@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeProjectionPolicyEvidence.js","sourceRoot":"","sources":["mergeProjectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAO5D,SAAS,KAAK,CACZ,QAA4D,EAC5D,IAAqC;IAErC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW;QACrE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;IACJ,IACE,QAAQ,CAAC,YAAY,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO;QAC3D,QAAQ,CAAC,YAAY,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY,CAAC,SAAS;QAE/D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;AACnE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,QAAqD;IAErD,IAAI,SAAuD,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2C,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,SAAS,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,QAAQ;gBACR,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;oBAC3C,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;oBAChD,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;oBAC1C,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC;gBAErD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,oBAAoB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicySnapshotResponse,\n  PrincipalStatePayloadResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\n\nfunction newer(\n  previous: PrincipalPolicySnapshotResponse | null | undefined,\n  next: PrincipalPolicySnapshotResponse,\n): boolean {\n  if (!previous) return true;\n  if (previous.currentState.principalId !== next.currentState.principalId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Projection evidence crosses principals\",\n    );\n  if (\n    previous.currentState.version === next.currentState.version &&\n    previous.currentState.stateHash !== next.currentState.stateHash\n  )\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Projection evidence contains conflicting heads\",\n    );\n  return previous.currentState.version < next.currentState.version;\n}\n\n/** Combine proof material when locally composing projections; verification follows. */\nexport function mergeProjectionPolicyEvidence(\n  evidence: readonly ProjectionPolicyEvidenceResponse[],\n): ProjectionPolicyEvidenceResponse {\n  let directory: ProjectionPolicyEvidenceResponse | undefined;\n  const groups = new Map<string, PrincipalPolicySnapshotResponse>();\n  const payloads = new Map<string, PrincipalStatePayloadResponse>();\n  for (const proof of evidence) {\n    const organization = proof.organization;\n    if (organization && newer(directory?.organization, organization))\n      directory = proof;\n    for (const payload of proof.organizationPayloads) {\n      const previous = payloads.get(payload.stateHash);\n      if (\n        previous &&\n        (previous.principalId !== payload.principalId ||\n          previous.principalType !== payload.principalType ||\n          previous.ciphertext !== payload.ciphertext ||\n          previous.ciphertextHash !== payload.ciphertextHash)\n      )\n        throw new KeyingVerificationError(\n          \"hash_mismatch\",\n          \"Projection evidence contains conflicting directory payloads\",\n        );\n      payloads.set(payload.stateHash, payload);\n    }\n    for (const group of proof.groups) {\n      const prior = groups.get(group.currentState.principalId);\n      if (newer(prior, group))\n        groups.set(group.currentState.principalId, group);\n    }\n  }\n  return {\n    organization: directory?.organization ?? null,\n    organizationPayloads: [...payloads.values()],\n    groups: [...groups.values()],\n  };\n}\n"]}

package/data/keyingProjectionVerification/organizationFounderBinding.js

@@ -0,0 +1,41 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { rememberOrganizationFounder } from "../persistence/organizationFounderPersistence.js";
+import { verifiedContainerCreateManifest } from "./containerCreateManifest.js";
+/**
+ * A directory can cite someone else's public policies. Bind its founder to the
+ * verified personal root's creator before trusting it to authorize a rehome.
+ * Metadata roots can be created by later admins and cannot establish this pin.
+ * This immutable identity anchor survives read-only verification and canceled
+ * views; it neither advances nor replaces a current-policy checkpoint.
