@tearleads/client-sdk 0.1.13 → 0.1.15

package/workflows/principals/publicPrincipalHistoryProgress.js

@@ -0,0 +1,178 @@
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, restorePrincipalPolicyHistoryVerifier, serializeKeyingCanonicalJson, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
+import { isReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
+import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { discardPrincipalHistoryPrefix, loadPrincipalHistoryPrefix, savePrincipalHistoryPrefix, } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import { discardPrincipalHistoryStage, loadPrincipalHistoryStage, } from "../../data/persistence/principalHistoryStagePersistence.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { principalHistoryEvidenceScopeId, principalHistoryPrefixProtection, } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { principalHistoryStageId, principalHistoryStageProtection, } from "../../data/principals/principalHistoryStageProtection.js";
+import { PublicHistoryAuthorityUnavailableError, parsePublicHistoryAuthority, publicHistoryAuthorityJson, validatePublicHistoryAuthority, } from "./publicPrincipalHistoryAuthority.js";
+async function restorePublicPrefix(input, scopeId, id, prefix) {
+    const head = input.source.head;
+    const historyInput = {
+        principalType: head.principalType,
+        principalId: head.principalId,
+    };
+    const current = () => !input.signal?.aborted && input.stillCurrent();
+    if (prefix) {
+        const authorityReference = parsePublicHistoryAuthority(input, prefix.currentJson);
+        let prefixHead;
+        try {
+            prefixHead = JSON.parse(prefix.headJson);
+        }
+        catch {
+            prefixHead = null;
+        }
+        if (prefix.organizationId === input.organizationId &&
+            authorityReference !== undefined &&
+            isReferencedPrincipalStateResponse(prefixHead) &&
+            prefixHead.principalId === head.principalId &&
+            prefixHead.principalType === head.principalType &&
+            prefixHead.version === prefix.version) {
+            const restored = await restorePrincipalPolicyHistoryVerifier(historyInput, prefix.progress, await principalHistoryPrefixProtection(input.protection, prefix));
+            if (restored.ok && restored.value.finish(prefixHead).ok) {
+                await validatePublicHistoryAuthority(input, authorityReference, prefix);
+                return {
+                    id,
+                    scopeId,
+                    verifier: restored.value,
+                    completedHead: prefixHead.version >= head.version ? prefixHead : null,
+                    afterVersion: Math.min(prefixHead.version, head.version - 1),
+                    saved: null,
+                    cachedPrefix: prefix,
+                    authorityReference,
+                };
+            }
+        }
+        if (!input.offline)
+            await discardPrincipalHistoryPrefix({
+                execSql: input.execSql,
+                prefix,
+                stillCurrent: current,
+            });
+    }
+    return null;
+}
+export async function restorePublicPrincipalHistoryProgress(input, allowReuse) {
+    const head = input.source.head;
+    const historyInput = {
+        principalType: head.principalType,
+        principalId: head.principalId,
+    };
+    const scopeId = await principalHistoryEvidenceScopeId({
+        organizationId: input.organizationId,
+        head,
+        protection: input.protection,
+    });
+    const id = await principalHistoryStageId(input.organizationId, head, input.protection.context);
+    const current = () => !input.signal?.aborted && input.stillCurrent();
+    const saved = await loadPrincipalHistoryStage(input.execSql, id);
+    if (saved) {
+        const authorityReference = parsePublicHistoryAuthority(input, saved.currentJson);
+        if (allowReuse &&
+            saved.organizationId === input.organizationId &&
+            authorityReference !== undefined) {
+            const restored = await restorePrincipalPolicyHistoryVerifier(historyInput, saved.progress, await principalHistoryStageProtection(input.protection, head, saved));
+            if (restored.ok && (!saved.complete || restored.value.finish(head).ok)) {
+                await validatePublicHistoryAuthority(input, authorityReference);
+                return {
+                    id,
+                    scopeId,
+                    verifier: restored.value,
+                    completedHead: saved.complete ? head : null,
+                    afterVersion: saved.afterVersion,
+                    saved,
+                    cachedPrefix: null,
+                    authorityReference,
+                };
+            }
+        }
+        if (!input.offline)
+            await discardPrincipalHistoryStage(input.execSql, saved, current);
+    }
+    if (allowReuse) {
+        const prefix = await restorePublicPrefix(input, scopeId, id, await loadPrincipalHistoryPrefix(input.execSql, scopeId));
+        if (prefix)
+            return prefix;
+    }
+    return {
+        id,
+        scopeId,
+        verifier: createPrincipalPolicyHistoryVerifier(historyInput),
+        completedHead: null,
+        afterVersion: 0,
+        saved: null,
+        cachedPrefix: null,
+        authorityReference: null,
+    };
+}
+/** A resumed stage may finish after the reader that rejected the prefix exits. */
+async function rejectedCompletedPrefix(input, progress, history) {
+    const candidate = await loadPrincipalHistoryPrefix(input.execSql, progress.scopeId);
+    if (!candidate || candidate.version <= history.currentEntry.state.version)
+        return null;
+    try {
+        const cached = await restorePublicPrefix(input, progress.scopeId, progress.id, candidate);
+        if (!cached?.completedHead)
+            return null;
+        const finished = cached.verifier.finish(cached.completedHead);
+        if (!finished.ok)
+            throw finished.error;
+        const proof = await loadPrincipalHistoryReference({
+            execSql: input.execSql,
+            scopeId: progress.scopeId,
+            history: finished.value,
+            version: input.source.head.version,
+        });
+        const verified = await verifyPrincipalPolicyHistoryReferences({
+            history: finished.value,
+            references: [proof],
+        });
+        if (!verified.ok)
+            throw verified.error;
+        return principalHeadMatchesReference(proof.entry.state, input.source.head)
+            ? null
+            : candidate;
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError ||
+            error instanceof PublicHistoryAuthorityUnavailableError)
+            return candidate;
+        throw error;
+    }
+}
+export async function publishPublicPrincipalHistoryPrefix(input, progress, history, rejectedPrefix) {
+    const state = history.currentEntry.state;
+    const head = {
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        stateHash: state.stateHash,
+        keyEpoch: state.keyEpoch,
+        keyFingerprint: state.keyFingerprint,
+    };
+    const prefix = {
+        scopeId: progress.scopeId,
+        organizationId: input.organizationId,
+        version: head.version,
+        headJson: serializeKeyingCanonicalJson(head),
+        currentJson: publicHistoryAuthorityJson(progress.authorityReference),
+    };
+    const sealed = await progress.verifier.exportProgress(await principalHistoryPrefixProtection(input.protection, prefix));
+    if (!sealed.ok)
+        throw sealed.error;
+    const rejected = rejectedPrefix ??
+        (progress.cachedPrefix
+            ? null
+            : await rejectedCompletedPrefix(input, progress, history));
+    const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();
+    await savePrincipalHistoryPrefix({
+        execSql: input.execSql,
+        prefix: { ...prefix, progress: sealed.value },
+        stillCurrent,
+        rejectedPrefix: rejected,
+    });
+    if (progress.saved)
+        await discardPrincipalHistoryStage(input.execSql, progress.saved, stillCurrent);
+}
+//# sourceMappingURL=publicPrincipalHistoryProgress.js.map

