@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/keyingProjectionVerification/principalPolicyVerification.js

@@ -0,0 +1,253 @@
+import { KeyingVerificationError, toFingerprint, verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
+import { principalPolicyHeadMeetsCheckpoint, verifiedPrincipalPolicyMeetsCheckpoint, } from "../persistence/principalPolicyCheckpointSelection.js";
+import { loadPrincipalPolicyBundle } from "../persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../persistence/principalPolicyReferencePersistence.js";
+import { principalPolicyBundleStates } from "../principalPolicyStates.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../principals/organizationAuthorityDescriptor.js";
+import { organizationAdminExternalAuthority, principalPolicyReferenceFromBundle, verifyOrganizationAdminPolicy, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../principals/principalPolicyAdminSigners.js";
+import { observePrincipalPolicy, } from "./checkpointContext.js";
+import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
+import { rethrowProjectionVerificationBoundaryError } from "./error.js";
+import { filterUncachedPrincipalPolicyReferences, referencedPrincipalPolicyKey, verifiedPrincipalPolicyContainsReference, } from "./principalPolicyCache.js";
+import { resolveReferencedPrincipalPolicy } from "./resolvedPrincipalPolicy.js";
+import { assertProjectionVerificationCurrent, generationGuardedPrincipalPolicyWarmer, } from "./types.js";
+function principalPolicyReferenceLabel(reference) {
+    return `${reference.principalType}:${reference.principalId}@${reference.version}`;
+}
+/**
+ * A referenced principal policy is not in the local store and warming could
+ * not fetch it this pass — a transient cold-cache condition, typical for a
+ * member whose access arrives via a group policy the device has not hydrated
+ * yet. Sync passes discriminate on this type to defer the affected container
+ * and retry on a later trigger, rather than failing the whole pass.
+ */
+export class PrincipalPolicyNotCachedError extends Error {
+    constructor(referenceLabel) {
+        super(`Principal policy ${referenceLabel} is not cached`);
+        this.name = "PrincipalPolicyNotCachedError";
+    }
+}
+export function isPrincipalPolicyNotCachedError(error) {
+    return (error instanceof PrincipalPolicyNotCachedError ||
+        (error instanceof Error && error.name === "PrincipalPolicyNotCachedError"));
+}
+async function collectPrincipalPolicySignerPublicKeys(input) {
+    const signerPublicKeysByKey = new Map();
+    for (const state of principalPolicyBundleStates(input.bundle)) {
+        const cacheKey = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;
+        if (signerPublicKeysByKey.has(cacheKey)) {
+            continue;
+        }
+        const signerKey = await input.resolveUserKey(state.signerUserId);
+        if (!signerKey) {
+            throw new ProjectionDependencyUnavailableError(`${input.label} signer key could not be resolved for ${state.signerUserId}`);
+        }
+        const signingKeyFingerprint = await toFingerprint(signerKey.signingPublicKey);
+        if (signingKeyFingerprint !== state.signerUserKeyFingerprint) {
+            throw new KeyingVerificationError("signer_mismatch", `${input.label} signer key fingerprint mismatch`);
+        }
+        signerPublicKeysByKey.set(cacheKey, {
+            userId: state.signerUserId,
+            signingKeyFingerprint,
+            signingPublicKey: signerKey.signingPublicKey,
+        });
+    }
+    return [...signerPublicKeysByKey.values()];
+}
+async function loadOrganizationPolicyForVerification(input) {
+    const execSql = input.checkpointContext.execSql;
+    let bundle = await loadPrincipalPolicyBundle(execSql, "organization", input.organizationId);
+    if (!bundle) {
+        return undefined;
+    }
+    let localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, "organization", input.organizationId);
+    if (!principalPolicyHeadMeetsCheckpoint(bundle.currentState, localCheckpoint) &&
+        input.warmReferencedPrincipalPolicies) {
+        await input.warmReferencedPrincipalPolicies({
+            organizationId: input.organizationId,
+            references: [principalPolicyReferenceFromBundle(bundle)],
+        });
+        bundle = await loadPrincipalPolicyBundle(execSql, "organization", input.organizationId);
+        localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, "organization", input.organizationId);
+        if (!bundle) {
+            return undefined;
+        }
+    }
+    return { bundle, localCheckpoint };
+}
+function assertReservedAdminsPolicyShape(policy) {
+    const history = policy.history ?? [{ projection: policy.projection }];
+    if (history.some((entry) => entry.projection.length === 0 ||
+        entry.projection.some((member) => member.role !== "admin"))) {
+        throw new KeyingVerificationError("invalid_shape", "reserved Admins policy must contain only direct admin users");
+    }
+}
+async function verifyOrganizationAdminsPolicy(input) {
+    const adminBundle = await loadPrincipalPolicyBundle(input.execSql, "group", input.adminGroupId);
+    if (!adminBundle) {
+        return undefined;
+    }
+    if (!principalHeadMatchesReference(principalPolicyReferenceFromBundle(adminBundle), input.expectedHead)) {
+        throw new KeyingVerificationError("hash_mismatch", "Admins policy does not match the signed organization directory");
+    }
+    const adminCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", input.adminGroupId);
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: adminBundle,
+        label: `Admins policy ${input.adminGroupId}`,
+        resolveUserKey: input.resolveUserKey,
