@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/persistence/trustedUserIdentityPinPersistence.js

@@ -0,0 +1,252 @@
+import { and, eq } from "drizzle-orm";
+import { trustedUserIdentityPins, trustedUserIdentityPinTables, } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE, TRUSTED_USER_IDENTITY_FORMAT_VERSION, TRUSTED_USER_IDENTITY_SIGNING_SUITE, } from "../trustedUserIdentity/types.js";
+import { runTrustedUserIdentityPinTransaction } from "./trustedUserIdentityPinTransaction.js";
+const comparedPinFields = [
+    "userId",
+    "formatVersion",
+    "signingSuite",
+    "signingPublicKey",
+    "signingKeyFingerprint",
+    "encapsulationSuite",
+    "encapsulationPublicKey",
+    "encapsulationKeyFingerprint",
+];
+const requiredStringFields = [
+    "identityTrustDomain",
+    "userId",
+    "signingSuite",
+    "signingPublicKey",
+    "signingKeyFingerprint",
+    "encapsulationSuite",
+    "encapsulationPublicKey",
+    "encapsulationKeyFingerprint",
+];
+function pinDiagnostic(pin) {
+    return {
+        userId: pin.userId,
+        formatVersion: pin.formatVersion,
+        signingSuite: pin.signingSuite,
+        signingKeyFingerprint: pin.signingKeyFingerprint,
+        encapsulationSuite: pin.encapsulationSuite,
+        encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,
+        firstSeenAt: pin.firstSeenAt,
+    };
+}
+export class TrustedUserIdentityPinMismatchError extends Error {
+    code = "trusted_user_identity_pin_mismatch";
+    identityTrustDomain;
+    userId;
+    existing;
+    candidate;
+    differingFields;
+    constructor(existing, candidate, differingFields) {
+        super(`Trusted identity pin mismatch for ${candidate.userId} in ${candidate.identityTrustDomain}: ${differingFields.join(", ")}`);
+        this.name = "TrustedUserIdentityPinMismatchError";
+        this.identityTrustDomain = candidate.identityTrustDomain;
+        this.userId = candidate.userId;
+        this.existing = pinDiagnostic(existing);
+        this.candidate = pinDiagnostic(candidate);
+        this.differingFields = differingFields;
+    }
+}
+export class TrustedUserIdentityPinCorruptError extends Error {
+    code = "trusted_user_identity_pin_corrupt";
+    identityTrustDomain;
+    userId;
+    reason;
+    constructor(scope, reason) {
+        super(`Stored trusted identity pin is corrupt for ${scope.userId} in ${scope.identityTrustDomain}: ${reason}`);
+        this.name = "TrustedUserIdentityPinCorruptError";
+        this.identityTrustDomain = scope.identityTrustDomain;
+        this.userId = scope.userId;
+        this.reason = reason;
+    }
+}
+export class TrustedUserIdentityPinInputError extends Error {
+    code = "trusted_user_identity_pin_invalid_input";
+    identityTrustDomain;
+    userId;
+    reason;
+    constructor(scope, reason) {
+        super(`Invalid trusted identity pin candidate: ${reason}`);
+        this.name = "TrustedUserIdentityPinInputError";
+        this.identityTrustDomain = scope.identityTrustDomain;
+        this.userId = scope.userId;
+        this.reason = reason;
+    }
+}
+function pinScope(value) {
+    if (typeof value !== "object" || value === null) {
+        return { identityTrustDomain: "<invalid>", userId: "<invalid>" };
+    }
+    const identityTrustDomain = Reflect.get(value, "identityTrustDomain");
+    const userId = Reflect.get(value, "userId");
+    return {
+        identityTrustDomain: typeof identityTrustDomain === "string"
+            ? identityTrustDomain
+            : "<invalid>",
+        userId: typeof userId === "string" ? userId : "<invalid>",
+    };
+}
+function validationFailure(value) {
+    if (typeof value !== "object" || value === null) {
+        return "row must be an object";
+    }
+    const formatVersion = Reflect.get(value, "formatVersion");
+    if (formatVersion !== TRUSTED_USER_IDENTITY_FORMAT_VERSION) {
+        return `formatVersion must be ${TRUSTED_USER_IDENTITY_FORMAT_VERSION}`;
+    }
+    for (const field of requiredStringFields) {
+        const fieldValue = Reflect.get(value, field);
+        if (typeof fieldValue !== "string" || fieldValue.trim().length === 0) {
+            return `${field} must be a non-empty string`;
+        }
+    }
+    if (Reflect.get(value, "signingSuite") !== TRUSTED_USER_IDENTITY_SIGNING_SUITE) {
+        return `signingSuite must be ${TRUSTED_USER_IDENTITY_SIGNING_SUITE}`;
+    }
+    if (Reflect.get(value, "encapsulationSuite") !==
+        TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE) {
+        return `encapsulationSuite must be ${TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE}`;
+    }
+    const firstSeenAt = Reflect.get(value, "firstSeenAt");
+    if (typeof firstSeenAt !== "string" ||
+        !Number.isFinite(Date.parse(firstSeenAt))) {
+        return "firstSeenAt must be a valid timestamp";
+    }
+    return null;
+}
+function validatedStringField(value, field) {
+    const fieldValue = Reflect.get(value, field);
+    if (typeof fieldValue !== "string") {
+        throw new TypeError(`Validated pin field ${field} is not a string`);
