@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/data/principals/organizationAuthorityDescriptor.js

@@ -0,0 +1,138 @@
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+    const actual = Object.keys(value);
+    return (actual.length === keys.length && actual.every((key) => keys.includes(key)));
+}
+function parseGroupHead(value) {
+    if (!isPlainRecord(value) ||
+        !hasExactKeys(value, [
+            "principalType",
+            "principalId",
+            "version",
+            "keyEpoch",
+            "stateHash",
+            "keyFingerprint",
+        ]) ||
+        value.principalType !== "group" ||
+        typeof value.principalId !== "string" ||
+        value.principalId.length === 0 ||
+        !Number.isSafeInteger(value.version) ||
+        Number(value.version) < 1 ||
+        !Number.isSafeInteger(value.keyEpoch) ||
+        Number(value.keyEpoch) < 1 ||
+        typeof value.stateHash !== "string" ||
+        value.stateHash.length === 0 ||
+        typeof value.keyFingerprint !== "string" ||
+        value.keyFingerprint.length === 0) {
+        return null;
+    }
+    return {
+        principalType: "group",
+        principalId: value.principalId,
+        version: Number(value.version),
+        keyEpoch: Number(value.keyEpoch),
+        stateHash: value.stateHash,
+        keyFingerprint: value.keyFingerprint,
+    };
+}
+export function normalizeOrganizationGroupHeads(heads) {
+    const sorted = [...heads].sort((left, right) => left.principalId < right.principalId
+        ? -1
+        : left.principalId > right.principalId
+            ? 1
+            : 0);
+    if (sorted.some((head, index) => head.principalId === sorted[index - 1]?.principalId)) {
+        throw new Error("Organization authority descriptor has duplicate groups");
+    }
+    return sorted;
+}
+export function encodeOrganizationAuthorityDescriptor(descriptor) {
+    return bytesToBase64(new TextEncoder().encode(JSON.stringify({
+        version: descriptor.version,
+        organizationId: descriptor.organizationId,
+        adminGroupId: descriptor.adminGroupId,
+        memberGroupId: descriptor.memberGroupId,
+        groupHeads: normalizeOrganizationGroupHeads(descriptor.groupHeads),
+    })));
+}
+export function parseOrganizationAuthorityDescriptor(ciphertext) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(base64ToBytes(ciphertext)));
+    }
+    catch {
+        throw new Error("Organization authority descriptor is invalid");
+    }
+    if (!isPlainRecord(parsed) ||
+        !hasExactKeys(parsed, [
+            "version",
+            "organizationId",
+            "adminGroupId",
+            "memberGroupId",
+            "groupHeads",
+        ]) ||
+        parsed.version !== 2 ||
+        typeof parsed.organizationId !== "string" ||
+        parsed.organizationId.length === 0 ||
+        typeof parsed.adminGroupId !== "string" ||
+        parsed.adminGroupId.length === 0 ||
+        typeof parsed.memberGroupId !== "string" ||
+        parsed.memberGroupId.length === 0 ||
+        parsed.adminGroupId === parsed.memberGroupId ||
+        !Array.isArray(parsed.groupHeads)) {
+        throw new Error("Organization authority descriptor is invalid");
+    }
+    const groupHeads = [];
+    for (const candidate of parsed.groupHeads) {
+        const head = parseGroupHead(candidate);
+        if (!head) {
+            throw new Error("Organization authority descriptor is invalid");
+        }
+        groupHeads.push(head);
+    }
+    const normalized = normalizeOrganizationGroupHeads(groupHeads);
+    if (!normalized.some((head) => head.principalId === parsed.adminGroupId) ||
+        !normalized.some((head) => head.principalId === parsed.memberGroupId)) {
+        throw new Error("Organization authority descriptor is invalid");
+    }
+    return {
+        version: 2,
+        organizationId: parsed.organizationId,
+        adminGroupId: parsed.adminGroupId,
+        memberGroupId: parsed.memberGroupId,
+        groupHeads: normalized,
+    };
+}
+export function requireOrganizationGroupHead(descriptor, groupId) {
+    const head = descriptor.groupHeads.find((candidate) => candidate.principalId === groupId);
+    if (!head) {
+        throw new Error("Group is absent from the signed organization directory");
+    }
+    return head;
+}
+/**
+ * Whether a served policy bundle's previous states include `head`. The chain
+ * is only as trustworthy as the bundle: callers decide whether it is verified.
+ */
+export function previousStatesIncludeHead(bundle, head) {
+    return bundle.previousStates.some(({ state }) => principalHeadMatchesReference({
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        keyEpoch: state.keyEpoch,
+        stateHash: state.stateHash,
+        keyFingerprint: state.keyFingerprint,
+    }, head));
+}
+export function principalHeadMatchesReference(head, reference) {
+    return (head.principalType === reference.principalType &&
+        head.principalId === reference.principalId &&
+        head.version === reference.version &&
+        head.keyEpoch === reference.keyEpoch &&
+        head.stateHash === reference.stateHash &&
+        head.keyFingerprint === reference.keyFingerprint);
+}
+//# sourceMappingURL=organizationAuthorityDescriptor.js.map

