@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/persistence/organizations/organizationReadModelProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelProjection.js","sourceRoot":"","sources":["organizationReadModelProjection.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AACvG,OAAO,EACL,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,iCAAiC,CAAC;AA8EzC,SAAS,0BAA0B,CACjC,KAAa;IAEb,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,GAA0B,EAC1B,aAAqB;IAErB,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,mCAAmC,CAC3C,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;QAClD,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,aAAa;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAkB,EAClB,UAAuD;IAEvD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,WAAW;KAChB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,mCAAmC,CAC3C,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,GAAG,CAAC,WAAW,KAAK,IAAI;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,IAAI,CAAC;QACrB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,GAAG,CAAC,QAAQ,IAAI,CAAC;QACjB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,WAAW,GAAG,CAAC;QACnB,CAAC,UAAU;QACX,UAAU,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;QACtC,UAAU,CAAC,OAAO,KAAK,GAAG,CAAC,YAAY;QACvC,UAAU,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QACpC,UAAU,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAC1C,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,GAAuB;IAEvB,IACE,CAAC,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,KAAK,cAAc,CAAC;QACvE,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,IAAI,CAAC;QACrB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,GAAG,CAAC,QAAQ,IAAI,CAAC;QACjB,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,WAAW,GAAG,CAAC,EACnB,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,UAAU,EAAE,mCAAmC,CAAC,UAAU;QAC1D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,sBAAsB,EACpB,mCAAmC,CAAC,sBAAsB;QAC5D,QAAQ,EAAE,mCAAmC,CAAC,QAAQ;QACtD,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,iBAAiB,EAAE,mCAAmC,CAAC,iBAAiB;QACxE,qBAAqB,EACnB,mCAAmC,CAAC,qBAAqB;QAC3D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,MAAM,EAAE,mCAAmC,CAAC,MAAM;QAClD,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,MAAM,EAAE,mCAAmC,CAAC,MAAM;KACnD,CAAC;SACD,IAAI,CAAC,mCAAmC,CAAC;SACzC,KAAK,CACJ,EAAE,CAAC,mCAAmC,CAAC,cAAc,EAAE,cAAc,CAAC,CACvE;SACA,OAAO,CACN,GAAG,CAAC,mCAAmC,CAAC,SAAS,CAAC,EAClD,GAAG,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAChD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;QAC9C,WAAW,EAAE,2BAA2B,CAAC,WAAW;QACpD,IAAI,EAAE,2BAA2B,CAAC,IAAI;QACtC,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,YAAY,EAAE,2BAA2B,CAAC,YAAY;KACvD,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACrE,OAAO,CACN,GAAG,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAC1C,GAAG,CAAC,2BAA2B,CAAC,OAAO,CAAC,CACzC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,QAAQ,EAAE,gCAAgC,CAAC,QAAQ;QACnD,cAAc,EAAE,gCAAgC,CAAC,cAAc;QAC/D,WAAW,EAAE,gCAAgC,CAAC,WAAW;QACzD,cAAc,EAAE,gCAAgC,CAAC,cAAc;QAC/D,WAAW,EAAE,gCAAgC,CAAC,WAAW;QACzD,aAAa,EAAE,gCAAgC,CAAC,aAAa;QAC7D,SAAS,EAAE,gCAAgC,CAAC,SAAS;QACrD,YAAY,EAAE,gCAAgC,CAAC,YAAY;KAC5D,CAAC;SACD,IAAI,CAAC,gCAAgC,CAAC;SACtC,KAAK,CAAC,EAAE,CAAC,gCAAgC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SAC1E,OAAO,CACN,GAAG,CAAC,gCAAgC,CAAC,aAAa,CAAC,EACnD,GAAG,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAClD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,OAAO,EAAE,iCAAiC,CAAC,OAAO;QAClD,MAAM,EAAE,iCAAiC,CAAC,MAAM;KACjD,CAAC;SACD,IAAI,CAAC,iCAAiC,CAAC;SACvC,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SAC3E,OAAO,CACN,GAAG,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAC9C,GAAG,CAAC,iCAAiC,CAAC,SAAS,CAAC,EAChD,GAAG,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAC9C,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,KAI5B;IAOC,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,uBAAuB,GAAG,WAAW,CAAC,MAAM,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc,CAChD,CAAC;IACF,IACE,uBAAuB,CAAC,MAAM,KAAK,CAAC;QACpC,uBAAuB,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,KAAK,CAAC,cAAc,EAChE,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,WAAW;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAC3C,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IACE,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CACnD,EACD,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAItE;IACC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC3B,MAAM,CAAC;QACN,MAAM,EAAE,0BAA0B,CAAC,MAAM;QACzC,aAAa,EAAE,0BAA0B,CAAC,aAAa;QACvD,iBAAiB,EAAE,0BAA0B,CAAC,iBAAiB;QAC/D,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC/B,MAAM,CAAC,EAAE,UAAU,EAAE,+BAA+B,CAAC,UAAU,EAAE,CAAC;SAClE,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAChE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAC/C,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAC7C,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC;QAC5D,SAAS;QACT,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;KACf,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/B,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAC1C;SACF;QACD,MAAM;QACN,MAAM,EAAE;YACN,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,YAAY,EAAE,mBAAmB,CAC/B,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAClC;aACF,CAAC,CAAC;SACJ;QACD,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW;QACX,eAAe,EAAE,wCAAwC;QACzD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ListOrganizationGroupsResponse,\n  OrganizationContainerGrantsResponse,\n  OrganizationDirectoryResponse,\n  OrganizationDirectoryUserResponse,\n  OrganizationGroupCurrentStateResponse,\n  OrganizationRosterStatus,\n} from \"@tearleads/validators/response\";\nimport { and, asc, eq } from \"drizzle-orm\";\nimport {\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelPolicyHeads,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/organizationReadModelSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { loadOrganizationReadModelGrantsInTransaction } from \"./organizationReadModelGrantPersistence\";\nimport {\n  ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n  OrganizationReadModelIntegrityError,\n} from \"./organizationReadModelProtocol\";\n\nexport type OrganizationDirectoryProjection = Omit<\n  OrganizationDirectoryResponse,\n  \"currentUser\"\n>;\n\nexport interface OrganizationReadModelProjection {\n  readonly cursor: string;\n  readonly directory: OrganizationDirectoryProjection;\n  readonly grants: OrganizationContainerGrantsResponse;\n  readonly groups: Omit<ListOrganizationGroupsResponse, \"groups\"> & {\n    groups: Array<\n      ListOrganizationGroupsResponse[\"groups\"][number] & { name: string }\n    >;\n  };\n  readonly membershipEdges: OrganizationReadModelMembershipEdge[];\n  readonly organizationId: string;\n  readonly policyHeads: readonly OrganizationReadModelPolicyHead[];\n  readonly protocolVersion: typeof ORGANIZATION_READ_MODEL_PROTOCOL_VERSION;\n  readonly requester: OrganizationDirectoryResponse[\"currentUser\"] | null;\n  readonly updatedAt: string;\n}\n\nexport interface OrganizationReadModelPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly organizationId: string;\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n  readonly stateHash: string;\n  readonly version: number;\n}\n\nexport interface OrganizationReadModelMembershipEdge {\n  readonly groupId: string;\n  readonly userId: string;\n}\n\ninterface SelectedDirectoryUser {\n  readonly createdAt: string;\n  readonly disabledAt: string | null;\n  readonly disabledByUserId: string | null;\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: string;\n  readonly isPersonalOrganizationOwner: boolean;\n  readonly joinedAt: string;\n  readonly profileDocumentId: string | null;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: string;\n  readonly status: string;\n  readonly updatedAt: string;\n  readonly userId: string;\n}\n\ninterface SelectedGroup {\n  readonly createdAt: string;\n  readonly groupId: string;\n  readonly isBuiltin: boolean;\n  readonly keyEpoch: number | null;\n  readonly memberCount: number | null;\n  readonly name: string;\n  readonly stateHash: string | null;\n  readonly stateVersion: number | null;\n}\n\ninterface SelectedPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly organizationId: string;\n  readonly principalId: string;\n  readonly principalType: string;\n  readonly stateHash: string;\n  readonly stateVersion: number;\n}\n\nfunction isOrganizationRosterStatus(\n  value: string,\n): value is OrganizationRosterStatus {\n  return value === \"active\" || value === \"disabled\";\n}\n\nfunction toDirectoryUser(\n  row: SelectedDirectoryUser,\n  currentUserId: string,\n): OrganizationDirectoryUserResponse {\n  if (!isOrganizationRosterStatus(row.status)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization directory status is invalid\",\n    );\n  }\n\n  return {\n    userId: row.userId,\n    signingKeyFingerprint: row.signingKeyFingerprint,\n    signingPublicKey: row.signingPublicKey,\n    encapsulationPublicKey: row.encapsulationPublicKey,\n    encapsulationKeyFingerprint: row.encapsulationKeyFingerprint,\n    createdAt: row.createdAt,\n    isPersonalOrganizationOwner: row.isPersonalOrganizationOwner,\n    isSelf: row.userId === currentUserId,\n    status: row.status,\n    profileDocumentId: row.profileDocumentId,\n    joinedAt: row.joinedAt,\n    updatedAt: row.updatedAt,\n    disabledAt: row.disabledAt,\n    disabledByUserId: row.disabledByUserId,\n  };\n}\n\nfunction toGroupCurrentState(\n  row: SelectedGroup,\n  policyHead: OrganizationReadModelPolicyHead | undefined,\n): OrganizationGroupCurrentStateResponse | null {\n  const values = [\n    row.stateHash,\n    row.stateVersion,\n    row.keyEpoch,\n    row.memberCount,\n  ];\n  if (values.every((value) => value === null)) {\n    if (policyHead) {\n      throw new OrganizationReadModelIntegrityError(\n        \"Stored organization group policy head is orphaned\",\n      );\n    }\n    return null;\n  }\n  if (\n    row.stateHash === null ||\n    row.stateVersion === null ||\n    row.keyEpoch === null ||\n    row.memberCount === null ||\n    row.stateHash.length === 0 ||\n    !Number.isInteger(row.stateVersion) ||\n    row.stateVersion <= 0 ||\n    !Number.isInteger(row.keyEpoch) ||\n    row.keyEpoch <= 0 ||\n    !Number.isInteger(row.memberCount) ||\n    row.memberCount < 0 ||\n    !policyHead ||\n    policyHead.stateHash !