+    });
+    const verified = await verifyPrincipalPolicyBundle({
+        bundle: adminBundle,
+        expectedReference: input.expectedHead,
+        localCheckpoint: adminCheckpoint,
+        signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    assertReservedAdminsPolicyShape(verified.value);
+    return verified.value;
+}
+async function loadOrganizationExternalAuthority(input) {
+    const organizationPolicy = await loadOrganizationPolicyForVerification(input);
+    if (!organizationPolicy) {
+        return null;
+    }
+    try {
+        const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+            bundle: organizationPolicy.bundle,
+            label: `Organization policy ${input.organizationId}`,
+            resolveUserKey: input.resolveUserKey,
+        });
+        const verified = await verifyOrganizationAdminPolicy({
+            bundle: organizationPolicy.bundle,
+            localCheckpoint: organizationPolicy.localCheckpoint,
+            organizationId: input.organizationId,
+            signerPublicKeys,
+        });
+        if (!verified.ok) {
+            throw verified.error;
+        }
+        const descriptor = parseOrganizationAuthorityDescriptor(organizationPolicy.bundle.currentPayload.ciphertext);
+        if (descriptor.organizationId !== input.organizationId) {
+            throw new KeyingVerificationError("object_mismatch", "organization authority descriptor scope does not match");
+        }
+        const verifiedAdmins = await verifyOrganizationAdminsPolicy({
+            adminGroupId: descriptor.adminGroupId,
+            execSql: input.checkpointContext.execSql,
+            expectedHead: requireOrganizationGroupHead(descriptor, descriptor.adminGroupId),
+            resolveUserKey: input.resolveUserKey,
+        });
+        if (!verifiedAdmins) {
+            return null;
+        }
+        observePrincipalPolicy(input.checkpointContext, verified.value, input.organizationId);
+        observePrincipalPolicy(input.checkpointContext, verifiedAdmins, input.organizationId);
+        return organizationAdminExternalAuthority(verifiedAdmins);
+    }
+    catch (error) {
+        rethrowProjectionVerificationBoundaryError(error);
+        if (error instanceof KeyingVerificationError) {
+            throw error;
+        }
+        return null;
+    }
+}
+async function verifyReferencedPrincipalPolicy(input) {
+    const cacheKey = referencedPrincipalPolicyKey(input.reference);
+    const cachedPolicy = input.principalPolicyCache.get(cacheKey);
+    const execSql = input.checkpointContext.execSql;
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, input.reference.principalType, input.reference.principalId);
+    if (cachedPolicy && !("retainedHistory" in cachedPolicy)) {
+        if (!verifiedPrincipalPolicyContainsReference(cachedPolicy, input.reference)) {
+            throw new KeyingVerificationError("hash_mismatch", "in-memory principal policy cache does not match its exact reference");
+        }
+        if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, localCheckpoint)) {
+            observePrincipalPolicy(input.checkpointContext, cachedPolicy, input.organizationId);
+            return cachedPolicy;
+        }
+    }
+    const referenceLabel = principalPolicyReferenceLabel(input.reference);
+    let bundle = await loadPrincipalPolicyBundleForReference(execSql, input.reference, localCheckpoint);
+    if (!bundle) {
+        const recovered = await resolveReferencedPrincipalPolicy(input);
+        if (recovered)
+            return recovered;
+    }
+    if (!bundle && input.warmReferencedPrincipalPolicies) {
+        // The reference is not cached locally — the common case for a member who
+        // gained access via another org's group grant and never hydrated that
+        // group's policy. Fetch+verify+persist it, then re-read from the cache.
+        await input.warmReferencedPrincipalPolicies({
+            organizationId: input.organizationId,
+            references: [input.reference],
+        });
+        bundle = await loadPrincipalPolicyBundleForReference(execSql, input.reference, localCheckpoint);
+    }
+    if (!bundle) {
+        throw new PrincipalPolicyNotCachedError(referenceLabel);
+    }
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        label: `Principal policy ${referenceLabel}`,
+        resolveUserKey: input.resolveUserKey,
+    });
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: input.reference,
+        loadExternalAuthority: () => loadOrganizationExternalAuthority({
+            checkpointContext: input.checkpointContext,
+            organizationId: input.organizationId,
+            resolveUserKey: input.resolveUserKey,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        }),
+        localCheckpoint,
+        signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    observePrincipalPolicy(input.checkpointContext, verified.value, input.organizationId);
+    input.principalPolicyCache.set(cacheKey, verified.value);
+    return verified.value;
+}
+export async function collectReferencedPrincipalPolicies(input) {
+    const warmReferencedPrincipalPolicies = generationGuardedPrincipalPolicyWarmer(input.warmReferencedPrincipalPolicies, input.stillCurrent);
+    const uniqueReferences = new Map();
+    for (const reference of input.references) {
+        uniqueReferences.set(referencedPrincipalPolicyKey(reference), reference);
+    }
+    const references = [...uniqueReferences.values()];
+    // Warm every missing reference in one batched fetch before verifying, so a
+    // path that references several uncached policies makes a single round of
+    // requests rather than one per reference.
