@tearleads/client-sdk 0.1.114 → 0.1.116

package/workflows/principals/runtimePolicyRecovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePolicyRecovery.js","sourceRoot":"","sources":["runtimePolicyRecovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,mCAAmC,GAIpC,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAKzG,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EACL,4BAA4B,GAE7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,mCAAmC,EAAE,MAAM,sDAAsD,CAAC;AAC3G,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAavF,6FAA6F;AAC7F,MAAM,UAAU,oCAAoC,CAClD,OAAuC,EACvC,UAAqD,EAAE;IAEvD,MAAM,OAAO,GAAG,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,OAAO;QACZ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACzE,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAiBD,iFAAiF;AACjF,SAAS,oBAAoB,CAC3B,KAA6D,EAC7D,OAEI,EACJ,KAAoC;IAEpC,OAAO,KAAK,CAAC,SAAS;QACpB,CAAC,CAAC,mCAAmC,CACjC,KAAK,CAAC,OAAO,EACb;YACE,GAAG,OAAO;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,EACD,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EACtE,KAAK,CAAC,kBAAkB,KAAK,IAAI,CAClC;QACH,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,2CAA2C,CACzD,OAAuC;IAMvC,MAAM,KAAK,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,4BAA4B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,EAGxB,CAAC;IACJ,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,mCAAmC,EAAE,CAAC;QACzD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,mCAAmC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,qCAAqC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,CACxE,KAAK,CAAC,cAAc,EACpB,GAAG,EAAE,CACH,gCAAgC,CAC9B,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,IAAI,KAAK,CAAC,cAAc;QAC9D,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,0BAA0B;QACrC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,EACD,GAAG,EAAE,CACH,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QACzD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;QACrD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG;gBACd,aAAa;gBACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU;gBACV,0BAA0B,EACxB,OAAO,CAAC,0BAA0B;gBACpC,YAAY;aACb,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC7C,GAAG,EAAE,CACH,oBAAoB,CAClB,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,EAC/B,OAAO,EACP,KAAK,CACN,EACH,YAAY,CACb,CAAC;YACF,0DAA0D;YAC1D,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC1C,mCAAmC,CAAC,aAAa,CAAC,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,aAAa;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,YAAY,+BAA+B;gBAChD,KAAK,YAAY,iCAAiC;gBAClD,CAAC,KAAK,YAAY,uBAAuB;oBACvC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBAEtC,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACL,CACJ,CAAC;AACN,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoC;IACpE,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC;IAC/C,IACE,CAAC,KAAK,CAAC,SAAS;QAChB,CAAC,MAAM,KAAK,SAAS;YACnB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC5B,MAAM,IAAI,CAAC;gBACX,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,iEAAiE,CAClE,CAAC;AACN,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  assertProjectionVerificationCurrent,\n  type PrincipalPolicyResolveRequest,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"../../data/keyingProjectionVerification/types\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { readPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../data/principals/principalPolicyCoordinator\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { RecoveredPrincipalHistoryPage } from \"./historyRecovery/loadRecoveredPrincipalHistoryPage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  PrincipalPolicyHistoryReadError,\n} from \"./historyRecovery/principalHistoryRecoveryTypes\";\nimport type { ScopedPrincipalPolicyRecovery } from \"./historyRecovery/recoverScopedPrincipalPolicyHistory\";\nimport {\n  apiPrincipalPolicyPageReader,\n  type PrincipalPolicyHistoryReader,\n} from \"./principalPolicyHistoryReader\";\nimport { createPrincipalCurrentRecoveryBatch } from \"./recoveryOperation/principalCurrentRecoveryBatch\";\nimport { recoverWithPrincipalLocalPreference } from \"./recoveryOperation/principalRecoveryLocalPreference\";\nimport { resumeAfterSupersededStage } from \"./recoveryOperation/supersededStageResume\";\n\nexport interface PrincipalPolicyRecoveryRuntime {\n  readonly apiClient: Partial<PrincipalPolicyHistoryReader>;\n  readonly infra: { readonly execSql: ExecSql };\n  readonly state?: { readonly online: boolean } | undefined;\n  readonly util: { readonly reportSecurityIncident: SecurityIncidentReporter };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\n/** Keep the private recovery key inside its runtime lease while resolving cited evidence. */\nexport function createRuntimePrincipalPolicyResolver(\n  runtime: PrincipalPolicyRecoveryRuntime,\n  options: { readonly preferLocalCurrent?: boolean } = {},\n): ReferencedPrincipalPolicyWarmer[\"resolveReference\"] {\n  const resolve = createRuntimePrincipalPolicyCurrentResolver(runtime);\n  return resolve\n    ? (input) =>\n        resolve({ ...input, preferLocalCurrent: options.preferLocalCurrent })\n    : undefined;\n}\n\nexport interface ResolvedPrincipalPolicyCurrent\n  extends ResolvedPrincipalPolicyEvidence {\n  readonly current: PrincipalPolicyPageCurrent;\n  /** Rows end at the selected reference; current/policy may describe a newer recovered head. */\n  readonly historyPage?: RecoveredPrincipalHistoryPage | undefined;\n}\n\ninterface PrincipalPolicyCurrentRequest\n  extends Omit<PrincipalPolicyResolveRequest, \"reference\"> {\n  readonly reference?: PrincipalPolicyResolveRequest[\"reference\"] | undefined;\n  /** A read-model caller has selected this exact signed head; not a freshness read. */\n  readonly preferLocalCurrent?: boolean | undefined;\n  readonly historyPage?: { readonly beforeVersion?: number } | undefined;\n}\n\n/** One recovery attempt for a resolver request through the operation's batch. */\nfunction recoverPolicyCurrent(\n  batch: ReturnType<typeof createPrincipalCurrentRecoveryBatch>,\n  options: Parameters<\n    ReturnType<typeof createPrincipalCurrentRecoveryBatch>[\"discover\"]\n  >[0],\n  input: PrincipalPolicyCurrentRequest,\n): Promise<ScopedPrincipalPolicyRecovery> {\n  return input.reference\n    ? recoverWithPrincipalLocalPreference(\n        batch.recover,\n        {\n          ...options,\n          reference: input.reference,\n          historyPage: input.historyPage,\n        },\n        input.preferLocalCurrent === true || input.preferLocalHistory === true,\n        input.preferLocalHistory === true,\n      )\n    : batch.discover(options);\n}\n\n/** Keep current artifacts with their verified evidence and private runtime lifetime. */\nexport function createRuntimePrincipalPolicyCurrentResolver(\n  runtime: PrincipalPolicyRecoveryRuntime,\n):\n  | ((\n      input: PrincipalPolicyCurrentRequest,\n    ) => Promise<ResolvedPrincipalPolicyCurrent>)\n  | undefined {\n  const lease = readPrincipalHistoryProtection(runtime);\n  const historyReader = apiPrincipalPolicyPageReader(runtime.apiClient);\n  if (!lease || !historyReader) return undefined;\n  const batches = new WeakMap<\n    object,\n    ReturnType<typeof createPrincipalCurrentRecoveryBatch>\n  >();\n  const recoverFor = (batch: object | undefined) => {\n    if (!batch) return createPrincipalCurrentRecoveryBatch();\n    let recover = batches.get(batch);\n    if (!recover) {\n      recover = createPrincipalCurrentRecoveryBatch();\n      batches.set(batch, recover);\n    }\n    return recover;\n  };\n  return (input) =>\n    getOrCreatePrincipalPolicyCoordinator(runtime.infra.execSql).queueRecovery(\n      input.organizationId,\n      () =>\n        runWithSecurityIncidentReporting(\n          runtime.util.reportSecurityIncident,\n          {\n            objectId: input.reference?.principalId ?? input.organizationId,\n            objectKind: \"principal\",\n            operation: \"principal.policy.recover\",\n            organizationId: input.organizationId,\n          },\n          () =>\n            lease(async ({ protection, stillCurrent: leaseCurrent }) => {\n              const stillCurrent = () =>\n                leaseCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(stillCurrent);\n              