@tearleads/client-sdk 0.1.11 → 0.1.14

package/data/persistence/principalHistoryStagePersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryStagePersistence.js","sourceRoot":"","sources":["principalHistoryStagePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAIpE,MAAM,iCAAkC,SAAQ,KAAK;IAC1C,IAAI,GAAG,iCAAiC,CAAC;IAClD;QACE,KAAK,CACH,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgB,EAAE,EAAU;IAC1E,MAAM,eAAe,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC5C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,gBAAgB;YACzD,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAChD,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACrE,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,KAA4B,EAC5B,YAA2B;IAE3B,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAChD,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EACvC,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CACpD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalHistoryStages,\n  principalHistoryStageTables,\n} from \"../sqlite/principalHistoryStageSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalHistoryStage = typeof principalHistoryStages.$inferSelect;\n\nclass PrincipalHistoryStageChangedError extends Error {\n  readonly code = \"principal_history_stage_changed\";\n  constructor() {\n    super(\n      \"Another operation changed the saved principal history; resume from its current state\",\n    );\n    this.name = \"PrincipalHistoryStageChangedError\";\n  }\n}\n\nexport async function loadPrincipalHistoryStage(execSql: ExecSql, id: string) {\n  await ensureSqlTables(execSql, principalHistoryStageTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select()\n    .from(principalHistoryStages)\n    .where(eq(principalHistoryStages.id, id))\n    .limit(1);\n  return row ?? null;\n}\n\n/** The checked evidence lives inside authenticated progress, in the same row. */\nexport async function savePrincipalHistoryStage(input: {\n  readonly execSql: ExecSql;\n  readonly stage: PrincipalHistoryStage;\n  readonly previousProgress: string | null;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const stage = { ...input.stage };\n  await ensureSqlTables(input.execSql, principalHistoryStageTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const saved = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select({ progress: principalHistoryStages.progress })\n        .from(principalHistoryStages)\n        .where(eq(principalHistoryStages.id, stage.id))\n        .limit(1);\n      if ((previous?.progress ?? null) !== input.previousProgress)\n        throw new PrincipalHistoryStageChangedError();\n      await tx\n        .insert(principalHistoryStages)\n        .values(stage)\n        .onConflictDoUpdate({ target: principalHistoryStages.id, set: stage })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => saved.committed);\n}\n\nexport async function discardPrincipalHistoryStage(\n  execSql: ExecSql,\n  stage: PrincipalHistoryStage,\n  stillCurrent: () => boolean,\n) {\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const discarded = await runtime.guardedTransaction(\n    async (db) => {\n      await db\n        .delete(principalHistoryStages)\n        .where(\n          and(\n            eq(principalHistoryStages.id, stage.id),\n            eq(principalHistoryStages.progress, stage.progress),\n          ),\n        )\n        .run();\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => discarded.committed);\n}\n"]}
+{"version":3,"file":"principalHistoryStagePersistence.js","sourceRoot":"","sources":["principalHistoryStagePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAI/C,MAAM,iCAAkC,SAAQ,KAAK;IAC1C,IAAI,GAAG,iCAAiC,CAAC;IAClD;QACE,KAAK,CACH,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgB,EAAE,EAAU;IAC1E,MAAM,eAAe,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,2BAA2B;QAC9B,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC5C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,gBAAgB;YACzD,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAChD,MAAM,iCAAiC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACrE,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,KAA4B,EAC5B,YAA2B;IAE3B,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAChD,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EACvC,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CACpD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport { principalHistoryEvidenceTables } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalHistoryStages,\n  principalHistoryStageTables,\n} from \"../sqlite/principalHistoryStageSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  type PrincipalHistoryEvidencePage,\n  writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\n\nexport type PrincipalHistoryStage = typeof principalHistoryStages.$inferSelect;\n\nclass PrincipalHistoryStageChangedError extends Error {\n  readonly code = \"principal_history_stage_changed\";\n  constructor() {\n    super(\n      \"Another operation changed the saved principal history; resume from its current state\",\n    );\n    this.name = \"PrincipalHistoryStageChangedError\";\n  }\n}\n\nexport async function loadPrincipalHistoryStage(execSql: ExecSql, id: string) {\n  await ensureSqlTables(execSql, principalHistoryStageTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select()\n    .from(principalHistoryStages)\n    .where(eq(principalHistoryStages.id, id))\n    .limit(1);\n  return row ?? null;\n}\n\n/** Publish accepted entries and index nodes atomically with authenticated progress. */\nexport async function savePrincipalHistoryStage(input: {\n  readonly execSql: ExecSql;\n  readonly stage: PrincipalHistoryStage;\n  readonly evidence: PrincipalHistoryEvidencePage;\n  readonly previousProgress: string | null;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const stage = { ...input.stage };\n  const evidence = structuredClone(input.evidence);\n  await ensureSqlTables(input.execSql, [\n    ...principalHistoryStageTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const saved = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select({ progress: principalHistoryStages.progress })\n        .from(principalHistoryStages)\n        .where(eq(principalHistoryStages.id, stage.id))\n        .limit(1);\n      if ((previous?.progress ?? null) !== input.previousProgress)\n        throw new PrincipalHistoryStageChangedError();\n      await writePrincipalHistoryEvidencePage(tx, evidence);\n      await tx\n        .insert(principalHistoryStages)\n        .values(stage)\n        .onConflictDoUpdate({ target: principalHistoryStages.id, set: stage })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => saved.committed);\n}\n\nexport async function discardPrincipalHistoryStage(\n  execSql: ExecSql,\n  stage: PrincipalHistoryStage,\n  stillCurrent: () => boolean,\n) {\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const discarded = await runtime.guardedTransaction(\n    async (db) => {\n      await db\n        .delete(principalHistoryStages)\n        .where(\n          and(\n            eq(principalHistoryStages.id, stage.id),\n            eq(principalHistoryStages.progress, stage.progress),\n          ),\n        )\n        .run();\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => discarded.committed);\n}\n"]}

