@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/persistence/principalKeyEnvelopeCandidates.js

@@ -0,0 +1,67 @@
+import { isCurrentPrincipalMemberEnvelopesResponse, } from "../../internal/validators/response/index.js";
+import { desc, eq, sql } from "drizzle-orm";
+import { principalHistoryEvidenceTables, principalHistoryPrefixes, } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalCurrentFingerprintJson, principalStateFingerprintJson, } from "../sqlite/principalKeyFingerprintJson.js";
+import { principalPolicies, principalPolicyBundleHistory, } from "../sqlite/principalPolicySchema.js";
+import { principalPolicyTables } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+/**
+ * Untrusted encrypted key candidates, never authorization evidence. The actual
+ * private key must open the requested recipient wrap; the projection verifier
+ * separately checks the signed KEK material identity and all policy authority.
+ * Read only envelopes for the requested fingerprints, never signed histories.
+ */
+export async function loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints) {
+    await ensureSqlTables(execSql, [
+        ...principalPolicyTables,
+        ...principalHistoryEvidenceTables,
+    ]);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const candidates = [];
+    for (const fingerprint of new Set(fingerprints)) {
+        const encoded = [];
+        for (const table of [principalPolicies, principalPolicyBundleHistory]) {
+            const [row] = await db
+                .select({ envelopes: table.currentMemberEnvelopesJson })
+                .from(table)
+                .where(eq(principalStateFingerprintJson(table.currentStateJson), fingerprint))
+                .orderBy(desc(table.updatedAt))
+                .limit(1);
+            if (row)
+                encoded.push(row.envelopes);
+        }
+        const [prefix] = await db
+            .select({
+            envelopes: sql `json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,
+        })
+            .from(principalHistoryPrefixes)
+            .where(eq(principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson), fingerprint))
+            .orderBy(desc(principalHistoryPrefixes.version))
+            .limit(1);
+        if (prefix)
+            encoded.push(prefix.envelopes);
+        for (const json of encoded) {
+            let envelopes;
+            try {
+                envelopes = JSON.parse(json);
+            }
+            catch {
+                continue;
+            }
+            if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes))
+                continue;
+            candidates.push({
+                currentState: {
+                    principalType: envelopes.principalType,
+                    principalId: envelopes.principalId,
+                    stateHash: envelopes.stateHash,
+                    keyFingerprint: fingerprint,
+                },
+                currentMemberEnvelopes: envelopes,
+            });
+        }
+    }
+    return candidates;
+}
+//# sourceMappingURL=principalKeyEnvelopeCandidates.js.map

package/data/persistence/principalKeyEnvelopeCandidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}

package/data/persistence/principalPolicyBundleIntegrity.js

@@ -0,0 +1,49 @@
+import { compareCanonicalStrings, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
+import { isPrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+import { storedPrincipalPolicyBundleFromJson, } from "./storedPrincipalPolicyBundle.js";
+function parseBundle(row) {
+    const bundle = storedPrincipalPolicyBundleFromJson(row);
+    if (!isPrincipalPolicyBundleResponse(bundle)) {
+        throw new Error("Stored principal policy bundle is invalid");
+    }
+    return bundle;
+}
+function canonical(value) {
+    return canonicalKeyingJsonString(value, "principal policy bundle security content");
+}
+function withoutCreatedAt(value) {
+    const { createdAt: _createdAt, ...content } = value;
+    return content;
+}
+function securityContent(bundle) {
+    return {
+        currentMemberEnvelopes: {
+            ...bundle.currentMemberEnvelopes,
+            envelopes: [...bundle.currentMemberEnvelopes.envelopes].sort((a, b) => compareCanonicalStrings(canonical(a), canonical(b))),
+        },
+        currentPayload: withoutCreatedAt(bundle.currentPayload),
+        currentProjection: normalizePrincipalProjectionMembers(bundle.currentProjection),
+        currentGrants: normalizePrincipalContainerGrants(bundle.currentGrants),
+        currentState: withoutCreatedAt(bundle.currentState),
+        previousStates: bundle.previousStates.map((entry) => ({
+            projection: normalizePrincipalProjectionMembers(entry.projection),
+            grants: normalizePrincipalContainerGrants(entry.grants),
+            state: withoutCreatedAt(entry.state),
+        })),
+    };
+}
+export function assertSameHeadPrincipalPolicyBundle(stored, incoming) {
+    try {
+        if (canonical(securityContent(parseBundle(stored))) ===
+            canonical(securityContent(parseBundle(incoming)))) {
+            return;
+        }
+    }
+    catch {
+        // Invalid same-head cache content is also an integrity conflict: replacing
+        // it would erase the only durable evidence that the head was inconsistent.
+    }
+    throw new KeyingVerificationError("equivocation", "principal policy bundle content conflicts with the cached bundle at the same head");
+}
+//# sourceMappingURL=principalPolicyBundleIntegrity.js.map

package/data/persistence/principalPolicyBundleIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyBundleIntegrity.js","sourceRoot":"","sources":["principalPolicyBundleIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAEL,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AAEvC,SAAS,WAAW,CAClB,GAAoC;IAEpC,MAAM,MAAM,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,yBAAyB,CAC9B,KAAK,EACL,0CAA0C,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAQ;IAER,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAqC;IAC5D,OAAO;QACL,sBAAsB,EAAE;YACtB,GAAG,MAAM,CAAC,sBAAsB;YAChC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACpE,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CACpD;SACF;QACD,cAAc,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QACvD,iBAAiB,EAAE,mCAAmC,CACpD,MAAM,CAAC,iBAAiB,CACzB;QACD,aAAa,EAAE,iCAAiC,CAAC,MAAM,CAAC,aAAa,CAAC;QACtE,YAAY,EAAE,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;YACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;YACvD,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;SACrC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAuC,EACvC,QAAyC;IAEzC,IAAI,CAAC;QACH,IACE,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EACjD,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,2EAA2E;IAC7E,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mFAAmF,CACpF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { isPrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport {\n  type StoredPrincipalPolicyBundleJson,\n  storedPrincipalPolicyBundleFromJson,\n} from \"./storedPrincipalPolicyBundle\";\n\nfunction parseBundle(\n  row: StoredPrincipalPolicyBundleJson,\n): PrincipalPolicyBundleResponse {\n  const bundle = storedPrincipalPolicyBundleFromJson(row);\n  if (!isPrincipalPolicyBundleResponse(bundle)) {\n    throw new Error(\"Stored principal policy bundle is invalid\");\n  }\n  return bundle;\n}\n\nfunction canonical(value: unknown): string {\n  return canonicalKeyingJsonString(\n    value,\n    \"principal policy bundle security content\",\n  );\n}\n\nfunction withoutCreatedAt<T extends { readonly createdAt: string }>(\n  value: T,\n): Omit<T, \"createdAt\"> {\n  const { createdAt: _createdAt, ...content } = value;\n  return content;\n}\n\nfunction securityContent(bundle: PrincipalPolicyBundleResponse) {\n  return {\n    currentMemberEnvelopes: {\n      ...bundle.currentMemberEnvelopes,\n      envelopes: [...bundle.currentMemberEnvelopes.envelopes].sort((a, b) =>\n        compareCanonicalStrings(canonical(a), canonical(b)),\n      ),\n    },\n    currentPayload: withoutCreatedAt(bundle.currentPayload),\n    currentProjection: normalizePrincipalProjectionMembers(\n      bundle.currentProjection,\n    ),\n    currentGrants: normalizePrincipalContainerGrants(bundle.currentGrants),\n    currentState: withoutCreatedAt(bundle.currentState),\n    previousStates: bundle.previousStates.map((entry) => ({\n      projection: normalizePrincipalProjectionMembers(entry.projection),\n      grants: normalizePrincipalContainerGrants(entry.grants),\n      state: withoutCreatedAt(entry.state),\n    })),\n  };\n}\n\nexport function assertSameHeadPrincipalPolicyBundle(\n  stored: StoredPrincipalPolicyBundleJson,\n  incoming: StoredPrincipalPolicyBundleJson,\n): void {\n  try {\n    if (\n      canonical(securityContent(parseBundle(stored))) ===\n      canonical(securityContent(parseBundle(incoming)))\n    ) {\n      return;\n    }\n  } catch {\n    // Invalid same-head cache content is also an integrity conflict: replacing\n    // it would erase the only durable evidence that the head was inconsistent.\n  }\n  throw new KeyingVerificationError(\n    \"equivocation\",\n    \"principal policy bundle content conflicts with the cached bundle at the same head\",\n  );\n}\n"]}

