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,KAAK,CAAC,OAAO,EACb,OAAO,CAAC,cAAc,CACvB,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,CAAC,WAAW,CACvB,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;aACtE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM,EAAE,CAAC;YACX,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,oBAAoB,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n} from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { organizationFounders } from \"../sqlite/organizationFounderSchema\";\nimport { keyingCheckpointTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nfunction assertSameFounder(\n  stored: typeof organizationFounders.$inferSelect,\n  founder: typeof organizationFounders.$inferInsert,\n): void {\n  if (\n    stored.userId !== founder.userId ||\n    stored.signingKeyFingerprint !== founder.signingKeyFingerprint ||\n    stored.genesisStateHash !== founder.genesisStateHash\n  )\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Organization founder conflicts with its durable genesis binding\",\n    );\n}\n\nexport async function loadOrganizationFounder(\n  execSql: ExecSql,\n  organizationId: string,\n): Promise<typeof organizationFounders.$inferSelect | null> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const [stored] = await runtime.db\n    .select()\n    .from(organizationFounders)\n    .where(eq(organizationFounders.organizationId, organizationId))\n    .limit(1);\n  return stored ?? null;\n}\n\n/** Pin verified genesis, never a later administrator or a folder's creator. */\nexport async function rememberOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly organization: AnyVerifiedPrincipalPolicy;\n}): Promise<void> {\n  const genesis = input.organization.history?.find(\n    ({ state }) => state.version === 1,\n  )?.state;\n  if (\n    genesis?.principalType !== \"organization\" ||\n    genesis.prevStateHash !== null\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const founder = {\n    organizationId: genesis.principalId,\n    userId: genesis.signerUserId,\n    signingKeyFingerprint: genesis.signerUserKeyFingerprint,\n    genesisStateHash: genesis.stateHash,\n  };\n  const held = await loadOrganizationFounder(\n    input.execSql,\n    founder.organizationId,\n  );\n  if (held) {\n    assertSameFounder(held, founder);\n    return;\n  }\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  await runtime.transaction(\n    async (tx) => {\n      const [stored] = await tx\n        .select()\n        .from(organizationFounders)\n        .where(eq(organizationFounders.organizationId, founder.organizationId))\n        .limit(1);\n      if (stored) {\n        assertSameFounder(stored, founder);\n        return;\n      }\n      await tx\n        .insert(organizationFounders)\n        .values(founder)\n        .onConflictDoNothing()\n        .run();\n    },\n    { behavior: \"immediate\" },\n  );\n}\n"]}

package/data/persistence/organizationReplacementCheckpointPersistence.js

@@ -0,0 +1,72 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { keyingCheckpointTables, principalPolicyTables, } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, upsertAccessManifestCheckpointInTransaction, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
+import { assertContainerNotRetired } from "./principalGrantRetirementPersistence.js";
+import { recordPrincipalPolicyOrganizationInTransaction } from "./principalPolicyOrganizationPersistence.js";
+/**
+ * A verified authorization from this identity also authenticates the winning
+ * device's genesis. Seed first-sight pins before adopting its IDs; retain any
+ * later observations rather than rolling them back to the provisioning epoch.
+ */
+export async function persistOrganizationReplacementCheckpoints(input) {
+    const authorization = input.authorization;
+    const organizationId = authorization.organizationId;
+    const root = {
+        objectKind: "container",
+        objectId: authorization.rootContainerId,
+        organizationId,
+        epoch: 1,
+        manifestHash: authorization.rootManifestHash,
+    };
+    const principals = [
+        {
+            principalType: "organization",
+            principalId: organizationId,
+            version: 1,
+            stateHash: authorization.organizationStateHash,
+        },
+        {
+            principalType: "group",
+            principalId: authorization.adminGroupId,
+            version: 1,
+            stateHash: authorization.adminGroupStateHash,
+        },
+        {
+            principalType: "group",
+            principalId: authorization.memberGroupId,
+            version: 1,
+            stateHash: authorization.memberGroupStateHash,
+        },
+    ];
+    await ensureSqlTables(input.execSql, [
+        ...principalPolicyTables,
+        ...keyingCheckpointTables,
+    ]);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const updatedAt = new Date().toISOString();
+        await assertContainerNotRetired(tx, root);
+        const storedRoot = await loadStoredAccessManifestCheckpoint(tx, root);
+        if (storedRoot?.epoch === 1 &&
+            storedRoot.manifestHash !== root.manifestHash)
+            throw new KeyingVerificationError("equivocation", "Replacement root conflicts with its local genesis checkpoint");
+        if (!storedRoot)
+            await upsertAccessManifestCheckpointInTransaction(tx, root, updatedAt);
+        for (const principal of principals) {
+            await recordPrincipalPolicyOrganizationInTransaction(tx, {
+                principalId: principal.principalId,
+                principalType: principal.principalType,
+                organizationId,
+            });
+            const stored = await loadStoredPrincipalPolicyCheckpoint(tx, principal);
+            if (stored?.version === 1 && stored.stateHash !== principal.stateHash)
+                throw new KeyingVerificationError("equivocation", "Replacement policy conflicts with its local genesis checkpoint");
+            if (!stored)
+                await upsertPrincipalPolicyCheckpointInTransaction(tx, principal, updatedAt, organizationId);
+        }
+    }, input.stillCurrent ?? (() => true), { behavior: "immediate" });
+    return result.committed;
+}
+//# sourceMappingURL=organizationReplacementCheckpointPersistence.js.map