assertHistoryPageRequest(input);\n              const offline = runtime.state?.online === false;\n              try {\n                const options = {\n                  historyReader,\n                  execSql: runtime.infra.execSql,\n                  offline,\n                  organizationId: input.organizationId,\n                  protection,\n                  resolveTrustedUserIdentity:\n                    runtime.resolveTrustedUserIdentity,\n                  stillCurrent,\n                };\n                const result = await resumeAfterSupersededStage(\n                  () =>\n                    recoverPolicyCurrent(\n                      recoverFor(input.recoveryBatch),\n                      options,\n                      input,\n                    ),\n                  stillCurrent,\n                );\n                // Reused evidence stays bound to every producer lifetime.\n                const resultCurrent = () =>\n                  stillCurrent() && result.stillCurrent();\n                assertProjectionVerificationCurrent(resultCurrent);\n                return {\n                  current: result.current,\n                  organizationId: input.organizationId,\n                  policy: result.policy,\n                  dependencies: result.dependencies,\n                  historyPage: result.historyPage,\n                  stillCurrent: resultCurrent,\n                };\n              } catch (error) {\n                assertProjectionVerificationCurrent(stillCurrent);\n                if (\n                  error instanceof PrincipalPolicyHistoryReadError ||\n                  error instanceof PrincipalHistoryRecoveryRaceError ||\n                  (error instanceof KeyingVerificationError &&\n                    error.code === \"missing_dependency\")\n                )\n                  throw new ProjectionDependencyUnavailableError(error.message);\n                throw error;\n              }\n            }),\n        ),\n    );\n}\n\nfunction assertHistoryPageRequest(input: PrincipalPolicyCurrentRequest) {\n  if (!input.historyPage) return;\n  const before = input.historyPage.beforeVersion;\n  if (\n    !input.reference ||\n    (before !== undefined &&\n      (!Number.isSafeInteger(before) ||\n        before <= 1 ||\n        before > input.reference.version + 1))\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"History display requires a selected head and an in-range cursor\",\n    );\n}\n"]}
+{"version":3,"file":"runtimePolicyRecovery.js","sourceRoot":"","sources":["runtimePolicyRecovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,mCAAmC,GAIpC,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,qCAAqC,GAEtC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EACL,4BAA4B,GAE7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,mCAAmC,EAAE,MAAM,sDAAsD,CAAC;AAC3G,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAavF,6FAA6F;AAC7F,MAAM,UAAU,oCAAoC,CAClD,OAAuC,EACvC,UAAqD,EAAE;IAEvD,MAAM,OAAO,GAAG,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,OAAO;QACZ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACzE,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAGjC,CAAC;AAEJ,SAAS,sBAAsB,CAC7B,WAAuC,EACvC,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,mCAAmC,EAAE,CAAC;IAC7D,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QACxB,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,mCAAmC,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,oBAAoB,CAC3B,KAA6D,EAC7D,OAEI,EACJ,KAAoC;IAEpC,OAAO,KAAK,CAAC,SAAS;QACpB,CAAC,CAAC,mCAAmC,CACjC,KAAK,CAAC,OAAO,EACb;YACE,GAAG,OAAO;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,EACD,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EACtE,KAAK,CAAC,kBAAkB,KAAK,IAAI,CAClC;QACH,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,2CAA2C,CACzD,OAAuC;IAMvC,MAAM,KAAK,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,4BAA4B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,WAAW,GAAG,qCAAqC,CACvD,OAAO,CAAC,KAAK,CAAC,OAAO,CACtB,CAAC;IACF,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,CACnD,gCAAgC,CAC9B,