@tearleads/client-sdk 0.1.11 → 0.1.13

package/workflows/principals/principalRecoveryDirectory.js

@@ -0,0 +1,107 @@
+import { KeyingVerificationError, serializeKeyingCanonicalJson, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { parseOrganizationAuthorityDescriptor, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { principalHistoryEvidenceScopeId } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { loadVerifiedPrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
+import { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
+import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+export class PrincipalRecoveryDirectoryAdvanced extends Error {
+}
+/** An unverified discovery read chooses a pin; recovery must authenticate it. */
+async function discoverDirectoryHead(input) {
+    assertProjectionVerificationCurrent(() => !input.signal?.aborted && input.stillCurrent());
+    if (input.offline) {
+        const principal = {
+            principalType: "organization",
+            principalId: input.organizationId,
+        };
+        const scopeId = await principalHistoryEvidenceScopeId({
+            organizationId: input.organizationId,
+            head: principal,
+            protection: input.protection,
+        });
+        const prefix = await loadVerifiedPrincipalHistoryPrefix(input, principal, scopeId);
+        if (!prefix)
+            throw new KeyingVerificationError("missing_dependency", "Organization directory is unavailable offline");
+        const history = prefix.verifier.finish(prefix.head);
+        if (!history.ok)
+            throw history.error;
+        const genesis = await loadPrincipalHistoryReference({
+            execSql: input.execSql,
+            scopeId,
+            history: history.value,
+            version: 1,
+        });
+        const selected = await verifyPrincipalPolicyHistoryReferences({
+            history: history.value,
+            references: [genesis],
+        });
+        if (!selected.ok)
+            throw selected.error;
+        return { head: prefix.head, genesis: genesis.reference };
+    }
+    for await (const result of input.apiClient.getPrincipalPolicyPages("organization", input.organizationId, { signal: input.signal })) {
+        if (!result.ok)
+            throw new PrincipalPolicyHistoryReadError(result);
+        assertProjectionVerificationCurrent(() => !input.signal?.aborted && input.stillCurrent());
+        const state = result.data.currentState;
+        const first = result.data.previousStates[0]?.state ?? state;
+        if (first.version !== 1 ||
+            first.principalType !== "organization" ||
+            first.principalId !== input.organizationId)
+            throw new KeyingVerificationError("missing_dependency", "Organization directory discovery requires genesis");
+        return {
+            genesis: {
+                principalType: first.principalType,
+                principalId: first.principalId,
+                version: first.version,
+                stateHash: first.stateHash,
+                keyEpoch: first.keyEpoch,
+                keyFingerprint: first.keyFingerprint,
+            },
+            head: {
+                principalType: "organization",
+                principalId: input.organizationId,
+                version: state.version,
+                stateHash: state.stateHash,
+                keyEpoch: state.keyEpoch,
+                keyFingerprint: state.keyFingerprint,
+            },
+        };
+    }
+    throw new KeyingVerificationError("missing_dependency", "Organization directory head is unavailable");
+}
+export async function recoverPolicyDirectory(input, references) {
+    const scoped = {
+        ...input,
+        protection: {
+            localKey: input.protection.localKey,
+            context: serializeKeyingCanonicalJson([
+                "tearleads.sdk.principal-history.directory.v1",
+                input.protection.context,
+            ]),
+        },
+    };
+    const { head: expectedHead, genesis } = await discoverDirectoryHead(scoped);
+    if (references.some((reference) => reference.version > expectedHead.version))
+        throw new PrincipalRecoveryDirectoryAdvanced();
+    const recovered = await recoverPrincipalPolicyHistory({
+        ...scoped,
+        expectedHead,
+        retainedReferences: references.some((reference) => reference.version === 1)
+            ? references
+            : [genesis, ...references],
+    });
+    let descriptor;
+    try {
+        descriptor = parseOrganizationAuthorityDescriptor(recovered.current.currentPayload.ciphertext);
+    }
+    catch {
+        throw new KeyingVerificationError("invalid_shape", "Organization directory payload is invalid");
+    }
+    if (descriptor.organizationId !== input.organizationId)
+        throw new KeyingVerificationError("object_mismatch", "Organization directory scope does not match");
+    return { ...recovered, descriptor };
+}
+//# sourceMappingURL=principalRecoveryDirectory.js.map

