@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/persistence/principalPolicyReferenceIndexPersistence.js

@@ -0,0 +1,52 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalPolicyBundleStates } from "../principalPolicyStates.js";
+import { principalPolicyBundleReferences } from "../sqlite/schema.js";
+function exactReferenceWhere(row) {
+    return and(eq(principalPolicyBundleReferences.principalType, row.principalType), eq(principalPolicyBundleReferences.principalId, row.principalId), eq(principalPolicyBundleReferences.version, row.version), eq(principalPolicyBundleReferences.stateHash, row.stateHash), eq(principalPolicyBundleReferences.keyEpoch, row.keyEpoch), eq(principalPolicyBundleReferences.keyFingerprint, row.keyFingerprint));
+}
+async function assertNoIndexedConflict(tx, row) {
+    const conflicts = await tx
+        .select({
+        bundleStateHash: principalPolicyBundleReferences.bundleStateHash,
+    })
+        .from(principalPolicyBundleReferences)
+        .where(and(exactReferenceWhere(row), eq(principalPolicyBundleReferences.bundleVersion, row.bundleVersion)));
+    if (conflicts.some(({ bundleStateHash }) => bundleStateHash !== row.bundleStateHash)) {
+        throw new KeyingVerificationError("equivocation", "principal policy reference has conflicting bundle heads at one version");
+    }
+}
+export async function indexPrincipalPolicyBundleInTransaction(tx, bundle) {
+    const head = bundle.currentState;
+    for (const state of principalPolicyBundleStates(bundle)) {
+        if (state.principalType !== head.principalType ||
+            state.principalId !== head.principalId) {
+            throw new KeyingVerificationError("object_mismatch", "principal policy bundle reference belongs to another principal");
+        }
+        const row = {
+            principalType: state.principalType,
+            principalId: state.principalId,
+            version: state.version,
+            stateHash: state.stateHash,
+            keyEpoch: state.keyEpoch,
+            keyFingerprint: state.keyFingerprint,
+            bundleVersion: head.version,
+            bundleStateHash: head.stateHash,
+        };
+        await assertNoIndexedConflict(tx, row);
+        await tx
+            .insert(principalPolicyBundleReferences)
+            .values(row)
+            .onConflictDoNothing()
+            .run();
+        const [stored] = await tx
+            .select({ bundleVersion: principalPolicyBundleReferences.bundleVersion })
+            .from(principalPolicyBundleReferences)
+            .where(and(exactReferenceWhere(row), eq(principalPolicyBundleReferences.bundleStateHash, row.bundleStateHash)))
+            .limit(1);
+        if (stored?.bundleVersion !== row.bundleVersion) {
+            throw new KeyingVerificationError("equivocation", "principal policy reference index conflicts with the bundle head");
+        }
+    }
+}
+//# sourceMappingURL=principalPolicyReferenceIndexPersistence.js.map

package/data/persistence/principalPolicyReferenceIndexPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyReferenceIndexPersistence.js","sourceRoot":"","sources":["principalPolicyReferenceIndexPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAMnE,SAAS,mBAAmB,CAAC,GAAgC;IAC3D,OAAO,GAAG,CACR,EAAE,CAAC,+BAA+B,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,+BAA+B,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,EAChE,EAAE,CAAC,+BAA+B,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EACxD,EAAE,CAAC,+BAA+B,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAC5D,EAAE,CAAC,+BAA+B,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,EAC1D,EAAE,CAAC,+BAA+B,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,EAAgC,EAChC,GAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC;QACN,eAAe,EAAE,+BAA+B,CAAC,eAAe;KACjE,CAAC;SACD,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,mBAAmB,CAAC,GAAG,CAAC,EACxB,EAAE,CAAC,+BAA+B,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CACrE,CACF,CAAC;IACJ,IACE,SAAS,CAAC,IAAI,CACZ,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe,CACjE,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,EAAgC,EAChC,MAAqC;IAErC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IACE,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EACtC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAgC;YACvC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,eAAe,EAAE,IAAI,CAAC,SAAS;SAChC,CAAC;QACF,MAAM,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE;aACL,MAAM,CAAC,+BAA+B,CAAC;aACvC,MAAM,CAAC,GAAG,CAAC;aACX,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,aAAa,EAAE,+BAA+B,CAAC,aAAa,EAAE,CAAC;aACxE,IAAI,CAAC,+BAA+B,CAAC;aACrC,KAAK,CACJ,GAAG,CACD,mBAAmB,CAAC,GAAG,CAAC,EACxB,EAAE,CACA,+BAA+B,CAAC,eAAe,EAC/C,GAAG,CAAC,eAAe,CACpB,CACF,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM,EAAE,aAAa,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalPolicyBundleStates } from \"../principalPolicyStates\";\nimport { principalPolicyBundleReferences } from \"../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\ntype PrincipalPolicyReferenceRow =\n  typeof principalPolicyBundleReferences.$inferInsert;\n\nfunction exactReferenceWhere(row: PrincipalPolicyReferenceRow) {\n  return and(\n    eq(principalPolicyBundleReferences.principalType, row.principalType),\n    eq(principalPolicyBundleReferences.principalId, row.principalId),\n    eq(principalPolicyBundleReferences.version, row.version),\n    eq(principalPolicyBundleReferences.stateHash, row.stateHash),\n    eq(principalPolicyBundleReferences.keyEpoch, row.keyEpoch),\n    eq(principalPolicyBundleReferences.keyFingerprint, row.keyFingerprint),\n  );\n}\n\nasync function assertNoIndexedConflict(\n  tx: ClientSQLiteTransactionScope,\n  row: PrincipalPolicyReferenceRow,\n): Promise<void> {\n  const conflicts = await tx\n    .select({\n      bundleStateHash: principalPolicyBundleReferences.bundleStateHash,\n    })\n    .from(principalPolicyBundleReferences)\n    .where(\n      and(\n        exactReferenceWhere(row),\n        eq(principalPolicyBundleReferences.bundleVersion, row.bundleVersion),\n      ),\n    );\n  if (\n    conflicts.some(\n      ({ bundleStateHash }) => bundleStateHash !== row.bundleStateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy reference has conflicting bundle heads at one version\",\n    );\n  }\n}\n\nexport async function indexPrincipalPolicyBundleInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<void> {\n  const head = bundle.currentState;\n  for (const state of principalPolicyBundleStates(bundle)) {\n    if (\n      state.principalType !== head.principalType ||\n      state.principalId !