+    }
+    return fieldValue;
+}
+function validatedFormatVersion(value) {
+    const formatVersion = Reflect.get(value, "formatVersion");
+    if (typeof formatVersion !== "number") {
+        throw new TypeError("Validated pin formatVersion is not a number");
+    }
+    return formatVersion;
+}
+function assertCandidatePin(pin) {
+    const failure = validationFailure(pin);
+    if (failure) {
+        throw new TrustedUserIdentityPinInputError(pinScope(pin), failure);
+    }
+}
+function parseStoredPin(value, scope) {
+    const failure = validationFailure(value);
+    if (failure) {
+        throw new TrustedUserIdentityPinCorruptError(scope, failure);
+    }
+    if (typeof value !== "object" || value === null) {
+        throw new TrustedUserIdentityPinCorruptError(scope, "row must be an object");
+    }
+    const pin = {
+        identityTrustDomain: validatedStringField(value, "identityTrustDomain"),
+        userId: validatedStringField(value, "userId"),
+        formatVersion: validatedFormatVersion(value),
+        signingSuite: validatedStringField(value, "signingSuite"),
+        signingPublicKey: validatedStringField(value, "signingPublicKey"),
+        signingKeyFingerprint: validatedStringField(value, "signingKeyFingerprint"),
+        encapsulationSuite: validatedStringField(value, "encapsulationSuite"),
+        encapsulationPublicKey: validatedStringField(value, "encapsulationPublicKey"),
+        encapsulationKeyFingerprint: validatedStringField(value, "encapsulationKeyFingerprint"),
+        firstSeenAt: validatedStringField(value, "firstSeenAt"),
+    };
+    if (pin.identityTrustDomain !== scope.identityTrustDomain ||
+        pin.userId !== scope.userId) {
+        throw new TrustedUserIdentityPinCorruptError(scope, "primary-key scope does not match the requested pin");
+    }
+    return pin;
+}
+async function selectStoredPin(db, scope) {
+    const rows = await db
+        .select()
+        .from(trustedUserIdentityPins)
+        .where(and(eq(trustedUserIdentityPins.identityTrustDomain, scope.identityTrustDomain), eq(trustedUserIdentityPins.userId, scope.userId)))
+        .limit(1);
+    const row = rows[0];
+    return row ? parseStoredPin(row, scope) : null;
+}
+function differingPinFields(existing, candidate) {
+    return comparedPinFields.filter((field) => existing[field] !== candidate[field]);
+}
+export async function loadTrustedUserIdentityPin(input) {
+    const scope = {
+        identityTrustDomain: input.identityTrustDomain,
+        userId: input.userId,
+    };
+    await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);
+    return selectStoredPin(getClientSQLitePersistenceRuntime(input.execSql).db, scope);
+}
+/**
+ * The user a signing key is already bound to in this trust domain, if any.
+ * Each key has at most one such user: the reverse binding is unique.
+ */
+export async function loadTrustedUserIdForSigningKey(input) {
+    await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);
+    const rows = await getClientSQLitePersistenceRuntime(input.execSql)
+        .db.select({ userId: trustedUserIdentityPins.userId })
+        .from(trustedUserIdentityPins)
+        .where(and(eq(trustedUserIdentityPins.identityTrustDomain, input.identityTrustDomain), eq(trustedUserIdentityPins.signingKeyFingerprint, input.signingKeyFingerprint)))
+        .limit(1);
+    return rows[0]?.userId ?? null;
+}
+/**
+ * Atomically establishes or verifies a trust-on-first-use identity pin.
+ *
+ * The immediate transaction serializes first contact across SDK instances that
+ * share the SQLite database. Conflict handling never replaces the existing
+ * row: the winning pin is re-read and every identity field is compared before
+ * this function returns.
+ */
+export async function compareOrInsertTrustedUserIdentityPin(input) {
+    assertCandidatePin(input.pin);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    return runTrustedUserIdentityPinTransaction(async () => {
+        await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);
+        return runtime.transaction(async (tx) => {
+            const aliases = await tx
+                .select()
+                .from(trustedUserIdentityPins)
+                .where(and(eq(trustedUserIdentityPins.identityTrustDomain, input.pin.identityTrustDomain), eq(trustedUserIdentityPins.signingKeyFingerprint, input.pin.signingKeyFingerprint)))
+                .limit(1);
+            const alias = aliases[0];
+            if (alias && alias.userId !== input.pin.userId) {
+                throw new TrustedUserIdentityPinMismatchError(parseStoredPin(alias, {
+                    identityTrustDomain: input.pin.identityTrustDomain,
+                    userId: alias.userId,
+                }), input.pin, ["userId"]);
+            }
+            // Targets the primary key only: re-pinning the same user is a no-op,
+            // but a write that would bind this key to a second user must fail at
+            // the unique index rather than be silently skipped.