package/workflows/principals/principalRecoveryDirectory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalRecoveryDirectory.js","sourceRoot":"","sources":["principalRecoveryDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,EAC5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAEL,oCAAoC,GACrC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAehF,MAAM,OAAO,kCAAmC,SAAQ,KAAK;CAAG;AAEhE,iFAAiF;AACjF,KAAK,UAAU,qBAAqB,CAAC,KAA+B;IAIlE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG;YAChB,aAAa,EAAE,cAAuB;YACtC,WAAW,EAAE,KAAK,CAAC,cAAc;SAClC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,OAAO,EAAE,CAAC;SACX,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAClE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC5D,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,KAAK,CAAC,aAAa,KAAK,cAAc;YACtC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,OAAO;YACL,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;YACD,IAAI,EAAE;gBACJ,aAAa,EAAE,cAAc;gBAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA+B,EAC/B,UAA8C;IAE9C,MAAM,MAAM,GAAG;QACb,GAAG,KAAK;QACR,UAAU,EAAE;YACV,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;YACnC,OAAO,EAAE,4BAA4B,CAAC;gBACpC,8CAA8C;gBAC9C,KAAK,CAAC,UAAU,CAAC,OAAO;aACzB,CAAC;SACH;KACF,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QAC1E,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,GAAG,MAAM;QACT,YAAY;QACZ,kBAAkB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;KAC7B,CAAC,CAAC;IACH,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,oCAAoC,CAC/C,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,OAAO,EAAE,GAAG,SAAS,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport type PrincipalRecoveryContext = Omit<\n  RecoverPrincipalPolicyHistoryOptions,\n  | \"expectedHead\"\n  | \"retainedReferences\"\n  | \"historyVerification\"\n  | \"loadExternalAuthority\"\n>;\n\nexport interface RecoveredPolicyDirectory\n  extends RecoveredPrincipalPolicyHistory {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n}\n\nexport class PrincipalRecoveryDirectoryAdvanced extends Error {}\n\n/** An unverified discovery read chooses a pin; recovery must authenticate it. */\nasync function discoverDirectoryHead(input: PrincipalRecoveryContext): Promise<{\n  head: ReferencedPrincipalHead;\n  genesis: ReferencedPrincipalHead;\n}> {\n  assertProjectionVerificationCurrent(\n    () => !input.signal?.aborted && input.stillCurrent(),\n  );\n  if (input.offline) {\n    const principal = {\n      principalType: \"organization\" as const,\n      principalId: input.organizationId,\n    };\n    const scopeId = await principalHistoryEvidenceScopeId({\n      organizationId: input.organizationId,\n      head: principal,\n      protection: input.protection,\n    });\n    const prefix = await loadVerifiedPrincipalHistoryPrefix(\n      input,\n      principal,\n      scopeId,\n    );\n    if (!prefix)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory is unavailable offline\",\n      );\n    const history = prefix.verifier.finish(prefix.head);\n    if (!history.ok) throw history.error;\n    const genesis = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId,\n      history: history.value,\n      version: 1,\n    });\n    const selected = await verifyPrincipalPolicyHistoryReferences({\n      history: history.value,\n      references: [genesis],\n    });\n    if (!selected.ok) throw selected.error;\n    return { head: prefix.head, genesis: genesis.reference };\n  }\n  for await (const result of input.apiClient.getPrincipalPolicyPages(\n    \"organization\",\n    input.organizationId,\n    { signal: input.signal },\n  )) {\n    if (!result.ok) throw new PrincipalPolicyHistoryReadError(result);\n    assertProjectionVerificationCurrent(\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n    const state = result.data.currentState;\n    const first = result.data.previousStates[0]?.state ?? state;\n    if (\n      first.version !== 1 ||\n      first.principalType !== \"organization\" ||\n      first.principalId !== input.organizationId\n    )\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory discovery requires genesis\",\n      );\n    return {\n      genesis: {\n        principalType: first.principalType,\n        principalId: first.principalId,\n        version: first.version,\n        stateHash: first.stateHash,\n        keyEpoch: first.keyEpoch,\n        keyFingerprint: first.keyFingerprint,\n      },\n      head: {\n        principalType: \"organization\",\n        principalId: input.organizationId,\n        version: state.version,\n        stateHash: state.stateHash,\n        keyEpoch: state.keyEpoch,\n        keyFingerprint: state.keyFingerprint,\n      },\n    };\n  }\n  throw new KeyingVerificationError(\n    \"missing_dependency\",\n    \"Organization directory head is unavailable\",\n  );\n}\n\nexport async function recoverPolicyDirectory(\n  input: PrincipalRecoveryContext,\n  references: readonly ReferencedPrincipalHead[],\n): Promise<RecoveredPolicyDirectory> {\n  const scoped = {\n    ...input,\n    protection: {\n      localKey: input.protection.localKey,\n      context: serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history.directory.v1\",\n        input.protection.context,\n      ]),\n    },\n  };\n  const { head: expectedHead, genesis } = await discoverDirectoryHead(scoped);\n  if (references.some((reference) => reference.version > expectedHead.version))\n    throw new PrincipalRecoveryDirectoryAdvanced();\n  const recovered = await recoverPrincipalPolicyHistory({\n    ...scoped,\n    expectedHead,\n    retainedReferences: references.some((reference) => reference.version === 1)\n      ? references\n      : [genesis, ...references],\n  });\n  let descriptor: OrganizationAuthorityDescriptor;\n  try {\n    descriptor = parseOrganizationAuthorityDescriptor(\n      recovered.current.currentPayload.ciphertext,\n    );\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Organization directory payload is invalid\",\n    );\n  }\n  if (descriptor.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Organization directory scope does not match\",\n    );\n  return { ...recovered, descriptor };\n}\n"]}

package/workflows/principals/principalRecoveryMemo.js

@@ -0,0 +1,46 @@
+import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { recoverPolicyDirectory, } from "./principalRecoveryDirectory.js";
+import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+/** Only share authenticated results within one projection collection lifetime. */
+async function memoPrincipalRecovery(memo, key, stillCurrent, work) {
+    assertProjectionVerificationCurrent(stillCurrent);
+    let pending = memo?.get(key);
+    if (!pending) {
+        pending = work().then((value) => ({ value, stillCurrent }));
+        memo?.set(key, pending);
+    }
+    const result = await pending.catch((error) => {
+        if (memo?.get(key) === pending)
+            memo.delete(key);
+        throw error;
+    });
+    assertProjectionVerificationCurrent(result.stillCurrent);
+    assertProjectionVerificationCurrent(stillCurrent);
+    return result.value;
+}
+export function createPrincipalRecoveryReader(input, memo) {
+    const scope = [
+        input.organizationId,
+        input.protection.context,
+        input.offline === true,
+    ];
+    const current = () => !input.signal?.aborted && input.stillCurrent();
+    return {
+        directory: (references) => memoPrincipalRecovery(memo?.directories, serializeKeyingCanonicalJson([
+            ...scope,
+            references.map((reference) => ({ ...reference })),
+        ]), current, () => recoverPolicyDirectory(input, references)),
+        admins: (expectedHead, retainedReferences = []) => memoPrincipalRecovery(memo?.admins, serializeKeyingCanonicalJson([
+            ...scope,
+            { ...expectedHead },
+            retainedReferences.map((reference) => ({ ...reference })),
+        ]), current, () => recoverPrincipalPolicyHistory({
+            ...input,
+            expectedHead,
+            retainedReferences,
+            historyVerification: "direct-admins",
+        })),
+    };
+}
+//# sourceMappingURL=principalRecoveryMemo.js.map