package/workflows/principals/publicPrincipalHistoryProgress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicPrincipalHistoryProgress.js","sourceRoot":"","sources":["publicPrincipalHistoryProgress.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,qCAAqC,EACrC,4BAA4B,EAE5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAE1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,sCAAsC,EACtC,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAM3C,KAAK,UAAU,mBAAmB,CAChC,KAAoC,EACpC,OAAe,EACf,EAAU,EACV,MAAqC;IAErC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC9C,kBAAkB,KAAK,SAAS;YAChC,kCAAkC,CAAC,UAAU,CAAC;YAC9C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAC3C,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC/C,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EACrC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,MAAM,CAAC,QAAQ,EACf,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBACxE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;oBACrE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;oBAC5D,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,MAAM;oBACpB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,6BAA6B,CAAC;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM;gBACN,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAoC,EACpC,UAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,IAAI,EACJ,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IACE,UAAU;YACV,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC7C,kBAAkB,KAAK,SAAS,EAChC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CACrE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvE,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBAChE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK;oBACL,YAAY,EAAE,IAAI;oBAClB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,OAAO,EACP,EAAE,EACF,MAAM,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CACzD,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,CAAC;QACf,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,uBAAuB,CACpC,KAAoC,EACpC,QAAwC,EACxC,OAAuC;IAEvC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QACvE,OAAO,IAAI,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,EAAE,EACX,SAAS,CACV,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,UAAU,EAAE,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACxE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,uBAAuB;YACxC,KAAK,YAAY,sCAAsC;YAEvD,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAoC,EACpC,QAAwC,EACxC,OAAuC,EACvC,cAA6C;IAE7C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,4BAA4B,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACrE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,QAAQ,GACZ,cAAc;QACd,CAAC,QAAQ,CAAC,YAAY;YACpB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,0BAA0B,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY;QACZ,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK;QAChB,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,KAAK,EACd,YAAY,CACb,CAAC;AACN,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  restorePrincipalPolicyHistoryVerifier,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyHistory,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryPrefix,\n  loadPrincipalHistoryPrefix,\n  type PrincipalHistoryPrefix,\n  savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalHistoryEvidenceScopeId,\n  principalHistoryPrefixProtection,\n} from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport {\n  PublicHistoryAuthorityUnavailableError,\n  parsePublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  validatePublicHistoryAuthority,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nasync function restorePublicPrefix(\n  input: PublicPrincipalHistoryOptions,\n  scopeId: string,\n  id: string,\n  prefix: PrincipalHistoryPrefix | null,\n): Promise<PublicPrincipalHistoryProgress | null> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  if (prefix) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      prefix.currentJson,\n    );\n    let prefixHead: unknown;\n    try {\n      prefixHead = JSON.parse(prefix.headJson);\n    } catch {\n      prefixHead = null;\n    }\n    if (\n      prefix.organizationId === input.organizationId &&\n      authorityReference !== undefined &&\n      isReferencedPrincipalStateResponse(prefixHead) &&\n      prefixHead.principalId === head.principalId &&\n      prefixHead.principalType === head.principalType &&\n      prefixHead.version === prefix.version\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        prefix.progress,\n        await principalHistoryPrefixProtection(input.protection, prefix),\n      );\n      if (restored.ok && restored.value.finish(prefixHead).ok) {\n        await validatePublicHistoryAuthority(input, authorityReference, prefix);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: prefixHead.version >= head.version ? prefixHead : null,\n          afterVersion: Math.min(prefixHead.version, head.version - 1),\n          saved: null,\n          cachedPrefix: prefix,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryPrefix({\n        execSql: input.execSql,\n        prefix,\n        stillCurrent: current,\n      });\n  }\n  return null;\n}\n\nexport async function restorePublicPrincipalHistoryProgress(\n  input: PublicPrincipalHistoryOptions,\n  allowReuse: boolean,\n): Promise<PublicPrincipalHistoryProgress> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    head,\n    input.protection.context,\n  );\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      saved.currentJson,\n    );\n    if (\n      allowReuse &&\n      saved.organizationId === input.organizationId &&\n      authorityReference !== undefined\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(input.protection, head, saved),\n      );\n      if (restored.ok && (!saved.complete || restored.value.finish(head).ok)) {\n        await validatePublicHistoryAuthority(input, authorityReference);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: saved.complete ? head : null,\n          afterVersion: saved.afterVersion,\n          saved,\n          cachedPrefix: null,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryStage(input.execSql, saved, current);\n  }\n  if (allowReuse) {\n    const prefix = await restorePublicPrefix(\n      input,\n      scopeId,\n      id,\n      await loadPrincipalHistoryPrefix(input.execSql, scopeId),\n    );\n    if (prefix) return prefix;\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    completedHead: null,\n    afterVersion: 0,\n    saved: null,\n    cachedPrefix: null,\n    authorityReference: null,\n  };\n}\n\n/** A resumed stage may finish after the reader that rejected the prefix exits. */\nasync function rejectedCompletedPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n): Promise<PrincipalHistoryPrefix | null> {\n  const candidate = await loadPrincipalHistoryPrefix(\n    input.execSql,\n    progress.scopeId,\n  );\n  if (!candidate || candidate.version <= history.currentEntry.state.version)\n    return null;\n  try {\n    const cached = await restorePublicPrefix(\n      input,\n      progress.scopeId,\n      progress.id,\n      candidate,\n    );\n    if (!cached?.completedHead) return null;\n    const finished = cached.verifier.finish(cached.completedHead);\n    if (!finished.ok) throw finished.error;\n    const proof = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId: progress.scopeId,\n      history: finished.value,\n      version: input.source.head.version,\n    });\n    const verified = await verifyPrincipalPolicyHistoryReferences({\n      history: finished.value,\n      references: [proof],\n    });\n    if (!verified.ok) throw verified.error;\n    return principalHeadMatchesReference(proof.entry.state, input.source.head)\n      ? null\n      : candidate;\n  } catch (error) {\n    if (\n      error instanceof KeyingVerificationError ||\n      error instanceof PublicHistoryAuthorityUnavailableError\n    )\n      return candidate;\n    throw error;\n  }\n}\n\nexport async function publishPublicPrincipalHistoryPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n  rejectedPrefix: PrincipalHistoryPrefix | null,\n): Promise<void> {\n  const state = history.currentEntry.state;\n  const head = {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n  const prefix = {\n    scopeId: progress.scopeId,\n    organizationId: input.organizationId,\n    version: head.version,\n    headJson: serializeKeyingCanonicalJson(head),\n    currentJson: publicHistoryAuthorityJson(progress.authorityReference),\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryPrefixProtection(input.protection, prefix),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const rejected =\n    rejectedPrefix ??\n    (progress.cachedPrefix\n      ? null\n      : await rejectedCompletedPrefix(input, progress, history));\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  await savePrincipalHistoryPrefix({\n    execSql: input.execSql,\n    prefix: { ...prefix, progress: sealed.value },\n    stillCurrent,\n    rejectedPrefix: rejected,\n  });\n  if (progress.saved)\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      progress.saved,\n      stillCurrent,\n    );\n}\n"]}