package/data/persistence/principalKeyEnvelopeCandidates.js

@@ -0,0 +1,67 @@
+import { isCurrentPrincipalMemberEnvelopesResponse, } from "../../internal/validators/response/index.js";
+import { desc, eq, sql } from "drizzle-orm";
+import { principalHistoryEvidenceTables, principalHistoryPrefixes, } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalCurrentFingerprintJson, principalStateFingerprintJson, } from "../sqlite/principalKeyFingerprintJson.js";
+import { principalPolicies, principalPolicyBundleHistory, } from "../sqlite/principalPolicySchema.js";
+import { principalPolicyTables } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+/**
+ * Untrusted encrypted key candidates, never authorization evidence. The actual
+ * private key must open the requested recipient wrap; the projection verifier
+ * separately checks the signed KEK material identity and all policy authority.
+ * Read only envelopes for the requested fingerprints, never signed histories.
+ */
+export async function loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints) {
+    await ensureSqlTables(execSql, [
+        ...principalPolicyTables,
+        ...principalHistoryEvidenceTables,
+    ]);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const candidates = [];
+    for (const fingerprint of new Set(fingerprints)) {
+        const encoded = [];
+        for (const table of [principalPolicies, principalPolicyBundleHistory]) {
+            const [row] = await db
+                .select({ envelopes: table.currentMemberEnvelopesJson })
+                .from(table)
+                .where(eq(principalStateFingerprintJson(table.currentStateJson), fingerprint))
+                .orderBy(desc(table.updatedAt))
+                .limit(1);
+            if (row)
+                encoded.push(row.envelopes);
+        }
+        const [prefix] = await db
+            .select({
+            envelopes: sql `json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,
+        })
+            .from(principalHistoryPrefixes)
+            .where(eq(principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson), fingerprint))
+            .orderBy(desc(principalHistoryPrefixes.version))
+            .limit(1);
+        if (prefix)
+            encoded.push(prefix.envelopes);
+        for (const json of encoded) {
+            let envelopes;
+            try {
+                envelopes = JSON.parse(json);
+            }
+            catch {
+                continue;
+            }
+            if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes))
+                continue;
+            candidates.push({
+                currentState: {
+                    principalType: envelopes.principalType,
+                    principalId: envelopes.principalId,
+                    stateHash: envelopes.stateHash,
+                    keyFingerprint: fingerprint,
+                },
+                currentMemberEnvelopes: envelopes,
+            });
+        }
+    }
+    return candidates;
+}
+//# sourceMappingURL=principalKeyEnvelopeCandidates.js.map

package/data/persistence/principalKeyEnvelopeCandidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}

package/data/principals/principalHistoryPrefixProtection.js

@@ -0,0 +1,29 @@
+import { serializeKeyingCanonicalJson, toFingerprint, } from "../../internal/crypto/index.js";
+// Signed entries and index nodes are content-addressed public evidence. Keep
+// their storage namespace stable across local-key replacement; authenticating a
+// prefix still requires the current private key. An unreadable prefix is discarded
+// and rebuilt from signatures, reusing rows only after checking the new root.
+export async function principalHistoryEvidenceScopeId(input) {
+    return toFingerprint(new TextEncoder().encode(serializeKeyingCanonicalJson([
+        "tearleads.sdk.principal-history-evidence.v2",
+        input.organizationId,
+        input.head.principalType,
+        input.head.principalId,
+        input.protection.context,
+    ])));
+}
+export async function principalHistoryPrefixProtection(protection, prefix) {
+    return {
+        localKey: protection.localKey,
+        context: serializeKeyingCanonicalJson({
+            domain: "tearleads.sdk.principal-history-prefix.v2",
+            context: protection.context,
+            scopeId: prefix.scopeId,
+            organizationId: prefix.organizationId,
+            version: prefix.version,
+            headJson: prefix.headJson,
+            currentDigest: await toFingerprint(new TextEncoder().encode(prefix.currentJson)),
+        }),
+    };
+}
+//# sourceMappingURL=principalHistoryPrefixProtection.js.map

package/data/principals/principalHistoryPrefixProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryPrefixProtection.js","sourceRoot":"","sources":["principalHistoryPrefixProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,6EAA6E;AAC7E,gFAAgF;AAChF,mFAAmF;AACnF,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,6CAA6C;QAC7C,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,IAAI,CAAC,aAAa;QACxB,KAAK,CAAC,IAAI,CAAC,WAAW;QACtB,KAAK,CAAC,UAAU,CAAC,OAAO;KACzB,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAAiD,EACjD,MAAgD;IAEhD,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAC7C;SACF,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalHistoryPrefix } from \"../persistence/principalHistoryPrefixPersistence\";\n\n// Signed entries and index nodes are content-addressed public evidence. Keep\n// their storage namespace stable across local-key replacement; authenticating a\n// prefix still requires the current private key. An unreadable prefix is discarded\n// and rebuilt from signatures, reusing rows only after checking the new root.\nexport async function principalHistoryEvidenceScopeId(input: {\n  readonly organizationId: string;\n  readonly head: Pick<ReferencedPrincipalHead, \"principalType\" | \"principalId\">;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n}): Promise<string> {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-evidence.v2\",\n        input.organizationId,\n        input.head.principalType,\n        input.head.principalId,\n        input.protection.context,\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryPrefixProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  prefix: Omit<PrincipalHistoryPrefix, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-prefix.v2\",\n      context: protection.context,\n      scopeId: prefix.scopeId,\n      organizationId: prefix.organizationId,\n      version: prefix.version,\n      headJson: prefix.headJson,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(prefix.currentJson),\n      ),\n    }),\n  };\n}\n"]}

package/data/principals/principalHistoryProtection.d.ts

@@ -0,0 +1,10 @@
+import { type PrincipalPolicyHistoryProgressOptions } from "../../internal/crypto/index.js";
+export type PrincipalHistoryProtectionLease = <T>(operation: (input: {
+    readonly protection: PrincipalPolicyHistoryProgressOptions;
+    readonly stillCurrent: () => boolean;
+}) => Promise<T>) => Promise<T>;
+/** Own private key bytes before any asynchronous discovery or verification. */
+export declare function ownPrincipalHistoryProtection(protection: PrincipalPolicyHistoryProgressOptions): {
+    context: string;
+    localKey: Uint8Array<ArrayBuffer>;
+};

