@tearleads/client-sdk 0.1.13 → 0.1.15

package/data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js

@@ -1,13 +1,14 @@
 import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { principalHeadMatchesReference } from "../principals/organizationAuthorityDescriptor.js";
 function newer(previous, next) {
     if (!previous)
         return true;
-    if (previous.currentState.principalId !== next.currentState.principalId)
+    if (previous.head.principalId !== next.head.principalId)
         throw new KeyingVerificationError("object_mismatch", "Projection evidence crosses principals");
-    if (previous.currentState.version === next.currentState.version &&
-        previous.currentState.stateHash !== next.currentState.stateHash)
+    if (previous.head.version === next.head.version &&
+        !principalHeadMatchesReference(previous.head, next.head))
         throw new KeyingVerificationError("hash_mismatch", "Projection evidence contains conflicting heads");
-    return previous.currentState.version < next.currentState.version;
+    return previous.head.version < next.head.version;
 }
 /** Combine proof material when locally composing projections; verification follows. */
 export function mergeProjectionPolicyEvidence(evidence) {
@@ -19,19 +20,20 @@ export function mergeProjectionPolicyEvidence(evidence) {
         if (organization && newer(directory?.organization, organization))
             directory = proof;
         for (const payload of proof.organizationPayloads) {
-            const previous = payloads.get(payload.stateHash);
+            const previous = payloads.get(payload.reference.stateHash);
             if (previous &&
-                (previous.principalId !== payload.principalId ||
-                    previous.principalType !== payload.principalType ||
-                    previous.ciphertext !== payload.ciphertext ||
-                    previous.ciphertextHash !== payload.ciphertextHash))
+                (!principalHeadMatchesReference(previous.reference, payload.reference) ||
+                    previous.payload.principalId !== payload.payload.principalId ||
+                    previous.payload.principalType !== payload.payload.principalType ||
+                    previous.payload.ciphertext !== payload.payload.ciphertext ||
+                    previous.payload.ciphertextHash !== payload.payload.ciphertextHash))
                 throw new KeyingVerificationError("hash_mismatch", "Projection evidence contains conflicting directory payloads");
-            payloads.set(payload.stateHash, payload);
+            payloads.set(payload.reference.stateHash, payload);
         }
         for (const group of proof.groups) {
-            const prior = groups.get(group.currentState.principalId);
+            const prior = groups.get(group.head.principalId);
             if (newer(prior, group))
-                groups.set(group.currentState.principalId, group);
+                groups.set(group.head.principalId, group);
         }
     }
     return {

package/data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"mergeProjectionPolicyEvidence.js","sourceRoot":"","sources":["mergeProjectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAO5D,SAAS,KAAK,CACZ,QAA4D,EAC5D,IAAqC;IAErC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW;QACrE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;IACJ,IACE,QAAQ,CAAC,YAAY,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO;QAC3D,QAAQ,CAAC,YAAY,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY,CAAC,SAAS;QAE/D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;AACnE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,QAAqD;IAErD,IAAI,SAAuD,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2C,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,SAAS,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,QAAQ;gBACR,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;oBAC3C,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;oBAChD,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;oBAC1C,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC;gBAErD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,oBAAoB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicySnapshotResponse,\n  PrincipalStatePayloadResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\n\nfunction newer(\n  previous: PrincipalPolicySnapshotResponse | null | undefined,\n  next: PrincipalPolicySnapshotResponse,\n): boolean {\n  if (!previous) return true;\n  if (previous.currentState.principalId !== next.currentState.principalId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Projection evidence crosses principals\",\n    );\n  if (\n    previous.currentState.version === next.currentState.version &&\n    previous.currentState.stateHash !== next.currentState.stateHash\n  )\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Projection evidence contains conflicting heads\",\n    );\n  return previous.currentState.version < next.currentState.version;\n}\n\n/** Combine proof material when locally composing projections; verification follows. */\nexport function mergeProjectionPolicyEvidence(\n  evidence: readonly ProjectionPolicyEvidenceResponse[],\n): ProjectionPolicyEvidenceResponse {\n  let directory: ProjectionPolicyEvidenceResponse | undefined;\n  const groups = new Map<string, PrincipalPolicySnapshotResponse>();\n  const payloads = new Map<string, PrincipalStatePayloadResponse>();\n  for (const proof of evidence) {\n    const organization = proof.organization;\n    if (organization && newer(directory?.organization, organization))\n      directory = proof;\n    for (const payload of proof.organizationPayloads) {\n      const previous = payloads.get(payload.stateHash);\n      if (\n        previous &&\n        (previous.principalId !== payload.principalId ||\n          previous.principalType !== payload.principalType ||\n          previous.ciphertext !== payload.ciphertext ||\n          previous.ciphertextHash !== payload.ciphertextHash)\n      )\n        throw new KeyingVerificationError(\n          \"hash_mismatch\",\n          \"Projection evidence contains conflicting directory payloads\",\n        );\n      payloads.set(payload.stateHash, payload);\n    }\n    for (const group of proof.groups) {\n      const prior = groups.get(group.currentState.principalId);\n      if (newer(prior, group))\n        groups.set(group.currentState.principalId, group);\n    }\n  }\n  return {\n    organization: directory?.organization ?? null,\n    organizationPayloads: [...payloads.values()],\n    groups: [...groups.values()],\n  };\n}\n"]}
+{"version":3,"file":"mergeProjectionPolicyEvidence.js","sourceRoot":"","sources":["mergeProjectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAK5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,SAAS,KAAK,CACZ,QAAiE,EACjE,IAA0C;IAE1C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;QACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;IACJ,IACE,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;QAC3C,CAAC,6BAA6B,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAExD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,QAAqD;IAErD,IAAI,SAAuD,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,SAAS,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC3D,IACE,QAAQ;gBACR,CAAC,CAAC,6BAA6B,CAC7B,QAAQ,CAAC,SAAS,EAClB,OAAO,CAAC,SAAS,CAClB;oBACC,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW;oBAC5D,QAAQ,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,aAAa;oBAChE,QAAQ,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU;oBAC1D,QAAQ,CAAC,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAErE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,oBAAoB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyHistorySourceResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport { principalHeadMatchesReference } from \"../principals/organizationAuthorityDescriptor\";\n\nfunction newer(\n  previous: PrincipalPolicyHistorySourceResponse | null | undefined,\n  next: PrincipalPolicyHistorySourceResponse,\n): boolean {\n  if (!previous) return true;\n  if (previous.head.principalId !== next.head.principalId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Projection evidence crosses principals\",\n    );\n  if (\n    previous.head.version === next.head.version &&\n    !principalHeadMatchesReference(previous.head, next.head)\n  )\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Projection evidence contains conflicting heads\",\n    );\n  return previous.head.version < next.head.version;\n}\n\n/** Combine proof material when locally composing projections; verification follows. */\nexport function mergeProjectionPolicyEvidence(\n  evidence: readonly ProjectionPolicyEvidenceResponse[],\n): ProjectionPolicyEvidenceResponse {\n  let directory: ProjectionPolicyEvidenceResponse | undefined;\n  const groups = new Map<string, PrincipalPolicyHistorySourceResponse>();\n  const payloads = new Map<\n    string,\n    ProjectionPolicyEvidenceResponse[\"organizationPayloads\"][number]\n  >();\n  for (const proof of evidence) {\n    const organization = proof.organization;\n    if (organization && newer(directory?.organization, organization))\n      directory = proof;\n    for (const payload of proof.organizationPayloads) {\n      const previous = payloads.get(payload.reference.stateHash);\n      if (\n        previous &&\n        (!principalHeadMatchesReference(\n          previous.reference,\n          payload.reference,\n        ) ||\n          previous.payload.principalId !== payload.payload.principalId ||\n          previous.payload.principalType !== payload.payload.principalType ||\n          previous.payload.ciphertext !== payload.payload.ciphertext ||\n          previous.payload.ciphertextHash !== payload.payload.ciphertextHash)\n      )\n        throw new KeyingVerificationError(\n          \"hash_mismatch\",\n          \"Projection evidence contains conflicting directory payloads\",\n        );\n      payloads.set(payload.reference.stateHash, payload);\n    }\n    for (const group of proof.groups) {\n      const prior = groups.get(group.head.principalId);\n      if (newer(prior, group)) groups.set(group.head.principalId, group);\n    }\n  }\n  return {\n    organization: directory?.organization ?? null,\n    organizationPayloads: [...payloads.values()],\n    groups: [...groups.values()],\n  };\n}\n"]}

