@tearleads/client-sdk 0.1.14 → 0.1.15

package/workflows/documents/linkSetBlobRewraps.js

@@ -35,6 +35,8 @@ export async function prepareDocumentLinkBlobRewraps(input) {
             execSql: input.execSql,
             resolveProjectionUserKey: requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Attachment relink"),
             targetSecretKey: input.targetSecretKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
             writerProjection: input.writerProjection,
         };
         const needsKey = input.targets.some((target) => !retainedTarget(binding, target, documentId));

package/workflows/documents/linkSetBlobRewraps.js.map

@@ -1 +1 @@
-{"version":3,"file":"linkSetBlobRewraps.js","sourceRoot":"","sources":["linkSetBlobRewraps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAG3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EACL,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAQnF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAOiC;IAEjC,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,gCAAgC,CACtD,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;IACF,MAAM,cAAc,GAAG,2BAA2B,CAChD,KAAK,CAAC,SAAS,EACf,UAAU,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,kBAAkB,EAAE,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,wBAAwB,EAAE,gCAAgC,CACxD,KAAK,CAAC,wBAAwB,EAC9B,mBAAmB,CACpB;YACD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,CAAC,QAAQ;YAAE,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBACV,OAAO;oBACL,GAAG,QAAQ;oBACX,GAAG,MAAM;oBACT,gBAAgB,EAAE,iBAAiB,CACjC,QAAQ,CAAC,gBAAgB,EACzB,0BAA0B,CAC3B;iBACF,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;YACJ,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,OAAO,oBAAoB,CAAC;gBAC1B,OAAO;gBACP,UAAU;gBACV,UAAU;gBACV,GAAG;gBACH,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACzD,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAMnC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QAChE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,gBAAgB,EAAE;YAChB,KAAK,EAAE,2BAA2B;YAClC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,OAA8B,EAC9B,MAAgC,EAChC,UAAkB;IAElB,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACzC,SAAS,CAAC,UAAU,KAAK,UAAU;QACnC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAC5C,SAAS,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI;QACvB,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACvD,KAAK,CAAC,yBAAyB;KAChC,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,yEAAyE;QACzE,8EAA8E;QAC9E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,kCAAkC,CAAC;gBAChD,GAAG,UAAU;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBACzC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;aAC5D,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjD,+DAA+D;YAC/D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ;gBACV,gBAAgB,CACd,QAAQ,EACR,GAAG,EACH,sDAAsD,CACvD,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAqB,EAAE,CAAqB;IAClE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkAccessEventBody,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  BlobAttachmentSummary,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  deriveDocumentTargetFromProjection,\n  unwrapContainerKekPath,\n} from \"../../data/documents/shared/projection\";\nimport {\n  assertEqualBytes,\n  targetKey,\n} from \"../../data/documents/shared/readers\";\nimport type {\n  DocumentLinkSetMutationApi,\n  ProjectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport { readCanonicalJson } from \"../../data/keyingCanonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { createAttachmentProofReader } from \"../blobs/attachmentDecryptor\";\nimport { createAttachmentKeyAuthenticator } from \"../blobs/attachmentKeyAuthenticator\";\nimport { verifyRetainedAttachment } from \"../blobs/retainedAttachmentVerification\";\n\ninterface BlobRewrap {\n  blobId: string;\n  contentKeyEpoch: number;\n  targets: DocumentLinkAccessEventBody[\"blobRewraps\"][number][\"targets\"][number][];\n}\n\n/** Authenticate the existing bytes before propagating their DEK to a new scope. */\nexport async function prepareDocumentLinkBlobRewraps(\n  input: {\n    apiClient: DocumentLinkSetMutationApi;\n    execSql: ExecSql;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    targets: readonly DocumentContentKeyTarget[];\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<DocumentLinkAccessEventBody[\"blobRewraps\"]> {\n  const documentId = input.writerProjection.documentId;\n  const bindings = await input.apiClient.listDocumentAttachments(documentId);\n  // The API refuses the link unless every active binding is rewrapped, so an\n  // unavailable listing (offline, or a 409 while a bind is mid-flight) is a\n  // retryable availability failure of this mutation, not integrity evidence.