package/data/principals/principalHistoryProtection.js

@@ -0,0 +1,14 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+/** Own private key bytes before any asynchronous discovery or verification. */
+export function ownPrincipalHistoryProtection(protection) {
+    if (!(protection.localKey instanceof Uint8Array) ||
+        protection.localKey.byteLength !== 32 ||
+        typeof protection.context !== "string" ||
+        protection.context.length === 0)
+        throw new KeyingVerificationError("invalid_shape", "Principal history recovery requires a private 32-byte key and trust context");
+    return {
+        context: protection.context,
+        localKey: new Uint8Array(protection.localKey),
+    };
+}
+//# sourceMappingURL=principalHistoryProtection.js.map

package/data/principals/principalHistoryProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryProtection.js","sourceRoot":"","sources":["principalHistoryProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAS3B,+EAA+E;AAC/E,MAAM,UAAU,6BAA6B,CAC3C,UAAiD;IAEjD,IACE,CAAC,CAAC,UAAU,CAAC,QAAQ,YAAY,UAAU,CAAC;QAC5C,UAAU,CAAC,QAAQ,CAAC,UAAU,KAAK,EAAE;QACrC,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;QACtC,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAE/B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6EAA6E,CAC9E,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,QAAQ,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;KAC9C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryProgressOptions,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalHistoryProtectionLease = <T>(\n  operation: (input: {\n    readonly protection: PrincipalPolicyHistoryProgressOptions;\n    readonly stillCurrent: () => boolean;\n  }) => Promise<T>,\n) => Promise<T>;\n\n/** Own private key bytes before any asynchronous discovery or verification. */\nexport function ownPrincipalHistoryProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n) {\n  if (\n    !(protection.localKey instanceof Uint8Array) ||\n    protection.localKey.byteLength !== 32 ||\n    typeof protection.context !== \"string\" ||\n    protection.context.length === 0\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal history recovery requires a private 32-byte key and trust context\",\n    );\n  return {\n    context: protection.context,\n    localKey: new Uint8Array(protection.localKey),\n  };\n}\n"]}

package/data/principals/principalHistoryStageProtection.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryStageProtection.js","sourceRoot":"","sources":["principalHistoryStageProtection.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAG/E,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,IAA6B,EAC7B,OAAe,EACf,kBAAsD;IAEtD,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,0CAA0C;QAC1C,cAAc;QACd,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc;QACnB,OAAO;QACP,CAAC,GAAG,kBAAkB,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAClB,SAAS,CAAC,aAAa;YACvB,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,OAAO;YACjB,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,SAAS;YACnB,SAAS,CAAC,cAAc;SACzB,CAAC;KACL,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAiD,EACjD,YAAqC,EACrC,KAA8C;IAE9C,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAA4B;IAE5B,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;KAC1E,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO;QAE/C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryStage } from \"../persistence/principalHistoryStagePersistence\";\n\nexport function principalHistoryStageId(\n  organizationId: string,\n  head: ReferencedPrincipalHead,\n  context: string,\n  retainedReferences: readonly ReferencedPrincipalHead[],\n) {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-stage.v1\",\n        organizationId,\n        head.principalType,\n        head.principalId,\n        head.version,\n        head.keyEpoch,\n        head.stateHash,\n        head.keyFingerprint,\n        context,\n        [...retainedReferences]\n          .sort((a, b) => a.version - b.version)\n          .map((reference) => [\n            reference.principalType,\n            reference.principalId,\n            reference.version,\n            reference.keyEpoch,\n            reference.stateHash,\n            reference.keyFingerprint,\n          ]),\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryStageProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  expectedHead: ReferencedPrincipalHead,\n  stage: Omit<PrincipalHistoryStage, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-stage.v1\",\n      context: protection.context,\n      id: stage.id,\n      organizationId: stage.organizationId,\n      expectedHead: { ...expectedHead },\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(stage.currentJson),\n      ),\n    }),\n  };\n}\n\nexport function parsePrincipalHistoryStageCurrent(\n  stage: PrincipalHistoryStage,\n): PrincipalPolicyPageCurrent | null {\n  let current: unknown;\n  try {\n    current = JSON.parse(stage.currentJson);\n  } catch {\n    return null;\n  }\n  if (!current || typeof current !== \"object\" || Array.isArray(current))\n    return null;\n  const page = {\n    ...current,\n    previousStates: [],\n    historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },\n  };\n  if (\n    !isPrincipalPolicyPageResponse(page) ||\n    stage.afterVersion >= page.currentState.version\n  )\n    return null;\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n"]}
+{"version":3,"file":"principalHistoryStageProtection.js","sourceRoot":"","sources":["principalHistoryStageProtection.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAG/E,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,IAA6B,EAC7B,OAAe,EACf,kBAAsD;IAEtD,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,0CAA0C;QAC1C,cAAc;QACd,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc;QACnB,OAAO;QACP,CAAC,GAAG,kBAAkB,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAClB,SAAS,CAAC,aAAa;YACvB,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,OAAO;YACjB,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,SAAS;YACnB,SAAS,CAAC,cAAc;SACzB,CAAC;KACL,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAiD,EACjD,YAAqC,EACrC,KAA8C;IAE9C,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAkE;IAElE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;KAC1E,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO;QAE/C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryStage } from \"../persistence/principalHistoryStagePersistence\";\n\nexport function principalHistoryStageId(\n  organizationId: string,\n  head: ReferencedPrincipalHead,\n  context: string,\n  retainedReferences: readonly ReferencedPrincipalHead[],\n) {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-stage.v1\",\n        organizationId,\n        head.principalType,\n        head.principalId,\n        head.version,\n        head.keyEpoch,\n        head.stateHash,\n        head.keyFingerprint,\n        context,\n        [...retainedReferences]\n          .sort((a, b) => a.version - b.version)\n          .map((reference) => [\n            reference.principalType,\n            reference.principalId,\n            reference.version,\n            reference.keyEpoch,\n            reference.stateHash,\n            reference.keyFingerprint,\n          ]),\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryStageProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  expectedHead: ReferencedPrincipalHead,\n  stage: Omit<PrincipalHistoryStage, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-stage.v1\",\n      context: protection.context,\n      id: stage.id,\n      organizationId: stage.organizationId,\n      expectedHead: { ...expectedHead },\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(stage.currentJson),\n      ),\n    }),\n  };\n}\n\nexport function parsePrincipalHistoryStageCurrent(\n  stage: Pick<PrincipalHistoryStage, \"currentJson\" | \"afterVersion\">,\n): PrincipalPolicyPageCurrent | null {\n  let current: unknown;\n  try {\n    current = JSON.parse(stage.currentJson);\n  } catch {\n    return null;\n  }\n  if (!current || typeof current !== \"object\" || Array.isArray(current))\n    return null;\n  const page = {\n    ...current,\n    previousStates: [],\n    historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },\n  };\n  if (\n    !isPrincipalPolicyPageResponse(page) ||\n    stage.afterVersion >= page.currentState.version\n  )\n    return null;\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n"]}