package/data/keyingProjectionVerification/organizationFounderBinding.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationFounderBinding.js","sourceRoot":"","sources":["organizationFounderBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAG5F,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CACnD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,OAAO,GACX,iBAAiB,IAAI,YAAY;QAC/B,CAAC,CAAC,YAAY,CAAC,eAAe;QAC9B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;QAC1D,OAAO,CAAC,wBAAwB;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberOrganizationFounder } from \"../persistence/organizationFounderPersistence\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { verifiedContainerCreateManifest } from \"./containerCreateManifest\";\n\n/**\n * A directory can cite someone else's public policies. Bind its founder to the\n * verified personal root's creator before trusting it to authorize a rehome.\n * Metadata roots can be created by later admins and cannot establish this pin.\n * This immutable identity anchor survives read-only verification and canceled\n * views; it neither advances nor replaces a current-policy checkpoint.\n */\nexport async function rememberRootBoundOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyCheckpointEvidence[] | undefined;\n  readonly root: VerifiedContainerAccessManifest | undefined;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<void> {\n  const { root } = input;\n  if (!root || root.state.systemSlot !== null) return;\n  const organization = input.policies?.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === root.state.organizationId,\n  );\n  if (!organization) return;\n  const entries =\n    \"retainedHistory\" in organization\n      ? organization.retainedHistory\n      : organization.history;\n  if (!entries) return;\n  const genesis = entries.find(({ state }) => state.version === 1)?.state;\n  if (!genesis)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const created = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Organization founder root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  if (\n    genesis?.signerUserId !== created.event.event.signerUserId ||\n    genesis.signerUserKeyFingerprint !==\n      created.event.event.signerKeyFingerprint\n  )\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Organization founder does not match its verified personal root's creator\",\n    );\n  await rememberOrganizationFounder({\n    execSql: input.execSql,\n    organization,\n  });\n}\n"]}
+{"version":3,"file":"organizationFounderBinding.js","sourceRoot":"","sources":["organizationFounderBinding.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAE5F,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CACnD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,OAAO,GACX,iBAAiB,IAAI,YAAY;QAC/B,CAAC,CAAC,YAAY,CAAC,eAAe;QAC9B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;QAC1D,OAAO,CAAC,wBAAwB;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberOrganizationFounder } from \"../persistence/organizationFounderPersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { verifiedContainerCreateManifest } from \"./containerCreateManifest\";\n\n/**\n * A directory can cite someone else's public policies. Bind its founder to the\n * verified personal root's creator before trusting it to authorize a rehome.\n * Metadata roots can be created by later admins and cannot establish this pin.\n * This immutable identity anchor survives read-only verification and canceled\n * views; it neither advances nor replaces a current-policy checkpoint.\n */\nexport async function rememberRootBoundOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyAuthorization[] | undefined;\n  readonly root: VerifiedContainerAccessManifest | undefined;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<void> {\n  const { root } = input;\n  if (!root || root.state.systemSlot !== null) return;\n  const organization = input.policies?.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === root.state.organizationId,\n  );\n  if (!organization) return;\n  const entries =\n    \"retainedHistory\" in organization\n      ? organization.retainedHistory\n      : organization.history;\n  if (!entries) return;\n  const genesis = entries.find(({ state }) => state.version === 1)?.state;\n  if (!genesis)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const created = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Organization founder root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  if (\n    genesis?.signerUserId !== created.event.event.signerUserId ||\n    genesis.signerUserKeyFingerprint !==\n      created.event.event.signerKeyFingerprint\n  )\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Organization founder does not match its verified personal root's creator\",\n    );\n  await rememberOrganizationFounder({\n    execSql: input.execSql,\n    organization,\n  });\n}\n"]}

package/data/keyingProjectionVerification/projectionAuthorizationEvidence.js

@@ -1,5 +1,6 @@
 import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
 import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
+import { observeProjectionLifetime } from "./projectionLifetimes.js";
 import { verifyProjectionPolicyEvidence } from "./projectionPolicyEvidence.js";
 import { readAccessManifest } from "./readers.js";
 /** Locally planned successors may cite an already verified, uncommitted policy. */
@@ -19,18 +20,44 @@ async function resolveProjectionAuthorizationEvidence(input) {
             principalPolicyCache: input.principalPolicyCache,
             references,
             resolveUserKey: input.resolveUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
         })),
     ];
 }
 export async function verifyProjectionAuthorizationEvidence(input) {
+    const sources = [
+        input.policyEvidence.organization,
+        ...input.policyEvidence.groups,
+    ];
+    const known = [...input.principalPolicyCache.values()];
+    const references = input.bundles
+        .flatMap((bundle) => readAccessManifest(bundle.manifest, "Projection manifest")
+        .referencedPrincipalHeads)
+        .filter((reference) => {
+        if (sources.some((source) => source &&
+            source.head.principalType === reference.principalType &&
+            source.head.principalId === reference.principalId &&
+            source.head.version >= reference.version))
+            return true;
+        // Locally planned successors are verified below through the current-policy path.
+        if (known.some((policy) => principalPolicyMatchesReference({ policy, reference })))
+            return false;
+        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
+    });
+    const recovered = await verifyProjectionPolicyEvidence({
+        evidence: input.policyEvidence,
+        organizationId: input.organizationId,
+        references,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (input.policyEvidence.organization)
+        observeProjectionLifetime(input.checkpointContext, recovered.stillCurrent);
+    input.checkpointContext.authorizationPolicies.push(...recovered.policies);
     return resolveProjectionAuthorizationEvidence({
         ...input,
-        evidence: await verifyProjectionPolicyEvidence({
-            evidence: input.policyEvidence,
-            execSql: input.checkpointContext.execSql,
-            organizationId: input.organizationId,
-            resolveUserKey: input.resolveUserKey,
-        }),
+        evidence: recovered.policies,
     });
 }
 //# sourceMappingURL=projectionAuthorizationEvidence.js.map