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,IAAI,KAAK,CAAC,cAAc;QAC9D,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,0BAA0B;QACrC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,EACD,GAAG,EAAE,CACH,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QACzD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;QACrD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG;gBACd,aAAa;gBACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU;gBACV,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;gBAC9D,YAAY;aACb,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC7C,GAAG,EAAE,CACH,oBAAoB,CAClB,sBAAsB,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,EACxD,OAAO,EACP,KAAK,CACN,EACH,YAAY,CACb,CAAC;YACF,0DAA0D;YAC1D,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC1C,mCAAmC,CAAC,aAAa,CAAC,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,aAAa;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,YAAY,+BAA+B;gBAChD,KAAK,YAAY,iCAAiC;gBAClD,CAAC,KAAK,YAAY,uBAAuB;oBACvC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBAEtC,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACL,CACF,CAAC;AACN,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoC;IACpE,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC;IAC/C,IACE,CAAC,KAAK,CAAC,SAAS;QAChB,CAAC,MAAM,KAAK,SAAS;YACnB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC5B,MAAM,IAAI,CAAC;gBACX,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,iEAAiE,CAClE,CAAC;AACN,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  assertProjectionVerificationCurrent,\n  type PrincipalPolicyResolveRequest,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"../../data/keyingProjectionVerification/types\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { readPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport {\n  getOrCreatePrincipalPolicyCoordinator,\n  type PrincipalPolicyCoordinator,\n} from \"../../data/principals/principalPolicyCoordinator\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { RecoveredPrincipalHistoryPage } from \"./historyRecovery/loadRecoveredPrincipalHistoryPage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  PrincipalPolicyHistoryReadError,\n} from \"./historyRecovery/principalHistoryRecoveryTypes\";\nimport type { ScopedPrincipalPolicyRecovery } from \"./historyRecovery/recoverScopedPrincipalPolicyHistory\";\nimport {\n  apiPrincipalPolicyPageReader,\n  type PrincipalPolicyHistoryReader,\n} from \"./principalPolicyHistoryReader\";\nimport { createPrincipalCurrentRecoveryBatch } from \"./recoveryOperation/principalCurrentRecoveryBatch\";\nimport { recoverWithPrincipalLocalPreference } from \"./recoveryOperation/principalRecoveryLocalPreference\";\nimport { resumeAfterSupersededStage } from \"./recoveryOperation/supersededStageResume\";\n\nexport interface PrincipalPolicyRecoveryRuntime {\n  readonly apiClient: Partial<PrincipalPolicyHistoryReader>;\n  readonly infra: { readonly execSql: ExecSql };\n  readonly state?: { readonly online: boolean } | undefined;\n  readonly util: { readonly reportSecurityIncident: SecurityIncidentReporter };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\n/** Keep the private recovery key inside its runtime lease while resolving cited evidence. */\nexport function createRuntimePrincipalPolicyResolver(\n  runtime: PrincipalPolicyRecoveryRuntime,\n  options: { readonly preferLocalCurrent?: boolean } = {},\n): ReferencedPrincipalPolicyWarmer[\"resolveReference\"] {\n  const resolve = createRuntimePrincipalPolicyCurrentResolver(runtime);\n  return resolve\n    ? (input) =>\n        resolve({ ...input, preferLocalCurrent: options.preferLocalCurrent })\n    : undefined;\n}\n\nexport interface ResolvedPrincipalPolicyCurrent\n  extends ResolvedPrincipalPolicyEvidence {\n  readonly current: PrincipalPolicyPageCurrent;\n  /** Rows end at the selected reference; current/policy may describe a newer recovered head. */\n  readonly historyPage?: RecoveredPrincipalHistoryPage | undefined;\n}\n\ninterface PrincipalPolicyCurrentRequest\n  extends Omit<PrincipalPolicyResolveRequest, \"reference\"> {\n  readonly reference?: PrincipalPolicyResolveRequest[\"reference\"] | undefined;\n  /** A read-model caller has selected this exact signed head; not a freshness read. */\n  readonly preferLocalCurrent?: boolean | undefined;\n  readonly historyPage?: { readonly beforeVersion?: number } | undefined;\n}\n\ntype PrincipalCurrentRecoveryBatch = ReturnType<\n  typeof createPrincipalCurrentRecoveryBatch\n>;\n\n/**\n * Operation batches belong to the database's coordinator, keyed by the\n * operation token, so every resolver and warmer one operation creates for that\n * database shares one authenticated view. A batch dies with its token (the end\n * of the pass or workflow) and its entries with any organization hint.\n */\nconst operationBatches = new WeakMap<\n  PrincipalPolicyCoordinator,\n  WeakMap<object, PrincipalCurrentRecoveryBatch>\n>();\n\nfunction operationRecoveryBatch(\n  coordinator: PrincipalPolicyCoordinator,\n  operation: object | undefined,\n): PrincipalCurrentRecoveryBatch {\n  if (!operation) return createPrincipalCurrentRecoveryBatch();\n  let batches = operationBatches.get(coordinator);\n  if (!batches) {\n    batches = new WeakMap();\n    operationBatches.set(coordinator, batches);\n  }\n  let batch = batches.get(operation);\n  if (!batch) {\n    batch = createPrincipalCurrentRecoveryBatch();\n    batches.set(operation, batch);\n  }\n  return batch;\n}\n\n/** One recovery attempt for a resolver request through the operation's batch. */\nfunction recoverPolicyCurrent(\n  batch: ReturnType<typeof createPrincipalCurrentRecoveryBatch>,\n  options: Parameters<\n    ReturnType<typeof createPrincipalCurrentRecoveryBatch>[\"discover\"]\n  >[0],\n  input: PrincipalPolicyCurrentRequest,\n): Promise<ScopedPrincipalPolicyRecovery> {\n  return input.reference\n    ? recoverWithPrincipalLocalPreference(\n        batch.recover,\n        {\n          ...options,\n          reference: input.reference,\n          historyPage: input.historyPage,\n        },\n        input.preferLocalCurrent === true || input.preferLocalHistory === true,\n        input.preferLocalHistory === true,\n      )\n    : batch.discover(options);\n}\n\n/** Keep current artifacts with their verified evidence and private runtime lifetime. */\nexport function createRuntimePrincipalPolicyCurrentResolver(\n  runtime: PrincipalPolicyRecoveryRuntime,\n):\n  | ((\n      input: PrincipalPolicyCurrentRequest,\n    ) => Promise<ResolvedPrincipalPolicyCurrent>)\n  | undefined {\n  const lease = readPrincipalHistoryProtection(runtime);\n  const historyReader = apiPrincipalPolicyPageReader(runtime.apiClient);\n  if (!lease || !historyReader) return undefined;\n  const coordinator = getOrCreatePrincipalPolicyCoordinator(\n    runtime.infra.execSql,\n  );\n  return (input) =>\n    coordinator.queueRecovery(input.organizationId, () =>\n      runWithSecurityIncidentReporting(\n        runtime.util.reportSecurityIncident,\n        {\n          objectId: input.reference?.principalId ?? input.organizationId,\n          objectKind: \"principal\",\n          operation: \"principal.policy.recover\",\n          organizationId: input.organizationId,\n        },\n        () =>\n          lease(async ({ protection, stillCurrent: leaseCurrent }) => {\n            const stillCurrent = () =>\n              leaseCurrent() && input.stillCurrent?.() !== false;\n            assertProjectionVerificationCurrent(stillCurrent);\n            assertHistoryPageRequest(input);\n            const offline = runtime.state?.online === false;\n            try {\n              const options = {\n                historyReader,\n                execSql: runtime.infra.execSql,\n                offline,\n                organizationId: input.organizationId,\n                protection,\n                resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n                stillCurrent,\n              };\n              const result = await resumeAfterSupersededStage(\n                () =>\n                  recoverPolicyCurrent(\n                    operationRecoveryBatch(coordinator, input.recoveryBatch),\n                    options,\n                    input,\n                  ),\n                stillCurrent,\n              );\n              // Reused evidence stays bound to every producer lifetime.