package/data/principals/organizationAuthorityDescriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationAuthorityDescriptor.js","sourceRoot":"","sources":["organizationAuthorityDescriptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA4BnE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CACnB,KAA8B,EAC9B,IAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IACE,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,YAAY,CAAC,KAAK,EAAE;YACnB,eAAe;YACf,aAAa;YACb,SAAS;YACT,UAAU;YACV,WAAW;YACX,gBAAgB;SACjB,CAAC;QACF,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACxC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAuC;IAEvC,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC7C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW;QAClC,CAAC,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW;YACpC,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CACR,CAAC;IACF,IACE,MAAM,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,WAAW,CACrE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,UAA2C;IAE3C,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,UAAU,EAAE,+BAA+B,CAAC,UAAU,CAAC,UAAU,CAAC;KACnE,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,UAAkB;IAElB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,IACE,CAAC,aAAa,CAAC,MAAM,CAAC;QACtB,CAAC,YAAY,CAAC,MAAM,EAAE;YACpB,SAAS;YACT,gBAAgB;YAChB,cAAc;YACd,eAAe;YACf,YAAY;SACb,CAAC;QACF,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;QACzC,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAClC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAChC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QACjC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,aAAa;QAC5C,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,UAAU,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IAC/D,IACE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,YAAY,CAAC;QACpE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,aAAa,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,UAAU;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,UAA2C,EAC3C,OAAe;IAEf,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CACrC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,OAAO,CACjD,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA6D,EAC7D,IAA6B;IAE7B,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC9C,6BAA6B,CAC3B;QACE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,EACD,IAAI,CACL,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAA6B,EAC7B,SAAkC;IAElC,OAAO,CACL,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC9C,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC1C,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QAClC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;QACpC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;QACtC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,CACjD,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport type OrganizationGroupHead = ReferencedPrincipalHead & {\n  readonly principalType: \"group\";\n};\n\nexport interface OrganizationAuthorityDescriptor {\n  readonly adminGroupId: string;\n  readonly groupHeads: readonly OrganizationGroupHead[];\n  readonly memberGroupId: string;\n  readonly organizationId: string;\n  readonly version: 2;\n}\n\ninterface DescriptorCandidate extends Record<string, unknown> {\n  adminGroupId?: unknown;\n  groupHeads?: unknown;\n  keyEpoch?: unknown;\n  keyFingerprint?: unknown;\n  memberGroupId?: unknown;\n  organizationId?: unknown;\n  principalId?: unknown;\n  principalType?: unknown;\n  stateHash?: unknown;\n  version?: unknown;\n}\n\nfunction isPlainRecord(value: unknown): value is DescriptorCandidate {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction hasExactKeys(\n  value: Record<string, unknown>,\n  keys: readonly string[],\n): boolean {\n  const actual = Object.keys(value);\n  return (\n    actual.length === keys.length && actual.every((key) => keys.includes(key))\n  );\n}\n\nfunction parseGroupHead(value: unknown): OrganizationGroupHead | null {\n  if (\n    !isPlainRecord(value) ||\n    !hasExactKeys(value, [\n      \"principalType\",\n      \"principalId\",\n      \"version\",\n      \"keyEpoch\",\n      \"stateHash\",\n      \"keyFingerprint\",\n    ]) ||\n    value.principalType !== \"group\" ||\n    typeof value.principalId !== \"string\" ||\n    value.principalId.length === 0 ||\n    !Number.isSafeInteger(value.version) ||\n    Number(value.version) < 1 ||\n    !Number.isSafeInteger(value.keyEpoch) ||\n    Number(value.keyEpoch) < 1 ||\n    typeof value.stateHash !== \"string\" ||\n    value.stateHash.length === 0 ||\n    typeof value.keyFingerprint !== \"string\" ||\n    value.keyFingerprint.length === 0\n  ) {\n    return null;\n  }\n  return {\n    principalType: \"group\",\n    principalId: value.principalId,\n    version: Number(value.version),\n    keyEpoch: Number(value.keyEpoch),\n    stateHash: value.stateHash,\n    keyFingerprint: value.keyFingerprint,\n  };\n}\n\nexport function normalizeOrganizationGroupHeads(\n  heads: readonly OrganizationGroupHead[],\n): OrganizationGroupHead[] {\n  const sorted = [...heads].sort((left, right) =>\n    left.principalId < right.principalId\n      ? -1\n      : left.principalId > right.principalId\n        ? 1\n        : 0,\n  );\n  if (\n    sorted.some(\n      (head, index) => head.principalId === sorted[index - 1]?.principalId,\n    )\n  ) {\n    throw new Error(\"Organization authority descriptor has duplicate groups\");\n  }\n  return sorted;\n}\n\nexport function encodeOrganizationAuthorityDescriptor(\n  descriptor: OrganizationAuthorityDescriptor,\n): string {\n  return bytesToBase64(\n    new TextEncoder().encode(\n      JSON.stringify({\n        version: descriptor.version,\n        organizationId: descriptor.organizationId,\n        adminGroupId: descriptor.adminGroupId,\n        memberGroupId: descriptor.memberGroupId,\n        groupHeads: normalizeOrganizationGroupHeads(descriptor.groupHeads),\n      }),\n    ),\n  );\n}\n\nexport function parseOrganizationAuthorityDescriptor(\n  ciphertext: string,\n): OrganizationAuthorityDescriptor {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(new TextDecoder().decode(base64ToBytes(ciphertext)));\n  } catch {\n    throw new Error(\"Organization authority descriptor is invalid\");\n  }\n\n  if (\n    !isPlainRecord(parsed) ||\n    !hasExactKeys(parsed, [\n      \"version\",\n      \"organizationId\",\n      \"adminGroupId\",\n      \"memberGroupId\",\n      \"groupHeads\",\n    ]) ||\n    parsed.version !== 2 ||\n    typeof parsed.organizationId !== \"string\" ||\n    parsed.organizationId.length === 0 ||\n    typeof parsed.adminGroupId !== \"string\" ||\n    parsed.adminGroupId.length === 0 ||\n    typeof parsed.memberGroupId !== \"string\" ||\n    parsed.memberGroupId.length === 0 ||\n    parsed.adminGroupId === parsed.memberGroupId ||\n    !Array.isArray(parsed.groupHeads)\n  ) {\n    throw new Error(\"Organization authority descriptor is invalid\");\n  }\n\n  const groupHeads: OrganizationGroupHead[] = [];\n  for (const candidate of parsed.groupHeads) {\n    const head = parseGroupHead(candidate);\n    if (!head) {\n      throw new Error(\"Organization authority descriptor is invalid\");\n    }\n    groupHeads.push(head);\n  }\n  const normalized = normalizeOrganizationGroupHeads(groupHeads);\n  if (\n    !normalized.some((head) => head.principalId === parsed.adminGroupId) ||\n    !normalized.some((head) => head.principalId === parsed.memberGroupId)\n  ) {\n    throw new Error(\"Organization authority descriptor is invalid\");\n  }\n\n  return {\n    version: 2,\n    organizationId: parsed.organizationId,\n    adminGroupId: parsed.adminGroupId,\n    memberGroupId: parsed.memberGroupId,\n    groupHeads: normalized,\n  };\n}\n\nexport function requireOrganizationGroupHead(\n  descriptor: OrganizationAuthorityDescriptor,\n  groupId: string,\n): OrganizationGroupHead {\n  const head = descriptor.groupHeads.find(\n    (candidate) => candidate.principalId === groupId,\n  );\n  if (!head) {\n    throw new Error(\"Group is absent from the signed organization directory\");\n  }\n  return head;\n}\n\n/**\n * Whether a served policy bundle's previous states include `head`. The chain\n * is only as trustworthy as the bundle: callers decide whether it is verified.\n */\nexport function previousStatesIncludeHead(\n  bundle: Pick<PrincipalPolicyBundleResponse, \"previousStates\">,\n  head: ReferencedPrincipalHead,\n): boolean {\n  return bundle.previousStates.some(({ state }) =>\n    principalHeadMatchesReference(\n      {\n        principalType: state.principalType,\n        principalId: state.principalId,\n        version: state.version,\n        keyEpoch: state.keyEpoch,\n        stateHash: state.stateHash,\n        keyFingerprint: state.keyFingerprint,\n      },\n      head,\n    ),\n  );\n}\n\nexport function principalHeadMatchesReference(\n  head: ReferencedPrincipalHead,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  return (\n    head.principalType === reference.principalType &&\n    head.principalId === reference.principalId &&\n    head.version === reference.version &&\n    head.keyEpoch === reference.keyEpoch &&\n    head.stateHash === reference.stateHash &&\n    head.keyFingerprint === reference.keyFingerprint\n  );\n}\n"]}