+            await tx
+                .insert(trustedUserIdentityPins)
+                .values(input.pin)
+                .onConflictDoNothing({
+                target: [
+                    trustedUserIdentityPins.identityTrustDomain,
+                    trustedUserIdentityPins.userId,
+                ],
+            })
+                .run();
+            const stored = await selectStoredPin(tx, input.pin);
+            if (!stored) {
+                throw new TrustedUserIdentityPinCorruptError(input.pin, "row is missing after compare-or-insert");
+            }
+            const differingFields = differingPinFields(stored, input.pin);
+            if (differingFields.length > 0) {
+                throw new TrustedUserIdentityPinMismatchError(stored, input.pin, differingFields);
+            }
+            return stored;
+        }, { behavior: "immediate" });
+    });
+}
+//# sourceMappingURL=trustedUserIdentityPinPersistence.js.map

package/data/persistence/trustedUserIdentityPinPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedUserIdentityPinPersistence.js","sourceRoot":"","sources":["trustedUserIdentityPinPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,yCAAyC,EACzC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAwC3F,MAAM,iBAAiB,GAAgC;IACrD,QAAQ;IACR,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,6BAA6B;CAC9B,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,qBAAqB;IACrB,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,6BAA6B;CAC+B,CAAC;AAE/D,SAAS,aAAa,CAAC,GAA2B;IAChD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IACnD,IAAI,GAAG,oCAAoC,CAAC;IAC5C,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,QAAQ,CAAgB;IACxB,SAAS,CAAgB;IACzB,eAAe,CAA8B;IAEtD,YACE,QAAgC,EAChC,SAAiC,EACjC,eAA4C;QAE5C,KAAK,CACH,qCAAqC,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,mBAAmB,KAAK,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC,mBAAmB,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAClD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,KAAe,EAAE,MAAc;QACzC,KAAK,CACH,8CAA8C,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,mBAAmB,KAAK,MAAM,EAAE,CACxG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,IAAI,GAAG,yCAAyC,CAAC;IACjD,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,KAAe,EAAE,MAAc;QACzC,KAAK,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO;QACL,mBAAmB,EACjB,OAAO,mBAAmB,KAAK,QAAQ;YACrC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,WAAW;QACjB,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,aAAa,KAAK,oCAAoC,EAAE,CAAC;QAC3D,OAAO,yBAAyB,oCAAoC,EAAE,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,KAAK,6BAA6B,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,mCAAmC,EAC1E,CAAC;QACD,OAAO,wBAAwB,mCAAmC,EAAE,CAAC;IACvE,CAAC;IACD,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACxC,yCAAyC,EACzC,CAAC;QACD,OAAO,8BAA8B,yCAAyC,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACtD,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa,EACb,KAA4D;IAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,uBAAuB,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA2B;IACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,gCAAgC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,KAAe;IAEf,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,kCAAkC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kCAAkC,CAC1C,KAAK,EACL,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAA2B;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,CAAC;QACvE,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC7C,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC;QAC5C,YAAY,EAAE,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC;QACzD,gBAAgB,EAAE,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACjE,qBAAqB,EAAE,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC;QAC3E,kBAAkB,EAAE,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACrE,sBAAsB,EAAE,oBAAoB,CAC1C,KAAK,EACL,wBAAwB,CACzB;QACD,2BAA2B,EAAE,oBAAoB,CAC/C,KAAK,EACL,6BAA6B,CAC9B;QACD,WAAW,EAAE,oBAAoB,CAAC,KAAK,EAAE,aAAa,CAAC;KACxD,CAAC;IACF,IACE,GAAG,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACrD,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAC3B,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,KAAK,EACL,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAuD,EACvD,KAAe;IAEf,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,mBAAmB,CAC1B,EACD,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAgC,EAChC,SAAiC;IAEjC,OAAO,iBAAiB,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,KAAK,GAAa;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACnE,OAAO,eAAe,CACpB,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EACnD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC;SAChE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC;SACrD,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,mBAAmB,CAC1B,EACD,EAAE,CACA,uBAAuB,CAAC,qBAAqB,EAC7C,KAAK,CAAC,qBAAqB,CAC5B,CACF,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAG3D;IACC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,oCAAoC,CAAC,KAAK,IAAI,EAAE;QACrD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,WAAW,CACxB,KAAK,EAAE,EAAE,EAAE,EAAE;YACX,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,EAAE;iBACR,IAAI,CAAC,uBAAuB,CAAC;iBAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAC9B,EACD,EAAE,CACA,uBAAuB,CAAC,qBAAqB,EAC7C,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAChC,CACF,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,mCAAmC,CAC3C,cAAc,CAAC,KAAK,EAAE;oBACpB,mBAAmB,EAAE,KAAK,CAAC,GAAG,CAAC,mBAAmB;oBAClD,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,EACF,KAAK,CAAC,GAAG,EACT,CAAC,QAAQ,CAAC,CACX,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,oDAAoD;YACpD,MAAM,EAAE;iBACL,MAAM,CAAC,uBAAuB,CAAC;iBAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;iBACjB,mBAAmB,CAAC;gBACnB,MAAM,EAAE;oBACN,uBAAuB,CAAC,mBAAmB;oBAC3C,uBAAuB,CAAC,MAAM;iBAC/B;aACF,CAAC;iBACD,GAAG,EAAE,CAAC;YAET,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,kCAAkC,CAC1C,KAAK,CAAC,GAAG,EACT,wCAAwC,CACzC,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,mCAAmC,CAC3C,MAAM,EACN,KAAK,CAAC,GAAG,EACT,eAAe,CAChB,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport {\n  trustedUserIdentityPins,\n  trustedUserIdentityPinTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n} from \"../trustedUserIdentity/types\";\nimport { runTrustedUserIdentityPinTransaction } from \"./trustedUserIdentityPinTransaction\";\n\nexport interface TrustedUserIdentityPin {\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly formatVersion: number;\n  readonly signingSuite: string;\n  readonly signingPublicKey: string;\n  readonly signingKeyFingerprint: string;\n  readonly encapsulationSuite: string;\n  readonly encapsulationPublicKey: string;\n  readonly encapsulationKeyFingerprint: string;\n  readonly firstSeenAt: string;\n}\n\ntype ComparedPinField =\n  | \"userId\"\n  | \"formatVersion\"\n  | \"signingSuite\"\n  | \"signingPublicKey\"\n  | \"signingKeyFingerprint\"\n  | \"encapsulationSuite\"\n  | \"encapsulationPublicKey\"\n  | \"encapsulationKeyFingerprint\";\n\ninterface PinDiagnostic {\n  readonly userId: string;\n  readonly formatVersion: number;\n  readonly signingSuite: string;\n  readonly signingKeyFingerprint: string;\n  readonly encapsulationSuite: string;\n  readonly encapsulationKeyFingerprint: string;\n  readonly firstSeenAt: string;\n}\n\ninterface PinScope {\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}\n\nconst comparedPinFields: readonly ComparedPinField[] = [\n  \"userId\",\n  \"formatVersion\",\n  \"signingSuite\",\n  \"signingPublicKey\",\n  \"signingKeyFingerprint\",\n  \"encapsulationSuite\",\n  \"encapsulationPublicKey\",\n  \"encapsulationKeyFingerprint\",\n];\n\nconst requiredStringFields = [\n  \"identityTrustDomain\",\n  \"userId\",\n  \"signingSuite\",\n  \"signingPublicKey\",\n  \"signingKeyFingerprint\",\n  \"encapsulationSuite\",\n  \"encapsulationPublicKey\",\n  \"encapsulationKeyFingerprint\",\n] as const satisfies readonly (keyof TrustedUserIdentityPin)[];\n\nfunction pinDiagnostic(pin: TrustedUserIdentityPin): PinDiagnostic {\n  return {\n    userId: pin.userId,\n    formatVersion: pin.formatVersion,\n    signingSuite: pin.signingSuite,\n    signingKeyFingerprint: pin.signingKeyFingerprint,\n    encapsulationSuite: pin.encapsulationSuite,\n    encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,\n    firstSeenAt: pin.firstSeenAt,\n  };\n}\n\nexport class TrustedUserIdentityPinMismatchError extends Error {\n  readonly code = \"trusted_user_identity_pin_mismatch\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly existing: PinDiagnostic;\n  readonly candidate: PinDiagnostic;\n  readonly differingFields: readonly ComparedPinField[];\n\n  constructor(\n    existing: TrustedUserIdentityPin,\n    candidate: TrustedUserIdentityPin,\n    differingFields: readonly ComparedPinField[],\n  ) {\n    super(\n      `Trusted identity pin mismatch for ${candidate.userId} in ${candidate.identityTrustDomain}: ${differingFields.join(\", \")}`,\n    );\n    this.name = \"TrustedUserIdentityPinMismatchError\";\n    this.identityTrustDomain = candidate.identityTrustDomain;\n    this.userId = candidate.userId;\n    this.existing = pinDiagnostic(existing);\n    this.candidate = pinDiagnostic(candidate);\n    this.differingFields = differingFields;\n  }\n}\n\nexport class TrustedUserIdentityPinCorruptError extends Error {\n  readonly code = \"trusted_user_identity_pin_corrupt\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly reason: string;\n\n  constructor(scope: PinScope, reason: string) {\n    super(\n      `Stored trusted identity pin is corrupt for ${scope.userId} in ${scope.identityTrustDomain}: ${reason}`,\n    );\n    this.name = \"TrustedUserIdentityPinCorruptError\";\n    this.identityTrustDomain = scope.identityTrustDomain;\n    this.userId = scope.userId;\n    this.reason = reason;\n  }\n}\n\nexport class TrustedUserIdentityPinInputError extends Error {\n  readonly code = \"trusted_user_identity_pin_invalid_input\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly reason: string;\n\n  constructor(scope: PinScope, reason: string) {\n    super(`Invalid trusted identity pin candidate: ${reason}`);\n    this.name = \"TrustedUserIdentityPinInputError\";\n    this.identityTrustDomain = scope.identityTrustDomain;\n    this.userId = scope.userId;\n    this.reason = reason;\n  }\n}\n\nfunction pinScope(value: unknown): PinScope {\n  if (typeof value !== \"object\" || value === null) {\n    return { identityTrustDomain: \"<invalid>\", userId: \"<invalid>\" };\n  }\n  const identityTrustDomain = Reflect.get(value, \"identityTrustDomain\");\n  const userId = Reflect.get(value, \"userId\");\n  return {\n    identityTrustDomain:\n      typeof identityTrustDomain === \"string\"\n        ? identityTrustDomain\n        : \"<invalid>\",\n    userId: typeof userId === \"string\" ? userId : \"<invalid>\",\n  };\n}\n\nfunction validationFailure(value: unknown): string | null {\n  if (typeof value !== \"object\" || value === null) {\n    return \"row must be an object\";\n  }\n  const formatVersion = Reflect.get(value, \"formatVersion\");\n  if (formatVersion !== TRUSTED_USER_IDENTITY_FORMAT_VERSION) {\n    return `formatVersion must be ${TRUSTED_USER_IDENTITY_FORMAT_VERSION}`;\n  }\n  for (const field of requiredStringFields) {\n    const fieldValue = Reflect.get(value, field);\n    if (typeof fieldValue !== \"string\" || fieldValue.trim().length === 0) {\n      return `${field} must be a non-empty string`;\n    }\n  }\n  if (\n    Reflect.get(value, \"signingSuite\") !== TRUSTED_USER_IDENTITY_SIGNING_SUITE\n  ) {\n    return `signingSuite must be ${TRUSTED_USER_IDENTITY_SIGNING_SUITE}`;\n  }\n  if (\n    Reflect.get(value, \"encapsulationSuite\") !==\n    TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE\n  ) {\n    return `encapsulationSuite must be ${TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE}`;\n  }\n  const firstSeenAt = Reflect.get(value, \"firstSeenAt\");\n  if (\n    typeof firstSeenAt !== \"string\" ||\n    !Number.isFinite(Date.parse(firstSeenAt))\n  ) {\n    return \"firstSeenAt must be a valid timestamp\";\n  }\n  return null;\n}\n\nfunction validatedStringField(\n  value: object,\n  field: (typeof requiredStringFields)[number] | \"firstSeenAt\",\n): string {\n  const fieldValue = Reflect.get(value, field);\n  if (typeof fieldValue !== \"string\") {\n    throw new TypeError(`Validated pin field ${field} is not a string`);\n  }\n  return fieldValue;\n}\n\nfunction validatedFormatVersion(value: object): number {\n  const formatVersion = Reflect.get(value, \"formatVersion\");\n  if (typeof formatVersion !