@tearleads/client-sdk 0.1.11 → 0.1.13

package/workflows/principals/recoverScopedPrincipalPolicyHistory.d.ts

@@ -0,0 +1,13 @@
+import { type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+import { type RecoveredPrincipalPolicyHistory } from "./principalHistoryRecoveryTypes.js";
+import { type PrincipalRecoveryContext } from "./principalRecoveryDirectory.js";
+export interface RecoverScopedPrincipalPolicyHistoryOptions extends PrincipalRecoveryContext {
+    readonly reference: ReferencedPrincipalHead;
+}
+export interface RecoveredScopedPrincipalPolicyHistory extends RecoveredPrincipalPolicyHistory {
+    /** Submit these with policy when atomically admitting its organization scope. */
+    readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];
+}
+export declare function recoverScopedPrincipalPolicyHistory(options: RecoverScopedPrincipalPolicyHistoryOptions): Promise<RecoveredScopedPrincipalPolicyHistory>;
+/** Internal runtime batch: shared results never outlive one caller's collection. */
+export declare function createScopedPrincipalPolicyHistoryBatch(): typeof recoverScopedPrincipalPolicyHistory;

package/workflows/principals/recoverScopedPrincipalPolicyHistory.js

@@ -0,0 +1,150 @@
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
+import { PrincipalHistoryRecoveryRaceError, } from "./principalHistoryRecoveryTypes.js";
+import { PrincipalRecoveryDirectoryAdvanced, } from "./principalRecoveryDirectory.js";
+import { createPrincipalRecoveryReader, } from "./principalRecoveryMemo.js";
+import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+function groupHead(directory, principalId) {
+    const head = directory.descriptor.groupHeads.find((entry) => entry.principalId === principalId);
+    if (!head)
+        throw new KeyingVerificationError("missing_dependency", "Group is absent from the signed organization directory");
+    return head;
+}
+function authorityHead(state) {
+    return {
+        principalType: "group",
+        principalId: state.principalId,
+        version: state.version,
+        stateHash: state.stateHash,
+        keyEpoch: state.keyEpoch,
+        keyFingerprint: state.keyFingerprint,
+    };
+}
+function scopedGroupProtection(input, adminHead) {
+    return {
+        localKey: input.protection.localKey,
+        context: serializeKeyingCanonicalJson([
+            "tearleads.sdk.principal-history.scoped-group.v1",
+            input.protection.context,
+            input.organizationId,
+            adminHead.principalId,
+        ]),
+    };
+}
+async function recoverScopedPolicy(input, memo) {
+    if (input.reference.principalType === "organization" &&
+        input.reference.principalId !== input.organizationId)
+        throw new KeyingVerificationError("object_mismatch", "Requested organization policy is outside its scope");
+    const read = createPrincipalRecoveryReader(input, memo);
+    const directory = await read.directory(input.reference.principalType === "organization" ? [input.reference] : []);
+    if (input.reference.principalType === "organization")
+        return {
+            current: directory.current,
+            policy: directory.policy,
+            dependencies: [],
+        };
+    const expectedHead = groupHead(directory, input.reference.principalId);
+    if (input.reference.version > expectedHead.version)
+        throw new PrincipalRecoveryDirectoryAdvanced();
+    const adminHead = groupHead(directory, directory.descriptor.adminGroupId);
+    const isAdmins = expectedHead.principalId === adminHead.principalId;
+    let admins = null;
+    if (!isAdmins) {
+        admins = (await read.admins(adminHead)).policy;
+    }
+    const loadExternalAuthority = async (entries) => {
+        const references = new Map();
+        for (const { state } of entries) {
+            const citation = state.externalAuthority;
+            if (!citation)
+                continue;
+            if (citation.principalId !== adminHead.principalId)
+                throw new KeyingVerificationError("object_mismatch", "Group cites another organization's Admins authority");
+            if (citation.version > adminHead.version)
+                throw new PrincipalRecoveryDirectoryAdvanced();
+            references.set(`${citation.version}:${citation.stateHash}`, citation);
+        }
+        if (!references.size)
+            return undefined;
+        const recovered = await read.admins(adminHead, [...references.values()]);
+        return {
+            currentHead: adminHead,
+            states: recovered.policy.retainedHistory.map(({ state, projection }) => ({
+                head: authorityHead(state),
+                projection,
+            })),
+        };
+    };
+    const recovered = await recoverPrincipalPolicyHistory({
+        ...input,
+        expectedHead,
+        retainedReferences: [input.reference],
+        historyVerification: isAdmins ? "direct-admins" : "standard",
+        ...(isAdmins
+            ? {}
+            : { protection: scopedGroupProtection(input, adminHead) }),
+        ...(isAdmins ? {} : { loadExternalAuthority }),
+    });
+    return {
+        ...recovered,
+        dependencies: admins ? [directory.policy, admins] : [directory.policy],
+    };
+}
+/** Recover signed directory and strict Admins dependencies without full histories. */
+async function recoverScopedPrincipalPolicyHistoryInBatch(options, memo) {
+    if (options.offline !== undefined && typeof options.offline !== "boolean")
+        throw new KeyingVerificationError("invalid_shape", "Invalid principal history transport mode");
+    if (!options.organizationId)
+        throw new KeyingVerificationError("object_mismatch", "Principal recovery requires an organization scope");
+    const input = {
+        apiClient: options.apiClient,
+        execSql: options.execSql,
+        organizationId: options.organizationId,
+        offline: options.offline,
+        resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,
+        signal: options.signal,
+        stillCurrent: options.stillCurrent,
+        reference: structuredClone(options.reference),
+        protection: ownPrincipalHistoryProtection(options.protection),
+    };
+    try {
+        // Reject malformed exact citations before any discovery or disposable writes.