package/data/principals/principalPolicyCrypto.js

@@ -1,6 +1,6 @@
 import { unwrapDek } from "../../internal/crypto/index.js";
 import { base64ToBytes } from "../../internal/encoding/index.js";
-import { loadAllPrincipalPolicyBundles } from "../persistence/principalPolicyPersistence.js";
+import { loadPrincipalKeyEnvelopeCandidates, } from "../persistence/principalKeyEnvelopeCandidates.js";
 function toKeyEnvelopeEntries(envelopes) {
     return envelopes.map((envelope) => ({
         keyFingerprint: envelope.keyFingerprint,
@@ -18,8 +18,8 @@ function toMemberEnvelopeEntries(envelopes) {
 function principalBundleKey(bundle) {
     return `${bundle.principalType}:${bundle.principalId}`;
 }
-async function createPrincipalPolicyResolutionContext(execSql) {
-    const bundles = await loadAllPrincipalPolicyBundles(execSql);
+async function createPrincipalPolicyResolutionContext(execSql, fingerprints) {
+    const bundles = await loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints);
     const bundlesByKeyFingerprint = new Map();
     for (const bundle of bundles) {
         const matchingBundles = bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];
@@ -28,21 +28,13 @@ async function createPrincipalPolicyResolutionContext(execSql) {
     }
     return {
         bundlesByKeyFingerprint,
-        resolvedPrincipalSecretKeys: new Map(),
     };
 }
-async function unwrapPrincipalSecretKey(bundle, secretKey, context) {
+async function unwrapPrincipalSecretKey(bundle, secretKey) {
     const principalKey = principalBundleKey(bundle.currentState);
-    const policyEpochKey = `${principalKey}:${bundle.currentState.stateHash}`;
-    const cachedSecretKey = context.resolvedPrincipalSecretKeys.get(policyEpochKey) ?? null;
-    if (cachedSecretKey) {
-        return cachedSecretKey;
-    }
     const memberEnvelopeEntries = toMemberEnvelopeEntries(bundle.currentMemberEnvelopes.envelopes);
     try {
-        const resolvedSecretKey = await unwrapDek(memberEnvelopeEntries, secretKey);
-        context.resolvedPrincipalSecretKeys.set(policyEpochKey, resolvedSecretKey);
-        return resolvedSecretKey;
+        return await unwrapDek(memberEnvelopeEntries, secretKey);
     }
     catch {
         // No transitive fallback: a principal's envelopes are all addressed to
@@ -61,18 +53,16 @@ export async function unwrapKeyEnvelopesWithPrincipalPolicies(input) {
             throw new Error("No matching key envelope entry found for this secret key and no principal policy cache is available");
         }
     }
-    const context = await createPrincipalPolicyResolutionContext(input.execSql);
-    const attemptedPrincipalKeys = new Set();
+    const context = await createPrincipalPolicyResolutionContext(input.execSql, input.envelopes.map((envelope) => envelope.keyFingerprint));
+    const attemptedFingerprints = new Set();
     for (const envelope of input.envelopes) {
+        if (attemptedFingerprints.has(envelope.keyFingerprint))
+            continue;
+        attemptedFingerprints.add(envelope.keyFingerprint);
         const candidateBundles = context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];
         for (const bundle of candidateBundles) {
-            const principalKey = principalBundleKey(bundle.currentState);
-            if (attemptedPrincipalKeys.has(principalKey)) {
-                continue;
-            }
-            attemptedPrincipalKeys.add(principalKey);
             try {
-                const principalSecretKey = await unwrapPrincipalSecretKey(bundle, input.secretKey, context);
+                const principalSecretKey = await unwrapPrincipalSecretKey(bundle, input.secretKey);
                 return await unwrapDek(keyEntries, principalSecretKey);
             }
             catch { }