== \"number\") {\n    throw new TypeError(\"Validated pin formatVersion is not a number\");\n  }\n  return formatVersion;\n}\n\nfunction assertCandidatePin(pin: TrustedUserIdentityPin): void {\n  const failure = validationFailure(pin);\n  if (failure) {\n    throw new TrustedUserIdentityPinInputError(pinScope(pin), failure);\n  }\n}\n\nfunction parseStoredPin(\n  value: unknown,\n  scope: PinScope,\n): TrustedUserIdentityPin {\n  const failure = validationFailure(value);\n  if (failure) {\n    throw new TrustedUserIdentityPinCorruptError(scope, failure);\n  }\n  if (typeof value !== \"object\" || value === null) {\n    throw new TrustedUserIdentityPinCorruptError(\n      scope,\n      \"row must be an object\",\n    );\n  }\n  const pin: TrustedUserIdentityPin = {\n    identityTrustDomain: validatedStringField(value, \"identityTrustDomain\"),\n    userId: validatedStringField(value, \"userId\"),\n    formatVersion: validatedFormatVersion(value),\n    signingSuite: validatedStringField(value, \"signingSuite\"),\n    signingPublicKey: validatedStringField(value, \"signingPublicKey\"),\n    signingKeyFingerprint: validatedStringField(value, \"signingKeyFingerprint\"),\n    encapsulationSuite: validatedStringField(value, \"encapsulationSuite\"),\n    encapsulationPublicKey: validatedStringField(\n      value,\n      \"encapsulationPublicKey\",\n    ),\n    encapsulationKeyFingerprint: validatedStringField(\n      value,\n      \"encapsulationKeyFingerprint\",\n    ),\n    firstSeenAt: validatedStringField(value, \"firstSeenAt\"),\n  };\n  if (\n    pin.identityTrustDomain !== scope.identityTrustDomain ||\n    pin.userId !== scope.userId\n  ) {\n    throw new TrustedUserIdentityPinCorruptError(\n      scope,\n      \"primary-key scope does not match the requested pin\",\n    );\n  }\n  return pin;\n}\n\nasync function selectStoredPin(\n  db: ClientSQLiteDatabase | ClientSQLiteTransactionScope,\n  scope: PinScope,\n): Promise<TrustedUserIdentityPin | null> {\n  const rows = await db\n    .select()\n    .from(trustedUserIdentityPins)\n    .where(\n      and(\n        eq(\n          trustedUserIdentityPins.identityTrustDomain,\n          scope.identityTrustDomain,\n        ),\n        eq(trustedUserIdentityPins.userId, scope.userId),\n      ),\n    )\n    .limit(1);\n  const row = rows[0];\n  return row ? parseStoredPin(row, scope) : null;\n}\n\nfunction differingPinFields(\n  existing: TrustedUserIdentityPin,\n  candidate: TrustedUserIdentityPin,\n): readonly ComparedPinField[] {\n  return comparedPinFields.filter(\n    (field) => existing[field] !== candidate[field],\n  );\n}\n\nexport async function loadTrustedUserIdentityPin(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}): Promise<TrustedUserIdentityPin | null> {\n  const scope: PinScope = {\n    identityTrustDomain: input.identityTrustDomain,\n    userId: input.userId,\n  };\n  await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n  return selectStoredPin(\n    getClientSQLitePersistenceRuntime(input.execSql).db,\n    scope,\n  );\n}\n\n/**\n * The user a signing key is already bound to in this trust domain, if any.\n * Each key has at most one such user: the reverse binding is unique.\n */\nexport async function loadTrustedUserIdForSigningKey(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly signingKeyFingerprint: string;\n}): Promise<string | null> {\n  await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n  const rows = await getClientSQLitePersistenceRuntime(input.execSql)\n    .db.select({ userId: trustedUserIdentityPins.userId })\n    .from(trustedUserIdentityPins)\n    .where(\n      and(\n        eq(\n          trustedUserIdentityPins.identityTrustDomain,\n          input.identityTrustDomain,\n        ),\n        eq(\n          trustedUserIdentityPins.signingKeyFingerprint,\n          input.signingKeyFingerprint,\n        ),\n      ),\n    )\n    .limit(1);\n  return rows[0]?.userId ?? null;\n}\n\n/**\n * Atomically establishes or verifies a trust-on-first-use identity pin.\n *\n * The immediate transaction serializes first contact across SDK instances that\n * share the SQLite database. Conflict handling never replaces the existing\n * row: the winning pin is re-read and every identity field is compared before\n * this function returns.\n */\nexport async function compareOrInsertTrustedUserIdentityPin(input: {\n  readonly execSql: ExecSql;\n  readonly pin: TrustedUserIdentityPin;\n}): Promise<TrustedUserIdentityPin> {\n  assertCandidatePin(input.pin);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  return runTrustedUserIdentityPinTransaction(async () => {\n    await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n    return runtime.transaction(\n      async (tx) => {\n        const aliases = await tx\n          .select()\n          .from(trustedUserIdentityPins)\n          .where(\n            and(\n              eq(\n                trustedUserIdentityPins.identityTrustDomain,\n                input.pin.identityTrustDomain,\n              ),\n              eq(\n                trustedUserIdentityPins.signingKeyFingerprint,\n                input.pin.signingKeyFingerprint,\n              ),\n            ),\n          )\n          .limit(1);\n        const alias = aliases[0];\n        if (alias && alias.userId !== input.pin.userId) {\n          throw new TrustedUserIdentityPinMismatchError(\n            parseStoredPin(alias, {\n              identityTrustDomain: input.pin.identityTrustDomain,\n              userId: alias.userId,\n            }),\n            input.pin,\n            [\"userId\"],\n          );\n        }\n        // Targets the primary key only: re-pinning the same user is a no-op,\n        // but a write that would bind this key to a second user must fail at\n        // the unique index rather than be silently skipped.\n        await tx\n          .insert(trustedUserIdentityPins)\n          .values(input.pin)\n          .onConflictDoNothing({\n            target: [\n              trustedUserIdentityPins.identityTrustDomain,\n              trustedUserIdentityPins.userId,\n            ],\n          })\n          .run();\n\n        const stored = await selectStoredPin(tx, input.pin);\n        if (!stored) {\n          throw new TrustedUserIdentityPinCorruptError(\n            input.pin,\n            \"row is missing after compare-or-insert\",\n          );\n        }\n\n        const differingFields = differingPinFields(stored, input.pin);\n        if (differingFields.length > 0) {\n          throw new TrustedUserIdentityPinMismatchError(\n            stored,\n            input.pin,\n            differingFields,\n          );\n        }\n        return stored;\n      },\n      { behavior: \"immediate\" },\n    );\n  });\n}\n"]}