== row.stateHash ||\n    policyHead.version !== row.stateVersion ||\n    policyHead.keyEpoch !== row.keyEpoch ||\n    policyHead.memberCount !== row.memberCount\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization group state is invalid\",\n    );\n  }\n\n  return {\n    stateHash: row.stateHash,\n    version: row.stateVersion,\n    keyEpoch: row.keyEpoch,\n    keyFingerprint: policyHead.keyFingerprint,\n    memberCount: row.memberCount,\n  };\n}\n\nfunction toPolicyHead(\n  row: SelectedPolicyHead,\n): OrganizationReadModelPolicyHead {\n  if (\n    (row.principalType !== \"group\" && row.principalType !== \"organization\") ||\n    row.principalId.length === 0 ||\n    row.stateHash.length === 0 ||\n    !Number.isInteger(row.stateVersion) ||\n    row.stateVersion <= 0 ||\n    !Number.isInteger(row.keyEpoch) ||\n    row.keyEpoch <= 0 ||\n    row.keyFingerprint.length === 0 ||\n    !Number.isInteger(row.memberCount) ||\n    row.memberCount < 0\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization policy head is invalid\",\n    );\n  }\n\n  return {\n    organizationId: row.organizationId,\n    principalType: row.principalType,\n    principalId: row.principalId,\n    stateHash: row.stateHash,\n    version: row.stateVersion,\n    keyEpoch: row.keyEpoch,\n    keyFingerprint: row.keyFingerprint,\n    memberCount: row.memberCount,\n  };\n}\n\nasync function loadDirectoryRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedDirectoryUser[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelDirectoryUsers.createdAt,\n      disabledAt: organizationReadModelDirectoryUsers.disabledAt,\n      disabledByUserId: organizationReadModelDirectoryUsers.disabledByUserId,\n      encapsulationKeyFingerprint:\n        organizationReadModelDirectoryUsers.encapsulationKeyFingerprint,\n      encapsulationPublicKey:\n        organizationReadModelDirectoryUsers.encapsulationPublicKey,\n      joinedAt: organizationReadModelDirectoryUsers.joinedAt,\n      isPersonalOrganizationOwner:\n        organizationReadModelDirectoryUsers.isPersonalOrganizationOwner,\n      profileDocumentId: organizationReadModelDirectoryUsers.profileDocumentId,\n      signingKeyFingerprint:\n        organizationReadModelDirectoryUsers.signingKeyFingerprint,\n      signingPublicKey: organizationReadModelDirectoryUsers.signingPublicKey,\n      status: organizationReadModelDirectoryUsers.status,\n      updatedAt: organizationReadModelDirectoryUsers.updatedAt,\n      userId: organizationReadModelDirectoryUsers.userId,\n    })\n    .from(organizationReadModelDirectoryUsers)\n    .where(\n      eq(organizationReadModelDirectoryUsers.organizationId, organizationId),\n    )\n    .orderBy(\n      asc(organizationReadModelDirectoryUsers.sortOrder),\n      asc(organizationReadModelDirectoryUsers.userId),\n    );\n}\n\nasync function loadGroupRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedGroup[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelGroups.createdAt,\n      groupId: organizationReadModelGroups.groupId,\n      isBuiltin: organizationReadModelGroups.isBuiltin,\n      keyEpoch: organizationReadModelGroups.keyEpoch,\n      memberCount: organizationReadModelGroups.memberCount,\n      name: organizationReadModelGroups.name,\n      stateHash: organizationReadModelGroups.stateHash,\n      stateVersion: organizationReadModelGroups.stateVersion,\n    })\n    .from(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroups.sortOrder),\n      asc(organizationReadModelGroups.groupId),\n    );\n}\n\nasync function loadPolicyHeadRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedPolicyHead[]> {\n  return tx\n    .select({\n      keyEpoch: organizationReadModelPolicyHeads.keyEpoch,\n      keyFingerprint: organizationReadModelPolicyHeads.keyFingerprint,\n      memberCount: organizationReadModelPolicyHeads.memberCount,\n      organizationId: organizationReadModelPolicyHeads.organizationId,\n      principalId: organizationReadModelPolicyHeads.principalId,\n      principalType: organizationReadModelPolicyHeads.principalType,\n      stateHash: organizationReadModelPolicyHeads.stateHash,\n      stateVersion: organizationReadModelPolicyHeads.stateVersion,\n    })\n    .from(organizationReadModelPolicyHeads)\n    .where(eq(organizationReadModelPolicyHeads.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelPolicyHeads.principalType),\n      asc(organizationReadModelPolicyHeads.principalId),\n    );\n}\n\nasync function loadMembershipEdges(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<OrganizationReadModelMembershipEdge[]> {\n  return tx\n    .select({\n      groupId: organizationReadModelGroupMembers.groupId,\n      userId: organizationReadModelGroupMembers.userId,\n    })\n    .from(organizationReadModelGroupMembers)\n    .where(eq(organizationReadModelGroupMembers.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroupMembers.groupId),\n      asc(organizationReadModelGroupMembers.sortOrder),\n      asc(organizationReadModelGroupMembers.userId),\n    );\n}\n\nfunction validatePolicyHeads(input: {\n  readonly groupRows: readonly SelectedGroup[];\n  readonly organizationId: string;\n  readonly policyHeadRows: readonly SelectedPolicyHead[];\n}): {\n  readonly groupPolicyHeads: ReadonlyMap<\n    string,\n    OrganizationReadModelPolicyHead\n  >;\n  readonly policyHeads: readonly OrganizationReadModelPolicyHead[];\n} {\n  const policyHeads = input.policyHeadRows.map(toPolicyHead);\n  const organizationPolicyHeads = policyHeads.filter(\n    (head) => head.principalType === \"organization\",\n  );\n  if (\n    organizationPolicyHeads.length !== 1 ||\n    organizationPolicyHeads[0]?.principalId !== input.organizationId\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization policy head is missing or ambiguous\",\n    );\n  }\n  const groupPolicyHeads = new Map(\n    policyHeads\n      .filter((head) => head.principalType === \"group\")\n      .map((head) => [head.principalId, head]),\n  );\n  const visibleGroupIds = new Set(input.groupRows.map((row) => row.groupId));\n  if (\n    [...groupPolicyHeads.keys()].some(\n      (principalId) => !visibleGroupIds.has(principalId),\n    )\n  ) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization group policy head is not visible\",\n    );\n  }\n  return { groupPolicyHeads, policyHeads };\n}\n\nexport async function loadOrganizationReadModelProjectionInTransaction(input: {\n  readonly currentUserId: string;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<OrganizationReadModelProjection | null> {\n  const [state] = await input.tx\n    .select({\n      cursor: organizationReadModelState.cursor,\n      memberGroupId: organizationReadModelState.memberGroupId,\n      profileDocumentId: organizationReadModelState.profileDocumentId,\n      updatedAt: organizationReadModelState.updatedAt,\n    })\n    .from(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, input.organizationId))\n    .limit(1);\n  if (!state) {\n    return null;\n  }\n  const [requester] = await input.tx\n    .select({ isOrgAdmin: organizationReadModelRequesters.isOrgAdmin })\n    .from(organizationReadModelRequesters)\n    .where(\n      and(\n        eq(\n          organizationReadModelRequesters.organizationId,\n          input.organizationId,\n        ),\n        eq(organizationReadModelRequesters.userId, input.currentUserId),\n      ),\n    )\n    .limit(1);\n  const directoryRows = await loadDirectoryRows(input.tx, input.organizationId);\n  const groupRows = await loadGroupRows(input.tx, input.organizationId);\n  const grants = await loadOrganizationReadModelGrantsInTransaction(input);\n  const membershipEdges = await loadMembershipEdges(\n    input.tx,\n    input.organizationId,\n  );\n  const policyHeadRows = await loadPolicyHeadRows(\n    input.tx,\n    input.organizationId,\n  );\n  const { groupPolicyHeads, policyHeads } = validatePolicyHeads({\n    groupRows,\n    organizationId: input.organizationId,\n    policyHeadRows,\n  });\n\n  return {\n    cursor: state.cursor,\n    directory: {\n      organizationId: input.organizationId,\n      profileDocumentId: state.profileDocumentId,\n      users: directoryRows.map((row) =>\n        toDirectoryUser(row, input.currentUserId),\n      ),\n    },\n    grants,\n    groups: {\n      organizationId: input.organizationId,\n      memberGroupId: state.memberGroupId,\n      groups: groupRows.map((row) => ({\n        groupId: row.groupId,\n        organizationId: input.organizationId,\n        name: row.name,\n        createdAt: row.createdAt,\n        isBuiltin: row.isBuiltin,\n        currentState: toGroupCurrentState(\n          row,\n          groupPolicyHeads.get(row.groupId),\n        ),\n      })),\n    },\n    membershipEdges,\n    organizationId: input.organizationId,\n    policyHeads,\n    protocolVersion: ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n    requester: requester ? { isOrgAdmin: requester.isOrgAdmin } : null,\n    updatedAt: state.updatedAt,\n  };\n}\n"]}