package/data/persistence/principalPolicyCheckpointSelection.js

@@ -0,0 +1,26 @@
+import { verifyPrincipalPolicyCheckpoint } from "../../internal/crypto/index.js";
+import { assertPrincipalPolicyCheckpointShape } from "./keyingCheckpointPersistence.js";
+export function principalPolicyHeadMeetsCheckpoint(head, checkpoint) {
+    return (!checkpoint ||
+        head.version > checkpoint.version ||
+        (head.version === checkpoint.version &&
+            head.stateHash === checkpoint.stateHash));
+}
+export function verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint) {
+    if (!checkpoint) {
+        return true;
+    }
+    assertPrincipalPolicyCheckpointShape(checkpoint, policy);
+    if (policy.version < checkpoint.version) {
+        return false;
+    }
+    verifyPrincipalPolicyCheckpoint({
+        chain: "retainedHistory" in policy
+            ? policy.retainedHistory
+            : (policy.history ?? []),
+        currentState: policy.state,
+        localCheckpoint: checkpoint,
+    });
+    return true;
+}
+//# sourceMappingURL=principalPolicyCheckpointSelection.js.map

package/data/persistence/principalPolicyCheckpointSelection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCheckpointSelection.js","sourceRoot":"","sources":["principalPolicyCheckpointSelection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AAErF,MAAM,UAAU,kCAAkC,CAChD,IAA8D,EAC9D,UAA4C;IAE5C,OAAO,CACL,CAAC,UAAU;QACX,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QACjC,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;YAClC,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+BAA+B,CAAC;QAC9B,KAAK,EACH,iBAAiB,IAAI,MAAM;YACzB,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type {\n  PrincipalPolicyAuthorization,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { verifyPrincipalPolicyCheckpoint } from \"@tearleads/crypto\";\nimport { assertPrincipalPolicyCheckpointShape } from \"./keyingCheckpointPersistence\";\n\nexport function principalPolicyHeadMeetsCheckpoint(\n  head: { readonly stateHash: string; readonly version: number },\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n  return (\n    !checkpoint ||\n    head.version > checkpoint.version ||\n    (head.version === checkpoint.version &&\n      head.stateHash === checkpoint.stateHash)\n  );\n}\n\nexport function verifiedPrincipalPolicyMeetsCheckpoint(\n  policy: PrincipalPolicyAuthorization,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n  if (!checkpoint) {\n    return true;\n  }\n  assertPrincipalPolicyCheckpointShape(checkpoint, policy);\n  if (policy.version < checkpoint.version) {\n    return false;\n  }\n  verifyPrincipalPolicyCheckpoint({\n    chain:\n      \"retainedHistory\" in policy\n        ? policy.retainedHistory\n        : (policy.history ?? []),\n    currentState: policy.state,\n    localCheckpoint: checkpoint,\n  });\n  return true;\n}\n"]}

package/data/persistence/principalPolicyOrganizationPersistence.js

@@ -0,0 +1,42 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalPolicyOrganizations } from "../sqlite/schema.js";
+function resolveOrganizationId(input) {
+    if (input.principalType === "organization") {
+        if (input.organizationId !== undefined &&
+            input.organizationId !== input.principalId) {
+            throw new KeyingVerificationError("object_mismatch", "organization policy cache ownership targets another organization");
+        }
+        return input.principalId;
+    }
+    if (!input.organizationId) {
+        throw new Error("Group policy cache writes require an organization ID");
+    }
+    return input.organizationId;
+}
+/** Pins cache ownership in the same transaction as the cached policy state. */
+export async function recordPrincipalPolicyOrganizationInTransaction(tx, input) {
+    const organizationId = resolveOrganizationId(input);
+    const wherePrincipal = and(eq(principalPolicyOrganizations.principalType, input.principalType), eq(principalPolicyOrganizations.principalId, input.principalId));
+    const [stored] = await tx
+        .select({ organizationId: principalPolicyOrganizations.organizationId })
+        .from(principalPolicyOrganizations)
+        .where(wherePrincipal)
+        .limit(1);
+    if (stored && stored.organizationId !== organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "principal policy cache is already owned by another organization");
+    }
+    await tx
+        .insert(principalPolicyOrganizations)
+        .values({ ...input, organizationId })
+        .onConflictDoNothing()
+        .run();
+}
+export function recordPrincipalPolicyBundleOrganizationInTransaction(tx, bundle, organizationId) {
+    return recordPrincipalPolicyOrganizationInTransaction(tx, {
+        organizationId,
+        principalId: bundle.currentState.principalId,
+        principalType: bundle.currentState.principalType,
+    });
+}
+//# sourceMappingURL=principalPolicyOrganizationPersistence.js.map