+        createPrincipalPolicyHistoryVerifier({
+            principalId: input.reference.principalId,
+            principalType: input.reference.principalType,
+            retainedReferences: [input.reference],
+        });
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                const recovered = await recoverScopedPolicy(input, memo);
+                assertProjectionVerificationCurrent(() => !input.signal?.aborted && input.stillCurrent());
+                return recovered;
+            }
+            catch (error) {
+                if (!(error instanceof PrincipalRecoveryDirectoryAdvanced))
+                    throw error;
+                memo?.directories.clear();
+                memo?.admins.clear();
+                if (input.offline)
+                    throw new KeyingVerificationError("missing_dependency", "Requested principal evidence is newer than the offline directory");
+            }
+        }
+        throw new PrincipalHistoryRecoveryRaceError("Organization directory remains behind the requested policy evidence");
+    }
+    finally {
+        input.protection.localKey.fill(0);
+    }
+}
+export function recoverScopedPrincipalPolicyHistory(options) {
+    return recoverScopedPrincipalPolicyHistoryInBatch(options);
+}
+/** Internal runtime batch: shared results never outlive one caller's collection. */
+export function createScopedPrincipalPolicyHistoryBatch() {
+    const memo = {
+        directories: new Map(),
+        admins: new Map(),
+    };
+    return (options) => recoverScopedPrincipalPolicyHistoryInBatch(options, memo);
+}
+//# sourceMappingURL=recoverScopedPrincipalPolicyHistory.js.map

package/workflows/principals/recoverScopedPrincipalPolicyHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoverScopedPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverScopedPrincipalPolicyHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EAIvB,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EACL,iCAAiC,GAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,kCAAkC,GAEnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,6BAA6B,GAE9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAahF,SAAS,SAAS,CAAC,SAAmC,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAC7C,CAAC;IACF,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO;QACL,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAiD,EACjD,SAAkC;IAElC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;QACnC,OAAO,EAAE,4BAA4B,CAAC;YACpC,iDAAiD;YACjD,KAAK,CAAC,UAAU,CAAC,OAAO;YACxB,KAAK,CAAC,cAAc;YACpB,SAAS,CAAC,WAAW;SACtB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAiD,EACjD,IAA4B;IAE5B,IACE,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAChD,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;QAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,oDAAoD,CACrD,CAAC;IACJ,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAClD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO;QAChD,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAAC;IACpE,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,CAAC;IACD,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAAkD,EACK,EAAE;QACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC9D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC;YACzC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;gBAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;YACJ,IAAI,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO;gBACtC,MAAM,IAAI,kCAAkC,EAAE,CAAC;YACjD,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO;YACL,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC1B,UAAU;aACX,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,GAAG,KAAK;QACR,YAAY;QACZ,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACrC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU;QAC5D,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,GAAG,SAAS;QACZ,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,0CAA0C,CACvD,OAAmD,EACnD,IAA4B;IAE5B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,cAAc;QACzB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,8EAA8E;QAC9E,oCAAoC,CAAC;YACnC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YACxC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;YAC5C,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SACtC,CAAC,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzD,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kCAAkC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,KAAK,CAAC,OAAO;oBACf,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,kEAAkE,CACnE,CAAC;YACN,CAAC;QACH,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAAmD;IAEnD,OAAO,0CAA0C,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uCAAuC;IACrD,MAAM,IAAI,GAA0B;QAClC,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,MAAM,EAAE,IAAI,GAAG,EAAE;KAClB,CAAC;IACF,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,0CAA0C,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicyStateChainEntry,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  type RecoveredPrincipalPolicyHistory,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n  type PrincipalRecoveryContext,\n  PrincipalRecoveryDirectoryAdvanced,\n  type RecoveredPolicyDirectory,\n} from \"./principalRecoveryDirectory\";\nimport {\n  createPrincipalRecoveryReader,\n  type PrincipalRecoveryMemo,\n} from \"./principalRecoveryMemo\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport interface RecoverScopedPrincipalPolicyHistoryOptions\n  extends PrincipalRecoveryContext {\n  readonly reference: ReferencedPrincipalHead;\n}\n\nexport interface RecoveredScopedPrincipalPolicyHistory\n  extends RecoveredPrincipalPolicyHistory {\n  /** Submit these with policy when atomically admitting its organization scope. */\n  readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n}\n\nfunction