package/data/persistence/organizations/organizationReadModelProtocol.js

@@ -0,0 +1,14 @@
+/** Wire version required by organization read-model responses and cursors. */
+export const ORGANIZATION_READ_MODEL_PROTOCOL_VERSION = 6;
+/**
+ * A stored projection row failed load-time validation. The projection is a
+ * server-refetchable presentation cache, so loaders purge it and reconcile a
+ * fresh snapshot instead of failing every read until a protocol bump.
+ */
+export class OrganizationReadModelIntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "OrganizationReadModelIntegrityError";
+    }
+}
+//# sourceMappingURL=organizationReadModelProtocol.js.map

package/data/persistence/organizations/organizationReadModelProtocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelProtocol.js","sourceRoot":"","sources":["organizationReadModelProtocol.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAU,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IAC5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF","sourcesContent":["/** Wire version required by organization read-model responses and cursors. */\nexport const ORGANIZATION_READ_MODEL_PROTOCOL_VERSION = 6 as const;\n\n/**\n * A stored projection row failed load-time validation. The projection is a\n * server-refetchable presentation cache, so loaders purge it and reconcile a\n * fresh snapshot instead of failing every read until a protocol bump.\n */\nexport class OrganizationReadModelIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"OrganizationReadModelIntegrityError\";\n  }\n}\n"]}