\n              const resultCurrent = () =>\n                stillCurrent() && result.stillCurrent();\n              assertProjectionVerificationCurrent(resultCurrent);\n              return {\n                current: result.current,\n                organizationId: input.organizationId,\n                policy: result.policy,\n                dependencies: result.dependencies,\n                historyPage: result.historyPage,\n                stillCurrent: resultCurrent,\n              };\n            } catch (error) {\n              assertProjectionVerificationCurrent(stillCurrent);\n              if (\n                error instanceof PrincipalPolicyHistoryReadError ||\n                error instanceof PrincipalHistoryRecoveryRaceError ||\n                (error instanceof KeyingVerificationError &&\n                  error.code === \"missing_dependency\")\n              )\n                throw new ProjectionDependencyUnavailableError(error.message);\n              throw error;\n            }\n          }),\n      ),\n    );\n}\n\nfunction assertHistoryPageRequest(input: PrincipalPolicyCurrentRequest) {\n  if (!input.historyPage) return;\n  const before = input.historyPage.beforeVersion;\n  if (\n    !input.reference ||\n    (before !== undefined &&\n      (!Number.isSafeInteger(before) ||\n        before <= 1 ||\n        before > input.reference.version + 1))\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"History display requires a selected head and an in-range cursor\",\n    );\n}\n"]}

package/workflows/principals/runtimePolicyWarmer.d.ts

@@ -0,0 +1,26 @@
+import { type ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification/types.js";
+import { type PrincipalPolicyRecoveryRuntime } from "./runtimePolicyRecovery.js";
+interface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {
+    readonly util: PrincipalPolicyRecoveryRuntime["util"] & {
+        readonly log?: ((message: string) => void) | undefined;
+    };
+}
+/**
+ * The token of one reconciliation pass or user workflow. Every warmer created
+ * with it shares one authenticated directory view, discovered once; the view
+ * dies with the token, an organization hint, a durable pin past it, or the end
+ * of its producing lease. Mint one at the pass or workflow root.
+ */
+export type PrincipalPolicyOperation = object;
+export declare function createPrincipalPolicyOperation(): PrincipalPolicyOperation;
+/**
+ * One warmer serves one workflow operation: either the `operation` its root
+ * minted, or a fresh one of its own. Its projection collections share one
+ * authenticated directory view per operation. Prefetch is best-effort; exact
+ * resolution still rejects unavailable evidence.
+ */
+export declare function createRuntimePrincipalPolicyWarmer(runtime: PrincipalPolicyWarmRuntime, options?: {
+    readonly preferLocalCurrent?: boolean;
+    readonly operation?: PrincipalPolicyOperation | undefined;
+}): ReferencedPrincipalPolicyWarmer;
+export {};

package/workflows/principals/runtimePolicyWarmer.js

@@ -4,15 +4,18 @@ import { assertProjectionVerificationCurrent, isProjectionVerificationCancelledE
 import { errorMessage } from "../../data/shared/errorMessage.js";
 import { createRuntimePrincipalPolicyResolver, } from "./runtimePolicyRecovery.js";
 import { createRuntimeProjectionPolicyResolver } from "./runtimeProjectionPolicyRecovery.js";
+export function createPrincipalPolicyOperation() {
+    return {};
+}
 /**
- * One warmer serves one workflow operation; create it per operation. Its
- * projection collections share one authenticated directory view, discovered
- * once per operation and discarded with the warmer. Prefetch is best-effort;
- * exact resolution still rejects unavailable evidence.
+ * One warmer serves one workflow operation: either the `operation` its root
+ * minted, or a fresh one of its own. Its projection collections share one
+ * authenticated directory view per operation. Prefetch is best-effort; exact
+ * resolution still rejects unavailable evidence.