== head.principalId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"principal policy bundle reference belongs to another principal\",\n      );\n    }\n    const row: PrincipalPolicyReferenceRow = {\n      principalType: state.principalType,\n      principalId: state.principalId,\n      version: state.version,\n      stateHash: state.stateHash,\n      keyEpoch: state.keyEpoch,\n      keyFingerprint: state.keyFingerprint,\n      bundleVersion: head.version,\n      bundleStateHash: head.stateHash,\n    };\n    await assertNoIndexedConflict(tx, row);\n    await tx\n      .insert(principalPolicyBundleReferences)\n      .values(row)\n      .onConflictDoNothing()\n      .run();\n    const [stored] = await tx\n      .select({ bundleVersion: principalPolicyBundleReferences.bundleVersion })\n      .from(principalPolicyBundleReferences)\n      .where(\n        and(\n          exactReferenceWhere(row),\n          eq(\n            principalPolicyBundleReferences.bundleStateHash,\n            row.bundleStateHash,\n          ),\n        ),\n      )\n      .limit(1);\n    if (stored?.bundleVersion !== row.bundleVersion) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"principal policy reference index conflicts with the bundle head\",\n      );\n    }\n  }\n}\n"]}

package/data/persistence/principalPolicyReferencePersistence.js

@@ -0,0 +1,215 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { isPrincipalPolicyBundleResponse, isReferencedPrincipalStateResponse, } from "../../internal/validators/response/index.js";
+import { and, eq, inArray } from "drizzle-orm";
+import { principalPolicyBundleContainsReference, principalPolicyBundleStates, } from "../principalPolicyStates.js";
+import { principalPolicies, principalPolicyBundleHistory, principalPolicyBundleReferences, } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { assertSameHeadPrincipalPolicyBundle } from "./principalPolicyBundleIntegrity.js";
+import { ensurePrincipalPolicyTables, principalPolicyBundleSelection, } from "./principalPolicyPersistence.js";
+import { applyPrincipalPolicyReferenceCheckpoint } from "./principalPolicyReferenceCheckpoint.js";
+import { storedPrincipalPolicyBundleFromJson } from "./storedPrincipalPolicyBundle.js";
+function assertUnambiguousBundleChain(bundle) {
+    const states = principalPolicyBundleStates(bundle);
+    if (states.length !== bundle.currentState.version) {
+        throw new KeyingVerificationError("missing_dependency", "stored principal policy bundle chain length does not match its head");
+    }
+    const versions = new Map();
+    for (const [index, state] of states.entries()) {
+        if (state.principalType !== bundle.currentState.principalType ||
+            state.principalId !== bundle.currentState.principalId) {
+            throw new KeyingVerificationError("object_mismatch", "stored principal policy bundle chain belongs to another principal");
+        }
+        if (!Number.isInteger(state.version) ||
+            state.version !== index + 1 ||
+            !Number.isInteger(state.keyEpoch) ||
+            state.keyEpoch < 1 ||
+            state.principalId.length === 0 ||
+            state.stateHash.length === 0 ||
+            state.keyFingerprint.length === 0) {
+            throw new KeyingVerificationError("invalid_shape", "stored principal policy bundle chain has an invalid version or epoch");
+        }
+        if (versions.has(state.version)) {
+            const previousHash = versions.get(state.version);
+            throw new KeyingVerificationError(previousHash === state.stateHash ? "duplicate_entry" : "equivocation", "stored principal policy bundle chain repeats a version");
+        }
+        versions.set(state.version, state.stateHash);
+    }
+}
+function parseBoundBundle(row) {
+    let bundle;
+    try {
+        bundle = storedPrincipalPolicyBundleFromJson(row);
+    }
+    catch {
+        throw new KeyingVerificationError("invalid_shape", "stored principal policy bundle contains malformed JSON");
+    }
+    if (!isPrincipalPolicyBundleResponse(bundle)) {
+        throw new KeyingVerificationError("invalid_shape", "stored principal policy bundle is invalid");
+    }
+    if (bundle.currentState.principalType !== row.principalType ||
+        bundle.currentState.principalId !== row.principalId) {
+        throw new KeyingVerificationError("object_mismatch", "stored principal policy bundle row belongs to another principal");
+    }
+    if (bundle.currentState.stateHash !== row.stateHash) {
+        throw new KeyingVerificationError("hash_mismatch", "stored principal policy bundle row has a different head hash");
+    }
+    assertUnambiguousBundleChain(bundle);
+    return bundle;
+}
+function assertIndexedBundle(bundle, indexed, reference) {
+    if (bundle.currentState.stateHash !== indexed.bundleStateHash ||
+        bundle.currentState.version !== indexed.bundleVersion) {
+        throw new KeyingVerificationError("equivocation", "principal policy reference index conflicts with its bundle head");
+    }
+    if (!principalPolicyBundleContainsReference(bundle, reference)) {
+        throw new KeyingVerificationError("hash_mismatch", "indexed principal policy bundle does not contain the exact reference");
+    }
+}
+function addCandidate(candidates, bundle, row) {
+    const existing = candidates.get(bundle.currentState.stateHash);
+    if (existing) {
+        assertSameHeadPrincipalPolicyBundle(existing.row, row);
+        return;
+    }
+    candidates.set(bundle.currentState.stateHash, { bundle, row });
+}
+function assertCurrentDoesNotConflict(bundle, reference) {
+    if (bundle.currentState.version < reference.version) {
+        return;
+    }
+    const stateAtReference = principalPolicyBundleStates(bundle).find((state) => state.version === reference.version);
+    if (!stateAtReference) {
+        throw new KeyingVerificationError("stale_predecessor", "current principal policy chain omits the referenced version");
+    }
+    if (stateAtReference.stateHash !== reference.stateHash) {
+        throw new KeyingVerificationError("equivocation", "current principal policy chain conflicts with the referenced version");
+    }
+    throw new KeyingVerificationError("hash_mismatch", "current principal policy state does not match the exact reference");
+}
+function selectNewestCandidate(candidates) {
+    let selected = null;
+    const stateHashByVersion = new Map();
+    for (const { bundle } of candidates.values()) {
+        const existingHash = stateHashByVersion.get(bundle.currentState.version);
+        if (existingHash !== undefined &&
+            existingHash !== bundle.currentState.stateHash) {
+            throw new KeyingVerificationError("equivocation", "stored principal policy bundles conflict at one version");
+        }
+        stateHashByVersion.set(bundle.currentState.version, bundle.currentState.stateHash);
+        if (!selected ||
+            bundle.currentState.version > selected.currentState.version) {
+            selected = bundle;
+        }
+    }
+    return selected;
+}
+function assertReferenceShape(reference) {