package/data/principals/organizationGroupRoles.js

@@ -0,0 +1,27 @@
+import { computePrincipalStateHash, computePrincipalStatePayloadCiphertextHash, } from "../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalPolicyBundle } from "../persistence/principalPolicyPersistence.js";
+import { parseOrganizationAuthorityDescriptor } from "./organizationAuthorityDescriptor.js";
+/** Public labels come only from a descriptor pinned by prior verification. */
+export async function loadVerifiedOrganizationGroupRoles(execSql, organizationId) {
+    const checkpoint = await loadPrincipalPolicyCheckpoint(execSql, "organization", organizationId);
+    const bundle = await loadPrincipalPolicyBundle(execSql, "organization", organizationId);
+    if (!checkpoint || !bundle)
+        return new Map();
+    const state = bundle.currentState;
+    if (state.principalType !== "organization" ||
+        state.principalId !== organizationId ||
+        state.version !== checkpoint.version ||
+        state.stateHash !== checkpoint.stateHash ||
+        (await computePrincipalStateHash(state)) !== checkpoint.stateHash ||
+        (await computePrincipalStatePayloadCiphertextHash(bundle.currentPayload.ciphertext)) !== state.payloadCiphertextHash)
+        return new Map();
+    const descriptor = parseOrganizationAuthorityDescriptor(bundle.currentPayload.ciphertext);
+    if (descriptor.organizationId !== organizationId)
+        return new Map();
+    return new Map([
+        [descriptor.adminGroupId, "Admins"],
+        [descriptor.memberGroupId, "Members"],
+    ]);
+}
+//# sourceMappingURL=organizationGroupRoles.js.map

package/data/principals/organizationGroupRoles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationGroupRoles.js","sourceRoot":"","sources":["organizationGroupRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AAEzF,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,cAAsB;IAEtB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,EACP,cAAc,EACd,cAAc,CACf,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,OAAO,EACP,cAAc,EACd,cAAc,CACf,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,IACE,KAAK,CAAC,aAAa,KAAK,cAAc;QACtC,KAAK,CAAC,WAAW,KAAK,cAAc;QACpC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;QACpC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;QACxC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS;QACjE,CAAC,MAAM,0CAA0C,CAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC,KAAK,KAAK,CAAC,qBAAqB;QAElC,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,oCAAoC,CACrD,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACF,IAAI,UAAU,CAAC,cAAc,KAAK,cAAc;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACnE,OAAO,IAAI,GAAG,CAAC;QACb,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC;QACnC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC;KACtC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  computePrincipalStateHash,\n  computePrincipalStatePayloadCiphertextHash,\n} from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../persistence/principalPolicyPersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { parseOrganizationAuthorityDescriptor } from \"./organizationAuthorityDescriptor\";\n\n/** Public labels come only from a descriptor pinned by prior verification. */\nexport async function loadVerifiedOrganizationGroupRoles(\n  execSql: ExecSql,\n  organizationId: string,\n): Promise<ReadonlyMap<string, string>> {\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    \"organization\",\n    organizationId,\n  );\n  const bundle = await loadPrincipalPolicyBundle(\n    execSql,\n    \"organization\",\n    organizationId,\n  );\n  if (!checkpoint || !bundle) return new Map();\n  const state = bundle.currentState;\n  if (\n    state.principalType !== \"organization\" ||\n    state.principalId !== organizationId ||\n    state.version !== checkpoint.version ||\n    state.stateHash !== checkpoint.stateHash ||\n    (await computePrincipalStateHash(state)) !== checkpoint.stateHash ||\n    (await computePrincipalStatePayloadCiphertextHash(\n      bundle.currentPayload.ciphertext,\n    )) !== state.payloadCiphertextHash\n  )\n    return new Map();\n  const descriptor = parseOrganizationAuthorityDescriptor(\n    bundle.currentPayload.ciphertext,\n  );\n  if (descriptor.organizationId !== organizationId) return new Map();\n  return new Map([\n    [descriptor.adminGroupId, \"Admins\"],\n    [descriptor.memberGroupId, \"Members\"],\n  ]);\n}\n"]}