  */
 export function createRuntimePrincipalPolicyWarmer(runtime, options = {}) {
     const resolve = createRuntimePrincipalPolicyResolver(runtime, options);
-    const operation = {};
+    const operation = options.operation ?? createPrincipalPolicyOperation();
     const resolveReference = async (input) => {
         if (!resolve)
             throw new ProjectionDependencyUnavailableError("Principal policies require private paged recovery");

package/workflows/principals/runtimePolicyWarmer.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,oCAAoC,GAErC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAW1F;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAmC,EACnC,UAAqD,EAAE;IAEvD,MAAM,OAAO,GAAG,oCAAoC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,gBAAgB,GAAmB,KAAK,EAAE,KAAK,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,oCAAoC,CAC5C,mDAAmD,CACpD,CAAC;QACJ,OAAO,OAAO,CAAC;YACb,GAAG,KAAK;YACR,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,SAAS;SAChD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAqD,EAAE,EAAE,CACxD,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,EACtD;QACE,gBAAgB;QAChB,wBAAwB,EAAE,qCAAqC,CAAC,OAAO,CAAC;KACzE,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAmC,EACnC,OAAuB,EACvB,KAAqD;IAErD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1D,0EAA0E;YAC1E,8BAA8B,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAChB,8BAA8B,SAAS,CAAC,WAAW,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { rethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  assertProjectionVerificationCurrent,\n  isProjectionVerificationCancelledError,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification/types\";\nimport { errorMessage } from \"../../data/shared/errorMessage\";\nimport {\n  createRuntimePrincipalPolicyResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"./runtimePolicyRecovery\";\nimport { createRuntimeProjectionPolicyResolver } from \"./runtimeProjectionPolicyRecovery\";\n\ntype PolicyResolver = NonNullable<\n  ReferencedPrincipalPolicyWarmer[\"resolveReference\"]\n>;\ninterface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {\n  readonly util: PrincipalPolicyRecoveryRuntime[\"util\"] & {\n    readonly log?: ((message: string) => void) | undefined;\n  };\n}\n\n/**\n * One warmer serves one workflow operation; create it per operation. Its\n * projection collections share one authenticated directory view, discovered\n * once per operation and discarded with the warmer. Prefetch is best-effort;\n * exact resolution still rejects unavailable evidence.\n */\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n  options: { readonly preferLocalCurrent?: boolean } = {},\n): ReferencedPrincipalPolicyWarmer {\n  const resolve = createRuntimePrincipalPolicyResolver(runtime, options);\n  const operation = {};\n  const resolveReference: PolicyResolver = async (input) => {\n    if (!resolve)\n      throw new ProjectionDependencyUnavailableError(\n        \"Principal policies require private paged recovery\",\n      );\n    return resolve({\n      ...input,\n      recoveryBatch: input.recoveryBatch ?? operation,\n    });\n  };\n  return Object.assign(\n    (input: Parameters<ReferencedPrincipalPolicyWarmer>[0]) =>\n      prefetchReferences(runtime, resolveReference, input),\n    {\n      resolveReference,\n      resolveProjectionHistory: createRuntimeProjectionPolicyResolver(runtime),\n    },\n  );\n}\n\nasync function prefetchReferences(\n  runtime: PrincipalPolicyWarmRuntime,\n  resolve: PolicyResolver,\n  input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n): Promise<void> {\n  for (const reference of input.references) {\n    try {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      const resolved = await resolve({ ...input, reference });\n      assertProjectionVerificationCurrent(resolved.stillCurrent);\n    } catch (error) {\n      if (isProjectionVerificationCancelledError(error)) return;\n      // Recovery already reports signature/authority failures. Keep them fatal.\n      rethrowKeyingVerificationError(error);\n      runtime.util.log?.