\n  if (!bindings)\n    throw new ProjectionDependencyUnavailableError(\n      \"Document attachments are unavailable for relinking\",\n    );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (bindings.length === 0) return [];\n  const keks = await collectRelinkKeks(input);\n  const authenticateKey = createAttachmentKeyAuthenticator(\n    input.apiClient,\n    documentId,\n  );\n  const verifyRetained = createAttachmentProofReader(\n    input.apiClient,\n    documentId,\n    verifyRetainedAttachment,\n  );\n  const rewrapByBlob = new Map<string, BlobRewrap>();\n  for (const binding of bindings) {\n    const verification = {\n      binding,\n      expectedDocumentId: documentId,\n      expectedSlotId: binding.slotId,\n      execSql: input.execSql,\n      resolveProjectionUserKey: requireProjectionUserKeyResolver(\n        input.resolveProjectionUserKey,\n        \"Attachment relink\",\n      ),\n      targetSecretKey: input.targetSecretKey,\n      writerProjection: input.writerProjection,\n    };\n    const needsKey = input.targets.some(\n      (target) => !retainedTarget(binding, target, documentId),\n    );\n    const contentKey = needsKey ? await authenticateKey(verification) : null;\n    if (!needsKey) await verifyRetained(verification);\n    const targets = await Promise.all(\n      input.targets.map(async (target) => {\n        const previous = retainedTarget(binding, target, documentId);\n        if (previous)\n          return {\n            ...previous,\n            ...target,\n            wrappingMetadata: readCanonicalJson(\n              previous.wrappingMetadata,\n              \"Attachment wrap metadata\",\n            ),\n          };\n        const kek = keks.get(targetKey(target));\n        if (!kek)\n          throw new Error(\n            \"Attachment destination is not a verified current container head\",\n          );\n        if (!contentKey)\n          throw new Error(\"Attachment content key is unavailable\");\n        return wrapBlobKeyForTarget({\n          binding,\n          contentKey,\n          documentId,\n          kek,\n          target,\n        });\n      }),\n    );\n    const rewrap = rewrapByBlob.get(binding.blobId) ?? {\n      blobId: binding.blobId,\n      contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n      targets: [],\n    };\n    if (rewrap.contentKeyEpoch !== binding.contentKeyBundle.contentKeyEpoch)\n      throw new Error(\"Attachment content epoch changed during relinking\");\n    rewrap.targets.push(...targets);\n    rewrapByBlob.set(binding.blobId, rewrap);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  }\n  return [...rewrapByBlob.values()].sort(compareBlobIds);\n}\n\nasync function wrapBlobKeyForTarget(input: {\n  binding: BlobAttachmentSummary;\n  contentKey: Uint8Array;\n  documentId: string;\n  kek: Uint8Array;\n  target: DocumentContentKeyTarget;\n}) {\n  const { binding, target } = input;\n  const wrapped = await wrapContentKey(input.contentKey, input.kek, {\n    kind: \"Blob\",\n    objectId: binding.blobId,\n    contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n    containerId: target.containerId,\n    containerKeyEpochId: target.containerKeyEpochId,\n  });\n  return {\n    ...target,\n    bindingId: binding.bindingId,\n    documentId: input.documentId,\n    wrappedKey: bytesToBase64(wrapped.ciphertext),\n    wrappingMetadata: {\n      suite: BLOB_CONTENT_KEY_WRAP_SUITE,\n      iv: bytesToBase64(wrapped.iv),\n    },\n  };\n}\n\nfunction retainedTarget(\n  binding: BlobAttachmentSummary,\n  target: DocumentContentKeyTarget,\n  documentId: string,\n) {\n  return binding.contentKeyBundle.targets.find(\n    (candidate) =>\n      candidate.bindingId === binding.bindingId &&\n      candidate.documentId === documentId &&\n      candidate.containerId === target.containerId &&\n      candidate.containerKeyEpochId === target.containerKeyEpochId,\n  );\n}\n\nasync function collectRelinkKeks(\n  input: Parameters<typeof prepareDocumentLinkBlobRewraps>[0],\n): Promise<Map<string, Uint8Array>> {\n  const keks = new Map<string, Uint8Array>();\n  for (const projection of [\n    ...documentContainerProjections(input.writerProjection),\n    input.targetContainerProjection,\n  ]) {\n    const keys = await unwrapContainerKekPath({\n      projection,\n      secretKey: input.targetSecretKey,\n      execSql: input.execSql,\n      ...projectionVerificationOptions(input),\n    });\n    // Every node of this verified path has a current signed head. Historical\n    // keyring entries may open source bytes, but never enter the destination map.\n    for (const [index, head] of projection.containerKeks.entries()) {\n      const target = deriveDocumentTargetFromProjection({\n        ...projection,\n        containerId: head.containerId,\n        path: projection.path.slice(0, index + 1),\n        containerKeks: projection.containerKeks.slice(0, index + 1),\n      });\n      const key = keys.get(target.containerKeyEpochId);\n      // A direct child grantee need not possess any ancestor secret.\n      if (!key) continue;\n      const id = targetKey(target);\n      const previous = keks.get(id);\n      if (previous)\n        assertEqualBytes(\n          previous,\n          key,\n          \"Attachment link projections contain conflicting KEKs\",\n        );\n      keks.set(id, key);\n    }\n  }\n  return keks;\n}\n\nfunction compareBlobIds(a: { blobId: string }, b: { blobId: string }): number {\n  return a.blobId < b.blobId ? -1 : a.blobId > b.blobId ? 1 : 0;\n}\n"]}