package/data/principals/principalPolicyCrypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyCrypto.js","sourceRoot":"","sources":["principalPolicyCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAW1F,SAAS,oBAAoB,CAC3B,SAA+C;IAE/C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CACzB,MAGC;IAED,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,eAAe,GACnB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,uBAAuB,CAAC,GAAG,CACzB,MAAM,CAAC,YAAY,CAAC,cAAc,EAClC,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,uBAAuB;QACvB,2BAA2B,EAAE,IAAI,GAAG,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqC,EACrC,SAAqB,EACrB,OAAyC;IAEzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;IAC1E,MAAM,eAAe,GACnB,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IAElE,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,qBAAqB,GAAG,uBAAuB,CACnD,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,MAAM,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;QAC3E,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,2EAA2E;QAC3E,mBAAmB;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,gBAAgB,GACpB,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAErE,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAE7D,IAAI,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAEzC,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CACvD,MAAM,EACN,KAAK,CAAC,SAAS,EACf,OAAO,CACR,CAAC;gBAEF,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;AACJ,CAAC","sourcesContent":["import { type RecipientEntry, unwrapDek } from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport type {\n  PrincipalMemberEnvelopeResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { SerializedKeyEnvelope } from \"@tearleads/validators/util\";\nimport { loadAllPrincipalPolicyBundles } from \"../persistence/principalPolicyPersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\ninterface PrincipalPolicyResolutionContext {\n  bundlesByKeyFingerprint: ReadonlyMap<\n    string,\n    ReadonlyArray<PrincipalPolicyBundleResponse>\n  >;\n  resolvedPrincipalSecretKeys: Map<string, Uint8Array>;\n}\n\nfunction toKeyEnvelopeEntries(\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.keyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction toMemberEnvelopeEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction principalBundleKey(\n  bundle: Pick<\n    PrincipalPolicyBundleResponse[\"currentState\"],\n    \"principalType\" | \"principalId\"\n  >,\n): string {\n  return `${bundle.principalType}:${bundle.principalId}`;\n}\n\nasync function createPrincipalPolicyResolutionContext(\n  execSql: ExecSql,\n): Promise<PrincipalPolicyResolutionContext> {\n  const bundles = await loadAllPrincipalPolicyBundles(execSql);\n  const bundlesByKeyFingerprint = new Map<\n    string,\n    PrincipalPolicyBundleResponse[]\n  >();\n\n  for (const bundle of bundles) {\n    const matchingBundles =\n      bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];\n    matchingBundles.push(bundle);\n    bundlesByKeyFingerprint.set(\n      bundle.currentState.keyFingerprint,\n      matchingBundles,\n    );\n  }\n\n  return {\n    bundlesByKeyFingerprint,\n    resolvedPrincipalSecretKeys: new Map(),\n  };\n}\n\nasync function unwrapPrincipalSecretKey(\n  bundle: PrincipalPolicyBundleResponse,\n  secretKey: Uint8Array,\n  context: PrincipalPolicyResolutionContext,\n): Promise<Uint8Array> {\n  const principalKey = principalBundleKey(bundle.currentState);\n  const policyEpochKey = `${principalKey}:${bundle.currentState.stateHash}`;\n  const cachedSecretKey =\n    context.resolvedPrincipalSecretKeys.get(policyEpochKey) ?? null;\n\n  if (cachedSecretKey) {\n    return cachedSecretKey;\n  }\n\n  const memberEnvelopeEntries = toMemberEnvelopeEntries(\n    bundle.currentMemberEnvelopes.envelopes,\n  );\n\n  try {\n    const resolvedSecretKey = await unwrapDek(memberEnvelopeEntries, secretKey);\n    context.resolvedPrincipalSecretKeys.set(policyEpochKey, resolvedSecretKey);\n    return resolvedSecretKey;\n  } catch {\n    // No transitive fallback: a principal's envelopes are all addressed to\n    // users directly, so if this identity key opens none of them the requester\n    // is not a member.\n  }\n\n  throw new Error(`No matching principal member envelope for ${principalKey}`);\n}\n\nexport async function unwrapKeyEnvelopesWithPrincipalPolicies(input: {\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n}): Promise<Uint8Array> {\n  const keyEntries = toKeyEnvelopeEntries(input.envelopes);\n\n  try {\n    return await unwrapDek(keyEntries, input.secretKey);\n  } catch {\n    if (!input.execSql) {\n      throw new Error(\n        \"No matching key envelope entry found for this secret key and no principal policy cache is available\",\n      );\n    }\n  }\n\n  const context = await createPrincipalPolicyResolutionContext(input.execSql);\n  const attemptedPrincipalKeys = new Set<string>();\n\n  for (const envelope of input.envelopes) {\n    const candidateBundles =\n      context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];\n\n    for (const bundle of candidateBundles) {\n      const principalKey = principalBundleKey(bundle.currentState);\n\n      if (attemptedPrincipalKeys.has(principalKey)) {\n        continue;\n      }\n\n      attemptedPrincipalKeys.add(principalKey);\n\n      try {\n        const principalSecretKey = await unwrapPrincipalSecretKey(\n          bundle,\n          input.secretKey,\n          context,\n        );\n\n        return await unwrapDek(keyEntries, principalSecretKey);\n      } catch {}\n    }\n  }\n\n  throw new Error(\n    \"No matching key envelope entry found for this secret key or cached principal policies\",\n  );\n}\n"]}
+{"version":3,"file":"principalPolicyCrypto.js","sourceRoot":"","sources":["principalPolicyCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EACL,kCAAkC,GAEnC,MAAM,+CAA+C,CAAC;AAUvD,SAAS,oBAAoB,CAC3B,SAA+C;IAE/C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CACzB,MAGC;IAED,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,kCAAkC,CACtD,OAAO,EACP,YAAY,CACb,CAAC;IACF,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,eAAe,GACnB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,uBAAuB,CAAC,GAAG,CACzB,MAAM,CAAC,YAAY,CAAC,cAAc,EAClC,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqC,EACrC,SAAqB;IAErB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CACnD,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,2EAA2E;QAC3E,mBAAmB;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC3D,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QACjE,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,gBAAgB,GACpB,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAErE,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CACvD,MAAM,EACN,KAAK,CAAC,SAAS,CAChB,CAAC;gBAEF,OAAO,MAAM,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;AACJ,CAAC","sourcesContent":["import { type RecipientEntry, unwrapDek } from \"@tearleads/crypto\";\nimport { base64ToBytes } from \"@tearleads/encoding\";\nimport type { PrincipalMemberEnvelopeResponse } from \"@tearleads/validators/response\";\nimport type { SerializedKeyEnvelope } from \"@tearleads/validators/util\";\nimport {\n  loadPrincipalKeyEnvelopeCandidates,\n  type PrincipalKeyEnvelopeCandidate,\n} from \"../persistence/principalKeyEnvelopeCandidates\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\n\ninterface PrincipalPolicyResolutionContext {\n  bundlesByKeyFingerprint: ReadonlyMap<\n    string,\n    ReadonlyArray<PrincipalKeyEnvelopeCandidate>\n  >;\n}\n\nfunction toKeyEnvelopeEntries(\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.keyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction toMemberEnvelopeEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n): RecipientEntry[] {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\nfunction principalBundleKey(\n  bundle: Pick<\n    PrincipalKeyEnvelopeCandidate[\"currentState\"],\n    \"principalType\" | \"principalId\"\n  >,\n): string {\n  return `${bundle.principalType}:${bundle.principalId}`;\n}\n\nasync function createPrincipalPolicyResolutionContext(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalPolicyResolutionContext> {\n  const bundles = await loadPrincipalKeyEnvelopeCandidates(\n    execSql,\n    fingerprints,\n  );\n  const bundlesByKeyFingerprint = new Map<\n    string,\n    PrincipalKeyEnvelopeCandidate[]\n  >();\n\n  for (const bundle of bundles) {\n    const matchingBundles =\n      bundlesByKeyFingerprint.get(bundle.currentState.keyFingerprint) ?? [];\n    matchingBundles.push(bundle);\n    bundlesByKeyFingerprint.set(\n      bundle.currentState.keyFingerprint,\n      matchingBundles,\n    );\n  }\n\n  return {\n    bundlesByKeyFingerprint,\n  };\n}\n\nasync function unwrapPrincipalSecretKey(\n  bundle: PrincipalKeyEnvelopeCandidate,\n  secretKey: Uint8Array,\n): Promise<Uint8Array> {\n  const principalKey = principalBundleKey(bundle.currentState);\n  const memberEnvelopeEntries = toMemberEnvelopeEntries(\n    bundle.currentMemberEnvelopes.envelopes,\n  );\n\n  try {\n    return await unwrapDek(memberEnvelopeEntries, secretKey);\n  } catch {\n    // No transitive fallback: a principal's envelopes are all addressed to\n    // users directly, so if this identity key opens none of them the requester\n    // is not a member.\n  }\n\n  throw new Error(`No matching principal member envelope for ${principalKey}`);\n}\n\nexport async function unwrapKeyEnvelopesWithPrincipalPolicies(input: {\n  envelopes: ReadonlyArray<SerializedKeyEnvelope>;\n  execSql?: ExecSql | undefined;\n  secretKey: Uint8Array;\n}): Promise<Uint8Array> {\n  const keyEntries = toKeyEnvelopeEntries(input.envelopes);\n\n  try {\n    return await unwrapDek(keyEntries, input.secretKey);\n  } catch {\n    if (!input.execSql) {\n      throw new Error(\n        \"No matching key envelope entry found for this secret key and no principal policy cache is available\",\n      );\n    }\n  }\n\n  const context = await createPrincipalPolicyResolutionContext(\n    input.execSql,\n    input.envelopes.map((envelope) => envelope.keyFingerprint),\n  );\n  const attemptedFingerprints = new Set<string>();\n\n  for (const envelope of input.envelopes) {\n    if (attemptedFingerprints.has(envelope.keyFingerprint)) continue;\n    attemptedFingerprints.add(envelope.keyFingerprint);\n    const candidateBundles =\n      context.bundlesByKeyFingerprint.get(envelope.keyFingerprint) ?? [];\n\n    for (const bundle of candidateBundles) {\n      try {\n        const principalSecretKey = await unwrapPrincipalSecretKey(\n          bundle,\n          input.secretKey,\n        );\n\n        return await unwrapDek(keyEntries, principalSecretKey);\n      } catch {}\n    }\n  }\n\n  throw new Error(\n    \"No matching key envelope entry found for this secret key or cached principal policies\",\n  );\n}\n"]}