package/workflows/principals/publicPrincipalHistoryTypes.d.ts

@@ -0,0 +1,39 @@
+import type { ApiClient } from "../../internal/api-client/index.js";
+import type { PrincipalPolicyExternalAuthority, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryVerifier, ReferencedPrincipalHead, VerifiedPrincipalPolicyHistory } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyHistorySourceResponse } from "../../internal/validators/response/index.js";
+import type { PrincipalHistoryPrefix } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import type { PrincipalHistoryStage } from "../../data/persistence/principalHistoryStagePersistence.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
+export interface PublicPrincipalHistoryOptions {
+    readonly apiClient: Pick<ApiClient, "getProjectionPolicyHistoryPages">;
+    readonly source: PrincipalPolicyHistorySourceResponse;
+    readonly organizationId: string;
+    readonly execSql: ExecSql;
+    readonly protection: PrincipalPolicyHistoryProgressOptions;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly stillCurrent: () => boolean;
+    readonly signal?: AbortSignal | undefined;
+    readonly offline?: boolean | undefined;
+    /** Retry disposable evidence loss once from signatures, without reusing hints. */
+    readonly replay?: boolean | undefined;
+    readonly strictAdmins?: boolean | undefined;
+    /** Already verified organization binding; included in the protected cache scope. */
+    readonly authorityGroupId?: string | undefined;
+    readonly loadExternalAuthority?: ((references: readonly ReferencedPrincipalHead[], cachedPrefix?: boolean) => Promise<PrincipalPolicyExternalAuthority | undefined>) | undefined;
+}
+export interface PublicPrincipalHistoryProgress {
+    readonly id: string;
+    readonly scopeId: string;
+    readonly verifier: PrincipalPolicyHistoryVerifier;
+    readonly completedHead: ReferencedPrincipalHead | null;
+    readonly afterVersion: number;
+    readonly saved: PrincipalHistoryStage | null;
+    readonly cachedPrefix: PrincipalHistoryPrefix | null;
+    readonly authorityReference: ReferencedPrincipalHead | null;
+}
+/** Public authorization only; caller must check directory binding and local pins. */
+export interface RecoveredPublicPrincipalHistory {
+    readonly scopeId: string;
+    readonly history: VerifiedPrincipalPolicyHistory;
+}

package/workflows/principals/publicPrincipalHistoryTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=publicPrincipalHistoryTypes.js.map

package/workflows/principals/publicPrincipalHistoryTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicPrincipalHistoryTypes.js","sourceRoot":"","sources":["publicPrincipalHistoryTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyHistorySourceResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\nexport interface PublicPrincipalHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getProjectionPolicyHistoryPages\">;\n  readonly source: PrincipalPolicyHistorySourceResponse;\n  readonly organizationId: string;\n  readonly execSql: ExecSql;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n  readonly offline?: boolean | undefined;\n  /** Retry disposable evidence loss once from signatures, without reusing hints. */\n  readonly replay?: boolean | undefined;\n  readonly strictAdmins?: boolean | undefined;\n  /** Already verified organization binding; included in the protected cache scope. */\n  readonly authorityGroupId?: string | undefined;\n  readonly loadExternalAuthority?:\n    | ((\n        references: readonly ReferencedPrincipalHead[],\n        cachedPrefix?: boolean,\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n}\n\nexport interface PublicPrincipalHistoryProgress {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly completedHead: ReferencedPrincipalHead | null;\n  readonly afterVersion: number;\n  readonly saved: PrincipalHistoryStage | null;\n  readonly cachedPrefix: PrincipalHistoryPrefix | null;\n  readonly authorityReference: ReferencedPrincipalHead | null;\n}\n\n/** Public authorization only; caller must check directory binding and local pins. */\nexport interface RecoveredPublicPrincipalHistory {\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}\n"]}