package/workflows/principals/principalRecoveryMemo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalRecoveryMemo.js","sourceRoot":"","sources":["principalRecoveryMemo.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAGL,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAShF,kFAAkF;AAClF,KAAK,UAAU,qBAAqB,CAClC,IAAyB,EACzB,GAAW,EACX,YAA2B,EAC3B,IAAsB;IAEtB,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACpD,IAAI,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAA+B,EAC/B,IAA4B;IAE5B,MAAM,KAAK,GAAG;QACZ,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,UAAU,CAAC,OAAO;QACxB,KAAK,CAAC,OAAO,KAAK,IAAI;KACvB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,OAAO;QACL,SAAS,EAAE,CAAC,UAA8C,EAAE,EAAE,CAC5D,qBAAqB,CACnB,IAAI,EAAE,WAAW,EACjB,4BAA4B,CAAC;YAC3B,GAAG,KAAK;YACR,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;SAClD,CAAC,EACF,OAAO,EACP,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,CAAC,CAChD;QACH,MAAM,EAAE,CACN,YAAqC,EACrC,qBAAyD,EAAE,EAC3D,EAAE,CACF,qBAAqB,CACnB,IAAI,EAAE,MAAM,EACZ,4BAA4B,CAAC;YAC3B,GAAG,KAAK;YACR,EAAE,GAAG,YAAY,EAAE;YACnB,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;SAC1D,CAAC,EACF,OAAO,EACP,GAAG,EAAE,CACH,6BAA6B,CAAC;YAC5B,GAAG,KAAK;YACR,YAAY;YACZ,kBAAkB;YAClB,mBAAmB,EAAE,eAAe;SACrC,CAAC,CACL;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { RecoveredPrincipalPolicyHistory } from \"./principalHistoryRecoveryTypes\";\nimport {\n  type PrincipalRecoveryContext,\n  type RecoveredPolicyDirectory,\n  recoverPolicyDirectory,\n} from \"./principalRecoveryDirectory\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\ntype Memo<T> = Map<string, Promise<{ value: T; stillCurrent: () => boolean }>>;\n\nexport interface PrincipalRecoveryMemo {\n  readonly directories: Memo<RecoveredPolicyDirectory>;\n  readonly admins: Memo<RecoveredPrincipalPolicyHistory>;\n}\n\n/** Only share authenticated results within one projection collection lifetime. */\nasync function memoPrincipalRecovery<T>(\n  memo: Memo<T> | undefined,\n  key: string,\n  stillCurrent: () => boolean,\n  work: () => Promise<T>,\n): Promise<T> {\n  assertProjectionVerificationCurrent(stillCurrent);\n  let pending = memo?.get(key);\n  if (!pending) {\n    pending = work().then((value) => ({ value, stillCurrent }));\n    memo?.set(key, pending);\n  }\n  const result = await pending.catch((error: unknown) => {\n    if (memo?.get(key) === pending) memo.delete(key);\n    throw error;\n  });\n  assertProjectionVerificationCurrent(result.stillCurrent);\n  assertProjectionVerificationCurrent(stillCurrent);\n  return result.value;\n}\n\nexport function createPrincipalRecoveryReader(\n  input: PrincipalRecoveryContext,\n  memo?: PrincipalRecoveryMemo,\n) {\n  const scope = [\n    input.organizationId,\n    input.protection.context,\n    input.offline === true,\n  ];\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  return {\n    directory: (references: readonly ReferencedPrincipalHead[]) =>\n      memoPrincipalRecovery(\n        memo?.directories,\n        serializeKeyingCanonicalJson([\n          ...scope,\n          references.map((reference) => ({ ...reference })),\n        ]),\n        current,\n        () => recoverPolicyDirectory(input, references),\n      ),\n    admins: (\n      expectedHead: ReferencedPrincipalHead,\n      retainedReferences: readonly ReferencedPrincipalHead[] = [],\n    ) =>\n      memoPrincipalRecovery(\n        memo?.admins,\n        serializeKeyingCanonicalJson([\n          ...scope,\n          { ...expectedHead },\n          retainedReferences.map((reference) => ({ ...reference })),\n        ]),\n        current,\n        () =>\n          recoverPrincipalPolicyHistory({\n            ...input,\n            expectedHead,\n            retainedReferences,\n            historyVerification: \"direct-admins\",\n          }),\n      ),\n  };\n}\n"]}

package/workflows/principals/principalRecoveryOutage.js

@@ -0,0 +1,40 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { PrincipalPolicyHistoryReadError } from "./principalHistoryRecoveryTypes.js";
+import { recoverScopedPrincipalPolicyHistory } from "./recoverScopedPrincipalPolicyHistory.js";
+/** Refusals and invalid evidence must never silently select a cached policy. */
+function isPrincipalRecoveryOutage(error) {
+    if (!(error instanceof PrincipalPolicyHistoryReadError))
+        return false;
+    const { failure } = error;
+    return (failure.kind === "network" ||
+        (failure.kind === "http" &&
+            failure.status !== null &&
+            failure.status >= 500) ||
+        (failure.kind === "cancelled" &&
+            failure.code === "principal_history_request_timed_out"));
+}
+export async function recoverWithPrincipalOutageFallback(recover, options) {
+    try {
+        return await recover(options);
+    }
+    catch (error) {
+        assertProjectionVerificationCurrent(options.stillCurrent);
+        if (options.offline || !isPrincipalRecoveryOutage(error))
+            throw error;
+        try {
+            return await recoverScopedPrincipalPolicyHistory({
+                ...options,
+                offline: true,
+            });
+        }
+        catch (localError) {
+            if (localError instanceof KeyingVerificationError &&
+                localError.code === "missing_dependency")
+                throw new ProjectionDependencyUnavailableError(localError.message);
+            throw localError;
+        }
+    }
+}
+//# sourceMappingURL=principalRecoveryOutage.js.map