groupHead(directory: RecoveredPolicyDirectory, principalId: string) {\n  const head = directory.descriptor.groupHeads.find(\n    (entry) => entry.principalId === principalId,\n  );\n  if (!head)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Group is absent from the signed organization directory\",\n    );\n  return head;\n}\n\nfunction authorityHead(state: ReferencedPrincipalHead) {\n  return {\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nfunction scopedGroupProtection(\n  input: RecoverScopedPrincipalPolicyHistoryOptions,\n  adminHead: ReferencedPrincipalHead,\n) {\n  return {\n    localKey: input.protection.localKey,\n    context: serializeKeyingCanonicalJson([\n      \"tearleads.sdk.principal-history.scoped-group.v1\",\n      input.protection.context,\n      input.organizationId,\n      adminHead.principalId,\n    ]),\n  };\n}\n\nasync function recoverScopedPolicy(\n  input: RecoverScopedPrincipalPolicyHistoryOptions,\n  memo?: PrincipalRecoveryMemo,\n): Promise<RecoveredScopedPrincipalPolicyHistory> {\n  if (\n    input.reference.principalType === \"organization\" &&\n    input.reference.principalId !== input.organizationId\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Requested organization policy is outside its scope\",\n    );\n  const read = createPrincipalRecoveryReader(input, memo);\n  const directory = await read.directory(\n    input.reference.principalType === \"organization\" ? [input.reference] : [],\n  );\n  if (input.reference.principalType === \"organization\")\n    return {\n      current: directory.current,\n      policy: directory.policy,\n      dependencies: [],\n    };\n  const expectedHead = groupHead(directory, input.reference.principalId);\n  if (input.reference.version > expectedHead.version)\n    throw new PrincipalRecoveryDirectoryAdvanced();\n  const adminHead = groupHead(directory, directory.descriptor.adminGroupId);\n  const isAdmins = expectedHead.principalId === adminHead.principalId;\n  let admins: VerifiedPrincipalPolicyCurrent | null = null;\n  if (!isAdmins) {\n    admins = (await read.admins(adminHead)).policy;\n  }\n  const loadExternalAuthority = async (\n    entries: readonly PrincipalPolicyStateChainEntry[],\n  ): Promise<PrincipalPolicyExternalAuthority | undefined> => {\n    const references = new Map<string, ReferencedPrincipalHead>();\n    for (const { state } of entries) {\n      const citation = state.externalAuthority;\n      if (!citation) continue;\n      if (citation.principalId !== adminHead.principalId)\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Group cites another organization's Admins authority\",\n        );\n      if (citation.version > adminHead.version)\n        throw new PrincipalRecoveryDirectoryAdvanced();\n      references.set(`${citation.version}:${citation.stateHash}`, citation);\n    }\n    if (!references.size) return undefined;\n    const recovered = await read.admins(adminHead, [...references.values()]);\n    return {\n      currentHead: adminHead,\n      states: recovered.policy.retainedHistory.map(({ state, projection }) => ({\n        head: authorityHead(state),\n        projection,\n      })),\n    };\n  };\n  const recovered = await recoverPrincipalPolicyHistory({\n    ...input,\n    expectedHead,\n    retainedReferences: [input.reference],\n    historyVerification: isAdmins ? \"direct-admins\" : \"standard\",\n    ...(isAdmins\n      ? {}\n      : { protection: scopedGroupProtection(input, adminHead) }),\n    ...(isAdmins ? {} : { loadExternalAuthority }),\n  });\n  return {\n    ...recovered,\n    dependencies: admins ? [directory.policy, admins] : [directory.policy],\n  };\n}\n\n/** Recover signed directory and strict Admins dependencies without full histories. */\nasync function recoverScopedPrincipalPolicyHistoryInBatch(\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n  memo?: PrincipalRecoveryMemo,\n): Promise<RecoveredScopedPrincipalPolicyHistory> {\n  if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid principal history transport mode\",\n    );\n  if (!options.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal recovery requires an organization scope\",\n    );\n  const input = {\n    apiClient: options.apiClient,\n    execSql: options.execSql,\n    organizationId: options.organizationId,\n    offline: options.offline,\n    resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,\n    signal: options.signal,\n    stillCurrent: options.stillCurrent,\n    reference: structuredClone(options.reference),\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    // Reject malformed exact citations before any discovery or disposable writes.\n    createPrincipalPolicyHistoryVerifier({\n      principalId: input.reference.principalId,\n      principalType: input.reference.principalType,\n      retainedReferences: [input.reference],\n    });\n    for (let attempt = 0; attempt < 2; attempt += 1) {\n      try {\n        const recovered = await recoverScopedPolicy(input, memo);\n        assertProjectionVerificationCurrent(\n          () => !input.signal?.aborted && input.stillCurrent(),\n        );\n        return recovered;\n      } catch (error) {\n        if (!(error instanceof PrincipalRecoveryDirectoryAdvanced)) throw error;\n        memo?.directories.clear();\n        memo?.admins.clear();\n        if (input.offline)\n          throw new KeyingVerificationError(\n            \"missing_dependency\",\n            \"Requested principal evidence is newer than the offline directory\",\n          );\n      }\n    }\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Organization directory remains behind the requested policy evidence\",\n    );\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n\nexport function recoverScopedPrincipalPolicyHistory(\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n): Promise<RecoveredScopedPrincipalPolicyHistory> {\n  return recoverScopedPrincipalPolicyHistoryInBatch(options);\n}\n\n/** Internal runtime batch: shared results never outlive one caller's collection. */\nexport function createScopedPrincipalPolicyHistoryBatch(): typeof recoverScopedPrincipalPolicyHistory {\n  const memo: PrincipalRecoveryMemo = {\n    directories: new Map(),\n    admins: new Map(),\n  };\n  return (options) => recoverScopedPrincipalPolicyHistoryInBatch(options, memo);\n}\n"]}