package/workflows/principals/publicProjectionDirectory.js

@@ -0,0 +1,40 @@
+import { computePrincipalStatePayloadCiphertextHash, } from "../../internal/crypto/index.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { rejectPublicProjection, selectPublicProjectionPrincipal, } from "./publicProjectionPrincipal.js";
+export async function publicProjectionDirectoryBindings(evidence, organization) {
+    const policies = await selectPublicProjectionPrincipal(organization);
+    const entries = policies.flatMap((policy) => policy.retainedHistory);
+    const descriptors = [];
+    const seen = new Set();
+    for (const { reference, payload } of evidence.organizationPayloads) {
+        const state = entries.find(({ state }) => principalHeadMatchesReference(state, reference))?.state;
+        if (!state ||
+            reference.version > organization.options.source.head.version ||
+            payload.principalType !== "organization" ||
+            payload.principalId !== organization.options.organizationId ||
+            payload.stateHash !== state.stateHash ||
+            seen.has(state.stateHash))
+            rejectPublicProjection("directory payload scope is invalid");
+        seen.add(state.stateHash);
+        const hash = await computePrincipalStatePayloadCiphertextHash(payload.ciphertext);
+        if (hash !== payload.ciphertextHash || hash !== state.payloadCiphertextHash)
+            rejectPublicProjection("directory payload differs from its signed hash");
+        const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);
+        if (descriptor.organizationId !== organization.options.organizationId)
+            rejectPublicProjection("directory belongs to another organization");
+        descriptors.push(descriptor);
+    }
+    const bindings = new Map();
+    for (const source of evidence.groups) {
+        if (source.head.principalType !== "group" ||
+            bindings.has(source.head.principalId))
+            rejectPublicProjection("group sources have invalid or repeated scopes");
+        const directory = descriptors.find((candidate) => candidate.groupHeads.some((head) => principalHeadMatchesReference(head, source.head)));
+        const adminHead = directory?.groupHeads.find((head) => head.principalId === directory.adminGroupId);
+        if (!adminHead)
+            rejectPublicProjection("group source lacks its signed directory binding");
+        bindings.set(source.head.principalId, { adminHead });
+    }
+    return bindings;
+}
+//# sourceMappingURL=publicProjectionDirectory.js.map

package/workflows/principals/publicProjectionDirectory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicProjectionDirectory.js","sourceRoot":"","sources":["publicProjectionDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,GAE3C,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAEL,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,QAA0C,EAC1C,YAAuC;IAEvC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACvC,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD,EAAE,KAAK,CAAC;QACT,IACE,CAAC,KAAK;YACN,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5D,OAAO,CAAC,aAAa,KAAK,cAAc;YACxC,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC,OAAO,CAAC,cAAc;YAC3D,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAEzB,sBAAsB,CAAC,oCAAoC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,IAAI,KAAK,OAAO,CAAC,cAAc,IAAI,IAAI,KAAK,KAAK,CAAC,qBAAqB;YACzE,sBAAsB,CAAC,gDAAgD,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,oCAAoC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,cAAc,KAAK,YAAY,CAAC,OAAO,CAAC,cAAc;YACnE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;QACtE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkD,CAAC;IAC3E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IACE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO;YACrC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAErC,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,6BAA6B,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CACjD,CACF,CAAC;QACF,MAAM,SAAS,GAAG,SAAS,EAAE,UAAU,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,YAAY,CACtD,CAAC;QACF,IAAI,CAAC,SAAS;YACZ,sBAAsB,CAAC,iDAAiD,CAAC,CAAC;QAC5E,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computePrincipalStatePayloadCiphertextHash,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  type PublicProjectionPrincipal,\n  rejectPublicProjection,\n  selectPublicProjectionPrincipal,\n} from \"./publicProjectionPrincipal\";\n\nexport async function publicProjectionDirectoryBindings(\n  evidence: ProjectionPolicyEvidenceResponse,\n  organization: PublicProjectionPrincipal,\n) {\n  const policies = await selectPublicProjectionPrincipal(organization);\n  const entries = policies.flatMap((policy) => policy.retainedHistory);\n  const descriptors = [];\n  const seen = new Set<string>();\n  for (const { reference, payload } of evidence.organizationPayloads) {\n    const state = entries.find(({ state }) =>\n      principalHeadMatchesReference(state, reference),\n    )?.state;\n    if (\n      !state ||\n      reference.version > organization.options.source.head.version ||\n      payload.principalType !== \"organization\" ||\n      payload.principalId !== organization.options.organizationId ||\n      payload.stateHash !== state.stateHash ||\n      seen.has(state.stateHash)\n    )\n      rejectPublicProjection(\"directory payload scope is invalid\");\n    seen.add(state.stateHash);\n    const hash = await computePrincipalStatePayloadCiphertextHash(\n      payload.ciphertext,\n    );\n    if (hash !== payload.ciphertextHash || hash !== state.payloadCiphertextHash)\n      rejectPublicProjection(\"directory payload differs from its signed hash\");\n    const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);\n    if (descriptor.organizationId !== organization.options.organizationId)\n      rejectPublicProjection(\"directory belongs to another organization\");\n    descriptors.push(descriptor);\n  }\n  const bindings = new Map<string, { adminHead: ReferencedPrincipalHead }>();\n  for (const source of evidence.groups) {\n    if (\n      source.head.principalType !== \"group\" ||\n      bindings.has(source.head.principalId)\n    )\n      rejectPublicProjection(\"group sources have invalid or repeated scopes\");\n    const directory = descriptors.find((candidate) =>\n      candidate.groupHeads.some((head) =>\n        principalHeadMatchesReference(head, source.head),\n      ),\n    );\n    const adminHead = directory?.groupHeads.find(\n      (head) => head.principalId === directory.adminGroupId,\n    );\n    if (!adminHead)\n      rejectPublicProjection(\"group source lacks its signed directory binding\");\n    bindings.set(source.head.principalId, { adminHead });\n  }\n  return bindings;\n}\n"]}