+    if (warmReferencedPrincipalPolicies &&
+        !warmReferencedPrincipalPolicies.resolveReference) {
+        const uncached = await filterUncachedPrincipalPolicyReferences({
+            execSql: input.checkpointContext.execSql,
+            principalPolicyCache: input.principalPolicyCache,
+            references,
+        });
+        if (uncached.length > 0) {
+            assertProjectionVerificationCurrent(input.stillCurrent);
+            await warmReferencedPrincipalPolicies({
+                organizationId: input.organizationId,
+                references: uncached,
+            });
+            assertProjectionVerificationCurrent(input.stillCurrent);
+        }
+    }
+    const recoveryBatch = {};
+    return Promise.all(references.map((reference) => verifyReferencedPrincipalPolicy({
+        recoveryBatch,
+        checkpointContext: input.checkpointContext,
+        organizationId: input.organizationId,
+        principalPolicyCache: input.principalPolicyCache,
+        reference,
+        stillCurrent: input.stillCurrent,
+        resolveUserKey: input.resolveUserKey,
+        warmReferencedPrincipalPolicies,
+    })));
+}
+//# sourceMappingURL=principalPolicyVerification.js.map

package/data/keyingProjectionVerification/principalPolicyVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyVerification.js","sourceRoot":"","sources":["principalPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,aAAa,EAEb,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EACL,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAC3G,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,6BAA6B,EAC7B,yDAAyD,GAC1D,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,0CAA0C,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EACL,uCAAuC,EACvC,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAM7E,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,SAAS,CAAC;AAEjB,SAAS,6BAA6B,CACpC,SAAkC;IAElC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,cAAsB;QAChC,KAAK,CAAC,oBAAoB,cAAc,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,CACL,KAAK,YAAY,6BAA6B;QAC9C,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAIrD;IACC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC3E,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,oCAAoC,CAC5C,GAAG,KAAK,CAAC,KAAK,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,aAAa,CAC/C,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,IAAI,qBAAqB,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,kCAAkC,CACjD,CAAC;QACJ,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,qBAAqB;YACrB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,KAAmC;IAUnC,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,IAAI,MAAM,GAAG,MAAM,yBAAyB,CAC1C,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,GAAG,MAAM,6BAA6B,CACvD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IACE,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;QACzE,KAAK,CAAC,+BAA+B,EACrC,CAAC;QACD,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,yBAAyB,CACtC,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,eAAe,GAAG,MAAM,6BAA6B,CACnD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,+BAA+B,CACtC,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,WAAW,CAAC,EAC/C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,iBAAiB,KAAK,CAAC,YAAY,EAAE;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,WAAW;QACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe,EAAE,eAAe;QAChC,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,+BAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAmC;IAEnC,MAAM,kBAAkB,GAAG,MAAM,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;YACpE,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,KAAK,EAAE,uBAAuB,KAAK,CAAC,cAAc,EAAE;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,eAAe,EAAE,kBAAkB,CAAC,eAAe;YACnD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,MAAM,UAAU,GAAG,oCAAoC,CACrD,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CACpD,CAAC;QACF,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC;YAC1D,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;YACD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,kCAAkC,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0CAA0C,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAS9C;IACC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,OAAO,EACP,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,KAAK,CAAC,SAAS,CAAC,WAAW,CAC5B,CAAC;IACF,IAAI,YAAY,IAAI,CAAC,CAAC,iBAAiB,IAAI,YAAY,CAAC,EAAE,CAAC;QACzD,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1E,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,YAAY,EACZ,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,MAAM,GAAG,MAAM,qCAAqC,CACtD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC;QACrD,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,qCAAqC,CAClD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,KAAK,EAAE,oBAAoB,cAAc,EAAE;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,qBAAqB,EAAE,GAAG,EAAE,CAC1B,iCAAiC,CAAC;YAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;SACxC,CAAC;QACJ,eAAe;QACf,gBAAgB;KACjB,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,2EAA2E;IAC3E,yEAAyE;IACzE,0CAA0C;IAC1C,IACE,+BAA+B;QAC/B,CAAC,+BAA+B,CAAC,gBAAgB,EACjD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAAC;YAC7D,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,+BAA+B,CAAC;gBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,+BAA+B,CAAC;QAC9B,aAAa;QACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS;QACT,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B;KAChC,CAAC,CACH,CACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  toFingerprint,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../persistence/keyingCheckpointPersistence\";\nimport {\n  principalPolicyHeadMeetsCheckpoint,\n  verifiedPrincipalPolicyMeetsCheckpoint,\n} from \"../persistence/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundle } from \"../persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../persistence/principalPolicyReferencePersistence\";\nimport { principalPolicyBundleStates } from \"../principalPolicyStates\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../principals/principalPolicyEvidence\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { rethrowProjectionVerificationBoundaryError } from \"./error\";\nimport {\n  filterUncachedPrincipalPolicyReferences,\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\nimport { resolveReferencedPrincipalPolicy } from \"./resolvedPrincipalPolicy\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n} from \"./types\";\n\nfunction principalPolicyReferenceLabel(\n  reference: ReferencedPrincipalHead,\n): string {\n  return `${reference.principalType}:${reference.principalId}@${reference.version}`;\n}\n\n/**\n * A referenced principal policy is not in the local store and warming could\n * not fetch it this pass — a transient cold-cache condition, typical for a\n * member whose access arrives via a group policy the device has not hydrated\n * yet. Sync passes discriminate on this type to defer the affected container\n * and retry on a later trigger, rather than failing the whole pass.\n */\nexport class PrincipalPolicyNotCachedError extends Error {\n  constructor(referenceLabel: string) {\n    super(`Principal policy ${referenceLabel} is not cached`);\n    this.name = \"PrincipalPolicyNotCachedError\";\n  }\n}\n\nexport function isPrincipalPolicyNotCachedError(error: unknown): boolean {\n  return (\n    error instanceof PrincipalPolicyNotCachedError ||\n    (error instanceof Error && error.name === \"PrincipalPolicyNotCachedError\")\n  );\n}\n\nasync function collectPrincipalPolicySignerPublicKeys(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  label: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyBundleStates(input.bundle)) {\n    const cacheKey = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const signerKey = await input.resolveUserKey(state.signerUserId);\n    if (!signerKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `${input.label} signer key could not be resolved for ${state.signerUserId}`,\n      );\n    }\n\n    const signingKeyFingerprint = await toFingerprint(\n      signerKey.signingPublicKey,\n    );\n    if (signingKeyFingerprint !