@tearleads/client-sdk 0.1.112 → 0.1.113

package/data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js

@@ -3,11 +3,11 @@ import { keyingCheckpointTables, principalPolicyTables, } from "../../sqlite/sch
 import { verifiedManifestBundleTables } from "../../sqlite/schema/verifiedManifestBundleSchema.js";
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
-import { assertContainerNotRetired } from "../principalKeys/principalGrantRetirementPersistence.js";
+import { loadContainerRetirementCheck } from "../principalKeys/principalGrantRetirementPersistence.js";
 import { verifiedManifestBundleRows, writeVerifiedManifestBundlesInTransaction, } from "../verifiedManifestBundlePersistence.js";
 import { storeDocumentPurgeCheckpointInTransaction, } from "./documentPurgeCheckpointPersistence.js";
 import { validateAccessManifestCheckpointEvidence } from "./keyingCheckpointEvidence.js";
-import { accessManifestObjectKey, loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertAccessManifestCheckpointInTransaction, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
+import { accessManifestObjectKey, loadAccessManifestCheckpointRows, loadStoredPrincipalPolicyCheckpoints, principalPolicyKey, upsertAccessManifestCheckpointsInTransaction, upsertPrincipalPolicyCheckpointsInTransaction, } from "./keyingCheckpointPersistence.js";
 import { validatePrincipalAuthorizationCheckpoints } from "./principalAuthorizationCheckpoints.js";
 function validateAccessAdvance(advance, localCheckpoint) {
     const current = {
@@ -40,13 +40,21 @@ function validateAccessAdvance(advance, localCheckpoint) {
 }
 async function validateAccessAdvances(tx, advances) {
     const pending = new Map();
+    if (advances.length === 0)
+        return pending;
+    // Set reads first; the checks then replay in order, so the same advance
+    // fails first with the same error.
+    const heads = advances.map((advance) => advance.head.checkpoint);
+    const assertNotRetired = await loadContainerRetirementCheck(tx, heads);
+    const stored = await loadAccessManifestCheckpointRows(tx, heads);
     for (const advance of advances) {
-        await assertContainerNotRetired(tx, advance.head.checkpoint);
+        assertNotRetired(advance.head.checkpoint);
         const key = accessManifestObjectKey(advance.head.checkpoint);
         if (pending.has(key)) {
             throw new KeyingVerificationError("equivocation", `projection declares multiple access checkpoint heads for ${key}`);
         }
-        const localCheckpoint = await loadStoredAccessManifestCheckpoint(tx, advance.head.checkpoint);
+        const row = stored.get(key);
+        const localCheckpoint = row ? { ...advance.head.checkpoint, ...row } : null;
         pending.set(key, validateAccessAdvance(advance, localCheckpoint));
     }
     return pending;
@@ -72,6 +80,7 @@ export async function validatePrincipalPolicyCheckpointAdvances(tx, policies) {
         policiesByPrincipal.set(key, candidates);
     }
     const pending = new Map();
+    const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);
     for (const key of [...policiesByPrincipal.keys()].sort()) {
         const candidates = policiesByPrincipal.get(key) ?? [];
         const maxVersion = Math.max(...candidates.map((policy) => policy.version));
@@ -91,7 +100,7 @@ export async function validatePrincipalPolicyCheckpointAdvances(tx, policies) {
                 throw new KeyingVerificationError("stale_predecessor", `principal policy head does not extend observed state for ${key}`);
             }
         }
-        const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);
+        const localCheckpoint = stored.get(key) ?? null;
         verifyPrincipalPolicyCheckpoint({
             chain: "retainedHistory" in head ? head.retainedHistory : (head.history ?? []),
             currentState: head.state,
@@ -102,15 +111,11 @@ export async function validatePrincipalPolicyCheckpointAdvances(tx, policies) {
     return pending;
 }
 async function writeAccessCheckpoints(tx, pending, updatedAt) {
-    for (const { checkpoint } of pending.values()) {
-        await upsertAccessManifestCheckpointInTransaction(tx, checkpoint, updatedAt);
-    }
+    await upsertAccessManifestCheckpointsInTransaction(tx, [...pending.values()].map(({ checkpoint }) => checkpoint), updatedAt);
 }
 /** Pins the heads `validatePrincipalPolicyCheckpointAdvances` returned. */
 export async function writePrincipalPolicyCheckpoints(tx, pending, updatedAt, organizationId) {
-    for (const policy of pending.values()) {
-        await upsertPrincipalPolicyCheckpointInTransaction(tx, policy.checkpoint, updatedAt, organizationId);
-    }
+    await upsertPrincipalPolicyCheckpointsInTransaction(tx, [...pending.values()].map((policy) => policy.checkpoint), updatedAt, organizationId);
 }
 /**
  * Digests the verified bundles and ensures every table the batch touches,

package/data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAIvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAGL,0BAA0B,EAC1B,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AA8BhG,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,kCAAkC,CAC9D,EAAE,EACF,OAAO,CAAC,IAAI,CAAC,UAAU,CACxB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,cAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,KAAK,CAAC,eAAe,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,sBAAsB;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,yCAAyC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QACF,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,EAAE,EACF,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QAEF,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,+BAA+B,CACnC,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../../sqlite/schema\";\nimport { verifiedManifestBundleTables } from \"../../sqlite/schema/verifiedManifestBundleSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { assertContainerNotRetired } from \"../principalKeys/principalGrantRetirementPersistence\";\nimport {\n  type VerifiedManifestBundle,\n  type VerifiedManifestBundleRow,\n  verifiedManifestBundleRows,\n  writeVerifiedManifestBundlesInTransaction,\n} from \"../verifiedManifestBundlePersistence\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { validatePrincipalAuthorizationCheckpoints } from \"./principalAuthorizationCheckpoints\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /**\n   * Bundles this projection verified. They are stored for later citation in\n   * the same transaction, so they commit only with the batch they verified.\n   */\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n\n  for (const advance of advances) {\n    await assertContainerNotRetired(tx, advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const localCheckpoint = await loadStoredAccessManifestCheckpoint(\n      tx,\n      advance.head.checkpoint,\n    );\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\n/**\n * Checks, inside the caller's transaction, that each principal's newest policy\n * extends every other candidate and its durable checkpoint. Returns the heads\n * to pin, keyed by principal.\n */\nexport async function validatePrincipalPolicyCheckpointAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const { checkpoint } of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\n/** Pins the heads `validatePrincipalPolicyCheckpointAdvances` returned. */\nexport async function writePrincipalPolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  for (const policy of pending.values()) {\n    await upsertPrincipalPolicyCheckpointInTransaction(\n      tx,\n      policy.checkpoint,\n      updatedAt,\n      organizationId,\n    );\n  }\n}\n\n/**\n * Digests the verified bundles and ensures every table the batch touches,\n * all before its transaction begins.\n */\nasync function prepareKeyingCheckpointBatch(\n  input: KeyingCheckpointValidationInput,\n): Promise<VerifiedManifestBundleRow[]> {\n  const bundleRows = await verifiedManifestBundleRows(\n    input.verifiedBundles ?? [],\n  );\n  await ensureSqlTables(input.execSql, [\n    ...(input.policies.length > 0 ||\n    (input.authorizationPolicies?.length ?? 0) > 0\n      ? principalPolicyTables\n      : []),\n    ...keyingCheckpointTables,\n    ...(bundleRows.length > 0 ? verifiedManifestBundleTables : []),\n  ]);\n  return bundleRows;\n}\n\n/**\n * Re-checks verified candidates against durable pins without advancing them.\n * Only the verified bundles' citation rows are written.\n */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const verifiedAt = new Date().toISOString();\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePrincipalPolicyCheckpointAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence, with the batch's verified bundles, are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput & {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly organizationId?: string | undefined;\n  },\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePrincipalPolicyCheckpointAdvances(\n      tx,\n      input.policies,\n    );\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePrincipalPolicyCheckpoints(\n      tx,\n      policies,\n      updatedAt,\n      input.organizationId,\n    );\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, updatedAt);\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n"]}