package/workflows/principals/runtimePolicyRecovery.js

@@ -0,0 +1,65 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
+import { assertProjectionVerificationCurrent, } from "../../data/keyingProjectionVerification/types.js";
+import { PrincipalHistoryRecoveryRaceError, PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
+import { recoverWithPrincipalOutageFallback } from "./principalRecoveryOutage.js";
+import { queuePrincipalRecovery } from "./principalRecoveryQueue.js";
+import { createScopedPrincipalPolicyHistoryBatch, recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
+/** Keep the private recovery key inside its runtime lease throughout verification. */
+export function createRuntimePrincipalPolicyResolver(runtime) {
+    const lease = runtime.withPrincipalHistoryProtection;
+    const readPages = runtime.apiClient.getPrincipalPolicyPages?.bind(runtime.apiClient);
+    if (!lease || !readPages)
+        return undefined;
+    const batches = new WeakMap();
+    const recoverFor = (batch) => {
+        if (!batch)
+            return recoverScopedPrincipalPolicyHistory;
+        let recover = batches.get(batch);
+        if (!recover) {
+            recover = createScopedPrincipalPolicyHistoryBatch();
+            batches.set(batch, recover);
+        }
+        return recover;
+    };
+    return (input) => queuePrincipalRecovery(runtime.infra.execSql, input.organizationId, () => runWithSecurityIncidentReporting(runtime.util.reportSecurityIncident, {
+        objectId: input.reference.principalId,
+        objectKind: "principal",
+        operation: "principal.policy.recover",
+        organizationId: input.organizationId,
+    }, () => lease(async ({ protection, stillCurrent: leaseCurrent }) => {
+        const stillCurrent = () => leaseCurrent() && input.stillCurrent?.() !== false;
+        assertProjectionVerificationCurrent(stillCurrent);
+        const offline = runtime.state?.online === false;
+        try {
+            const options = {
+                apiClient: { getPrincipalPolicyPages: readPages },
+                execSql: runtime.infra.execSql,
+                offline,
+                organizationId: input.organizationId,
+                protection,
+                reference: input.reference,
+                resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+                stillCurrent,
+            };
+            const result = await recoverWithPrincipalOutageFallback(recoverFor(input.recoveryBatch), options);
+            return {
+                organizationId: input.organizationId,
+                policy: result.policy,
+                dependencies: result.dependencies,
+                stillCurrent,
+            };
+        }
+        catch (error) {
+            assertProjectionVerificationCurrent(stillCurrent);
+            if (error instanceof PrincipalPolicyHistoryReadError ||
+                error instanceof PrincipalHistoryRecoveryRaceError ||
+                (error instanceof KeyingVerificationError &&
+                    error.code === "missing_dependency"))
+                throw new ProjectionDependencyUnavailableError(error.message);
+            throw error;
+        }
+    })));
+}
+//# sourceMappingURL=runtimePolicyRecovery.js.map

package/workflows/principals/runtimePolicyRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimePolicyRecovery.js","sourceRoot":"","sources":["runtimePolicyRecovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,mCAAmC,GAEpC,MAAM,+CAA+C,CAAC;AAKvD,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAa/C,sFAAsF;AACtF,MAAM,UAAU,oCAAoC,CAClD,OAAuC;IAEvC,MAAM,KAAK,GAAG,OAAO,CAAC,8BAA8B,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,CAC/D,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAGxB,CAAC;IACJ,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,mCAAmC,CAAC;QACvD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,uCAAuC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,CACvE,gCAAgC,CAC9B,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;QACrC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,0BAA0B;QACrC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,EACD,GAAG,EAAE,CACH,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QACzD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;QACrD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG;gBACd,SAAS,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE;gBACjD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;gBAC9D,YAAY;aACb,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,EAC/B,OAAO,CACR,CAAC;YACF,OAAO;gBACL,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,YAAY;aACb,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,YAAY,+BAA+B;gBAChD,KAAK,YAAY,iCAAiC;gBAClD,CAAC,KAAK,YAAY,uBAAuB;oBACvC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBAEtC,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACL,CACF,CAAC;AACN,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  assertProjectionVerificationCurrent,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification/types\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  PrincipalPolicyHistoryReadError,\n} from \"./principalHistoryRecoveryTypes\";\nimport { recoverWithPrincipalOutageFallback } from \"./principalRecoveryOutage\";\nimport { queuePrincipalRecovery } from \"./principalRecoveryQueue\";\nimport {\n  createScopedPrincipalPolicyHistoryBatch,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n\nexport interface PrincipalPolicyRecoveryRuntime {\n  readonly apiClient: Partial<Pick<ApiClient, \"getPrincipalPolicyPages\">>;\n  readonly infra: { readonly execSql: ExecSql };\n  readonly state?: { readonly online: boolean } | undefined;\n  readonly util: { readonly reportSecurityIncident: SecurityIncidentReporter };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\n/** Keep the private recovery key inside its runtime lease throughout verification. */\nexport function createRuntimePrincipalPolicyResolver(\n  runtime: PrincipalPolicyRecoveryRuntime,\n): ReferencedPrincipalPolicyWarmer[\"resolveReference\"] {\n  const lease = runtime.withPrincipalHistoryProtection;\n  const readPages = runtime.apiClient.getPrincipalPolicyPages?.bind(\n    runtime.apiClient,\n  );\n  if (!lease || !readPages) return undefined;\n  const batches = new WeakMap<\n    object,\n    typeof recoverScopedPrincipalPolicyHistory\n  >();\n  const recoverFor = (batch: object | undefined) => {\n    if (!batch) return recoverScopedPrincipalPolicyHistory;\n    let recover = batches.get(batch);\n    if (!recover) {\n      recover = createScopedPrincipalPolicyHistoryBatch();\n      batches.set(batch, recover);\n    }\n    return recover;\n  };\n  return (input) =>\n    queuePrincipalRecovery(runtime.infra.execSql, input.organizationId, () =>\n      runWithSecurityIncidentReporting(\n        runtime.util.reportSecurityIncident,\n        {\n          objectId: input.reference.principalId,\n          objectKind: \"principal\",\n          operation: \"principal.policy.recover\",\n          organizationId: input.organizationId,\n        },\n        () =>\n          lease(async ({ protection, stillCurrent: leaseCurrent }) => {\n            const stillCurrent = () =>\n              leaseCurrent() && input.stillCurrent?.() !== false;\n            assertProjectionVerificationCurrent(stillCurrent);\n            const offline = runtime.state?.online === false;\n            try {\n              const options = {\n                apiClient: { getPrincipalPolicyPages: readPages },\n                execSql: runtime.infra.execSql,\n                offline,\n                organizationId: input.organizationId,\n                protection,\n                reference: input.reference,\n                resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n                stillCurrent,\n              };\n              const result = await recoverWithPrincipalOutageFallback(\n                recoverFor(input.recoveryBatch),\n                options,\n              );\n              return {\n                organizationId: input.organizationId,\n                policy: result.policy,\n                dependencies: result.dependencies,\n                stillCurrent,\n              };\n            } catch (error) {\n              assertProjectionVerificationCurrent(stillCurrent);\n              if (\n                error instanceof PrincipalPolicyHistoryReadError ||\n                error instanceof PrincipalHistoryRecoveryRaceError ||\n                (error instanceof KeyingVerificationError &&\n                  error.code === \"missing_dependency\")\n              )\n                throw new ProjectionDependencyUnavailableError(error.message);\n              throw error;\n            }\n          }),\n      ),\n    );\n}\n"]}

package/workflows/principals/runtimePolicyWarmer.js

@@ -1,4 +1,5 @@
 import { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
+import { createRuntimePrincipalPolicyResolver, } from "./runtimePolicyRecovery.js";
 export function createRuntimePrincipalPolicyWarmer(runtime) {
     const policyInput = ({ organizationId, references, stillCurrent, }) => {
         const input = {
@@ -24,6 +25,9 @@ export function createRuntimePrincipalPolicyWarmer(runtime) {
         resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
         stillCurrent: input.stillCurrent,
     });
-    return Object.assign(warmer, { cacheBundles });
+    return Object.assign(warmer, {
+        cacheBundles,
+        resolveReference: createRuntimePrincipalPolicyResolver(runtime),
+    });
 }
 //# sourceMappingURL=runtimePolicyWarmer.js.map

package/workflows/principals/runtimePolicyWarmer.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AAiBvB,MAAM,UAAU,kCAAkC,CAChD,OAAmC;IAEnC,MAAM,WAAW,GAAG,CAAC,EACnB,cAAc,EACd,UAAU,EACV,YAAY,GACmC,EAAE,EAAE;QACnD,MAAM,KAAK,GAA2D;YACpE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;YACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;YACrB,cAAc;YACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAC3D,UAAU;YACV,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,YAAY;SACb,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAClB,KAAqD,EACrD,EAAE,CAAC,gCAAgC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,KAAwC,EAAE,EAAE,CAChE,2BAA2B,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type {\n  PrincipalPolicyBundleCacheRequest,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\n\ninterface PrincipalPolicyWarmRuntime {\n  readonly apiClient: {\n    getCurrentPrincipalPolicy(\n      principalType: \"group\" | \"organization\",\n      principalId: string,\n    ): Promise<PrincipalPolicyBundleResponse | null>;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n): ReferencedPrincipalPolicyWarmer {\n  const policyInput = ({\n    organizationId,\n    references,\n    stillCurrent,\n  }: Parameters<ReferencedPrincipalPolicyWarmer>[0]) => {\n    const input: Parameters<typeof cacheReferencedPrincipalPolicies>[0] = {\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      references,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent,\n    };\n    return input;\n  };\n  const warmer = async (\n    input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n  ) => cacheReferencedPrincipalPolicies(policyInput(input));\n  const cacheBundles = (input: PrincipalPolicyBundleCacheRequest) =>\n    cachePrincipalPolicyBundles({\n      bundles: input.bundles,\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId: input.organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent: input.stillCurrent,\n    });\n  return Object.assign(warmer, { cacheBundles });\n}\n"]}