== state.signerUserKeyFingerprint) {\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        `${input.label} signer key fingerprint mismatch`,\n      );\n    }\n\n    signerPublicKeysByKey.set(cacheKey, {\n      userId: state.signerUserId,\n      signingKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    });\n  }\n\n  return [...signerPublicKeysByKey.values()];\n}\n\ntype OrganizationAdminPolicyInput = {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n};\n\nasync function loadOrganizationPolicyForVerification(\n  input: OrganizationAdminPolicyInput,\n): Promise<\n  | {\n      bundle: PrincipalPolicyBundleResponse;\n      localCheckpoint: Awaited<\n        ReturnType<typeof loadPrincipalPolicyCheckpoint>\n      >;\n    }\n  | undefined\n> {\n  const execSql = input.checkpointContext.execSql;\n  let bundle = await loadPrincipalPolicyBundle(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (!bundle) {\n    return undefined;\n  }\n  let localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (\n    !principalPolicyHeadMeetsCheckpoint(bundle.currentState, localCheckpoint) &&\n    input.warmReferencedPrincipalPolicies\n  ) {\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [principalPolicyReferenceFromBundle(bundle)],\n    });\n    bundle = await loadPrincipalPolicyBundle(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    localCheckpoint = await loadPrincipalPolicyCheckpoint(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) {\n      return undefined;\n    }\n  }\n\n  return { bundle, localCheckpoint };\n}\n\nfunction assertReservedAdminsPolicyShape(\n  policy: VerifiedPrincipalPolicy,\n): void {\n  const history = policy.history ?? [{ projection: policy.projection }];\n  if (\n    history.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\nasync function verifyOrganizationAdminsPolicy(input: {\n  adminGroupId: string;\n  execSql: ProjectionCheckpointContext[\"execSql\"];\n  expectedHead: ReferencedPrincipalHead;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<VerifiedPrincipalPolicy | undefined> {\n  const adminBundle = await loadPrincipalPolicyBundle(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!adminBundle) {\n    return undefined;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(adminBundle),\n      input.expectedHead,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Admins policy does not match the signed organization directory\",\n    );\n  }\n  const adminCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: adminBundle,\n    label: `Admins policy ${input.adminGroupId}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: adminBundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint: adminCheckpoint,\n    signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  assertReservedAdminsPolicyShape(verified.value);\n  return verified.value;\n}\n\nasync function loadOrganizationExternalAuthority(\n  input: OrganizationAdminPolicyInput,\n): Promise<ReturnType<typeof organizationAdminExternalAuthority> | null> {\n  const organizationPolicy = await loadOrganizationPolicyForVerification(input);\n  if (!organizationPolicy) {\n    return null;\n  }\n\n  try {\n    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n      bundle: organizationPolicy.bundle,\n      label: `Organization policy ${input.organizationId}`,\n      resolveUserKey: input.resolveUserKey,\n    });\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle: organizationPolicy.bundle,\n      localCheckpoint: organizationPolicy.localCheckpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys,\n    });\n    if (!verified.ok) {\n      throw verified.error;\n    }\n    const descriptor = parseOrganizationAuthorityDescriptor(\n      organizationPolicy.bundle.currentPayload.ciphertext,\n    );\n    if (descriptor.organizationId !== input.organizationId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization authority descriptor scope does not match\",\n      );\n    }\n    const verifiedAdmins = await verifyOrganizationAdminsPolicy({\n      adminGroupId: descriptor.adminGroupId,\n      execSql: input.checkpointContext.execSql,\n      expectedHead: requireOrganizationGroupHead(\n        descriptor,\n        descriptor.adminGroupId,\n      ),\n      resolveUserKey: input.resolveUserKey,\n    });\n    if (!verifiedAdmins) {\n      return null;\n    }\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verified.value,\n      input.organizationId,\n    );\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verifiedAdmins,\n      input.organizationId,\n    );\n    return organizationAdminExternalAuthority(verifiedAdmins);\n  } catch (error) {\n    rethrowProjectionVerificationBoundaryError(error);\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n\nasync function verifyReferencedPrincipalPolicy(input: {\n  recoveryBatch: object;\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  reference: ReferencedPrincipalHead;\n  stillCurrent?: (() => boolean) | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n  const cacheKey = referencedPrincipalPolicyKey(input.reference);\n  const cachedPolicy = input.principalPolicyCache.get(cacheKey);\n  const execSql = input.checkpointContext.execSql;\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    input.reference.principalType,\n    input.reference.principalId,\n  );\n  if (cachedPolicy && !(\"retainedHistory\" in cachedPolicy)) {\n    if (\n      !verifiedPrincipalPolicyContainsReference(cachedPolicy, input.reference)\n    ) {\n      throw new KeyingVerificationError(\n        \"hash_mismatch\",\n        \"in-memory principal policy cache does not match its exact reference\",\n      );\n    }\n    if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, localCheckpoint)) {\n      observePrincipalPolicy(\n        input.checkpointContext,\n        cachedPolicy,\n        input.organizationId,\n      );\n      return cachedPolicy;\n    }\n  }\n\n  const referenceLabel = principalPolicyReferenceLabel(input.reference);\n  let bundle = await loadPrincipalPolicyBundleForReference(\n    execSql,\n    input.reference,\n    localCheckpoint,\n  );\n  if (!bundle) {\n    const recovered = await resolveReferencedPrincipalPolicy(input);\n    if (recovered) return recovered;\n  }\n  if (!bundle && input.warmReferencedPrincipalPolicies) {\n    // The reference is not cached locally — the common case for a member who\n    // gained access via another org's group grant and never hydrated that\n    // group's policy. Fetch+verify+persist it, then re-read from the cache.\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [input.reference],\n    });\n    bundle = await loadPrincipalPolicyBundleForReference(\n      execSql,\n      input.reference,\n      localCheckpoint,\n    );\n  }\n  if (!bundle) {\n    throw new PrincipalPolicyNotCachedError(referenceLabel);\n  }\n\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    label: `Principal policy ${referenceLabel}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: input.reference,\n      loadExternalAuthority: () =>\n        loadOrganizationExternalAuthority({\n          checkpointContext: input.checkpointContext,\n          organizationId: input.organizationId,\n          resolveUserKey: input.resolveUserKey,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n        }),\n      localCheckpoint,\n      signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n\n  observePrincipalPolicy(\n    input.checkpointContext,\n    verified.value,\n    input.organizationId,\n  );\n  input.principalPolicyCache.set(cacheKey, verified.value);\n  return verified.value;\n}\n\nexport async function collectReferencedPrincipalPolicies(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  references: readonly ReferencedPrincipalHead[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const warmReferencedPrincipalPolicies =\n    generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    );\n  const uniqueReferences = new Map<string, ReferencedPrincipalHead>();\n  for (const reference of input.references) {\n    uniqueReferences.