+{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAIvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAGL,0BAA0B,EAC1B,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,oCAAoC,EACpC,kBAAkB,EAClB,4CAA4C,EAC5C,6CAA6C,GAC9C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AA8BhG,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1C,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAEjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,eAAe,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAChD,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,MAAM,4CAA4C,CAChD,EAAE,EACF,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EACzD,SAAS,CACV,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,MAAM,6CAA6C,CACjD,EAAE,EACF,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EACxD,SAAS,EACT,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,KAAK,CAAC,eAAe,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,sBAAsB;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,yCAAyC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QACF,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,EAAE,EACF,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QAEF,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,+BAA+B,CACnC,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../../sqlite/schema\";\nimport { verifiedManifestBundleTables } from \"../../sqlite/schema/verifiedManifestBundleSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { loadContainerRetirementCheck } from \"../principalKeys/principalGrantRetirementPersistence\";\nimport {\n  type VerifiedManifestBundle,\n  type VerifiedManifestBundleRow,\n  verifiedManifestBundleRows,\n  writeVerifiedManifestBundlesInTransaction,\n} from \"../verifiedManifestBundlePersistence\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadAccessManifestCheckpointRows,\n  loadStoredPrincipalPolicyCheckpoints,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointsInTransaction,\n  upsertPrincipalPolicyCheckpointsInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { validatePrincipalAuthorizationCheckpoints } from \"./principalAuthorizationCheckpoints\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /**\n   * Bundles this projection verified. They are stored for later citation in\n   * the same transaction, so they commit only with the batch they verified.\n   */\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n  if (advances.length === 0) return pending;\n  // Set reads first; the checks then replay in order, so the same advance\n  // fails first with the same error.\n  const heads = advances.map((advance) => advance.head.checkpoint);\n  const assertNotRetired = await loadContainerRetirementCheck(tx, heads);\n  const stored = await loadAccessManifestCheckpointRows(tx, heads);\n\n  for (const advance of advances) {\n    assertNotRetired(advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const row = stored.get(key);\n    const localCheckpoint = row ? { ...advance.head.checkpoint, ...row } : null;\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\n/**\n * Checks, inside the caller's transaction, that each principal's newest policy\n * extends every other candidate and its durable checkpoint. Returns the heads\n * to pin, keyed by principal.\n */\nexport async function validatePrincipalPolicyCheckpointAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = stored.get(key) ?? null;\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  await upsertAccessManifestCheckpointsInTransaction(\n    tx,\n    [...pending.values()].map(({ checkpoint }) => checkpoint),\n    updatedAt,\n  );\n}\n\n/** Pins the heads `validatePrincipalPolicyCheckpointAdvances` returned. */\nexport async function writePrincipalPolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await upsertPrincipalPolicyCheckpointsInTransaction(\n    tx,\n    [...pending.values()].map((policy) => policy.checkpoint),\n    updatedAt,\n    organizationId,\n  );\n}\n\n/**\n * Digests the verified bundles and ensures every table the batch touches,\n * all before its transaction begins.\n */\nasync function prepareKeyingCheckpointBatch(\n  input: KeyingCheckpointValidationInput,\n): Promise<VerifiedManifestBundleRow[]> {\n  const bundleRows = await verifiedManifestBundleRows(\n    input.verifiedBundles ?? [],\n  );\n  await ensureSqlTables(input.execSql, [\n    ...(input.policies.length > 0 ||\n    (input.authorizationPolicies?.length ?? 0) > 0\n      ? principalPolicyTables\n      : []),\n    ...keyingCheckpointTables,\n    ...(bundleRows.length > 0 ? verifiedManifestBundleTables : []),\n  ]);\n  return bundleRows;\n}\n\n/**\n * Re-checks verified candidates against durable pins without advancing them.\n * Only the verified bundles' citation rows are written.\n */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const verifiedAt = new Date().toISOString();\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePrincipalPolicyCheckpointAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence, with the batch's verified bundles, are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput & {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly organizationId?: string | undefined;\n  },\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePrincipalPolicyCheckpointAdvances(\n      tx,\n      input.policies,\n    );\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePrincipalPolicyCheckpoints(\n      tx,\n      policies,\n      updatedAt,\n      input.organizationId,\n    );\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, updatedAt);\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n"]}

package/data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js

@@ -1,9 +1,11 @@
 import { KeyingVerificationError } from "../../../internal/crypto/index.js";
-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { accessManifestCheckpoints, keyingCheckpointTables, principalPolicyCheckpoints, } from "../../sqlite/schema/index.js";
+import { sqliteInsertBatchSize, sqliteRowsPerStatement, } from "../../sqlite/sqliteBindBudget.js";
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { excludedValue } from "../../sqlite/sqliteUpsert.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
-import { recordPrincipalPolicyOrganizationInTransaction } from "../principalPolicy/principalPolicyOrganizationPersistence.js";
+import { recordPrincipalPolicyOrganizationInTransaction, recordPrincipalPolicyOrganizationsInTransaction, } from "../principalPolicy/principalPolicyOrganizationPersistence.js";
 /** One key format per checkpoint identity, shared by every batch validator. */
 export function accessManifestObjectKey(identity) {
     return JSON.stringify([
@@ -37,6 +39,80 @@ async function loadPrincipalPolicyCheckpointRow(handle, identity) {
         .limit(1);
     return rows[0] ?? null;
 }
+// An access lookup binds its kind and organization once; a policy lookup its type.