package/data/keyingProjectionVerification/projectionAuthorizationEvidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectionAuthorizationEvidence.js","sourceRoot":"","sources":["projectionAuthorizationEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG/C,mFAAmF;AACnF,KAAK,UAAU,sCAAsC,CAAC,KAOrD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAGiE;IAEjE,OAAO,sCAAsC,CAAC;QAC5C,GAAG,KAAK;QACR,QAAQ,EAAE,MAAM,8BAA8B,CAAC;YAC7C,QAAQ,EAAE,KAAK,CAAC,cAAc;YAC9B,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;KACH,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { verifyProjectionPolicyEvidence } from \"./projectionPolicyEvidence\";\nimport { readAccessManifest } from \"./readers\";\nimport type { PrincipalPolicyCache, ProjectionUserKeyResolver } from \"./types\";\n\n/** Locally planned successors may cite an already verified, uncommitted policy. */\nasync function resolveProjectionAuthorizationEvidence(input: {\n  readonly bundles: readonly AccessManifestBundleWireResponse[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly evidence: readonly PrincipalPolicyCheckpointEvidence[];\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<PrincipalPolicyCheckpointEvidence[]> {\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter(\n      (reference) =>\n        !input.evidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  const known = [...input.principalPolicyCache.values()];\n  if (\n    references.some(\n      (reference) =>\n        !known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  return [\n    ...input.evidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n    })),\n  ];\n}\n\nexport async function verifyProjectionAuthorizationEvidence(\n  input: Omit<\n    Parameters<typeof resolveProjectionAuthorizationEvidence>[0],\n    \"evidence\"\n  > & { readonly policyEvidence: ProjectionPolicyEvidenceResponse },\n) {\n  return resolveProjectionAuthorizationEvidence({\n    ...input,\n    evidence: await verifyProjectionPolicyEvidence({\n      evidence: input.policyEvidence,\n      execSql: input.checkpointContext.execSql,\n      organizationId: input.organizationId,\n      resolveUserKey: input.resolveUserKey,\n    }),\n  });\n}\n"]}
+{"version":3,"file":"projectionAuthorizationEvidence.js","sourceRoot":"","sources":["projectionAuthorizationEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAO/C,mFAAmF;AACnF,KAAK,UAAU,sCAAsC,CAAC,KAWrD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAGiE;IAEjE,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,cAAc,CAAC,YAAY;QACjC,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM;KAC/B,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACpB,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM;YACN,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YACrD,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YACjD,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAC3C;YAED,OAAO,IAAI,CAAC;QACd,iFAAiF;QACjF,IACE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD;YAED,OAAO,KAAK,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;QACrD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,cAAc,CAAC,YAAY;QACnC,yBAAyB,CAAC,KAAK,CAAC,iBAAiB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7E,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1E,OAAO,sCAAsC,CAAC;QAC5C,GAAG,KAAK;QACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { ProjectionCheckpointContext } from \"./checkpointContext\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { observeProjectionLifetime } from \"./projectionLifetimes\";\nimport { verifyProjectionPolicyEvidence } from \"./projectionPolicyEvidence\";\nimport { readAccessManifest } from \"./readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\n\n/** Locally planned successors may cite an already verified, uncommitted policy. */\nasync function resolveProjectionAuthorizationEvidence(input: {\n  readonly bundles: readonly AccessManifestBundleWireResponse[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly evidence: readonly PrincipalPolicyAuthorization[];\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<PrincipalPolicyAuthorization[]> {\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter(\n      (reference) =>\n        !input.evidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  const known = [...input.principalPolicyCache.values()];\n  if (\n    references.some(\n      (reference) =>\n        !known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  return [\n    ...input.evidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport async function verifyProjectionAuthorizationEvidence(\n  input: Omit<\n    Parameters<typeof resolveProjectionAuthorizationEvidence>[0],\n    \"evidence\"\n  > & { readonly policyEvidence: ProjectionPolicyEvidenceResponse },\n) {\n  const sources = [\n    input.policyEvidence.organization,\n    ...input.policyEvidence.groups,\n  ];\n  const known = [...input.principalPolicyCache.values()];\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter((reference) => {\n      if (\n        sources.some(\n          (source) =>\n            source &&\n            source.head.principalType === reference.principalType &&\n            source.head.principalId === reference.principalId &&\n            source.head.version >= reference.version,\n        )\n      )\n        return true;\n      // Locally planned successors are verified below through the current-policy path.\n      if (\n        known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        )\n      )\n        return false;\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Projection omits required principal policy evidence\",\n      );\n    });\n  const recovered = await verifyProjectionPolicyEvidence({\n    evidence: input.policyEvidence,\n    organizationId: input.organizationId,\n    references,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (input.policyEvidence.organization)\n    observeProjectionLifetime(input.checkpointContext, recovered.stillCurrent);\n  input.checkpointContext.authorizationPolicies.push(...recovered.policies);\n  return resolveProjectionAuthorizationEvidence({\n    ...input,\n    evidence: recovered.policies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/projectionLifetimes.js

@@ -0,0 +1,13 @@
+const lifetimes = new WeakMap();
+export function observeProjectionLifetime(context, current) {
+    const guards = lifetimes.get(context) ?? [];
+    guards.push(current);
+    lifetimes.set(context, guards);
+}
+export function projectionLifetimeGuard(context, current) {
+    if (!lifetimes.has(context))
+        return current;
+    return () => current?.() !== false &&
+        (lifetimes.get(context)?.every((guard) => guard()) ?? true);
+}
+//# sourceMappingURL=projectionLifetimes.js.map

package/data/keyingProjectionVerification/projectionLifetimes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionLifetimes.js","sourceRoot":"","sources":["projectionLifetimes.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,IAAI,OAAO,EAA6B,CAAC;AAE3D,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,OAAsB;IAEtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,OAAqC;IAErC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,GAAG,EAAE,CACV,OAAO,EAAE,EAAE,KAAK,KAAK;QACrB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;AAChE,CAAC","sourcesContent":["const lifetimes = new WeakMap<object, (() => boolean)[]>();\n\nexport function observeProjectionLifetime(\n  context: object,\n  current: () => boolean,\n): void {\n  const guards = lifetimes.get(context) ?? [];\n  guards.push(current);\n  lifetimes.set(context, guards);\n}\n\nexport function projectionLifetimeGuard(\n  context: object,\n  current?: (() => boolean) | undefined,\n): (() => boolean) | undefined {\n  if (!lifetimes.has(context)) return current;\n  return () =>\n    current?.() !== false &&\n    (lifetimes.get(context)?.every((guard) => guard()) ?? true);\n}\n"]}

