@tearleads/client-sdk 0.1.11 → 0.1.13

package/data/principals/principalPolicyCrypto.js

@@ -1,6 +1,6 @@
 import { unwrapDek } from "../../internal/crypto/index.js";
 import { base64ToBytes } from "../../internal/encoding/index.js";
-import { loadAllPrincipalPolicyBundles } from "../persistence/principalPolicyPersistence.js";
+import { loadPrincipalKeyEnvelopeCandidates, } from "../persistence/principalKeyEnvelopeCandidates.js";
 function toKeyEnvelopeEntries(envelopes) {
     return envelopes.map((envelope) => ({
         keyFingerprint: envelope.keyFingerprint,
@@ -18,8 +18,8 @@ function toMemberEnvelopeEntries(envelopes) {
 function principalBundleKey(bundle) {
     return `${bundle.principalType}:${bundle.principalId}`;
 }
-async function createPrincipalPolicyResolutionContext(execSql) {
-    const bundles = await loadAllPrincipalPolicyBundles(execSql);
+async function createPrincipalPolicyResolutionContext(execSql, fingerprints) {
+    const bundles = await loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints);
     const bundlesByKeyFingerprint = new Map();
     for (const bundle of bundles) {
         const matchingBundles = bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];
@@ -28,21 +28,13 @@ async function createPrincipalPolicyResolutionContext(execSql) {
     }
     return {
         bundlesByKeyFingerprint,
-        resolvedPrincipalSecretKeys: new Map(),
     };
 }
-async function unwrapPrincipalSecretKey(bundle, secretKey, context) {
+async function unwrapPrincipalSecretKey(bundle, secretKey) {
     const principalKey = principalBundleKey(bundle.currentState);
-    const policyEpochKey = `${principalKey}:${bundle.currentState.stateHash}`;
-    const cachedSecretKey = context.resolvedPrincipalSecretKeys.get(policyEpochKey) ?? null;
-    if (cachedSecretKey) {
-        return cachedSecretKey;
-    }
     const memberEnvelopeEntries = toMemberEnvelopeEntries(bundle.currentMemberEnvelopes.envelopes);
     try {
-        const resolvedSecretKey = await unwrapDek(memberEnvelopeEntries, secretKey);
-        context.resolvedPrincipalSecretKeys.set(policyEpochKey, resolvedSecretKey);
-        return resolvedSecretKey;
+        return await unwrapDek(memberEnvelopeEntries, secretKey);
     }
     catch {
         // No transitive fallback: a principal's envelopes are all addressed to
@@ -61,18 +53,16 @@ export async function unwrapKeyEnvelopesWithPrincipalPolicies(input) {
             throw new Error("No matching key envelope entry found for this secret key and no principal policy cache is available");
         }
     }
-    const context = await createPrincipalPolicyResolutionContext(input.execSql);
-    const attemptedPrincipalKeys = new Set();
+    const context = await createPrincipalPolicyResolutionContext(input.execSql, input.envelopes.map((envelope) => envelope.keyFingerprint));
+    const attemptedFingerprints = new Set();
     for (const envelope of input.envelopes) {
+        if (attemptedFingerprints.has(envelope.keyFingerprint))
+            continue;
+        attemptedFingerprints.add(envelope.keyFingerprint);
         const candidateBundles = context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];
         for (const bundle of candidateBundles) {
-            const principalKey = principalBundleKey(bundle.currentState);
-            if (attemptedPrincipalKeys.has(principalKey)) {
-                continue;
-            }
-            attemptedPrincipalKeys.add(principalKey);
             try {
-                const principalSecretKey = await unwrapPrincipalSecretKey(bundle, input.secretKey, context);
+                const principalSecretKey = await unwrapPrincipalSecretKey(bundle, input.secretKey);
                 return await unwrapDek(keyEntries, principalSecretKey);
             }
             catch { }