+const ACCESS_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 2);
+const POLICY_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);
+const ACCESS_WRITE_BATCH_SIZE = sqliteInsertBatchSize(accessManifestCheckpoints);
+const POLICY_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalPolicyCheckpoints);
+/** Splits `values` into consecutive slices of at most `size`. */
+function checkpointBatches(values, size) {
+    const result = [];
+    for (let index = 0; index < values.length; index += size)
+        result.push(values.slice(index, index + size));
+    return result;
+}
+/** Distinct ids per group key, in first-seen order. */
+function groupIds(items, group, id) {
+    const groups = new Map();
+    for (const item of items) {
+        const entry = groups.get(group(item)) ?? { first: item, ids: [] };
+        if (!entry.ids.includes(id(item)))
+            entry.ids.push(id(item));
+        groups.set(group(item), entry);
+    }
+    return groups;
+}
+/**
+ * Every stored access checkpoint row for `identities`, keyed by
+ * `accessManifestObjectKey`: one read per object kind and organization.
+ */
+export async function loadAccessManifestCheckpointRows(handle, identities) {
+    const stored = new Map();
+    const groups = groupIds(identities, (identity) => JSON.stringify([identity.objectKind, identity.organizationId]), (identity) => identity.objectId);
+    for (const { first, ids } of groups.values())
+        for (const batch of checkpointBatches(ids, ACCESS_LOOKUP_BATCH_SIZE)) {
+            const rows = await handle
+                .select({
+                objectId: accessManifestCheckpoints.objectId,
+                epoch: accessManifestCheckpoints.epoch,
+                manifestHash: accessManifestCheckpoints.manifestHash,
+            })
+                .from(accessManifestCheckpoints)
+                .where(and(eq(accessManifestCheckpoints.objectKind, first.objectKind), eq(accessManifestCheckpoints.organizationId, first.organizationId), inArray(accessManifestCheckpoints.objectId, batch)));
+            for (const { objectId, ...row } of rows)
+                stored.set(accessManifestObjectKey({ ...first, objectId }), row);
+        }
+    return stored;
+}
+/**
+ * Every stored policy checkpoint for `identities`, keyed by
+ * `principalPolicyKey`: one read per principal type.
+ */
+export async function loadStoredPrincipalPolicyCheckpoints(handle, identities) {
+    const stored = new Map();
+    const groups = groupIds(identities, (identity) => identity.principalType, (identity) => identity.principalId);
+    for (const { first, ids } of groups.values())
+        for (const batch of checkpointBatches(ids, POLICY_LOOKUP_BATCH_SIZE)) {
+            const rows = await handle
+                .select({
+                principalId: principalPolicyCheckpoints.principalId,
+                version: principalPolicyCheckpoints.version,
+                stateHash: principalPolicyCheckpoints.stateHash,
+            })
+                .from(principalPolicyCheckpoints)
+                .where(and(eq(principalPolicyCheckpoints.principalType, first.principalType), inArray(principalPolicyCheckpoints.principalId, batch)));
+            for (const row of rows) {
+                const checkpoint = {
+                    principalType: first.principalType,
+                    principalId: row.principalId,
+                    version: row.version,
+                    stateHash: row.stateHash,
+                };
+                stored.set(principalPolicyKey(checkpoint), checkpoint);
+            }
+        }
+    return stored;
+}
 /**
  * A loaded checkpoint row merged back with the identity it was looked up by —
  * the full checkpoint shape every comparison consumes.
@@ -98,6 +174,78 @@ export async function upsertPrincipalPolicyCheckpointInTransaction(tx, checkpoin
     })
         .run();
 }
+/**
+ * Upserts every checkpoint in multi-row statements; a repeated identity keeps
+ * its last checkpoint, as sequential upserts would.
+ */
+export async function upsertAccessManifestCheckpointsInTransaction(tx, checkpoints, updatedAt) {
+    const rows = new Map(checkpoints.map((checkpoint) => [
+        accessManifestObjectKey(checkpoint),
+        {
+            objectKind: checkpoint.objectKind,
+            organizationId: checkpoint.organizationId,
+            objectId: checkpoint.objectId,
+            epoch: checkpoint.epoch,
+            manifestHash: checkpoint.manifestHash,
+            updatedAt,
+        },
+    ]));
+    for (const batch of checkpointBatches([...rows.values()], ACCESS_WRITE_BATCH_SIZE))
+        await tx
+            .insert(accessManifestCheckpoints)
+            .values(batch)
+            .onConflictDoUpdate({
+            target: [
+                accessManifestCheckpoints.objectKind,
+                accessManifestCheckpoints.organizationId,
+                accessManifestCheckpoints.objectId,
+            ],
+            set: {
+                epoch: excludedValue(accessManifestCheckpoints.epoch),
+                manifestHash: excludedValue(accessManifestCheckpoints.manifestHash),
+                updatedAt: excludedValue(accessManifestCheckpoints.updatedAt),
+            },
+        })
+            .run();
+}
+/**
+ * Records every checkpoint's cache ownership, failing on the first conflict in
+ * order as `upsertPrincipalPolicyCheckpointInTransaction` would, then upserts
+ * the checkpoints in multi-row statements.
+ */
+export async function upsertPrincipalPolicyCheckpointsInTransaction(tx, checkpoints, updatedAt, organizationId) {
+    await recordPrincipalPolicyOrganizationsInTransaction(tx, checkpoints.map((checkpoint) => ({
+        organizationId,
+        principalId: checkpoint.principalId,
+        principalType: checkpoint.principalType,
+    })));
+    const rows = new Map(checkpoints.map((checkpoint) => [
+        principalPolicyKey(checkpoint),
+        {
+            principalType: checkpoint.principalType,
+            principalId: checkpoint.principalId,
+            version: checkpoint.version,
+            stateHash: checkpoint.stateHash,
+            updatedAt,
+        },
+    ]));
+    for (const batch of checkpointBatches([...rows.values()], POLICY_WRITE_BATCH_SIZE))
+        await tx
+            .insert(principalPolicyCheckpoints)
+            .values(batch)
+            .onConflictDoUpdate({
+            target: [
+                principalPolicyCheckpoints.principalType,
+                principalPolicyCheckpoints.principalId,
+            ],
+            set: {
+                version: excludedValue(principalPolicyCheckpoints.version),
+                stateHash: excludedValue(principalPolicyCheckpoints.stateHash),
+                updatedAt: excludedValue(principalPolicyCheckpoints.updatedAt),
+            },
+        })
+            .run();
+}
 // Lazily create the checkpoint tables on first access. Every load/save below
 // calls this, so the tables exist on demand; it is intentionally module-private
 // (no caller outside this file needs it, and exporting it tripped knip).