package/data/keyingProjectionVerification/projectionPolicyEvidence.js

@@ -1,70 +1,23 @@
-import { computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../principals/organizationAuthorityDescriptor.js";
-import { enforcePrincipalPolicySnapshotCheckpoints, verifyPrincipalPolicySnapshots, } from "./principalPolicySnapshotVerification.js";
-function reject(message) {
-    throw new KeyingVerificationError("object_mismatch", `Projection policy evidence: ${message}`);
-}
-async function verifyDirectories(input) {
-    const states = new Map(input.organization.history.map(({ state }) => [state.stateHash, state]));
-    const descriptors = [];
-    for (const payload of input.evidence.organizationPayloads) {
-        const state = states.get(payload.stateHash);
-        if (!state ||
-            payload.principalType !== "organization" ||
-            payload.principalId !== input.organizationId)
-            reject("directory payload scope is invalid");
-        const hash = await computePrincipalStatePayloadCiphertextHash(payload.ciphertext);
-        if (hash !== state.payloadCiphertextHash || hash !== payload.ciphertextHash)
-            reject("directory payload does not match its signed hash");
-        const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);
-        if (descriptor.organizationId !== input.organizationId)
-            reject("directory belongs to another organization");
-        descriptors.push(descriptor);
-        states.delete(payload.stateHash);
-    }
-    // Only directory payloads needed to bind the supplied group heads are
-    // required. The organization's complete signed state chain is verified above;
-    // unrelated payload bodies add no authority and need not be disclosed.
-    return descriptors;
-}
-/** Evidence authenticates signed citations only; it never becomes current policy. */
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent, } from "./types.js";
+/** Recover public authorization without admitting historical heads as current policy. */
 export async function verifyProjectionPolicyEvidence(input) {
-    const { evidence, organizationId } = input;
-    if (evidence.organization === null) {
-        if (evidence.groups.length > 0 || evidence.organizationPayloads.length > 0)
-            reject("group evidence requires its signed organization history");
-        return [];
-    }
-    if (evidence.organization.currentState.principalType !== "organization" ||
-        evidence.organization.currentState.principalId !== organizationId ||
-        evidence.groups.some((group) => group.currentState.principalType !== "group"))
-        reject("principal scope is invalid");
-    const policies = await verifyPrincipalPolicySnapshots({
-        resolveUserKey: input.resolveUserKey,
-        snapshots: [evidence.organization, ...evidence.groups],
-    });
-    const organization = policies.find((policy) => policy.principalType === "organization");
-    if (!organization)
-        reject("organization snapshot is missing");
-    const directories = await verifyDirectories({ ...input, organization });
-    for (const group of policies.filter((policy) => policy.principalType === "group")) {
-        const directory = directories.find((candidate) => candidate.groupHeads.some((reference) => principalHeadMatchesReference(group.state, reference)));
-        if (!directory)
-            reject("group state is absent from signed directory history");
-        // The snapshot's authenticated predecessor chain supplies older states;
-        // only its bound head needs to appear in a directory payload.
-        for (const { state } of group.history) {
-            if (state.externalAuthority &&
-                state.externalAuthority.principalId !== directory.adminGroupId)
-                reject("group authority is not the organization's Admins group");
-        }
+    const stillCurrent = () => input.stillCurrent?.() !== false;
+    assertProjectionVerificationCurrent(stillCurrent);
+    if (!input.evidence.organization) {
+        if (input.evidence.groups.length ||
+            input.evidence.organizationPayloads.length ||
+            input.references.length)
+            throw new KeyingVerificationError("missing_dependency", "Projection omits required organization history");
+        return { policies: [], stillCurrent };
     }
-    // Check connection to known chains without pinning historical group heads or
-    // caching keyless evidence as a live policy bundle.
-    await enforcePrincipalPolicySnapshotCheckpoints({
-        execSql: input.execSql,
-        policies,
-    });
-    return policies;
+    const resolve = input.warmReferencedPrincipalPolicies?.resolveProjectionHistory;
+    if (!resolve)
+        throw new ProjectionDependencyUnavailableError("Private projection history recovery is unavailable");
+    const result = await resolve({ ...input, stillCurrent });
+    assertProjectionVerificationCurrent(stillCurrent);
+    assertProjectionVerificationCurrent(result.stillCurrent);
+    return result;
 }
 //# sourceMappingURL=projectionPolicyEvidence.js.map

package/data/keyingProjectionVerification/projectionPolicyEvidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectionPolicyEvidence.js","sourceRoot":"","sources":["projectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,EAC1C,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EACL,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,uCAAuC,CAAC;AAG/C,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+BAA+B,OAAO,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAIhC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CACxE,CAAC;IACF,MAAM,WAAW,GAAsC,EAAE,CAAC;IAC1D,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,IACE,CAAC,KAAK;YACN,OAAO,CAAC,aAAa,KAAK,cAAc;YACxC,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;YAE5C,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,IAAI,KAAK,KAAK,CAAC,qBAAqB,IAAI,IAAI,KAAK,OAAO,CAAC,cAAc;YACzE,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,oCAAoC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YACpD,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACtD,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,uEAAuE;IACvE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IACC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC3C,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACxE,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IACE,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QACnE,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,KAAK,cAAc;QACjE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO,CACxD;QAED,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,KAAK,cAAc,CACpD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO,CAC7C,EAAE,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAkC,EAAE,EAAE,CAC/D,6BAA6B,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CACtD,CACF,CAAC;QACF,IAAI,CAAC,SAAS;YACZ,MAAM,CAAC,qDAAqD,CAAC,CAAC;QAChE,wEAAwE;QACxE,8DAA8D;QAC9D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,IACE,KAAK,CAAC,iBAAiB;gBACvB,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,SAAS,CAAC,YAAY;gBAE9D,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,yCAAyC,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ;KACT,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicySnapshot,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport {\n  enforcePrincipalPolicySnapshotCheckpoints,\n  verifyPrincipalPolicySnapshots,\n} from \"./principalPolicySnapshotVerification\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nfunction reject(message: string): never {\n  throw new KeyingVerificationError(\n    \"object_mismatch\",\n    `Projection policy evidence: ${message}`,\n  );\n}\n\nasync function verifyDirectories(input: {\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly organization: VerifiedPrincipalPolicySnapshot;\n  readonly organizationId: string;\n}): Promise<OrganizationAuthorityDescriptor[]> {\n  const states = new Map(\n    input.organization.history.map(({ state }) => [state.stateHash, state]),\n  );\n  const descriptors: OrganizationAuthorityDescriptor[] = [];\n  for (const payload of input.evidence.organizationPayloads) {\n    const state = states.get(payload.stateHash);\n    if (\n      !state ||\n      payload.principalType !== \"organization\" ||\n      payload.principalId !== input.organizationId\n    )\n      reject(\"directory payload scope is invalid\");\n    const hash = await computePrincipalStatePayloadCiphertextHash(\n      payload.ciphertext,\n    );\n    if (hash !== state.payloadCiphertextHash || hash !== payload.ciphertextHash)\n      reject(\"directory payload does not match its signed hash\");\n    const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);\n    if (descriptor.organizationId !== input.organizationId)\n      reject(\"directory belongs to another organization\");\n    descriptors.push(descriptor);\n    states.delete(payload.stateHash);\n  }\n  // Only directory payloads needed to bind the supplied group heads are\n  // required. The organization's complete signed state chain is verified above;\n  // unrelated payload bodies add no authority and need not be disclosed.\n  return descriptors;\n}\n\n/** Evidence authenticates signed citations only; it never becomes current policy. */\nexport async function verifyProjectionPolicyEvidence(input: {\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<VerifiedPrincipalPolicySnapshot[]> {\n  const { evidence, organizationId } = input;\n  if (evidence.organization === null) {\n    if (evidence.groups.length > 0 || evidence.organizationPayloads.length > 0)\n      reject(\"group evidence requires its signed organization history\");\n    return [];\n  }\n  if (\n    evidence.organization.currentState.principalType !== \"organization\" ||\n    evidence.organization.currentState.principalId !== organizationId ||\n    evidence.groups.some(\n      (group) => group.currentState.principalType !== \"group\",\n    )\n  )\n    reject(\"principal scope is invalid\");\n  const policies = await verifyPrincipalPolicySnapshots({\n    resolveUserKey: input.resolveUserKey,\n    snapshots: [evidence.organization, ...evidence.groups],\n  });\n  const organization = policies.find(\n    (policy) => policy.principalType === \"organization\",\n  );\n  if (!organization) reject(\"organization snapshot is missing\");\n  const directories = await verifyDirectories({ ...input, organization });\n  for (const group of policies.filter(\n    (policy) => policy.principalType === \"group\",\n  )) {\n    const directory = directories.find((candidate) =>\n      candidate.groupHeads.some((reference: ReferencedPrincipalHead) =>\n        principalHeadMatchesReference(group.state, reference),\n      ),\n    );\n    if (!directory)\n      reject(\"group state is absent from signed directory history\");\n    // The snapshot's authenticated predecessor chain supplies older states;\n    // only its bound head needs to appear in a directory payload.\n    for (const { state } of group.history) {\n      if (\n        state.externalAuthority &&\n        state.externalAuthority.principalId !== directory.adminGroupId\n      )\n        reject(\"group authority is not the organization's Admins group\");\n    }\n  }\n  // Check connection to known chains without pinning historical group heads or\n  // caching keyless evidence as a live policy bundle.\n  await enforcePrincipalPolicySnapshotCheckpoints({\n    execSql: input.execSql,\n    policies,\n  });\n  return policies;\n}\n"]}
+{"version":3,"file":"projectionPolicyEvidence.js","sourceRoot":"","sources":["projectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EACL,mCAAmC,GAGpC,MAAM,SAAS,CAAC;AAEjB,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAQpD;IACC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;IAC5D,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,IACE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;YAC5B,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM;YAC1C,KAAK,CAAC,UAAU,CAAC,MAAM;YAEvB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;QACJ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GACX,KAAK,CAAC,+BAA+B,EAAE,wBAAwB,CAAC;IAClE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACzD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport {\n  assertProjectionVerificationCurrent,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedProjectionPolicyHistory,\n} from \"./types\";\n\n/** Recover public authorization without admitting historical heads as current policy. */\nexport async function verifyProjectionPolicyEvidence(input: {\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly organizationId: string;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<ResolvedProjectionPolicyHistory> {\n  const stillCurrent = () => input.stillCurrent?.() !== false;\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!input.evidence.organization) {\n    if (\n      input.evidence.groups.length ||\n      input.evidence.organizationPayloads.length ||\n      input.references.length\n    )\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Projection omits required organization history\",\n      );\n    return { policies: [], stillCurrent };\n  }\n  const resolve =\n    input.warmReferencedPrincipalPolicies?.resolveProjectionHistory;\n  if (!resolve)\n    throw new ProjectionDependencyUnavailableError(\n      \"Private projection history recovery is unavailable\",\n    );\n  const result = await resolve({ ...input, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  assertProjectionVerificationCurrent(result.stillCurrent);\n  return result;\n}\n"]}