package/data/persistence/trustedUserIdentityPinTransaction.js

@@ -0,0 +1,51 @@
+const MAX_CONTENTION_ATTEMPTS = 8;
+export class TrustedUserIdentityPinContentionError extends Error {
+    code = "trusted_user_identity_pin_contention";
+    constructor() {
+        super("Trusted identity pin transaction remained busy after retry");
+        this.name = "TrustedUserIdentityPinContentionError";
+    }
+}
+function errorChainMessages(error) {
+    const messages = [];
+    let current = error;
+    for (let depth = 0; depth < 4; depth += 1) {
+        if (typeof current !== "object" || current === null) {
+            break;
+        }
+        const message = Reflect.get(current, "message");
+        if (typeof message === "string") {
+            messages.push(message);
+        }
+        current = Reflect.get(current, "cause");
+    }
+    return messages;
+}
+function isImmediateTransactionContention(error) {
+    return errorChainMessages(error).some((message) => /SQLITE_(?:BUSY|LOCKED)|database(?: table)? is locked|cannot start a transaction within a transaction/iu.test(message));
+}
+function contentionDelay(attempt) {
+    const delayMs = Math.min(2 ** attempt, 32);
+    return new Promise((resolve) => {
+        setTimeout(resolve, delayMs);
+    });
+}
+/** Retry only acquisition contention; transaction/body errors pass through. */
+export async function runTrustedUserIdentityPinTransaction(operation) {
+    for (let attempt = 0; attempt < MAX_CONTENTION_ATTEMPTS; attempt += 1) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (!isImmediateTransactionContention(error)) {
+                throw error;
+            }
+            if (attempt + 1 === MAX_CONTENTION_ATTEMPTS) {
+                throw new TrustedUserIdentityPinContentionError();
+            }
+            await contentionDelay(attempt);
+        }
+    }
+    throw new TrustedUserIdentityPinContentionError();
+}
+//# sourceMappingURL=trustedUserIdentityPinTransaction.js.map

package/data/persistence/trustedUserIdentityPinTransaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedUserIdentityPinTransaction.js","sourceRoot":"","sources":["trustedUserIdentityPinTransaction.ts"],"names":[],"mappings":"AAAA,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IACrD,IAAI,GAAG,sCAAsC,CAAC;IAEvD;QACE,KAAK,CAAC,4DAA4D,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;IACtD,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,KAAc;IACtD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAChD,wGAAwG,CAAC,IAAI,CAC3G,OAAO,CACR,CACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,SAA2B;IAE3B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,KAAK,uBAAuB,EAAE,CAAC;gBAC5C,MAAM,IAAI,qCAAqC,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qCAAqC,EAAE,CAAC;AACpD,CAAC","sourcesContent":["const MAX_CONTENTION_ATTEMPTS = 8;\n\nexport class TrustedUserIdentityPinContentionError extends Error {\n  readonly code = \"trusted_user_identity_pin_contention\";\n\n  constructor() {\n    super(\"Trusted identity pin transaction remained busy after retry\");\n    this.name = \"TrustedUserIdentityPinContentionError\";\n  }\n}\n\nfunction errorChainMessages(error: unknown): string[] {\n  const messages: string[] = [];\n  let current: unknown = error;\n  for (let depth = 0; depth < 4; depth += 1) {\n    if (typeof current !== \"object\" || current === null) {\n      break;\n    }\n    const message = Reflect.get(current, \"message\");\n    if (typeof message === \"string\") {\n      messages.push(message);\n    }\n    current = Reflect.get(current, \"cause\");\n  }\n  return messages;\n}\n\nfunction isImmediateTransactionContention(error: unknown): boolean {\n  return errorChainMessages(error).some((message) =>\n    /SQLITE_(?:BUSY|LOCKED)|database(?: table)? is locked|cannot start a transaction within a transaction/iu.test(\n      message,\n    ),\n  );\n}\n\nfunction contentionDelay(attempt: number): Promise<void> {\n  const delayMs = Math.min(2 ** attempt, 32);\n  return new Promise((resolve) => {\n    setTimeout(resolve, delayMs);\n  });\n}\n\n/** Retry only acquisition contention; transaction/body errors pass through. */\nexport async function runTrustedUserIdentityPinTransaction<T>(\n  operation: () => Promise<T>,\n): Promise<T> {\n  for (let attempt = 0; attempt < MAX_CONTENTION_ATTEMPTS; attempt += 1) {\n    try {\n      return await operation();\n    } catch (error) {\n      if (!isImmediateTransactionContention(error)) {\n        throw error;\n      }\n      if (attempt + 1 === MAX_CONTENTION_ATTEMPTS) {\n        throw new TrustedUserIdentityPinContentionError();\n      }\n      await contentionDelay(attempt);\n    }\n  }\n  throw new TrustedUserIdentityPinContentionError();\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyBundle.js

@@ -0,0 +1,77 @@
+import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+function bundleMismatch(message) {
+    throw new KeyingVerificationError("equivocation", message);
+}
+async function memberEnvelopesRoot(bundle) {
+    try {
+        return await computePrincipalMemberEnvelopesRoot(bundle.currentMemberEnvelopes.envelopes);
+    }
+    catch (error) {
+        if (error instanceof PrincipalMemberEnvelopeValidationError) {
+            throw new KeyingVerificationError("invalid_shape", error.message);
+        }
+        throw error;
+    }
+}
+async function assertBundlePayloadMatches(input) {
+    const { bundle, policy } = input;
+    const payloadHash = await computePrincipalStatePayloadCiphertextHash(bundle.currentPayload.ciphertext);
+    const envelopesRoot = await memberEnvelopesRoot(bundle);
+    if (bundle.currentPayload.principalType !== policy.principalType ||
+        bundle.currentPayload.principalId !== policy.principalId ||
+        bundle.currentPayload.stateHash !== policy.stateHash ||
+        bundle.currentPayload.ciphertextHash !== payloadHash ||
+        policy.state.payloadCiphertextHash !== payloadHash ||
+        bundle.currentMemberEnvelopes.principalType !== policy.principalType ||
+        bundle.currentMemberEnvelopes.principalId !== policy.principalId ||
+        bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||
+        bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
+        envelopesRoot !== policy.state.memberEnvelopesRoot) {
+        bundleMismatch("Verified principal policy bundle payload mismatch");