package/data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyingCheckpointPersistence.js","sourceRoot":"","sources":["keyingCheckpointPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,8CAA8C,EAAE,MAAM,2DAA2D,CAAC;AAc3H,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,QAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAwB,EACxB,QAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,KAAK,EAAE,yBAAyB,CAAC,KAAK;QACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;KACrD,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC7D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAwB,EACxB,QAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,0BAA0B,CAAC,OAAO;QAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACjE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwB,EACxB,UAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,QAA2C;IAE3C,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,GAAG;QACR,CAAC,CAAC;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,GAAG;SACP;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,uCAAuC,CACrD,MAAwB;IAExB,OAAO,MAAM;SACV,cAAc,CAAC;QACd,EAAE,EAAE,0BAA0B,CAAC,WAAW;QAC1C,IAAI,EAAE,0BAA0B,CAAC,aAAa;KAC/C,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,EAAgC,EAChC,UAAoC,EACpC,SAAiB;IAEjB,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,yBAAyB,CAAC,UAAU;YACpC,yBAAyB,CAAC,cAAc;YACxC,yBAAyB,CAAC,QAAQ;SACnC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,UAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,0BAA0B,CAAC,aAAa;YACxC,0BAA0B,CAAC,WAAW;SACvC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,KAAK,UAAU,4BAA4B,CAAC,OAAgB;IAC1D,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,UAA4B,EAC5B,cAAsB,EACtB,QAAgB;IAEhB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE;QACpD,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,aAAmC,EACnC,WAAmB;IAEnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE;QACrD,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAAqC,EACrC,IAAuC;IAEvC,IACE,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC/C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  AccessManifestCheckpoint,\n  AccessObjectKind,\n  ManagedPrincipalKind,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  accessManifestCheckpoints,\n  keyingCheckpointTables,\n  principalPolicyCheckpoints,\n} from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { recordPrincipalPolicyOrganizationInTransaction } from \"../principalPolicy/principalPolicyOrganizationPersistence\";\n\ntype CheckpointHandle = ClientSQLiteDatabase | ClientSQLiteTransactionScope;\n\ntype AccessManifestCheckpointIdentity = Pick<\n  AccessManifestCheckpoint,\n  \"objectKind\" | \"organizationId\" | \"objectId\"\n>;\n\ntype PrincipalPolicyCheckpointIdentity = Pick<\n  PrincipalPolicyCheckpoint,\n  \"principalType\" | \"principalId\"\n>;\n\n/** One key format per checkpoint identity, shared by every batch validator. */\nexport function accessManifestObjectKey(\n  identity: AccessManifestCheckpointIdentity,\n): string {\n  return JSON.stringify([\n    identity.objectKind,\n    identity.organizationId,\n    identity.objectId,\n  ]);\n}\n\nexport function principalPolicyKey(\n  identity: PrincipalPolicyCheckpointIdentity,\n): string {\n  return JSON.stringify([identity.principalType, identity.principalId]);\n}\n\nasync function loadAccessManifestCheckpointRow(\n  handle: CheckpointHandle,\n  identity: AccessManifestCheckpointIdentity,\n): Promise<Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\"> | null> {\n  const rows = await handle\n    .select({\n      epoch: accessManifestCheckpoints.epoch,\n      manifestHash: accessManifestCheckpoints.manifestHash,\n    })\n    .from(accessManifestCheckpoints)\n    .where(\n      and(\n        eq(accessManifestCheckpoints.objectKind, identity.objectKind),\n        eq(accessManifestCheckpoints.organizationId, identity.organizationId),\n        eq(accessManifestCheckpoints.objectId, identity.objectId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\nasync function loadPrincipalPolicyCheckpointRow(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<Pick<PrincipalPolicyCheckpoint, \"version\" | \"stateHash\"> | null> {\n  const rows = await handle\n    .select({\n      version: principalPolicyCheckpoints.version,\n      stateHash: principalPolicyCheckpoints.stateHash,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, identity.principalType),\n        eq(principalPolicyCheckpoints.principalId, identity.principalId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\n/**\n * A loaded checkpoint row merged back with the identity it was looked up by —\n * the full checkpoint shape every comparison consumes.\n */\nexport async function loadStoredAccessManifestCheckpoint(\n  handle: CheckpointHandle,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<AccessManifestCheckpoint | null> {\n  const row = await loadAccessManifestCheckpointRow(handle, checkpoint);\n  return row ? { ...checkpoint, ...row } : null;\n}\n\nexport async function loadStoredPrincipalPolicyCheckpoint(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  const row = await loadPrincipalPolicyCheckpointRow(handle, identity);\n  return row\n    ? {\n        principalType: identity.principalType,\n        principalId: identity.principalId,\n        ...row,\n      }\n    : null;\n}\n\n/** Every principal with a durable policy checkpoint. */\nexport function listPrincipalPolicyCheckpointPrincipals(\n  handle: CheckpointHandle,\n): Promise<{ id: string; type: string }[]> {\n  return handle\n    .selectDistinct({\n      id: principalPolicyCheckpoints.principalId,\n      type: principalPolicyCheckpoints.principalType,\n    })\n    .from(principalPolicyCheckpoints);\n}\n\nexport async function upsertAccessManifestCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(accessManifestCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        accessManifestCheckpoints.objectKind,\n        accessManifestCheckpoints.organizationId,\n        accessManifestCheckpoints.objectId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\nexport async function upsertPrincipalPolicyCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: PrincipalPolicyCheckpoint,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: checkpoint.principalId,\n    principalType: checkpoint.principalType,\n  });\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(principalPolicyCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        principalPolicyCheckpoints.principalType,\n        principalPolicyCheckpoints.principalId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\n// Lazily create the checkpoint tables on first access. Every load/save below\n// calls this, so the tables exist on demand; it is intentionally module-private\n// (no caller outside this file needs it, and exporting it tripped knip).