package/data/principals/principalHistoryPrefixProtection.js

@@ -0,0 +1,29 @@
+import { serializeKeyingCanonicalJson, toFingerprint, } from "../../internal/crypto/index.js";
+// Signed entries and index nodes are content-addressed public evidence. Keep
+// their storage namespace stable across local-key replacement; authenticating a
+// prefix still requires the current private key. An unreadable prefix is discarded
+// and rebuilt from signatures, reusing rows only after checking the new root.
+export async function principalHistoryEvidenceScopeId(input) {
+    return toFingerprint(new TextEncoder().encode(serializeKeyingCanonicalJson([
+        "tearleads.sdk.principal-history-evidence.v2",
+        input.organizationId,
+        input.head.principalType,
+        input.head.principalId,
+        input.protection.context,
+    ])));
+}
+export async function principalHistoryPrefixProtection(protection, prefix) {
+    return {
+        localKey: protection.localKey,
+        context: serializeKeyingCanonicalJson({
+            domain: "tearleads.sdk.principal-history-prefix.v2",
+            context: protection.context,
+            scopeId: prefix.scopeId,
+            organizationId: prefix.organizationId,
+            version: prefix.version,
+            headJson: prefix.headJson,
+            currentDigest: await toFingerprint(new TextEncoder().encode(prefix.currentJson)),
+        }),
+    };
+}
+//# sourceMappingURL=principalHistoryPrefixProtection.js.map

package/data/principals/principalHistoryPrefixProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryPrefixProtection.js","sourceRoot":"","sources":["principalHistoryPrefixProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,6EAA6E;AAC7E,gFAAgF;AAChF,mFAAmF;AACnF,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,6CAA6C;QAC7C,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,IAAI,CAAC,aAAa;QACxB,KAAK,CAAC,IAAI,CAAC,WAAW;QACtB,KAAK,CAAC,UAAU,CAAC,OAAO;KACzB,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAAiD,EACjD,MAAgD;IAEhD,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAC7C;SACF,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalHistoryPrefix } from \"../persistence/principalHistoryPrefixPersistence\";\n\n// Signed entries and index nodes are content-addressed public evidence. Keep\n// their storage namespace stable across local-key replacement; authenticating a\n// prefix still requires the current private key. An unreadable prefix is discarded\n// and rebuilt from signatures, reusing rows only after checking the new root.\nexport async function principalHistoryEvidenceScopeId(input: {\n  readonly organizationId: string;\n  readonly head: Pick<ReferencedPrincipalHead, \"principalType\" | \"principalId\">;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n}): Promise<string> {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-evidence.v2\",\n        input.organizationId,\n        input.head.principalType,\n        input.head.principalId,\n        input.protection.context,\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryPrefixProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  prefix: Omit<PrincipalHistoryPrefix, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-prefix.v2\",\n      context: protection.context,\n      scopeId: prefix.scopeId,\n      organizationId: prefix.organizationId,\n      version: prefix.version,\n      headJson: prefix.headJson,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(prefix.currentJson),\n      ),\n    }),\n  };\n}\n"]}

package/data/principals/principalHistoryProtection.d.ts

@@ -0,0 +1,10 @@
+import { type PrincipalPolicyHistoryProgressOptions } from "../../internal/crypto/index.js";
+export type PrincipalHistoryProtectionLease = <T>(operation: (input: {
+    readonly protection: PrincipalPolicyHistoryProgressOptions;
+    readonly stillCurrent: () => boolean;
+}) => Promise<T>) => Promise<T>;
+/** Own private key bytes before any asynchronous discovery or verification. */
+export declare function ownPrincipalHistoryProtection(protection: PrincipalPolicyHistoryProgressOptions): {
+    context: string;
+    localKey: Uint8Array<ArrayBuffer>;
+};

package/data/principals/principalHistoryProtection.js

@@ -0,0 +1,14 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+/** Own private key bytes before any asynchronous discovery or verification. */
+export function ownPrincipalHistoryProtection(protection) {
+    if (!(protection.localKey instanceof Uint8Array) ||
+        protection.localKey.byteLength !== 32 ||
+        typeof protection.context !== "string" ||
+        protection.context.length === 0)
+        throw new KeyingVerificationError("invalid_shape", "Principal history recovery requires a private 32-byte key and trust context");
+    return {
+        context: protection.context,
+        localKey: new Uint8Array(protection.localKey),
+    };
+}
+//# sourceMappingURL=principalHistoryProtection.js.map

package/data/principals/principalHistoryProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryProtection.js","sourceRoot":"","sources":["principalHistoryProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAS3B,+EAA+E;AAC/E,MAAM,UAAU,6BAA6B,CAC3C,UAAiD;IAEjD,IACE,CAAC,CAAC,UAAU,CAAC,QAAQ,YAAY,UAAU,CAAC;QAC5C,UAAU,CAAC,QAAQ,CAAC,UAAU,KAAK,EAAE;QACrC,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;QACtC,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAE/B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6EAA6E,CAC9E,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,QAAQ,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;KAC9C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryProgressOptions,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalHistoryProtectionLease = <T>(\n  operation: (input: {\n    readonly protection: PrincipalPolicyHistoryProgressOptions;\n    readonly stillCurrent: () => boolean;\n  }) => Promise<T>,\n) => Promise<T>;\n\n/** Own private key bytes before any asynchronous discovery or verification. */\nexport function ownPrincipalHistoryProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n) {\n  if (\n    !(protection.localKey instanceof Uint8Array) ||\n    protection.localKey.byteLength !== 32 ||\n    typeof protection.context !== \"string\" ||\n    protection.context.length === 0\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal history recovery requires a private 32-byte key and trust context\",\n    );\n  return {\n    context: protection.context,\n    localKey: new Uint8Array(protection.localKey),\n  };\n}\n"]}