+    }
+}
+export async function assertBundleMatchesVerifiedPolicy(input) {
+    const { bundle, policy } = input;
+    if (bundle.currentState.principalType !== policy.principalType ||
+        bundle.currentState.principalId !== policy.principalId ||
+        bundle.currentState.version !== policy.version ||
+        bundle.currentState.keyEpoch !== policy.keyEpoch ||
+        bundle.currentState.stateHash !== policy.stateHash ||
+        policy.checkpoint.version !== policy.version ||
+        policy.checkpoint.stateHash !== policy.stateHash) {
+        bundleMismatch("Verified principal policy bundle head mismatch");
+    }
+    if (canonicalKeyingJsonString(bundle.currentState, "principal policy bundle state") !==
+        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
+        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(bundle.currentProjection), "principal policy bundle projection") !==
+            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
+        canonicalKeyingJsonString(normalizePrincipalContainerGrants(bundle.currentGrants), "principal policy bundle grants") !==
+            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
+        bundleMismatch("Verified principal policy bundle content mismatch");
+    }
+    const history = policy.history ?? [];
+    const expectedChain = [
+        ...bundle.previousStates,
+        {
+            state: bundle.currentState,
+            projection: bundle.currentProjection,
+            grants: bundle.currentGrants,
+        },
+    ].map((entry) => ({
+        ...entry,
+        projection: normalizePrincipalProjectionMembers(entry.projection),
+        grants: normalizePrincipalContainerGrants(entry.grants),
+    }));
+    const verifiedHistory = history.map((entry) => ({
+        ...entry,
+        projection: normalizePrincipalProjectionMembers(entry.projection),
+        grants: normalizePrincipalContainerGrants(entry.grants),
+    }));
+    if (canonicalKeyingJsonString(expectedChain, "principal policy bundle history") !==
+        canonicalKeyingJsonString(verifiedHistory, "verified principal policy history")) {
+        bundleMismatch("Verified principal policy bundle history mismatch");
+    }
+    await assertBundlePayloadMatches(input);
+}
+//# sourceMappingURL=verifiedPrincipalPolicyBundle.js.map

package/data/persistence/verifiedPrincipalPolicyBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,IACE,MAAM,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC5D,MAAM,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACxD,MAAM,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACpD,MAAM,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACpD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,MAAM,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACpE,MAAM,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAChE,MAAM,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC5D,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACvD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC1D,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACtD,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC9C,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAChD,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAClD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,IACE,yBAAyB,CACvB,MAAM,CAAC,YAAY,EACnB,+BAA+B,CAChC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC7D,oCAAoC,CACrC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,aAAa,CAAC,EACvD,gCAAgC,CACjC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["import {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\n\nfunction bundleMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      bundle.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertBundlePayloadMatches(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    bundle.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(bundle);\n  if (\n    bundle.currentPayload.principalType !== policy.principalType ||\n    bundle.currentPayload.principalId !== policy.principalId ||\n    bundle.currentPayload.stateHash !== policy.stateHash ||\n    bundle.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    bundle.currentMemberEnvelopes.principalType !== policy.principalType ||\n    bundle.currentMemberEnvelopes.principalId !== policy.principalId ||\n    bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    bundleMismatch(\"Verified principal policy bundle payload mismatch\");\n  }\n}\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  if (\n    bundle.currentState.principalType !== policy.principalType ||\n    bundle.currentState.principalId !== policy.principalId ||\n    bundle.currentState.version !== policy.version ||\n    bundle.currentState.keyEpoch !== policy.keyEpoch ||\n    bundle.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    bundleMismatch(\"Verified principal policy bundle head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      bundle.currentState,\n      \"principal policy bundle state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(bundle.currentProjection),\n      \"principal policy bundle projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(bundle.currentGrants),\n      \"principal policy bundle grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle content mismatch\");\n  }\n\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle history mismatch\");\n  }\n  await assertBundlePayloadMatches(input);\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyRetentionPersistence.js

@@ -0,0 +1,18 @@
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensurePrincipalPolicyTables, retainPrincipalPolicyBundleInTransaction, } from "./principalPolicyPersistence.js";
+import { assertBundleMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyBundle.js";
+/** Retains a just-verified epoch without promoting it to the mutable head. */
+export async function retainVerifiedPrincipalPolicyBundle(input) {
+    await assertBundleMatchesVerifiedPolicy(input);
+    await ensurePrincipalPolicyTables(input.execSql);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const retain = (tx) => retainPrincipalPolicyBundleInTransaction(tx, input.bundle, input.updatedAt, input.organizationId);
+    if (input.stillCurrent) {
+        await runtime.guardedTransaction(retain, input.stillCurrent, {
+            behavior: "immediate",
+        });
+        return;
+    }
