@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/persistence/organizations/organizationReadModelProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelProjection.js","sourceRoot":"","sources":["organizationReadModelProjection.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AACvG,OAAO,EACL,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,iCAAiC,CAAC;AA8EzC,SAAS,0BAA0B,CACjC,KAAa;IAEb,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,GAA0B,EAC1B,aAAqB;IAErB,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,mCAAmC,CAC3C,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;QAClD,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,aAAa;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAkB,EAClB,UAAuD;IAEvD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,WAAW;KAChB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,mCAAmC,CAC3C,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,GAAG,CAAC,WAAW,KAAK,IAAI;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,IAAI,CAAC;QACrB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,GAAG,CAAC,QAAQ,IAAI,CAAC;QACjB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,WAAW,GAAG,CAAC;QACnB,CAAC,UAAU;QACX,UAAU,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;QACtC,UAAU,CAAC,OAAO,KAAK,GAAG,CAAC,YAAY;QACvC,UAAU,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QACpC,UAAU,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAC1C,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,GAAuB;IAEvB,IACE,CAAC,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,KAAK,cAAc,CAAC;QACvE,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,IAAI,CAAC;QACrB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,GAAG,CAAC,QAAQ,IAAI,CAAC;QACjB,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,WAAW,GAAG,CAAC,EACnB,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,UAAU,EAAE,mCAAmC,CAAC,UAAU;QAC1D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,sBAAsB,EACpB,mCAAmC,CAAC,sBAAsB;QAC5D,QAAQ,EAAE,mCAAmC,CAAC,QAAQ;QACtD,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,iBAAiB,EAAE,mCAAmC,CAAC,iBAAiB;QACxE,qBAAqB,EACnB,mCAAmC,CAAC,qBAAqB;QAC3D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,MAAM,EAAE,mCAAmC,CAAC,MAAM;QAClD,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,MAAM,EAAE,mCAAmC,CAAC,MAAM;KACnD,CAAC;SACD,IAAI,CAAC,mCAAmC,CAAC;SACzC,KAAK,CACJ,EAAE,CAAC,mCAAmC,CAAC,cAAc,EAAE,cAAc,CAAC,CACvE;SACA,OAAO,CACN,GAAG,CAAC,mCAAmC,CAAC,SAAS,CAAC,EAClD,GAAG,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAChD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;QAC9C,WAAW,EAAE,2BAA2B,CAAC,WAAW;QACpD,IAAI,EAAE,2BAA2B,CAAC,IAAI;QACtC,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,YAAY,EAAE,2BAA2B,CAAC,YAAY;KACvD,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACrE,OAAO,CACN,GAAG,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAC1C,GAAG,CAAC,2BAA2B,CAAC,OAAO,CAAC,CACzC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,QAAQ,EAAE,gCAAgC,CAAC,QAAQ;QACnD,cAAc,EAAE,gCAAgC,CAAC,cAAc;QAC/D,WAAW,EAAE,gCAAgC,CAAC,WAAW;QACzD,cAAc,EAAE,gCAAgC,CAAC,cAAc;QAC/D,WAAW,EAAE,gCAAgC,CAAC,WAAW;QACzD,aAAa,EAAE,gCAAgC,CAAC,aAAa;QAC7D,SAAS,EAAE,gCAAgC,CAAC,SAAS;QACrD,YAAY,EAAE,gCAAgC,CAAC,YAAY;KAC5D,CAAC;SACD,IAAI,CAAC,gCAAgC,CAAC;SACtC,KAAK,CAAC,EAAE,CAAC,gCAAgC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SAC1E,OAAO,CACN,GAAG,CAAC,gCAAgC,CAAC,aAAa,CAAC,EACnD,GAAG,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAClD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,OAAO,EAAE,iCAAiC,CAAC,OAAO;QAClD,MAAM,EAAE,iCAAiC,CAAC,MAAM;KACjD,CAAC;SACD,IAAI,CAAC,iCAAiC,CAAC;SACvC,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SAC3E,OAAO,CACN,GAAG,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAC9C,GAAG,CAAC,iCAAiC,CAAC,SAAS,CAAC,EAChD,GAAG,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAC9C,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,KAI5B;IAOC,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,uBAAuB,GAAG,WAAW,CAAC,MAAM,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc,CAChD,CAAC;IACF,IACE,uBAAuB,CAAC,MAAM,KAAK,CAAC;QACpC,uBAAuB,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,KAAK,CAAC,cAAc,EAChE,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,WAAW;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAC3C,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IACE,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CACnD,EACD,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAItE;IACC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC3B,MAAM,CAAC;QACN,MAAM,EAAE,0BAA0B,CAAC,MAAM;QACzC,aAAa,EAAE,0BAA0B,CAAC,aAAa;QACvD,iBAAiB,EAAE,0BAA0B,CAAC,iBAAiB;QAC/D,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC/B,MAAM,CAAC,EAAE,UAAU,EAAE,+BAA+B,CAAC,UAAU,EAAE,CAAC;SAClE,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAChE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAC/C,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAC7C,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC;QAC5D,SAAS;QACT,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;KACf,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/B,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAC1C;SACF;QACD,MAAM;QACN,MAAM,EAAE;YACN,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,YAAY,EAAE,mBAAmB,CAC/B,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAClC;aACF,CAAC,CAAC;SACJ;QACD,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW;QACX,eAAe,EAAE,wCAAwC;QACzD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ListOrganizationGroupsResponse,\n  OrganizationContainerGrantsResponse,\n  OrganizationDirectoryResponse,\n  OrganizationDirectoryUserResponse,\n  OrganizationGroupCurrentStateResponse,\n  OrganizationRosterStatus,\n} from \"@tearleads/validators/response\";\nimport { and, asc, eq } from \"drizzle-orm\";\nimport {\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelPolicyHeads,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/organizationReadModelSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { loadOrganizationReadModelGrantsInTransaction } from \"./organizationReadModelGrantPersistence\";\nimport {\n  ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n  OrganizationReadModelIntegrityError,\n} from \"./organizationReadModelProtocol\";\n\nexport type OrganizationDirectoryProjection = Omit<\n  OrganizationDirectoryResponse,\n  \"currentUser\"\n>;\n\nexport interface OrganizationReadModelProjection {\n  readonly cursor: string;\n  readonly directory: OrganizationDirectoryProjection;\n  readonly grants: OrganizationContainerGrantsResponse;\n  readonly groups: Omit<ListOrganizationGroupsResponse, \"groups\"> & {\n    groups: Array<\n      ListOrganizationGroupsResponse[\"groups\"][number] & { name: string }\n    >;\n  };\n  readonly membershipEdges: OrganizationReadModelMembershipEdge[];\n  readonly organizationId: string;\n  readonly policyHeads: readonly OrganizationReadModelPolicyHead[];\n  readonly protocolVersion: typeof ORGANIZATION_READ_MODEL_PROTOCOL_VERSION;\n  readonly requester: OrganizationDirectoryResponse[\"currentUser\"] | null;\n  readonly updatedAt: string;\n}\n\nexport interface OrganizationReadModelPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly organizationId: string;\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n  readonly stateHash: string;\n  readonly version: number;\n}\n\nexport interface OrganizationReadModelMembershipEdge {\n  readonly groupId: string;\n  readonly userId: string;\n}\n\ninterface SelectedDirectoryUser {\n  readonly createdAt: string;\n  readonly disabledAt: string | null;\n  readonly disabledByUserId: string | null;\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: string;\n  readonly isPersonalOrganizationOwner: boolean;\n  readonly joinedAt: string;\n  readonly profileDocumentId: string | null;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: string;\n  readonly status: string;\n  readonly updatedAt: string;\n  readonly userId: string;\n}\n\ninterface SelectedGroup {\n  readonly createdAt: string;\n  readonly groupId: string;\n  readonly isBuiltin: boolean;\n  readonly keyEpoch: number | null;\n  readonly memberCount: number | null;\n  readonly name: string;\n  readonly stateHash: string | null;\n  readonly stateVersion: number | null;\n}\n\ninterface SelectedPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly organizationId: string;\n  readonly principalId: string;\n  readonly principalType: string;\n  readonly stateHash: string;\n  readonly stateVersion: number;\n}\n\nfunction isOrganizationRosterStatus(\n  value: string,\n): value is OrganizationRosterStatus {\n  return value === \"active\" || value === \"disabled\";\n}\n\nfunction toDirectoryUser(\n  row: SelectedDirectoryUser,\n  currentUserId: string,\n): OrganizationDirectoryUserResponse {\n  if (!isOrganizationRosterStatus(row.status)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization directory status is invalid\",\n    );\n  }\n\n  return {\n    userId: row.userId,\n    signingKeyFingerprint: row.signingKeyFingerprint,\n    signingPublicKey: row.signingPublicKey,\n    encapsulationPublicKey: row.encapsulationPublicKey,\n    encapsulationKeyFingerprint: row.encapsulationKeyFingerprint,\n    createdAt: row.createdAt,\n    isPersonalOrganizationOwner: row.isPersonalOrganizationOwner,\n    isSelf: row.userId === currentUserId,\n    status: row.status,\n    profileDocumentId: row.profileDocumentId,\n    joinedAt: row.joinedAt,\n    updatedAt: row.updatedAt,\n    disabledAt: row.disabledAt,\n    disabledByUserId: row.disabledByUserId,\n  };\n}\n\nfunction toGroupCurrentState(\n  row: SelectedGroup,\n  policyHead: OrganizationReadModelPolicyHead | undefined,\n): OrganizationGroupCurrentStateResponse | null {\n  const values = [\n    row.stateHash,\n    row.stateVersion,\n    row.keyEpoch,\n    row.memberCount,\n  ];\n  if (values.every((value) => value === null)) {\n    if (policyHead) {\n      throw new OrganizationReadModelIntegrityError(\n        \"Stored organization group policy head is orphaned\",\n      );\n    }\n    return null;\n  }\n  if (\n    row.stateHash === null ||\n    row.stateVersion === null ||\n    row.keyEpoch === null ||\n    row.memberCount === null ||\n    row.stateHash.length === 0 ||\n    !Number.isInteger(row.stateVersion) ||\n    row.stateVersion <= 0 ||\n    !Number.isInteger(row.keyEpoch) ||\n    row.keyEpoch <= 0 ||\n    !Number.isInteger(row.memberCount) ||\n    row.memberCount < 0 ||\n    !policyHead ||\n    policyHead.stateHash !