(\n        `Principal policy prefetch: ${reference.principalId}: ${errorMessage(error)}`,\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,oCAAoC,GAErC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAmB1F,MAAM,UAAU,8BAA8B;IAC5C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAmC,EACnC,UAGI,EAAE;IAEN,MAAM,OAAO,GAAG,oCAAoC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,8BAA8B,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAmB,KAAK,EAAE,KAAK,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,oCAAoC,CAC5C,mDAAmD,CACpD,CAAC;QACJ,OAAO,OAAO,CAAC;YACb,GAAG,KAAK;YACR,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,SAAS;SAChD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAqD,EAAE,EAAE,CACxD,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,EACtD;QACE,gBAAgB;QAChB,wBAAwB,EAAE,qCAAqC,CAAC,OAAO,CAAC;KACzE,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAmC,EACnC,OAAuB,EACvB,KAAqD;IAErD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1D,0EAA0E;YAC1E,8BAA8B,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAChB,8BAA8B,SAAS,CAAC,WAAW,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { rethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  assertProjectionVerificationCurrent,\n  isProjectionVerificationCancelledError,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification/types\";\nimport { errorMessage } from \"../../data/shared/errorMessage\";\nimport {\n  createRuntimePrincipalPolicyResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"./runtimePolicyRecovery\";\nimport { createRuntimeProjectionPolicyResolver } from \"./runtimeProjectionPolicyRecovery\";\n\ntype PolicyResolver = NonNullable<\n  ReferencedPrincipalPolicyWarmer[\"resolveReference\"]\n>;\ninterface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {\n  readonly util: PrincipalPolicyRecoveryRuntime[\"util\"] & {\n    readonly log?: ((message: string) => void) | undefined;\n  };\n}\n\n/**\n * The token of one reconciliation pass or user workflow. Every warmer created\n * with it shares one authenticated directory view, discovered once; the view\n * dies with the token, an organization hint, a durable pin past it, or the end\n * of its producing lease. Mint one at the pass or workflow root.\n */\nexport type PrincipalPolicyOperation = object;\n\nexport function createPrincipalPolicyOperation(): PrincipalPolicyOperation {\n  return {};\n}\n\n/**\n * One warmer serves one workflow operation: either the `operation` its root\n * minted, or a fresh one of its own. Its projection collections share one\n * authenticated directory view per operation. Prefetch is best-effort; exact\n * resolution still rejects unavailable evidence.\n */\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n  options: {\n    readonly preferLocalCurrent?: boolean;\n    readonly operation?: PrincipalPolicyOperation | undefined;\n  } = {},\n): ReferencedPrincipalPolicyWarmer {\n  const resolve = createRuntimePrincipalPolicyResolver(runtime, options);\n  const operation = options.operation ?? createPrincipalPolicyOperation();\n  const resolveReference: PolicyResolver = async (input) => {\n    if (!resolve)\n      throw new ProjectionDependencyUnavailableError(\n        \"Principal policies require private paged recovery\",\n      );\n    return resolve({\n      ...input,\n      recoveryBatch: input.recoveryBatch ?? operation,\n    });\n  };\n  return Object.assign(\n    (input: Parameters<ReferencedPrincipalPolicyWarmer>[0]) =>\n      prefetchReferences(runtime, resolveReference, input),\n    {\n      resolveReference,\n      resolveProjectionHistory: createRuntimeProjectionPolicyResolver(runtime),\n    },\n  );\n}\n\nasync function prefetchReferences(\n  runtime: PrincipalPolicyWarmRuntime,\n  resolve: PolicyResolver,\n  input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n): Promise<void> {\n  for (const reference of input.references) {\n    try {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      const resolved = await resolve({ ...input, reference });\n      assertProjectionVerificationCurrent(resolved.stillCurrent);\n    } catch (error) {\n      if (isProjectionVerificationCancelledError(error)) return;\n      // Recovery already reports signature/authority failures. Keep them fatal.\n      rethrowKeyingVerificationError(error);\n      runtime.util.log?.(\n        `Principal policy prefetch: ${reference.principalId}: ${errorMessage(error)}`,\n      );\n    }\n  }\n}\n"]}