package/data/persistence/organizationReplacementCheckpointPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReplacementCheckpointPersistence.js","sourceRoot":"","sources":["organizationReplacementCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,kCAAkC,EAClC,mCAAmC,EACnC,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAE1G;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAI/D;IACC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;IACpD,MAAM,IAAI,GAA6B;QACrC,UAAU,EAAE,WAAW;QACvB,QAAQ,EAAE,aAAa,CAAC,eAAe;QACvC,cAAc;QACd,KAAK,EAAE,CAAC;QACR,YAAY,EAAE,aAAa,CAAC,gBAAgB;KAC7C,CAAC;IACF,MAAM,UAAU,GAAgC;QAC9C;YACE,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,aAAa,CAAC,qBAAqB;SAC/C;QACD;YACE,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,aAAa,CAAC,YAAY;YACvC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,aAAa,CAAC,mBAAmB;SAC7C;QACD;YACE,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,aAAa,CAAC,aAAa;YACxC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,aAAa,CAAC,oBAAoB;SAC9C;KACF,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtE,IACE,UAAU,EAAE,KAAK,KAAK,CAAC;YACvB,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YAE7C,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8DAA8D,CAC/D,CAAC;QACJ,IAAI,CAAC,UAAU;YACb,MAAM,2CAA2C,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACzE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;gBACvD,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,cAAc;aACf,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACxE,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;gBACnE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,gEAAgE,CACjE,CAAC;YACJ,IAAI,CAAC,MAAM;gBACT,MAAM,4CAA4C,CAChD,EAAE,EACF,SAAS,EACT,SAAS,EACT,cAAc,CACf,CAAC;QACN,CAAC;IACH,CAAC,EACD,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAClC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC;AAC1B,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type VerifiedOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { assertContainerNotRetired } from \"./principalGrantRetirementPersistence\";\nimport { recordPrincipalPolicyOrganizationInTransaction } from \"./principalPolicyOrganizationPersistence\";\n\n/**\n * A verified authorization from this identity also authenticates the winning\n * device's genesis. Seed first-sight pins before adopting its IDs; retain any\n * later observations rather than rolling them back to the provisioning epoch.\n */\nexport async function persistOrganizationReplacementCheckpoints(input: {\n  readonly authorization: VerifiedOrganizationReplacementAuthorization;\n  readonly execSql: ExecSql;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  const authorization = input.authorization;\n  const organizationId = authorization.organizationId;\n  const root: AccessManifestCheckpoint = {\n    objectKind: \"container\",\n    objectId: authorization.rootContainerId,\n    organizationId,\n    epoch: 1,\n    manifestHash: authorization.rootManifestHash,\n  };\n  const principals: PrincipalPolicyCheckpoint[] = [\n    {\n      principalType: \"organization\",\n      principalId: organizationId,\n      version: 1,\n      stateHash: authorization.organizationStateHash,\n    },\n    {\n      principalType: \"group\",\n      principalId: authorization.adminGroupId,\n      version: 1,\n      stateHash: authorization.adminGroupStateHash,\n    },\n    {\n      principalType: \"group\",\n      principalId: authorization.memberGroupId,\n      version: 1,\n      stateHash: authorization.memberGroupStateHash,\n    },\n  ];\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const updatedAt = new Date().toISOString();\n      await assertContainerNotRetired(tx, root);\n      const storedRoot = await loadStoredAccessManifestCheckpoint(tx, root);\n      if (\n        storedRoot?.epoch === 1 &&\n        storedRoot.manifestHash !== root.manifestHash\n      )\n        throw new KeyingVerificationError(\n          \"equivocation\",\n          \"Replacement root conflicts with its local genesis checkpoint\",\n        );\n      if (!storedRoot)\n        await upsertAccessManifestCheckpointInTransaction(tx, root, updatedAt);\n      for (const principal of principals) {\n        await recordPrincipalPolicyOrganizationInTransaction(tx, {\n          principalId: principal.principalId,\n          principalType: principal.principalType,\n          organizationId,\n        });\n        const stored = await loadStoredPrincipalPolicyCheckpoint(tx, principal);\n        if (stored?.version === 1 && stored.stateHash !== principal.stateHash)\n          throw new KeyingVerificationError(\n            \"equivocation\",\n            \"Replacement policy conflicts with its local genesis checkpoint\",\n          );\n        if (!stored)\n          await upsertPrincipalPolicyCheckpointInTransaction(\n            tx,\n            principal,\n            updatedAt,\n            organizationId,\n          );\n      }\n    },\n    input.stillCurrent ?? (() => true),\n    { behavior: \"immediate\" },\n  );\n  return result.committed;\n}\n"]}