+ */
+export async function rememberRootBoundOrganizationFounder(input) {
+    const { root } = input;
+    if (!root || root.state.systemSlot !== null)
+        return;
+    const organization = input.policies?.find((policy) => policy.principalType === "organization" &&
+        policy.principalId === root.state.organizationId);
+    if (!organization)
+        return;
+    const entries = "retainedHistory" in organization
+        ? organization.retainedHistory
+        : organization.history;
+    if (!entries)
+        return;
+    const genesis = entries.find(({ state }) => state.version === 1)?.state;
+    if (!genesis)
+        throw new KeyingVerificationError("missing_dependency", "Organization founder requires verified genesis");
+    const created = verifiedContainerCreateManifest({
+        head: root,
+        label: "Organization founder root",
+        verifiedByHash: input.verifiedByHash,
+    });
+    if (genesis?.signerUserId !== created.event.event.signerUserId ||
+        genesis.signerUserKeyFingerprint !==
+            created.event.event.signerKeyFingerprint)
+        throw new KeyingVerificationError("signer_mismatch", "Organization founder does not match its verified personal root's creator");
+    await rememberOrganizationFounder({
+        execSql: input.execSql,
+        organization,
+    });
+}
+//# sourceMappingURL=organizationFounderBinding.js.map

package/data/keyingProjectionVerification/organizationFounderBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationFounderBinding.js","sourceRoot":"","sources":["organizationFounderBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAG5F,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CACnD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,OAAO,GACX,iBAAiB,IAAI,YAAY;QAC/B,CAAC,CAAC,YAAY,CAAC,eAAe;QAC9B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;QAC1D,OAAO,CAAC,wBAAwB;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberOrganizationFounder } from \"../persistence/organizationFounderPersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { verifiedContainerCreateManifest } from \"./containerCreateManifest\";\n\n/**\n * A directory can cite someone else's public policies. Bind its founder to the\n * verified personal root's creator before trusting it to authorize a rehome.\n * Metadata roots can be created by later admins and cannot establish this pin.\n * This immutable identity anchor survives read-only verification and canceled\n * views; it neither advances nor replaces a current-policy checkpoint.\n */\nexport async function rememberRootBoundOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[] | undefined;\n  readonly root: VerifiedContainerAccessManifest | undefined;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<void> {\n  const { root } = input;\n  if (!root || root.state.systemSlot !== null) return;\n  const organization = input.policies?.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === root.state.organizationId,\n  );\n  if (!organization) return;\n  const entries =\n    \"retainedHistory\" in organization\n      ? organization.retainedHistory\n      : organization.history;\n  if (!entries) return;\n  const genesis = entries.find(({ state }) => state.version === 1)?.state;\n  if (!genesis)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const created = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Organization founder root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  if (\n    genesis?.signerUserId !== created.event.event.signerUserId ||\n    genesis.signerUserKeyFingerprint !==\n      created.event.event.signerKeyFingerprint\n  )\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Organization founder does not match its verified personal root's creator\",\n    );\n  await rememberOrganizationFounder({\n    execSql: input.execSql,\n    organization,\n  });\n}\n"]}

package/data/keyingProjectionVerification/principalPolicyCache.js

@@ -0,0 +1,76 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
+import { verifiedPrincipalPolicyMeetsCheckpoint } from "../persistence/principalPolicyCheckpointSelection.js";
+import { loadPrincipalPolicyBundleForReference } from "../persistence/principalPolicyReferencePersistence.js";
+import { principalStateMatchesReference } from "../principalPolicyStates.js";
+import { principalPolicyEvidenceEntries, } from "../principals/principalPolicyEvidence.js";
+/**
+ * Cache key for a referenced principal policy. The in-memory principal-policy
+ * cache is populated and read from several call sites; they must agree on this
+ * format byte-for-byte or a populated entry looks uncached (extra warm fetches)
+ * — so this is the single source of truth, imported rather than re-declared.
+ */
+export function referencedPrincipalPolicyKey(reference) {
+    return JSON.stringify([
+        reference.principalType,
+        reference.principalId,
+        reference.version,
+        reference.stateHash,
+        reference.keyEpoch,
+        reference.keyFingerprint,
+    ]);
+}
+/**
+ * Dedupes references by their exact head identity, keyed with
+ * {@link referencedPrincipalPolicyKey} so every consumer agrees on what
+ * "the same reference" means. Later duplicates win, preserving each
+ * caller's original last-wins behavior.
+ */
+export function dedupeReferencedPrincipalStates(references) {
+    const referencesByState = new Map();
+    for (const reference of references) {
+        referencesByState.set(referencedPrincipalPolicyKey(reference), reference);
+    }
+    return Array.from(referencesByState.values());
+}
+export function principalPolicyCacheForVerifiedPolicies(policies) {
+    const cache = new Map();
+    for (const policy of policies) {
+        const states = principalPolicyEvidenceEntries(policy).map((entry) => entry.state);
+        for (const state of states) {
+            cache.set(referencedPrincipalPolicyKey({
+                principalType: state.principalType,
+                principalId: state.principalId,
+                version: state.version,
+                keyEpoch: state.keyEpoch,
+                stateHash: state.stateHash,
+                keyFingerprint: state.keyFingerprint,
+            }), policy);
+        }
+    }
+    return cache;
+}
+export function verifiedPrincipalPolicyContainsReference(policy, reference) {
+    const states = principalPolicyEvidenceEntries(policy).map(({ state }) => state);
+    return states.some((state) => principalStateMatchesReference(state, reference));
+}
+// Identify which referenced policies are absent from both the in-memory cache
+// and local storage, so the warmer fetches only what is genuinely missing.