package/data/principals/principalHistoryStageProtection.js

@@ -0,0 +1,67 @@
+import { serializeKeyingCanonicalJson, toFingerprint, } from "../../internal/crypto/index.js";
+import { isPrincipalPolicyPageResponse } from "../../internal/validators/response/index.js";
+export function principalHistoryStageId(organizationId, head, context, retainedReferences) {
+    return toFingerprint(new TextEncoder().encode(serializeKeyingCanonicalJson([
+        "tearleads.sdk.principal-history-stage.v1",
+        organizationId,
+        head.principalType,
+        head.principalId,
+        head.version,
+        head.keyEpoch,
+        head.stateHash,
+        head.keyFingerprint,
+        context,
+        [...retainedReferences]
+            .sort((a, b) => a.version - b.version)
+            .map((reference) => [
+            reference.principalType,
+            reference.principalId,
+            reference.version,
+            reference.keyEpoch,
+            reference.stateHash,
+            reference.keyFingerprint,
+        ]),
+    ])));
+}
+export async function principalHistoryStageProtection(protection, expectedHead, stage) {
+    return {
+        localKey: protection.localKey,
+        context: serializeKeyingCanonicalJson({
+            domain: "tearleads.sdk.principal-history-stage.v1",
+            context: protection.context,
+            id: stage.id,
+            organizationId: stage.organizationId,
+            expectedHead: { ...expectedHead },
+            afterVersion: stage.afterVersion,
+            complete: stage.complete,
+            currentDigest: await toFingerprint(new TextEncoder().encode(stage.currentJson)),
+        }),
+    };
+}
+export function parsePrincipalHistoryStageCurrent(stage) {
+    let current;
+    try {
+        current = JSON.parse(stage.currentJson);
+    }
+    catch {
+        return null;
+    }
+    if (!current || typeof current !== "object" || Array.isArray(current))
+        return null;
+    const page = {
+        ...current,
+        previousStates: [],
+        historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },
+    };
+    if (!isPrincipalPolicyPageResponse(page) ||
+        stage.afterVersion >= page.currentState.version)
+        return null;
+    return {
+        currentState: page.currentState,
+        currentPayload: page.currentPayload,
+        currentProjection: page.currentProjection,
+        currentGrants: page.currentGrants,
+        currentMemberEnvelopes: page.currentMemberEnvelopes,
+    };
+}
+//# sourceMappingURL=principalHistoryStageProtection.js.map

package/data/principals/principalHistoryStageProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryStageProtection.js","sourceRoot":"","sources":["principalHistoryStageProtection.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAG/E,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,IAA6B,EAC7B,OAAe,EACf,kBAAsD;IAEtD,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,0CAA0C;QAC1C,cAAc;QACd,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc;QACnB,OAAO;QACP,CAAC,GAAG,kBAAkB,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAClB,SAAS,CAAC,aAAa;YACvB,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,OAAO;YACjB,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,SAAS;YACnB,SAAS,CAAC,cAAc;SACzB,CAAC;KACL,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAiD,EACjD,YAAqC,EACrC,KAA8C;IAE9C,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAkE;IAElE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;KAC1E,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO;QAE/C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryStage } from \"../persistence/principalHistoryStagePersistence\";\n\nexport function principalHistoryStageId(\n  organizationId: string,\n  head: ReferencedPrincipalHead,\n  context: string,\n  retainedReferences: readonly ReferencedPrincipalHead[],\n) {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-stage.v1\",\n        organizationId,\n        head.principalType,\n        head.principalId,\n        head.version,\n        head.keyEpoch,\n        head.stateHash,\n        head.keyFingerprint,\n        context,\n        [...retainedReferences]\n          .sort((a, b) => a.version - b.version)\n          .map((reference) => [\n            reference.principalType,\n            reference.principalId,\n            reference.version,\n            reference.keyEpoch,\n            reference.stateHash,\n            reference.keyFingerprint,\n          ]),\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryStageProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  expectedHead: ReferencedPrincipalHead,\n  stage: Omit<PrincipalHistoryStage, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-stage.v1\",\n      context: protection.context,\n      id: stage.id,\n      organizationId: stage.organizationId,\n      expectedHead: { ...expectedHead },\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(stage.currentJson),\n      ),\n    }),\n  };\n}\n\nexport function parsePrincipalHistoryStageCurrent(\n  stage: Pick<PrincipalHistoryStage, \"currentJson\" | \"afterVersion\">,\n): PrincipalPolicyPageCurrent | null {\n  let current: unknown;\n  try {\n    current = JSON.parse(stage.currentJson);\n  } catch {\n    return null;\n  }\n  if (!current || typeof current !== \"object\" || Array.isArray(current))\n    return null;\n  const page = {\n    ...current,\n    previousStates: [],\n    historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },\n  };\n  if (\n    !isPrincipalPolicyPageResponse(page) ||\n    stage.afterVersion >= page.currentState.version\n  )\n    return null;\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n"]}

package/data/principals/principalKeyValidation.js

@@ -0,0 +1,19 @@
+import { toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../internal/crypto/index.js";
+import { base64ToBytes } from "../../internal/encoding/index.js";
+/** Check the private material as well as the public key embedded in an ML-KEM key. */
+export async function principalSecretKeyMatchesState(secretKey, state) {
+    try {
+        const publicKey = base64ToBytes(state.encapsulationPublicKey);
+        if ((await toFingerprint(publicKey)) !== state.keyFingerprint)
+            return false;
+        const challenge = crypto.getRandomValues(new Uint8Array(32));
+        const wrapped = await wrapDekForRecipients(challenge, [publicKey]);
+        const recovered = await unwrapDek(wrapped, secretKey);
+        return (recovered.length === challenge.length &&
+            recovered.every((byte, index) => byte === challenge[index]));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=principalKeyValidation.js.map