package/data/principals/principalPolicyEvidence.d.ts

@@ -0,0 +1,4 @@
+import type { AnyVerifiedPrincipalPolicy, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+export type PrincipalPolicyCurrentEvidence = VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
+export type PrincipalPolicyCheckpointEvidence = AnyVerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
+export declare function principalPolicyEvidenceEntries(policy: PrincipalPolicyCheckpointEvidence): NonNullable<VerifiedPrincipalPolicy["history"]>;

package/data/principals/principalPolicyEvidence.js

@@ -0,0 +1,12 @@
+export function principalPolicyEvidenceEntries(policy) {
+    return "retainedHistory" in policy
+        ? policy.retainedHistory
+        : (policy.history ?? [
+            {
+                state: policy.state,
+                projection: policy.projection,
+                grants: policy.grants,
+            },
+        ]);
+}
+//# sourceMappingURL=principalPolicyEvidence.js.map

package/data/principals/principalPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyEvidence.js","sourceRoot":"","sources":["principalPolicyEvidence.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,8BAA8B,CAC5C,MAAyC;IAEzC,OAAO,iBAAiB,IAAI,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI;YACjB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type {\n  AnyVerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalPolicyCurrentEvidence =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\nexport type PrincipalPolicyCheckpointEvidence =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nexport function principalPolicyEvidenceEntries(\n  policy: PrincipalPolicyCheckpointEvidence,\n): NonNullable<VerifiedPrincipalPolicy[\"history\"]> {\n  return \"retainedHistory\" in policy\n    ? policy.retainedHistory\n    : (policy.history ?? [\n        {\n          state: policy.state,\n          projection: policy.projection,\n          grants: policy.grants,\n        },\n      ]);\n}\n"]}

package/data/sqlite/principalHistoryEvidenceSchema.js

@@ -0,0 +1,46 @@
+import { desc } from "drizzle-orm";
+import { index, integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqlite-core";
+import { principalCurrentFingerprintJson } from "./principalKeyFingerprintJson.js";
+import { defineSqlTableSchema } from "./sqlTableSchema.js";
+/** A completed, locally authenticated prefix; never an application trust pin. */
+export const principalHistoryPrefixes = sqliteTable("principal_history_prefixes", {
+    scopeId: text("scope_id").primaryKey(),
+    organizationId: text("organization_id").notNull(),
+    version: integer("version").notNull(),
+    headJson: text("head_json").notNull(),
+    currentJson: text("current_json").notNull(),
+    progress: text("progress").notNull(),
+}, (table) => [
+    index("principal_history_prefixes_key_fingerprint_idx").on(principalCurrentFingerprintJson(table.currentJson), desc(table.version)),
+    index("principal_history_prefixes_organization_idx").on(table.organizationId),
+]);
+/** Entries are selected by their exact signed leaf, including signature bytes. */
+export const principalHistoryEntries = sqliteTable("principal_history_entries", {
+    scopeId: text("scope_id").notNull(),
+    organizationId: text("organization_id").notNull(),
+    leafHash: text("leaf_hash").notNull(),
+    entryJson: text("entry_json").notNull(),
+}, (table) => [
+    primaryKey({ columns: [table.scopeId, table.leafHash] }),
+    index("principal_history_entries_organization_idx").on(table.organizationId),
+]);
+/** Untrusted proof material, checked against a locally restored private root. */
+export const principalHistoryNodes = sqliteTable("principal_history_nodes", {
+    scopeId: text("scope_id").notNull(),
+    organizationId: text("organization_id").notNull(),
+    hash: text("hash").notNull(),
+    leftHash: text("left_hash").notNull(),
+    rightHash: text("right_hash").notNull(),
+}, (table) => [
+    primaryKey({ columns: [table.scopeId, table.hash] }),
+    index("principal_history_nodes_organization_idx").on(table.organizationId),
+]);
+export const principalHistoryEvidenceTables = [
+    {
+        ...defineSqlTableSchema(principalHistoryPrefixes),
+        requiredColumns: ["current_json"],
+    },
+    defineSqlTableSchema(principalHistoryEntries),
+    defineSqlTableSchema(principalHistoryNodes),
+];
+//# sourceMappingURL=principalHistoryEvidenceSchema.js.map