package/data/persistence/principalPolicyOrganizationPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyOrganizationPersistence.js","sourceRoot":"","sources":["principalPolicyOrganizationPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAShE,SAAS,qBAAqB,CAC5B,KAAuC;IAEvC,IAAI,KAAK,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;QAC3C,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,cAAc,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,EAAgC,EAChC,KAAuC;IAEvC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,GAAG,CACxB,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EACnE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAChE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,CAAC;SACvE,IAAI,CAAC,4BAA4B,CAAC;SAClC,KAAK,CAAC,cAAc,CAAC;SACrB,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,4BAA4B,CAAC;SACpC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC;SACpC,mBAAmB,EAAE;SACrB,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,oDAAoD,CAClE,EAAgC,EAChC,MAAyD,EACzD,cAAmC;IAEnC,OAAO,8CAA8C,CAAC,EAAE,EAAE;QACxD,cAAc;QACd,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalPolicyOrganizations } from \"../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\ninterface PrincipalPolicyOrganizationInput {\n  readonly organizationId?: string | undefined;\n  readonly principalId: string;\n  readonly principalType: PrincipalStateResponse[\"principalType\"];\n}\n\nfunction resolveOrganizationId(\n  input: PrincipalPolicyOrganizationInput,\n): string {\n  if (input.principalType === \"organization\") {\n    if (\n      input.organizationId !== undefined &&\n      input.organizationId !== input.principalId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization policy cache ownership targets another organization\",\n      );\n    }\n    return input.principalId;\n  }\n  if (!input.organizationId) {\n    throw new Error(\"Group policy cache writes require an organization ID\");\n  }\n  return input.organizationId;\n}\n\n/** Pins cache ownership in the same transaction as the cached policy state. */\nexport async function recordPrincipalPolicyOrganizationInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  input: PrincipalPolicyOrganizationInput,\n): Promise<void> {\n  const organizationId = resolveOrganizationId(input);\n  const wherePrincipal = and(\n    eq(principalPolicyOrganizations.principalType, input.principalType),\n    eq(principalPolicyOrganizations.principalId, input.principalId),\n  );\n  const [stored] = await tx\n    .select({ organizationId: principalPolicyOrganizations.organizationId })\n    .from(principalPolicyOrganizations)\n    .where(wherePrincipal)\n    .limit(1);\n  if (stored && stored.organizationId !== organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy cache is already owned by another organization\",\n    );\n  }\n  await tx\n    .insert(principalPolicyOrganizations)\n    .values({ ...input, organizationId })\n    .onConflictDoNothing()\n    .run();\n}\n\nexport function recordPrincipalPolicyBundleOrganizationInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: { readonly currentState: PrincipalStateResponse },\n  organizationId?: string | undefined,\n): Promise<void> {\n  return recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: bundle.currentState.principalId,\n    principalType: bundle.currentState.principalType,\n  });\n}\n"]}