+    if (!isReferencedPrincipalStateResponse(reference)) {
+        throw new KeyingVerificationError("invalid_shape", "principal policy reference is malformed");
+    }
+    if (!Number.isInteger(reference.version) ||
+        reference.version < 1 ||
+        !Number.isInteger(reference.keyEpoch) ||
+        reference.keyEpoch < 1 ||
+        reference.principalId.length === 0 ||
+        reference.stateHash.length === 0 ||
+        reference.keyFingerprint.length === 0) {
+        throw new KeyingVerificationError("invalid_shape", "principal policy reference is malformed");
+    }
+}
+async function loadCurrentRow(execSql, reference) {
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [row] = await db
+        .select(principalPolicyBundleSelection(principalPolicies))
+        .from(principalPolicies)
+        .where(and(eq(principalPolicies.principalType, reference.principalType), eq(principalPolicies.principalId, reference.principalId)))
+        .limit(1);
+    return row;
+}
+async function loadIndexedHeads(execSql, reference) {
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    return db
+        .select({
+        bundleStateHash: principalPolicyBundleReferences.bundleStateHash,
+        bundleVersion: principalPolicyBundleReferences.bundleVersion,
+    })
+        .from(principalPolicyBundleReferences)
+        .where(and(eq(principalPolicyBundleReferences.principalType, reference.principalType), eq(principalPolicyBundleReferences.principalId, reference.principalId), eq(principalPolicyBundleReferences.version, reference.version), eq(principalPolicyBundleReferences.stateHash, reference.stateHash), eq(principalPolicyBundleReferences.keyEpoch, reference.keyEpoch), eq(principalPolicyBundleReferences.keyFingerprint, reference.keyFingerprint)));
+}
+function indexHeadsByHash(heads) {
+    const stateHashByVersion = new Map();
+    for (const head of heads) {
+        if (!Number.isInteger(head.bundleVersion) ||
+            head.bundleVersion < 1 ||
+            head.bundleStateHash.length === 0) {
+            throw new KeyingVerificationError("invalid_shape", "principal policy reference index is malformed");
+        }
+        const indexedHash = stateHashByVersion.get(head.bundleVersion);
+        if (indexedHash !== undefined && indexedHash !== head.bundleStateHash) {
+            throw new KeyingVerificationError("equivocation", "principal policy reference index has conflicting bundle heads at one version");
+        }
+        stateHashByVersion.set(head.bundleVersion, head.bundleStateHash);
+    }
+    return new Map(heads.map((head) => [head.bundleStateHash, head]));
+}
+async function loadRetainedRows(execSql, reference, currentRow, indexedByHash) {
+    const hashes = new Set([reference.stateHash, ...indexedByHash.keys()]);
+    if (currentRow) {
+        hashes.delete(currentRow.stateHash);
+    }
+    if (hashes.size === 0) {
+        return [];
+    }
+    // Remote reset deliberately clears mutable heads while retaining historical
+    // key material, so an index target can outlive its bundle row. Such a target
+    // is only a selection hint; rows that still exist remain authoritative.
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    return db
+        .select(principalPolicyBundleSelection(principalPolicyBundleHistory))
+        .from(principalPolicyBundleHistory)
+        .where(and(eq(principalPolicyBundleHistory.principalType, reference.principalType), eq(principalPolicyBundleHistory.principalId, reference.principalId), inArray(principalPolicyBundleHistory.stateHash, [...hashes])));
+}
+function collectCandidates(currentRow, retainedRows, indexedByHash, reference) {
+    const candidates = new Map();
+    if (currentRow) {
+        const bundle = parseBoundBundle(currentRow);
+        const indexed = indexedByHash.get(currentRow.stateHash);
+        if (indexed) {
+            assertIndexedBundle(bundle, indexed, reference);
+        }
+        if (principalPolicyBundleContainsReference(bundle, reference)) {
+            addCandidate(candidates, bundle, currentRow);
+        }
+        else {
+            assertCurrentDoesNotConflict(bundle, reference);
+        }
+    }
+    for (const row of retainedRows) {
+        const bundle = parseBoundBundle(row);
+        const indexed = indexedByHash.get(row.stateHash);
+        if (indexed) {
+            assertIndexedBundle(bundle, indexed, reference);
+        }
+        else if (!principalPolicyBundleContainsReference(bundle, reference)) {
+            throw new KeyingVerificationError("hash_mismatch", "stored principal policy bundle head does not match the exact reference");
+        }
+        addCandidate(candidates, bundle, row);
+    }
+    return candidates;
+}
+export async function loadPrincipalPolicyBundleForReference(execSql, reference, checkpoint) {
+    assertReferenceShape(reference);
+    await ensurePrincipalPolicyTables(execSql);
+    const [currentRow, indexedHeads] = await Promise.all([
+        loadCurrentRow(execSql, reference),
+        loadIndexedHeads(execSql, reference),
+    ]);
+    const indexedByHash = indexHeadsByHash(indexedHeads);
+    const retainedRows = await loadRetainedRows(execSql, reference, currentRow, indexedByHash);
+    const candidates = collectCandidates(currentRow, retainedRows, indexedByHash, reference);
+    const selected = selectNewestCandidate(candidates);
+    return selected
+        ? applyPrincipalPolicyReferenceCheckpoint(selected, checkpoint)
+        : null;
+}
+//# sourceMappingURL=principalPolicyReferencePersistence.js.map

package/data/persistence/principalPolicyReferencePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyReferencePersistence.js","sourceRoot":"","sources":["principalPolicyReferencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,sCAAsC,EACtC,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAOpF,SAAS,4BAA4B,CACnC,MAAqC;IAErC,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IACE,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC,aAAa;YACzD,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW,EACrD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;YAChC,KAAK,CAAC,OAAO,KAAK,KAAK,GAAG,CAAC;YAC3B,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjC,KAAK,CAAC,QAAQ,GAAG,CAAC;YAClB,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAC9B,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAC5B,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,uBAAuB,CAC/B,YAAY,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,EACrE,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,GAA+B;IAE/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa;QACvD,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAqC,EACrC,OAA0B,EAC1B,SAAkC;IAElC,IACE,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,OAAO,CAAC,eAAe;QACzD,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,OAAO,CAAC,aAAa,EACrD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