+{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oCAAoC,GAErC,MAAM,yBAAyB,CAAC;AAiBjC,MAAM,UAAU,kCAAkC,CAChD,OAAmC;IAEnC,MAAM,WAAW,GAAG,CAAC,EACnB,cAAc,EACd,UAAU,EACV,YAAY,GACmC,EAAE,EAAE;QACnD,MAAM,KAAK,GAA2D;YACpE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;YACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;YACrB,cAAc;YACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAC3D,UAAU;YACV,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,YAAY;SACb,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAClB,KAAqD,EACrD,EAAE,CAAC,gCAAgC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,KAAwC,EAAE,EAAE,CAChE,2BAA2B,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,YAAY;QACZ,gBAAgB,EAAE,oCAAoC,CAAC,OAAO,CAAC;KAChE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type {\n  PrincipalPolicyBundleCacheRequest,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nimport {\n  createRuntimePrincipalPolicyResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"./runtimePolicyRecovery\";\n\ninterface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] & {\n    getCurrentPrincipalPolicy(\n      principalType: \"group\" | \"organization\",\n      principalId: string,\n    ): Promise<PrincipalPolicyBundleResponse | null>;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n): ReferencedPrincipalPolicyWarmer {\n  const policyInput = ({\n    organizationId,\n    references,\n    stillCurrent,\n  }: Parameters<ReferencedPrincipalPolicyWarmer>[0]) => {\n    const input: Parameters<typeof cacheReferencedPrincipalPolicies>[0] = {\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      references,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent,\n    };\n    return input;\n  };\n  const warmer = async (\n    input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n  ) => cacheReferencedPrincipalPolicies(policyInput(input));\n  const cacheBundles = (input: PrincipalPolicyBundleCacheRequest) =>\n    cachePrincipalPolicyBundles({\n      bundles: input.bundles,\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId: input.organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent: input.stillCurrent,\n    });\n  return Object.assign(warmer, {\n    cacheBundles,\n    resolveReference: createRuntimePrincipalPolicyResolver(runtime),\n  });\n}\n"]}

package/workflows/sync/remoteResetPrincipalScope.js

@@ -1,4 +1,5 @@
 import { and, eq, or } from "drizzle-orm";
+import { principalHistoryEntries, principalHistoryNodes, principalHistoryPrefixes, } from "../../data/sqlite/principalHistoryEvidenceSchema.js";
 import { principalHistoryStages } from "../../data/sqlite/principalHistoryStageSchema.js";
 import { principalPolicies, principalPolicyBundleHistory, principalPolicyBundleReferences, principalPolicyCheckpoints, principalPolicyOrganizations, } from "../../data/sqlite/schema.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
@@ -68,6 +69,15 @@ export async function loadRemoteResetPrincipalScope(tx, organizationId) {
 // Trust checkpoints and their ownership survive reset. Clearing cached bundles
 // must not turn a previously observed principal or object into first sight.
 export async function clearRemoteResetPrincipalRows(input) {
+    for (const table of [
+        principalHistoryEntries,
+        principalHistoryNodes,
+        principalHistoryPrefixes,
+    ])
+        await input.tx
+            .delete(table)
+            .where(eq(table.organizationId, input.organizationId))
+            .run();
     await input.tx
         .delete(principalHistoryStages)
         .where(eq(principalHistoryStages.organizationId, input.organizationId))

package/workflows/sync/remoteResetPrincipalScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"remoteResetPrincipalScope.js","sourceRoot":"","sources":["remoteResetPrincipalScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAY1D,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAgC,EAChC,cAAsB;IAKtB,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClE,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,iBAAiB,CAAC,WAAW;YACjC,IAAI,EAAE,iBAAiB,CAAC,aAAa;SACtC,CAAC;aACD,IAAI,CAAC,iBAAiB,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT;YACE,4BAA4B;YAC5B,+BAA+B;YAC/B,0BAA0B;SAC3B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,EAAE;aACC,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC,CACf,CACF;QACD,EAAE;aACC,MAAM,CAAC;YACN,cAAc,EAAE,4BAA4B,CAAC,cAAc;YAC3D,WAAW,EAAE,4BAA4B,CAAC,WAAW;YACrD,aAAa,EAAE,4BAA4B,CAAC,aAAa;SAC1D,CAAC;aACD,IAAI,CAAC,4BAA4B,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACzB,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE;QAC1C,GAAG,CAAC,cAAc;KACnB,CAAC,CACH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,IACE,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,GAAG,CAAC,EAAE,EAChB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,iBAAiB,cAAc,EAAE,EAAE;QAC1C,WAAW,EAAE,cAAc;QAC3B,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,KAAK,cAAc;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE;YACnD,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,sBAAsB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SACtE,GAAG,EAAE,CAAC;IACT,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,aAAa,CAC7B,EAAE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI;YAClB,iBAAiB;YACjB,4BAA4B;YAC5B,+BAA+B;SACvB,EAAE,CAAC;YACX,MAAM,KAAK,CAAC,EAAE;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CACJ,EAAE,CACA,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EAChD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAC7C,CACF,CACF,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { and, eq, or } from \"drizzle-orm\";\nimport { principalHistoryStages } from \"../../data/sqlite/principalHistoryStageSchema\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyBundleReferences,\n  principalPolicyCheckpoints,\n  principalPolicyOrganizations,\n} from \"../../data/sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\n\nexport interface RemoteResetPrincipalKey {\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n}\n\ninterface PrincipalRow {\n  readonly id: string;\n  readonly type: string;\n}\n\n/** Current cache writes atomically pin ownership; reset never backfills it. */\nexport async function loadRemoteResetPrincipalScope(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<{\n  readonly policyRows: readonly PrincipalRow[];\n  readonly principalKeys: readonly RemoteResetPrincipalKey[];\n}> {\n  const [policyRows, retainedRows, ownershipRows] = await Promise.all([\n    tx\n      .select({\n        id: principalPolicies.principalId,\n        type: principalPolicies.principalType,\n      })\n      .from(principalPolicies),\n    Promise.all(\n      [\n        principalPolicyBundleHistory,\n        principalPolicyBundleReferences,\n        principalPolicyCheckpoints,\n      ].map((table) =>\n        tx\n          .selectDistinct({ id: table.principalId, type: table.principalType })\n          .from(table),\n      ),\n    ),\n    tx\n      .select({\n        organizationId: principalPolicyOrganizations.organizationId,\n        principalId: principalPolicyOrganizations.principalId,\n        principalType: principalPolicyOrganizations.principalType,\n      })\n      .from(principalPolicyOrganizations),\n  ]);\n  const owners = new Map(\n    ownershipRows.map((row) => [\n      `${row.principalType}\\0${row.principalId}`,\n      row.organizationId,\n    ]),\n  );\n  for (const row of [...policyRows, ...retainedRows.flat()]) {\n    const owner = owners.get(`${row.type}\\0${row.id}`);\n    if (row.type === \"group\" && !owner) {\n      throw new Error(\n        \"Unowned group policy cache requires a local database reset before organization purge\",\n      );\n    }\n    if (row.type !== \"group\" && row.type !== \"organization\") {\n      throw new Error(\"Principal policy cache has an invalid principal type\");\n    }\n    if (\n      row.type === \"organization\" &&\n      owner !== undefined &&\n      owner !== row.id\n    ) {\n      throw new Error(\n        \"Organization policy cache ownership does not match its identity\",\n      );\n    }\n  }\n  const keys = new Map<string, RemoteResetPrincipalKey>();\n  keys.set(`organization\\0${organizationId}`, {\n    principalId: organizationId,\n    principalType: \"organization\",\n  });\n  for (const row of ownershipRows) {\n    if (row.principalType !== \"group\" && row.principalType !== \"organization\") {\n      throw new Error(\n        \"Principal policy cache ownership has an invalid principal type\",\n      );\n    }\n    if (!row.organizationId) {\n      throw new Error(\n        \"Principal policy cache ownership requires a local database reset\",\n      );\n    }\n    if (row.organizationId !== organizationId) continue;\n    keys.set(`${row.principalType}\\0${row.principalId}`, {\n      principalId: row.principalId,\n      principalType: row.principalType,\n    });\n  }\n  return { policyRows, principalKeys: [...keys.values()] };\n}\n\n// Trust checkpoints and their ownership survive reset. Clearing cached bundles\n// must not turn a previously observed principal or object into first sight.\nexport async function clearRemoteResetPrincipalRows(input: {\n  organizationId: string;\n  snapshot: { principalKeys: readonly RemoteResetPrincipalKey[] };\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(principalHistoryStages)\n    .where(eq(principalHistoryStages.organizationId, input.organizationId))\n    .run();\n  for (const principalBatch of remoteResetBatches(\n    input.snapshot.principalKeys,\n  )) {\n    for (const table of [\n      principalPolicies,\n      principalPolicyBundleHistory,\n      principalPolicyBundleReferences,\n    ] as const) {\n      await input.tx\n        .delete(table)\n        .where(\n          or(\n            ...principalBatch.map((principal) =>\n              and(\n                eq(table.principalType, principal.principalType),\n                eq(table.principalId, principal.principalId),\n              ),\n            ),\n          ),\n        )\n        .run();\n    }\n  }\n}\n"]}
+{"version":3,"file":"remoteResetPrincipalScope.js","sourceRoot":"","sources":["remoteResetPrincipalScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAY1D,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAgC,EAChC,cAAsB;IAKtB,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClE,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,iBAAiB,CAAC,WAAW;YACjC,IAAI,EAAE,iBAAiB,CAAC,aAAa;SACtC,CAAC;aACD,IAAI,CAAC,iBAAiB,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT;YACE,4BAA4B;YAC5B,+BAA+B;YAC/B,0BAA0B;SAC3B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,EAAE;aACC,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC,CACf,CACF;QACD,EAAE;aACC,MAAM,CAAC;YACN,cAAc,EAAE,4BAA4B,CAAC,cAAc;YAC3D,WAAW,EAAE,4BAA4B,CAAC,WAAW;YACrD,aAAa,EAAE,4BAA4B,CAAC,aAAa;SAC1D,CAAC;aACD,IAAI,CAAC,4BAA4B,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACzB,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE;QAC1C,GAAG,CAAC,cAAc;KACnB,CAAC,CACH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,IACE,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,GAAG,CAAC,EAAE,EAChB