package/data/principals/principalPolicyCrypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyCrypto.js","sourceRoot":"","sources":["principalPolicyCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAW1F,SAAS,oBAAoB,CAC3B,SAA+C;IAE/C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CACzB,MAGC;IAED,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,eAAe,GACnB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,uBAAuB,CAAC,GAAG,CACzB,MAAM,CAAC,YAAY,CAAC,cAAc,EAClC,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,uBAAuB;QACvB,2BAA2B,EAAE,IAAI,GAAG,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqC,EACrC,SAAqB,EACrB,OAAyC;IAEzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;IAC1E,MAAM,eAAe,GACnB,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IAElE,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,qBAAqB,GAAG,uBAAuB,CACnD,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,MAAM,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;QAC3E,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,2EAA2E;QAC3E,mBAAmB;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,gBAAgB,GACpB,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAErE,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAE7D,IAAI,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAEzC,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CACvD,MAAM,EACN,KAAK,CAAC,SAAS,EACf,OAAO,CACR,CAAC;gBAEF,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;AACJ,CAAC","sourcesContent":["import { type RecipientEntry, unwrapDek } from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport type {\n  PrincipalMemberEnvelopeResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { SerializedKeyEnvelope } from \"@tearleads/validators/util\";\nimport { loadAllPrincipalPolicyBundles } from \"../persistence/principalPolicyPersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\ninterface PrincipalPolicyResolutionContext {\n  bundlesByKeyFingerprint: ReadonlyMap<\n    string,\n    ReadonlyArray<PrincipalPolicyBundleResponse>\n  >;\n  resolvedPrincipalSecretKeys: Map<string, Uint8Array>;\n}\n\nfunction toKeyEnvelopeEntries(\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.keyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction toMemberEnvelopeEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction principalBundleKey(\n  bundle: Pick<\n    PrincipalPolicyBundleResponse[\"currentState\"],\n    \"principalType\" | \"principalId\"\n  >,\n): string {\n  return `${bundle.principalType}:${bundle.principalId}`;\n}\n\nasync function createPrincipalPolicyResolutionContext(\n  execSql: ExecSql,\n): Promise<PrincipalPolicyResolutionContext> {\n  const bundles = await loadAllPrincipalPolicyBundles(execSql);\n  const bundlesByKeyFingerprint = new Map<\n    string,\n    PrincipalPolicyBundleResponse[]\n  >();\n\n  for (const bundle of bundles) {\n    const matchingBundles =\n      bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];\n    matchingBundles.push(bundle);\n    bundlesByKeyFingerprint.set(\n      bundle.currentState.keyFingerprint,\n      matchingBundles,\n    );\n  }\n\n  return {\n    bundlesByKeyFingerprint,\n    resolvedPrincipalSecretKeys: new Map(),\n  };\n}\n\nasync function unwrapPrincipalSecretKey(\n  bundle: PrincipalPolicyBundleResponse,\n  secretKey: Uint8Array,\n  context: PrincipalPolicyResolutionContext,\n): Promise<Uint8Array> {\n  const principalKey = principalBundleKey(bundle.currentState);\n  const policyEpochKey = `${principalKey}:${bundle.currentState.stateHash}`;\n  const cachedSecretKey =\n    context.resolvedPrincipalSecretKeys.get(policyEpochKey) ?? null;\n\n  if (cachedSecretKey) {\n    return cachedSecretKey;\n  }\n\n  const memberEnvelopeEntries = toMemberEnvelopeEntries(\n    bundle.currentMemberEnvelopes.envelopes,\n  );\n\n  try {\n    const resolvedSecretKey = await unwrapDek(memberEnvelopeEntries, secretKey);\n    context.resolvedPrincipalSecretKeys.set(policyEpochKey, resolvedSecretKey);\n    return resolvedSecretKey;\n  } catch {\n    // No transitive fallback: a principal's envelopes are all addressed to\n    // users directly, so if this identity key opens none of them the requester\n    // is not a member.\n  }\n\n  throw new Error(`No matching principal member envelope for ${principalKey}`);\n}\n\nexport async function unwrapKeyEnvelopesWithPrincipalPolicies(input: {\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n}): Promise<Uint8Array> {\n  const keyEntries = toKeyEnvelopeEntries(input.envelopes);\n\n  try {\n    return await unwrapDek(keyEntries, input.secretKey);\n  } catch {\n    if (!input.execSql) {\n      throw new Error(\n        \"No matching key envelope entry found for this secret key and no principal policy cache is available\",\n      );\n    }\n  }\n\n  const context = await createPrincipalPolicyResolutionContext(input.execSql);\n  const attemptedPrincipalKeys = new Set<string>();\n\n  for (const envelope of input.envelopes) {\n    const candidateBundles =\n      context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];\n\n    for (const bundle of candidateBundles) {\n      const principalKey = principalBundleKey(bundle.currentState);\n\n      if (attemptedPrincipalKeys.has(principalKey)) {\n        continue;\n      }\n\n      attemptedPrincipalKeys.add(principalKey);\n\n      try {\n        const principalSecretKey = await unwrapPrincipalSecretKey(\n          bundle,\n          input.secretKey,\n          context,\n        );\n\n        return await unwrapDek(keyEntries, principalSecretKey);\n      } catch {}\n    }\n  }\n\n  throw new Error(\n    \"No matching key envelope entry found for this secret key or cached principal policies\",\n  );\n}\n"]}