,UAGC,EACD,MAAqC,EACrC,GAA+B;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,QAAQ,EAAE,CAAC;QACb,mCAAmC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAqC,EACrC,SAAkC;IAElC,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,IAAI,CAC/D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,CAC/C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mEAAmE,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAGC;IAED,IAAI,QAAQ,GAAyC,IAAI,CAAC;IAC1D,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzE,IACE,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,EAC9C,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,GAAG,CACpB,MAAM,CAAC,YAAY,CAAC,OAAO,EAC3B,MAAM,CAAC,YAAY,CAAC,SAAS,CAC9B,CAAC;QACF,IACE,CAAC,QAAQ;YACT,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAC3D,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAkC;IAC9D,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,SAAS,CAAC,OAAO,GAAG,CAAC;QACrB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrC,SAAS,CAAC,QAAQ,GAAG,CAAC;QACtB,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAClC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAChC,SAAS,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,SAAkC;IAElC,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;SACzD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EAC5D,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CACzD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,SAAkC;IAElC,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,EAAE;SACN,MAAM,CAAC;QACN,eAAe,EAAE,+BAA+B,CAAC,eAAe;QAChE,aAAa,EAAE,+BAA+B,CAAC,aAAa;KAC7D,CAAC;SACD,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,aAAa,EAC7C,SAAS,CAAC,aAAa,CACxB,EACD,EAAE,CAAC,+BAA+B,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACtE,EAAE,CAAC,+BAA+B,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAC9D,EAAE,CAAC,+BAA+B,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAClE,EAAE,CAAC,+BAA+B,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,EAChE,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,SAAS,CAAC,cAAc,CACzB,CACF,CACF,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAmC;IAEnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;YACrC,IAAI,CAAC,aAAa,GAAG,CAAC;YACtB,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,SAAkC,EAClC,UAAkD,EAClD,aAAqD;IAErD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,EAAE;SACN,MAAM,CAAC,8BAA8B,CAAC,4BAA4B,CAAC,CAAC;SACpE,IAAI,CAAC,4BAA4B,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EACvE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACnE,OAAO,CAAC,4BAA4B,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAC7D,CACF,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CACxB,UAAkD,EAClD,YAAmD,EACnD,aAAqD,EACrD,SAAkC;IAElC,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;IACJ,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,sCAAsC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAgB,EAChB,SAAkC,EAClC,UAA4C;IAE5C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;QAClC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC;KACrC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,OAAO,EACP,SAAS,EACT,UAAU,EACV,aAAa,CACd,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAClC,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,QAAQ;QACb,CAAC,CAAC,uCAAuC,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  isPrincipalPolicyBundleResponse,\n  isReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq, inArray } from \"drizzle-orm\";\nimport {\n  principalPolicyBundleContainsReference,\n  principalPolicyBundleStates,\n} from \"../principalPolicyStates\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyBundleReferences,\n} from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { assertSameHeadPrincipalPolicyBundle } from \"./principalPolicyBundleIntegrity\";\nimport {\n  ensurePrincipalPolicyTables,\n  principalPolicyBundleSelection,\n  type SelectedPrincipalPolicyRow,\n} from \"./principalPolicyPersistence\";\nimport { applyPrincipalPolicyReferenceCheckpoint } from \"./principalPolicyReferenceCheckpoint\";\nimport { storedPrincipalPolicyBundleFromJson } from \"./storedPrincipalPolicyBundle\";\n\ninterface IndexedBundleHead {\n  readonly bundleStateHash: string;\n  readonly bundleVersion: number;\n}\n\nfunction assertUnambiguousBundleChain(\n  bundle: PrincipalPolicyBundleResponse,\n): void {\n  const states = principalPolicyBundleStates(bundle);\n  if (states.length !== bundle.currentState.version) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"stored principal policy bundle chain length does not match its head\",\n    );\n  }\n  const versions = new Map<number, string>();\n  for (const [index, state] of states.entries()) {\n    if (\n      state.principalType !== bundle.currentState.principalType ||\n      state.principalId !== bundle.currentState.principalId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"stored principal policy bundle chain belongs to another principal\",\n      );\n    }\n    if (\n      !Number.isInteger(state.version) ||\n      state.version !== index + 1 ||\n      !Number.isInteger(state.keyEpoch) ||\n      state.keyEpoch < 1 ||\n      state.principalId.length === 0 ||\n      state.stateHash.length === 0 ||\n      state.keyFingerprint.length === 0\n    ) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"stored principal policy bundle chain has an invalid version or epoch\",\n      );\n    }\n    if (versions.has(state.version)) {\n      const previousHash = versions.get(state.version);\n      throw new KeyingVerificationError(\n        previousHash === state.stateHash ? \"duplicate_entry\" : \"equivocation\",\n        \"stored principal policy bundle chain repeats a version\",\n      );\n    }\n    versions.set(state.version, state.stateHash);\n  }\n}\n\nfunction parseBoundBundle(\n  row: SelectedPrincipalPolicyRow,\n): PrincipalPolicyBundleResponse {\n  let bundle: unknown;\n  try {\n    bundle = storedPrincipalPolicyBundleFromJson(row);\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"stored principal policy bundle contains malformed JSON\",\n    );\n  }\n  if (!isPrincipalPolicyBundleResponse(bundle)) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"stored principal policy bundle is invalid\",\n    );\n  }\n  if (\n    bundle.currentState.principalType !== row.principalType ||\n    bundle.currentState.principalId !== row.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"stored principal policy bundle row belongs to another principal\",\n    );\n  }\n  if (bundle.currentState.stateHash !== row.stateHash) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"stored principal policy bundle row has a different head hash\",\n    );\n  }\n  assertUnambiguousBundleChain(bundle);\n  return bundle;\n}\n\nfunction assertIndexedBundle(\n  bundle: PrincipalPolicyBundleResponse,\n  indexed: IndexedBundleHead,\n  reference: ReferencedPrincipalHead,\n): void {\n  if (\n    bundle.currentState.stateHash !