package/workflows/principals/publicProjectionPrincipal.js

@@ -0,0 +1,53 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+import { recoverPublicPrincipalHistory } from "./recoverPublicPrincipalHistory.js";
+import { selectPublicPrincipalHistory } from "./selectPublicPrincipalHistory.js";
+/** The source head and every citation remain bound independently of a newer prefix. */
+export async function selectPublicProjectionPrincipal(principal, references = principal.references) {
+    const { options } = principal;
+    const current = () => !options.signal?.aborted && options.stillCurrent();
+    assertProjectionVerificationCurrent(current);
+    const checkpoint = await loadPrincipalPolicyCheckpoint(options.execSql, options.source.head.principalType, options.source.head.principalId);
+    try {
+        return await selectPublicPrincipalHistory({
+            execSql: options.execSql,
+            recovered: principal.recovered,
+            references: [options.source.head, ...references],
+            checkpoint,
+            includeGenesis: options.source.head.principalType === "organization",
+            stillCurrent: current,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))
+            throw error;
+        if (options.offline || principal.replayed)
+            throw error.verificationError;
+        principal.replayed = true;
+        principal.recovered = await recoverPublicPrincipalHistory({
+            ...options,
+            replay: true,
+        });
+        return selectPublicProjectionPrincipal(principal, references);
+    }
+}
+export async function recoverPublicProjectionPrincipal(options, references) {
+    const selected = references.filter((head) => head.principalType === options.source.head.principalType &&
+        head.principalId === options.source.head.principalId);
+    if (selected.some((head) => head.version > options.source.head.version))
+        rejectPublicProjection("citation exceeds its supplied source head");
+    const principal = {
+        options,
+        references: structuredClone(selected),
+        recovered: await recoverPublicPrincipalHistory(options),
+        replayed: false,
+    };
+    await selectPublicProjectionPrincipal(principal);
+    return principal;
+}
+export function rejectPublicProjection(message) {
+    throw new KeyingVerificationError("object_mismatch", `Public projection history: ${message}`);
+}
+//# sourceMappingURL=publicProjectionPrincipal.js.map

package/workflows/principals/publicProjectionPrincipal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicProjectionPrincipal.js","sourceRoot":"","sources":["publicProjectionPrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAKhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAS9E,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAoC,EACpC,aAAiD,SAAS,CAAC,UAAU;IAErE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAChC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC;YAChD,UAAU;YACV,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc;YACpE,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAwC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC,iBAAiB,CAAC;QACzE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,SAAS,GAAG,MAAM,6BAA6B,CAAC;YACxD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,+BAA+B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAsC,EACtC,UAA8C;IAE9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;QACxD,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACrE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC;QACvD,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8BAA8B,OAAO,EAAE,CACxC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  RecoveredPublicPrincipalHistory,\n} from \"./publicPrincipalHistoryTypes\";\nimport { recoverPublicPrincipalHistory } from \"./recoverPublicPrincipalHistory\";\nimport { selectPublicPrincipalHistory } from \"./selectPublicPrincipalHistory\";\n\nexport interface PublicProjectionPrincipal {\n  readonly options: PublicPrincipalHistoryOptions;\n  readonly references: readonly ReferencedPrincipalHead[];\n  recovered: RecoveredPublicPrincipalHistory;\n  replayed: boolean;\n}\n\n/** The source head and every citation remain bound independently of a newer prefix. */\nexport async function selectPublicProjectionPrincipal(\n  principal: PublicProjectionPrincipal,\n  references: readonly ReferencedPrincipalHead[] = principal.references,\n) {\n  const { options } = principal;\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.source.head.principalType,\n    options.source.head.principalId,\n  );\n  try {\n    return await selectPublicPrincipalHistory({\n      execSql: options.execSql,\n      recovered: principal.recovered,\n      references: [options.source.head, ...references],\n      checkpoint,\n      includeGenesis: options.source.head.principalType === \"organization\",\n      stillCurrent: current,\n    });\n  } catch (error) {\n    if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))\n      throw error;\n    if (options.offline || principal.replayed) throw error.verificationError;\n    principal.replayed = true;\n    principal.recovered = await recoverPublicPrincipalHistory({\n      ...options,\n      replay: true,\n    });\n    return selectPublicProjectionPrincipal(principal, references);\n  }\n}\n\nexport async function recoverPublicProjectionPrincipal(\n  options: PublicPrincipalHistoryOptions,\n  references: readonly ReferencedPrincipalHead[],\n): Promise<PublicProjectionPrincipal> {\n  const selected = references.filter(\n    (head) =>\n      head.principalType === options.source.head.principalType &&\n      head.principalId === options.source.head.principalId,\n  );\n  if (selected.some((head) => head.version > options.source.head.version))\n    rejectPublicProjection(\"citation exceeds its supplied source head\");\n  const principal = {\n    options,\n    references: structuredClone(selected),\n    recovered: await recoverPublicPrincipalHistory(options),\n    replayed: false,\n  };\n  await selectPublicProjectionPrincipal(principal);\n  return principal;\n}\n\nexport function rejectPublicProjection(message: string): never {\n  throw new KeyingVerificationError(\n    \"object_mismatch\",\n    `Public projection history: ${message}`,\n  );\n}\n"]}

package/workflows/principals/recoverPrincipalPolicyHistory.js

@@ -6,6 +6,7 @@ import { discardPrincipalHistoryStage, savePrincipalHistoryStage, } from "../../
 import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
 import { principalHistoryStageProtection } from "../../data/principals/principalHistoryStageProtection.js";
 import { collectPrincipalPolicySignerPublicKeys } from "./policyVerification.js";
+import { validatePrincipalHistoryRecoveryAuthority } from "./principalHistoryRecoveryAuthority.js";
 import { publishReusablePrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
 import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "./principalHistoryRecoveryReferences.js";
 import { restorePrincipalHistoryRecoveryStage, } from "./principalHistoryRecoveryStage.js";
@@ -74,7 +75,7 @@ async function acceptPage(input, stage, response) {
     });
     if ("error" in keys)
         throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Principal history signer identity could not be authenticated");
-    const externalAuthority = await input.loadExternalAuthority?.(entries);
+    const externalAuthority = await input.loadExternalAuthority?.(entries.flatMap(({ state }) => state.externalAuthority ? [state.externalAuthority] : []));
     const appended = await stage.verifier.append({
         entries,
         signerPublicKeys: keys.signerPublicKeys,
@@ -196,6 +197,8 @@ async function recover(input, allowEvidenceRebuild = true) {
     };
     const stage = await restorePrincipalHistoryRecoveryStage(input, historyInput, allowEvidenceRebuild);
     try {
+        if (stage.fromCache)
+            await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);
         await readRecoveryPages(input, stage);
         return await finishRecovery(input, stage, checkpoint);
     }