package/data/persistence/organizations/organizationReadModelPurge.js

@@ -0,0 +1,113 @@
+import { and, eq, ne, notInArray } from "drizzle-orm";
+import { organizationDataUsageCategories, organizationDataUsageSnapshots, } from "../../sqlite/organizationDataUsageSchema.js";
+import { organizationReadModelContainerGrants, organizationReadModelDirectoryUsers, organizationReadModelGroupMembers, organizationReadModelGroupMemberships, organizationReadModelGroups, organizationReadModelPolicyHeads, organizationReadModelRequesters, organizationReadModelState, } from "../../sqlite/organizationReadModelSchema.js";
+import { organizationReadModelTables } from "../../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
+import { notifyOrganizationReadModelInvalidated } from "./organizationReadModelInvalidation.js";
+import { OrganizationReadModelIntegrityError } from "./organizationReadModelProtocol.js";
+function inactiveUserScope(input, organizationIdColumn, userIdColumn) {
+    const scope = and(eq(organizationIdColumn, input.organizationId), ne(userIdColumn, input.retainUserId));
+    return input.activeUserIds.length > 0
+        ? and(scope, notInArray(userIdColumn, [...input.activeUserIds]))
+        : scope;
+}
+/**
+ * Retire requester rows — and the requester-scoped usage projections beside
+ * them — for users the just-applied authoritative directory no longer lists as
+ * active. Without this, a removed member whose identity shares the database
+ * keeps presentation access until it personally sees a 403. The applying
+ * requester's own rows are never pruned here: the server response that
+ * carried this directory already proved that user's access.
+ */
+export async function pruneInactiveOrganizationRequestersInTransaction(input) {
+    await input.tx
+        .delete(organizationReadModelRequesters)
+        .where(inactiveUserScope(input, organizationReadModelRequesters.organizationId, organizationReadModelRequesters.userId))
+        .run();
+    await input.tx
+        .delete(organizationDataUsageSnapshots)
+        .where(inactiveUserScope(input, organizationDataUsageSnapshots.organizationId, organizationDataUsageSnapshots.requesterUserId))
+        .run();
+    await input.tx
+        .delete(organizationDataUsageCategories)
+        .where(inactiveUserScope(input, organizationDataUsageCategories.organizationId, organizationDataUsageCategories.requesterUserId))
+        .run();
+}
+/**
+ * Delete the shared projection rows for one organization. By default every
+ * requester row falls with them; `onlyRequesterUserId` scopes the requester
+ * delete to that user for rebuilds where the shared rows are about to be
+ * replaced authoritatively — other local identities keep their rows and read
+ * the replacement instead of losing access until their own next reconcile.
+ */
+export async function purgeOrganizationReadModelProjectionInTransaction(input) {
+    await input.tx
+        .delete(organizationReadModelPolicyHeads)
+        .where(eq(organizationReadModelPolicyHeads.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelContainerGrants)
+        .where(eq(organizationReadModelContainerGrants.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelGroupMembers)
+        .where(eq(organizationReadModelGroupMembers.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelGroupMemberships)
+        .where(eq(organizationReadModelGroupMemberships.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelDirectoryUsers)
+        .where(eq(organizationReadModelDirectoryUsers.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelGroups)
+        .where(eq(organizationReadModelGroups.organizationId, input.organizationId))
+        .run();
+    await input.tx
+        .delete(organizationReadModelRequesters)
+        .where(input.onlyRequesterUserId === undefined
+        ? eq(organizationReadModelRequesters.organizationId, input.organizationId)
+        : and(eq(organizationReadModelRequesters.organizationId, input.organizationId), eq(organizationReadModelRequesters.userId, input.onlyRequesterUserId)))
+        .run();
+    await input.tx
+        .delete(organizationReadModelState)
+        .where(eq(organizationReadModelState.organizationId, input.organizationId))
+        .run();
+}
+/**
+ * The ONE load shell for the durable read-model projection: run `load` in a
+ * transaction and, if a stored row fails integrity validation, purge the
+ * organization's projection and report null. The projection is a
+ * server-refetchable cache, so the next reconcile requests a cursorless
+ * snapshot instead of every read and repair pass failing on the same row.
+ */
+export async function loadWithOrganizationReadModelIntegrityPurge(input) {
+    await ensureSqlTables(input.execSql, organizationReadModelTables);
+    let purgedInvalidRows = false;
+    const result = await getClientSQLitePersistenceRuntime(input.execSql).transaction(async (tx) => {
+        try {
+            return await input.load(tx);
+        }
+        catch (error) {
+            if (!(error instanceof OrganizationReadModelIntegrityError)) {
+                throw error;
+            }
+            await purgeOrganizationReadModelProjectionInTransaction({
+                organizationId: input.organizationId,
+                tx,
+            });
+            purgedInvalidRows = true;
+            return null;
+        }
+    });
+    if (purgedInvalidRows) {
+        // Realtime consumers may hold a caught-up lease over rows that no longer
+        // exist; the notification lets them drop it and refetch authoritatively.
+        notifyOrganizationReadModelInvalidated(input.execSql, input.organizationId);
+    }
+    return result;
+}
+//# sourceMappingURL=organizationReadModelPurge.js.map

package/data/persistence/organizations/organizationReadModelPurge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelPurge.js","sourceRoot":"","sources":["organizationReadModelPurge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAe,EAAE,EAAE,EAAE,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,qCAAqC,EACrC,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,SAAS,iBAAiB,CACxB,KAIC,EACD,oBAA4B,EAC5B,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CACf,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,EAC9C,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CACrC,CAAC;IACF,OAAO,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAKtE;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,KAAK,CACJ,iBAAiB,CACf,KAAK,EACL,+BAA+B,CAAC,cAAc,EAC9C,+BAA+B,CAAC,MAAM,CACvC,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,8BAA8B,CAAC;SACtC,KAAK,CACJ,iBAAiB,CACf,KAAK,EACL,8BAA8B,CAAC,cAAc,EAC7C,8BAA8B,CAAC,eAAe,CAC/C,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,KAAK,CACJ,iBAAiB,CACf,KAAK,EACL,+BAA+B,CAAC,cAAc,EAC9C,+BAA+B,CAAC,eAAe,CAChD,CACF;SACA,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iDAAiD,CAAC,KAIvE;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,gCAAgC,CAAC;SACxC,KAAK,CACJ,EAAE,CAAC,gCAAgC,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAC1E;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,oCAAoC,CAAC;SAC5C,KAAK,CACJ,EAAE,CACA,oCAAoC,CAAC,cAAc,EACnD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,iCAAiC,CAAC;SACzC,KAAK,CACJ,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,qCAAqC,CAAC;SAC7C,KAAK,CACJ,EAAE,CACA,qCAAqC,CAAC,cAAc,EACpD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,mCAAmC,CAAC;SAC3C,KAAK,CACJ,EAAE,CACA,mCAAmC,CAAC,cAAc,EAClD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,2BAA2B,CAAC;SACnC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC3E,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,KAAK,CACJ,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACrC,CAAC,CAAC,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB;QACH,CAAC,CAAC,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CACA,+BAA+B,CAAC,MAAM,EACtC,KAAK,CAAC,mBAAmB,CAC1B,CACF,CACN;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,0BAA0B,CAAC;SAClC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC1E,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAAI,KAIpE;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAClE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,iCAAiC,CACpD,KAAK,CAAC,OAAO,CACd,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,mCAAmC,CAAC,EAAE,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,iDAAiD,CAAC;gBACtD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,EAAE;aACH,CAAC,CAAC;YACH,iBAAiB,GAAG,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,iBAAiB,EAAE,CAAC;QACtB,yEAAyE;QACzE,yEAAyE;QACzE,sCAAsC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { and, type Column, eq, ne, notInArray, type SQL } from \"drizzle-orm\";\nimport {\n  organizationDataUsageCategories,\n  organizationDataUsageSnapshots,\n} from \"../../sqlite/organizationDataUsageSchema\";\nimport {\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroupMemberships,\n  organizationReadModelGroups,\n  organizationReadModelPolicyHeads,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/organizationReadModelSchema\";\nimport { organizationReadModelTables } from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { notifyOrganizationReadModelInvalidated } from \"./organizationReadModelInvalidation\";\nimport { OrganizationReadModelIntegrityError } from \"./organizationReadModelProtocol\";\n\nfunction inactiveUserScope(\n  input: {\n    readonly activeUserIds: readonly string[];\n    readonly organizationId: string;\n    readonly retainUserId: string;\n  },\n  organizationIdColumn: Column,\n  userIdColumn: Column,\n): SQL | undefined {\n  const scope = and(\n    eq(organizationIdColumn, input.organizationId),\n    ne(userIdColumn, input.retainUserId),\n  );\n  return input.activeUserIds.length > 0\n    ? and(scope, notInArray(userIdColumn, [...input.activeUserIds]))\n    : scope;\n}\n\n/**\n * Retire requester rows — and the requester-scoped usage projections beside\n * them — for users the just-applied authoritative directory no longer lists as\n * active. Without this, a removed member whose identity shares the database\n * keeps presentation access until it personally sees a 403. The applying\n * requester's own rows are never pruned here: the server response that\n * carried this directory already proved that user's access.\n */\nexport async function pruneInactiveOrganizationRequestersInTransaction(input: {\n  readonly activeUserIds: readonly string[];\n  readonly organizationId: string;\n  readonly retainUserId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelRequesters)\n    .where(\n      inactiveUserScope(\n        input,\n        organizationReadModelRequesters.organizationId,\n        organizationReadModelRequesters.userId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationDataUsageSnapshots)\n    .where(\n      inactiveUserScope(\n        input,\n        organizationDataUsageSnapshots.organizationId,\n        organizationDataUsageSnapshots.requesterUserId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationDataUsageCategories)\n    .where(\n      inactiveUserScope(\n        input,\n        organizationDataUsageCategories.organizationId,\n        organizationDataUsageCategories.requesterUserId,\n      ),\n    )\n    .run();\n}\n\n/**\n * Delete the shared projection rows for one organization. By default every\n * requester row falls with them; `onlyRequesterUserId` scopes the requester\n * delete to that user for rebuilds where the shared rows are about to be\n * replaced authoritatively — other local identities keep their rows and read\n * the replacement instead of losing access until their own next reconcile.\n */\nexport async function purgeOrganizationReadModelProjectionInTransaction(input: {\n  readonly onlyRequesterUserId?: string | undefined;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelPolicyHeads)\n    .where(\n      eq(organizationReadModelPolicyHeads.organizationId, input.organizationId),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelContainerGrants)\n    .where(\n      eq(\n        organizationReadModelContainerGrants.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelGroupMembers)\n    .where(\n      eq(\n        organizationReadModelGroupMembers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelGroupMemberships)\n    .where(\n      eq(\n        organizationReadModelGroupMemberships.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelDirectoryUsers)\n    .where(\n      eq(\n        organizationReadModelDirectoryUsers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, input.organizationId))\n    .run();\n  await input.tx\n    .delete(organizationReadModelRequesters)\n    .where(\n      input.onlyRequesterUserId === undefined\n        ? eq(\n            organizationReadModelRequesters.organizationId,\n            input.organizationId,\n          )\n        : and(\n            eq(\n              organizationReadModelRequesters.organizationId,\n              input.organizationId,\n            ),\n            eq(\n              organizationReadModelRequesters.userId,\n              input.onlyRequesterUserId,\n            ),\n          ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, input.organizationId))\n    .run();\n}\n\n/**\n * The ONE load shell for the durable read-model projection: run `load` in a\n * transaction and, if a stored row fails integrity validation, purge the\n * organization's projection and report null. The projection is a\n * server-refetchable cache, so the next reconcile requests a cursorless\n * snapshot instead of every read and repair pass failing on the same row.\n */\nexport async function loadWithOrganizationReadModelIntegrityPurge<T>(input: {\n  readonly execSql: ExecSql;\n  readonly load: (tx: ClientSQLiteTransactionScope) => Promise<T | null>;\n  readonly organizationId: string;\n}): Promise<T | null> {\n  await ensureSqlTables(input.execSql, organizationReadModelTables);\n  let purgedInvalidRows = false;\n  const result = await getClientSQLitePersistenceRuntime(\n    input.execSql,\n  ).transaction(async (tx) => {\n    try {\n      return await input.load(tx);\n    } catch (error) {\n      if (!(error instanceof OrganizationReadModelIntegrityError)) {\n        throw error;\n      }\n      await purgeOrganizationReadModelProjectionInTransaction({\n        organizationId: input.organizationId,\n        tx,\n      });\n      purgedInvalidRows = true;\n      return null;\n    }\n  });\n  if (purgedInvalidRows) {\n    // Realtime consumers may hold a caught-up lease over rows that no longer\n    // exist; the notification lets them drop it and refetch authoritatively.\n    notifyOrganizationReadModelInvalidated(input.execSql, input.organizationId);\n  }\n  return result;\n}\n"]}