== row.stateHash ||\n    policyHead.version !== row.stateVersion ||\n    policyHead.keyEpoch !== row.keyEpoch ||\n    policyHead.memberCount !== row.memberCount\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization group state is invalid\",\n    );\n  }\n\n  return {\n    stateHash: row.stateHash,\n    version: row.stateVersion,\n    keyEpoch: row.keyEpoch,\n    keyFingerprint: policyHead.keyFingerprint,\n    memberCount: row.memberCount,\n  };\n}\n\nfunction toPolicyHead(\n  row: SelectedPolicyHead,\n): OrganizationReadModelPolicyHead {\n  if (\n    (row.principalType !== \"group\" && row.principalType !== \"organization\") ||\n    row.principalId.length === 0 ||\n    row.stateHash.length === 0 ||\n    !Number.isInteger(row.stateVersion) ||\n    row.stateVersion <= 0 ||\n    !Number.isInteger(row.keyEpoch) ||\n    row.keyEpoch <= 0 ||\n    row.keyFingerprint.length === 0 ||\n    !Number.isInteger(row.memberCount) ||\n    row.memberCount < 0\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization policy head is invalid\",\n    );\n  }\n\n  return {\n    organizationId: row.organizationId,\n    principalType: row.principalType,\n    principalId: row.principalId,\n    stateHash: row.stateHash,\n    version: row.stateVersion,\n    keyEpoch: row.keyEpoch,\n    keyFingerprint: row.keyFingerprint,\n    memberCount: row.memberCount,\n  };\n}\n\nasync function loadDirectoryRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedDirectoryUser[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelDirectoryUsers.createdAt,\n      disabledAt: organizationReadModelDirectoryUsers.disabledAt,\n      disabledByUserId: organizationReadModelDirectoryUsers.disabledByUserId,\n      encapsulationKeyFingerprint:\n        organizationReadModelDirectoryUsers.encapsulationKeyFingerprint,\n      encapsulationPublicKey:\n        organizationReadModelDirectoryUsers.encapsulationPublicKey,\n      joinedAt: organizationReadModelDirectoryUsers.joinedAt,\n      isPersonalOrganizationOwner:\n        organizationReadModelDirectoryUsers.isPersonalOrganizationOwner,\n      profileDocumentId: organizationReadModelDirectoryUsers.profileDocumentId,\n      signingKeyFingerprint:\n        organizationReadModelDirectoryUsers.signingKeyFingerprint,\n      signingPublicKey: organizationReadModelDirectoryUsers.signingPublicKey,\n      status: organizationReadModelDirectoryUsers.status,\n      updatedAt: organizationReadModelDirectoryUsers.updatedAt,\n      userId: organizationReadModelDirectoryUsers.userId,\n    })\n    .from(organizationReadModelDirectoryUsers)\n    .where(\n      eq(organizationReadModelDirectoryUsers.organizationId, organizationId),\n    )\n    .orderBy(\n      asc(organizationReadModelDirectoryUsers.sortOrder),\n      asc(organizationReadModelDirectoryUsers.userId),\n    );\n}\n\nasync function loadGroupRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedGroup[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelGroups.createdAt,\n      groupId: organizationReadModelGroups.groupId,\n      isBuiltin: organizationReadModelGroups.isBuiltin,\n      keyEpoch: organizationReadModelGroups.keyEpoch,\n      memberCount: organizationReadModelGroups.memberCount,\n      name: organizationReadModelGroups.name,\n      stateHash: organizationReadModelGroups.stateHash,\n      stateVersion: organizationReadModelGroups.stateVersion,\n    })\n    .from(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroups.sortOrder),\n      asc(organizationReadModelGroups.groupId),\n    );\n}\n\nasync function loadPolicyHeadRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedPolicyHead[]> {\n  return tx\n    .select({\n      keyEpoch: organizationReadModelPolicyHeads.keyEpoch,\n      keyFingerprint: organizationReadModelPolicyHeads.keyFingerprint,\n      memberCount: organizationReadModelPolicyHeads.memberCount,\n      organizationId: organizationReadModelPolicyHeads.organizationId,\n      principalId: organizationReadModelPolicyHeads.principalId,\n      principalType: organizationReadModelPolicyHeads.principalType,\n      stateHash: organizationReadModelPolicyHeads.stateHash,\n      stateVersion: organizationReadModelPolicyHeads.stateVersion,\n    })\n    .from(organizationReadModelPolicyHeads)\n    .where(eq(organizationReadModelPolicyHeads.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelPolicyHeads.principalType),\n      asc(organizationReadModelPolicyHeads.principalId),\n    );\n}\n\nasync function loadMembershipEdges(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<OrganizationReadModelMembershipEdge[]> {\n  return tx\n    .select({\n      groupId: organizationReadModelGroupMembers.groupId,\n      userId: organizationReadModelGroupMembers.userId,\n    })\n    .from(organizationReadModelGroupMembers)\n    .where(eq(organizationReadModelGroupMembers.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroupMembers.groupId),\n      asc(organizationReadModelGroupMembers.sortOrder),\n      asc(organizationReadModelGroupMembers.userId),\n    );\n}\n\nfunction validatePolicyHeads(input: {\n  readonly groupRows: readonly SelectedGroup[];\n  readonly organizationId: string;\n  readonly policyHeadRows: readonly SelectedPolicyHead[];\n}): {\n  readonly groupPolicyHeads: ReadonlyMap<\n    string,\n    OrganizationReadModelPolicyHead\n  >;\n  readonly policyHeads: readonly OrganizationReadModelPolicyHead[];\n} {\n  const policyHeads = input.policyHeadRows.map(toPolicyHead);\n  const organizationPolicyHeads = policyHeads.filter(\n    (head) => head.principalType === \"organization\",\n  );\n  if (\n    organizationPolicyHeads.length !== 1 ||\n    organizationPolicyHeads[0]?.principalId !== input.organizationId\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization policy head is missing or ambiguous\",\n    );\n  }\n  const groupPolicyHeads = new Map(\n    policyHeads\n      .filter((head) => head.principalType === \"group\")\n      .map((head) => [head.principalId, head]),\n  );\n  const visibleGroupIds = new Set(input.groupRows.map((row) => row.groupId));\n  if (\n    [...groupPolicyHeads.keys()].some(\n      (principalId) => !visibleGroupIds.has(principalId),\n    )\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization group policy head is not visible\",\n    );\n  }\n  return { groupPolicyHeads, policyHeads };\n}\n\nexport async function loadOrganizationReadModelProjectionInTransaction(input: {\n  readonly currentUserId: string;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<OrganizationReadModelProjection | null> {\n  const [state] = await input.tx\n    .select({\n      cursor: organizationReadModelState.cursor,\n      memberGroupId: organizationReadModelState.memberGroupId,\n      profileDocumentId: organizationReadModelState.profileDocumentId,\n      updatedAt: organizationReadModelState.updatedAt,\n    })\n    .from(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, input.organizationId))\n    .limit(1);\n  if (!state) {\n    return null;\n  }\n  const [requester] = await input.tx\n    .select({ isOrgAdmin: organizationReadModelRequesters.isOrgAdmin })\n    .from(organizationReadModelRequesters)\n    .where(\n      and(\n        eq(\n          organizationReadModelRequesters.organizationId,\n          input.organizationId,\n        ),\n        eq(organizationReadModelRequesters.userId, input.currentUserId),\n      ),\n    )\n    .limit(1);\n  const directoryRows = await loadDirectoryRows(input.tx, input.organizationId);\n  const groupRows = await loadGroupRows(input.tx, input.organizationId);\n  const grants = await loadOrganizationReadModelGrantsInTransaction(input);\n  const membershipEdges = await loadMembershipEdges(\n    input.tx,\n    input.organizationId,\n  );\n  const policyHeadRows = await loadPolicyHeadRows(\n    input.tx,\n    input.organizationId,\n  );\n  const { groupPolicyHeads, policyHeads } = validatePolicyHeads({\n    groupRows,\n    organizationId: input.organizationId,\n    policyHeadRows,\n  });\n\n  return {\n    cursor: state.cursor,\n    directory: {\n      organizationId: input.organizationId,\n      profileDocumentId: state.profileDocumentId,\n      users: directoryRows.map((row) =>\n        toDirectoryUser(row, input.currentUserId),\n      ),\n    },\n    grants,\n    groups: {\n      organizationId: input.organizationId,\n      memberGroupId: state.memberGroupId,\n      groups: groupRows.map((row) => ({\n        groupId: row.groupId,\n        organizationId: input.organizationId,\n        name: row.name,\n        createdAt: row.createdAt,\n        isBuiltin: row.isBuiltin,\n        currentState: toGroupCurrentState(\n          row,\n          groupPolicyHeads.get(row.groupId),\n        ),\n      })),\n    },\n    membershipEdges,\n    organizationId: input.organizationId,\n    policyHeads,\n    protocolVersion: ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n    requester: requester ? { isOrgAdmin: requester.isOrgAdmin } : null,\n    updatedAt: state.updatedAt,\n  };\n}\n"]}