package/workflows/principals/recoverPrincipalPolicyHistory.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EAGvB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,uCAAwC,SAAQ,KAAK;IACpC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAC;IACxD,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C;IAE3C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC,EACnC,YAAkE;IAElE,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,sCAAsC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,uCAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAA2C,EAC3C,KAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,+BAA+B,CAAC;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;QACpC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QACjC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,qCAAqC,CACzC,KAAK,EACL,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2C,EAC3C,KAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;YACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACjD,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;AACN,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAA2C,EAC3C,oBAAoB,GAAG,IAAI;IAE3B,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,EACjD,2DAA2D,CAC5D,CAAC;IACJ,8EAA8E;IAC9E,oCAAoC,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CACtD,KAAK,EACL,YAAY,EACZ,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAChB,KAAK,YAAY,wCAAwC,CAAC;QAC5D,MAAM,YAAY,GAChB,KAAK,YAAY,uCAAuC,CAAC;QAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;YAAE,MAAM,KAAK,CAAC;QAChD,IAAI,KAAK,CAAC,KAAK;YACb,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;QACJ,IACE,CAAC,KAAK,CAAC,OAAO;YACd,oBAAoB;YACpB,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,CAAC;YAEjC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,UAAU;QAC9D,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryInput,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  savePrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport { publishReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalHistoryEvidenceUnavailableError,\n  selectRecoveredPrincipalHistory,\n} from \"./principalHistoryRecoveryReferences\";\nimport {\n  type PrincipalHistoryRecoveryStage,\n  restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n  assertPrincipalHistoryVerificationMode,\n  principalHistoryVerificationContext,\n} from \"./principalHistoryRecoveryVerification\";\n\nclass PrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\nfunction currentArtifacts(\n  page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n\nfunction recoveryIsCurrent(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): boolean {\n  return !input.signal?.aborted && input.stillCurrent();\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n  assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));\n}\n\nfunction assertExpectedHead(\n  current: PrincipalPolicyPageCurrent,\n  expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): void {\n  for (const field of [\n    \"principalType\",\n    \"principalId\",\n    \"version\",\n    \"stateHash\",\n    \"keyEpoch\",\n    \"keyFingerprint\",\n  ] as const) {\n    if (current.currentState[field] !== expectedHead[field])\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Principal history page does not match its requested head\",\n      );\n  }\n}\n\nasync function acceptPage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  response: PrincipalPolicyPageResponse,\n): Promise<void> {\n  const page = structuredClone(response);\n  assertCurrent(input);\n  assertExpectedHead(page, input.expectedHead);\n  if (stage.complete) {\n    if (\n      page.previousStates.length !== 0 ||\n      page.historyPage.nextAfterVersion !== null\n    )\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Completed history returned additional entries\",\n      );\n    stage.current = currentArtifacts(page);\n    return;\n  }\n  const complete = page.historyPage.nextAfterVersion === null;\n  const current = currentArtifacts(page);\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n  assertPrincipalHistoryVerificationMode(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: { ...current, previousStates: page.previousStates },\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Principal history signer identity could not be authenticated\",\n    );\n  const externalAuthority = await input.loadExternalAuthority?.(entries);\n  const appended = await stage.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const next = {\n    id: stage.id,\n    organizationId: input.organizationId,\n    currentJson: JSON.stringify(current),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const protectedProgress = await stage.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.expectedHead,\n      next,\n    ),\n  );\n  if (!protectedProgress.ok) throw protectedProgress.error;\n  const saved = { ...next, progress: protectedProgress.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      scopeId: stage.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: stage.saved?.progress ?? null,\n    stillCurrent: () => recoveryIsCurrent(input),\n  });\n  stage.current = current;\n  stage.saved = saved;\n  stage.complete = complete;\n}\n\nasync function finishRecovery(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (!stage.current || !stage.complete)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history ended before its pinned head\",\n    );\n  const history = stage.verifier.finish(input.expectedHead);\n  if (!history.ok) throw history.error;\n  const selected = await selectRecoveredPrincipalHistory({\n    options: input,\n    scopeId: stage.scopeId,\n    history: history.value,\n    checkpoint,\n  });\n  const current = await verifyPrincipalPolicyCurrent({\n    current: stage.current,\n    history: selected,\n  });\n  if (!current.ok) throw current.error;\n  verifyPrincipalPolicyCheckpoint({\n    chain: current.value.retainedHistory,\n    currentState: current.value.state,\n    localCheckpoint: checkpoint,\n  });\n  const latest = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Local principal checkpoint changed during history recovery\",\n    );\n  assertCurrent(input);\n  if (!input.offline)\n    await publishReusablePrincipalHistoryPrefix(\n      input,\n      stage.scopeId,\n      stage.verifier,\n      stage.current,\n    );\n  assertCurrent(input);\n  return { current: stage.current, policy: current.value };\n}\n\nasync function readRecoveryPages(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n): Promise<void> {\n  if (input.offline) {\n    if (!stage.complete || !stage.current)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Completed principal history is unavailable offline\",\n      );\n    assertExpectedHead(stage.current, input.expectedHead);\n    return;\n  }\n  let receivedFinalPage = false;\n  for await (const result of input.apiClient.getPrincipalPolicyPages(\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n    {\n      signal: input.signal,\n      stateHash: input.expectedHead.stateHash,\n      ...(stage.saved && stage.current\n        ? {\n            resume: {\n              current: stage.current,\n              afterVersion: stage.saved.afterVersion,\n            },\n          }\n        : { afterVersion: stage.initialAfterVersion }),\n    },\n  )) {\n    if (!result.ok) {\n      // A rejected transport pin cannot justify skipping history on retry.\n      // Discard only this operation's progress, then let a new call replay it.