package/data/persistence/principalPolicyPersistence.js

@@ -0,0 +1,279 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { isPrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import { and, asc, eq } from "drizzle-orm";
+import { keyingCheckpointTables, principalPolicies, principalPolicyBundleHistory, principalPolicyCheckpoints, principalPolicyTables, } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { assertSameHeadPrincipalPolicyBundle } from "./principalPolicyBundleIntegrity.js";
+import { recordPrincipalPolicyBundleOrganizationInTransaction, recordPrincipalPolicyOrganizationInTransaction, } from "./principalPolicyOrganizationPersistence.js";
+import { indexPrincipalPolicyBundleInTransaction } from "./principalPolicyReferenceIndexPersistence.js";
+import { storedPrincipalPolicyBundleFromJson } from "./storedPrincipalPolicyBundle.js";
+function isManagedPrincipalType(value) {
+    return value === "group" || value === "organization";
+}
+function parsePrincipalPolicyRow(row) {
+    if (!isManagedPrincipalType(row.principalType)) {
+        return null;
+    }
+    return {
+        principalType: row.principalType,
+        principalId: row.principalId,
+        stateHash: row.stateHash,
+        currentStateJson: row.currentStateJson,
+        currentPayloadJson: row.currentPayloadJson,
+        currentProjectionJson: row.currentProjectionJson,
+        currentGrantsJson: row.currentGrantsJson,
+        currentMemberEnvelopesJson: row.currentMemberEnvelopesJson,
+        previousStatesJson: row.previousStatesJson,
+        updatedAt: row.updatedAt,
+    };
+}
+function parseStoredPrincipalPolicyHead(currentStateJson) {
+    try {
+        const value = JSON.parse(currentStateJson);
+        if (!value || typeof value !== "object") {
+            return null;
+        }
+        const stateHash = Reflect.get(value, "stateHash");
+        const version = Reflect.get(value, "version");
+        return typeof stateHash === "string" && typeof version === "number"
+            ? { stateHash, version }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function parsePrincipalPolicyBundle(row) {
+    const bundle = storedPrincipalPolicyBundleFromJson(row);
+    if (!isPrincipalPolicyBundleResponse(bundle)) {
+        throw new Error("Stored principal policy bundle is invalid");
+    }
+    return bundle;
+}
+export async function ensurePrincipalPolicyTables(execSql) {
+    await ensureSqlTables(execSql, principalPolicyTables);
+}
+/**
+ * The ONE select shape for a stored principal-policy bundle row, over either
+ * the mutable-head table or the retained-history table.
+ */
+export function principalPolicyBundleSelection(table) {
+    return {
+        principalType: table.principalType,
+        principalId: table.principalId,
+        stateHash: table.stateHash,
+        currentStateJson: table.currentStateJson,
+        currentPayloadJson: table.currentPayloadJson,
+        currentProjectionJson: table.currentProjectionJson,
+        currentGrantsJson: table.currentGrantsJson,
+        currentMemberEnvelopesJson: table.currentMemberEnvelopesJson,
+        previousStatesJson: table.previousStatesJson,
+        updatedAt: table.updatedAt,
+    };
+}
+export async function loadPrincipalPolicyBundle(execSql, principalType, principalId) {
+    await ensurePrincipalPolicyTables(execSql);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const rows = await db
+        .select(principalPolicyBundleSelection(principalPolicies))
+        .from(principalPolicies)
+        .where(and(eq(principalPolicies.principalType, principalType), eq(principalPolicies.principalId, principalId)))
+        .limit(1);
+    const row = rows[0] ? parsePrincipalPolicyRow(rows[0]) : null;
+    return row ? parsePrincipalPolicyBundle(row) : null;
+}
+export async function loadAllPrincipalPolicyBundles(execSql) {
+    await ensurePrincipalPolicyTables(execSql);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const rows = await db
+        .select(principalPolicyBundleSelection(principalPolicies))
+        .from(principalPolicies)
+        .orderBy(asc(principalPolicies.principalType), asc(principalPolicies.principalId));
+    const historyRows = await db
+        .select(principalPolicyBundleSelection(principalPolicyBundleHistory))
+        .from(principalPolicyBundleHistory)
+        .orderBy(asc(principalPolicyBundleHistory.principalType), asc(principalPolicyBundleHistory.principalId), asc(principalPolicyBundleHistory.stateHash));
+    const bundles = [];
+    for (const rawRow of [...rows, ...historyRows]) {
+        const row = parsePrincipalPolicyRow(rawRow);
+        if (!row) {
+            continue;
+        }
+        bundles.push(parsePrincipalPolicyBundle(row));
+    }
+    return bundles;
+}
+export async function loadPrincipalPolicyStateHash(execSql, principalType, principalId) {
+    await ensurePrincipalPolicyTables(execSql);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const rows = await db
+        .select({ stateHash: principalPolicies.stateHash })
+        .from(principalPolicies)
+        .where(and(eq(principalPolicies.principalType, principalType), eq(principalPolicies.principalId, principalId)))
+        .limit(1);
+    return rows[0]?.stateHash ?? null;
+}
+function policyBundleRow(bundle, updatedAt) {
+    return {
+        principalType: bundle.currentState.principalType,
+        principalId: bundle.currentState.principalId,
+        stateHash: bundle.currentState.stateHash,
+        currentStateJson: JSON.stringify(bundle.currentState),
+        currentPayloadJson: JSON.stringify(bundle.currentPayload),
+        currentProjectionJson: JSON.stringify(bundle.currentProjection),
+        currentGrantsJson: JSON.stringify(bundle.currentGrants),
+        currentMemberEnvelopesJson: JSON.stringify(bundle.currentMemberEnvelopes),
+        previousStatesJson: JSON.stringify(bundle.previousStates),
+        updatedAt,
+    };
+}
+function assertNoHeadConflict(incoming, checkpoint) {
+    if (checkpoint &&
+        incoming.version === checkpoint.version &&
+        incoming.stateHash !== checkpoint.stateHash) {
+        throw new KeyingVerificationError("equivocation", "principal policy bundle conflicts with the cached head at one version");
+    }
+}
+async function archiveOlderPolicyBundle(tx, storedPolicy, storedHead, incomingHead) {
+    if (!storedPolicy ||
+        !storedHead ||
+        storedHead.version >= incomingHead.version) {
+        return;
+    }
+    const archiveRow = parsePrincipalPolicyRow(storedPolicy);
+    if (!archiveRow) {
+        return;
+    }
+    try {
+        parsePrincipalPolicyBundle(archiveRow);
+        await tx
+            .insert(principalPolicyBundleHistory)
+            .values(archiveRow)
+            .onConflictDoNothing()
+            .run();
+    }
+    catch {
+        // A corrupt cache row is replaced, never retained as key material.
+    }
+}
+async function writePrincipalPolicyBundle(tx, bundle, nextRow, incomingHead) {
+    const wherePrincipal = and(eq(principalPolicies.principalType, nextRow.principalType), eq(principalPolicies.principalId, nextRow.principalId));
+    const [storedPolicy] = await tx
+        .select(principalPolicyBundleSelection(principalPolicies))
+        .from(principalPolicies)
+        .where(wherePrincipal)
+        .limit(1);
+    const [durableCheckpoint] = await tx
+        .select({
+        stateHash: principalPolicyCheckpoints.stateHash,
+        version: principalPolicyCheckpoints.version,
+    })
+        .from(principalPolicyCheckpoints)
+        .where(and(eq(principalPolicyCheckpoints.principalType, nextRow.principalType), eq(principalPolicyCheckpoints.principalId, nextRow.principalId)))
+        .limit(1);
+    const storedHead = storedPolicy
+        ? parseStoredPrincipalPolicyHead(storedPolicy.currentStateJson)
+        : null;
+    if (storedPolicy &&
+        storedHead?.version === incomingHead.version &&
+        storedHead.stateHash === incomingHead.stateHash) {
+        assertSameHeadPrincipalPolicyBundle(storedPolicy, nextRow);
+        await indexPrincipalPolicyBundleInTransaction(tx, bundle);
+        return;
+    }
+    const [retainedPolicy] = await tx
+        .select(principalPolicyBundleSelection(principalPolicyBundleHistory))
+        .from(principalPolicyBundleHistory)
+        .where(and(eq(principalPolicyBundleHistory.principalType, nextRow.principalType), eq(principalPolicyBundleHistory.principalId, nextRow.principalId), eq(principalPolicyBundleHistory.stateHash, nextRow.stateHash)))
+        .limit(1);
+    if (retainedPolicy) {
+        assertSameHeadPrincipalPolicyBundle(retainedPolicy, nextRow);
+        await indexPrincipalPolicyBundleInTransaction(tx, bundle);
+    }
+    const effectiveHead = durableCheckpoint &&
+        (!storedHead || durableCheckpoint.version >= storedHead.version)
+        ? durableCheckpoint
+        : storedHead;
+    assertNoHeadConflict(incomingHead, storedHead);
+    assertNoHeadConflict(incomingHead, durableCheckpoint ?? null);
+    if (effectiveHead && incomingHead.version < effectiveHead.version) {
+        return;
+    }
+    await archiveOlderPolicyBundle(tx, storedPolicy, storedHead, incomingHead);
+    await tx
+        .insert(principalPolicies)
+        .values(nextRow)
+        .onConflictDoUpdate({
+        target: [principalPolicies.principalType, principalPolicies.principalId],
+        set: nextRow,
+    })
+        .run();
+    await tx
+        .delete(principalPolicyBundleHistory)
+        .where(and(eq(principalPolicyBundleHistory.principalType, nextRow.principalType), eq(principalPolicyBundleHistory.principalId, nextRow.principalId), eq(principalPolicyBundleHistory.stateHash, nextRow.stateHash)))
+        .run();
+    await indexPrincipalPolicyBundleInTransaction(tx, bundle);
+}
+export async function writePrincipalPolicyBundleInTransaction(tx, bundle, updatedAt, organizationId) {
+    await recordPrincipalPolicyBundleOrganizationInTransaction(tx, bundle, organizationId);
+    await writePrincipalPolicyBundle(tx, bundle, policyBundleRow(bundle, updatedAt), bundle.currentState);
+}
+export async function assertPrincipalPolicyBundleStoredInTransaction(tx, bundle) {
+    const expected = policyBundleRow(bundle, bundle.currentState.createdAt);
+    const [stored] = await tx
+        .select(principalPolicyBundleSelection(principalPolicies))
+        .from(principalPolicies)
+        .where(and(eq(principalPolicies.principalType, expected.principalType), eq(principalPolicies.principalId, expected.principalId)))
+        .limit(1);
+    if (!stored) {
+        throw new Error("Verified principal policy bundle was not persisted");
+    }
+    assertSameHeadPrincipalPolicyBundle(stored, expected);
+}
+export async function retainPrincipalPolicyBundleInTransaction(tx, bundle, updatedAt, organizationId) {
+    const row = policyBundleRow(bundle, updatedAt);
+    await recordPrincipalPolicyOrganizationInTransaction(tx, {
+        organizationId,
+        principalId: row.principalId,
+        principalType: row.principalType,
+    });
+    const [current] = await tx
+        .select(principalPolicyBundleSelection(principalPolicies))
+        .from(principalPolicies)
+        .where(and(eq(principalPolicies.principalType, row.principalType), eq(principalPolicies.principalId, row.principalId)))
+        .limit(1);
+    if (current?.stateHash === row.stateHash) {
+        assertSameHeadPrincipalPolicyBundle(current, row);
+        await indexPrincipalPolicyBundleInTransaction(tx, bundle);
+        return;
+    }
+    const [retained] = await tx
+        .select(principalPolicyBundleSelection(principalPolicyBundleHistory))
+        .from(principalPolicyBundleHistory)
+        .where(and(eq(principalPolicyBundleHistory.principalType, row.principalType), eq(principalPolicyBundleHistory.principalId, row.principalId), eq(principalPolicyBundleHistory.stateHash, row.stateHash)))
+        .limit(1);
+    if (retained) {
+        assertSameHeadPrincipalPolicyBundle(retained, row);
+        await indexPrincipalPolicyBundleInTransaction(tx, bundle);
+        return;
+    }
+    await tx.insert(principalPolicyBundleHistory).values(row).run();
+    await indexPrincipalPolicyBundleInTransaction(tx, bundle);
+}
+export async function savePrincipalPolicyBundle(execSql, bundle, updatedAt, organizationId, options) {
+    await ensureSqlTables(execSql, [
+        ...principalPolicyTables,
+        ...keyingCheckpointTables,
+    ]);
+    const runtime = getClientSQLitePersistenceRuntime(execSql);
+    const save = (tx) => writePrincipalPolicyBundleInTransaction(tx, bundle, updatedAt, organizationId);
+    if (options?.stillCurrent) {
+        await runtime.guardedTransaction(save, options.stillCurrent, {
+            behavior: "immediate",
+        });
+        return;
+    }
+    await runtime.transaction(save, { behavior: "immediate" });
+}
+//# sourceMappingURL=principalPolicyPersistence.js.map