package/data/persistence/organizations/organizationReadModelProtocol.js

@@ -0,0 +1,14 @@
+/** Wire version required by organization read-model responses and cursors. */
+export const ORGANIZATION_READ_MODEL_PROTOCOL_VERSION = 6;
+/**
+ * A stored projection row failed load-time validation. The projection is a
+ * server-refetchable presentation cache, so loaders purge it and reconcile a
+ * fresh snapshot instead of failing every read until a protocol bump.
+ */
+export class OrganizationReadModelIntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "OrganizationReadModelIntegrityError";
+    }
+}
+//# sourceMappingURL=organizationReadModelProtocol.js.map

package/data/persistence/organizations/organizationReadModelProtocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelProtocol.js","sourceRoot":"","sources":["organizationReadModelProtocol.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAU,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IAC5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF","sourcesContent":["/** Wire version required by organization read-model responses and cursors. */\nexport const ORGANIZATION_READ_MODEL_PROTOCOL_VERSION = 6 as const;\n\n/**\n * A stored projection row failed load-time validation. The projection is a\n * server-refetchable presentation cache, so loaders purge it and reconcile a\n * fresh snapshot instead of failing every read until a protocol bump.\n */\nexport class OrganizationReadModelIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"OrganizationReadModelIntegrityError\";\n  }\n}\n"]}