package/data/sqlite/principalHistoryEvidenceSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryEvidenceSchema.js","sourceRoot":"","sources":["principalHistoryEvidenceSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CACjD,4BAA4B,EAC5B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE;IACtC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,gDAAgD,CAAC,CAAC,EAAE,CACxD,+BAA+B,CAAC,KAAK,CAAC,WAAW,CAAC,EAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CACpB;IACD,KAAK,CAAC,6CAA6C,CAAC,CAAC,EAAE,CACrD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAChD,2BAA2B,EAC3B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,KAAK,CAAC,4CAA4C,CAAC,CAAC,EAAE,CACpD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAC9C,yBAAyB,EACzB;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,KAAK,CAAC,0CAA0C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC3E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C;QACE,GAAG,oBAAoB,CAAC,wBAAwB,CAAC;QACjD,eAAe,EAAE,CAAC,cAAc,CAAC;KAClC;IACD,oBAAoB,CAAC,uBAAuB,CAAC;IAC7C,oBAAoB,CAAC,qBAAqB,CAAC;CAC5C,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport {\n  index,\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\nimport { principalCurrentFingerprintJson } from \"./principalKeyFingerprintJson\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** A completed, locally authenticated prefix; never an application trust pin. */\nexport const principalHistoryPrefixes = sqliteTable(\n  \"principal_history_prefixes\",\n  {\n    scopeId: text(\"scope_id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    headJson: text(\"head_json\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_prefixes_key_fingerprint_idx\").on(\n      principalCurrentFingerprintJson(table.currentJson),\n      desc(table.version),\n    ),\n    index(\"principal_history_prefixes_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\n/** Entries are selected by their exact signed leaf, including signature bytes. */\nexport const principalHistoryEntries = sqliteTable(\n  \"principal_history_entries\",\n  {\n    scopeId: text(\"scope_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n    leafHash: text(\"leaf_hash\").notNull(),\n    entryJson: text(\"entry_json\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.scopeId, table.leafHash] }),\n    index(\"principal_history_entries_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\n/** Untrusted proof material, checked against a locally restored private root. */\nexport const principalHistoryNodes = sqliteTable(\n  \"principal_history_nodes\",\n  {\n    scopeId: text(\"scope_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n    hash: text(\"hash\").notNull(),\n    leftHash: text(\"left_hash\").notNull(),\n    rightHash: text(\"right_hash\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.scopeId, table.hash] }),\n    index(\"principal_history_nodes_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryEvidenceTables = [\n  {\n    ...defineSqlTableSchema(principalHistoryPrefixes),\n    requiredColumns: [\"current_json\"],\n  },\n  defineSqlTableSchema(principalHistoryEntries),\n  defineSqlTableSchema(principalHistoryNodes),\n];\n"]}

package/data/sqlite/principalKeyFingerprintJson.js

@@ -0,0 +1,9 @@
+import { sql } from "drizzle-orm";
+/** Match the candidate query to its expression index, including corrupt caches. */
+export function principalStateFingerprintJson(column) {
+    return sql `json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.keyFingerprint')`;
+}
+export function principalCurrentFingerprintJson(column) {
+    return sql `json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.currentState.keyFingerprint')`;
+}
+//# sourceMappingURL=principalKeyFingerprintJson.js.map

package/data/sqlite/principalKeyFingerprintJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalKeyFingerprintJson.js","sourceRoot":"","sources":["principalKeyFingerprintJson.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnD,mFAAmF;AACnF,MAAM,UAAU,6BAA6B,CAAC,MAAkB;IAC9D,OAAO,GAAG,CAAQ,qCAAqC,MAAM,UAAU,MAAM,2BAA2B,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAkB;IAChE,OAAO,GAAG,CAAQ,qCAAqC,MAAM,UAAU,MAAM,wCAAwC,CAAC;AACxH,CAAC","sourcesContent":["import { type SQLWrapper, sql } from \"drizzle-orm\";\n\n/** Match the candidate query to its expression index, including corrupt caches. */\nexport function principalStateFingerprintJson(column: SQLWrapper) {\n  return sql<string>`json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.keyFingerprint')`;\n}\n\nexport function principalCurrentFingerprintJson(column: SQLWrapper) {\n  return sql<string>`json_extract(CASE WHEN json_valid(${column}) THEN ${column} END, '$.currentState.keyFingerprint')`;\n}\n"]}

package/data/sqlite/principalPolicySchema.js

@@ -1,4 +1,6 @@
+import { desc } from "drizzle-orm";
 import { index, integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqlite-core";
+import { principalStateFingerprintJson } from "./principalKeyFingerprintJson.js";
 /** Durable organization ownership for every managed-principal cache. */
 export const principalPolicyOrganizations = sqliteTable("principal_policy_organizations", {
     principalType: text("principal_type").notNull(),
@@ -25,12 +27,14 @@ function principalPolicyBundleColumns() {
 /** Latest full policy bundle per managed principal. */
 export const principalPolicies = sqliteTable("principal_policies", principalPolicyBundleColumns(), (table) => [
     primaryKey({ columns: [table.principalType, table.principalId] }),
+    index("principal_policies_key_fingerprint_idx").on(principalStateFingerprintJson(table.currentStateJson), desc(table.updatedAt)),
 ]);
 /** Older verified bundles retained for exact-reference verification and epoch key unwrapping. */
 export const principalPolicyBundleHistory = sqliteTable("principal_policy_bundle_history", principalPolicyBundleColumns(), (table) => [
     primaryKey({
         columns: [table.principalType, table.principalId, table.stateHash],
     }),
+    index("principal_policy_history_key_fingerprint_idx").on(principalStateFingerprintJson(table.currentStateJson), desc(table.updatedAt)),
 ]);
 /** Exact policy states mapped to every retained bundle chain that contains them. */
 export const principalPolicyBundleReferences = sqliteTable("principal_policy_bundle_references", {