package/data/keyingProjectionVerification/types.d.ts

@@ -1,5 +1,5 @@
-import type { ReferencedPrincipalHead, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
-import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import type { ReferencedPrincipalHead, VerifiedPrincipalPolicyCurrent, VerifiedPrincipalPolicySelection } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyBundleResponse, ProjectionPolicyEvidenceResponse } from "../../internal/validators/response/index.js";
 import type { PrincipalPolicyCurrentEvidence } from "../principals/principalPolicyEvidence.js";
 import type { TrustedUserIdentity } from "../trustedUserIdentity/index.js";
 export type ProjectionUserKey = TrustedUserIdentity;
@@ -28,9 +28,20 @@ export interface PrincipalPolicyBundleCacheRequest {
     readonly organizationId: string;
     readonly stillCurrent?: (() => boolean) | undefined;
 }
+export interface ProjectionPolicyHistoryResolveRequest {
+    readonly organizationId: string;
+    readonly evidence: ProjectionPolicyEvidenceResponse;
+    readonly references: readonly ReferencedPrincipalHead[];
+    readonly stillCurrent?: (() => boolean) | undefined;
+}
+export interface ResolvedProjectionPolicyHistory {
+    readonly policies: readonly VerifiedPrincipalPolicySelection[];
+    readonly stillCurrent: () => boolean;
+}
 export type PrincipalPolicyBundleCacher = (input: PrincipalPolicyBundleCacheRequest) => Promise<void>;
 export type ReferencedPrincipalPolicyWarmer = ((input: ReferencedPrincipalPolicyWarmRequest) => Promise<void>) & {
     readonly cacheBundles?: PrincipalPolicyBundleCacher | undefined;
+    readonly resolveProjectionHistory?: ((input: ProjectionPolicyHistoryResolveRequest) => Promise<ResolvedProjectionPolicyHistory>) | undefined;
     readonly resolveReference?: ((input: PrincipalPolicyResolveRequest) => Promise<ResolvedPrincipalPolicyEvidence>) | undefined;
 };
 export declare class ProjectionVerificationCancelledError extends Error {

package/data/keyingProjectionVerification/types.js

@@ -38,7 +38,22 @@ export function generationGuardedPrincipalPolicyWarmer(warmer, stillCurrent) {
     const guardWithCapabilities = (operation) => {
         const guarded = guard(operation);
         const resolve = operation.resolveReference;
+        const resolveProjectionHistory = operation.resolveProjectionHistory;
         return Object.assign(guarded, {
+            ...(resolveProjectionHistory
+                ? {
+                    resolveProjectionHistory: async (input) => {
+                        const current = () => stillCurrent() && input.stillCurrent?.() !== false;
+                        assertProjectionVerificationCurrent(current);
+                        const result = await resolveProjectionHistory({
+                            ...input,
+                            stillCurrent: current,
+                        });
+                        assertProjectionVerificationCurrent(current);
+                        return result;
+                    },
+                }
+                : {}),
             ...(resolve
                 ? {
                     resolveReference: async (input) => {