+{"version":3,"file":"principalPolicyCrypto.js","sourceRoot":"","sources":["principalPolicyCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EACL,kCAAkC,GAEnC,MAAM,+CAA+C,CAAC;AAUvD,SAAS,oBAAoB,CAC3B,SAA+C;IAE/C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CACzB,MAGC;IAED,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,kCAAkC,CACtD,OAAO,EACP,YAAY,CACb,CAAC;IACF,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,eAAe,GACnB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,uBAAuB,CAAC,GAAG,CACzB,MAAM,CAAC,YAAY,CAAC,cAAc,EAClC,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqC,EACrC,SAAqB;IAErB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CACnD,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,2EAA2E;QAC3E,mBAAmB;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC3D,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QACjE,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,gBAAgB,GACpB,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAErE,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CACvD,MAAM,EACN,KAAK,CAAC,SAAS,CAChB,CAAC;gBAEF,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;AACJ,CAAC","sourcesContent":["import { type RecipientEntry, unwrapDek } from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport type { PrincipalMemberEnvelopeResponse } from \"@tearleads/validators/response\";\nimport type { SerializedKeyEnvelope } from \"@tearleads/validators/util\";\nimport {\n  loadPrincipalKeyEnvelopeCandidates,\n  type PrincipalKeyEnvelopeCandidate,\n} from \"../persistence/principalKeyEnvelopeCandidates\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\ninterface PrincipalPolicyResolutionContext {\n  bundlesByKeyFingerprint: ReadonlyMap<\n    string,\n    ReadonlyArray<PrincipalKeyEnvelopeCandidate>\n  >;\n}\n\nfunction toKeyEnvelopeEntries(\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.keyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction toMemberEnvelopeEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction principalBundleKey(\n  bundle: Pick<\n    PrincipalKeyEnvelopeCandidate[\"currentState\"],\n    \"principalType\" | \"principalId\"\n  >,\n): string {\n  return `${bundle.principalType}:${bundle.principalId}`;\n}\n\nasync function createPrincipalPolicyResolutionContext(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalPolicyResolutionContext> {\n  const bundles = await loadPrincipalKeyEnvelopeCandidates(\n    execSql,\n    fingerprints,\n  );\n  const bundlesByKeyFingerprint = new Map<\n    string,\n    PrincipalKeyEnvelopeCandidate[]\n  >();\n\n  for (const bundle of bundles) {\n    const matchingBundles =\n      bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];\n    matchingBundles.push(bundle);\n    bundlesByKeyFingerprint.set(\n      bundle.currentState.keyFingerprint,\n      matchingBundles,\n    );\n  }\n\n  return {\n    bundlesByKeyFingerprint,\n  };\n}\n\nasync function unwrapPrincipalSecretKey(\n  bundle: PrincipalKeyEnvelopeCandidate,\n  secretKey: Uint8Array,\n): Promise<Uint8Array> {\n  const principalKey = principalBundleKey(bundle.currentState);\n  const memberEnvelopeEntries = toMemberEnvelopeEntries(\n    bundle.currentMemberEnvelopes.envelopes,\n  );\n\n  try {\n    return await unwrapDek(memberEnvelopeEntries, secretKey);\n  } catch {\n    // No transitive fallback: a principal's envelopes are all addressed to\n    // users directly, so if this identity key opens none of them the requester\n    // is not a member.\n  }\n\n  throw new Error(`No matching principal member envelope for ${principalKey}`);\n}\n\nexport async function unwrapKeyEnvelopesWithPrincipalPolicies(input: {\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n}): Promise<Uint8Array> {\n  const keyEntries = toKeyEnvelopeEntries(input.envelopes);\n\n  try {\n    return await unwrapDek(keyEntries, input.secretKey);\n  } catch {\n    if (!input.execSql) {\n      throw new Error(\n        \"No matching key envelope entry found for this secret key and no principal policy cache is available\",\n      );\n    }\n  }\n\n  const context = await createPrincipalPolicyResolutionContext(\n    input.execSql,\n    input.envelopes.map((envelope) => envelope.keyFingerprint),\n  );\n  const attemptedFingerprints = new Set<string>();\n\n  for (const envelope of input.envelopes) {\n    if (attemptedFingerprints.has(envelope.keyFingerprint)) continue;\n    attemptedFingerprints.add(envelope.keyFingerprint);\n    const candidateBundles =\n      context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];\n\n    for (const bundle of candidateBundles) {\n      try {\n        const principalSecretKey = await unwrapPrincipalSecretKey(\n          bundle,\n          input.secretKey,\n        );\n\n        return await unwrapDek(keyEntries, principalSecretKey);\n      } catch {}\n    }\n  }\n\n  throw new Error(\n    \"No matching key envelope entry found for this secret key or cached principal policies\",\n  );\n}\n"]}