package/workflows/principals/principalRecoveryOutage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalRecoveryOutage.js","sourceRoot":"","sources":["principalRecoveryOutage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAE5F,gFAAgF;AAChF,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,+BAA+B,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;YACtB,OAAO,CAAC,MAAM,KAAK,IAAI;YACvB,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACxB,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;YAC3B,OAAO,CAAC,IAAI,KAAK,qCAAqC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAmD,EACnD,OAAkE;IAElE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,mCAAmC,CAAC;gBAC/C,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IACE,UAAU,YAAY,uBAAuB;gBAC7C,UAAU,CAAC,IAAI,KAAK,oBAAoB;gBAExC,MAAM,IAAI,oCAAoC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { PrincipalPolicyHistoryReadError } from \"./principalHistoryRecoveryTypes\";\nimport { recoverScopedPrincipalPolicyHistory } from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Refusals and invalid evidence must never silently select a cached policy. */\nfunction isPrincipalRecoveryOutage(error: unknown): boolean {\n  if (!(error instanceof PrincipalPolicyHistoryReadError)) return false;\n  const { failure } = error;\n  return (\n    failure.kind === \"network\" ||\n    (failure.kind === \"http\" &&\n      failure.status !== null &&\n      failure.status >= 500) ||\n    (failure.kind === \"cancelled\" &&\n      failure.code === \"principal_history_request_timed_out\")\n  );\n}\n\nexport async function recoverWithPrincipalOutageFallback(\n  recover: typeof recoverScopedPrincipalPolicyHistory,\n  options: Parameters<typeof recoverScopedPrincipalPolicyHistory>[0],\n) {\n  try {\n    return await recover(options);\n  } catch (error) {\n    assertProjectionVerificationCurrent(options.stillCurrent);\n    if (options.offline || !isPrincipalRecoveryOutage(error)) throw error;\n    try {\n      return await recoverScopedPrincipalPolicyHistory({\n        ...options,\n        offline: true,\n      });\n    } catch (localError) {\n      if (\n        localError instanceof KeyingVerificationError &&\n        localError.code === \"missing_dependency\"\n      )\n        throw new ProjectionDependencyUnavailableError(localError.message);\n      throw localError;\n    }\n  }\n}\n"]}

package/workflows/principals/principalRecoveryQueue.js

@@ -0,0 +1,22 @@
+// Directory and Admins stages are shared by every reference in an organization.
+// Coordinate runtime callers across warmer instances; different databases and
+// organizations keep independent queues. Completed queues retain no work.
+// Queued work must not re-enter this queue for the same organization.
+const queues = new WeakMap();
+export function queuePrincipalRecovery(execSql, organizationId, work) {
+    let scoped = queues.get(execSql);
+    if (!scoped) {
+        scoped = new Map();
+        queues.set(execSql, scoped);
+    }
+    const operation = (scoped.get(organizationId) ?? Promise.resolve()).then(work);
+    const settled = operation.then(() => undefined, () => undefined);
+    scoped.set(organizationId, settled);
+    const owned = scoped;
+    void settled.then(() => {
+        if (owned.get(organizationId) === settled)
+            owned.delete(organizationId);
+    });
+    return operation;
+}
+//# sourceMappingURL=principalRecoveryQueue.js.map

package/workflows/principals/principalRecoveryQueue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalRecoveryQueue.js","sourceRoot":"","sources":["principalRecoveryQueue.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuC,CAAC;AAElE,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,cAAsB,EACtB,IAAsB;IAEtB,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CACtE,IAAI,CACL,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAC5B,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC;IACrB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\n// Directory and Admins stages are shared by every reference in an organization.\n// Coordinate runtime callers across warmer instances; different databases and\n// organizations keep independent queues. Completed queues retain no work.\n// Queued work must not re-enter this queue for the same organization.\nconst queues = new WeakMap<ExecSql, Map<string, Promise<void>>>();\n\nexport function queuePrincipalRecovery<T>(\n  execSql: ExecSql,\n  organizationId: string,\n  work: () => Promise<T>,\n): Promise<T> {\n  let scoped = queues.get(execSql);\n  if (!scoped) {\n    scoped = new Map();\n    queues.set(execSql, scoped);\n  }\n  const operation = (scoped.get(organizationId) ?? Promise.resolve()).then(\n    work,\n  );\n  const settled = operation.then(\n    () => undefined,\n    () => undefined,\n  );\n  scoped.set(organizationId, settled);\n  const owned = scoped;\n  void settled.then(() => {\n    if (owned.get(organizationId) === settled) owned.delete(organizationId);\n  });\n  return operation;\n}\n"]}

package/workflows/principals/recoverPrincipalPolicyHistory.d.ts

@@ -2,5 +2,6 @@ import { type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistor
 /**
  * Recover one exact head with bounded retained history and durable checked progress.
  * The result is a sparse current-policy capability; this does not advance app checkpoints.
+ * Retain organization version 1 when the result will establish founder binding.
  */
 export declare function recoverPrincipalPolicyHistory(options: RecoverPrincipalPolicyHistoryOptions): Promise<RecoveredPrincipalPolicyHistory>;