+export async function filterUncachedPrincipalPolicyReferences(input) {
+    const results = await Promise.all(input.references.map(async (reference) => {
+        const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, reference.principalType, reference.principalId);
+        const cachedPolicy = input.principalPolicyCache.get(referencedPrincipalPolicyKey(reference));
+        if (cachedPolicy) {
+            if (!verifiedPrincipalPolicyContainsReference(cachedPolicy, reference)) {
+                throw new KeyingVerificationError("hash_mismatch", "in-memory principal policy cache does not match its exact reference");
+            }
+            if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, checkpoint)) {
+                return null;
+            }
+        }
+        const bundle = await loadPrincipalPolicyBundleForReference(input.execSql, reference, checkpoint);
+        return bundle ? null : reference;
+    }));
+    return results.filter((reference) => reference !== null);
+}
+//# sourceMappingURL=principalPolicyCache.js.map

package/data/keyingProjectionVerification/principalPolicyCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCache.js","sourceRoot":"","sources":["principalPolicyCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,sCAAsC,EAAE,MAAM,mDAAmD,CAAC;AAC3G,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAC3G,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAEL,8BAA8B,GAC/B,MAAM,uCAAuC,CAAC;AAG/C;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAkC;IAElC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,OAAO;QACjB,SAAS,CAAC,SAAS;QACnB,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,cAAc;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAE7C,UAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,iBAAiB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CACvB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CACP,4BAA4B,CAAC;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,EACF,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAAsC,EACtC,SAAkC;IAElC,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CACrB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,8BAA8B,CAAC,KAAK,EAAE,SAAS,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CACjD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,SAAS,CAAC,EAClE,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,SAAS,EAAwC,EAAE,CAAC,SAAS,KAAK,IAAI,CACxE,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../persistence/keyingCheckpointPersistence\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"../persistence/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundleForReference } from \"../persistence/principalPolicyReferencePersistence\";\nimport { principalStateMatchesReference } from \"../principalPolicyStates\";\nimport {\n  type PrincipalPolicyCurrentEvidence,\n  principalPolicyEvidenceEntries,\n} from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\n/**\n * Cache key for a referenced principal policy. The in-memory principal-policy\n * cache is populated and read from several call sites; they must agree on this\n * format byte-for-byte or a populated entry looks uncached (extra warm fetches)\n * — so this is the single source of truth, imported rather than re-declared.\n */\nexport function referencedPrincipalPolicyKey(\n  reference: ReferencedPrincipalHead,\n): string {\n  return JSON.stringify([\n    reference.principalType,\n    reference.principalId,\n    reference.version,\n    reference.stateHash,\n    reference.keyEpoch,\n    reference.keyFingerprint,\n  ]);\n}\n\n/**\n * Dedupes references by their exact head identity, keyed with\n * {@link referencedPrincipalPolicyKey} so every consumer agrees on what\n * \"the same reference\" means. Later duplicates win, preserving each\n * caller's original last-wins behavior.\n */\nexport function dedupeReferencedPrincipalStates<\n  TReference extends ReferencedPrincipalHead,\n>(references: ReadonlyArray<TReference>): TReference[] {\n  const referencesByState = new Map<string, TReference>();\n  for (const reference of references) {\n    referencesByState.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n  return Array.from(referencesByState.values());\n}\n\nexport function principalPolicyCacheForVerifiedPolicies(\n  policies: readonly PrincipalPolicyCurrentEvidence[],\n): Map<string, PrincipalPolicyCurrentEvidence> {\n  const cache = new Map<string, PrincipalPolicyCurrentEvidence>();\n  for (const policy of policies) {\n    const states = principalPolicyEvidenceEntries(policy).map(\n      (entry) => entry.state,\n    );\n    for (const state of states) {\n      cache.set(\n        referencedPrincipalPolicyKey({\n          principalType: state.principalType,\n          principalId: state.principalId,\n          version: state.version,\n          keyEpoch: state.keyEpoch,\n          stateHash: state.stateHash,\n          keyFingerprint: state.keyFingerprint,\n        }),\n        policy,\n      );\n    }\n  }\n  return cache;\n}\n\nexport function verifiedPrincipalPolicyContainsReference(\n  policy: PrincipalPolicyCurrentEvidence,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const states = principalPolicyEvidenceEntries(policy).map(\n    ({ state }) => state,\n  );\n  return states.some((state) =>\n    principalStateMatchesReference(state, reference),\n  );\n}\n\n// Identify which referenced policies are absent from both the in-memory cache\n// and local storage, so the warmer fetches only what is genuinely missing.