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n\n  const references = [...uniqueReferences.values()];\n  // Warm every missing reference in one batched fetch before verifying, so a\n  // path that references several uncached policies makes a single round of\n  // requests rather than one per reference.\n  if (\n    warmReferencedPrincipalPolicies &&\n    !warmReferencedPrincipalPolicies.resolveReference\n  ) {\n    const uncached = await filterUncachedPrincipalPolicyReferences({\n      execSql: input.checkpointContext.execSql,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n    });\n    if (uncached.length > 0) {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      await warmReferencedPrincipalPolicies({\n        organizationId: input.organizationId,\n        references: uncached,\n      });\n      assertProjectionVerificationCurrent(input.stillCurrent);\n    }\n  }\n\n  const recoveryBatch = {};\n  return Promise.all(\n    references.map((reference) =>\n      verifyReferencedPrincipalPolicy({\n        recoveryBatch,\n        checkpointContext: input.checkpointContext,\n        organizationId: input.organizationId,\n        principalPolicyCache: input.principalPolicyCache,\n        reference,\n        stillCurrent: input.stillCurrent,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      }),\n    ),\n  );\n}\n"]}

package/data/keyingProjectionVerification/projectionAuthorizationEvidence.js

@@ -0,0 +1,36 @@
+import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
+import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
+import { verifyProjectionPolicyEvidence } from "./projectionPolicyEvidence.js";
+import { readAccessManifest } from "./readers.js";
+/** Locally planned successors may cite an already verified, uncommitted policy. */
+async function resolveProjectionAuthorizationEvidence(input) {
+    const references = input.bundles
+        .flatMap((bundle) => readAccessManifest(bundle.manifest, "Projection manifest")
+        .referencedPrincipalHeads)
+        .filter((reference) => !input.evidence.some((policy) => principalPolicyMatchesReference({ policy, reference })));
+    const known = [...input.principalPolicyCache.values()];
+    if (references.some((reference) => !known.some((policy) => principalPolicyMatchesReference({ policy, reference }))))
+        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
+    return [
+        ...input.evidence,
+        ...(await collectReferencedPrincipalPolicies({
+            checkpointContext: input.checkpointContext,
+            organizationId: input.organizationId,
+            principalPolicyCache: input.principalPolicyCache,
+            references,
+            resolveUserKey: input.resolveUserKey,
+        })),
+    ];
+}
+export async function verifyProjectionAuthorizationEvidence(input) {
+    return resolveProjectionAuthorizationEvidence({
+        ...input,
+        evidence: await verifyProjectionPolicyEvidence({
+            evidence: input.policyEvidence,
+            execSql: input.checkpointContext.execSql,
+            organizationId: input.organizationId,
+            resolveUserKey: input.resolveUserKey,
+        }),
+    });
+}
+//# sourceMappingURL=projectionAuthorizationEvidence.js.map

package/data/keyingProjectionVerification/projectionAuthorizationEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionAuthorizationEvidence.js","sourceRoot":"","sources":["projectionAuthorizationEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG/C,mFAAmF;AACnF,KAAK,UAAU,sCAAsC,CAAC,KAOrD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAGiE;IAEjE,OAAO,sCAAsC,CAAC;QAC5C,GAAG,KAAK;QACR,QAAQ,EAAE,MAAM,8BAA8B,CAAC;YAC7C,QAAQ,EAAE,KAAK,CAAC,cAAc;YAC9B,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;KACH,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { verifyProjectionPolicyEvidence } from \"./projectionPolicyEvidence\";\nimport { readAccessManifest } from \"./readers\";\nimport type { PrincipalPolicyCache, ProjectionUserKeyResolver } from \"./types\";\n\n/** Locally planned successors may cite an already verified, uncommitted policy. */\nasync function resolveProjectionAuthorizationEvidence(input: {\n  readonly bundles: readonly AccessManifestBundleWireResponse[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly evidence: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<PrincipalPolicyCheckpointEvidence[]> {\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter(\n      (reference) =>\n        !input.evidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  const known = [...input.principalPolicyCache.values()];\n  if (\n    references.some(\n      (reference) =>\n        !known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  return [\n    ...input.evidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n    })),\n  ];\n}\n\nexport async function verifyProjectionAuthorizationEvidence(\n  input: Omit<\n    Parameters<typeof resolveProjectionAuthorizationEvidence>[0],\n    \"evidence\"\n  > & { readonly policyEvidence: ProjectionPolicyEvidenceResponse },\n) {\n  return resolveProjectionAuthorizationEvidence({\n    ...input,\n    evidence: await verifyProjectionPolicyEvidence({\n      evidence: input.policyEvidence,\n      execSql: input.checkpointContext.execSql,\n      organizationId: input.organizationId,\n      resolveUserKey: input.resolveUserKey,\n    }),\n  });\n}\n"]}

package/data/keyingProjectionVerification/projectionPolicyEvidence.js

@@ -0,0 +1,70 @@
+import { computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../principals/organizationAuthorityDescriptor.js";
+import { enforcePrincipalPolicySnapshotCheckpoints, verifyPrincipalPolicySnapshots, } from "./principalPolicySnapshotVerification.js";
+function reject(message) {
+    throw new KeyingVerificationError("object_mismatch", `Projection policy evidence: ${message}`);
+}
+async function verifyDirectories(input) {
+    const states = new Map(input.organization.history.map(({ state }) => [state.stateHash, state]));
+    const descriptors = [];
+    for (const payload of input.evidence.organizationPayloads) {
+        const state = states.get(payload.stateHash);
+        if (!state ||
+            payload.principalType !== "organization" ||
+            payload.principalId !== input.organizationId)
+            reject("directory payload scope is invalid");
+        const hash = await computePrincipalStatePayloadCiphertextHash(payload.ciphertext);
+        if (hash !== state.payloadCiphertextHash || hash !== payload.ciphertextHash)
+            reject("directory payload does not match its signed hash");
+        const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);
+        if (descriptor.organizationId !== input.organizationId)
+            reject("directory belongs to another organization");
+        descriptors.push(descriptor);
+        states.delete(payload.stateHash);
+    }
+    // Only directory payloads needed to bind the supplied group heads are
+    // required. The organization's complete signed state chain is verified above;
+    // unrelated payload bodies add no authority and need not be disclosed.