package/data/principals/principalKeyValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalKeyValidation.js","sourceRoot":"","sources":["principalKeyValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,SAAqB,EACrB,KAGC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YACrC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAC5D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import {\n  toFingerprint,\n  unwrapDek,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\n\n/** Check the private material as well as the public key embedded in an ML-KEM key. */\nexport async function principalSecretKeyMatchesState(\n  secretKey: Uint8Array,\n  state: {\n    readonly encapsulationPublicKey: string;\n    readonly keyFingerprint: string;\n  },\n): Promise<boolean> {\n  try {\n    const publicKey = base64ToBytes(state.encapsulationPublicKey);\n    if ((await toFingerprint(publicKey)) !== state.keyFingerprint) return false;\n    const challenge = crypto.getRandomValues(new Uint8Array(32));\n    const wrapped = await wrapDekForRecipients(challenge, [publicKey]);\n    const recovered = await unwrapDek(wrapped, secretKey);\n    return (\n      recovered.length === challenge.length &&\n      recovered.every((byte, index) => byte === challenge[index])\n    );\n  } catch {\n    return false;\n  }\n}\n"]}

package/data/principals/principalPolicyAdminSigners.js

@@ -0,0 +1,81 @@
+import { KeyingVerificationError, verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
+export function principalPolicyReferenceFromBundle(bundle) {
+    return {
+        principalType: bundle.currentState.principalType,
+        principalId: bundle.currentState.principalId,
+        version: bundle.currentState.version,
+        keyEpoch: bundle.currentState.keyEpoch,
+        stateHash: bundle.currentState.stateHash,
+        keyFingerprint: bundle.currentState.keyFingerprint,
+    };
+}
+export function organizationAdminSignerUserIds(policy) {
+    return [
+        ...new Set(policy.projection
+            .filter((member) => member.role === "admin")
+            .map((member) => member.userId)),
+    ].sort();
+}
+export function organizationAdminExternalAuthority(policy) {
+    const history = policy.history ?? [
+        {
+            state: policy.state,
+            projection: policy.projection,
+            grants: policy.grants,
+        },
+    ];
+    const toHead = (state) => ({
+        principalType: "group",
+        principalId: state.principalId,
+        version: state.version,
+        keyEpoch: state.keyEpoch,
+        stateHash: state.stateHash,
+        keyFingerprint: state.keyFingerprint,
+    });
+    return {
+        currentHead: toHead(policy.state),
+        states: history.map((entry) => ({
+            head: toHead(entry.state),
+            projection: entry.projection,
+        })),
+    };
+}
+export async function verifyOrganizationAdminPolicy(input) {
+    if (input.bundle.currentState.principalType !== "organization" ||
+        input.bundle.currentState.principalId !== input.organizationId) {
+        return {
+            ok: false,
+            error: new KeyingVerificationError("object_mismatch", "organization policy does not match the expected organization"),
+        };
+    }
+    return verifyPrincipalPolicyBundle({
+        bundle: input.bundle,
+        expectedReference: principalPolicyReferenceFromBundle(input.bundle),
+        localCheckpoint: input.localCheckpoint ?? null,
+        signerPublicKeys: input.signerPublicKeys,
+    });
+}
+export async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input) {
+    const verified = await verifyPrincipalPolicyBundle({
+        bundle: input.bundle,
+        expectedReference: input.expectedReference,
+        localCheckpoint: input.localCheckpoint ?? null,
+        signerPublicKeys: input.signerPublicKeys,
+    });
+    if (verified.ok || verified.error.code !== "unauthorized") {
+        return verified;
+    }
+    const externalAuthority = await input.loadExternalAuthority();
+    if (!externalAuthority) {
+        return verified;
+    }
+    const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({
+        bundle: input.bundle,
+        externalAuthority,
+        expectedReference: input.expectedReference,
+        localCheckpoint: input.localCheckpoint ?? null,
+        signerPublicKeys: input.signerPublicKeys,
+    });
+    return verifiedWithExternalAdmins;
+}
+//# sourceMappingURL=principalPolicyAdminSigners.js.map

package/data/principals/principalPolicyAdminSigners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyAdminSigners.js","sourceRoot":"","sources":["principalPolicyAdminSigners.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAOvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,kCAAkC,CAChD,MAAqC;IAErC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAA+B;IAE/B,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,UAAU;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;aAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAClC;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI;QAChC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE,CAAC,CAAC;QAC5D,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IACE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,8DAA8D,CAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,2BAA2B,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yDAAyD,CAAC,KAM/E;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function principalPolicyReferenceFromBundle(\n  bundle: PrincipalPolicyBundleResponse,\n): ReferencedPrincipalHead {\n  return {\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    keyFingerprint: bundle.currentState.keyFingerprint,\n  };\n}\n\nexport function organizationAdminSignerUserIds(\n  policy: VerifiedPrincipalPolicy,\n): string[] {\n  return [\n    ...new Set(\n      policy.projection\n        .filter((member) => member.role === \"admin\")\n        .map((member) => member.userId),\n    ),\n  ].sort();\n}\n\nexport function organizationAdminExternalAuthority(\n  policy: VerifiedPrincipalPolicy,\n): PrincipalPolicyExternalAuthority {\n  const history = policy.history ?? [\n    {\n      state: policy.state,\n      projection: policy.projection,\n      grants: policy.grants,\n    },\n  ];\n  const toHead = (state: (typeof history)[number][\"state\"]) => ({\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  });\n  return {\n    currentHead: toHead(policy.state),\n    states: history.map((entry) => ({\n      head: toHead(entry.state),\n      projection: entry.projection,\n    })),\n  };\n}\n\nexport async function verifyOrganizationAdminPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly organizationId: string;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  if (\n    input.bundle.currentState.principalType !== \"organization\" ||\n    input.bundle.currentState.principalId !== input.organizationId\n  ) {\n    return {\n      ok: false,\n      error: new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization policy does not match the expected organization\",\n      ),\n    };\n  }\n\n  return verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: principalPolicyReferenceFromBundle(input.bundle),\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n}\n\nexport async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly expectedReference: ReferencedPrincipalHead;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n  if (verified.ok || verified.error.code !== \"unauthorized\") {\n    return verified;\n  }\n\n  const externalAuthority = await input.loadExternalAuthority();\n  if (!externalAuthority) {\n    return verified;\n  }\n\n  const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    externalAuthority,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  return verifiedWithExternalAdmins;\n}\n"]}