package/data/principals/principalPolicyEvidence.d.ts

@@ -0,0 +1,4 @@
+import type { AnyVerifiedPrincipalPolicy, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+export type PrincipalPolicyCurrentEvidence = VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
+export type PrincipalPolicyCheckpointEvidence = AnyVerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
+export declare function principalPolicyEvidenceEntries(policy: PrincipalPolicyCheckpointEvidence): NonNullable<VerifiedPrincipalPolicy["history"]>;

package/data/principals/principalPolicyEvidence.js

@@ -0,0 +1,12 @@
+export function principalPolicyEvidenceEntries(policy) {
+    return "retainedHistory" in policy
+        ? policy.retainedHistory
+        : (policy.history ?? [
+            {
+                state: policy.state,
+                projection: policy.projection,
+                grants: policy.grants,
+            },
+        ]);
+}
+//# sourceMappingURL=principalPolicyEvidence.js.map

package/data/principals/principalPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyEvidence.js","sourceRoot":"","sources":["principalPolicyEvidence.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,8BAA8B,CAC5C,MAAyC;IAEzC,OAAO,iBAAiB,IAAI,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI;YACjB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type {\n  AnyVerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalPolicyCurrentEvidence =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\nexport type PrincipalPolicyCheckpointEvidence =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nexport function principalPolicyEvidenceEntries(\n  policy: PrincipalPolicyCheckpointEvidence,\n): NonNullable<VerifiedPrincipalPolicy[\"history\"]> {\n  return \"retainedHistory\" in policy\n    ? policy.retainedHistory\n    : (policy.history ?? [\n        {\n          state: policy.state,\n          projection: policy.projection,\n          grants: policy.grants,\n        },\n      ]);\n}\n"]}