package/data/persistence/organizations/organizationReadModelPurge.js

@@ -0,0 +1,113 @@
+import { and, eq, ne, notInArray } from "drizzle-orm";
+import { organizationDataUsageCategories, organizationDataUsageSnapshots, } from "../../sqlite/organizationDataUsageSchema.js";
+import { organizationReadModelContainerGrants, organizationReadModelDirectoryUsers, organizationReadModelGroupMembers, organizationReadModelGroupMemberships, organizationReadModelGroups, organizationReadModelPolicyHeads, organizationReadModelRequesters, organizationReadModelState, } from "../../sqlite/organizationReadModelSchema.js";
+import { organizationReadModelTables } from "../../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
+import { notifyOrganizationReadModelInvalidated } from "./organizationReadModelInvalidation.js";
+import { OrganizationReadModelIntegrityError } from "./organizationReadModelProtocol.js";
+function inactiveUserScope(input, organizationIdColumn, userIdColumn) {
+    const scope = and(eq(organizationIdColumn, input.organizationId), ne(userIdColumn, input.retainUserId));
+    return input.activeUserIds.length > 0
+        ? and(scope, notInArray(userIdColumn, [...input.activeUserIds]))
+        : scope;
+}
+/**
+ * Retire requester rows — and the requester-scoped usage projections beside
+ * them — for users the just-applied authoritative directory no longer lists as
+ * active. Without this, a removed member whose identity shares the database
+ * keeps presentation access until it personally sees a 403. The applying
+ * requester's own rows are never pruned here: the server response that
+ * carried this directory already proved that user's access.
+ */
+export async function pruneInactiveOrganizationRequestersInTransaction(input) {
+    await input.tx
+        .delete(organizationReadModelRequesters)
+        .where(inactiveUserScope(input, organizationReadModelRequesters.organizationId, organizationReadModelRequesters.userId))
+        .run();
+    await input.tx
+        .delete(organizationDataUsageSnapshots)
+        .where(inactiveUserScope(input, organizationDataUsageSnapshots.organizationId, organizationDataUsageSnapshots.requesterUserId))
+        .run();
+    await input.tx
+        .delete(organizationDataUsageCategories)
+        .where(inactiveUserScope(input, organizationDataUsageCategories.organizationId, organizationDataUsageCategories.requesterUserId))
+        .run();
+}
+/**
+ * Delete the shared projection rows for one organization. By default every
+ * requester row falls with them; `onlyRequesterUserId` scopes the requester
+ * delete to that user for rebuilds where the shared rows are about to be
+ * replaced authoritatively — other local identities keep their rows and read
+ * the replacement instead of losing access until their own next reconcile.
+ */
+export async function purgeOrganizationReadModelProjectionInTransaction(input) {
+    await input.tx
+        .delete(organizationReadModelPolicyHeads)
+        .where(eq(organizationReadModelPolicyHeads.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelContainerGrants)
+        .where(eq(organizationReadModelContainerGrants.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelGroupMembers)
+        .where(eq(organizationReadModelGroupMembers.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelGroupMemberships)
+        .where(eq(organizationReadModelGroupMemberships.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelDirectoryUsers)
+        .where(eq(organizationReadModelDirectoryUsers.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelGroups)
+        .where(eq(organizationReadModelGroups.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelRequesters)
+        .where(input.onlyRequesterUserId === undefined
+        ? eq(organizationReadModelRequesters.organizationId, input.organizationId)
+        : and(eq(organizationReadModelRequesters.organizationId, input.organizationId), eq(organizationReadModelRequesters.userId, input.onlyRequesterUserId)))
+        .run();
+    await input.tx
+        .delete(organizationReadModelState)
+        .where(eq(organizationReadModelState.organizationId, input.organizationId))
+        .run();
+}
+/**
+ * The ONE load shell for the durable read-model projection: run `load` in a
+ * transaction and, if a stored row fails integrity validation, purge the
+ * organization's projection and report null. The projection is a
+ * server-refetchable cache, so the next reconcile requests a cursorless
+ * snapshot instead of every read and repair pass failing on the same row.
+ */
+export async function loadWithOrganizationReadModelIntegrityPurge(input) {
+    await ensureSqlTables(input.execSql, organizationReadModelTables);
+    let purgedInvalidRows = false;
+    const result = await getClientSQLitePersistenceRuntime(input.execSql).transaction(async (tx) => {
+        try {
+            return await input.load(tx);
+        }
+        catch (error) {
+            if (!(error instanceof OrganizationReadModelIntegrityError)) {
+                throw error;
+            }
+            await purgeOrganizationReadModelProjectionInTransaction({
+                organizationId: input.organizationId,
+                tx,
+            });
+            purgedInvalidRows = true;
+            return null;
+        }
+    });
+    if (purgedInvalidRows) {
+        // Realtime consumers may hold a caught-up lease over rows that no longer
+        // exist; the notification lets them drop it and refetch authoritatively.
+        notifyOrganizationReadModelInvalidated(input.execSql, input.organizationId);
+    }
+    return result;
+}
+//# sourceMappingURL=organizationReadModelPurge.js.map

package/data/persistence/organizations/organizationReadModelPurge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelPurge.js","sourceRoot":"","sources":["organizationReadModelPurge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAe,EAAE,EAAE,EAAE,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,qCAAqC,EACrC,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,SAAS,iBAAiB,CACxB,KAIC,EACD,oBAA4B,EAC5B,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CACf,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,EAC9C,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CACrC,CAAC;IACF,OAAO,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAKtE;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,KAAK,CACJ,iBAAiB,CACf,KAAK,EACL,+BAA+B,CAAC,cAAc,EAC9C,+BAA+B,CAAC,MAAM,CACvC,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,8BAA8B,CAAC;SACtC,KAAK,CACJ,iBAAiB,CACf,KAAK,EACL,8BAA8B,CAAC,cAAc,EAC7C,8BAA8B,CAAC,eAAe,CAC/C,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,KAAK,CACJ,iBAAiB,CACf,KAAK,EACL,+BAA+B,CAAC,cAAc,EAC9C,+BAA+B,CAAC,eAAe,CAChD,CACF;SACA,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iDAAiD,CAAC,KAIvE;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,gCAAgC,CAAC;SACxC,KAAK,CACJ,EAAE,CAAC,gCAAgC,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAC1E;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,oCAAoC,CAAC;SAC5C,KAAK,CACJ,EAAE,CACA,oCAAoC,CAAC,cAAc,EACnD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,iCAAiC,CAAC;SACzC,KAAK,CACJ,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,qCAAqC,CAAC;SAC7C,KAAK,CACJ,EAAE,CACA,qCAAqC,CAAC,cAAc,EACpD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,mCAAmC,CAAC;SAC3C,KAAK,CACJ,EAAE,CACA,mCAAmC,CAAC,cAAc,EAClD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,2BAA2B,CAAC;SACnC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC3E,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,KAAK,CACJ,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACrC,CAAC,CAAC,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB;QACH,CAAC,CAAC,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CACA,+BAA+B,CAAC,MAAM,EACtC,KAAK,CAAC,mBAAmB,CAC1B,CACF,CACN;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,0BAA0B,CAAC;SAClC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC1E,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAAI,KAIpE;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAClE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,iCAAiC,CACpD,KAAK,CAAC,OAAO,CACd,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,mCAAmC,CAAC,EAAE,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,iDAAiD,CAAC;gBACtD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,EAAE;aACH,CAAC,CAAC;YACH,iBAAiB,GAAG,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,iBAAiB,EAAE,CAAC;QACtB,yEAAyE;QACzE,yEAAyE;QACzE,sCAAsC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { and, type Column, eq, ne, notInArray, type SQL } from \"drizzle-orm\";\nimport {\n  organizationDataUsageCategories,\n  organizationDataUsageSnapshots,\n} from \"../../sqlite/organizationDataUsageSchema\";\nimport {\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroupMemberships,\n  organizationReadModelGroups,\n  organizationReadModelPolicyHeads,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/organizationReadModelSchema\";\nimport { organizationReadModelTables } from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { notifyOrganizationReadModelInvalidated } from \"./organizationReadModelInvalidation\";\nimport { OrganizationReadModelIntegrityError } from \"./organizationReadModelProtocol\";\n\nfunction inactiveUserScope(\n  input: {\n    readonly activeUserIds: readonly string[];\n    readonly organizationId: string;\n    readonly retainUserId: string;\n  },\n  organizationIdColumn: Column,\n  userIdColumn: Column,\n): SQL | undefined {\n  const scope = and(\n    eq(organizationIdColumn, input.organizationId),\n    ne(userIdColumn, input.retainUserId),\n  );\n  return input.activeUserIds.length > 0\n    ? and(scope, notInArray(userIdColumn, [...input.activeUserIds]))\n    : scope;\n}\n\n/**\n * Retire requester rows — and the requester-scoped usage projections beside\n * them — for users the just-applied authoritative directory no longer lists as\n * active. Without this, a removed member whose identity shares the database\n * keeps presentation access until it personally sees a 403. The applying\n * requester's own rows are never pruned here: the server response that\n * carried this directory already proved that user's access.\n */\nexport async function pruneInactiveOrganizationRequestersInTransaction(input: {\n  readonly activeUserIds: readonly string[];\n  readonly organizationId: string;\n  readonly retainUserId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelRequesters)\n    .where(\n      inactiveUserScope(\n        input,\n        organizationReadModelRequesters.organizationId,\n        organizationReadModelRequesters.userId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationDataUsageSnapshots)\n    .where(\n      inactiveUserScope(\n        input,\n        organizationDataUsageSnapshots.organizationId,\n        organizationDataUsageSnapshots.requesterUserId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationDataUsageCategories)\n    .where(\n      inactiveUserScope(\n        input,\n        organizationDataUsageCategories.organizationId,\n        organizationDataUsageCategories.requesterUserId,\n      ),\n    )\n    .run();\n}\n\n/**\n * Delete the shared projection rows for one organization. By default every\n * requester row falls with them; `onlyRequesterUserId` scopes the requester\n * delete to that user for rebuilds where the shared rows are about to be\n * replaced authoritatively — other local identities keep their rows and read\n * the replacement instead of losing access until their own next reconcile.\n */\nexport async function purgeOrganizationReadModelProjectionInTransaction(input: {\n  readonly onlyRequesterUserId?: string | undefined;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelPolicyHeads)\n    .where(\n      eq(organizationReadModelPolicyHeads.organizationId, input.organizationId),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelContainerGrants)\n    .where(\n      eq(\n        organizationReadModelContainerGrants.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelGroupMembers)\n    .where(\n      eq(\n        organizationReadModelGroupMembers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelGroupMemberships)\n    .where(\n      eq(\n        organizationReadModelGroupMemberships.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelDirectoryUsers)\n    .where(\n      eq(\n        organizationReadModelDirectoryUsers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, input.organizationId))\n    .run();\n  await input.tx\n    .delete(organizationReadModelRequesters)\n    .where(\n      input.onlyRequesterUserId === undefined\n        ? eq(\n            organizationReadModelRequesters.organizationId,\n            input.organizationId,\n          )\n        : and(\n            eq(\n              organizationReadModelRequesters.organizationId,\n              input.organizationId,\n            ),\n            eq(\n              organizationReadModelRequesters.userId,\n              input.onlyRequesterUserId,\n            ),\n          ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, input.organizationId))\n    .run();\n}\n\n/**\n * The ONE load shell for the durable read-model projection: run `load` in a\n * transaction and, if a stored row fails integrity validation, purge the\n * organization's projection and report null. The projection is a\n * server-refetchable cache, so the next reconcile requests a cursorless\n * snapshot instead of every read and repair pass failing on the same row.\n */\nexport async function loadWithOrganizationReadModelIntegrityPurge<T>(input: {\n  readonly execSql: ExecSql;\n  readonly load: (tx: ClientSQLiteTransactionScope) => Promise<T | null>;\n  readonly organizationId: string;\n}): Promise<T | null> {\n  await ensureSqlTables(input.execSql, organizationReadModelTables);\n  let purgedInvalidRows = false;\n  const result = await getClientSQLitePersistenceRuntime(\n    input.execSql,\n  ).transaction(async (tx) => {\n    try {\n      return await input.load(tx);\n    } catch (error) {\n      if (!(error instanceof OrganizationReadModelIntegrityError)) {\n        throw error;\n      }\n      await purgeOrganizationReadModelProjectionInTransaction({\n        organizationId: input.organizationId,\n        tx,\n      });\n      purgedInvalidRows = true;\n      return null;\n    }\n  });\n  if (purgedInvalidRows) {\n    // Realtime consumers may hold a caught-up lease over rows that no longer\n    // exist; the notification lets them drop it and refetch authoritatively.\n    notifyOrganizationReadModelInvalidated(input.execSql, input.organizationId);\n  }\n  return result;\n}\n"]}