\nexport async function filterUncachedPrincipalPolicyReferences(input: {\n  execSql: ExecSql;\n  principalPolicyCache: ReadonlyMap<string, PrincipalPolicyCurrentEvidence>;\n  references: readonly ReferencedPrincipalHead[];\n}): Promise<ReferencedPrincipalHead[]> {\n  const results = await Promise.all(\n    input.references.map(async (reference) => {\n      const checkpoint = await loadPrincipalPolicyCheckpoint(\n        input.execSql,\n        reference.principalType,\n        reference.principalId,\n      );\n      const cachedPolicy = input.principalPolicyCache.get(\n        referencedPrincipalPolicyKey(reference),\n      );\n      if (cachedPolicy) {\n        if (\n          !verifiedPrincipalPolicyContainsReference(cachedPolicy, reference)\n        ) {\n          throw new KeyingVerificationError(\n            \"hash_mismatch\",\n            \"in-memory principal policy cache does not match its exact reference\",\n          );\n        }\n        if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, checkpoint)) {\n          return null;\n        }\n      }\n      const bundle = await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      );\n      return bundle ? null : reference;\n    }),\n  );\n  return results.filter(\n    (reference): reference is ReferencedPrincipalHead => reference !== null,\n  );\n}\n"]}

package/data/keyingProjectionVerification/principalPolicySnapshotVerification.js

@@ -0,0 +1,208 @@
+import { KeyingVerificationError, principalPolicyMatchesReference, toFingerprint, verifyPrincipalPolicyCheckpoint, } from "../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../persistence/principalPolicyReferencePersistence.js";
+import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
+import { verifyReceivedPolicySnapshot } from "./snapshotVerificationCache.js";
+function identityKey(input) {
+    return `${input.principalType}:${input.principalId}`;
+}
+function snapshotStates(snapshot) {
+    return [
+        ...snapshot.previousStates.map((entry) => entry.state),
+        snapshot.currentState,
+    ];
+}
+function snapshotReference(snapshot) {
+    const state = snapshot.currentState;
+    return {
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        keyEpoch: state.keyEpoch,
+        stateHash: state.stateHash,
+        keyFingerprint: state.keyFingerprint,
+    };
+}
+async function signerPublicKeys(input) {
+    const keys = new Map();
+    for (const state of snapshotStates(input.snapshot)) {
+        const key = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;
+        if (keys.has(key)) {
+            continue;
+        }
+        const identity = await input.resolveUserKey(state.signerUserId);
+        if (!identity) {
+            throw new ProjectionDependencyUnavailableError(`Principal policy snapshot signer ${state.signerUserId} is unavailable`);
+        }
+        const fingerprint = await toFingerprint(identity.signingPublicKey);
+        if (fingerprint !== state.signerUserKeyFingerprint) {
+            throw new KeyingVerificationError("signer_mismatch", "Principal policy snapshot signer fingerprint mismatch");
+        }
+        keys.set(key, {
+            userId: state.signerUserId,
+            signingKeyFingerprint: fingerprint,
+            signingPublicKey: identity.signingPublicKey,
+        });
+    }
+    return [...keys.values()];
+}
+function authorityReference(snapshot) {
+    const references = snapshotStates(snapshot).flatMap((state) => state.externalAuthority ? [state.externalAuthority] : []);
+    if (references.length === 0) {
+        return null;
+    }
+    const [first] = references;
+    if (!first ||
+        references.some((reference) => reference.principalId !== first.principalId ||
+            reference.principalType !== first.principalType)) {
+        throw new KeyingVerificationError("invalid_shape", "Principal policy snapshot cites inconsistent external authority");
+    }
+    return references.reduce((latest, reference) => reference.version > latest.version ? reference : latest);
+}
+function externalAuthority(policy) {
+    const states = policy.history.map((entry) => {