package/data/sqlite/principalHistoryEvidenceSchema.js

@@ -0,0 +1,46 @@
+import { desc } from "drizzle-orm";
+import { index, integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqlite-core";
+import { principalCurrentFingerprintJson } from "./principalKeyFingerprintJson.js";
+import { defineSqlTableSchema } from "./sqlTableSchema.js";
+/** A completed, locally authenticated prefix; never an application trust pin. */
+export const principalHistoryPrefixes = sqliteTable("principal_history_prefixes", {
+    scopeId: text("scope_id").primaryKey(),
+    organizationId: text("organization_id").notNull(),
+    version: integer("version").notNull(),
+    headJson: text("head_json").notNull(),
+    currentJson: text("current_json").notNull(),
+    progress: text("progress").notNull(),
+}, (table) => [
+    index("principal_history_prefixes_key_fingerprint_idx").on(principalCurrentFingerprintJson(table.currentJson), desc(table.version)),
+    index("principal_history_prefixes_organization_idx").on(table.organizationId),
+]);
+/** Entries are selected by their exact signed leaf, including signature bytes. */
+export const principalHistoryEntries = sqliteTable("principal_history_entries", {
+    scopeId: text("scope_id").notNull(),
+    organizationId: text("organization_id").notNull(),
+    leafHash: text("leaf_hash").notNull(),
+    entryJson: text("entry_json").notNull(),
+}, (table) => [
+    primaryKey({ columns: [table.scopeId, table.leafHash] }),
+    index("principal_history_entries_organization_idx").on(table.organizationId),
+]);
+/** Untrusted proof material, checked against a locally restored private root. */
+export const principalHistoryNodes = sqliteTable("principal_history_nodes", {
+    scopeId: text("scope_id").notNull(),
+    organizationId: text("organization_id").notNull(),
+    hash: text("hash").notNull(),
+    leftHash: text("left_hash").notNull(),
+    rightHash: text("right_hash").notNull(),
+}, (table) => [
+    primaryKey({ columns: [table.scopeId, table.hash] }),
+    index("principal_history_nodes_organization_idx").on(table.organizationId),
+]);
+export const principalHistoryEvidenceTables = [
+    {
+        ...defineSqlTableSchema(principalHistoryPrefixes),
+        requiredColumns: ["current_json"],
+    },
+    defineSqlTableSchema(principalHistoryEntries),
+    defineSqlTableSchema(principalHistoryNodes),
+];
+//# sourceMappingURL=principalHistoryEvidenceSchema.js.map

package/data/sqlite/principalHistoryEvidenceSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryEvidenceSchema.js","sourceRoot":"","sources":["principalHistoryEvidenceSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CACjD,4BAA4B,EAC5B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE;IACtC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,gDAAgD,CAAC,CAAC,EAAE,CACxD,+BAA+B,CAAC,KAAK,CAAC,WAAW,CAAC,EAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CACpB;IACD,KAAK,CAAC,6CAA6C,CAAC,CAAC,EAAE,CACrD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAChD,2BAA2B,EAC3B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,KAAK,CAAC,4CAA4C,CAAC,CAAC,EAAE,CACpD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAC9C,yBAAyB,EACzB;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,KAAK,CAAC,0CAA0C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC3E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C;QACE,GAAG,oBAAoB,CAAC,wBAAwB,CAAC;QACjD,eAAe,EAAE,CAAC,cAAc,CAAC;KAClC;IACD,oBAAoB,CAAC,uBAAuB,CAAC;IAC7C,oBAAoB,CAAC,qBAAqB,CAAC;CAC5C,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport {\n  index,\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\nimport { principalCurrentFingerprintJson } from \"./principalKeyFingerprintJson\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** A completed, locally authenticated prefix; never an application trust pin. */\nexport const principalHistoryPrefixes = sqliteTable(\n  \"principal_history_prefixes\",\n  {\n    scopeId: text(\"scope_id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    headJson: text(\"head_json\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_prefixes_key_fingerprint_idx\").on(\n      principalCurrentFingerprintJson(table.currentJson),\n      desc(table.version),\n    ),\n    index(\"principal_history_prefixes_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\n/** Entries are selected by their exact signed leaf, including signature bytes. */\nexport const principalHistoryEntries = sqliteTable(\n  \"principal_history_entries\",\n  {\n    scopeId: text(\"scope_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n    leafHash: text(\"leaf_hash\").notNull(),\n    entryJson: text(\"entry_json\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.scopeId, table.leafHash] }),\n    index(\"principal_history_entries_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\n/** Untrusted proof material, checked against a locally restored private root. */\nexport const principalHistoryNodes = sqliteTable(\n  \"principal_history_nodes\",\n  {\n    scopeId: text(\"scope_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n    hash: text(\"hash\").notNull(),\n    leftHash: text(\"left_hash\").notNull(),\n    rightHash: text(\"right_hash\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.scopeId, table.hash] }),\n    index(\"principal_history_nodes_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryEvidenceTables = [\n  {\n    ...defineSqlTableSchema(principalHistoryPrefixes),\n    requiredColumns: [\"current_json\"],\n  },\n  defineSqlTableSchema(principalHistoryEntries),\n  defineSqlTableSchema(principalHistoryNodes),\n];\n"]}