package/data/persistence/organizations/organizationReadModelResponseAssertions.js

@@ -0,0 +1,42 @@
+import { ORGANIZATION_READ_MODEL_PROTOCOL_VERSION } from "./organizationReadModelProtocol.js";
+function assertUniqueIds(values, label) {
+    if (new Set(values).size !== values.length) {
+        throw new Error(`Organization read-model ${label} contains duplicate IDs`);
+    }
+}
+export function assertOrganizationReadModelResponse(input) {
+    const { response } = input;
+    if (response.version !== ORGANIZATION_READ_MODEL_PROTOCOL_VERSION) {
+        throw new Error("Organization read-model protocol version is unsupported");
+    }
+    if (response.lanes.directory?.organizationId !== undefined &&
+        response.lanes.directory.organizationId !== response.organizationId) {
+        throw new Error("Organization directory response scope does not match");
+    }
+    if (response.lanes.groups?.organizationId !== undefined &&
+        response.lanes.groups.organizationId !== response.organizationId) {
+        throw new Error("Organization groups response scope does not match");
+    }
+    if (response.lanes.groupMemberships?.organizationId !== undefined &&
+        response.lanes.groupMemberships.organizationId !== response.organizationId) {
+        throw new Error("Organization group memberships scope does not match");
+    }
+    if (response.lanes.grants?.organizationId !== undefined &&
+        response.lanes.grants.organizationId !== response.organizationId) {
+        throw new Error("Organization grants response scope does not match");
+    }
+    if (response.lanes.organizationPolicy?.organizationId !== undefined &&
+        response.lanes.organizationPolicy.organizationId !== response.organizationId) {
+        throw new Error("Organization policy response scope does not match");
+    }
+    if (response.lanes.groups?.groups.some((group) => group.organizationId !== response.organizationId)) {
+        throw new Error("Organization group row scope does not match");
+    }
+    const directoryUsers = response.lanes.directory?.users ?? [];
+    assertUniqueIds(directoryUsers.map((user) => user.userId), "directory");
+    if (directoryUsers.some((user) => user.isSelf !== (user.userId === input.currentUserId))) {
+        throw new Error("Organization directory requester flags do not match");
+    }
+    assertUniqueIds(response.lanes.groups?.groups.map((group) => group.groupId) ?? [], "groups");
+}
+//# sourceMappingURL=organizationReadModelResponseAssertions.js.map

package/data/persistence/organizations/organizationReadModelResponseAssertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelResponseAssertions.js","sourceRoot":"","sources":["organizationReadModelResponseAssertions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAE3F,SAAS,eAAe,CAAC,MAA6B,EAAE,KAAa;IACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,yBAAyB,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAGnD;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,IAAI,QAAQ,CAAC,OAAO,KAAK,wCAAwC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,KAAK,SAAS;QACtD,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EACnE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS;QACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,cAAc,KAAK,SAAS;QAC7D,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS;QACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,KAAK,SAAS;QAC/D,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAC5D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7D,eAAe,CACb,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EACzC,WAAW,CACZ,CAAC;IACF,IACE,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,CAChE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,eAAe,CACb,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EACjE,QAAQ,CACT,CAAC;AACJ,CAAC","sourcesContent":["import type { OrganizationReadModelResponse } from \"@tearleads/validators/response\";\nimport { ORGANIZATION_READ_MODEL_PROTOCOL_VERSION } from \"./organizationReadModelProtocol\";\n\nfunction assertUniqueIds(values: ReadonlyArray<string>, label: string): void {\n  if (new Set(values).size !== values.length) {\n    throw new Error(`Organization read-model ${label} contains duplicate IDs`);\n  }\n}\n\nexport function assertOrganizationReadModelResponse(input: {\n  readonly currentUserId: string;\n  readonly response: OrganizationReadModelResponse;\n}): void {\n  const { response } = input;\n  if (response.version !== ORGANIZATION_READ_MODEL_PROTOCOL_VERSION) {\n    throw new Error(\"Organization read-model protocol version is unsupported\");\n  }\n  if (\n    response.lanes.directory?.organizationId !== undefined &&\n    response.lanes.directory.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization directory response scope does not match\");\n  }\n  if (\n    response.lanes.groups?.organizationId !== undefined &&\n    response.lanes.groups.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization groups response scope does not match\");\n  }\n  if (\n    response.lanes.groupMemberships?.organizationId !== undefined &&\n    response.lanes.groupMemberships.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization group memberships scope does not match\");\n  }\n  if (\n    response.lanes.grants?.organizationId !== undefined &&\n    response.lanes.grants.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization grants response scope does not match\");\n  }\n  if (\n    response.lanes.organizationPolicy?.organizationId !== undefined &&\n    response.lanes.organizationPolicy.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization policy response scope does not match\");\n  }\n  if (\n    response.lanes.groups?.groups.some(\n      (group) => group.organizationId !== response.organizationId,\n    )\n  ) {\n    throw new Error(\"Organization group row scope does not match\");\n  }\n\n  const directoryUsers = response.lanes.directory?.users ?? [];\n  assertUniqueIds(\n    directoryUsers.map((user) => user.userId),\n    \"directory\",\n  );\n  if (\n    directoryUsers.some(\n      (user) => user.isSelf !== (user.userId === input.currentUserId),\n    )\n  ) {\n    throw new Error(\"Organization directory requester flags do not match\");\n  }\n  assertUniqueIds(\n    response.lanes.groups?.groups.map((group) => group.groupId) ?? [],\n    \"groups\",\n  );\n}\n"]}