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,iBAAiB,cAAc,EAAE,EAAE;QAC1C,WAAW,EAAE,cAAc;QAC3B,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,KAAK,cAAc;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE;YACnD,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,KAAK,MAAM,KAAK,IAAI;QAClB,uBAAuB;QACvB,qBAAqB;QACrB,wBAAwB;KACzB;QACC,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;aACrD,GAAG,EAAE,CAAC;IACX,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,sBAAsB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SACtE,GAAG,EAAE,CAAC;IACT,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,aAAa,CAC7B,EAAE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI;YAClB,iBAAiB;YACjB,4BAA4B;YAC5B,+BAA+B;SACvB,EAAE,CAAC;YACX,MAAM,KAAK,CAAC,EAAE;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CACJ,EAAE,CACA,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EAChD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAC7C,CACF,CACF,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { and, eq, or } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryNodes,\n  principalHistoryPrefixes,\n} from \"../../data/sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../../data/sqlite/principalHistoryStageSchema\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyBundleReferences,\n  principalPolicyCheckpoints,\n  principalPolicyOrganizations,\n} from \"../../data/sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\n\nexport interface RemoteResetPrincipalKey {\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n}\n\ninterface PrincipalRow {\n  readonly id: string;\n  readonly type: string;\n}\n\n/** Current cache writes atomically pin ownership; reset never backfills it. */\nexport async function loadRemoteResetPrincipalScope(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<{\n  readonly policyRows: readonly PrincipalRow[];\n  readonly principalKeys: readonly RemoteResetPrincipalKey[];\n}> {\n  const [policyRows, retainedRows, ownershipRows] = await Promise.all([\n    tx\n      .select({\n        id: principalPolicies.principalId,\n        type: principalPolicies.principalType,\n      })\n      .from(principalPolicies),\n    Promise.all(\n      [\n        principalPolicyBundleHistory,\n        principalPolicyBundleReferences,\n        principalPolicyCheckpoints,\n      ].map((table) =>\n        tx\n          .selectDistinct({ id: table.principalId, type: table.principalType })\n          .from(table),\n      ),\n    ),\n    tx\n      .select({\n        organizationId: principalPolicyOrganizations.organizationId,\n        principalId: principalPolicyOrganizations.principalId,\n        principalType: principalPolicyOrganizations.principalType,\n      })\n      .from(principalPolicyOrganizations),\n  ]);\n  const owners = new Map(\n    ownershipRows.map((row) => [\n      `${row.principalType}\\0${row.principalId}`,\n      row.organizationId,\n    ]),\n  );\n  for (const row of [...policyRows, ...retainedRows.flat()]) {\n    const owner = owners.get(`${row.type}\\0${row.id}`);\n    if (row.type === \"group\" && !owner) {\n      throw new Error(\n        \"Unowned group policy cache requires a local database reset before organization purge\",\n      );\n    }\n    if (row.type !== \"group\" && row.type !== \"organization\") {\n      throw new Error(\"Principal policy cache has an invalid principal type\");\n    }\n    if (\n      row.type === \"organization\" &&\n      owner !== undefined &&\n      owner !== row.id\n    ) {\n      throw new Error(\n        \"Organization policy cache ownership does not match its identity\",\n      );\n    }\n  }\n  const keys = new Map<string, RemoteResetPrincipalKey>();\n  keys.set(`organization\\0${organizationId}`, {\n    principalId: organizationId,\n    principalType: \"organization\",\n  });\n  for (const row of ownershipRows) {\n    if (row.principalType !== \"group\" && row.principalType !== \"organization\") {\n      throw new Error(\n        \"Principal policy cache ownership has an invalid principal type\",\n      );\n    }\n    if (!row.organizationId) {\n      throw new Error(\n        \"Principal policy cache ownership requires a local database reset\",\n      );\n    }\n    if (row.organizationId !== organizationId) continue;\n    keys.set(`${row.principalType}\\0${row.principalId}`, {\n      principalId: row.principalId,\n      principalType: row.principalType,\n    });\n  }\n  return { policyRows, principalKeys: [...keys.values()] };\n}\n\n// Trust checkpoints and their ownership survive reset. Clearing cached bundles\n// must not turn a previously observed principal or object into first sight.\nexport async function clearRemoteResetPrincipalRows(input: {\n  organizationId: string;\n  snapshot: { principalKeys: readonly RemoteResetPrincipalKey[] };\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const table of [\n    principalHistoryEntries,\n    principalHistoryNodes,\n    principalHistoryPrefixes,\n  ])\n    await input.tx\n      .delete(table)\n      .where(eq(table.organizationId, input.organizationId))\n      .run();\n  await input.tx\n    .delete(principalHistoryStages)\n    .where(eq(principalHistoryStages.organizationId, input.organizationId))\n    .run();\n  for (const principalBatch of remoteResetBatches(\n    input.snapshot.principalKeys,\n  )) {\n    for (const table of [\n      principalPolicies,\n      principalPolicyBundleHistory,\n      principalPolicyBundleReferences,\n    ] as const) {\n      await input.tx\n        .delete(table)\n        .where(\n          or(\n            ...principalBatch.map((principal) =>\n              and(\n                eq(table.principalType, principal.principalType),\n                eq(table.principalId, principal.principalId),\n              ),\n            ),\n          ),\n        )\n        .run();\n    }\n  }\n}\n"]}