== indexed.bundleStateHash ||\n    bundle.currentState.version !== indexed.bundleVersion\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy reference index conflicts with its bundle head\",\n    );\n  }\n  if (!principalPolicyBundleContainsReference(bundle, reference)) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"indexed principal policy bundle does not contain the exact reference\",\n    );\n  }\n}\n\nfunction addCandidate(\n  candidates: Map<\n    string,\n    { bundle: PrincipalPolicyBundleResponse; row: SelectedPrincipalPolicyRow }\n  >,\n  bundle: PrincipalPolicyBundleResponse,\n  row: SelectedPrincipalPolicyRow,\n): void {\n  const existing = candidates.get(bundle.currentState.stateHash);\n  if (existing) {\n    assertSameHeadPrincipalPolicyBundle(existing.row, row);\n    return;\n  }\n  candidates.set(bundle.currentState.stateHash, { bundle, row });\n}\n\nfunction assertCurrentDoesNotConflict(\n  bundle: PrincipalPolicyBundleResponse,\n  reference: ReferencedPrincipalHead,\n): void {\n  if (bundle.currentState.version < reference.version) {\n    return;\n  }\n  const stateAtReference = principalPolicyBundleStates(bundle).find(\n    (state) => state.version === reference.version,\n  );\n  if (!stateAtReference) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"current principal policy chain omits the referenced version\",\n    );\n  }\n  if (stateAtReference.stateHash !== reference.stateHash) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"current principal policy chain conflicts with the referenced version\",\n    );\n  }\n  throw new KeyingVerificationError(\n    \"hash_mismatch\",\n    \"current principal policy state does not match the exact reference\",\n  );\n}\n\nfunction selectNewestCandidate(\n  candidates: ReadonlyMap<\n    string,\n    { readonly bundle: PrincipalPolicyBundleResponse }\n  >,\n): PrincipalPolicyBundleResponse | null {\n  let selected: PrincipalPolicyBundleResponse | null = null;\n  const stateHashByVersion = new Map<number, string>();\n  for (const { bundle } of candidates.values()) {\n    const existingHash = stateHashByVersion.get(bundle.currentState.version);\n    if (\n      existingHash !== undefined &&\n      existingHash !== bundle.currentState.stateHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"stored principal policy bundles conflict at one version\",\n      );\n    }\n    stateHashByVersion.set(\n      bundle.currentState.version,\n      bundle.currentState.stateHash,\n    );\n    if (\n      !selected ||\n      bundle.currentState.version > selected.currentState.version\n    ) {\n      selected = bundle;\n    }\n  }\n  return selected;\n}\n\nfunction assertReferenceShape(reference: ReferencedPrincipalHead): void {\n  if (!isReferencedPrincipalStateResponse(reference)) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy reference is malformed\",\n    );\n  }\n  if (\n    !Number.isInteger(reference.version) ||\n    reference.version < 1 ||\n    !Number.isInteger(reference.keyEpoch) ||\n    reference.keyEpoch < 1 ||\n    reference.principalId.length === 0 ||\n    reference.stateHash.length === 0 ||\n    reference.keyFingerprint.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy reference is malformed\",\n    );\n  }\n}\n\nasync function loadCurrentRow(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n): Promise<SelectedPrincipalPolicyRow | undefined> {\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select(principalPolicyBundleSelection(principalPolicies))\n    .from(principalPolicies)\n    .where(\n      and(\n        eq(principalPolicies.principalType, reference.principalType),\n        eq(principalPolicies.principalId, reference.principalId),\n      ),\n    )\n    .limit(1);\n  return row;\n}\n\nasync function loadIndexedHeads(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n): Promise<IndexedBundleHead[]> {\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  return db\n    .select({\n      bundleStateHash: principalPolicyBundleReferences.bundleStateHash,\n      bundleVersion: principalPolicyBundleReferences.bundleVersion,\n    })\n    .from(principalPolicyBundleReferences)\n    .where(\n      and(\n        eq(\n          principalPolicyBundleReferences.principalType,\n          reference.principalType,\n        ),\n        eq(principalPolicyBundleReferences.principalId, reference.principalId),\n        eq(principalPolicyBundleReferences.version, reference.version),\n        eq(principalPolicyBundleReferences.stateHash, reference.stateHash),\n        eq(principalPolicyBundleReferences.keyEpoch, reference.keyEpoch),\n        eq(\n          principalPolicyBundleReferences.keyFingerprint,\n          reference.keyFingerprint,\n        ),\n      ),\n    );\n}\n\nfunction indexHeadsByHash(\n  heads: readonly IndexedBundleHead[],\n): Map<string, IndexedBundleHead> {\n  const stateHashByVersion = new Map<number, string>();\n  for (const head of heads) {\n    if (\n      !Number.isInteger(head.bundleVersion) ||\n      head.bundleVersion < 1 ||\n      head.bundleStateHash.length === 0\n    ) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"principal policy reference index is malformed\",\n      );\n    }\n    const indexedHash = stateHashByVersion.get(head.bundleVersion);\n    if (indexedHash !== undefined && indexedHash !== head.bundleStateHash) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"principal policy reference index has conflicting bundle heads at one version\",\n      );\n    }\n    stateHashByVersion.set(head.bundleVersion, head.bundleStateHash);\n  }\n  return new Map(heads.map((head) => [head.bundleStateHash, head]));\n}\n\nasync function loadRetainedRows(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n  currentRow: SelectedPrincipalPolicyRow | undefined,\n  indexedByHash: ReadonlyMap<string, IndexedBundleHead>,\n): Promise<SelectedPrincipalPolicyRow[]> {\n  const hashes = new Set([reference.stateHash, ...indexedByHash.keys()]);\n  if (currentRow) {\n    hashes.delete(currentRow.stateHash);\n  }\n  if (hashes.size === 0) {\n    return [];\n  }\n  // Remote reset deliberately clears mutable heads while retaining historical\n  // key material, so an index target can outlive its bundle row. Such a target\n  // is only a selection hint; rows that still exist remain authoritative.