package/data/persistence/organizations/organizationReadModelResponseAssertions.js

@@ -0,0 +1,42 @@
+import { ORGANIZATION_READ_MODEL_PROTOCOL_VERSION } from "./organizationReadModelProtocol.js";
+function assertUniqueIds(values, label) {
+    if (new Set(values).size !== values.length) {
+        throw new Error(`Organization read-model ${label} contains duplicate IDs`);
+    }
+}
+export function assertOrganizationReadModelResponse(input) {
+    const { response } = input;
+    if (response.version !== ORGANIZATION_READ_MODEL_PROTOCOL_VERSION) {
+        throw new Error("Organization read-model protocol version is unsupported");
+    }
+    if (response.lanes.directory?.organizationId !== undefined &&
+        response.lanes.directory.organizationId !== response.organizationId) {
+        throw new Error("Organization directory response scope does not match");
+    }
+    if (response.lanes.groups?.organizationId !== undefined &&
+        response.lanes.groups.organizationId !== response.organizationId) {
+        throw new Error("Organization groups response scope does not match");
+    }
+    if (response.lanes.groupMemberships?.organizationId !== undefined &&
+        response.lanes.groupMemberships.organizationId !== response.organizationId) {
+        throw new Error("Organization group memberships scope does not match");
+    }
+    if (response.lanes.grants?.organizationId !== undefined &&
+        response.lanes.grants.organizationId !== response.organizationId) {
+        throw new Error("Organization grants response scope does not match");
+    }
+    if (response.lanes.organizationPolicy?.organizationId !== undefined &&
+        response.lanes.organizationPolicy.organizationId !== response.organizationId) {
+        throw new Error("Organization policy response scope does not match");
+    }
+    if (response.lanes.groups?.groups.some((group) => group.organizationId !== response.organizationId)) {
+        throw new Error("Organization group row scope does not match");
+    }
+    const directoryUsers = response.lanes.directory?.users ?? [];
+    assertUniqueIds(directoryUsers.map((user) => user.userId), "directory");
+    if (directoryUsers.some((user) => user.isSelf !== (user.userId === input.currentUserId))) {
+        throw new Error("Organization directory requester flags do not match");
+    }
+    assertUniqueIds(response.lanes.groups?.groups.map((group) => group.groupId) ?? [], "groups");
+}
+//# sourceMappingURL=organizationReadModelResponseAssertions.js.map