+    return descriptors;
+}
+/** Evidence authenticates signed citations only; it never becomes current policy. */
+export async function verifyProjectionPolicyEvidence(input) {
+    const { evidence, organizationId } = input;
+    if (evidence.organization === null) {
+        if (evidence.groups.length > 0 || evidence.organizationPayloads.length > 0)
+            reject("group evidence requires its signed organization history");
+        return [];
+    }
+    if (evidence.organization.currentState.principalType !== "organization" ||
+        evidence.organization.currentState.principalId !== organizationId ||
+        evidence.groups.some((group) => group.currentState.principalType !== "group"))
+        reject("principal scope is invalid");
+    const policies = await verifyPrincipalPolicySnapshots({
+        resolveUserKey: input.resolveUserKey,
+        snapshots: [evidence.organization, ...evidence.groups],
+    });
+    const organization = policies.find((policy) => policy.principalType === "organization");
+    if (!organization)
+        reject("organization snapshot is missing");
+    const directories = await verifyDirectories({ ...input, organization });
+    for (const group of policies.filter((policy) => policy.principalType === "group")) {
+        const directory = directories.find((candidate) => candidate.groupHeads.some((reference) => principalHeadMatchesReference(group.state, reference)));
+        if (!directory)
+            reject("group state is absent from signed directory history");
+        // The snapshot's authenticated predecessor chain supplies older states;
+        // only its bound head needs to appear in a directory payload.
+        for (const { state } of group.history) {
+            if (state.externalAuthority &&
+                state.externalAuthority.principalId !== directory.adminGroupId)
+                reject("group authority is not the organization's Admins group");
+        }
+    }
+    // Check connection to known chains without pinning historical group heads or
+    // caching keyless evidence as a live policy bundle.
+    await enforcePrincipalPolicySnapshotCheckpoints({
+        execSql: input.execSql,
+        policies,
+    });
+    return policies;
+}
+//# sourceMappingURL=projectionPolicyEvidence.js.map

package/data/keyingProjectionVerification/projectionPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionPolicyEvidence.js","sourceRoot":"","sources":["projectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,EAC1C,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EACL,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,uCAAuC,CAAC;AAG/C,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+BAA+B,OAAO,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAIhC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CACxE,CAAC;IACF,MAAM,WAAW,GAAsC,EAAE,CAAC;IAC1D,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,IACE,CAAC,KAAK;YACN,OAAO,CAAC,aAAa,KAAK,cAAc;YACxC,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;YAE5C,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,IAAI,KAAK,KAAK,CAAC,qBAAqB,IAAI,IAAI,KAAK,OAAO,CAAC,cAAc;YACzE,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,oCAAoC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YACpD,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACtD,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,uEAAuE;IACvE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IACC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC3C,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACxE,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IACE,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QACnE,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,KAAK,cAAc;QACjE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO,CACxD;QAED,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,KAAK,cAAc,CACpD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO,CAC7C,EAAE,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAkC,EAAE,EAAE,CAC/D,6BAA6B,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CACtD,CACF,CAAC;QACF,IAAI,CAAC,SAAS;YACZ,MAAM,CAAC,qDAAqD,CAAC,CAAC;QAChE,wEAAwE;QACxE,8DAA8D;QAC9D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,IACE,KAAK,CAAC,iBAAiB;gBACvB,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,SAAS,CAAC,YAAY;gBAE9D,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,yCAAyC,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ;KACT,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicySnapshot,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  enforcePrincipalPolicySnapshotCheckpoints,\n  verifyPrincipalPolicySnapshots,\n} from \"./principalPolicySnapshotVerification\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nfunction reject(message: string): never {\n  throw new KeyingVerificationError(\n    \"object_mismatch\",\n    `Projection policy evidence: ${message}`,\n  );\n}\n\nasync function verifyDirectories(input: {\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly organization: VerifiedPrincipalPolicySnapshot;\n  readonly organizationId: string;\n}): Promise<OrganizationAuthorityDescriptor[]> {\n  const states = new Map(\n    input.organization.history.map(({ state }) => [state.stateHash, state]),\n  );\n  const descriptors: OrganizationAuthorityDescriptor[] = [];\n  for (const payload of input.evidence.organizationPayloads) {\n    const state = states.get(payload.stateHash);\n    if (\n      !state ||\n      payload.principalType !== \"organization\" ||\n      payload.principalId !== input.organizationId\n    )\n      reject(\"directory payload scope is invalid\");\n    const hash = await computePrincipalStatePayloadCiphertextHash(\n      payload.ciphertext,\n    );\n    if (hash !== state.payloadCiphertextHash || hash !== payload.ciphertextHash)\n      reject(\"directory payload does not match its signed hash\");\n    const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);\n    if (descriptor.organizationId !