package/workflows/principals/recoverPrincipalPolicyHistory.js

@@ -1,11 +1,24 @@
-import { KeyingVerificationError, verifyPrincipalPolicyCurrent, } from "../../internal/crypto/index.js";
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, } from "../../internal/crypto/index.js";
 import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
 import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { preparePrincipalHistoryEvidencePage } from "../../data/persistence/principalHistoryEvidencePersistence.js";
 import { discardPrincipalHistoryStage, savePrincipalHistoryStage, } from "../../data/persistence/principalHistoryStagePersistence.js";
+import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
 import { principalHistoryStageProtection } from "../../data/principals/principalHistoryStageProtection.js";
 import { collectPrincipalPolicySignerPublicKeys } from "./policyVerification.js";
+import { publishReusablePrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
+import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "./principalHistoryRecoveryReferences.js";
 import { restorePrincipalHistoryRecoveryStage, } from "./principalHistoryRecoveryStage.js";
-import { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
+import { PrincipalHistoryRecoveryRaceError, PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
+import { assertPrincipalHistoryVerificationMode, principalHistoryVerificationContext, } from "./principalHistoryRecoveryVerification.js";
+class PrincipalHistoryPrefixDisconnectedError extends Error {
+    verificationError;
+    constructor(verificationError) {
+        super(verificationError.message);
+        this.verificationError = verificationError;
+        this.name = "PrincipalHistoryPrefixDisconnectedError";
+    }
+}
 function currentArtifacts(page) {
     return {
         currentState: page.currentState,
@@ -15,12 +28,13 @@ function currentArtifacts(page) {
         currentMemberEnvelopes: page.currentMemberEnvelopes,
     };
 }
+function recoveryIsCurrent(input) {
+    return !input.signal?.aborted && input.stillCurrent();
+}
 function assertCurrent(input) {
-    assertProjectionVerificationCurrent(() => !input.signal?.aborted && input.stillCurrent());
+    assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));
 }
-async function acceptPage(input, stage, response) {
-    const page = structuredClone(response);
-    assertCurrent(input);
+function assertExpectedHead(current, expectedHead) {
     for (const field of [
         "principalType",
         "principalId",
@@ -29,13 +43,19 @@ async function acceptPage(input, stage, response) {
         "keyEpoch",
         "keyFingerprint",
     ]) {
-        if (page.currentState[field] !== input.expectedHead[field])
+        if (current.currentState[field] !== expectedHead[field])
             throw new KeyingVerificationError("object_mismatch", "Principal history page does not match its requested head");
     }
-    if (stage.saved?.complete) {
+}
+async function acceptPage(input, stage, response) {
+    const page = structuredClone(response);
+    assertCurrent(input);
+    assertExpectedHead(page, input.expectedHead);
+    if (stage.complete) {
         if (page.previousStates.length !== 0 ||
             page.historyPage.nextAfterVersion !== null)
             throw new KeyingVerificationError("invalid_shape", "Completed history returned additional entries");
+        stage.current = currentArtifacts(page);
         return;
     }
     const complete = page.historyPage.nextAfterVersion === null;
@@ -47,6 +67,7 @@ async function acceptPage(input, stage, response) {
             projection: current.currentProjection,
             grants: current.currentGrants,
         });
+    assertPrincipalHistoryVerificationMode(input, entries);
     const keys = await collectPrincipalPolicySignerPublicKeys({
         bundle: { ...current, previousStates: page.previousStates },
         resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
@@ -59,8 +80,11 @@ async function acceptPage(input, stage, response) {
         signerPublicKeys: keys.signerPublicKeys,
         ...(externalAuthority ? { externalAuthority } : {}),
     });
-    if (!appended.ok)
+    if (!appended.ok) {
+        if (appended.error.code === "stale_predecessor")
+            throw new PrincipalHistoryPrefixDisconnectedError(appended.error);
         throw appended.error;
+    }
     const next = {
         id: stage.id,
         organizationId: input.organizationId,
@@ -75,43 +99,59 @@ async function acceptPage(input, stage, response) {
     await savePrincipalHistoryStage({
         execSql: input.execSql,
         stage: saved,
+        evidence: await preparePrincipalHistoryEvidencePage({
+            scopeId: stage.scopeId,
+            organizationId: input.organizationId,
+            entries,
+            nodes: appended.value.indexNodes,
+        }),
         previousProgress: stage.saved?.progress ?? null,
-        stillCurrent: () => !input.signal?.aborted && input.stillCurrent(),
+        stillCurrent: () => recoveryIsCurrent(input),
     });
     stage.current = current;
     stage.saved = saved;
+    stage.complete = complete;
 }
 async function finishRecovery(input, stage, checkpoint) {
-    if (!stage.current || !stage.saved?.complete)
+    if (!stage.current || !stage.complete)
         throw new KeyingVerificationError("missing_dependency", "Principal history ended before its pinned head");
     const history = stage.verifier.finish(input.expectedHead);
     if (!history.ok)
         throw history.error;
+    const selected = await selectRecoveredPrincipalHistory({
+        options: input,
+        scopeId: stage.scopeId,
+        history: history.value,
+        checkpoint,
+    });
     const current = await verifyPrincipalPolicyCurrent({
         current: stage.current,
-        history: history.value,
+        history: selected,
     });
     if (!current.ok)
         throw current.error;
+    verifyPrincipalPolicyCheckpoint({
+        chain: current.value.retainedHistory,
+        currentState: current.value.state,
+        localCheckpoint: checkpoint,
+    });
     const latest = await loadPrincipalPolicyCheckpoint(input.execSql, input.expectedHead.principalType, input.expectedHead.principalId);
     if (latest?.version !== checkpoint?.version ||
         latest?.stateHash !== checkpoint?.stateHash)
-        throw new KeyingVerificationError("stale_predecessor", "Local principal checkpoint changed during history recovery");