\nasync function ensureKeyingCheckpointTables(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n}\n\nexport async function loadAccessManifestCheckpoint(\n  execSql: ExecSql,\n  objectKind: AccessObjectKind,\n  organizationId: string,\n  objectId: string,\n): Promise<AccessManifestCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadAccessManifestCheckpointRow(db, {\n    objectKind,\n    organizationId,\n    objectId,\n  });\n\n  return row ? { objectKind, objectId, organizationId, ...row } : null;\n}\n\nexport async function loadPrincipalPolicyCheckpoint(\n  execSql: ExecSql,\n  principalType: ManagedPrincipalKind,\n  principalId: string,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadPrincipalPolicyCheckpointRow(db, {\n    principalType,\n    principalId,\n  });\n\n  return row ? { principalType, principalId, ...row } : null;\n}\n/**\n * The shared shape/ownership guard every checkpoint comparison runs before\n * trusting a durable pin: the pin must belong to the compared principal and\n * carry a well-formed version and hash.\n */\nexport function assertPrincipalPolicyCheckpointShape(\n  checkpoint: PrincipalPolicyCheckpoint,\n  head: PrincipalPolicyCheckpointIdentity,\n): void {\n  if (\n    checkpoint.principalType !== head.principalType ||\n    checkpoint.principalId !== head.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy checkpoint belongs to another principal\",\n    );\n  }\n  if (\n    !Number.isInteger(checkpoint.version) ||\n    checkpoint.version < 1 ||\n    checkpoint.stateHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy checkpoint is malformed\",\n    );\n  }\n}\n"]}
+{"version":3,"file":"keyingCheckpointPersistence.js","sourceRoot":"","sources":["keyingCheckpointPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,8CAA8C,EAC9C,+CAA+C,GAChD,MAAM,2DAA2D,CAAC;AAcnE,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,QAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAwB,EACxB,QAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,KAAK,EAAE,yBAAyB,CAAC,KAAK;QACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;KACrD,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC7D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAwB,EACxB,QAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,0BAA0B,CAAC,OAAO;QAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACjE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,yBAAyB,CAC1B,CAAC;AACF,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,0BAA0B,CAC3B,CAAC;AAEF,iEAAiE;AACjE,SAAS,iBAAiB,CAAI,MAAoB,EAAE,IAAY;IAC9D,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI;QACtD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,SAAS,QAAQ,CACf,KAAmB,EACnB,KAA0B,EAC1B,EAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,MAAwB,EACxB,UAAuD;IAIvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IACJ,MAAM,MAAM,GAAG,QAAQ,CACrB,UAAU,EACV,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,EAChE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAChC,CAAC;IACF,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE;QAC1C,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,MAAM;iBACtB,MAAM,CAAC;gBACN,QAAQ,EAAE,yBAAyB,CAAC,QAAQ;gBAC5C,KAAK,EAAE,yBAAyB,CAAC,KAAK;gBACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;aACrD,CAAC;iBACD,IAAI,CAAC,yBAAyB,CAAC;iBAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAC1D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EAClE,OAAO,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CACnD,CACF,CAAC;YACJ,KAAK,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,IAAI,IAAI;gBACrC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,MAAwB,EACxB,UAAwD;IAExD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CACrB,UAAU,EACV,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,EACpC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CACnC,CAAC;IACF,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE;QAC1C,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,MAAM;iBACtB,MAAM,CAAC;gBACN,WAAW,EAAE,0BAA0B,CAAC,WAAW;gBACnD,OAAO,EAAE,0BAA0B,CAAC,OAAO;gBAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;aAChD,CAAC;iBACD,IAAI,CAAC,0BAA0B,CAAC;iBAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EACjE,OAAO,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,CAAC,CACvD,CACF,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG;oBACjB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC;gBACF,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwB,EACxB,UAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,QAA2C;IAE3C,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,GAAG;QACR,CAAC,CAAC;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,GAAG;SACP;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,uCAAuC,CACrD,MAAwB;IAExB,OAAO,MAAM;SACV,cAAc,CAAC;QACd,EAAE,EAAE,0BAA0B,CAAC,WAAW;QAC1C,IAAI,EAAE,0BAA0B,CAAC,aAAa;KAC/C,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,EAAgC,EAChC,UAAoC,EACpC,SAAiB;IAEjB,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,yBAAyB,CAAC,UAAU;YACpC,yBAAyB,CAAC,cAAc;YACxC,yBAAyB,CAAC,QAAQ;SACnC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,UAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,0BAA0B,CAAC,aAAa;YACxC,0BAA0B,CAAC,WAAW;SACvC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,WAAgD,EAChD,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAC9B,uBAAuB,CAAC,UAAU,CAAC;QACnC;YACE,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,SAAS;SACV;KACF,CAAC,CACH,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,iBAAiB,CACnC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAClB,uBAAuB,CACxB;QACC,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,yBAAyB,CAAC,UAAU;gBACpC,yBAAyB,CAAC,cAAc;gBACxC,yBAAyB,CAAC,QAAQ;aACnC;YACD,GAAG,EAAE;gBACH,KAAK,EAAE,aAAa,CAAC,yBAAyB,CAAC,KAAK,CAAC;gBACrD,YAAY,EAAE,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC;gBACnE,SAAS,EAAE,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC;aAC9D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,EAAgC,EAChC,WAAiD,EACjD,SAAiB,EACjB,cAAmC;IAEnC,MAAM,+CAA+C,CACnD,EAAE,EACF,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/B,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAC9B,kBAAkB,CAAC,UAAU,CAAC;QAC9B;YACE,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS;SACV;KACF,CAAC,CACH,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,iBAAiB,CACnC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAClB,uBAAuB,CACxB;QACC,MAAM,EAAE;aACL,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,0BAA0B,CAAC,aAAa;gBACxC,0BAA0B,CAAC,WAAW;aACvC;YACD,GAAG,EAAE;gBACH,OAAO,EAAE,aAAa,CAAC,0BAA0B,CAAC,OAAO,CAAC;gBAC1D,SAAS,EAAE,aAAa,CAAC,0BAA0B,CAAC,SAAS,CAAC;gBAC9D,SAAS,EAAE,aAAa,CAAC,0BAA0B,CAAC,SAAS,CAAC;aAC/D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,KAAK,UAAU,4BAA4B,CAAC,OAAgB;IAC1D,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,UAA4B,EAC5B,cAAsB,EACtB,QAAgB;IAEhB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE;QACpD,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,aAAmC,EACnC,WAAmB;IAEnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE;QACrD,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAAqC,EACrC,IAAuC;IAEvC,IACE,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC/C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  AccessManifestCheckpoint,\n  AccessObjectKind,\n  ManagedPrincipalKind,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { and, eq, inArray } from \"drizzle-orm\";\nimport {\n  accessManifestCheckpoints,\n  keyingCheckpointTables,\n  principalPolicyCheckpoints,\n} from \"../../sqlite/schema\";\nimport {\n  sqliteInsertBatchSize,\n  sqliteRowsPerStatement,\n} from \"../../sqlite/sqliteBindBudget\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../../sqlite/sqliteUpsert\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport {\n  recordPrincipalPolicyOrganizationInTransaction,\n  recordPrincipalPolicyOrganizationsInTransaction,\n} from \"../principalPolicy/principalPolicyOrganizationPersistence\";\n\ntype CheckpointHandle = ClientSQLiteDatabase | ClientSQLiteTransactionScope;\n\ntype AccessManifestCheckpointIdentity = Pick<\n  AccessManifestCheckpoint,\n  \"objectKind\" | \"organizationId\" | \"objectId\"\n>;\n\ntype PrincipalPolicyCheckpointIdentity = Pick<\n  PrincipalPolicyCheckpoint,\n  \"principalType\" | \"principalId\"\n>;\n\n/** One key format per checkpoint identity, shared by every batch validator. */\nexport function accessManifestObjectKey(\n  identity: AccessManifestCheckpointIdentity,\n): string {\n  return JSON.stringify([\n    identity.objectKind,\n    identity.organizationId,\n    identity.objectId,\n  ]);\n}\n\nexport function principalPolicyKey(\n  identity: PrincipalPolicyCheckpointIdentity,\n): string {\n  return JSON.stringify([identity.principalType, identity.principalId]);\n}\n\nasync function loadAccessManifestCheckpointRow(\n  handle: CheckpointHandle,\n  identity: AccessManifestCheckpointIdentity,\n): Promise<Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\"> | null> {\n  const rows = await handle\n    .select({\n      epoch: accessManifestCheckpoints.epoch,\n      manifestHash: accessManifestCheckpoints.manifestHash,\n    })\n    .from(accessManifestCheckpoints)\n    .where(\n      and(\n        eq(accessManifestCheckpoints.objectKind, identity.objectKind),\n        eq(accessManifestCheckpoints.organizationId, identity.organizationId),\n        eq(accessManifestCheckpoints.objectId, identity.objectId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\nasync function loadPrincipalPolicyCheckpointRow(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<Pick<PrincipalPolicyCheckpoint, \"version\" | \"stateHash\"> | null> {\n  const rows = await handle\n    .select({\n      version: principalPolicyCheckpoints.version,\n      stateHash: principalPolicyCheckpoints.stateHash,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, identity.principalType),\n        eq(principalPolicyCheckpoints.principalId, identity.principalId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\n// An access lookup binds its kind and organization once; a policy lookup its type.\nconst ACCESS_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 2);\nconst POLICY_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);\nconst ACCESS_WRITE_BATCH_SIZE = sqliteInsertBatchSize(\n  accessManifestCheckpoints,\n);\nconst POLICY_WRITE_BATCH_SIZE = sqliteInsertBatchSize(\n  principalPolicyCheckpoints,\n);\n\n/** Splits `values` into consecutive slices of at most `size`. */\nfunction checkpointBatches<T>(values: readonly T[], size: number): T[][] {\n  const result: T[][] = [];\n  for (let index = 0; index < values.length; index += size)\n    result.push(values.slice(index, index + size));\n  return result;\n}\n\n/** Distinct ids per group key, in first-seen order. */\nfunction groupIds<T>(\n  items: readonly T[],\n  group: (item: T) => string,\n  id: (item: T) => string,\n): Map<string, { readonly first: T; readonly ids: string[] }> {\n  const groups = new Map<string, { first: T; ids: string[] }>();\n  for (const item of items) {\n    const entry = groups.get(group(item)) ?? { first: item, ids: [] };\n    if (!entry.ids.includes(id(item))) entry.ids.push(id(item));\n    groups.set(group(item), entry);\n  }\n  return groups;\n}\n\n/**\n * Every stored access checkpoint row for `identities`, keyed by\n * `accessManifestObjectKey`: one read per object kind and organization.\n */\nexport async function loadAccessManifestCheckpointRows(\n  handle: CheckpointHandle,\n  identities: readonly AccessManifestCheckpointIdentity[],\n): Promise<\n  Map<string, Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\">>\n> {\n  const stored = new Map<\n    string,\n    Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\">\n  >();\n  const groups = groupIds(\n    identities,\n    (identity) =>\n      JSON.stringify([identity.objectKind, identity.organizationId]),\n    (identity) => identity.objectId,\n  );\n  for (const { first, ids } of groups.values())\n    for (const batch of checkpointBatches(ids, ACCESS_LOOKUP_BATCH_SIZE)) {\n      const rows = await handle\n        .select({\n          objectId: accessManifestCheckpoints.objectId,\n          epoch: accessManifestCheckpoints.epoch,\n          manifestHash: accessManifestCheckpoints.manifestHash,\n        })\n        .from(accessManifestCheckpoints)\n        .where(\n          and(\n            eq(accessManifestCheckpoints.objectKind, first.objectKind),\n            eq(accessManifestCheckpoints.organizationId, first.organizationId),\n            inArray(accessManifestCheckpoints.objectId, batch),\n          ),\n        );\n      for (const { objectId, ...row } of rows)\n        stored.set(accessManifestObjectKey({ ...first, objectId }), row);\n    }\n  return stored;\n}\n\n/**\n * Every stored policy checkpoint for `identities`, keyed by\n * `principalPolicyKey`: one read per principal type.\n */\nexport async function loadStoredPrincipalPolicyCheckpoints(\n  handle: CheckpointHandle,\n  identities: readonly PrincipalPolicyCheckpointIdentity[],\n): Promise<Map<string, PrincipalPolicyCheckpoint>> {\n  const stored = new Map<string, PrincipalPolicyCheckpoint>();\n  const groups = groupIds(\n    identities,\n    (identity) => identity.principalType,\n    (identity) => identity.principalId,\n  );\n  for (const { first, ids } of groups.values())\n    for (const batch of checkpointBatches(ids, POLICY_LOOKUP_BATCH_SIZE)) {\n      const rows = await handle\n        .select({\n          principalId: principalPolicyCheckpoints.principalId,\n          version: principalPolicyCheckpoints.version,\n          stateHash: principalPolicyCheckpoints.stateHash,\n        })\n        .from(principalPolicyCheckpoints)\n        .where(\n          and(\n            eq(principalPolicyCheckpoints.principalType, first.principalType),\n            inArray(principalPolicyCheckpoints.principalId, batch),\n          ),\n        );\n      for (const row of rows) {\n        const checkpoint = {\n          principalType: first.principalType,\n          principalId: row.principalId,\n          version: row.version,\n          stateHash: row.stateHash,\n        };\n        stored.set(principalPolicyKey(checkpoint), checkpoint);\n      }\n    }\n  return stored;\n}\n\n/**\n * A loaded checkpoint row merged back with the identity it was looked up by —\n * the full checkpoint shape every comparison consumes.