package/data/persistence/principalGrantRetirementPersistence.d.ts

@@ -0,0 +1,9 @@
+import { type AccessManifestCheckpoint, type VerifiedPrincipalPolicy } from "../../internal/crypto/index.js";
+import type { ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
+export interface AcknowledgedPrincipalGrantRetirements {
+    readonly containerIds: readonly string[];
+    readonly organizationId: string;
+    readonly policy: VerifiedPrincipalPolicy;
+}
+export declare function storePrincipalGrantRetirements(tx: ClientSQLiteTransactionScope, retirement: AcknowledgedPrincipalGrantRetirements, policies: readonly VerifiedPrincipalPolicy[], organizationId: string | undefined): Promise<void>;
+export declare function assertContainerNotRetired(tx: ClientSQLiteTransactionScope, checkpoint: AccessManifestCheckpoint): Promise<void>;

package/data/persistence/principalGrantRetirementPersistence.js

@@ -0,0 +1,40 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalGrantRetirements } from "../sqlite/principalGrantRetirementSchema.js";
+export async function storePrincipalGrantRetirements(tx, retirement, policies, organizationId) {
+    if (!policies.some((policy) => policy.principalId === retirement.policy.principalId &&
+        policy.principalType === retirement.policy.principalType &&
+        policy.stateHash === retirement.policy.stateHash)) {
+        throw new KeyingVerificationError("object_mismatch", "Retirement must accompany its acknowledged policy");
+    }
+    const previous = retirement.policy.history?.find((entry) => entry.state.stateHash === retirement.policy.state.prevStateHash);
+    const granted = new Set([...retirement.policy.grants, ...(previous?.grants ?? [])].map((grant) => grant.containerId));
+    if (retirement.organizationId !== organizationId ||
+        retirement.containerIds.some((id) => !granted.has(id))) {
+        throw new KeyingVerificationError("object_mismatch", "Retirement must match the acknowledged organization and signed grants");
+    }
+    for (const containerId of new Set(retirement.containerIds)) {
+        await tx
+            .insert(principalGrantRetirements)
+            .values({
+            organizationId: retirement.organizationId,
+            containerId,
+            principalId: retirement.policy.principalId,
+            policyStateHash: retirement.policy.stateHash,
+        })
+            .onConflictDoNothing()
+            .run();
+    }
+}
+export async function assertContainerNotRetired(tx, checkpoint) {
+    if (checkpoint.objectKind !== "container")
+        return;
+    const [retired] = await tx
+        .select({ containerId: principalGrantRetirements.containerId })
+        .from(principalGrantRetirements)
+        .where(and(eq(principalGrantRetirements.organizationId, checkpoint.organizationId), eq(principalGrantRetirements.containerId, checkpoint.objectId)))
+        .limit(1);
+    if (retired)
+        throw new KeyingVerificationError("equivocation", `Container ${checkpoint.objectId} was retired during principal rotation`);
+}
+//# sourceMappingURL=principalGrantRetirementPersistence.js.map

package/data/persistence/principalGrantRetirementPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAA4C,EAC5C,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly VerifiedPrincipalPolicy[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const previous = retirement.policy.history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}

package/data/persistence/principalHistoryStagePersistence.js

@@ -0,0 +1,54 @@
+import { and, eq } from "drizzle-orm";
+import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
+import { principalHistoryStages, principalHistoryStageTables, } from "../sqlite/principalHistoryStageSchema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+class PrincipalHistoryStageChangedError extends Error {
+    code = "principal_history_stage_changed";
+    constructor() {
+        super("Another operation changed the saved principal history; resume from its current state");
+        this.name = "PrincipalHistoryStageChangedError";
+    }
+}
+export async function loadPrincipalHistoryStage(execSql, id) {
+    await ensureSqlTables(execSql, principalHistoryStageTables);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [row] = await db
+        .select()
+        .from(principalHistoryStages)
+        .where(eq(principalHistoryStages.id, id))
+        .limit(1);
+    return row ?? null;
+}
+/** The checked evidence lives inside authenticated progress, in the same row. */
+export async function savePrincipalHistoryStage(input) {
+    const stage = { ...input.stage };
+    await ensureSqlTables(input.execSql, principalHistoryStageTables);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const saved = await runtime.guardedTransaction(async (tx) => {
+        const [previous] = await tx
+            .select({ progress: principalHistoryStages.progress })
+            .from(principalHistoryStages)
+            .where(eq(principalHistoryStages.id, stage.id))
+            .limit(1);
+        if ((previous?.progress ?? null) !== input.previousProgress)
+            throw new PrincipalHistoryStageChangedError();
+        await tx
+            .insert(principalHistoryStages)
+            .values(stage)
+            .onConflictDoUpdate({ target: principalHistoryStages.id, set: stage })
+            .run();
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => saved.committed);
+}
+export async function discardPrincipalHistoryStage(execSql, stage, stillCurrent) {
+    const runtime = getClientSQLitePersistenceRuntime(execSql);
+    const discarded = await runtime.guardedTransaction(async (db) => {
+        await db
+            .delete(principalHistoryStages)
+            .where(and(eq(principalHistoryStages.id, stage.id), eq(principalHistoryStages.progress, stage.progress)))
+            .run();
+    }, stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => discarded.committed);
+}
+//# sourceMappingURL=principalHistoryStagePersistence.js.map