package/data/persistence/organizations/organizationReadModelResponseAssertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelResponseAssertions.js","sourceRoot":"","sources":["organizationReadModelResponseAssertions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAE3F,SAAS,eAAe,CAAC,MAA6B,EAAE,KAAa;IACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,yBAAyB,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAGnD;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,IAAI,QAAQ,CAAC,OAAO,KAAK,wCAAwC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,KAAK,SAAS;QACtD,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EACnE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS;QACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,cAAc,KAAK,SAAS;QAC7D,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS;QACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,KAAK,SAAS;QAC/D,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAC5D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7D,eAAe,CACb,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EACzC,WAAW,CACZ,CAAC;IACF,IACE,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,CAChE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,eAAe,CACb,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EACjE,QAAQ,CACT,CAAC;AACJ,CAAC","sourcesContent":["import type { OrganizationReadModelResponse } from \"@tearleads/validators/response\";\nimport { ORGANIZATION_READ_MODEL_PROTOCOL_VERSION } from \"./organizationReadModelProtocol\";\n\nfunction assertUniqueIds(values: ReadonlyArray<string>, label: string): void {\n  if (new Set(values).size !== values.length) {\n    throw new Error(`Organization read-model ${label} contains duplicate IDs`);\n  }\n}\n\nexport function assertOrganizationReadModelResponse(input: {\n  readonly currentUserId: string;\n  readonly response: OrganizationReadModelResponse;\n}): void {\n  const { response } = input;\n  if (response.version !== ORGANIZATION_READ_MODEL_PROTOCOL_VERSION) {\n    throw new Error(\"Organization read-model protocol version is unsupported\");\n  }\n  if (\n    response.lanes.directory?.organizationId !== undefined &&\n    response.lanes.directory.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization directory response scope does not match\");\n  }\n  if (\n    response.lanes.groups?.organizationId !== undefined &&\n    response.lanes.groups.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization groups response scope does not match\");\n  }\n  if (\n    response.lanes.groupMemberships?.organizationId !== undefined &&\n    response.lanes.groupMemberships.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization group memberships scope does not match\");\n  }\n  if (\n    response.lanes.grants?.organizationId !== undefined &&\n    response.lanes.grants.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization grants response scope does not match\");\n  }\n  if (\n    response.lanes.organizationPolicy?.organizationId !== undefined &&\n    response.lanes.organizationPolicy.organizationId !== response.organizationId\n  ) {\n    throw new Error(\"Organization policy response scope does not match\");\n  }\n  if (\n    response.lanes.groups?.groups.some(\n      (group) => group.organizationId !== response.organizationId,\n    )\n  ) {\n    throw new Error(\"Organization group row scope does not match\");\n  }\n\n  const directoryUsers = response.lanes.directory?.users ?? [];\n  assertUniqueIds(\n    directoryUsers.map((user) => user.userId),\n    \"directory\",\n  );\n  if (\n    directoryUsers.some(\n      (user) => user.isSelf !== (user.userId === input.currentUserId),\n    )\n  ) {\n    throw new Error(\"Organization directory requester flags do not match\");\n  }\n  assertUniqueIds(\n    response.lanes.groups?.groups.map((group) => group.groupId) ?? [],\n    \"groups\",\n  );\n}\n"]}

package/data/persistence/principalGrantRetirementPersistence.d.ts

@@ -0,0 +1,9 @@
+import { type AccessManifestCheckpoint, type VerifiedPrincipalPolicy } from "../../internal/crypto/index.js";
+import type { ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
+export interface AcknowledgedPrincipalGrantRetirements {
+    readonly containerIds: readonly string[];
+    readonly organizationId: string;
+    readonly policy: VerifiedPrincipalPolicy;
+}
+export declare function storePrincipalGrantRetirements(tx: ClientSQLiteTransactionScope, retirement: AcknowledgedPrincipalGrantRetirements, policies: readonly VerifiedPrincipalPolicy[], organizationId: string | undefined): Promise<void>;
+export declare function assertContainerNotRetired(tx: ClientSQLiteTransactionScope, checkpoint: AccessManifestCheckpoint): Promise<void>;

package/data/persistence/principalGrantRetirementPersistence.js

@@ -0,0 +1,40 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalGrantRetirements } from "../sqlite/principalGrantRetirementSchema.js";
+export async function storePrincipalGrantRetirements(tx, retirement, policies, organizationId) {
+    if (!policies.some((policy) => policy.principalId === retirement.policy.principalId &&
+        policy.principalType === retirement.policy.principalType &&
+        policy.stateHash === retirement.policy.stateHash)) {
+        throw new KeyingVerificationError("object_mismatch", "Retirement must accompany its acknowledged policy");
+    }
+    const previous = retirement.policy.history?.find((entry) => entry.state.stateHash === retirement.policy.state.prevStateHash);
+    const granted = new Set([...retirement.policy.grants, ...(previous?.grants ?? [])].map((grant) => grant.containerId));
+    if (retirement.organizationId !== organizationId ||
+        retirement.containerIds.some((id) => !granted.has(id))) {
+        throw new KeyingVerificationError("object_mismatch", "Retirement must match the acknowledged organization and signed grants");
+    }
+    for (const containerId of new Set(retirement.containerIds)) {
+        await tx
+            .insert(principalGrantRetirements)
+            .values({
+            organizationId: retirement.organizationId,
+            containerId,
+            principalId: retirement.policy.principalId,
+            policyStateHash: retirement.policy.stateHash,
+        })
+            .onConflictDoNothing()
+            .run();
+    }
+}
+export async function assertContainerNotRetired(tx, checkpoint) {
+    if (checkpoint.objectKind !== "container")
+        return;
+    const [retired] = await tx
+        .select({ containerId: principalGrantRetirements.containerId })
+        .from(principalGrantRetirements)
+        .where(and(eq(principalGrantRetirements.organizationId, checkpoint.organizationId), eq(principalGrantRetirements.containerId, checkpoint.objectId)))
+        .limit(1);
+    if (retired)
+        throw new KeyingVerificationError("equivocation", `Container ${checkpoint.objectId} was retired during principal rotation`);
+}
+//# sourceMappingURL=principalGrantRetirementPersistence.js.map

package/data/persistence/principalGrantRetirementPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAA4C,EAC5C,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly VerifiedPrincipalPolicy[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const previous = retirement.policy.history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}

package/data/persistence/principalHistoryEvidencePersistence.js

@@ -0,0 +1,91 @@
+import { compareCanonicalStrings, KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "../../internal/crypto/index.js";
+import { isPrincipalPolicyStateChainEntryResponse, } from "../../internal/validators/response/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalHistoryEntries, principalHistoryEvidenceTables, principalHistoryNodes, } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+/** Prepare only a page accepted by the signature/authorization verifier. */
+export async function preparePrincipalHistoryEvidencePage(input) {
+    if (input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||
+        input.nodes.length > 2 * PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT)
+        throw new KeyingVerificationError("invalid_shape", "Principal evidence page exceeds its batch budget");
+    const owned = structuredClone(input);
+    return {
+        ...owned,
+        entries: await Promise.all(owned.entries.map(async (entry) => ({
+            leafHash: await principalHistoryIndexLeaf(entry.state),
+            entryJson: JSON.stringify(entry),
+        }))),
+    };
+}
+/** Publish in the same guarded transaction as the accepted page's progress. */
+export async function writePrincipalHistoryEvidencePage(tx, page) {
+    const scope = { scopeId: page.scopeId, organizationId: page.organizationId };
+    for (const entry of [...page.entries].sort((a, b) => compareCanonicalStrings(a.leafHash, b.leafHash))) {
+        const row = { ...scope, ...entry };
+        await tx
+            .insert(principalHistoryEntries)
+            .values(row)
+            .onConflictDoUpdate({
+            target: [
+                principalHistoryEntries.scopeId,
+                principalHistoryEntries.leafHash,
+            ],
+            set: row,
+        })
+            .run();
+    }
+    for (const node of [...page.nodes].sort((a, b) => compareCanonicalStrings(a.hash, b.hash))) {
+        const row = { ...scope, ...node };
+        await tx
+            .insert(principalHistoryNodes)
+            .values(row)
+            .onConflictDoUpdate({
+            target: [principalHistoryNodes.scopeId, principalHistoryNodes.hash],
+            set: row,
+        })
+            .run();
+    }
+}
+/** Returns untrusted material. The caller must verify it against the issued root. */
+export async function loadPrincipalHistoryReference(input) {
+    await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);
+    const { db } = getClientSQLitePersistenceRuntime(input.execSql);
+    const resolved = await resolvePrincipalHistoryIndexProof({
+        rootHash: input.history.indexRootHash,
+        treeSize: input.history.currentEntry.state.version,
+        version: input.version,
+        readNode: async (hash) => {
+            const [row] = await db
+                .select()
+                .from(principalHistoryNodes)
+                .where(and(eq(principalHistoryNodes.scopeId, input.scopeId), eq(principalHistoryNodes.hash, hash)))
+                .limit(1);
+            return row ?? null;
+        },
+    });
+    const [row] = await db
+        .select()
+        .from(principalHistoryEntries)
+        .where(and(eq(principalHistoryEntries.scopeId, input.scopeId), eq(principalHistoryEntries.leafHash, resolved.leafHash)))
+        .limit(1);
+    let entry;
+    try {
+        entry = row ? JSON.parse(row.entryJson) : null;
+    }
+    catch {
+        entry = null;
+    }
+    if (!isPrincipalPolicyStateChainEntryResponse(entry))
+        throw new KeyingVerificationError("missing_dependency", "Principal history entry is missing or corrupt");
+    const reference = input.expectedReference ?? {
+        principalType: entry.state.principalType,
+        principalId: entry.state.principalId,
+        version: entry.state.version,
+        keyEpoch: entry.state.keyEpoch,
+        stateHash: entry.state.stateHash,
+        keyFingerprint: entry.state.keyFingerprint,
+    };
+    return { reference, entry, proof: resolved.proof };
+}
+//# sourceMappingURL=principalHistoryEvidencePersistence.js.map