package/data/keyingProjectionVerification/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AA0DA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,kCAAkC,GACtC,IAAI,oCAAoC,EAAE,CAAC;AAE7C,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,OAAO,KAAK,KAAK,kCAAkC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAAc;IACnE,IAAI,sCAAsC,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,SAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,YAAyC;IAEzC,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,kCAAkC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAmD,EACnD,YAAyC;IAEzC,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC5C,MAAM,KAAK,GACT,CAAC,SAA0C,EAAE,EAAE,CAC/C,KAAK,EAAE,KAA2C,EAAE,EAAE;QACpD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,CAAC;IACJ,MAAM,qBAAqB,GAAG,CAC5B,SAA0C,EACT,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,gBAAgB,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;YAC5B,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,gBAAgB,EAAE,KAAK,EAAE,KAAoC,EAAE,EAAE;wBAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;wBACrD,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;wBAClE,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,YAAY;gBACxB,CAAC,CAAC;oBACE,YAAY,EAAE,KAAK,EAAE,KAAwC,EAAE,EAAE;wBAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;wBAClD,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;wBAC3D,mCAAmC,CAAC,YAAY,CAAC,CAAC;oBACpD,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAO/C,KAAY;IACZ,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,sCAAsC,CACrE,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { TrustedUserIdentity } from \"../trustedUserIdentity\";\n\nexport type ProjectionUserKey = TrustedUserIdentity;\n\nexport type ProjectionUserKeyResolver = (\n  userId: string,\n) => Promise<ProjectionUserKey | null>;\n\nexport type PrincipalPolicyCache = Map<string, PrincipalPolicyCurrentEvidence>;\n\nexport interface PrincipalPolicyResolveRequest {\n  /** Identity of one projection collection, never caller-supplied evidence. */\n  readonly recoveryBatch?: object | undefined;\n  readonly organizationId: string;\n  readonly reference: ReferencedPrincipalHead;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ResolvedPrincipalPolicyEvidence {\n  readonly stillCurrent: () => boolean;\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n}\n\nexport interface ReferencedPrincipalPolicyWarmRequest {\n  readonly organizationId: string;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface PrincipalPolicyBundleCacheRequest {\n  readonly bundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport type PrincipalPolicyBundleCacher = (\n  input: PrincipalPolicyBundleCacheRequest,\n) => Promise<void>;\n\nexport type ReferencedPrincipalPolicyWarmer = ((\n  input: ReferencedPrincipalPolicyWarmRequest,\n) => Promise<void>) & {\n  readonly cacheBundles?: PrincipalPolicyBundleCacher | undefined;\n  readonly resolveReference?:\n    | ((\n        input: PrincipalPolicyResolveRequest,\n      ) => Promise<ResolvedPrincipalPolicyEvidence>)\n    | undefined;\n};\n\nexport class ProjectionVerificationCancelledError extends Error {\n  constructor() {\n    super(\"Projection verification generation expired\");\n    this.name = \"ProjectionVerificationCancelledError\";\n  }\n}\n\nconst projectionVerificationCancellation =\n  new ProjectionVerificationCancelledError();\n\nexport function isProjectionVerificationCancelledError(\n  error: unknown,\n): error is ProjectionVerificationCancelledError {\n  return error === projectionVerificationCancellation;\n}\n\nexport function rethrowProjectionVerificationCancelled(error: unknown): void {\n  if (isProjectionVerificationCancelledError(error)) throw error;\n}\n\nexport async function nullOnProjectionVerificationCancellation<T>(\n  operation: () => Promise<T>,\n): Promise<T | null> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (isProjectionVerificationCancelledError(error)) return null;\n    throw error;\n  }\n}\n\nexport function assertProjectionVerificationCurrent(\n  stillCurrent: (() => boolean) | undefined,\n): void {\n  if (stillCurrent?.() === false) {\n    throw projectionVerificationCancellation;\n  }\n}\n\nexport function generationGuardedPrincipalPolicyWarmer(\n  warmer: ReferencedPrincipalPolicyWarmer | undefined,\n  stillCurrent: (() => boolean) | undefined,\n): ReferencedPrincipalPolicyWarmer | undefined {\n  if (!warmer || !stillCurrent) return warmer;\n  const guard =\n    (operation: ReferencedPrincipalPolicyWarmer) =>\n    async (input: ReferencedPrincipalPolicyWarmRequest) => {\n      assertProjectionVerificationCurrent(stillCurrent);\n      await operation({ ...input, stillCurrent });\n      assertProjectionVerificationCurrent(stillCurrent);\n    };\n  const guardWithCapabilities = (\n    operation: ReferencedPrincipalPolicyWarmer,\n  ): ReferencedPrincipalPolicyWarmer => {\n    const guarded = guard(operation);\n    const resolve = operation.resolveReference;\n    return Object.assign(guarded, {\n      ...(resolve\n        ? {\n            resolveReference: async (input: PrincipalPolicyResolveRequest) => {\n              const current = () =>\n                stillCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(current);\n              const result = await resolve({ ...input, stillCurrent: current });\n              assertProjectionVerificationCurrent(current);\n              return result;\n            },\n          }\n        : {}),\n      ...(operation.cacheBundles\n        ? {\n            cacheBundles: async (input: PrincipalPolicyBundleCacheRequest) => {\n              assertProjectionVerificationCurrent(stillCurrent);\n              await operation.cacheBundles?.({ ...input, stillCurrent });\n              assertProjectionVerificationCurrent(stillCurrent);\n            },\n          }\n        : {}),\n    });\n  };\n  return guardWithCapabilities(warmer);\n}\n\nexport function withGenerationGuardedPolicyWarmer<\n  Input extends {\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  },\n>(input: Input): Input {\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    ),\n  };\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AA+EA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,kCAAkC,GACtC,IAAI,oCAAoC,EAAE,CAAC;AAE7C,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,OAAO,KAAK,KAAK,kCAAkC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAAc;IACnE,IAAI,sCAAsC,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,SAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,YAAyC;IAEzC,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,kCAAkC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAmD,EACnD,YAAyC;IAEzC,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC5C,MAAM,KAAK,GACT,CAAC,SAA0C,EAAE,EAAE,CAC/C,KAAK,EAAE,KAA2C,EAAE,EAAE;QACpD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,CAAC;IACJ,MAAM,qBAAqB,GAAG,CAC5B,SAA0C,EACT,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,gBAAgB,CAAC;QAC3C,MAAM,wBAAwB,GAAG,SAAS,CAAC,wBAAwB,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;YAC5B,GAAG,CAAC,wBAAwB;gBAC1B,CAAC,CAAC;oBACE,wBAAwB,EAAE,KAAK,EAC7B,KAA4C,EAC5C,EAAE;wBACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;wBACrD,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;4BAC5C,GAAG,KAAK;4BACR,YAAY,EAAE,OAAO;yBACtB,CAAC,CAAC;wBACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,gBAAgB,EAAE,KAAK,EAAE,KAAoC,EAAE,EAAE;wBAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;wBACrD,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;wBAClE,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,YAAY;gBACxB,CAAC,CAAC;oBACE,YAAY,EAAE,KAAK,EAAE,KAAwC,EAAE,EAAE;wBAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;wBAClD,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;wBAC3D,mCAAmC,CAAC,YAAY,CAAC,CAAC;oBACpD,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAO/C,KAAY;IACZ,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,sCAAsC,CACrE,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyCurrent,\n  VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { TrustedUserIdentity } from \"../trustedUserIdentity\";\n\nexport type ProjectionUserKey = TrustedUserIdentity;\n\nexport type ProjectionUserKeyResolver = (\n  userId: string,\n) => Promise<ProjectionUserKey | null>;\n\nexport type PrincipalPolicyCache = Map<string, PrincipalPolicyCurrentEvidence>;\n\nexport interface PrincipalPolicyResolveRequest {\n  /** Identity of one projection collection, never caller-supplied evidence. */\n  readonly recoveryBatch?: object | undefined;\n  readonly organizationId: string;\n  readonly reference: ReferencedPrincipalHead;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ResolvedPrincipalPolicyEvidence {\n  readonly stillCurrent: () => boolean;\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n}\n\nexport interface ReferencedPrincipalPolicyWarmRequest {\n  readonly organizationId: string;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface PrincipalPolicyBundleCacheRequest {\n  readonly bundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ProjectionPolicyHistoryResolveRequest {\n  readonly organizationId: string;\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ResolvedProjectionPolicyHistory {\n  readonly policies: readonly VerifiedPrincipalPolicySelection[];\n  readonly stillCurrent: () => boolean;\n}\n\nexport type PrincipalPolicyBundleCacher = (\n  input: PrincipalPolicyBundleCacheRequest,\n) => Promise<void>;\n\nexport type ReferencedPrincipalPolicyWarmer = ((\n  input: ReferencedPrincipalPolicyWarmRequest,\n) => Promise<void>) & {\n  readonly cacheBundles?: PrincipalPolicyBundleCacher | undefined;\n  readonly resolveProjectionHistory?:\n    | ((\n        input: ProjectionPolicyHistoryResolveRequest,\n      ) => Promise<ResolvedProjectionPolicyHistory>)\n    | undefined;\n  readonly resolveReference?:\n    | ((\n        input: PrincipalPolicyResolveRequest,\n      ) => Promise<ResolvedPrincipalPolicyEvidence>)\n    | undefined;\n};\n\nexport class ProjectionVerificationCancelledError extends Error {\n  constructor() {\n    super(\"Projection verification generation expired\");\n    this.name = \"ProjectionVerificationCancelledError\";\n  }\n}\n\nconst projectionVerificationCancellation =\n  new ProjectionVerificationCancelledError();\n\nexport function isProjectionVerificationCancelledError(\n  error: unknown,\n): error is ProjectionVerificationCancelledError {\n  return error === projectionVerificationCancellation;\n}\n\nexport function rethrowProjectionVerificationCancelled(error: unknown): void {\n  if (isProjectionVerificationCancelledError(error)) throw error;\n}\n\nexport async function nullOnProjectionVerificationCancellation<T>(\n  operation: () => Promise<T>,\n): Promise<T | null> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (isProjectionVerificationCancelledError(error)) return null;\n    throw error;\n  }\n}\n\nexport function assertProjectionVerificationCurrent(\n  stillCurrent: (() => boolean) | undefined,\n): void {\n  if (stillCurrent?.() === false) {\n    throw projectionVerificationCancellation;\n  }\n}\n\nexport function generationGuardedPrincipalPolicyWarmer(\n  warmer: ReferencedPrincipalPolicyWarmer | undefined,\n  stillCurrent: (() => boolean) | undefined,\n): ReferencedPrincipalPolicyWarmer | undefined {\n  if (!warmer || !stillCurrent) return warmer;\n  const guard =\n    (operation: ReferencedPrincipalPolicyWarmer) =>\n    async (input: ReferencedPrincipalPolicyWarmRequest) => {\n      assertProjectionVerificationCurrent(stillCurrent);\n      await operation({ ...input, stillCurrent });\n      assertProjectionVerificationCurrent(stillCurrent);\n    };\n  const guardWithCapabilities = (\n    operation: ReferencedPrincipalPolicyWarmer,\n  ): ReferencedPrincipalPolicyWarmer => {\n    const guarded = guard(operation);\n    const resolve = operation.resolveReference;\n    const resolveProjectionHistory = operation.resolveProjectionHistory;\n    return Object.assign(guarded, {\n      ...(resolveProjectionHistory\n        ? {\n            resolveProjectionHistory: async (\n              input: ProjectionPolicyHistoryResolveRequest,\n            ) => {\n              const current = () =>\n                stillCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(current);\n              const result = await resolveProjectionHistory({\n                ...input,\n                stillCurrent: current,\n              });\n              assertProjectionVerificationCurrent(current);\n              return result;\n            },\n          }\n        : {}),\n      ...(resolve\n        ? {\n            resolveReference: async (input: PrincipalPolicyResolveRequest) => {\n              const current = () =>\n                stillCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(current);\n              const result = await resolve({ ...input, stillCurrent: current });\n              assertProjectionVerificationCurrent(current);\n              return result;\n            },\n          }\n        : {}),\n      ...(operation.cacheBundles\n        ? {\n            cacheBundles: async (input: PrincipalPolicyBundleCacheRequest) => {\n              assertProjectionVerificationCurrent(stillCurrent);\n              await operation.cacheBundles?.({ ...input, stillCurrent });\n              assertProjectionVerificationCurrent(stillCurrent);\n            },\n          }\n        : {}),\n    });\n  };\n  return guardWithCapabilities(warmer);\n}\n\nexport function withGenerationGuardedPolicyWarmer<\n  Input extends {\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  },\n>(input: Input): Input {\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    ),\n  };\n}\n"]}