\n      if (result.kind === \"shape\" && stage.saved)\n        await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n          recoveryIsCurrent(input),\n        );\n      throw new PrincipalPolicyHistoryReadError(result);\n    }\n    await acceptPage(input, stage, result.data);\n    receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n  }\n  if (!receivedFinalPage)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history transport did not complete\",\n    );\n}\n\nasync function recover(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  allowEvidenceRebuild = true,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  assertCurrent(input);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (checkpoint && input.expectedHead.version < checkpoint.version)\n    throw new KeyingVerificationError(\n      input.offline ? \"missing_dependency\" : \"rollback\",\n      \"Requested principal history predates the local checkpoint\",\n    );\n  // Validate the requested pin/selection before creating any disposable caches.\n  createPrincipalPolicyHistoryVerifier({\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n    localCheckpoint: checkpoint,\n    retainedReferences: input.retainedReferences ?? [],\n  });\n  const historyInput: PrincipalPolicyHistoryInput = {\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n  };\n  const stage = await restorePrincipalHistoryRecoveryStage(\n    input,\n    historyInput,\n    allowEvidenceRebuild,\n  );\n  try {\n    await readRecoveryPages(input, stage);\n    return await finishRecovery(input, stage, checkpoint);\n  } catch (error) {\n    const lostEvidence =\n      error instanceof PrincipalHistoryEvidenceUnavailableError;\n    const disconnected =\n      error instanceof PrincipalHistoryPrefixDisconnectedError;\n    if (!lostEvidence && !disconnected) throw error;\n    if (stage.saved)\n      await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n        recoveryIsCurrent(input),\n      );\n    if (\n      !input.offline &&\n      allowEvidenceRebuild &&\n      (lostEvidence || stage.fromCache)\n    )\n      return recover(input, false);\n    throw lostEvidence || disconnected ? error.verificationError : error;\n  }\n}\n\n/**\n * Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n * Retain organization version 1 when the result will establish founder binding.\n */\nexport async function recoverPrincipalPolicyHistory(\n  options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid principal history transport mode\",\n    );\n  if (\n    !options.organizationId ||\n    (options.expectedHead.principalType === \"organization\" &&\n      options.expectedHead.principalId !== options.organizationId)\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal history organization scope is invalid\",\n    );\n  if (\n    options.retainedReferences?.some(\n      (reference) => reference.version > options.expectedHead.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Requested history reference is beyond the recovery head\",\n    );\n  const input = {\n    ...options,\n    historyVerification: options.historyVerification ?? \"standard\",\n    expectedHead: structuredClone(options.expectedHead),\n    retainedReferences: structuredClone(options.retainedReferences ?? []),\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    input.protection.context = principalHistoryVerificationContext(input);\n    return await recover(input);\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n"]}
+{"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EAGvB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,uCAAwC,SAAQ,KAAK;IACpC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAC;IACxD,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C;IAE3C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC,EACnC,YAAkE;IAElE,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,sCAAsC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC5B,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,uCAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAA2C,EAC3C,KAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,+BAA+B,CAAC;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;QACpC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QACjC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,qCAAqC,CACzC,KAAK,EACL,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2C,EAC3C,KAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;YACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACjD,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;AACN,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAA2C,EAC3C,oBAAoB,GAAG,IAAI;IAE3B,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,EACjD,2DAA2D,CAC5D,CAAC;IACJ,8EAA8E;IAC9E,oCAAoC,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CACtD,KAAK,EACL,YAAY,EACZ,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,SAAS;YACjB,MAAM,yCAAyC,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAChB,KAAK,YAAY,wCAAwC,CAAC;QAC5D,MAAM,YAAY,GAChB,KAAK,YAAY,uCAAuC,CAAC;QAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;YAAE,MAAM,KAAK,CAAC;QAChD,IAAI,KAAK,CAAC,KAAK;YACb,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;QACJ,IACE,CAAC,KAAK,CAAC,OAAO;YACd,oBAAoB;YACpB,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,CAAC;YAEjC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,UAAU;QAC9D,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryInput,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  savePrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport { validatePrincipalHistoryRecoveryAuthority } from \"./principalHistoryRecoveryAuthority\";\nimport { publishReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalHistoryEvidenceUnavailableError,\n  selectRecoveredPrincipalHistory,\n} from \"./principalHistoryRecoveryReferences\";\nimport {\n  type PrincipalHistoryRecoveryStage,\n  restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n  assertPrincipalHistoryVerificationMode,\n  principalHistoryVerificationContext,\n} from \"./principalHistoryRecoveryVerification\";\n\nclass PrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\nfunction currentArtifacts(\n  page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n\nfunction recoveryIsCurrent(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): boolean {\n  return !input.signal?.aborted && input.stillCurrent();\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n  assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));\n}\n\nfunction assertExpectedHead(\n  current: PrincipalPolicyPageCurrent,\n  expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): void {\n  for (const field of [\n    \"principalType\",\n    \"principalId\",\n    \"version\",\n    \"stateHash\",\n    \"keyEpoch\",\n    \"keyFingerprint\",\n  ] as const) {\n    if (current.currentState[field] !== expectedHead[field])\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Principal history page does not match its requested head\",\n      );\n  }\n}\n\nasync function acceptPage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  response: PrincipalPolicyPageResponse,\n): Promise<void> {\n  const page = structuredClone(response);\n  assertCurrent(input);\n  assertExpectedHead(page, input.expectedHead);\n  if (stage.complete) {\n    if (\n      page.previousStates.length !== 0 ||\n      page.historyPage.nextAfterVersion !== null\n    )\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Completed history returned additional entries\",\n      );\n    stage.current = currentArtifacts(page);\n    return;\n  }\n  const complete = page.historyPage.nextAfterVersion === null;\n  const current = currentArtifacts(page);\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n  assertPrincipalHistoryVerificationMode(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: { ...current, previousStates: page.previousStates },\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Principal history signer identity could not be authenticated\",\n    );\n  const externalAuthority = await input.loadExternalAuthority?.