package/data/sqlite/principalKeyFingerprintJson.js

@@ -0,0 +1,9 @@
+import { sql } from "drizzle-orm";
+/** Match the candidate query to its expression index, including corrupt caches. */
+export function principalStateFingerprintJson(column) {
+    return sql `json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.keyFingerprint')`;
+}
+export function principalCurrentFingerprintJson(column) {
+    return sql `json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.currentState.keyFingerprint')`;
+}
+//# sourceMappingURL=principalKeyFingerprintJson.js.map

package/data/sqlite/principalKeyFingerprintJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalKeyFingerprintJson.js","sourceRoot":"","sources":["principalKeyFingerprintJson.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnD,mFAAmF;AACnF,MAAM,UAAU,6BAA6B,CAAC,MAAkB;IAC9D,OAAO,GAAG,CAAQ,qCAAqC,MAAM,UAAU,MAAM,2BAA2B,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAkB;IAChE,OAAO,GAAG,CAAQ,qCAAqC,MAAM,UAAU,MAAM,wCAAwC,CAAC;AACxH,CAAC","sourcesContent":["import { type SQLWrapper, sql } from \"drizzle-orm\";\n\n/** Match the candidate query to its expression index, including corrupt caches. */\nexport function principalStateFingerprintJson(column: SQLWrapper) {\n  return sql<string>`json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.keyFingerprint')`;\n}\n\nexport function principalCurrentFingerprintJson(column: SQLWrapper) {\n  return sql<string>`json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.currentState.keyFingerprint')`;\n}\n"]}

package/data/sqlite/principalPolicySchema.js

@@ -1,4 +1,6 @@
+import { desc } from "drizzle-orm";
 import { index, integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqlite-core";
+import { principalStateFingerprintJson } from "./principalKeyFingerprintJson.js";
 /** Durable organization ownership for every managed-principal cache. */
 export const principalPolicyOrganizations = sqliteTable("principal_policy_organizations", {
     principalType: text("principal_type").notNull(),
@@ -25,12 +27,14 @@ function principalPolicyBundleColumns() {
 /** Latest full policy bundle per managed principal. */
 export const principalPolicies = sqliteTable("principal_policies", principalPolicyBundleColumns(), (table) => [
     primaryKey({ columns: [table.principalType, table.principalId] }),
+    index("principal_policies_key_fingerprint_idx").on(principalStateFingerprintJson(table.currentStateJson), desc(table.updatedAt)),
 ]);
 /** Older verified bundles retained for exact-reference verification and epoch key unwrapping. */
 export const principalPolicyBundleHistory = sqliteTable("principal_policy_bundle_history", principalPolicyBundleColumns(), (table) => [
     primaryKey({
         columns: [table.principalType, table.principalId, table.stateHash],
     }),
+    index("principal_policy_history_key_fingerprint_idx").on(principalStateFingerprintJson(table.currentStateJson), desc(table.updatedAt)),
 ]);
 /** Exact policy states mapped to every retained bundle chain that contains them. */
 export const principalPolicyBundleReferences = sqliteTable("principal_policy_bundle_references", {