package/data/persistence/principalHistoryStagePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryStagePersistence.js","sourceRoot":"","sources":["principalHistoryStagePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAIpE,MAAM,iCAAkC,SAAQ,KAAK;IAC1C,IAAI,GAAG,iCAAiC,CAAC;IAClD;QACE,KAAK,CACH,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgB,EAAE,EAAU;IAC1E,MAAM,eAAe,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC5C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,gBAAgB;YACzD,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAChD,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACrE,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,KAA4B,EAC5B,YAA2B;IAE3B,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAChD,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EACvC,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CACpD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalHistoryStages,\n  principalHistoryStageTables,\n} from \"../sqlite/principalHistoryStageSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalHistoryStage = typeof principalHistoryStages.$inferSelect;\n\nclass PrincipalHistoryStageChangedError extends Error {\n  readonly code = \"principal_history_stage_changed\";\n  constructor() {\n    super(\n      \"Another operation changed the saved principal history; resume from its current state\",\n    );\n    this.name = \"PrincipalHistoryStageChangedError\";\n  }\n}\n\nexport async function loadPrincipalHistoryStage(execSql: ExecSql, id: string) {\n  await ensureSqlTables(execSql, principalHistoryStageTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select()\n    .from(principalHistoryStages)\n    .where(eq(principalHistoryStages.id, id))\n    .limit(1);\n  return row ?? null;\n}\n\n/** The checked evidence lives inside authenticated progress, in the same row. */\nexport async function savePrincipalHistoryStage(input: {\n  readonly execSql: ExecSql;\n  readonly stage: PrincipalHistoryStage;\n  readonly previousProgress: string | null;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const stage = { ...input.stage };\n  await ensureSqlTables(input.execSql, principalHistoryStageTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const saved = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select({ progress: principalHistoryStages.progress })\n        .from(principalHistoryStages)\n        .where(eq(principalHistoryStages.id, stage.id))\n        .limit(1);\n      if ((previous?.progress ?? null) !== input.previousProgress)\n        throw new PrincipalHistoryStageChangedError();\n      await tx\n        .insert(principalHistoryStages)\n        .values(stage)\n        .onConflictDoUpdate({ target: principalHistoryStages.id, set: stage })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => saved.committed);\n}\n\nexport async function discardPrincipalHistoryStage(\n  execSql: ExecSql,\n  stage: PrincipalHistoryStage,\n  stillCurrent: () => boolean,\n) {\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const discarded = await runtime.guardedTransaction(\n    async (db) => {\n      await db\n        .delete(principalHistoryStages)\n        .where(\n          and(\n            eq(principalHistoryStages.id, stage.id),\n            eq(principalHistoryStages.progress, stage.progress),\n          ),\n        )\n        .run();\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => discarded.committed);\n}\n"]}

package/data/persistence/principalPolicyBundleIntegrity.js

@@ -0,0 +1,49 @@
+import { compareCanonicalStrings, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
+import { isPrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+import { storedPrincipalPolicyBundleFromJson, } from "./storedPrincipalPolicyBundle.js";
+function parseBundle(row) {
+    const bundle = storedPrincipalPolicyBundleFromJson(row);
+    if (!isPrincipalPolicyBundleResponse(bundle)) {
+        throw new Error("Stored principal policy bundle is invalid");
+    }
+    return bundle;
+}
+function canonical(value) {
+    return canonicalKeyingJsonString(value, "principal policy bundle security content");
+}
+function withoutCreatedAt(value) {
+    const { createdAt: _createdAt, ...content } = value;
+    return content;
+}
+function securityContent(bundle) {
+    return {
+        currentMemberEnvelopes: {
+            ...bundle.currentMemberEnvelopes,
+            envelopes: [...bundle.currentMemberEnvelopes.envelopes].sort((a, b) => compareCanonicalStrings(canonical(a), canonical(b))),
+        },
+        currentPayload: withoutCreatedAt(bundle.currentPayload),
+        currentProjection: normalizePrincipalProjectionMembers(bundle.currentProjection),
+        currentGrants: normalizePrincipalContainerGrants(bundle.currentGrants),
+        currentState: withoutCreatedAt(bundle.currentState),
+        previousStates: bundle.previousStates.map((entry) => ({
+            projection: normalizePrincipalProjectionMembers(entry.projection),
+            grants: normalizePrincipalContainerGrants(entry.grants),
+            state: withoutCreatedAt(entry.state),
+        })),
+    };
+}
+export function assertSameHeadPrincipalPolicyBundle(stored, incoming) {
+    try {
+        if (canonical(securityContent(parseBundle(stored))) ===
+            canonical(securityContent(parseBundle(incoming)))) {
+            return;
+        }
+    }
+    catch {
+        // Invalid same-head cache content is also an integrity conflict: replacing
+        // it would erase the only durable evidence that the head was inconsistent.
+    }
+    throw new KeyingVerificationError("equivocation", "principal policy bundle content conflicts with the cached bundle at the same head");
+}
+//# sourceMappingURL=principalPolicyBundleIntegrity.js.map

package/data/persistence/principalPolicyBundleIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyBundleIntegrity.js","sourceRoot":"","sources":["principalPolicyBundleIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAEL,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AAEvC,SAAS,WAAW,CAClB,GAAoC;IAEpC,MAAM,MAAM,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,yBAAyB,CAC9B,KAAK,EACL,0CAA0C,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAQ;IAER,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAqC;IAC5D,OAAO;QACL,sBAAsB,EAAE;YACtB,GAAG,MAAM,CAAC,sBAAsB;YAChC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACpE,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CACpD;SACF;QACD,cAAc,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QACvD,iBAAiB,EAAE,mCAAmC,CACpD,MAAM,CAAC,iBAAiB,CACzB;QACD,aAAa,EAAE,iCAAiC,CAAC,MAAM,CAAC,aAAa,CAAC;QACtE,YAAY,EAAE,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;YACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;YACvD,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;SACrC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAuC,EACvC,QAAyC;IAEzC,IAAI,CAAC;QACH,IACE,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EACjD,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,2EAA2E;IAC7E,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mFAAmF,CACpF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { isPrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport {\n  type StoredPrincipalPolicyBundleJson,\n  storedPrincipalPolicyBundleFromJson,\n} from \"./storedPrincipalPolicyBundle\";\n\nfunction parseBundle(\n  row: StoredPrincipalPolicyBundleJson,\n): PrincipalPolicyBundleResponse {\n  const bundle = storedPrincipalPolicyBundleFromJson(row);\n  if (!isPrincipalPolicyBundleResponse(bundle)) {\n    throw new Error(\"Stored principal policy bundle is invalid\");\n  }\n  return bundle;\n}\n\nfunction canonical(value: unknown): string {\n  return canonicalKeyingJsonString(\n    value,\n    \"principal policy bundle security content\",\n  );\n}\n\nfunction withoutCreatedAt<T extends { readonly createdAt: string }>(\n  value: T,\n): Omit<T, \"createdAt\"> {\n  const { createdAt: _createdAt, ...content } = value;\n  return content;\n}\n\nfunction securityContent(bundle: PrincipalPolicyBundleResponse) {\n  return {\n    currentMemberEnvelopes: {\n      ...bundle.currentMemberEnvelopes,\n      envelopes: [...bundle.currentMemberEnvelopes.envelopes].sort((a, b) =>\n        compareCanonicalStrings(canonical(a), canonical(b)),\n      ),\n    },\n    currentPayload: withoutCreatedAt(bundle.currentPayload),\n    currentProjection: normalizePrincipalProjectionMembers(\n      bundle.currentProjection,\n    ),\n    currentGrants: normalizePrincipalContainerGrants(bundle.currentGrants),\n    currentState: withoutCreatedAt(bundle.currentState),\n    previousStates: bundle.previousStates.map((entry) => ({\n      projection: normalizePrincipalProjectionMembers(entry.projection),\n      grants: normalizePrincipalContainerGrants(entry.grants),\n      state: withoutCreatedAt(entry.state),\n    })),\n  };\n}\n\nexport function assertSameHeadPrincipalPolicyBundle(\n  stored: StoredPrincipalPolicyBundleJson,\n  incoming: StoredPrincipalPolicyBundleJson,\n): void {\n  try {\n    if (\n      canonical(securityContent(parseBundle(stored))) ===\n      canonical(securityContent(parseBundle(incoming)))\n    ) {\n      return;\n    }\n  } catch {\n    // Invalid same-head cache content is also an integrity conflict: replacing\n    // it would erase the only durable evidence that the head was inconsistent.\n  }\n  throw new KeyingVerificationError(\n    \"equivocation\",\n    \"principal policy bundle content conflicts with the cached bundle at the same head\",\n  );\n}\n"]}