(\n    entries.flatMap(({ state }) =>\n      state.externalAuthority ? [state.externalAuthority] : [],\n    ),\n  );\n  const appended = await stage.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const next = {\n    id: stage.id,\n    organizationId: input.organizationId,\n    currentJson: JSON.stringify(current),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const protectedProgress = await stage.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.expectedHead,\n      next,\n    ),\n  );\n  if (!protectedProgress.ok) throw protectedProgress.error;\n  const saved = { ...next, progress: protectedProgress.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      scopeId: stage.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: stage.saved?.progress ?? null,\n    stillCurrent: () => recoveryIsCurrent(input),\n  });\n  stage.current = current;\n  stage.saved = saved;\n  stage.complete = complete;\n}\n\nasync function finishRecovery(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (!stage.current || !stage.complete)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history ended before its pinned head\",\n    );\n  const history = stage.verifier.finish(input.expectedHead);\n  if (!history.ok) throw history.error;\n  const selected = await selectRecoveredPrincipalHistory({\n    options: input,\n    scopeId: stage.scopeId,\n    history: history.value,\n    checkpoint,\n  });\n  const current = await verifyPrincipalPolicyCurrent({\n    current: stage.current,\n    history: selected,\n  });\n  if (!current.ok) throw current.error;\n  verifyPrincipalPolicyCheckpoint({\n    chain: current.value.retainedHistory,\n    currentState: current.value.state,\n    localCheckpoint: checkpoint,\n  });\n  const latest = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Local principal checkpoint changed during history recovery\",\n    );\n  assertCurrent(input);\n  if (!input.offline)\n    await publishReusablePrincipalHistoryPrefix(\n      input,\n      stage.scopeId,\n      stage.verifier,\n      stage.current,\n    );\n  assertCurrent(input);\n  return { current: stage.current, policy: current.value };\n}\n\nasync function readRecoveryPages(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n): Promise<void> {\n  if (input.offline) {\n    if (!stage.complete || !stage.current)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Completed principal history is unavailable offline\",\n      );\n    assertExpectedHead(stage.current, input.expectedHead);\n    return;\n  }\n  let receivedFinalPage = false;\n  for await (const result of input.apiClient.getPrincipalPolicyPages(\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n    {\n      signal: input.signal,\n      stateHash: input.expectedHead.stateHash,\n      ...(stage.saved && stage.current\n        ? {\n            resume: {\n              current: stage.current,\n              afterVersion: stage.saved.afterVersion,\n            },\n          }\n        : { afterVersion: stage.initialAfterVersion }),\n    },\n  )) {\n    if (!result.ok) {\n      // A rejected transport pin cannot justify skipping history on retry.\n      // Discard only this operation's progress, then let a new call replay it.\n      if (result.kind === \"shape\" && stage.saved)\n        await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n          recoveryIsCurrent(input),\n        );\n      throw new PrincipalPolicyHistoryReadError(result);\n    }\n    await acceptPage(input, stage, result.data);\n    receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n  }\n  if (!receivedFinalPage)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history transport did not complete\",\n    );\n}\n\nasync function recover(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  allowEvidenceRebuild = true,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  assertCurrent(input);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (checkpoint && input.expectedHead.version < checkpoint.version)\n    throw new KeyingVerificationError(\n      input.offline ? \"missing_dependency\" : \"rollback\",\n      \"Requested principal history predates the local checkpoint\",\n    );\n  // Validate the requested pin/selection before creating any disposable caches.\n  createPrincipalPolicyHistoryVerifier({\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n    localCheckpoint: checkpoint,\n    retainedReferences: input.retainedReferences ?? [],\n  });\n  const historyInput: PrincipalPolicyHistoryInput = {\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n  };\n  const stage = await restorePrincipalHistoryRecoveryStage(\n    input,\n    historyInput,\n    allowEvidenceRebuild,\n  );\n  try {\n    if (stage.fromCache)\n      await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);\n    await readRecoveryPages(input, stage);\n    return await finishRecovery(input, stage, checkpoint);\n  } catch (error) {\n    const lostEvidence =\n      error instanceof PrincipalHistoryEvidenceUnavailableError;\n    const disconnected =\n      error instanceof PrincipalHistoryPrefixDisconnectedError;\n    if (!lostEvidence && !disconnected) throw error;\n    if (stage.saved)\n      await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n        recoveryIsCurrent(input),\n      );\n    if (\n      !input.offline &&\n      allowEvidenceRebuild &&\n      (lostEvidence || stage.fromCache)\n    )\n      return recover(input, false);\n    throw lostEvidence || disconnected ? error.verificationError : error;\n  }\n}\n\n/**\n * Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n * Retain organization version 1 when the result will establish founder binding.\n */\nexport async function recoverPrincipalPolicyHistory(\n  options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid principal history transport mode\",\n    );\n  if (\n    !options.organizationId ||\n    (options.expectedHead.principalType === \"organization\" &&\n      options.expectedHead.principalId !== options.organizationId)\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal history organization scope is invalid\",\n    );\n  if (\n    options.retainedReferences?.some(\n      (reference) => reference.version > options.expectedHead.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Requested history reference is beyond the recovery head\",\n    );\n  const input = {\n    ...options,\n    historyVerification: options.historyVerification ?? \"standard\",\n    expectedHead: structuredClone(options.expectedHead),\n    retainedReferences: structuredClone(options.retainedReferences ?? []),\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    input.protection.context = principalHistoryVerificationContext(input);\n    return await recover(input);\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n"]}

package/workflows/principals/recoverProjectionPolicyHistory.d.ts

@@ -0,0 +1,9 @@
+import { type ReferencedPrincipalHead, type VerifiedPrincipalPolicySelection } from "../../internal/crypto/index.js";
+import type { ProjectionPolicyEvidenceResponse } from "../../internal/validators/response/index.js";
+import type { PublicPrincipalHistoryOptions } from "./publicPrincipalHistoryTypes.js";
+export interface ProjectionPolicyHistoryRecoveryOptions extends Omit<PublicPrincipalHistoryOptions, "source" | "loadExternalAuthority" | "strictAdmins" | "authorityGroupId" | "replay"> {
+    readonly evidence: ProjectionPolicyEvidenceResponse;
+    readonly references: readonly ReferencedPrincipalHead[];
+}
+/** Public authorization only; no current-policy cache or checkpoint is written. */
+export declare function recoverProjectionPolicyHistory(input: ProjectionPolicyHistoryRecoveryOptions): Promise<VerifiedPrincipalPolicySelection[]>;