package/data/principals/principalPolicyCrypto.js

@@ -0,0 +1,73 @@
+import { unwrapDek } from "../../internal/crypto/index.js";
+import { base64ToBytes } from "../../internal/encoding/index.js";
+import { loadPrincipalKeyEnvelopeCandidates, } from "../persistence/principalKeyEnvelopeCandidates.js";
+function toKeyEnvelopeEntries(envelopes) {
+    return envelopes.map((envelope) => ({
+        keyFingerprint: envelope.keyFingerprint,
+        kemCipherText: base64ToBytes(envelope.kemCipherText),
+        wrappedKey: base64ToBytes(envelope.wrappedKey),
+    }));
+}
+function toMemberEnvelopeEntries(envelopes) {
+    return envelopes.map((envelope) => ({
+        keyFingerprint: envelope.memberKeyFingerprint,
+        kemCipherText: base64ToBytes(envelope.kemCipherText),
+        wrappedKey: base64ToBytes(envelope.wrappedKey),
+    }));
+}
+function principalBundleKey(bundle) {
+    return `${bundle.principalType}:${bundle.principalId}`;
+}
+async function createPrincipalPolicyResolutionContext(execSql, fingerprints) {
+    const bundles = await loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints);
+    const bundlesByKeyFingerprint = new Map();
+    for (const bundle of bundles) {
+        const matchingBundles = bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];
+        matchingBundles.push(bundle);
+        bundlesByKeyFingerprint.set(bundle.currentState.keyFingerprint, matchingBundles);
+    }
+    return {
+        bundlesByKeyFingerprint,
+    };
+}
+async function unwrapPrincipalSecretKey(bundle, secretKey) {
+    const principalKey = principalBundleKey(bundle.currentState);
+    const memberEnvelopeEntries = toMemberEnvelopeEntries(bundle.currentMemberEnvelopes.envelopes);
+    try {
+        return await unwrapDek(memberEnvelopeEntries, secretKey);
+    }
+    catch {
+        // No transitive fallback: a principal's envelopes are all addressed to
+        // users directly, so if this identity key opens none of them the requester
+        // is not a member.
+    }
+    throw new Error(`No matching principal member envelope for ${principalKey}`);
+}
+export async function unwrapKeyEnvelopesWithPrincipalPolicies(input) {
+    const keyEntries = toKeyEnvelopeEntries(input.envelopes);
+    try {
+        return await unwrapDek(keyEntries, input.secretKey);
+    }
+    catch {
+        if (!input.execSql) {
+            throw new Error("No matching key envelope entry found for this secret key and no principal policy cache is available");
+        }
+    }
+    const context = await createPrincipalPolicyResolutionContext(input.execSql, input.envelopes.map((envelope) => envelope.keyFingerprint));
+    const attemptedFingerprints = new Set();
+    for (const envelope of input.envelopes) {
+        if (attemptedFingerprints.has(envelope.keyFingerprint))
+            continue;
+        attemptedFingerprints.add(envelope.keyFingerprint);
+        const candidateBundles = context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];
+        for (const bundle of candidateBundles) {
+            try {
+                const principalSecretKey = await unwrapPrincipalSecretKey(bundle, input.secretKey);
+                return await unwrapDek(keyEntries, principalSecretKey);
+            }
+            catch { }
+        }
+    }
+    throw new Error("No matching key envelope entry found for this secret key or cached principal policies");
+}
+//# sourceMappingURL=principalPolicyCrypto.js.map