package/data/sqlite/principalPolicySchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicySchema.js","sourceRoot":"","sources":["principalPolicySchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,gCAAgC,EAChC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;CAClD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACjE,KAAK,CAAC,iDAAiD,CAAC,CAAC,EAAE,CACzD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,SAAS,4BAA4B;IACnC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;QAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;QACtD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;QAChE,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE;QACxD,0BAA0B,EAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC,OAAO,EAAE;QAC3E,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAC1C,oBAAoB,EACpB,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,iCAAiC,EACjC,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;KACnE,CAAC;CACH,CACF,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;CACrD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,eAAe;SACtB;KACF,CAAC;CACH,CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC","sourcesContent":["import {\n  index,\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\n\n/** Durable organization ownership for every managed-principal cache. */\nexport const principalPolicyOrganizations = sqliteTable(\n  \"principal_policy_organizations\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n    index(\"principal_policy_organizations_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\nfunction principalPolicyBundleColumns() {\n  return {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    currentStateJson: text(\"current_state_json\").notNull(),\n    currentPayloadJson: text(\"current_payload_json\").notNull(),\n    currentProjectionJson: text(\"current_projection_json\").notNull(),\n    currentGrantsJson: text(\"current_grants_json\").notNull(),\n    currentMemberEnvelopesJson: text(\"current_member_envelopes_json\").notNull(),\n    previousStatesJson: text(\"previous_states_json\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  };\n}\n\n/** Latest full policy bundle per managed principal. */\nexport const principalPolicies = sqliteTable(\n  \"principal_policies\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n  ],\n);\n\n/** Older verified bundles retained for exact-reference verification and epoch key unwrapping. */\nexport const principalPolicyBundleHistory = sqliteTable(\n  \"principal_policy_bundle_history\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({\n      columns: [table.principalType, table.principalId, table.stateHash],\n    }),\n  ],\n);\n\n/** Exact policy states mapped to every retained bundle chain that contains them. */\nexport const principalPolicyBundleReferences = sqliteTable(\n  \"principal_policy_bundle_references\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    keyEpoch: integer(\"key_epoch\").notNull(),\n    keyFingerprint: text(\"key_fingerprint\").notNull(),\n    bundleVersion: integer(\"bundle_version\").notNull(),\n    bundleStateHash: text(\"bundle_state_hash\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [\n        table.principalType,\n        table.principalId,\n        table.version,\n        table.stateHash,\n        table.keyEpoch,\n        table.keyFingerprint,\n        table.bundleStateHash,\n      ],\n    }),\n  ],\n);\n\n/** Monotonic anti-rollback pin for each verified managed principal. */\nexport const principalPolicyCheckpoints = sqliteTable(\n  \"principal_policy_checkpoints\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n  ],\n);\n"]}
+{"version":3,"file":"principalPolicySchema.js","sourceRoot":"","sources":["principalPolicySchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,gCAAgC,EAChC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;CAClD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACjE,KAAK,CAAC,iDAAiD,CAAC,CAAC,EAAE,CACzD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,SAAS,4BAA4B;IACnC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;QAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;QACtD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;QAChE,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE;QACxD,0BAA0B,EAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC,OAAO,EAAE;QAC3E,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAC1C,oBAAoB,EACpB,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACjE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAChD,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACtB;CACF,CACF,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,iCAAiC,EACjC,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;KACnE,CAAC;IACF,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,CACtD,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACtB;CACF,CACF,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;CACrD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,eAAe;SACtB;KACF,CAAC;CACH,CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport {\n  index,\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\n\nimport { principalStateFingerprintJson } from \"./principalKeyFingerprintJson\";\n\n/** Durable organization ownership for every managed-principal cache. */\nexport const principalPolicyOrganizations = sqliteTable(\n  \"principal_policy_organizations\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n    index(\"principal_policy_organizations_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\nfunction principalPolicyBundleColumns() {\n  return {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    currentStateJson: text(\"current_state_json\").notNull(),\n    currentPayloadJson: text(\"current_payload_json\").notNull(),\n    currentProjectionJson: text(\"current_projection_json\").notNull(),\n    currentGrantsJson: text(\"current_grants_json\").notNull(),\n    currentMemberEnvelopesJson: text(\"current_member_envelopes_json\").notNull(),\n    previousStatesJson: text(\"previous_states_json\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  };\n}\n\n/** Latest full policy bundle per managed principal. */\nexport const principalPolicies = sqliteTable(\n  \"principal_policies\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n    index(\"principal_policies_key_fingerprint_idx\").on(\n      principalStateFingerprintJson(table.currentStateJson),\n      desc(table.updatedAt),\n    ),\n  ],\n);\n\n/** Older verified bundles retained for exact-reference verification and epoch key unwrapping. */\nexport const principalPolicyBundleHistory = sqliteTable(\n  \"principal_policy_bundle_history\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({\n      columns: [table.principalType, table.principalId, table.stateHash],\n    }),\n    index(\"principal_policy_history_key_fingerprint_idx\").on(\n      principalStateFingerprintJson(table.currentStateJson),\n      desc(table.updatedAt),\n    ),\n  ],\n);\n\n/** Exact policy states mapped to every retained bundle chain that contains them. */\nexport const principalPolicyBundleReferences = sqliteTable(\n  \"principal_policy_bundle_references\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    keyEpoch: integer(\"key_epoch\").notNull(),\n    keyFingerprint: text(\"key_fingerprint\").notNull(),\n    bundleVersion: integer(\"bundle_version\").notNull(),\n    bundleStateHash: text(\"bundle_state_hash\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [\n        table.principalType,\n        table.principalId,\n        table.version,\n        table.stateHash,\n        table.keyEpoch,\n        table.keyFingerprint,\n        table.bundleStateHash,\n      ],\n    }),\n  ],\n);\n\n/** Monotonic anti-rollback pin for each verified managed principal. */\nexport const principalPolicyCheckpoints = sqliteTable(\n  \"principal_policy_checkpoints\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n  ],\n);\n"]}