== input.organizationId)\n      reject(\"directory belongs to another organization\");\n    descriptors.push(descriptor);\n    states.delete(payload.stateHash);\n  }\n  // Only directory payloads needed to bind the supplied group heads are\n  // required. The organization's complete signed state chain is verified above;\n  // unrelated payload bodies add no authority and need not be disclosed.\n  return descriptors;\n}\n\n/** Evidence authenticates signed citations only; it never becomes current policy. */\nexport async function verifyProjectionPolicyEvidence(input: {\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<VerifiedPrincipalPolicySnapshot[]> {\n  const { evidence, organizationId } = input;\n  if (evidence.organization === null) {\n    if (evidence.groups.length > 0 || evidence.organizationPayloads.length > 0)\n      reject(\"group evidence requires its signed organization history\");\n    return [];\n  }\n  if (\n    evidence.organization.currentState.principalType !== \"organization\" ||\n    evidence.organization.currentState.principalId !== organizationId ||\n    evidence.groups.some(\n      (group) => group.currentState.principalType !== \"group\",\n    )\n  )\n    reject(\"principal scope is invalid\");\n  const policies = await verifyPrincipalPolicySnapshots({\n    resolveUserKey: input.resolveUserKey,\n    snapshots: [evidence.organization, ...evidence.groups],\n  });\n  const organization = policies.find(\n    (policy) => policy.principalType === \"organization\",\n  );\n  if (!organization) reject(\"organization snapshot is missing\");\n  const directories = await verifyDirectories({ ...input, organization });\n  for (const group of policies.filter(\n    (policy) => policy.principalType === \"group\",\n  )) {\n    const directory = directories.find((candidate) =>\n      candidate.groupHeads.some((reference: ReferencedPrincipalHead) =>\n        principalHeadMatchesReference(group.state, reference),\n      ),\n    );\n    if (!directory)\n      reject(\"group state is absent from signed directory history\");\n    // The snapshot's authenticated predecessor chain supplies older states;\n    // only its bound head needs to appear in a directory payload.\n    for (const { state } of group.history) {\n      if (\n        state.externalAuthority &&\n        state.externalAuthority.principalId !== directory.adminGroupId\n      )\n        reject(\"group authority is not the organization's Admins group\");\n    }\n  }\n  // Check connection to known chains without pinning historical group heads or\n  // caching keyless evidence as a live policy bundle.\n  await enforcePrincipalPolicySnapshotCheckpoints({\n    execSql: input.execSql,\n    policies,\n  });\n  return policies;\n}\n"]}

package/data/keyingProjectionVerification/readers.d.ts

@@ -0,0 +1,8 @@
+export { readRecordNullableString, readRecordString, readRequiredRecordValue, } from "../recordReaders.js";
+import type { AccessEvent, AccessManifest, ContainerKekRecipientTarget, ContainerKeyEpoch, ContainerKeyWrap, DocumentLinkAccessEventBody, DocumentUnlinkAccessEventBody } from "../../internal/crypto/index.js";
+export declare function readAccessEvent(value: unknown, label: string): AccessEvent;
+export declare function readAccessManifest(value: unknown, label: string): AccessManifest;
+export declare function readContainerKeyEpoch(value: unknown, label: string): ContainerKeyEpoch;
+export declare function readContainerKeyWrap(value: unknown, label: string): ContainerKeyWrap;
+export declare function readContainerKekRecipientTarget(value: unknown, label: string): ContainerKekRecipientTarget;
+export declare function readDocumentAccessEventBody(value: unknown, label: string): DocumentLinkAccessEventBody | DocumentUnlinkAccessEventBody;

package/data/keyingProjectionVerification/readers.js

@@ -0,0 +1,153 @@
+import { normalizeDocumentAccessEventBody } from "../../internal/crypto/index.js";
+export { readRecordNullableString, readRecordString, readRequiredRecordValue, } from "../recordReaders.js";
+import { readCanonicalJson, readCanonicalRecord } from "../keyingCanonicalJson.js";
+import { readRecordNullableString, readRecordPositiveInteger, readRecordString, readRequiredRecordValue, readStringArray, } from "../recordReaders.js";
+import { readKeyingVerificationShape } from "./error.js";
+function isAccessEventType(value) {
+    return (value === "attachment.bind" ||
+        value === "attachment.detach" ||
+        value === "container.create" ||
+        value === "container.grant" ||
+        value === "container.move" ||
+        value === "container.rekey" ||
+        value === "container.recite" ||
+        value === "container.revoke" ||
+        value === "document.link" ||
+        value === "document.purge" ||
+        value === "document.unlink");
+}
+function isAccessObjectKind(value) {
+    return value === "blob" || value === "container" || value === "document";
+}
+function isRecipientKind(value) {
+    return value === "container" || value === "group" || value === "user";
+}
+export function readAccessEvent(value, label) {
+    return readKeyingVerificationShape(() => readAccessEventShape(value, label));
+}
+function readAccessEventShape(value, label) {
+    const record = readCanonicalRecord(value, label);
+    const eventType = readRequiredRecordValue(record, "eventType", label);
+    const objectKind = readRequiredRecordValue(record, "objectKind", label);
+    if (!isAccessEventType(eventType)) {
+        throw new Error(`${label}.eventType is invalid`);
+    }
+    if (!isAccessObjectKind(objectKind)) {
+        throw new Error(`${label}.objectKind is invalid`);
+    }
+    if (readRecordPositiveInteger(record, "version", label) !== 1) {
+        throw new Error(`${label}.version must be 1`);
+    }
+    return {
+        version: 1,
+        eventId: readRecordString(record, "eventId", label),
+        eventType,
+        objectKind,
+        objectId: readRecordString(record, "objectId", label),
+        organizationId: readRecordString(record, "organizationId", label),
+        previousManifestHash: readRecordNullableString(record, "previousManifestHash", label),