+        throw new PrincipalHistoryRecoveryRaceError("Local principal checkpoint changed during history recovery");
+    assertCurrent(input);
+    if (!input.offline)
+        await publishReusablePrincipalHistoryPrefix(input, stage.scopeId, stage.verifier, stage.current);
     assertCurrent(input);
     return { current: stage.current, policy: current.value };
 }
-async function recover(input) {
-    assertCurrent(input);
-    const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, input.expectedHead.principalType, input.expectedHead.principalId);
-    if (checkpoint && input.expectedHead.version < checkpoint.version)
-        throw new KeyingVerificationError("rollback", "Requested principal history predates the local checkpoint");
-    const historyInput = {
-        principalType: input.expectedHead.principalType,
-        principalId: input.expectedHead.principalId,
-        localCheckpoint: checkpoint,
-        retainedReferences: input.retainedReferences ?? [],
-    };
-    const stage = await restorePrincipalHistoryRecoveryStage(input, historyInput);
+async function readRecoveryPages(input, stage) {
+    if (input.offline) {
+        if (!stage.complete || !stage.current)
+            throw new KeyingVerificationError("missing_dependency", "Completed principal history is unavailable offline");
+        assertExpectedHead(stage.current, input.expectedHead);
+        return;
+    }
     let receivedFinalPage = false;
     for await (const result of input.apiClient.getPrincipalPolicyPages(input.expectedHead.principalType, input.expectedHead.principalId, {
         signal: input.signal,
@@ -123,13 +163,13 @@ async function recover(input) {
                     afterVersion: stage.saved.afterVersion,
                 },
             }
-            : {}),
+            : { afterVersion: stage.initialAfterVersion }),
     })) {
         if (!result.ok) {
             // A rejected transport pin cannot justify skipping history on retry.
             // Discard only this operation's progress, then let a new call replay it.
             if (result.kind === "shape" && stage.saved)
-                await discardPrincipalHistoryStage(input.execSql, stage.saved, () => !input.signal?.aborted && input.stillCurrent());
+                await discardPrincipalHistoryStage(input.execSql, stage.saved, () => recoveryIsCurrent(input));
             throw new PrincipalPolicyHistoryReadError(result);
         }
         await acceptPage(input, stage, result.data);
@@ -137,33 +177,65 @@ async function recover(input) {
     }
     if (!receivedFinalPage)
         throw new KeyingVerificationError("missing_dependency", "Principal history transport did not complete");
-    return finishRecovery(input, stage, checkpoint);
+}
+async function recover(input, allowEvidenceRebuild = true) {
+    assertCurrent(input);
+    const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, input.expectedHead.principalType, input.expectedHead.principalId);
+    if (checkpoint && input.expectedHead.version < checkpoint.version)
+        throw new KeyingVerificationError(input.offline ? "missing_dependency" : "rollback", "Requested principal history predates the local checkpoint");
+    // Validate the requested pin/selection before creating any disposable caches.
+    createPrincipalPolicyHistoryVerifier({
+        principalType: input.expectedHead.principalType,
+        principalId: input.expectedHead.principalId,
+        localCheckpoint: checkpoint,
+        retainedReferences: input.retainedReferences ?? [],
+    });
+    const historyInput = {
+        principalType: input.expectedHead.principalType,
+        principalId: input.expectedHead.principalId,
+    };
+    const stage = await restorePrincipalHistoryRecoveryStage(input, historyInput, allowEvidenceRebuild);
+    try {
+        await readRecoveryPages(input, stage);
+        return await finishRecovery(input, stage, checkpoint);
+    }
+    catch (error) {
+        const lostEvidence = error instanceof PrincipalHistoryEvidenceUnavailableError;
+        const disconnected = error instanceof PrincipalHistoryPrefixDisconnectedError;
+        if (!lostEvidence && !disconnected)
+            throw error;
+        if (stage.saved)
+            await discardPrincipalHistoryStage(input.execSql, stage.saved, () => recoveryIsCurrent(input));
+        if (!input.offline &&
+            allowEvidenceRebuild &&
+            (lostEvidence || stage.fromCache))
+            return recover(input, false);
+        throw lostEvidence || disconnected ? error.verificationError : error;
+    }
 }
 /**
  * Recover one exact head with bounded retained history and durable checked progress.
  * The result is a sparse current-policy capability; this does not advance app checkpoints.
+ * Retain organization version 1 when the result will establish founder binding.
  */
 export async function recoverPrincipalPolicyHistory(options) {
+    if (options.offline !== undefined && typeof options.offline !== "boolean")
+        throw new KeyingVerificationError("invalid_shape", "Invalid principal history transport mode");
     if (!options.organizationId ||
         (options.expectedHead.principalType === "organization" &&
             options.expectedHead.principalId !== options.organizationId))
         throw new KeyingVerificationError("object_mismatch", "Principal history organization scope is invalid");
     if (options.retainedReferences?.some((reference) => reference.version > options.expectedHead.version))
         throw new KeyingVerificationError("missing_dependency", "Requested history reference is beyond the recovery head");
-    if (!(options.protection.localKey instanceof Uint8Array) ||
-        options.protection.localKey.byteLength !== 32 ||
-        !options.protection.context)
-        throw new KeyingVerificationError("invalid_shape", "Principal history recovery requires a private 32-byte key and trust context");
     const input = {
         ...options,
+        historyVerification: options.historyVerification ?? "standard",
         expectedHead: structuredClone(options.expectedHead),
         retainedReferences: structuredClone(options.retainedReferences ?? []),
-        protection: {
-            context: options.protection.context,
-            localKey: new Uint8Array(options.protection.localKey),
-        },
+        protection: ownPrincipalHistoryProtection(options.protection),
     };
     try {
+        input.protection.context = principalHistoryVerificationContext(input);
         return await recover(input);
     }
     finally {