\n */\nexport async function loadStoredAccessManifestCheckpoint(\n  handle: CheckpointHandle,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<AccessManifestCheckpoint | null> {\n  const row = await loadAccessManifestCheckpointRow(handle, checkpoint);\n  return row ? { ...checkpoint, ...row } : null;\n}\n\nexport async function loadStoredPrincipalPolicyCheckpoint(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  const row = await loadPrincipalPolicyCheckpointRow(handle, identity);\n  return row\n    ? {\n        principalType: identity.principalType,\n        principalId: identity.principalId,\n        ...row,\n      }\n    : null;\n}\n\n/** Every principal with a durable policy checkpoint. */\nexport function listPrincipalPolicyCheckpointPrincipals(\n  handle: CheckpointHandle,\n): Promise<{ id: string; type: string }[]> {\n  return handle\n    .selectDistinct({\n      id: principalPolicyCheckpoints.principalId,\n      type: principalPolicyCheckpoints.principalType,\n    })\n    .from(principalPolicyCheckpoints);\n}\n\nexport async function upsertAccessManifestCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(accessManifestCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        accessManifestCheckpoints.objectKind,\n        accessManifestCheckpoints.organizationId,\n        accessManifestCheckpoints.objectId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\nexport async function upsertPrincipalPolicyCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: PrincipalPolicyCheckpoint,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: checkpoint.principalId,\n    principalType: checkpoint.principalType,\n  });\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(principalPolicyCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        principalPolicyCheckpoints.principalType,\n        principalPolicyCheckpoints.principalId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\n/**\n * Upserts every checkpoint in multi-row statements; a repeated identity keeps\n * its last checkpoint, as sequential upserts would.\n */\nexport async function upsertAccessManifestCheckpointsInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoints: readonly AccessManifestCheckpoint[],\n  updatedAt: string,\n): Promise<void> {\n  const rows = new Map(\n    checkpoints.map((checkpoint) => [\n      accessManifestObjectKey(checkpoint),\n      {\n        objectKind: checkpoint.objectKind,\n        organizationId: checkpoint.organizationId,\n        objectId: checkpoint.objectId,\n        epoch: checkpoint.epoch,\n        manifestHash: checkpoint.manifestHash,\n        updatedAt,\n      },\n    ]),\n  );\n  for (const batch of checkpointBatches(\n    [...rows.values()],\n    ACCESS_WRITE_BATCH_SIZE,\n  ))\n    await tx\n      .insert(accessManifestCheckpoints)\n      .values(batch)\n      .onConflictDoUpdate({\n        target: [\n          accessManifestCheckpoints.objectKind,\n          accessManifestCheckpoints.organizationId,\n          accessManifestCheckpoints.objectId,\n        ],\n        set: {\n          epoch: excludedValue(accessManifestCheckpoints.epoch),\n          manifestHash: excludedValue(accessManifestCheckpoints.manifestHash),\n          updatedAt: excludedValue(accessManifestCheckpoints.updatedAt),\n        },\n      })\n      .run();\n}\n\n/**\n * Records every checkpoint's cache ownership, failing on the first conflict in\n * order as `upsertPrincipalPolicyCheckpointInTransaction` would, then upserts\n * the checkpoints in multi-row statements.\n */\nexport async function upsertPrincipalPolicyCheckpointsInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoints: readonly PrincipalPolicyCheckpoint[],\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationsInTransaction(\n    tx,\n    checkpoints.map((checkpoint) => ({\n      organizationId,\n      principalId: checkpoint.principalId,\n      principalType: checkpoint.principalType,\n    })),\n  );\n  const rows = new Map(\n    checkpoints.map((checkpoint) => [\n      principalPolicyKey(checkpoint),\n      {\n        principalType: checkpoint.principalType,\n        principalId: checkpoint.principalId,\n        version: checkpoint.version,\n        stateHash: checkpoint.stateHash,\n        updatedAt,\n      },\n    ]),\n  );\n  for (const batch of checkpointBatches(\n    [...rows.values()],\n    POLICY_WRITE_BATCH_SIZE,\n  ))\n    await tx\n      .insert(principalPolicyCheckpoints)\n      .values(batch)\n      .onConflictDoUpdate({\n        target: [\n          principalPolicyCheckpoints.principalType,\n          principalPolicyCheckpoints.principalId,\n        ],\n        set: {\n          version: excludedValue(principalPolicyCheckpoints.version),\n          stateHash: excludedValue(principalPolicyCheckpoints.stateHash),\n          updatedAt: excludedValue(principalPolicyCheckpoints.updatedAt),\n        },\n      })\n      .run();\n}\n\n// Lazily create the checkpoint tables on first access. Every load/save below\n// calls this, so the tables exist on demand; it is intentionally module-private\n// (no caller outside this file needs it, and exporting it tripped knip).\nasync function ensureKeyingCheckpointTables(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n}\n\nexport async function loadAccessManifestCheckpoint(\n  execSql: ExecSql,\n  objectKind: AccessObjectKind,\n  organizationId: string,\n  objectId: string,\n): Promise<AccessManifestCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadAccessManifestCheckpointRow(db, {\n    objectKind,\n    organizationId,\n    objectId,\n  });\n\n  return row ? { objectKind, objectId, organizationId, ...row } : null;\n}\n\nexport async function loadPrincipalPolicyCheckpoint(\n  execSql: ExecSql,\n  principalType: ManagedPrincipalKind,\n  principalId: string,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadPrincipalPolicyCheckpointRow(db, {\n    principalType,\n    principalId,\n  });\n\n  return row ? { principalType, principalId, ...row } : null;\n}\n/**\n * The shared shape/ownership guard every checkpoint comparison runs before\n * trusting a durable pin: the pin must belong to the compared principal and\n * carry a well-formed version and hash.\n */\nexport function assertPrincipalPolicyCheckpointShape(\n  checkpoint: PrincipalPolicyCheckpoint,\n  head: PrincipalPolicyCheckpointIdentity,\n): void {\n  if (\n    checkpoint.principalType !== head.principalType ||\n    checkpoint.principalId !== head.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy checkpoint belongs to another principal\",\n    );\n  }\n  if (\n    !Number.isInteger(checkpoint.version) ||\n    checkpoint.version < 1 ||\n    checkpoint.stateHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy checkpoint is malformed\",\n    );\n  }\n}\n"]}

package/data/persistence/keyingCheckpoints/principalAuthorizationCheckpoints.js

@@ -1,5 +1,5 @@
 import { KeyingVerificationError, verifyPrincipalPolicyCheckpoint, } from "../../../internal/crypto/index.js";
-import { loadStoredPrincipalPolicyCheckpoint } from "./keyingCheckpointPersistence.js";
+import { loadStoredPrincipalPolicyCheckpoints, principalPolicyKey, } from "./keyingCheckpointPersistence.js";
 export class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {
     constructor() {