+        dependencyManifestHashes: readStringArray(readRequiredRecordValue(record, "dependencyManifestHashes", label), `${label}.dependencyManifestHashes`),
+        bodyHash: readRecordString(record, "bodyHash", label),
+        signerUserId: readRecordString(record, "signerUserId", label),
+        signerDeviceId: readRecordString(record, "signerDeviceId", label),
+        signerKeyFingerprint: readRecordString(record, "signerKeyFingerprint", label),
+        signedAt: readRecordString(record, "signedAt", label),
+        signature: readRecordString(record, "signature", label),
+    };
+}
+export function readAccessManifest(value, label) {
+    return readKeyingVerificationShape(() => readAccessManifestShape(value, label));
+}
+function readAccessManifestShape(value, label) {
+    const record = readCanonicalRecord(value, label);
+    const objectKind = readRequiredRecordValue(record, "objectKind", label);
+    if (!isAccessObjectKind(objectKind)) {
+        throw new Error(`${label}.objectKind is invalid`);
+    }
+    if (readRecordPositiveInteger(record, "version", label) !== 1) {
+        throw new Error(`${label}.version must be 1`);
+    }
+    const referencedPrincipalHeads = readRequiredRecordValue(record, "referencedPrincipalHeads", label);
+    if (!Array.isArray(referencedPrincipalHeads)) {
+        throw new Error(`${label}.referencedPrincipalHeads must be an array`);
+    }
+    return {
+        version: 1,
+        objectKind,
+        objectId: readRecordString(record, "objectId", label),
+        organizationId: readRecordString(record, "organizationId", label),
+        epoch: readRecordPositiveInteger(record, "epoch", label),
+        previousManifestHash: readRecordNullableString(record, "previousManifestHash", label),
+        eventHash: readRecordString(record, "eventHash", label),
+        structuralHash: readRecordString(record, "structuralHash", label),
+        grantRoot: readRecordString(record, "grantRoot", label),
+        referencedPrincipalHeads: referencedPrincipalHeads.map((head, index) => {
+            const headRecord = readCanonicalRecord(head, `${label}.referencedPrincipalHeads[${index}]`);
+            const principalType = readRequiredRecordValue(headRecord, "principalType", `${label}.referencedPrincipalHeads[${index}]`);
+            if (principalType !== "group" && principalType !== "organization") {
+                throw new Error(`${label}.referencedPrincipalHeads[${index}].principalType is invalid`);
+            }
+            return {
+                principalType,
+                principalId: readRecordString(headRecord, "principalId", `${label}.referencedPrincipalHeads[${index}]`),
+                version: readRecordPositiveInteger(headRecord, "version", `${label}.referencedPrincipalHeads[${index}]`),
+                keyEpoch: readRecordPositiveInteger(headRecord, "keyEpoch", `${label}.referencedPrincipalHeads[${index}]`),
+                stateHash: readRecordString(headRecord, "stateHash", `${label}.referencedPrincipalHeads[${index}]`),
+                keyFingerprint: readRecordString(headRecord, "keyFingerprint", `${label}.referencedPrincipalHeads[${index}]`),
+            };
+        }),
+        keyTargetHash: readRecordString(record, "keyTargetHash", label),
+    };
+}
+export function readContainerKeyEpoch(value, label) {
+    return readKeyingVerificationShape(() => {
+        const record = readCanonicalRecord(value, label);
+        return {
+            id: readRecordString(record, "id", label),
+            containerId: readRecordString(record, "containerId", label),
+            keyEpoch: readRecordPositiveInteger(record, "keyEpoch", label),
+            accessManifestHash: readRecordString(record, "accessManifestHash", label),
+            parentContainerKeyEpochId: readRecordNullableString(record, "parentContainerKeyEpochId", label),
+            createdByEventHash: readRecordString(record, "createdByEventHash", label),
+            createdByManifestHash: readRecordString(record, "createdByManifestHash", label),
+        };
+    });
+}
+export function readContainerKeyWrap(value, label) {
+    return readKeyingVerificationShape(() => {
+        const record = readCanonicalRecord(value, label);
+        const recipientKind = readRequiredRecordValue(record, "recipientKind", label);
+        if (!isRecipientKind(recipientKind)) {
+            throw new Error(`${label}.recipientKind is invalid`);
+        }
+        return {
+            containerKeyEpochId: readRecordString(record, "containerKeyEpochId", label),
+            recipientKind,
+            recipientId: readRecordString(record, "recipientId", label),
+            recipientKeyEpochId: readRecordString(record, "recipientKeyEpochId", label),
+            recipientKeyFingerprint: readRecordString(record, "recipientKeyFingerprint", label),
+            kemCipherText: readRecordString(record, "kemCipherText", label),
+            wrappedKey: readRecordString(record, "wrappedKey", label),
+            wrapManifestHash: readRecordString(record, "wrapManifestHash", label),
+        };
+    });
+}
+export function readContainerKekRecipientTarget(value, label) {
+    return readKeyingVerificationShape(() => {
+        const record = readCanonicalRecord(value, label);
+        const recipientKind = readRequiredRecordValue(record, "recipientKind", label);
+        if (!isRecipientKind(recipientKind)) {
+            throw new Error(`${label}.recipientKind is invalid`);
+        }
+        return {
+            recipientKind,
+            recipientId: readRecordString(record, "recipientId", label),
+            recipientKeyEpochId: readRecordString(record, "recipientKeyEpochId", label),
+            recipientKeyFingerprint: readRecordString(record, "recipientKeyFingerprint", label),
+        };
+    });
+}
+export function readDocumentAccessEventBody(value, label) {
+    return readKeyingVerificationShape(() => normalizeDocumentAccessEventBody(readCanonicalJson(value, label)));
+}
+//# sourceMappingURL=readers.js.map