+    await runtime.transaction(retain, { behavior: "immediate" });
+}
+//# sourceMappingURL=verifiedPrincipalPolicyRetentionPersistence.js.map

package/data/persistence/verifiedPrincipalPolicyRetentionPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyRetentionPersistence.js","sourceRoot":"","sources":["verifiedPrincipalPolicyRetentionPersistence.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF,OAAO,EACL,2BAA2B,EAC3B,wCAAwC,GACzC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEpF,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAOzD;IACC,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,CACb,EAAkE,EAClE,EAAE,CACF,wCAAwC,CACtC,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE;YAC3D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  ensurePrincipalPolicyTables,\n  retainPrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\n/** Retains a just-verified epoch without promoting it to the mutable head. */\nexport async function retainVerifiedPrincipalPolicyBundle(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  await assertBundleMatchesVerifiedPolicy(input);\n  await ensurePrincipalPolicyTables(input.execSql);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const retain = (\n    tx: Parameters<typeof retainPrincipalPolicyBundleInTransaction>[0],\n  ) =>\n    retainPrincipalPolicyBundleInTransaction(\n      tx,\n      input.bundle,\n      input.updatedAt,\n      input.organizationId,\n    );\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(retain, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(retain, { behavior: \"immediate\" });\n}\n"]}

package/data/principalPolicyStates.js

@@ -0,0 +1,24 @@
+/** Flatten a bundle's previous + current states into one chain for matching. */
+export function principalPolicyBundleStates(bundle) {
+    return [
+        ...bundle.previousStates.map((entry) => entry.state),
+        bundle.currentState,
+    ];
+}
+/**
+ * The exact six-field head match every reference check uses. All callers must
+ * agree on this definition of "the same state": a check that dropped a field
+ * would accept a forged or stale head that the others reject.
+ */
+export function principalStateMatchesReference(state, reference) {
+    return (state.principalType === reference.principalType &&
+        state.principalId === reference.principalId &&
+        state.version === reference.version &&
+        state.keyEpoch === reference.keyEpoch &&
+        state.stateHash === reference.stateHash &&
+        state.keyFingerprint === reference.keyFingerprint);
+}
+export function principalPolicyBundleContainsReference(bundle, reference) {
+    return principalPolicyBundleStates(bundle).some((state) => principalStateMatchesReference(state, reference));
+}
+//# sourceMappingURL=principalPolicyStates.js.map

package/data/principalPolicyStates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyStates.js","sourceRoot":"","sources":["principalPolicyStates.ts"],"names":[],"mappings":"AAaA,gFAAgF;AAChF,MAAM,UAAU,2BAA2B,CACzC,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,MAAM,CAAC,YAAY;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA+B,EAC/B,SAAkC;IAElC,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;QACrC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;QACvC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAqC,EACrC,SAAkC;IAElC,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACxD,8BAA8B,CAAC,KAAK,EAAE,SAAS,CAAC,CACjD,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\ntype PrincipalPolicyStateHead = Pick<\n  ReferencedPrincipalHead,\n  | \"principalType\"\n  | \"principalId\"\n  | \"version\"\n  | \"keyEpoch\"\n  | \"stateHash\"\n  | \"keyFingerprint\"\n>;\n\n/** Flatten a bundle's previous + current states into one chain for matching. */\nexport function principalPolicyBundleStates(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"currentState\"][] {\n  return [\n    ...bundle.previousStates.map((entry) => entry.state),\n    bundle.currentState,\n  ];\n}\n\n/**\n * The exact six-field head match every reference check uses. All callers must\n * agree on this definition of \"the same state\": a check that dropped a field\n * would accept a forged or stale head that the others reject.\n */\nexport function principalStateMatchesReference(\n  state: PrincipalPolicyStateHead,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  return (\n    state.principalType === reference.principalType &&\n    state.principalId === reference.principalId &&\n    state.version === reference.version &&\n    state.keyEpoch === reference.keyEpoch &&\n    state.stateHash === reference.stateHash &&\n    state.keyFingerprint === reference.keyFingerprint\n  );\n}\n\nexport function principalPolicyBundleContainsReference(\n  bundle: PrincipalPolicyBundleResponse,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  return principalPolicyBundleStates(bundle).some((state) =>\n    principalStateMatchesReference(state, reference),\n  );\n}\n"]}

package/data/principals/organizationAuthorityDescriptor.d.ts

@@ -0,0 +1,22 @@
+import type { ReferencedPrincipalHead } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+export type OrganizationGroupHead = ReferencedPrincipalHead & {
+    readonly principalType: "group";
+};
+export interface OrganizationAuthorityDescriptor {
+    readonly adminGroupId: string;
+    readonly groupHeads: readonly OrganizationGroupHead[];
+    readonly memberGroupId: string;
+    readonly organizationId: string;
+    readonly version: 2;
+}
+export declare function normalizeOrganizationGroupHeads(heads: readonly OrganizationGroupHead[]): OrganizationGroupHead[];
+export declare function encodeOrganizationAuthorityDescriptor(descriptor: OrganizationAuthorityDescriptor): string;
+export declare function parseOrganizationAuthorityDescriptor(ciphertext: string): OrganizationAuthorityDescriptor;
+export declare function requireOrganizationGroupHead(descriptor: OrganizationAuthorityDescriptor, groupId: string): OrganizationGroupHead;
+/**
+ * Whether a served policy bundle's previous states include `head`. The chain
+ * is only as trustworthy as the bundle: callers decide whether it is verified.
+ */
+export declare function previousStatesIncludeHead(bundle: Pick<PrincipalPolicyBundleResponse, "previousStates">, head: ReferencedPrincipalHead): boolean;
+export declare function principalHeadMatchesReference(head: ReferencedPrincipalHead, reference: ReferencedPrincipalHead): boolean;