package/data/sqlite/schema.d.ts

@@ -6510,6 +6510,310 @@ export declare const clientSQLiteSchema: {
         };
         dialect: "sqlite";
     }>;
+    principalHistoryEntries: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+        name: "principal_history_entries";
+        schema: undefined;
+        columns: {
+            scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "scope_id";
+                tableName: "principal_history_entries";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_id";
+                tableName: "principal_history_entries";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            leafHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "leaf_hash";
+                tableName: "principal_history_entries";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            entryJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "entry_json";
+                tableName: "principal_history_entries";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+        };
+        dialect: "sqlite";
+    }>;
+    principalHistoryNodes: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+        name: "principal_history_nodes";
+        schema: undefined;
+        columns: {
+            scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "scope_id";
+                tableName: "principal_history_nodes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_id";
+                tableName: "principal_history_nodes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            hash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "hash";
+                tableName: "principal_history_nodes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            leftHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "left_hash";
+                tableName: "principal_history_nodes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            rightHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "right_hash";
+                tableName: "principal_history_nodes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+        };
+        dialect: "sqlite";
+    }>;
+    principalHistoryPrefixes: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+        name: "principal_history_prefixes";
+        schema: undefined;
+        columns: {
+            scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "scope_id";
+                tableName: "principal_history_prefixes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_id";
+                tableName: "principal_history_prefixes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            version: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "version";
+                tableName: "principal_history_prefixes";
+                dataType: "number";
+                columnType: "SQLiteInteger";
+                data: number;
+                driverParam: number;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            headJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "head_json";
+                tableName: "principal_history_prefixes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            currentJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "current_json";
+                tableName: "principal_history_prefixes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            progress: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "progress";
+                tableName: "principal_history_prefixes";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+        };
+        dialect: "sqlite";
+    }>;
     principalHistoryStages: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
         name: "principal_history_stages";
         schema: undefined;

package/data/sqlite/schema.js

@@ -11,6 +11,7 @@ import { organizationFounders } from "./organizationFounderSchema.js";
 import * as provisioningAttempt from "./organizationProvisioningAttemptSchema.js";
 import { organizationReadModelSQLiteSchema, organizationReadModelTables, } from "./organizationReadModelTableRegistry.js";
 import { principalGrantRetirements } from "./principalGrantRetirementSchema.js";
+import { principalHistoryEntries, principalHistoryEvidenceTables, principalHistoryNodes, principalHistoryPrefixes, } from "./principalHistoryEvidenceSchema.js";
 import { principalHistoryStages, principalHistoryStageTables, } from "./principalHistoryStageSchema.js";
 import { principalPolicies, principalPolicyBundleHistory, principalPolicyBundleReferences, principalPolicyCheckpoints, principalPolicyOrganizations, } from "./principalPolicySchema.js";
 import { securityIncidents, securityIncidentTable, } from "./securityIncidentSchema.js";
@@ -523,6 +524,7 @@ export const principalPolicyTables = [
     defineSqlTableSchema(principalPolicyBundleReferences),
     defineSqlTableSchema(principalPolicyOrganizations),
     ...principalHistoryStageTables,
+    ...principalHistoryEvidenceTables,
 ];
 export const keyingCheckpointTables = [
     defineSqlTableSchema(organizationFounders),
@@ -596,6 +598,9 @@ export const clientSqlTables = [
     ...provisioningAttempt.organizationProvisioningAttemptTables,
 ];
 export const clientSQLiteSchema = {
+    principalHistoryEntries,
+    principalHistoryNodes,
+    principalHistoryPrefixes,
     principalHistoryStages,
     organizationFounders,
     principalGrantRetirements,