package/data/persistence/principalHistoryEvidencePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryEvidencePersistence.js","sourceRoot":"","sources":["principalHistoryEvidencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAGlC,yBAAyB,EAEzB,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAKzD;IACC,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,kCAAkC;QACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,kCAAkC;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,EAAgC,EAChC,IAAkC;IAElC,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClD,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAChD,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QACnC,MAAM,EAAE;aACL,MAAM,CAAC,uBAAuB,CAAC;aAC/B,MAAM,CAAC,GAAG,CAAC;aACX,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,uBAAuB,CAAC,OAAO;gBAC/B,uBAAuB,CAAC,QAAQ;aACjC;YACD,GAAG,EAAE,GAAG;SACT,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC/C,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACxC,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE;aACL,MAAM,CAAC,qBAAqB,CAAC;aAC7B,MAAM,CAAC,GAAG,CAAC;aACX,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC;YACnE,GAAG,EAAE,GAAG;SACT,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC;QACvD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CACrC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAClD,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CACxD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;IACJ,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI;QAC3C,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;QAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;KAC3C,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalHistoryIndexNode,\n  type PrincipalPolicyHistoryReferenceProof,\n  principalHistoryIndexLeaf,\n  type ReferencedPrincipalHead,\n  resolvePrincipalHistoryIndexProof,\n  type VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryEvidenceTables,\n  principalHistoryNodes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalHistoryEvidencePage {\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly {\n    readonly leafHash: string;\n    readonly entryJson: string;\n  }[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\n/** Prepare only a page accepted by the signature/authorization verifier. */\nexport async function preparePrincipalHistoryEvidencePage(input: {\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}): Promise<PrincipalHistoryEvidencePage> {\n  if (\n    input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n    input.nodes.length > 2 * PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal evidence page exceeds its batch budget\",\n    );\n  const owned = structuredClone(input);\n  return {\n    ...owned,\n    entries: await Promise.all(\n      owned.entries.map(async (entry) => ({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        entryJson: JSON.stringify(entry),\n      })),\n    ),\n  };\n}\n\n/** Publish in the same guarded transaction as the accepted page's progress. */\nexport async function writePrincipalHistoryEvidencePage(\n  tx: ClientSQLiteTransactionScope,\n  page: PrincipalHistoryEvidencePage,\n): Promise<void> {\n  const scope = { scopeId: page.scopeId, organizationId: page.organizationId };\n  for (const entry of [...page.entries].sort((a, b) =>\n    compareCanonicalStrings(a.leafHash, b.leafHash),\n  )) {\n    const row = { ...scope, ...entry };\n    await tx\n      .insert(principalHistoryEntries)\n      .values(row)\n      .onConflictDoUpdate({\n        target: [\n          principalHistoryEntries.scopeId,\n          principalHistoryEntries.leafHash,\n        ],\n        set: row,\n      })\n      .run();\n  }\n  for (const node of [...page.nodes].sort((a, b) =>\n    compareCanonicalStrings(a.hash, b.hash),\n  )) {\n    const row = { ...scope, ...node };\n    await tx\n      .insert(principalHistoryNodes)\n      .values(row)\n      .onConflictDoUpdate({\n        target: [principalHistoryNodes.scopeId, principalHistoryNodes.hash],\n        set: row,\n      })\n      .run();\n  }\n}\n\n/** Returns untrusted material. The caller must verify it against the issued root. */\nexport async function loadPrincipalHistoryReference(input: {\n  readonly execSql: ExecSql;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly version: number;\n  readonly expectedReference?: ReferencedPrincipalHead | undefined;\n}): Promise<PrincipalPolicyHistoryReferenceProof> {\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(input.execSql);\n  const resolved = await resolvePrincipalHistoryIndexProof({\n    rootHash: input.history.indexRootHash,\n    treeSize: input.history.currentEntry.state.version,\n    version: input.version,\n    readNode: async (hash) => {\n      const [row] = await db\n        .select()\n        .from(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, input.scopeId),\n            eq(principalHistoryNodes.hash, hash),\n          ),\n        )\n        .limit(1);\n      return row ?? null;\n    },\n  });\n  const [row] = await db\n    .select()\n    .from(principalHistoryEntries)\n    .where(\n      and(\n        eq(principalHistoryEntries.scopeId, input.scopeId),\n        eq(principalHistoryEntries.leafHash, resolved.leafHash),\n      ),\n    )\n    .limit(1);\n  let entry: unknown;\n  try {\n    entry = row ? JSON.parse(row.entryJson) : null;\n  } catch {\n    entry = null;\n  }\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history entry is missing or corrupt\",\n    );\n  const reference = input.expectedReference ?? {\n    principalType: entry.state.principalType,\n    principalId: entry.state.principalId,\n    version: entry.state.version,\n    keyEpoch: entry.state.keyEpoch,\n    stateHash: entry.state.stateHash,\n    keyFingerprint: entry.state.keyFingerprint,\n  };\n  return { reference, entry, proof: resolved.proof };\n}\n"]}

package/data/persistence/principalHistoryPrefixPersistence.js

@@ -0,0 +1,52 @@
+import { and, eq } from "drizzle-orm";
+import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
+import { principalHistoryEvidenceTables, principalHistoryPrefixes, } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+export async function loadPrincipalHistoryPrefix(execSql, scopeId) {
+    await ensureSqlTables(execSql, principalHistoryEvidenceTables);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [prefix] = await db
+        .select()
+        .from(principalHistoryPrefixes)
+        .where(eq(principalHistoryPrefixes.scopeId, scopeId))
+        .limit(1);
+    return prefix ?? null;
+}
+/** Keep one completed prefix per principal/trust scope; older readers cannot replace it. */
+export async function savePrincipalHistoryPrefix(input) {
+    const prefix = { ...input.prefix };
+    await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const [previous] = await tx
+            .select()
+            .from(principalHistoryPrefixes)
+            .where(eq(principalHistoryPrefixes.scopeId, prefix.scopeId))
+            .limit(1);
+        if (previous && previous.version > prefix.version)
+            return;
+        await tx
+            .insert(principalHistoryPrefixes)
+            .values(prefix)
+            .onConflictDoUpdate({
+            target: principalHistoryPrefixes.scopeId,
+            set: prefix,
+        })
+            .run();
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+}
+/** Invalid hints are disposable, but a losing reader must preserve a newer hint. */
+export async function discardPrincipalHistoryPrefix(input) {
+    const prefix = { ...input.prefix };
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        await tx
+            .delete(principalHistoryPrefixes)
+            .where(and(eq(principalHistoryPrefixes.scopeId, prefix.scopeId), eq(principalHistoryPrefixes.progress, prefix.progress)))
+            .run();
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+}
+//# sourceMappingURL=principalHistoryPrefixPersistence.js.map