package/workflows/principals/recoverPrincipalPolicyHistory.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EAGvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AAEzC,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC1B,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE;KACnE,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAA2C,EAC3C,KAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ;QAC1C,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAA2C;IAE3C,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,2DAA2D,CAC5D,CAAC;IACJ,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC9E,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,EACX,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;IACJ,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,IACE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,YAAY,UAAU,CAAC;QACpD,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,KAAK,EAAE;QAC7C,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO;QAE3B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6EAA6E,CAC9E,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE;YACV,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;YACnC,QAAQ,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;SACtD;KACF,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryInput,\n  verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  savePrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport {\n  type PrincipalHistoryRecoveryStage,\n  restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\n\nfunction currentArtifacts(\n  page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n  assertProjectionVerificationCurrent(\n    () => !input.signal?.aborted && input.stillCurrent(),\n  );\n}\n\nasync function acceptPage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  response: PrincipalPolicyPageResponse,\n): Promise<void> {\n  const page = structuredClone(response);\n  assertCurrent(input);\n  for (const field of [\n    \"principalType\",\n    \"principalId\",\n    \"version\",\n    \"stateHash\",\n    \"keyEpoch\",\n    \"keyFingerprint\",\n  ] as const) {\n    if (page.currentState[field] !== input.expectedHead[field])\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Principal history page does not match its requested head\",\n      );\n  }\n  if (stage.saved?.complete) {\n    if (\n      page.previousStates.length !== 0 ||\n      page.historyPage.nextAfterVersion !== null\n    )\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Completed history returned additional entries\",\n      );\n    return;\n  }\n  const complete = page.historyPage.nextAfterVersion === null;\n  const current = currentArtifacts(page);\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: { ...current, previousStates: page.previousStates },\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Principal history signer identity could not be authenticated\",\n    );\n  const externalAuthority = await input.loadExternalAuthority?.(entries);\n  const appended = await stage.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) throw appended.error;\n  const next = {\n    id: stage.id,\n    organizationId: input.organizationId,\n    currentJson: JSON.stringify(current),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const protectedProgress = await stage.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.expectedHead,\n      next,\n    ),\n  );\n  if (!protectedProgress.ok) throw protectedProgress.error;\n  const saved = { ...next, progress: protectedProgress.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    previousProgress: stage.saved?.progress ?? null,\n    stillCurrent: () => !input.signal?.aborted && input.stillCurrent(),\n  });\n  stage.current = current;\n  stage.saved = saved;\n}\n\nasync function finishRecovery(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (!stage.current || !stage.saved?.complete)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history ended before its pinned head\",\n    );\n  const history = stage.verifier.finish(input.expectedHead);\n  if (!history.ok) throw history.error;\n  const current = await verifyPrincipalPolicyCurrent({\n    current: stage.current,\n    history: history.value,\n  });\n  if (!current.ok) throw current.error;\n  const latest = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Local principal checkpoint changed during history recovery\",\n    );\n  assertCurrent(input);\n  return { current: stage.current, policy: current.value };\n}\n\nasync function recover(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  assertCurrent(input);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (checkpoint && input.expectedHead.version < checkpoint.version)\n    throw new KeyingVerificationError(\n      \"rollback\",\n      \"Requested principal history predates the local checkpoint\",\n    );\n  const historyInput: PrincipalPolicyHistoryInput = {\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n    localCheckpoint: checkpoint,\n    retainedReferences: input.retainedReferences ?? [],\n  };\n  const stage = await restorePrincipalHistoryRecoveryStage(input, historyInput);\n  let receivedFinalPage = false;\n  for await (const result of input.apiClient.getPrincipalPolicyPages(\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n    {\n      signal: input.signal,\n      stateHash: input.expectedHead.stateHash,\n      ...(stage.saved && stage.current\n        ? {\n            resume: {\n              current: stage.current,\n              afterVersion: stage.saved.afterVersion,\n            },\n          }\n        : {}),\n    },\n  )) {\n    if (!result.ok) {\n      // A rejected transport pin cannot justify skipping history on retry.\n      // Discard only this operation's progress, then let a new call replay it.\n      if (result.kind === \"shape\" && stage.saved)\n        await discardPrincipalHistoryStage(\n          input.execSql,\n          stage.saved,\n          () => !input.signal?.aborted && input.stillCurrent(),\n        );\n      throw new PrincipalPolicyHistoryReadError(result);\n    }\n    await acceptPage(input, stage, result.data);\n    receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n  }\n  if (!receivedFinalPage)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history transport did not complete\",\n    );\n  return finishRecovery(input, stage, checkpoint);\n}\n\n/**\n * Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n */\nexport async function recoverPrincipalPolicyHistory(\n  options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (\n    !options.organizationId ||\n    (options.expectedHead.principalType === \"organization\" &&\n      options.expectedHead.principalId !== options.organizationId)\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal history organization scope is invalid\",\n    );\n  if (\n    options.retainedReferences?.some(\n      (reference) => reference.version > options.expectedHead.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Requested history reference is beyond the recovery head\",\n    );\n  if (\n    !(options.protection.localKey instanceof Uint8Array) ||\n    options.protection.localKey.byteLength !== 32 ||\n    !options.protection.context\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal history recovery requires a private 32-byte key and trust context\",\n    );\n  const input = {\n    ...options,\n    expectedHead: structuredClone(options.expectedHead),\n    retainedReferences: structuredClone(options.retainedReferences ?? []),\n    protection: {\n      context: options.protection.context,\n      localKey: new Uint8Array(options.protection.localKey),\n    },\n  };\n  try {\n    return await recover(input);\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n"]}
+{"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EAGvB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,uCAAwC,SAAQ,KAAK;IACpC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAC;IACxD,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C;IAE3C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC,EACnC,YAAkE;IAElE,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,sCAAsC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,uCAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAA2C,EAC3C,KAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,+BAA+B,CAAC;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;QACpC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QACjC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,qCAAqC,CACzC,KAAK,EACL,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2C,EAC3C,KAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;YACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACjD,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;AACN,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAA2C,EAC3C,oBAAoB,GAAG,IAAI;IAE3B,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,EACjD,2DAA2D,CAC5D,CAAC;IACJ,8EAA8E;IAC9E,oCAAoC,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CACtD,KAAK,EACL,YAAY,EACZ,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAChB,KAAK,YAAY,wCAAwC,CAAC;QAC5D,MAAM,YAAY,GAChB,KAAK,YAAY,uCAAuC,CAAC;QAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;YAAE,MAAM,KAAK,CAAC;QAChD,IAAI,KAAK,CAAC,KAAK;YACb,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;QACJ,IACE,CAAC,KAAK,CAAC,OAAO;YACd,oBAAoB;YACpB,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,CAAC;YAEjC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,UAAU;QAC9D,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryInput,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  savePrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport { publishReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalHistoryEvidenceUnavailableError,\n  selectRecoveredPrincipalHistory,\n} from \"./principalHistoryRecoveryReferences\";\nimport {\n  type PrincipalHistoryRecoveryStage,\n  restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n  assertPrincipalHistoryVerificationMode,\n  principalHistoryVerificationContext,\n} from \"./principalHistoryRecoveryVerification\";\n\nclass PrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\nfunction currentArtifacts(\n  page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n\nfunction recoveryIsCurrent(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): boolean {\n  return !input.signal?.aborted && input.stillCurrent();\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n  assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));\n}\n\nfunction assertExpectedHead(\n  current: PrincipalPolicyPageCurrent,\n  expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): void {\n  for (const field of [\n    \"principalType\",\n    \"principalId\",\n    \"version\",\n    \"stateHash\",\n    \"keyEpoch\",\n    \"keyFingerprint\",\n  ] as const) {\n    if (current.currentState[field] !== expectedHead[field])\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Principal history page does not match its requested head\",\n      );\n  }\n}\n\nasync function acceptPage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  response: PrincipalPolicyPageResponse,\n): Promise<void> {\n  const page = structuredClone(response);\n  assertCurrent(input);\n  assertExpectedHead(page, input.expectedHead);\n  if (stage.complete) {\n    if (\n      page.previousStates.length !== 0 ||\n      page.historyPage.nextAfterVersion !== null\n    )\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Completed history returned additional entries\",\n      );\n    stage.current = currentArtifacts(page);\n    return;\n  }\n  const complete = page.historyPage.nextAfterVersion === null;\n  const current = currentArtifacts(page);\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n  assertPrincipalHistoryVerificationMode(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: { ...current, previousStates: page.previousStates },\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Principal history signer identity could not be authenticated\",\n    );\n  const externalAuthority = await input.loadExternalAuthority?.(entries);\n  const appended = await stage.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const next = {\n    id: stage.id,\n    organizationId: input.organizationId,\n    currentJson: JSON.stringify(current),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const protectedProgress = await stage.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.expectedHead,\n      next,\n    ),\n  );\n  if (!protectedProgress.ok) throw protectedProgress.error;\n  const saved = { ...next, progress: protectedProgress.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      scopeId: stage.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: stage.saved?.progress ?? null,\n    stillCurrent: () => recoveryIsCurrent(input),\n  });\n  stage.current = current;\n  stage.saved = saved;\n  stage.complete = complete;\n}\n\nasync function finishRecovery(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (!stage.current || !stage.complete)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history ended before its pinned head\",\n    );\n  const history = stage.verifier.finish(input.expectedHead);\n  if (!history.ok) throw history.error;\n  const selected = await selectRecoveredPrincipalHistory({\n    options: input,\n    scopeId: stage.scopeId,\n    history: history.value,\n    checkpoint,\n  });\n  const current = await verifyPrincipalPolicyCurrent({\n    current: stage.current,\n    history: selected,\n  });\n  if (!current.ok) throw current.error;\n  verifyPrincipalPolicyCheckpoint({\n    chain: current.value.retainedHistory,\n    currentState: current.value.state,\n    localCheckpoint: checkpoint,\n  });\n  const latest = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Local principal checkpoint changed during history recovery\",\n    );\n  assertCurrent(input);\n  if (!input.offline)\n    await publishReusablePrincipalHistoryPrefix(\n      input,\n      stage.scopeId,\n      stage.verifier,\n      stage.current,\n    );\n  assertCurrent(input);\n  return { current: stage.current, policy: current.value };\n}\n\nasync function readRecoveryPages(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n): Promise<void> {\n  if (input.offline) {\n    if (!stage.complete || !stage.current)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Completed principal history is unavailable offline\",\n      );\n    assertExpectedHead(stage.current, input.expectedHead);\n    return;\n  }\n  let receivedFinalPage = false;\n  for await (const result of input.apiClient.getPrincipalPolicyPages(\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n    {\n      signal: input.signal,\n      stateHash: input.expectedHead.stateHash,\n      ...(stage.saved && stage.current\n        ? {\n            resume: {\n              current: stage.current,\n              afterVersion: stage.saved.afterVersion,\n            },\n          }\n        : { afterVersion: stage.initialAfterVersion }),\n    },\n  )) {\n    if (!result.ok) {\n      // A rejected transport pin cannot justify skipping history on retry.\n      // Discard only this operation's progress, then let a new call replay it.\n      if (result.kind === \"shape\" && stage.saved)\n        await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n          recoveryIsCurrent(input),\n        );\n      throw new PrincipalPolicyHistoryReadError(result);\n    }\n    await acceptPage(input, stage, result.data);\n    receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n  }\n  if (!receivedFinalPage)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history transport did not complete\",\n    );\n}\n\nasync function recover(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  allowEvidenceRebuild = true,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  assertCurrent(input);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (checkpoint && input.expectedHead.version < checkpoint.version)\n    throw new KeyingVerificationError(\n      input.offline ? \"missing_dependency\" : \"rollback\",\n      \"Requested principal history predates the local checkpoint\",\n    );\n  // Validate the requested pin/selection before creating any disposable caches.\n  createPrincipalPolicyHistoryVerifier({\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n    localCheckpoint: checkpoint,\n    retainedReferences: input.retainedReferences ?? [],\n  });\n  const historyInput: PrincipalPolicyHistoryInput = {\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n  };\n  const stage = await restorePrincipalHistoryRecoveryStage(\n    input,\n    historyInput,\n    allowEvidenceRebuild,\n  );\n  try {\n    await readRecoveryPages(input, stage);\n    return await finishRecovery(input, stage, checkpoint);\n  } catch (error) {\n    const lostEvidence =\n      error instanceof PrincipalHistoryEvidenceUnavailableError;\n    const disconnected =\n      error instanceof PrincipalHistoryPrefixDisconnectedError;\n    if (!lostEvidence && !disconnected) throw error;\n    if (stage.saved)\n      await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n        recoveryIsCurrent(input),\n      );\n    if (\n      !input.offline &&\n      allowEvidenceRebuild &&\n      (lostEvidence || stage.fromCache)\n    )\n      return recover(input, false);\n    throw lostEvidence || disconnected ? error.verificationError : error;\n  }\n}\n\n/**\n * Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n * Retain organization version 1 when the result will establish founder binding.\n */\nexport async function recoverPrincipalPolicyHistory(\n  options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid principal history transport mode\",\n    );\n  if (\n    !options.organizationId ||\n    (options.expectedHead.principalType === \"organization\" &&\n      options.expectedHead.principalId !== options.organizationId)\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal history organization scope is invalid\",\n    );\n  if (\n    options.retainedReferences?.some(\n      (reference) => reference.version > options.expectedHead.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Requested history reference is beyond the recovery head\",\n    );\n  const input = {\n    ...options,\n    historyVerification: options.historyVerification ?? \"standard\",\n    expectedHead: structuredClone(options.expectedHead),\n    retainedReferences: structuredClone(options.retainedReferences ?? []),\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    input.protection.context = principalHistoryVerificationContext(input);\n    return await recover(input);\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n"]}