+        if (entry.state.principalType !== "group" ||
+            entry.projection.length === 0 ||
+            entry.projection.some((member) => member.role !== "admin")) {
+            throw new KeyingVerificationError("unauthorized", "Principal policy snapshot authority is invalid");
+        }
+        return {
+            head: {
+                principalType: "group",
+                principalId: entry.state.principalId,
+                version: entry.state.version,
+                keyEpoch: entry.state.keyEpoch,
+                stateHash: entry.state.stateHash,
+                keyFingerprint: entry.state.keyFingerprint,
+            },
+            projection: entry.projection,
+        };
+    });
+    const current = states.at(-1);
+    if (!current) {
+        throw new KeyingVerificationError("missing_dependency", "Principal policy snapshot authority is empty");
+    }
+    return { currentHead: current.head, states };
+}
+async function verifySnapshotAuthorization(input) {
+    const reference = snapshotReference(input.snapshot);
+    const authorityHead = authorityReference(input.snapshot);
+    if (reference.principalType === "organization" && authorityHead) {
+        throw new KeyingVerificationError("unauthorized", "organization states cannot cite external authority");
+    }
+    if (!authorityHead) {
+        const direct = await verifyReceivedPolicySnapshot({
+            expectedReference: reference,
+            signerPublicKeys: input.signerPublicKeys,
+            snapshot: input.snapshot,
+        });
+        if (!direct.ok)
+            throw direct.error;
+        return direct.value;
+    }
+    const authorityPolicy = await input.resolveAuthority(authorityHead);
+    if (!principalPolicyMatchesReference({
+        policy: authorityPolicy,
+        reference: authorityHead,
+    })) {
+        throw new KeyingVerificationError("missing_dependency", "Principal policy snapshot authority omits the referenced head");
+    }
+    const verified = await verifyReceivedPolicySnapshot({
+        expectedReference: reference,
+        externalAuthority: externalAuthority(authorityPolicy),
+        signerPublicKeys: input.signerPublicKeys,
+        snapshot: input.snapshot,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    return verified.value;
+}
+async function enforceSnapshotCheckpoint(input) {
+    const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, input.reference.principalType, input.reference.principalId);
+    if (!checkpoint)
+        return true;
+    if (input.policy.version >= checkpoint.version) {
+        verifyPrincipalPolicyCheckpoint({
+            chain: input.policy.history,
+            currentState: input.policy.state,
+            localCheckpoint: checkpoint,
+        });
+        return true;
+    }
+    const localDescendant = await loadPrincipalPolicyBundleForReference(input.execSql, input.reference, checkpoint);
+    if (!localDescendant) {
+        throw new KeyingVerificationError("rollback", "Principal policy snapshot cannot be connected to the newer local checkpoint");
+    }
+    return false;
+}
+export async function verifyPrincipalPolicySnapshots(input) {
+    const snapshotsByPrincipal = new Map();
+    for (const snapshot of input.snapshots) {
+        const key = identityKey(snapshot.currentState);
+        if (snapshotsByPrincipal.has(key)) {
+            throw new KeyingVerificationError("invalid_shape", "Principal policy snapshots contain a duplicate principal");
+        }
+        snapshotsByPrincipal.set(key, snapshot);
+    }
+    const verifiedByPrincipal = new Map();
+    const visiting = new Set();
+    const verifyOne = async (snapshot) => {
+        const key = identityKey(snapshot.currentState);
+        const cached = verifiedByPrincipal.get(key);
+        if (cached) {
+            return cached;
+        }
+        if (visiting.has(key)) {
+            throw new KeyingVerificationError("invalid_shape", "Principal policy snapshot authority contains a cycle");
+        }
+        visiting.add(key);
+        try {
+            const publicKeys = await signerPublicKeys({
+                resolveUserKey: input.resolveUserKey,
+                snapshot,
+            });
+            const policy = await verifySnapshotAuthorization({
+                resolveAuthority: async (reference) => {
+                    const authoritySnapshot = snapshotsByPrincipal.get(identityKey(reference));
+                    if (!authoritySnapshot) {
+                        throw new KeyingVerificationError("missing_dependency", "Principal policy snapshot authority is missing");
+                    }
+                    return verifyOne(authoritySnapshot);
+                },
+                signerPublicKeys: publicKeys,
+                snapshot,