package/data/sqlite/principalPolicySchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicySchema.js","sourceRoot":"","sources":["principalPolicySchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,gCAAgC,EAChC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;CAClD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACjE,KAAK,CAAC,iDAAiD,CAAC,CAAC,EAAE,CACzD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,SAAS,4BAA4B;IACnC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;QAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;QACtD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;QAChE,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE;QACxD,0BAA0B,EAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC,OAAO,EAAE;QAC3E,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAC1C,oBAAoB,EACpB,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,iCAAiC,EACjC,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;KACnE,CAAC;CACH,CACF,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;CACrD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,eAAe;SACtB;KACF,CAAC;CACH,CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC","sourcesContent":["import {\n  index,\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\n\n/** Durable organization ownership for every managed-principal cache. */\nexport const principalPolicyOrganizations = sqliteTable(\n  \"principal_policy_organizations\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n    index(\"principal_policy_organizations_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\nfunction principalPolicyBundleColumns() {\n  return {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    currentStateJson: text(\"current_state_json\").notNull(),\n    currentPayloadJson: text(\"current_payload_json\").notNull(),\n    currentProjectionJson: text(\"current_projection_json\").notNull(),\n    currentGrantsJson: text(\"current_grants_json\").notNull(),\n    currentMemberEnvelopesJson: text(\"current_member_envelopes_json\").notNull(),\n    previousStatesJson: text(\"previous_states_json\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  };\n}\n\n/** Latest full policy bundle per managed principal. */\nexport const principalPolicies = sqliteTable(\n  \"principal_policies\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n  ],\n);\n\n/** Older verified bundles retained for exact-reference verification and epoch key unwrapping. */\nexport const principalPolicyBundleHistory = sqliteTable(\n  \"principal_policy_bundle_history\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({\n      columns: [table.principalType, table.principalId, table.stateHash],\n    }),\n  ],\n);\n\n/** Exact policy states mapped to every retained bundle chain that contains them. */\nexport const principalPolicyBundleReferences = sqliteTable(\n  \"principal_policy_bundle_references\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    keyEpoch: integer(\"key_epoch\").notNull(),\n    keyFingerprint: text(\"key_fingerprint\").notNull(),\n    bundleVersion: integer(\"bundle_version\").notNull(),\n    bundleStateHash: text(\"bundle_state_hash\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [\n        table.principalType,\n        table.principalId,\n        table.version,\n        table.stateHash,\n        table.keyEpoch,\n        table.keyFingerprint,\n        table.bundleStateHash,\n      ],\n    }),\n  ],\n);\n\n/** Monotonic anti-rollback pin for each verified managed principal. */\nexport const principalPolicyCheckpoints = sqliteTable(\n  \"principal_policy_checkpoints\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n  ],\n);\n"]}
+{"version":3,"file":"principalPolicySchema.js","sourceRoot":"","sources":["principalPolicySchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,gCAAgC,EAChC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;CAClD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACjE,KAAK,CAAC,iDAAiD,CAAC,CAAC,EAAE,CACzD,KAAK,CAAC,cAAc,CACrB;CACF,CACF,CAAC;AAEF,SAAS,4BAA4B;IACnC,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;QAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;QACtD,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;QAChE,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE;QACxD,0BAA0B,EAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC,OAAO,EAAE;QAC3E,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;QAC1D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAC1C,oBAAoB,EACpB,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACjE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAChD,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACtB;CACF,CACF,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CACrD,iCAAiC,EACjC,4BAA4B,EAAE,EAC9B,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;KACnE,CAAC;IACF,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,CACtD,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACtB;CACF,CACF,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;CACrD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,eAAe;SACtB;KACF,CAAC;CACH,CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,8BAA8B,EAC9B;IACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CAClE,CACF,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport {\n  index,\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\n\nimport { principalStateFingerprintJson } from \"./principalKeyFingerprintJson\";\n\n/** Durable organization ownership for every managed-principal cache. */\nexport const principalPolicyOrganizations = sqliteTable(\n  \"principal_policy_organizations\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n    index(\"principal_policy_organizations_organization_idx\").on(\n      table.organizationId,\n    ),\n  ],\n);\n\nfunction principalPolicyBundleColumns() {\n  return {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    currentStateJson: text(\"current_state_json\").notNull(),\n    currentPayloadJson: text(\"current_payload_json\").notNull(),\n    currentProjectionJson: text(\"current_projection_json\").notNull(),\n    currentGrantsJson: text(\"current_grants_json\").notNull(),\n    currentMemberEnvelopesJson: text(\"current_member_envelopes_json\").notNull(),\n    previousStatesJson: text(\"previous_states_json\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  };\n}\n\n/** Latest full policy bundle per managed principal. */\nexport const principalPolicies = sqliteTable(\n  \"principal_policies\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n    index(\"principal_policies_key_fingerprint_idx\").on(\n      principalStateFingerprintJson(table.currentStateJson),\n      desc(table.updatedAt),\n    ),\n  ],\n);\n\n/** Older verified bundles retained for exact-reference verification and epoch key unwrapping. */\nexport const principalPolicyBundleHistory = sqliteTable(\n  \"principal_policy_bundle_history\",\n  principalPolicyBundleColumns(),\n  (table) => [\n    primaryKey({\n      columns: [table.principalType, table.principalId, table.stateHash],\n    }),\n    index(\"principal_policy_history_key_fingerprint_idx\").on(\n      principalStateFingerprintJson(table.currentStateJson),\n      desc(table.updatedAt),\n    ),\n  ],\n);\n\n/** Exact policy states mapped to every retained bundle chain that contains them. */\nexport const principalPolicyBundleReferences = sqliteTable(\n  \"principal_policy_bundle_references\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    keyEpoch: integer(\"key_epoch\").notNull(),\n    keyFingerprint: text(\"key_fingerprint\").notNull(),\n    bundleVersion: integer(\"bundle_version\").notNull(),\n    bundleStateHash: text(\"bundle_state_hash\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [\n        table.principalType,\n        table.principalId,\n        table.version,\n        table.stateHash,\n        table.keyEpoch,\n        table.keyFingerprint,\n        table.bundleStateHash,\n      ],\n    }),\n  ],\n);\n\n/** Monotonic anti-rollback pin for each verified managed principal. */\nexport const principalPolicyCheckpoints = sqliteTable(\n  \"principal_policy_checkpoints\",\n  {\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    version: integer(\"version\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.principalType, table.principalId] }),\n  ],\n);\n"]}