package/data/persistence/principalPolicyPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyPersistence.js","sourceRoot":"","sources":["principalPolicyPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAK5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,oDAAoD,EACpD,8CAA8C,GAC/C,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uCAAuC,EAAE,MAAM,4CAA4C,CAAC;AACrG,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAiCpF,SAAS,sBAAsB,CAC7B,KAAa;IAEb,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,cAAc,CAAC;AACvD,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAA+B;IAE/B,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,0BAA0B,EAAE,GAAG,CAAC,0BAA0B;QAC1D,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,gBAAwB;IAExB,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ;YACjE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE;YACxB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,GAAuB;IAEvB,MAAM,MAAM,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC;IAExD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB;IAEhB,MAAM,eAAe,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AACxD,CAAC;AAMD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAiC;IAEjC,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,aAAsD,EACtD,WAAmB;IAEnB,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;SACzD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,EAClD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB;IAEhB,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;SACzD,IAAI,CAAC,iBAAiB,CAAC;SACvB,OAAO,CACN,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC,EACpC,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CACnC,CAAC;IACJ,MAAM,WAAW,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC,8BAA8B,CAAC,4BAA4B,CAAC,CAAC;SACpE,IAAI,CAAC,4BAA4B,CAAC;SAClC,OAAO,CACN,GAAG,CAAC,4BAA4B,CAAC,aAAa,CAAC,EAC/C,GAAG,CAAC,4BAA4B,CAAC,WAAW,CAAC,EAC7C,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAC5C,CAAC;IAEJ,MAAM,OAAO,GAAoC,EAAE,CAAC;IAEpD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,aAAsD,EACtD,WAAmB;IAEnB,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC;SAClD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,EAClD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CACtB,MAAqC,EACrC,SAAiB;IAEjB,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;QACrD,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;QACzD,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/D,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC;QACvD,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACzE,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;QACzD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAmC,EACnC,UAA4C;IAE5C,IACE,UAAU;QACV,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;QACvC,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,uEAAuE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,EAAgC,EAChC,YAAoD,EACpD,UAA4C,EAC5C,YAAuC;IAEvC,IACE,CAAC,YAAY;QACb,CAAC,UAAU;QACX,UAAU,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,EAC1C,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,0BAA0B,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,EAAE;aACL,MAAM,CAAC,4BAA4B,CAAC;aACpC,MAAM,CAAC,UAAU,CAAC;aAClB,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,EAAgC,EAChC,MAAqC,EACrC,OAA2B,EAC3B,YAAuC;IAEvC,MAAM,cAAc,GAAG,GAAG,CACxB,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,EAC1D,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CACvD,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE;SAC5B,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;SACzD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,cAAc,CAAC;SACrB,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM,EAAE;SACjC,MAAM,CAAC;QACN,SAAS,EAAE,0BAA0B,CAAC,SAAS;QAC/C,OAAO,EAAE,0BAA0B,CAAC,OAAO;KAC5C,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,EACnE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAChE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,UAAU,GAAG,YAAY;QAC7B,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,gBAAgB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACT,IACE,YAAY;QACZ,UAAU,EAAE,OAAO,KAAK,YAAY,CAAC,OAAO;QAC5C,UAAU,CAAC,SAAS,KAAK,YAAY,CAAC,SAAS,EAC/C,CAAC;QACD,mCAAmC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,uCAAuC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE;SAC9B,MAAM,CAAC,8BAA8B,CAAC,4BAA4B,CAAC,CAAC;SACpE,IAAI,CAAC,4BAA4B,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,EACrE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EACjE,EAAE,CAAC,4BAA4B,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAC9D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,cAAc,EAAE,CAAC;QACnB,mCAAmC,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,uCAAuC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,aAAa,GACjB,iBAAiB;QACjB,CAAC,CAAC,UAAU,IAAI,iBAAiB,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAC9D,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,UAAU,CAAC;IACjB,oBAAoB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC/C,oBAAoB,CAAC,YAAY,EAAE,iBAAiB,IAAI,IAAI,CAAC,CAAC;IAC9D,IAAI,aAAa,IAAI,YAAY,CAAC,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,wBAAwB,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3E,MAAM,EAAE;SACL,MAAM,CAAC,iBAAiB,CAAC;SACzB,MAAM,CAAC,OAAO,CAAC;SACf,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,WAAW,CAAC;QACxE,GAAG,EAAE,OAAO;KACb,CAAC;SACD,GAAG,EAAE,CAAC;IACT,MAAM,EAAE;SACL,MAAM,CAAC,4BAA4B,CAAC;SACpC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,EACrE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EACjE,EAAE,CAAC,4BAA4B,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAC9D,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,uCAAuC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,EAAgC,EAChC,MAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,oDAAoD,CACxD,EAAE,EACF,MAAM,EACN,cAAc,CACf,CAAC;IACF,MAAM,0BAA0B,CAC9B,EAAE,EACF,MAAM,EACN,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,EAClC,MAAM,CAAC,YAAY,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,EAAgC,EAChC,MAAqC;IAErC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;SACzD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EAC3D,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACxD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,mCAAmC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,EAAgC,EAChC,MAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;SACzD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,EACtD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CACnD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QACzC,mCAAmC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,uCAAuC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,8BAA8B,CAAC,4BAA4B,CAAC,CAAC;SACpE,IAAI,CAAC,4BAA4B,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,EACjE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,EAC7D,EAAE,CAAC,4BAA4B,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,QAAQ,EAAE,CAAC;QACb,mCAAmC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,uCAAuC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAChE,MAAM,uCAAuC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,MAAqC,EACrC,SAAiB,EACjB,cAAsB,EACtB,OAAoE;IAEpE,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,CAAC,EAAgC,EAAE,EAAE,CAChD,uCAAuC,CACrC,EAAE,EACF,MAAM,EACN,SAAS,EACT,cAAc,CACf,CAAC;IACJ,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QAC1B,MAAM,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE;YAC3D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { isPrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { and, asc, eq } from \"drizzle-orm\";\nimport {\n  keyingCheckpointTables,\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyCheckpoints,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { assertSameHeadPrincipalPolicyBundle } from \"./principalPolicyBundleIntegrity\";\nimport {\n  recordPrincipalPolicyBundleOrganizationInTransaction,\n  recordPrincipalPolicyOrganizationInTransaction,\n} from \"./principalPolicyOrganizationPersistence\";\nimport { indexPrincipalPolicyBundleInTransaction } from \"./principalPolicyReferenceIndexPersistence\";\nimport { storedPrincipalPolicyBundleFromJson } from \"./storedPrincipalPolicyBundle\";\n\ninterface PrincipalPolicyRow {\n  principalType: \"group\" | \"organization\";\n  principalId: string;\n  stateHash: string;\n  currentStateJson: string;\n  currentPayloadJson: string;\n  currentProjectionJson: string;\n  currentGrantsJson: string;\n  currentMemberEnvelopesJson: string;\n  previousStatesJson: string;\n  updatedAt: string;\n}\n\nexport interface SelectedPrincipalPolicyRow {\n  principalType: string;\n  principalId: string;\n  stateHash: string;\n  currentStateJson: string;\n  currentPayloadJson: string;\n  currentProjectionJson: string;\n  currentGrantsJson: string;\n  currentMemberEnvelopesJson: string;\n  previousStatesJson: string;\n  updatedAt: string;\n}\n\ninterface StoredPrincipalPolicyHead {\n  readonly stateHash: string;\n  readonly version: number;\n}\n\nfunction isManagedPrincipalType(\n  value: string,\n): value is PrincipalStateResponse[\"principalType\"] {\n  return value === \"group\" || value === \"organization\";\n}\n\nfunction parsePrincipalPolicyRow(\n  row: SelectedPrincipalPolicyRow,\n): PrincipalPolicyRow | null {\n  if (!isManagedPrincipalType(row.principalType)) {\n    return null;\n  }\n\n  return {\n    principalType: row.principalType,\n    principalId: row.principalId,\n    stateHash: row.stateHash,\n    currentStateJson: row.currentStateJson,\n    currentPayloadJson: row.currentPayloadJson,\n    currentProjectionJson: row.currentProjectionJson,\n    currentGrantsJson: row.currentGrantsJson,\n    currentMemberEnvelopesJson: row.currentMemberEnvelopesJson,\n    previousStatesJson: row.previousStatesJson,\n    updatedAt: row.updatedAt,\n  };\n}\n\nfunction parseStoredPrincipalPolicyHead(\n  currentStateJson: string,\n): StoredPrincipalPolicyHead | null {\n  try {\n    const value: unknown = JSON.parse(currentStateJson);\n    if (!value || typeof value !== \"object\") {\n      return null;\n    }\n    const stateHash = Reflect.get(value, \"stateHash\");\n    const version = Reflect.get(value, \"version\");\n    return typeof stateHash === \"string\" && typeof version === \"number\"\n      ? { stateHash, version }\n      : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction parsePrincipalPolicyBundle(\n  row: PrincipalPolicyRow,\n): PrincipalPolicyBundleResponse {\n  const bundle = storedPrincipalPolicyBundleFromJson(row);\n\n  if (!isPrincipalPolicyBundleResponse(bundle)) {\n    throw new Error(\"Stored principal policy bundle is invalid\");\n  }\n\n  return bundle;\n}\n\nexport async function ensurePrincipalPolicyTables(\n  execSql: ExecSql,\n): Promise<void> {\n  await ensureSqlTables(execSql, principalPolicyTables);\n}\n\ntype PrincipalPolicyBundleTable =\n  | typeof principalPolicies\n  | typeof principalPolicyBundleHistory;\n\n/**\n * The ONE select shape for a stored principal-policy bundle row, over either\n * the mutable-head table or the retained-history table.\n */\nexport function principalPolicyBundleSelection(\n  table: PrincipalPolicyBundleTable,\n) {\n  return {\n    principalType: table.principalType,\n    principalId: table.principalId,\n    stateHash: table.stateHash,\n    currentStateJson: table.currentStateJson,\n    currentPayloadJson: table.currentPayloadJson,\n    currentProjectionJson: table.currentProjectionJson,\n    currentGrantsJson: table.currentGrantsJson,\n    currentMemberEnvelopesJson: table.currentMemberEnvelopesJson,\n    previousStatesJson: table.previousStatesJson,\n    updatedAt: table.updatedAt,\n  };\n}\n\nexport async function loadPrincipalPolicyBundle(\n  execSql: ExecSql,\n  principalType: PrincipalStateResponse[\"principalType\"],\n  principalId: string,\n): Promise<PrincipalPolicyBundleResponse | null> {\n  await ensurePrincipalPolicyTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select(principalPolicyBundleSelection(principalPolicies))\n    .from(principalPolicies)\n    .where(\n      and(\n        eq(principalPolicies.principalType, principalType),\n        eq(principalPolicies.principalId, principalId),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0] ? parsePrincipalPolicyRow(rows[0]) : null;\n  return row ? parsePrincipalPolicyBundle(row) : null;\n}\n\nexport async function loadAllPrincipalPolicyBundles(\n  execSql: ExecSql,\n): Promise<PrincipalPolicyBundleResponse[]> {\n  await ensurePrincipalPolicyTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select(principalPolicyBundleSelection(principalPolicies))\n    .from(principalPolicies)\n    .orderBy(\n      asc(principalPolicies.principalType),\n      asc(principalPolicies.principalId),\n    );\n  const historyRows = await db\n    .select(principalPolicyBundleSelection(principalPolicyBundleHistory))\n    .from(principalPolicyBundleHistory)\n    .orderBy(\n      asc(principalPolicyBundleHistory.principalType),\n      asc(principalPolicyBundleHistory.principalId),\n      asc(principalPolicyBundleHistory.stateHash),\n    );\n\n  const bundles: PrincipalPolicyBundleResponse[] = [];\n\n  for (const rawRow of [...rows, ...historyRows]) {\n    const row = parsePrincipalPolicyRow(rawRow);\n\n    if (!row) {\n      continue;\n    }\n\n    bundles.push(parsePrincipalPolicyBundle(row));\n  }\n\n  return bundles;\n}\n\nexport async function loadPrincipalPolicyStateHash(\n  execSql: ExecSql,\n  principalType: PrincipalStateResponse[\"principalType\"],\n  principalId: string,\n): Promise<string | null> {\n  await ensurePrincipalPolicyTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select({ stateHash: principalPolicies.stateHash })\n    .from(principalPolicies)\n    .where(\n      and(\n        eq(principalPolicies.principalType, principalType),\n        eq(principalPolicies.principalId, principalId),\n      ),\n    )\n    .limit(1);\n\n  return rows[0]?.stateHash ?? null;\n}\n\nfunction policyBundleRow(\n  bundle: PrincipalPolicyBundleResponse,\n  updatedAt: string,\n): PrincipalPolicyRow {\n  return {\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    stateHash: bundle.currentState.stateHash,\n    currentStateJson: JSON.stringify(bundle.currentState),\n    currentPayloadJson: JSON.stringify(bundle.currentPayload),\n    currentProjectionJson: JSON.stringify(bundle.currentProjection),\n    currentGrantsJson: JSON.stringify(bundle.currentGrants),\n    currentMemberEnvelopesJson: JSON.stringify(bundle.currentMemberEnvelopes),\n    previousStatesJson: JSON.stringify(bundle.previousStates),\n    updatedAt,\n  };\n}\n\nfunction assertNoHeadConflict(\n  incoming: StoredPrincipalPolicyHead,\n  checkpoint: StoredPrincipalPolicyHead | null,\n): void {\n  if (\n    checkpoint &&\n    incoming.version === checkpoint.version &&\n    incoming.stateHash !