package/data/persistence/keyingCheckpointAdvancePersistence.js

@@ -5,6 +5,7 @@ import { ensureSqlTables } from "../sqlite/sqlSchema.js";
 import { storeDocumentPurgeCheckpointInTransaction, } from "./documentPurgeCheckpointPersistence.js";
 import { validateAccessManifestCheckpointEvidence } from "./keyingCheckpointEvidence.js";
 import { accessManifestObjectKey, loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertAccessManifestCheckpointInTransaction, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
+import { validatePrincipalAuthorizationCheckpoints } from "./principalAuthorizationCheckpoints.js";
 import { assertContainerNotRetired } from "./principalGrantRetirementPersistence.js";
 import { assertPrincipalPolicyBundleStoredInTransaction, writePrincipalPolicyBundleInTransaction, } from "./principalPolicyPersistence.js";
 import { assertBundleMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyBundle.js";
@@ -106,7 +107,7 @@ async function writePolicyCheckpoints(tx, pending, updatedAt, organizationId) {
     }
 }
 async function ensureKeyingCheckpointValidationTables(input) {
-    await ensureSqlTables(input.execSql, input.policies.length > 0
+    await ensureSqlTables(input.execSql, input.policies.length > 0 || (input.authorizationPolicies?.length ?? 0) > 0
         ? [...principalPolicyTables, ...keyingCheckpointTables]
         : keyingCheckpointTables);
 }
@@ -116,6 +117,7 @@ export async function validateKeyingCheckpointsAtomically(input) {
     const validate = async (tx) => {
         await validateAccessAdvances(tx, input.access);
         await validatePolicyAdvances(tx, input.policies);
+        await validatePrincipalAuthorizationCheckpoints(tx, input.authorizationPolicies ?? []);
     };
     const runtime = getClientSQLitePersistenceRuntime(input.execSql);
     if (input.stillCurrent) {
@@ -139,6 +141,7 @@ export async function advanceKeyingCheckpointsAtomically(input) {
     const advance = async (tx) => {
         const access = await validateAccessAdvances(tx, input.access);
         const policies = await validatePolicyAdvances(tx, input.policies);
+        await validatePrincipalAuthorizationCheckpoints(tx, input.authorizationPolicies ?? []);
         await writeAccessCheckpoints(tx, access, updatedAt);
         await writePolicyCheckpoints(tx, policies, updatedAt, input.organizationId);
         if (input.documentPurgeCheckpoint) {

package/data/persistence/keyingCheckpointAdvancePersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAIvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EACL,8CAA8C,EAC9C,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AA2BpF,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,kCAAkC,CAC9D,EAAE,EACF,OAAO,CAAC,IAAI,CAAC,UAAU,CACxB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,cAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,KAAsC;IAEtC,MAAM,eAAe,CACnB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,sBAAsB,CAAC;QACvD,CAAC,CAAC,sBAAsB,CAC3B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAOxD;IACC,MAAM,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAElE,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAMrE;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,8CAA8C,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,sBAAsB,CAC1B,EAAE,EACF,QAAQ,EACR,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IACE,CAAC,UAAU;gBACX,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBACrC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { assertContainerNotRetired } from \"./principalGrantRetirementPersistence\";\nimport {\n  assertPrincipalPolicyBundleStoredInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\ninterface VerifiedPrincipalPolicyBundleEntry {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n\n  for (const advance of advances) {\n    await assertContainerNotRetired(tx, advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const localCheckpoint = await loadStoredAccessManifestCheckpoint(\n      tx,\n      advance.head.checkpoint,\n    );\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\nasync function validatePolicyAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const { checkpoint } of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\nasync function writePolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  for (const policy of pending.values()) {\n    await upsertPrincipalPolicyCheckpointInTransaction(\n      tx,\n      policy.checkpoint,\n      updatedAt,\n      organizationId,\n    );\n  }\n}\n\nasync function ensureKeyingCheckpointValidationTables(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  await ensureSqlTables(\n    input.execSql,\n    input.policies.length > 0\n      ? [...principalPolicyTables, ...keyingCheckpointTables]\n      : keyingCheckpointTables,\n  );\n}\n\n/** Re-checks verified candidates against durable pins without advancing them. */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  await ensureKeyingCheckpointValidationTables(input);\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePolicyAdvances(tx, input.policies);\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(input: {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  await ensureKeyingCheckpointValidationTables(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePolicyAdvances(tx, input.policies);\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePolicyCheckpoints(tx, policies, updatedAt, input.organizationId);\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n\n/**\n * Persists each verified full policy bundle together with its durable head.\n * This prevents a crash or bundle-write failure from leaving a checkpoint\n * without the exact same-head payload and member-envelope evidence.\n */\nexport async function persistVerifiedPrincipalPolicyBundlesAtomically(input: {\n  readonly entries: readonly VerifiedPrincipalPolicyBundleEntry[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  const seen = new Set<string>();\n  for (const entry of input.entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `verified policy bundle batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const persist = async (tx: ClientSQLiteTransactionScope) => {\n    const policies = await validatePolicyAdvances(\n      tx,\n      input.entries.map((entry) => entry.policy),\n    );\n    for (const entry of input.entries) {\n      await writePrincipalPolicyBundleInTransaction(\n        tx,\n        entry.bundle,\n        input.updatedAt,\n        input.organizationId,\n      );\n      await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);\n    }\n    await writePolicyCheckpoints(\n      tx,\n      policies,\n      input.updatedAt,\n      input.organizationId,\n    );\n    for (const policy of policies.values()) {\n      const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n      if (\n        !checkpoint ||\n        checkpoint.version !== policy.version ||\n        checkpoint.stateHash !== policy.stateHash\n      ) {\n        throw new Error(\n          \"Verified principal policy checkpoint was not persisted\",\n        );\n      }\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(persist, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(persist, { behavior: \"immediate\" });\n}\n"]}
+{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAKvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EACL,8CAA8C,EAC9C,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AA8BpF,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,kCAAkC,CAC9D,EAAE,EACF,OAAO,CAAC,IAAI,CAAC,UAAU,CACxB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,cAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,KAAsC;IAEtC,MAAM,eAAe,CACnB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACzE,CAAC,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,sBAAsB,CAAC;QACvD,CAAC,CAAC,sBAAsB,CAC3B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAUxD;IACC,MAAM,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QAEF,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAMrE;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,8CAA8C,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,sBAAsB,CAC1B,EAAE,EACF,QAAQ,EACR,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IACE,CAAC,UAAU;gBACX,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBACrC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { validatePrincipalAuthorizationCheckpoints } from \"./principalAuthorizationCheckpoints\";\nimport { assertContainerNotRetired } from \"./principalGrantRetirementPersistence\";\nimport {\n  assertPrincipalPolicyBundleStoredInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\ninterface VerifiedPrincipalPolicyBundleEntry {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n\n  for (const advance of advances) {\n    await assertContainerNotRetired(tx, advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const localCheckpoint = await loadStoredAccessManifestCheckpoint(\n      tx,\n      advance.head.checkpoint,\n    );\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\nasync function validatePolicyAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const { checkpoint } of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\nasync function writePolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  for (const policy of pending.values()) {\n    await upsertPrincipalPolicyCheckpointInTransaction(\n      tx,\n      policy.checkpoint,\n      updatedAt,\n      organizationId,\n    );\n  }\n}\n\nasync function ensureKeyingCheckpointValidationTables(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  await ensureSqlTables(\n    input.execSql,\n    input.policies.length > 0 || (input.authorizationPolicies?.length ?? 0) > 0\n      ? [...principalPolicyTables, ...keyingCheckpointTables]\n      : keyingCheckpointTables,\n  );\n}\n\n/** Re-checks verified candidates against durable pins without advancing them. */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  await ensureKeyingCheckpointValidationTables(input);\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePolicyAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(input: {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  await ensureKeyingCheckpointValidationTables(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePolicyAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePolicyCheckpoints(tx, policies, updatedAt, input.organizationId);\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n\n/**\n * Persists each verified full policy bundle together with its durable head.\n * This prevents a crash or bundle-write failure from leaving a checkpoint\n * without the exact same-head payload and member-envelope evidence.\n */\nexport async function persistVerifiedPrincipalPolicyBundlesAtomically(input: {\n  readonly entries: readonly VerifiedPrincipalPolicyBundleEntry[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  const seen = new Set<string>();\n  for (const entry of input.entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `verified policy bundle batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const persist = async (tx: ClientSQLiteTransactionScope) => {\n    const policies = await validatePolicyAdvances(\n      tx,\n      input.entries.map((entry) => entry.policy),\n    );\n    for (const entry of input.entries) {\n      await writePrincipalPolicyBundleInTransaction(\n        tx,\n        entry.bundle,\n        input.updatedAt,\n        input.organizationId,\n      );\n      await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);\n    }\n    await writePolicyCheckpoints(\n      tx,\n      policies,\n      input.updatedAt,\n      input.organizationId,\n    );\n    for (const policy of policies.values()) {\n      const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n      if (\n        !checkpoint ||\n        checkpoint.version !== policy.version ||\n        checkpoint.stateHash !== policy.stateHash\n      ) {\n        throw new Error(\n          \"Verified principal policy checkpoint was not persisted\",\n        );\n      }\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(persist, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(persist, { behavior: \"immediate\" });\n}\n"]}

package/data/persistence/organizationFounderPersistence.js

@@ -1,6 +1,6 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
 import { eq } from "drizzle-orm";
-import { principalPolicyEvidenceEntries, } from "../principals/principalPolicyEvidence.js";
+import { principalPolicyEvidenceEntries } from "../principals/principalPolicyEvidence.js";
 import { organizationFounders } from "../sqlite/organizationFounderSchema.js";
 import { keyingCheckpointTables } from "../sqlite/schema.js";
 import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";