\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  return db\n    .select(principalPolicyBundleSelection(principalPolicyBundleHistory))\n    .from(principalPolicyBundleHistory)\n    .where(\n      and(\n        eq(principalPolicyBundleHistory.principalType, reference.principalType),\n        eq(principalPolicyBundleHistory.principalId, reference.principalId),\n        inArray(principalPolicyBundleHistory.stateHash, [...hashes]),\n      ),\n    );\n}\n\nfunction collectCandidates(\n  currentRow: SelectedPrincipalPolicyRow | undefined,\n  retainedRows: readonly SelectedPrincipalPolicyRow[],\n  indexedByHash: ReadonlyMap<string, IndexedBundleHead>,\n  reference: ReferencedPrincipalHead,\n) {\n  const candidates = new Map<\n    string,\n    { bundle: PrincipalPolicyBundleResponse; row: SelectedPrincipalPolicyRow }\n  >();\n  if (currentRow) {\n    const bundle = parseBoundBundle(currentRow);\n    const indexed = indexedByHash.get(currentRow.stateHash);\n    if (indexed) {\n      assertIndexedBundle(bundle, indexed, reference);\n    }\n    if (principalPolicyBundleContainsReference(bundle, reference)) {\n      addCandidate(candidates, bundle, currentRow);\n    } else {\n      assertCurrentDoesNotConflict(bundle, reference);\n    }\n  }\n  for (const row of retainedRows) {\n    const bundle = parseBoundBundle(row);\n    const indexed = indexedByHash.get(row.stateHash);\n    if (indexed) {\n      assertIndexedBundle(bundle, indexed, reference);\n    } else if (!principalPolicyBundleContainsReference(bundle, reference)) {\n      throw new KeyingVerificationError(\n        \"hash_mismatch\",\n        \"stored principal policy bundle head does not match the exact reference\",\n      );\n    }\n    addCandidate(candidates, bundle, row);\n  }\n  return candidates;\n}\n\nexport async function loadPrincipalPolicyBundleForReference(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<PrincipalPolicyBundleResponse | null> {\n  assertReferenceShape(reference);\n  await ensurePrincipalPolicyTables(execSql);\n  const [currentRow, indexedHeads] = await Promise.all([\n    loadCurrentRow(execSql, reference),\n    loadIndexedHeads(execSql, reference),\n  ]);\n  const indexedByHash = indexHeadsByHash(indexedHeads);\n  const retainedRows = await loadRetainedRows(\n    execSql,\n    reference,\n    currentRow,\n    indexedByHash,\n  );\n  const candidates = collectCandidates(\n    currentRow,\n    retainedRows,\n    indexedByHash,\n    reference,\n  );\n  const selected = selectNewestCandidate(candidates);\n  return selected\n    ? applyPrincipalPolicyReferenceCheckpoint(selected, checkpoint)\n    : null;\n}\n"]}

package/data/persistence/securityIncidentPersistence.js

@@ -0,0 +1,156 @@
+import { isKeyingVerificationCode, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { desc, eq, inArray, isNull, sql } from "drizzle-orm";
+import { securityIncidents, securityIncidentTable, } from "../sqlite/securityIncidentSchema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+const SECURITY_INCIDENT_RETENTION_LIMIT = 1_000;
+/**
+ * The incident id hashes this text, so it must be identical on every device:
+ * code-unit key order, no locale collation, and no `Object` property-order
+ * rules (which would float integer-like keys ahead of the sort).
+ */
+function serializeEvidenceHashes(evidenceHashes) {
+    return serializeKeyingCanonicalJson(evidenceHashes ?? {});
+}
+function parseEvidenceHashes(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return {};
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return {};
+    }
+    const entries = [];
+    for (const [key, item] of Object.entries(parsed)) {
+        if (key.length === 0 || typeof item !== "string") {
+            return {};
+        }
+        entries.push([key, item]);
+    }
+    // Object.fromEntries keeps every key, including "__proto__", which an index
+    // assignment on a plain object would silently drop.
+    return Object.fromEntries(entries);
+}
+function parseVerificationCode(value) {
+    if (isKeyingVerificationCode(value))
+        return value;
+    return "unrecognized_verification_code";
+}
+function parseObjectKind(value) {
+    switch (value) {
+        case "blob":
+        case "container":
+        case "document":
+        case "principal":
+        case "user":
+        case "unknown":
+            return value;
+        default:
+            return "unknown";
+    }
+}
+async function ensureSecurityIncidentTable(execSql) {
+    await ensureSqlTables(execSql, [securityIncidentTable]);
+}
+function bytesToHex(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function deriveSecurityIncidentId(input) {
+    const canonicalIdentity = JSON.stringify([
+        input.trustDomain,
+        input.code,
+        input.operation,
+        input.objectKind,
+        input.objectId,
+        input.organizationId,
+        input.evidenceHashes,
+    ]);
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalIdentity));
+    return `incident_v1_${bytesToHex(new Uint8Array(digest))}`;
+}
+function parseSecurityIncidentRow(row) {
+    return {
+        ...row,
+        code: parseVerificationCode(row.code),
+        evidenceHashes: parseEvidenceHashes(row.evidenceHashes),
+        objectKind: parseObjectKind(row.objectKind),
+        trustDomain: row.trustDomain,
+    };
+}
+export async function appendSecurityIncident(execSql, incident) {
+    await ensureSecurityIncidentTable(execSql);
+    const runtime = getClientSQLitePersistenceRuntime(execSql);
+    const evidenceHashes = serializeEvidenceHashes(incident.evidenceHashes);
+    const organizationId = incident.organizationId ?? null;
+    const id = await deriveSecurityIncidentId({
+        code: incident.code,
+        evidenceHashes,
+        objectId: incident.objectId,
+        objectKind: incident.objectKind,
+        operation: incident.operation,
+        organizationId,
+        trustDomain: incident.trustDomain,
+    });
+    const row = await runtime.transaction(async (tx) => {
+        await tx
+            .insert(securityIncidents)
+            .values({
+            ...incident,
+            evidenceHashes,
+            id,
+            organizationId,
+            trustDomain: incident.trustDomain,
+        })
+            .onConflictDoUpdate({
+            target: securityIncidents.id,
+            set: {
+                detectedAt: sql `min(${securityIncidents.detectedAt}, ${incident.detectedAt})`,
+                lastDetectedAt: sql `max(${securityIncidents.lastDetectedAt}, ${incident.lastDetectedAt})`,
+                occurrenceCount: sql `${securityIncidents.occurrenceCount} + ${incident.occurrenceCount}`,
+            },
+        })
+            .run();
+        const trustDomainCondition = incident.trustDomain === null
+            ? isNull(securityIncidents.trustDomain)
+            : eq(securityIncidents.trustDomain, incident.trustDomain);
+        const staleRows = await tx
+            .select({ id: securityIncidents.id })
+            .from(securityIncidents)
+            .where(trustDomainCondition)
+            .orderBy(desc(securityIncidents.lastDetectedAt), desc(securityIncidents.id))
+            .limit(1)
+            .offset(SECURITY_INCIDENT_RETENTION_LIMIT);
+        // Each call can add at most one distinct row, so deleting the single 1,001st
+        // row restores the cap. A future bulk writer must delete its whole excess.