== checkpoint.stateHash\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy bundle conflicts with the cached head at one version\",\n    );\n  }\n}\n\nasync function archiveOlderPolicyBundle(\n  tx: ClientSQLiteTransactionScope,\n  storedPolicy: SelectedPrincipalPolicyRow | undefined,\n  storedHead: StoredPrincipalPolicyHead | null,\n  incomingHead: StoredPrincipalPolicyHead,\n): Promise<void> {\n  if (\n    !storedPolicy ||\n    !storedHead ||\n    storedHead.version >= incomingHead.version\n  ) {\n    return;\n  }\n  const archiveRow = parsePrincipalPolicyRow(storedPolicy);\n  if (!archiveRow) {\n    return;\n  }\n  try {\n    parsePrincipalPolicyBundle(archiveRow);\n    await tx\n      .insert(principalPolicyBundleHistory)\n      .values(archiveRow)\n      .onConflictDoNothing()\n      .run();\n  } catch {\n    // A corrupt cache row is replaced, never retained as key material.\n  }\n}\n\nasync function writePrincipalPolicyBundle(\n  tx: ClientSQLiteTransactionScope,\n  bundle: PrincipalPolicyBundleResponse,\n  nextRow: PrincipalPolicyRow,\n  incomingHead: StoredPrincipalPolicyHead,\n): Promise<void> {\n  const wherePrincipal = and(\n    eq(principalPolicies.principalType, nextRow.principalType),\n    eq(principalPolicies.principalId, nextRow.principalId),\n  );\n  const [storedPolicy] = await tx\n    .select(principalPolicyBundleSelection(principalPolicies))\n    .from(principalPolicies)\n    .where(wherePrincipal)\n    .limit(1);\n  const [durableCheckpoint] = await tx\n    .select({\n      stateHash: principalPolicyCheckpoints.stateHash,\n      version: principalPolicyCheckpoints.version,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, nextRow.principalType),\n        eq(principalPolicyCheckpoints.principalId, nextRow.principalId),\n      ),\n    )\n    .limit(1);\n  const storedHead = storedPolicy\n    ? parseStoredPrincipalPolicyHead(storedPolicy.currentStateJson)\n    : null;\n  if (\n    storedPolicy &&\n    storedHead?.version === incomingHead.version &&\n    storedHead.stateHash === incomingHead.stateHash\n  ) {\n    assertSameHeadPrincipalPolicyBundle(storedPolicy, nextRow);\n    await indexPrincipalPolicyBundleInTransaction(tx, bundle);\n    return;\n  }\n  const [retainedPolicy] = await tx\n    .select(principalPolicyBundleSelection(principalPolicyBundleHistory))\n    .from(principalPolicyBundleHistory)\n    .where(\n      and(\n        eq(principalPolicyBundleHistory.principalType, nextRow.principalType),\n        eq(principalPolicyBundleHistory.principalId, nextRow.principalId),\n        eq(principalPolicyBundleHistory.stateHash, nextRow.stateHash),\n      ),\n    )\n    .limit(1);\n  if (retainedPolicy) {\n    assertSameHeadPrincipalPolicyBundle(retainedPolicy, nextRow);\n    await indexPrincipalPolicyBundleInTransaction(tx, bundle);\n  }\n  const effectiveHead =\n    durableCheckpoint &&\n    (!storedHead || durableCheckpoint.version >= storedHead.version)\n      ? durableCheckpoint\n      : storedHead;\n  assertNoHeadConflict(incomingHead, storedHead);\n  assertNoHeadConflict(incomingHead, durableCheckpoint ?? null);\n  if (effectiveHead && incomingHead.version < effectiveHead.version) {\n    return;\n  }\n\n  await archiveOlderPolicyBundle(tx, storedPolicy, storedHead, incomingHead);\n  await tx\n    .insert(principalPolicies)\n    .values(nextRow)\n    .onConflictDoUpdate({\n      target: [principalPolicies.principalType, principalPolicies.principalId],\n      set: nextRow,\n    })\n    .run();\n  await tx\n    .delete(principalPolicyBundleHistory)\n    .where(\n      and(\n        eq(principalPolicyBundleHistory.principalType, nextRow.principalType),\n        eq(principalPolicyBundleHistory.principalId, nextRow.principalId),\n        eq(principalPolicyBundleHistory.stateHash, nextRow.stateHash),\n      ),\n    )\n    .run();\n  await indexPrincipalPolicyBundleInTransaction(tx, bundle);\n}\n\nexport async function writePrincipalPolicyBundleInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: PrincipalPolicyBundleResponse,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyBundleOrganizationInTransaction(\n    tx,\n    bundle,\n    organizationId,\n  );\n  await writePrincipalPolicyBundle(\n    tx,\n    bundle,\n    policyBundleRow(bundle, updatedAt),\n    bundle.currentState,\n  );\n}\n\nexport async function assertPrincipalPolicyBundleStoredInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<void> {\n  const expected = policyBundleRow(bundle, bundle.currentState.createdAt);\n  const [stored] = await tx\n    .select(principalPolicyBundleSelection(principalPolicies))\n    .from(principalPolicies)\n    .where(\n      and(\n        eq(principalPolicies.principalType, expected.principalType),\n        eq(principalPolicies.principalId, expected.principalId),\n      ),\n    )\n    .limit(1);\n  if (!stored) {\n    throw new Error(\"Verified principal policy bundle was not persisted\");\n  }\n  assertSameHeadPrincipalPolicyBundle(stored, expected);\n}\n\nexport async function retainPrincipalPolicyBundleInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: PrincipalPolicyBundleResponse,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  const row = policyBundleRow(bundle, updatedAt);\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: row.principalId,\n    principalType: row.principalType,\n  });\n  const [current] = await tx\n    .select(principalPolicyBundleSelection(principalPolicies))\n    .from(principalPolicies)\n    .where(\n      and(\n        eq(principalPolicies.principalType, row.principalType),\n        eq(principalPolicies.principalId, row.principalId),\n      ),\n    )\n    .limit(1);\n  if (current?.stateHash === row.stateHash) {\n    assertSameHeadPrincipalPolicyBundle(current, row);\n    await indexPrincipalPolicyBundleInTransaction(tx, bundle);\n    return;\n  }\n  const [retained] = await tx\n    .select(principalPolicyBundleSelection(principalPolicyBundleHistory))\n    .from(principalPolicyBundleHistory)\n    .where(\n      and(\n        eq(principalPolicyBundleHistory.principalType, row.principalType),\n        eq(principalPolicyBundleHistory.principalId, row.principalId),\n        eq(principalPolicyBundleHistory.stateHash, row.stateHash),\n      ),\n    )\n    .limit(1);\n  if (retained) {\n    assertSameHeadPrincipalPolicyBundle(retained, row);\n    await indexPrincipalPolicyBundleInTransaction(tx, bundle);\n    return;\n  }\n  await tx.insert(principalPolicyBundleHistory).values(row).run();\n  await indexPrincipalPolicyBundleInTransaction(tx, bundle);\n}\n\nexport async function savePrincipalPolicyBundle(\n  execSql: ExecSql,\n  bundle: PrincipalPolicyBundleResponse,\n  updatedAt: string,\n  organizationId: string,\n  options?: { stillCurrent?: (() => boolean) | undefined } | undefined,\n): Promise<void> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const save = (tx: ClientSQLiteTransactionScope) =>\n    writePrincipalPolicyBundleInTransaction(\n      tx,\n      bundle,\n      updatedAt,\n      organizationId,\n    );\n  if (options?.stillCurrent) {\n    await runtime.guardedTransaction(save, options.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(save, { behavior: \"immediate\" });\n}\n"]}