package/data/persistence/principalHistoryPrefixPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryPrefixPersistence.js","sourceRoot":"","sources":["principalHistoryPrefixPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YAAE,OAAO;QAC1D,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,MAAM,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC;YAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;YACxC,GAAG,EAAE,MAAM;SACZ,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EACpD,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CACvD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalHistoryPrefix =\n  typeof principalHistoryPrefixes.$inferSelect;\n\nexport async function loadPrincipalHistoryPrefix(\n  execSql: ExecSql,\n  scopeId: string,\n) {\n  await ensureSqlTables(execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [prefix] = await db\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, scopeId))\n    .limit(1);\n  return prefix ?? null;\n}\n\n/** Keep one completed prefix per principal/trust scope; older readers cannot replace it. */\nexport async function savePrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select()\n        .from(principalHistoryPrefixes)\n        .where(eq(principalHistoryPrefixes.scopeId, prefix.scopeId))\n        .limit(1);\n      if (previous && previous.version > prefix.version) return;\n      await tx\n        .insert(principalHistoryPrefixes)\n        .values(prefix)\n        .onConflictDoUpdate({\n          target: principalHistoryPrefixes.scopeId,\n          set: prefix,\n        })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** Invalid hints are disposable, but a losing reader must preserve a newer hint. */\nexport async function discardPrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      await tx\n        .delete(principalHistoryPrefixes)\n        .where(\n          and(\n            eq(principalHistoryPrefixes.scopeId, prefix.scopeId),\n            eq(principalHistoryPrefixes.progress, prefix.progress),\n          ),\n        )\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n"]}

package/data/persistence/principalHistoryStagePersistence.js

@@ -0,0 +1,61 @@
+import { and, eq } from "drizzle-orm";
+import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
+import { principalHistoryEvidenceTables } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalHistoryStages, principalHistoryStageTables, } from "../sqlite/principalHistoryStageSchema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { writePrincipalHistoryEvidencePage, } from "./principalHistoryEvidencePersistence.js";
+class PrincipalHistoryStageChangedError extends Error {
+    code = "principal_history_stage_changed";
+    constructor() {
+        super("Another operation changed the saved principal history; resume from its current state");
+        this.name = "PrincipalHistoryStageChangedError";
+    }
+}
+export async function loadPrincipalHistoryStage(execSql, id) {
+    await ensureSqlTables(execSql, principalHistoryStageTables);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [row] = await db
+        .select()
+        .from(principalHistoryStages)
+        .where(eq(principalHistoryStages.id, id))
+        .limit(1);
+    return row ?? null;
+}
+/** Publish accepted entries and index nodes atomically with authenticated progress. */
+export async function savePrincipalHistoryStage(input) {
+    const stage = { ...input.stage };
+    const evidence = structuredClone(input.evidence);
+    await ensureSqlTables(input.execSql, [
+        ...principalHistoryStageTables,
+        ...principalHistoryEvidenceTables,
+    ]);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const saved = await runtime.guardedTransaction(async (tx) => {
+        const [previous] = await tx
+            .select({ progress: principalHistoryStages.progress })
+            .from(principalHistoryStages)
+            .where(eq(principalHistoryStages.id, stage.id))
+            .limit(1);
+        if ((previous?.progress ?? null) !== input.previousProgress)
+            throw new PrincipalHistoryStageChangedError();
+        await writePrincipalHistoryEvidencePage(tx, evidence);
+        await tx
+            .insert(principalHistoryStages)
+            .values(stage)
+            .onConflictDoUpdate({ target: principalHistoryStages.id, set: stage })
+            .run();
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => saved.committed);
+}
+export async function discardPrincipalHistoryStage(execSql, stage, stillCurrent) {
+    const runtime = getClientSQLitePersistenceRuntime(execSql);
+    const discarded = await runtime.guardedTransaction(async (db) => {
+        await db
+            .delete(principalHistoryStages)
+            .where(and(eq(principalHistoryStages.id, stage.id), eq(principalHistoryStages.progress, stage.progress)))
+            .run();
+    }, stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => discarded.committed);
+}
+//# sourceMappingURL=principalHistoryStagePersistence.js.map

package/data/persistence/principalHistoryStagePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryStagePersistence.js","sourceRoot":"","sources":["principalHistoryStagePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAI/C,MAAM,iCAAkC,SAAQ,KAAK;IAC1C,IAAI,GAAG,iCAAiC,CAAC;IAClD;QACE,KAAK,CACH,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgB,EAAE,EAAU;IAC1E,MAAM,eAAe,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,2BAA2B;QAC9B,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC5C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,gBAAgB;YACzD,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAChD,MAAM,iCAAiC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACrE,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,KAA4B,EAC5B,YAA2B;IAE3B,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAChD,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EACvC,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CACpD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport { principalHistoryEvidenceTables } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalHistoryStages,\n  principalHistoryStageTables,\n} from \"../sqlite/principalHistoryStageSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  type PrincipalHistoryEvidencePage,\n  writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\n\nexport type PrincipalHistoryStage = typeof principalHistoryStages.$inferSelect;\n\nclass PrincipalHistoryStageChangedError extends Error {\n  readonly code = \"principal_history_stage_changed\";\n  constructor() {\n    super(\n      \"Another operation changed the saved principal history; resume from its current state\",\n    );\n    this.name = \"PrincipalHistoryStageChangedError\";\n  }\n}\n\nexport async function loadPrincipalHistoryStage(execSql: ExecSql, id: string) {\n  await ensureSqlTables(execSql, principalHistoryStageTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select()\n    .from(principalHistoryStages)\n    .where(eq(principalHistoryStages.id, id))\n    .limit(1);\n  return row ?? null;\n}\n\n/** Publish accepted entries and index nodes atomically with authenticated progress. */\nexport async function savePrincipalHistoryStage(input: {\n  readonly execSql: ExecSql;\n  readonly stage: PrincipalHistoryStage;\n  readonly evidence: PrincipalHistoryEvidencePage;\n  readonly previousProgress: string | null;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const stage = { ...input.stage };\n  const evidence = structuredClone(input.evidence);\n  await ensureSqlTables(input.execSql, [\n    ...principalHistoryStageTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const saved = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select({ progress: principalHistoryStages.progress })\n        .from(principalHistoryStages)\n        .where(eq(principalHistoryStages.id, stage.id))\n        .limit(1);\n      if ((previous?.progress ?? null) !== input.previousProgress)\n        throw new PrincipalHistoryStageChangedError();\n      await writePrincipalHistoryEvidencePage(tx, evidence);\n      await tx\n        .insert(principalHistoryStages)\n        .values(stage)\n        .onConflictDoUpdate({ target: principalHistoryStages.id, set: stage })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => saved.committed);\n}\n\nexport async function discardPrincipalHistoryStage(\n  execSql: ExecSql,\n  stage: PrincipalHistoryStage,\n  stillCurrent: () => boolean,\n) {\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const discarded = await runtime.guardedTransaction(\n    async (db) => {\n      await db\n        .delete(principalHistoryStages)\n        .where(\n          and(\n            eq(principalHistoryStages.id, stage.id),\n            eq(principalHistoryStages.progress, stage.progress),\n          ),\n        )\n        .run();\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => discarded.committed);\n}\n"]}