+            });
+            verifiedByPrincipal.set(key, policy);
+            return policy;
+        }
+        finally {
+            visiting.delete(key);
+        }
+    };
+    for (const snapshot of input.snapshots) {
+        await verifyOne(snapshot);
+    }
+    return [...verifiedByPrincipal.values()];
+}
+export async function enforcePrincipalPolicySnapshotCheckpoints(input) {
+    const policiesToPin = [];
+    for (const policy of input.policies) {
+        const shouldPin = await enforceSnapshotCheckpoint({
+            execSql: input.execSql,
+            policy,
+            reference: {
+                principalType: policy.state.principalType,
+                principalId: policy.state.principalId,
+                version: policy.state.version,
+                keyEpoch: policy.state.keyEpoch,
+                stateHash: policy.state.stateHash,
+                keyFingerprint: policy.state.keyFingerprint,
+            },
+        });
+        if (shouldPin)
+            policiesToPin.push(policy);
+    }
+    return policiesToPin;
+}
+//# sourceMappingURL=principalPolicySnapshotVerification.js.map

package/data/keyingProjectionVerification/principalPolicySnapshotVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicySnapshotVerification.js","sourceRoot":"","sources":["principalPolicySnapshotVerification.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,aAAa,EACb,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAE3G,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAG3E,SAAS,WAAW,CAAC,KAGpB;IACC,OAAO,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,QAAyC;IAC/D,OAAO;QACL,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACtD,QAAQ,CAAC,YAAY;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAyC;IAEzC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpC,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAG/B;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0C,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oCAAoC,CAC5C,oCAAoC,KAAK,CAAC,YAAY,iBAAiB,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,WAAW,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;YACnD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;YACZ,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,qBAAqB,EAAE,WAAW;YAClC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAyC;IAEzC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5D,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;IAC3B,IACE,CAAC,KAAK;QACN,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC3C,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAClD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAuC;IAEvC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,IACE,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;YACrC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EAC1D,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa,EAAE,OAAgB;gBAC/B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;aAC3C;YACD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAM1C;IACC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,aAAa,KAAK,cAAc,IAAI,aAAa,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,IACE,CAAC,+BAA+B,CAAC;QAC/B,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,aAAa;KACzB,CAAC,EACF,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;QAClD,iBAAiB,EAAE,SAAS;QAC5B,iBAAiB,EAAE,iBAAiB,CAAC,eAAe,CAAC;QACrD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,KAAK,CAAC,SAAS,CAAC,WAAW,CAC5B,CAAC;IACF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/C,+BAA+B,CAAC;YAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC3B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YAChC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,qCAAqC,CACjE,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAGpD;IACC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;IACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,SAAS,GAAG,KAAK,EACrB,QAAyC,EACC,EAAE;QAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sDAAsD,CACvD,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;gBAC/C,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;oBACpC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,CAChD,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;oBACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;oBACJ,CAAC;oBACD,OAAO,SAAS,CAAC,iBAAiB,CAAC,CAAC;gBACtC,CAAC;gBACD,gBAAgB,EAAE,UAAU;gBAC5B,QAAQ;aACT,CAAC,CAAC;YACH,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAG/D;IACC,MAAM,aAAa,GAAsC,EAAE,CAAC;IAC5D,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM;YACN,SAAS,EAAE;gBACT,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;gBACzC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;gBACrC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;gBACjC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;aAC5C;SACF,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicySignerPublicKey,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicySnapshot,\n} from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  