package/data/persistence/principalPolicyCheckpointSelection.js

@@ -0,0 +1,26 @@
+import { verifyPrincipalPolicyCheckpoint } from "../../internal/crypto/index.js";
+import { assertPrincipalPolicyCheckpointShape } from "./keyingCheckpointPersistence.js";
+export function principalPolicyHeadMeetsCheckpoint(head, checkpoint) {
+    return (!checkpoint ||
+        head.version > checkpoint.version ||
+        (head.version === checkpoint.version &&
+            head.stateHash === checkpoint.stateHash));
+}
+export function verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint) {
+    if (!checkpoint) {
+        return true;
+    }
+    assertPrincipalPolicyCheckpointShape(checkpoint, policy);
+    if (policy.version < checkpoint.version) {
+        return false;
+    }
+    verifyPrincipalPolicyCheckpoint({
+        chain: "retainedHistory" in policy
+            ? policy.retainedHistory
+            : (policy.history ?? []),
+        currentState: policy.state,
+        localCheckpoint: checkpoint,
+    });
+    return true;
+}
+//# sourceMappingURL=principalPolicyCheckpointSelection.js.map

package/data/persistence/principalPolicyCheckpointSelection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCheckpointSelection.js","sourceRoot":"","sources":["principalPolicyCheckpointSelection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AAErF,MAAM,UAAU,kCAAkC,CAChD,IAA8D,EAC9D,UAA4C;IAE5C,OAAO,CACL,CAAC,UAAU;QACX,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QACjC,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;YAClC,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+BAA+B,CAAC;QAC9B,KAAK,EACH,iBAAiB,IAAI,MAAM;YACzB,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type {\n  PrincipalPolicyAuthorization,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { verifyPrincipalPolicyCheckpoint } from \"@tearleads/crypto\";\nimport { assertPrincipalPolicyCheckpointShape } from \"./keyingCheckpointPersistence\";\n\nexport function principalPolicyHeadMeetsCheckpoint(\n  head: { readonly stateHash: string; readonly version: number },\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n  return (\n    !checkpoint ||\n    head.version > checkpoint.version ||\n    (head.version === checkpoint.version &&\n      head.stateHash === checkpoint.stateHash)\n  );\n}\n\nexport function verifiedPrincipalPolicyMeetsCheckpoint(\n  policy: PrincipalPolicyAuthorization,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n  if (!checkpoint) {\n    return true;\n  }\n  assertPrincipalPolicyCheckpointShape(checkpoint, policy);\n  if (policy.version < checkpoint.version) {\n    return false;\n  }\n  verifyPrincipalPolicyCheckpoint({\n    chain:\n      \"retainedHistory\" in policy\n        ? policy.retainedHistory\n        : (policy.history ?? []),\n    currentState: policy.state,\n    localCheckpoint: checkpoint,\n  });\n  return true;\n}\n"]}

package/data/persistence/principalPolicyOrganizationPersistence.js

@@ -0,0 +1,42 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalPolicyOrganizations } from "../sqlite/schema.js";
+function resolveOrganizationId(input) {
+    if (input.principalType === "organization") {
+        if (input.organizationId !== undefined &&
+            input.organizationId !== input.principalId) {
+            throw new KeyingVerificationError("object_mismatch", "organization policy cache ownership targets another organization");
+        }
+        return input.principalId;
+    }
+    if (!input.organizationId) {
+        throw new Error("Group policy cache writes require an organization ID");
+    }
+    return input.organizationId;
+}
+/** Pins cache ownership in the same transaction as the cached policy state. */
+export async function recordPrincipalPolicyOrganizationInTransaction(tx, input) {
+    const organizationId = resolveOrganizationId(input);
+    const wherePrincipal = and(eq(principalPolicyOrganizations.principalType, input.principalType), eq(principalPolicyOrganizations.principalId, input.principalId));
+    const [stored] = await tx
+        .select({ organizationId: principalPolicyOrganizations.organizationId })
+        .from(principalPolicyOrganizations)
+        .where(wherePrincipal)
+        .limit(1);
+    if (stored && stored.organizationId !== organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "principal policy cache is already owned by another organization");
+    }
+    await tx
+        .insert(principalPolicyOrganizations)
+        .values({ ...input, organizationId })
+        .onConflictDoNothing()
+        .run();
+}
+export function recordPrincipalPolicyBundleOrganizationInTransaction(tx, bundle, organizationId) {
+    return recordPrincipalPolicyOrganizationInTransaction(tx, {
+        organizationId,
+        principalId: bundle.currentState.principalId,
+        principalType: bundle.currentState.principalType,
+    });
+}
+//# sourceMappingURL=principalPolicyOrganizationPersistence.js.map

package/data/persistence/principalPolicyOrganizationPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyOrganizationPersistence.js","sourceRoot":"","sources":["principalPolicyOrganizationPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAShE,SAAS,qBAAqB,CAC5B,KAAuC;IAEvC,IAAI,KAAK,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;QAC3C,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,cAAc,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,EAAgC,EAChC,KAAuC;IAEvC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,GAAG,CACxB,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EACnE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAChE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,CAAC;SACvE,IAAI,CAAC,4BAA4B,CAAC;SAClC,KAAK,CAAC,cAAc,CAAC;SACrB,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,4BAA4B,CAAC;SACpC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC;SACpC,mBAAmB,EAAE;SACrB,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,oDAAoD,CAClE,EAAgC,EAChC,MAAyD,EACzD,cAAmC;IAEnC,OAAO,8CAA8C,CAAC,EAAE,EAAE;QACxD,cAAc;QACd,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalPolicyOrganizations } from \"../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\ninterface PrincipalPolicyOrganizationInput {\n  readonly organizationId?: string | undefined;\n  readonly principalId: string;\n  readonly principalType: PrincipalStateResponse[\"principalType\"];\n}\n\nfunction resolveOrganizationId(\n  input: PrincipalPolicyOrganizationInput,\n): string {\n  if (input.principalType === \"organization\") {\n    if (\n      input.organizationId !== undefined &&\n      input.organizationId !== input.principalId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization policy cache ownership targets another organization\",\n      );\n    }\n    return input.principalId;\n  }\n  if (!input.organizationId) {\n    throw new Error(\"Group policy cache writes require an organization ID\");\n  }\n  return input.organizationId;\n}\n\n/** Pins cache ownership in the same transaction as the cached policy state. */\nexport async function recordPrincipalPolicyOrganizationInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  input: PrincipalPolicyOrganizationInput,\n): Promise<void> {\n  const organizationId = resolveOrganizationId(input);\n  const wherePrincipal = and(\n    eq(principalPolicyOrganizations.principalType, input.principalType),\n    eq(principalPolicyOrganizations.principalId, input.principalId),\n  );\n  const [stored] = await tx\n    .select({ organizationId: principalPolicyOrganizations.organizationId })\n    .from(principalPolicyOrganizations)\n    .where(wherePrincipal)\n    .limit(1);\n  if (stored && stored.organizationId !== organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy cache is already owned by another organization\",\n    );\n  }\n  await tx\n    .insert(principalPolicyOrganizations)\n    .values({ ...input, organizationId })\n    .onConflictDoNothing()\n    .run();\n}\n\nexport function recordPrincipalPolicyBundleOrganizationInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: { readonly currentState: PrincipalStateResponse },\n  organizationId?: string | undefined,\n): Promise<void> {\n  return recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: bundle.currentState.principalId,\n    principalType: bundle.currentState.principalType,\n  });\n}\n"]}