package/data/principals/principalPolicyCrypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCrypto.js","sourceRoot":"","sources":["principalPolicyCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EACL,kCAAkC,GAEnC,MAAM,+CAA+C,CAAC;AAUvD,SAAS,oBAAoB,CAC3B,SAA+C;IAE/C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CACzB,MAGC;IAED,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,kCAAkC,CACtD,OAAO,EACP,YAAY,CACb,CAAC;IACF,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,eAAe,GACnB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,uBAAuB,CAAC,GAAG,CACzB,MAAM,CAAC,YAAY,CAAC,cAAc,EAClC,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqC,EACrC,SAAqB;IAErB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CACnD,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,2EAA2E;QAC3E,mBAAmB;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC3D,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QACjE,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,gBAAgB,GACpB,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAErE,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CACvD,MAAM,EACN,KAAK,CAAC,SAAS,CAChB,CAAC;gBAEF,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;AACJ,CAAC","sourcesContent":["import { type RecipientEntry, unwrapDek } from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport type { PrincipalMemberEnvelopeResponse } from \"@tearleads/validators/response\";\nimport type { SerializedKeyEnvelope } from \"@tearleads/validators/util\";\nimport {\n  loadPrincipalKeyEnvelopeCandidates,\n  type PrincipalKeyEnvelopeCandidate,\n} from \"../persistence/principalKeyEnvelopeCandidates\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\ninterface PrincipalPolicyResolutionContext {\n  bundlesByKeyFingerprint: ReadonlyMap<\n    string,\n    ReadonlyArray<PrincipalKeyEnvelopeCandidate>\n  >;\n}\n\nfunction toKeyEnvelopeEntries(\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.keyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction toMemberEnvelopeEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction principalBundleKey(\n  bundle: Pick<\n    PrincipalKeyEnvelopeCandidate[\"currentState\"],\n    \"principalType\" | \"principalId\"\n  >,\n): string {\n  return `${bundle.principalType}:${bundle.principalId}`;\n}\n\nasync function createPrincipalPolicyResolutionContext(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalPolicyResolutionContext> {\n  const bundles = await loadPrincipalKeyEnvelopeCandidates(\n    execSql,\n    fingerprints,\n  );\n  const bundlesByKeyFingerprint = new Map<\n    string,\n    PrincipalKeyEnvelopeCandidate[]\n  >();\n\n  for (const bundle of bundles) {\n    const matchingBundles =\n      bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];\n    matchingBundles.push(bundle);\n    bundlesByKeyFingerprint.set(\n      bundle.currentState.keyFingerprint,\n      matchingBundles,\n    );\n  }\n\n  return {\n    bundlesByKeyFingerprint,\n  };\n}\n\nasync function unwrapPrincipalSecretKey(\n  bundle: PrincipalKeyEnvelopeCandidate,\n  secretKey: Uint8Array,\n): Promise<Uint8Array> {\n  const principalKey = principalBundleKey(bundle.currentState);\n  const memberEnvelopeEntries = toMemberEnvelopeEntries(\n    bundle.currentMemberEnvelopes.envelopes,\n  );\n\n  try {\n    return await unwrapDek(memberEnvelopeEntries, secretKey);\n  } catch {\n    // No transitive fallback: a principal's envelopes are all addressed to\n    // users directly, so if this identity key opens none of them the requester\n    // is not a member.\n  }\n\n  throw new Error(`No matching principal member envelope for ${principalKey}`);\n}\n\nexport async function unwrapKeyEnvelopesWithPrincipalPolicies(input: {\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n}): Promise<Uint8Array> {\n  const keyEntries = toKeyEnvelopeEntries(input.envelopes);\n\n  try {\n    return await unwrapDek(keyEntries, input.secretKey);\n  } catch {\n    if (!input.execSql) {\n      throw new Error(\n        \"No matching key envelope entry found for this secret key and no principal policy cache is available\",\n      );\n    }\n  }\n\n  const context = await createPrincipalPolicyResolutionContext(\n    input.execSql,\n    input.envelopes.map((envelope) => envelope.keyFingerprint),\n  );\n  const attemptedFingerprints = new Set<string>();\n\n  for (const envelope of input.envelopes) {\n    if (attemptedFingerprints.has(envelope.keyFingerprint)) continue;\n    attemptedFingerprints.add(envelope.keyFingerprint);\n    const candidateBundles =\n      context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];\n\n    for (const bundle of candidateBundles) {\n      try {\n        const principalSecretKey = await unwrapPrincipalSecretKey(\n          bundle,\n          input.secretKey,\n        );\n\n        return await unwrapDek(keyEntries, principalSecretKey);\n      } catch {}\n    }\n  }\n\n  throw new Error(\n    \"No matching key envelope entry found for this secret key or cached principal policies\",\n  );\n}\n"]}

package/data/principals/principalPolicyEvidence.d.ts

@@ -0,0 +1,4 @@
+import type { AnyVerifiedPrincipalPolicy, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+export type PrincipalPolicyCurrentEvidence = VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
+export type PrincipalPolicyCheckpointEvidence = AnyVerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
+export declare function principalPolicyEvidenceEntries(policy: PrincipalPolicyCheckpointEvidence): NonNullable<VerifiedPrincipalPolicy["history"]>;

package/data/principals/principalPolicyEvidence.js

@@ -0,0 +1,12 @@
+export function principalPolicyEvidenceEntries(policy) {
+    return "retainedHistory" in policy
+        ? policy.retainedHistory
+        : (policy.history ?? [
+            {
+                state: policy.state,
+                projection: policy.projection,
+                grants: policy.grants,
+            },
+        ]);
+}
+//# sourceMappingURL=principalPolicyEvidence.js.map

package/data/principals/principalPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyEvidence.js","sourceRoot":"","sources":["principalPolicyEvidence.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,8BAA8B,CAC5C,MAAyC;IAEzC,OAAO,iBAAiB,IAAI,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI;YACjB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type {\n  AnyVerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalPolicyCurrentEvidence =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\nexport type PrincipalPolicyCheckpointEvidence =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nexport function principalPolicyEvidenceEntries(\n  policy: PrincipalPolicyCheckpointEvidence,\n): NonNullable<VerifiedPrincipalPolicy[\"history\"]> {\n  return \"retainedHistory\" in policy\n    ? policy.retainedHistory\n    : (policy.history ?? [\n        {\n          state: policy.state,\n          projection: policy.projection,\n          grants: policy.grants,\n        },\n      ]);\n}\n"]}

package/data/recordReaders.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The one family of labeled record readers for wire and stored payloads.
+ * Every domain previously carried private copies whose names collided while
+ * their semantics drifted (a plain lookup here, a throw-on-missing lookup
+ * there, and "number" sometimes meaning "positive integer"). The vocabulary
+ * is now explicit: value lookups are plain unless named required, and
+ * integer readers say exactly which integers they accept.
+ */
+export declare function readRecordValue(record: Record<string, unknown>, key: string): unknown;
+export declare function readRequiredRecordValue(record: Record<string, unknown>, key: string, label: string): unknown;
+export declare function readRecordString(record: Record<string, unknown>, key: string, label: string): string;
+export declare function readRecordNullableString(record: Record<string, unknown>, key: string, label: string): string | null;
+export declare function readRecordInteger(record: Record<string, unknown>, key: string, label: string): number;
+export declare function readRecordPositiveInteger(record: Record<string, unknown>, key: string, label: string): number;
+export declare function readRecordSafePositiveInteger(record: Record<string, unknown>, key: string, label: string): number;
+export declare function readRecordSafeByteLength(record: Record<string, unknown>, key: string, label: string): number;
+export declare function readStringArray(value: unknown, label: string): string[];