toFingerprint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicySnapshotResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../persistence/principalPolicyReferencePersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { verifyReceivedPolicySnapshot } from \"./snapshotVerificationCache\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nfunction identityKey(input: {\n  readonly principalId: string;\n  readonly principalType: string;\n}): string {\n  return `${input.principalType}:${input.principalId}`;\n}\n\nfunction snapshotStates(snapshot: PrincipalPolicySnapshotResponse) {\n  return [\n    ...snapshot.previousStates.map((entry) => entry.state),\n    snapshot.currentState,\n  ];\n}\n\nfunction snapshotReference(\n  snapshot: PrincipalPolicySnapshotResponse,\n): ReferencedPrincipalHead {\n  const state = snapshot.currentState;\n  return {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nasync function signerPublicKeys(input: {\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly snapshot: PrincipalPolicySnapshotResponse;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const keys = new Map<string, PrincipalPolicySignerPublicKey>();\n  for (const state of snapshotStates(input.snapshot)) {\n    const key = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;\n    if (keys.has(key)) {\n      continue;\n    }\n    const identity = await input.resolveUserKey(state.signerUserId);\n    if (!identity) {\n      throw new ProjectionDependencyUnavailableError(\n        `Principal policy snapshot signer ${state.signerUserId} is unavailable`,\n      );\n    }\n    const fingerprint = await toFingerprint(identity.signingPublicKey);\n    if (fingerprint !== state.signerUserKeyFingerprint) {\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        \"Principal policy snapshot signer fingerprint mismatch\",\n      );\n    }\n    keys.set(key, {\n      userId: state.signerUserId,\n      signingKeyFingerprint: fingerprint,\n      signingPublicKey: identity.signingPublicKey,\n    });\n  }\n  return [...keys.values()];\n}\n\nfunction authorityReference(\n  snapshot: PrincipalPolicySnapshotResponse,\n): ReferencedPrincipalHead | null {\n  const references = snapshotStates(snapshot).flatMap((state) =>\n    state.externalAuthority ? [state.externalAuthority] : [],\n  );\n  if (references.length === 0) {\n    return null;\n  }\n  const [first] = references;\n  if (\n    !first ||\n    references.some(\n      (reference) =>\n        reference.principalId !== first.principalId ||\n        reference.principalType !== first.principalType,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal policy snapshot cites inconsistent external authority\",\n    );\n  }\n  return references.reduce((latest, reference) =>\n    reference.version > latest.version ? reference : latest,\n  );\n}\n\nfunction externalAuthority(\n  policy: VerifiedPrincipalPolicySnapshot,\n): PrincipalPolicyExternalAuthority {\n  const states = policy.history.map((entry) => {\n    if (\n      entry.state.principalType !== \"group\" ||\n      entry.projection.length === 0 ||\n      entry.projection.some((member) => member.role !== \"admin\")\n    ) {\n      throw new KeyingVerificationError(\n        \"unauthorized\",\n        \"Principal policy snapshot authority is invalid\",\n      );\n    }\n    return {\n      head: {\n        principalType: \"group\" as const,\n        principalId: entry.state.principalId,\n        version: entry.state.version,\n        keyEpoch: entry.state.keyEpoch,\n        stateHash: entry.state.stateHash,\n        keyFingerprint: entry.state.keyFingerprint,\n      },\n      projection: entry.projection,\n    };\n  });\n  const current = states.at(-1);\n  if (!current) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal policy snapshot authority is empty\",\n    );\n  }\n  return { currentHead: current.head, states };\n}\n\nasync function verifySnapshotAuthorization(input: {\n  readonly resolveAuthority: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<VerifiedPrincipalPolicySnapshot>;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly snapshot: PrincipalPolicySnapshotResponse;\n}): Promise<VerifiedPrincipalPolicySnapshot> {\n  const reference = snapshotReference(input.snapshot);\n  const authorityHead = authorityReference(input.snapshot);\n  if (reference.principalType === \"organization\" && authorityHead) {\n    throw new KeyingVerificationError(\n      \"unauthorized\",\n      \"organization states cannot cite external authority\",\n    );\n  }\n  if (!authorityHead) {\n    const direct = await