+        if (staleRows.length > 0) {
+            await tx
+                .delete(securityIncidents)
+                .where(inArray(securityIncidents.id, staleRows.map((staleRow) => staleRow.id)))
+                .run();
+        }
+        const [storedRow] = await tx
+            .select()
+            .from(securityIncidents)
+            .where(eq(securityIncidents.id, id))
+            .limit(1);
+        return storedRow;
+    });
+    return row ? parseSecurityIncidentRow(row) : null;
+}
+export async function listSecurityIncidents(execSql, trustDomain) {
+    await ensureSecurityIncidentTable(execSql);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const rows = await db
+        .select()
+        .from(securityIncidents)
+        .where(trustDomain === null
+        ? isNull(securityIncidents.trustDomain)
+        : eq(securityIncidents.trustDomain, trustDomain))
+        .orderBy(desc(securityIncidents.lastDetectedAt), desc(securityIncidents.id))
+        .limit(SECURITY_INCIDENT_RETENTION_LIMIT);
+    return rows.map(parseSecurityIncidentRow);
+}
+//# sourceMappingURL=securityIncidentPersistence.js.map

package/data/persistence/securityIncidentPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityIncidentPersistence.js","sourceRoot":"","sources":["securityIncidentPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAK7D,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAepE,MAAM,iCAAiC,GAAG,KAAK,CAAC;AAEhD;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,cAA4D;IAE5D,OAAO,4BAA4B,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,4EAA4E;IAC5E,oDAAoD;IACpD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC;QACf;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,OAAgB;IACzD,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAQvC;IACC,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC;QACvC,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,cAAc;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAC5C,CAAC;IACF,OAAO,eAAe,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAA0C;IAE1C,OAAO;QACL,GAAG,GAAG;QACN,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC;QACvD,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3C,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,QAA+B;IAE/B,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,cAAc;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc;QACd,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACjD,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,GAAG,QAAQ;YACX,cAAc;YACd,EAAE;YACF,cAAc;YACd,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,iBAAiB,CAAC,EAAE;YAC5B,GAAG,EAAE;gBACH,UAAU,EAAE,GAAG,CAAA,OAAO,iBAAiB,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,GAAG;gBAC7E,cAAc,EAAE,GAAG,CAAA,OAAO,iBAAiB,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,GAAG;gBACzF,eAAe,EAAE,GAAG,CAAA,GAAG,iBAAiB,CAAC,eAAe,MAAM,QAAQ,CAAC,eAAe,EAAE;aACzF;SACF,CAAC;aACD,GAAG,EAAE,CAAC;QACT,MAAM,oBAAoB,GACxB,QAAQ,CAAC,WAAW,KAAK,IAAI;YAC3B,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC;YACvC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;aACpC,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,OAAO,CACN,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EACtC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAC3B;aACA,KAAK,CAAC,CAAC,CAAC;aACR,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC7C,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,iBAAiB,CAAC;iBACzB,KAAK,CACJ,OAAO,CACL,iBAAiB,CAAC,EAAE,EACpB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACzC,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,WAA0B;IAE1B,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CACnD;SACA,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;SAC3E,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import {\n  isKeyingVerificationCode,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { desc, eq, inArray, isNull, sql } from \"drizzle-orm\";\nimport type {\n  SecurityIncident,\n  SecurityIncidentObjectKind,\n} from \"../securityIncidents\";\nimport {\n  securityIncidents,\n  securityIncidentTable,\n} from \"../sqlite/securityIncidentSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\ninterface SecurityIncidentWrite {\n  readonly trustDomain: string | null;\n  readonly code: SecurityIncident[\"code\"];\n  readonly operation: string;\n  readonly objectKind: SecurityIncidentObjectKind;\n  readonly objectId: string | null;\n  readonly organizationId?: string | null | undefined;\n  readonly evidenceHashes?: Readonly<Record<string, string>> | undefined;\n  readonly detectedAt: string;\n  readonly lastDetectedAt: string;\n  readonly occurrenceCount: number;\n}\n\nconst SECURITY_INCIDENT_RETENTION_LIMIT = 1_000;\n\n/**\n * The incident id hashes this text, so it must be identical on every device:\n * code-unit key order, no locale collation, and no `Object` property-order\n * rules (which would float integer-like keys ahead of the sort).\n */\nfunction serializeEvidenceHashes(\n  evidenceHashes: Readonly<Record<string, string>> | undefined,\n): string {\n  return serializeKeyingCanonicalJson(evidenceHashes ?? {});\n}\n\nfunction parseEvidenceHashes(value: string): Readonly<Record<string, string>> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(value);\n  } catch {\n    return {};\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return {};\n  }\n  const entries: Array<[string, string]> = [];\n  for (const [key, item] of Object.entries(parsed)) {\n    if (key.length === 0 || typeof item !== \"string\") {\n      return {};\n    }\n    entries.push([key, item]);\n  }\n  // Object.fromEntries keeps every key, including \"__proto__\", which an index\n  // assignment on a plain object would silently drop.\n  return Object.fromEntries(entries);\n}\n\nfunction parseVerificationCode(value: string): SecurityIncident[\"code\"] {\n  if (isKeyingVerificationCode(value)) return value;\n  return \"unrecognized_verification_code\";\n}\n\nfunction parseObjectKind(value: string): SecurityIncidentObjectKind {\n  switch (value) {\n    case \"blob\":\n    case \"container\":\n    case \"document\":\n    case \"principal\":\n    case \"user\":\n    case \"unknown\":\n      return value;\n    default:\n      return \"unknown\";\n  }\n}\n\nasync function ensureSecurityIncidentTable(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, [securityIncidentTable]);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\n    \"\",\n  );\n}\n\nasync function deriveSecurityIncidentId(input: {\n  readonly code: SecurityIncident[\"code\"];\n  readonly evidenceHashes: string;\n  readonly objectId: string | null;\n  readonly objectKind: SecurityIncidentObjectKind;\n  readonly operation: string;\n  readonly organizationId: string | null;\n  readonly trustDomain: string | null;\n}): Promise<string> {\n  const canonicalIdentity = JSON.stringify([\n    input.trustDomain,\n    input.code,\n    input.operation,\n    input.objectKind,\n    input.objectId,\n    input.organizationId,\n    input.evidenceHashes,\n  ]);\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(canonicalIdentity),\n  );\n  return `incident_v1_${bytesToHex(new Uint8Array(digest))}`;\n}\n\nfunction parseSecurityIncidentRow(\n  row: typeof securityIncidents.