package/data/persistence/principalPolicyReferenceCheckpoint.js

@@ -0,0 +1,27 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { principalPolicyBundleStates } from "../principalPolicyStates.js";
+import { assertPrincipalPolicyCheckpointShape } from "./keyingCheckpointPersistence.js";
+export function applyPrincipalPolicyReferenceCheckpoint(bundle, checkpoint) {
+    if (!checkpoint) {
+        return bundle;
+    }
+    assertPrincipalPolicyCheckpointShape(checkpoint, bundle.currentState);
+    if (bundle.currentState.version < checkpoint.version) {
+        return null;
+    }
+    if (bundle.currentState.version === checkpoint.version) {
+        if (bundle.currentState.stateHash !== checkpoint.stateHash) {
+            throw new KeyingVerificationError("equivocation", "principal policy head conflicts with the local checkpoint");
+        }
+        return bundle;
+    }
+    const checkpointStates = principalPolicyBundleStates(bundle).filter((state) => state.version === checkpoint.version);
+    if (checkpointStates.length === 0) {
+        throw new KeyingVerificationError("stale_predecessor", "principal policy chain does not extend the local checkpoint");
+    }
+    if (checkpointStates.some((state) => state.stateHash !== checkpoint.stateHash)) {
+        throw new KeyingVerificationError("equivocation", "principal policy chain conflicts with the local checkpoint");
+    }
+    return bundle;
+}
+//# sourceMappingURL=principalPolicyReferenceCheckpoint.js.map

package/data/persistence/principalPolicyReferenceCheckpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyReferenceCheckpoint.js","sourceRoot":"","sources":["principalPolicyReferenceCheckpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AAErF,MAAM,UAAU,uCAAuC,CACrD,MAAqC,EACrC,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YAC3D,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,MAAM,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAChD,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IACE,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { principalPolicyBundleStates } from \"../principalPolicyStates\";\nimport { assertPrincipalPolicyCheckpointShape } from \"./keyingCheckpointPersistence\";\n\nexport function applyPrincipalPolicyReferenceCheckpoint(\n  bundle: PrincipalPolicyBundleResponse,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): PrincipalPolicyBundleResponse | null {\n  if (!checkpoint) {\n    return bundle;\n  }\n  assertPrincipalPolicyCheckpointShape(checkpoint, bundle.currentState);\n  if (bundle.currentState.version < checkpoint.version) {\n    return null;\n  }\n  if (bundle.currentState.version === checkpoint.version) {\n    if (bundle.currentState.stateHash !== checkpoint.stateHash) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"principal policy head conflicts with the local checkpoint\",\n      );\n    }\n    return bundle;\n  }\n  const checkpointStates = principalPolicyBundleStates(bundle).filter(\n    (state) => state.version === checkpoint.version,\n  );\n  if (checkpointStates.length === 0) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"principal policy chain does not extend the local checkpoint\",\n    );\n  }\n  if (\n    checkpointStates.some((state) => state.stateHash !== checkpoint.stateHash)\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy chain conflicts with the local checkpoint\",\n    );\n  }\n  return bundle;\n}\n"]}