verifyReceivedPolicySnapshot({\n      expectedReference: reference,\n      signerPublicKeys: input.signerPublicKeys,\n      snapshot: input.snapshot,\n    });\n    if (!direct.ok) throw direct.error;\n    return direct.value;\n  }\n  const authorityPolicy = await input.resolveAuthority(authorityHead);\n  if (\n    !principalPolicyMatchesReference({\n      policy: authorityPolicy,\n      reference: authorityHead,\n    })\n  ) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal policy snapshot authority omits the referenced head\",\n    );\n  }\n  const verified = await verifyReceivedPolicySnapshot({\n    expectedReference: reference,\n    externalAuthority: externalAuthority(authorityPolicy),\n    signerPublicKeys: input.signerPublicKeys,\n    snapshot: input.snapshot,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  return verified.value;\n}\n\nasync function enforceSnapshotCheckpoint(input: {\n  readonly execSql: ExecSql;\n  readonly policy: VerifiedPrincipalPolicySnapshot;\n  readonly reference: ReferencedPrincipalHead;\n}): Promise<boolean> {\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.reference.principalType,\n    input.reference.principalId,\n  );\n  if (!checkpoint) return true;\n  if (input.policy.version >= checkpoint.version) {\n    verifyPrincipalPolicyCheckpoint({\n      chain: input.policy.history,\n      currentState: input.policy.state,\n      localCheckpoint: checkpoint,\n    });\n    return true;\n  }\n  const localDescendant = await loadPrincipalPolicyBundleForReference(\n    input.execSql,\n    input.reference,\n    checkpoint,\n  );\n  if (!localDescendant) {\n    throw new KeyingVerificationError(\n      \"rollback\",\n      \"Principal policy snapshot cannot be connected to the newer local checkpoint\",\n    );\n  }\n  return false;\n}\n\nexport async function verifyPrincipalPolicySnapshots(input: {\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly snapshots: readonly PrincipalPolicySnapshotResponse[];\n}): Promise<VerifiedPrincipalPolicySnapshot[]> {\n  const snapshotsByPrincipal = new Map<\n    string,\n    PrincipalPolicySnapshotResponse\n  >();\n  for (const snapshot of input.snapshots) {\n    const key = identityKey(snapshot.currentState);\n    if (snapshotsByPrincipal.has(key)) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Principal policy snapshots contain a duplicate principal\",\n      );\n    }\n    snapshotsByPrincipal.set(key, snapshot);\n  }\n  const verifiedByPrincipal = new Map<\n    string,\n    VerifiedPrincipalPolicySnapshot\n  >();\n  const visiting = new Set<string>();\n\n  const verifyOne = async (\n    snapshot: PrincipalPolicySnapshotResponse,\n  ): Promise<VerifiedPrincipalPolicySnapshot> => {\n    const key = identityKey(snapshot.currentState);\n    const cached = verifiedByPrincipal.get(key);\n    if (cached) {\n      return cached;\n    }\n    if (visiting.has(key)) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Principal policy snapshot authority contains a cycle\",\n      );\n    }\n    visiting.add(key);\n    try {\n      const publicKeys = await signerPublicKeys({\n        resolveUserKey: input.resolveUserKey,\n        snapshot,\n      });\n      const policy = await verifySnapshotAuthorization({\n        resolveAuthority: async (reference) => {\n          const authoritySnapshot = snapshotsByPrincipal.get(\n            identityKey(reference),\n          );\n          if (!authoritySnapshot) {\n            throw new KeyingVerificationError(\n              \"missing_dependency\",\n              \"Principal policy snapshot authority is missing\",\n            );\n          }\n          return verifyOne(authoritySnapshot);\n        },\n        signerPublicKeys: publicKeys,\n        snapshot,\n      });\n      verifiedByPrincipal.set(key, policy);\n      return policy;\n    } finally {\n      visiting.delete(key);\n    }\n  };\n\n  for (const snapshot of input.snapshots) {\n    await verifyOne(snapshot);\n  }\n  return [...verifiedByPrincipal.values()];\n}\n\nexport async function enforcePrincipalPolicySnapshotCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly VerifiedPrincipalPolicySnapshot[];\n}): Promise<VerifiedPrincipalPolicySnapshot[]> {\n  const policiesToPin: VerifiedPrincipalPolicySnapshot[] = [];\n  for (const policy of input.policies) {\n    const shouldPin = await enforceSnapshotCheckpoint({\n      execSql: input.execSql,\n      policy,\n      reference: {\n        principalType: policy.state.principalType,\n        principalId: policy.state.principalId,\n        version: policy.state.version,\n        keyEpoch: policy.state.keyEpoch,\n        stateHash: policy.state.stateHash,\n        keyFingerprint: policy.state.keyFingerprint,\n      },\n    });\n    if (shouldPin) policiesToPin.push(policy);\n  }\n  return policiesToPin;\n}\n"]}