$inferSelect,\n): SecurityIncident {\n  return {\n    ...row,\n    code: parseVerificationCode(row.code),\n    evidenceHashes: parseEvidenceHashes(row.evidenceHashes),\n    objectKind: parseObjectKind(row.objectKind),\n    trustDomain: row.trustDomain,\n  };\n}\n\nexport async function appendSecurityIncident(\n  execSql: ExecSql,\n  incident: SecurityIncidentWrite,\n): Promise<SecurityIncident | null> {\n  await ensureSecurityIncidentTable(execSql);\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const evidenceHashes = serializeEvidenceHashes(incident.evidenceHashes);\n  const organizationId = incident.organizationId ?? null;\n  const id = await deriveSecurityIncidentId({\n    code: incident.code,\n    evidenceHashes,\n    objectId: incident.objectId,\n    objectKind: incident.objectKind,\n    operation: incident.operation,\n    organizationId,\n    trustDomain: incident.trustDomain,\n  });\n  const row = await runtime.transaction(async (tx) => {\n    await tx\n      .insert(securityIncidents)\n      .values({\n        ...incident,\n        evidenceHashes,\n        id,\n        organizationId,\n        trustDomain: incident.trustDomain,\n      })\n      .onConflictDoUpdate({\n        target: securityIncidents.id,\n        set: {\n          detectedAt: sql`min(${securityIncidents.detectedAt}, ${incident.detectedAt})`,\n          lastDetectedAt: sql`max(${securityIncidents.lastDetectedAt}, ${incident.lastDetectedAt})`,\n          occurrenceCount: sql`${securityIncidents.occurrenceCount} + ${incident.occurrenceCount}`,\n        },\n      })\n      .run();\n    const trustDomainCondition =\n      incident.trustDomain === null\n        ? isNull(securityIncidents.trustDomain)\n        : eq(securityIncidents.trustDomain, incident.trustDomain);\n    const staleRows = await tx\n      .select({ id: securityIncidents.id })\n      .from(securityIncidents)\n      .where(trustDomainCondition)\n      .orderBy(\n        desc(securityIncidents.lastDetectedAt),\n        desc(securityIncidents.id),\n      )\n      .limit(1)\n      .offset(SECURITY_INCIDENT_RETENTION_LIMIT);\n    // Each call can add at most one distinct row, so deleting the single 1,001st\n    // row restores the cap. A future bulk writer must delete its whole excess.\n    if (staleRows.length > 0) {\n      await tx\n        .delete(securityIncidents)\n        .where(\n          inArray(\n            securityIncidents.id,\n            staleRows.map((staleRow) => staleRow.id),\n          ),\n        )\n        .run();\n    }\n    const [storedRow] = await tx\n      .select()\n      .from(securityIncidents)\n      .where(eq(securityIncidents.id, id))\n      .limit(1);\n    return storedRow;\n  });\n  return row ? parseSecurityIncidentRow(row) : null;\n}\n\nexport async function listSecurityIncidents(\n  execSql: ExecSql,\n  trustDomain: string | null,\n): Promise<SecurityIncident[]> {\n  await ensureSecurityIncidentTable(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select()\n    .from(securityIncidents)\n    .where(\n      trustDomain === null\n        ? isNull(securityIncidents.trustDomain)\n        : eq(securityIncidents.trustDomain, trustDomain),\n    )\n    .orderBy(desc(securityIncidents.lastDetectedAt), desc(securityIncidents.id))\n    .limit(SECURITY_INCIDENT_RETENTION_LIMIT);\n  return rows.map(parseSecurityIncidentRow);\n}\n"]}

package/data/persistence/storedPrincipalPolicyBundle.js

@@ -0,0 +1,17 @@
+/**
+ * Maps the five stored JSON columns back into the wire bundle shape. Kept as
+ * the single column-to-field mapping so a renamed column cannot silently
+ * desynchronize one reader from the others; JSON.parse failures propagate for
+ * each caller to translate into its own error policy, as does validation.
+ */
+export function storedPrincipalPolicyBundleFromJson(row) {
+    return {
+        currentMemberEnvelopes: JSON.parse(row.currentMemberEnvelopesJson),
+        currentPayload: JSON.parse(row.currentPayloadJson),
+        currentProjection: JSON.parse(row.currentProjectionJson),
+        currentGrants: JSON.parse(row.currentGrantsJson),
+        currentState: JSON.parse(row.currentStateJson),
+        previousStates: JSON.parse(row.previousStatesJson),
+    };
+}
+//# sourceMappingURL=storedPrincipalPolicyBundle.js.map

package/data/persistence/storedPrincipalPolicyBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storedPrincipalPolicyBundle.js","sourceRoot":"","sources":["storedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,GAAoC;IAEpC,OAAO;QACL,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAClE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACxD,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChD,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC9C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;KACnD,CAAC;AACJ,CAAC","sourcesContent":["export interface StoredPrincipalPolicyBundleJson {\n  readonly currentMemberEnvelopesJson: string;\n  readonly currentPayloadJson: string;\n  readonly currentProjectionJson: string;\n  readonly currentGrantsJson: string;\n  readonly currentStateJson: string;\n  readonly previousStatesJson: string;\n}\n\n/**\n * Maps the five stored JSON columns back into the wire bundle shape. Kept as\n * the single column-to-field mapping so a renamed column cannot silently\n * desynchronize one reader from the others; JSON.parse failures propagate for\n * each caller to translate into its own error policy, as does validation.\n */\nexport function storedPrincipalPolicyBundleFromJson(\n  row: StoredPrincipalPolicyBundleJson,\n): unknown {\n  return {\n    currentMemberEnvelopes: JSON.parse(row.currentMemberEnvelopesJson),\n    currentPayload: JSON.parse(row.currentPayloadJson),\n    currentProjection: JSON.parse(row.currentProjectionJson),\n    currentGrants: JSON.parse(row.currentGrantsJson),\n    currentState: JSON.parse(row.currentStateJson),\n    previousStates: JSON.parse(row.previousStatesJson),\n  };\n}\n"]}