         super("missing_dependency", "Public authorization cannot connect to the latest durable checkpoint");
@@ -7,8 +7,9 @@ export class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVeri
 }
 /** Validate public evidence or a verified private ancestry bridge without admitting pins. */
 export async function validatePrincipalAuthorizationCheckpoints(tx, policies) {
+    const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);
     for (const policy of policies) {
-        const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);
+        const checkpoint = stored.get(principalPolicyKey(policy));
         if (!checkpoint)
             continue;
         const matchingHead = policies.filter((other) => other.principalType === policy.principalType &&

package/data/persistence/keyingCheckpoints/principalAuthorizationCheckpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalAuthorizationCheckpoints.js","sourceRoot":"","sources":["principalAuthorizationCheckpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,MAAM,OAAO,gDAAiD,SAAQ,uBAAuB;IAC3F;QACE,KAAK,CACH,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAGG;IAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC5C,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACvC,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,IACE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAM,IAAI,gDAAgD,EAAE,CAAC;QAC/D,+BAA+B,CAAC;YAC9B,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { loadStoredPrincipalPolicyCheckpoint } from \"./keyingCheckpointPersistence\";\n\nexport class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {\n  constructor() {\n    super(\n      \"missing_dependency\",\n      \"Public authorization cannot connect to the latest durable checkpoint\",\n    );\n  }\n}\n\n/** Validate public evidence or a verified private ancestry bridge without admitting pins. */\nexport async function validatePrincipalAuthorizationCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly (\n    | VerifiedPrincipalPolicySelection\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n): Promise<void> {\n  for (const policy of policies) {\n    const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n    if (!checkpoint) continue;\n    const matchingHead = policies.filter(\n      (other) =>\n        other.principalType === policy.principalType &&\n        other.principalId === policy.principalId &&\n        other.stateHash === policy.stateHash,\n    );\n    const chain = matchingHead.flatMap((other) => other.retainedHistory);\n    if (\n      checkpoint.version > policy.version ||\n      (checkpoint.version < policy.version &&\n        !chain.some(({ state }) => state.version === checkpoint.version))\n    )\n      throw new PrincipalAuthorizationCheckpointUnavailableError();\n    verifyPrincipalPolicyCheckpoint({\n      chain,\n      currentState: policy.state,\n      localCheckpoint: checkpoint,\n    });\n  }\n}\n"]}
+{"version":3,"file":"principalAuthorizationCheckpoints.js","sourceRoot":"","sources":["principalAuthorizationCheckpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oCAAoC,EACpC,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,OAAO,gDAAiD,SAAQ,uBAAuB;IAC3F;QACE,KAAK,CACH,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAGG;IAEH,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC5C,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACvC,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,IACE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAM,IAAI,gDAAgD,EAAE,CAAC;QAC/D,+BAA+B,CAAC;YAC9B,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport {\n  loadStoredPrincipalPolicyCheckpoints,\n  principalPolicyKey,\n} from \"./keyingCheckpointPersistence\";\n\nexport class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {\n  constructor() {\n    super(\n      \"missing_dependency\",\n      \"Public authorization cannot connect to the latest durable checkpoint\",\n    );\n  }\n}\n\n/** Validate public evidence or a verified private ancestry bridge without admitting pins. */\nexport async function validatePrincipalAuthorizationCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly (\n    | VerifiedPrincipalPolicySelection\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n): Promise<void> {\n  const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);\n  for (const policy of policies) {\n    const checkpoint = stored.get(principalPolicyKey(policy));\n    if (!checkpoint) continue;\n    const matchingHead = policies.filter(\n      (other) =>\n        other.principalType === policy.principalType &&\n        other.principalId === policy.principalId &&\n        other.stateHash === policy.stateHash,\n    );\n    const chain = matchingHead.flatMap((other) => other.retainedHistory);\n    if (\n      checkpoint.version > policy.version ||\n      (checkpoint.version < policy.version &&\n        !chain.some(({ state }) => state.version === checkpoint.version))\n    )\n      throw new PrincipalAuthorizationCheckpointUnavailableError();\n    verifyPrincipalPolicyCheckpoint({\n      chain,\n      currentState: policy.state,\n      localCheckpoint: checkpoint,\n    });\n  }\n}\n"]}

package/data/persistence/principalHistory/principalHistoryEvidencePersistence.d.ts

@@ -2,6 +2,7 @@ import { type PrincipalHistoryIndexNode, type PrincipalPolicyHistoryReferencePro
 import { type PrincipalPolicyStateChainEntryResponse } from "../../../internal/validators/response/index.js";
 import { type ClientSQLiteTransactionScope } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { type ExecSql } from "../../sqlite/sqlSchema.js";
+import type { PrincipalHistoryRootEdges } from "./principalHistoryRootOwnership.js";
 export interface PrincipalHistoryEvidencePage {
     readonly indexRootHash: string;
     readonly scopeId: string;
@@ -21,7 +22,19 @@ export declare function preparePrincipalHistoryEvidencePage(input: {
     readonly nodes: readonly PrincipalHistoryIndexNode[];
 }): Promise<PrincipalHistoryEvidencePage>;
 /** Publish in the same guarded transaction as the accepted page's progress. */
-export declare function writePrincipalHistoryEvidencePage(tx: ClientSQLiteTransactionScope, page: PrincipalHistoryEvidencePage): Promise<void>;
+export declare function writePrincipalHistoryEvidencePage(tx: ClientSQLiteTransactionScope, page: PrincipalHistoryEvidencePage, rootEdges?: PrincipalHistoryRootEdges | undefined): Promise<void>;
+/**
+ * Returns untrusted material, in `versions` order. The caller must verify it
+ * against the issued root. Index nodes are read one level at a time for every
+ * version and entries in one set read; the first version that fails, in
+ * order, throws the error loading it alone would.
+ */
+export declare function loadPrincipalHistoryReferences(input: {
+    readonly execSql: ExecSql;
+    readonly scopeId: string;
+    readonly history: VerifiedPrincipalPolicyHistory;
+    readonly versions: readonly number[];
+}): Promise<PrincipalPolicyHistoryReferenceProof[]>;
 /** Returns untrusted material. The caller must verify it against the issued root. */
 export declare function loadPrincipalHistoryReference(input: {
     readonly execSql: ExecSql;