+{"version":3,"file":"linkSetBlobRewraps.js","sourceRoot":"","sources":["linkSetBlobRewraps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAG3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EACL,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAQnF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAOiC;IAEjC,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,gCAAgC,CACtD,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;IACF,MAAM,cAAc,GAAG,2BAA2B,CAChD,KAAK,CAAC,SAAS,EACf,UAAU,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,kBAAkB,EAAE,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,wBAAwB,EAAE,gCAAgC,CACxD,KAAK,CAAC,wBAAwB,EAC9B,mBAAmB,CACpB;YACD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,CAAC,QAAQ;YAAE,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBACV,OAAO;oBACL,GAAG,QAAQ;oBACX,GAAG,MAAM;oBACT,gBAAgB,EAAE,iBAAiB,CACjC,QAAQ,CAAC,gBAAgB,EACzB,0BAA0B,CAC3B;iBACF,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;YACJ,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,OAAO,oBAAoB,CAAC;gBAC1B,OAAO;gBACP,UAAU;gBACV,UAAU;gBACV,GAAG;gBACH,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACzD,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAMnC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QAChE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,gBAAgB,EAAE;YAChB,KAAK,EAAE,2BAA2B;YAClC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,OAA8B,EAC9B,MAAgC,EAChC,UAAkB;IAElB,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACzC,SAAS,CAAC,UAAU,KAAK,UAAU;QACnC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAC5C,SAAS,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI;QACvB,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACvD,KAAK,CAAC,yBAAyB;KAChC,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,yEAAyE;QACzE,8EAA8E;QAC9E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,kCAAkC,CAAC;gBAChD,GAAG,UAAU;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBACzC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;aAC5D,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjD,+DAA+D;YAC/D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ;gBACV,gBAAgB,CACd,QAAQ,EACR,GAAG,EACH,sDAAsD,CACvD,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAqB,EAAE,CAAqB;IAClE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkAccessEventBody,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  BlobAttachmentSummary,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  deriveDocumentTargetFromProjection,\n  unwrapContainerKekPath,\n} from \"../../data/documents/shared/projection\";\nimport {\n  assertEqualBytes,\n  targetKey,\n} from \"../../data/documents/shared/readers\";\nimport type {\n  DocumentLinkSetMutationApi,\n  ProjectionVerificationOptions,\n} from \"../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport { readCanonicalJson } from \"../../data/keyingCanonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { createAttachmentProofReader } from \"../blobs/attachmentDecryptor\";\nimport { createAttachmentKeyAuthenticator } from \"../blobs/attachmentKeyAuthenticator\";\nimport { verifyRetainedAttachment } from \"../blobs/retainedAttachmentVerification\";\n\ninterface BlobRewrap {\n  blobId: string;\n  contentKeyEpoch: number;\n  targets: DocumentLinkAccessEventBody[\"blobRewraps\"][number][\"targets\"][number][];\n}\n\n/** Authenticate the existing bytes before propagating their DEK to a new scope. */\nexport async function prepareDocumentLinkBlobRewraps(\n  input: {\n    apiClient: DocumentLinkSetMutationApi;\n    execSql: ExecSql;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    targets: readonly DocumentContentKeyTarget[];\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<DocumentLinkAccessEventBody[\"blobRewraps\"]> {\n  const documentId = input.writerProjection.documentId;\n  const bindings = await input.apiClient.listDocumentAttachments(documentId);\n  // The API refuses the link unless every active binding is rewrapped, so an\n  // unavailable listing (offline, or a 409 while a bind is mid-flight) is a\n  // retryable availability failure of this mutation, not integrity evidence.\n  if (!bindings)\n    throw new ProjectionDependencyUnavailableError(\n      \"Document attachments are unavailable for relinking\",\n    );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (bindings.length === 0) return [];\n  const keks = await collectRelinkKeks(input);\n  const authenticateKey = createAttachmentKeyAuthenticator(\n    input.apiClient,\n    documentId,\n  );\n  const verifyRetained = createAttachmentProofReader(\n    input.apiClient,\n    documentId,\n    verifyRetainedAttachment,\n  );\n  const rewrapByBlob = new Map<string, BlobRewrap>();\n  for (const binding of bindings) {\n    const verification = {\n      binding,\n      expectedDocumentId: documentId,\n      expectedSlotId: binding.slotId,\n      execSql: input.execSql,\n      resolveProjectionUserKey: requireProjectionUserKeyResolver(\n        input.resolveProjectionUserKey,\n        \"Attachment relink\",\n      ),\n      targetSecretKey: input.targetSecretKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      writerProjection: input.writerProjection,\n    };\n    const needsKey = input.targets.some(\n      (target) => !retainedTarget(binding, target, documentId),\n    );\n    const contentKey = needsKey ? await authenticateKey(verification) : null;\n    if (!needsKey) await verifyRetained(verification);\n    const targets = await Promise.all(\n      input.targets.map(async (target) => {\n        const previous = retainedTarget(binding, target, documentId);\n        if (previous)\n          return {\n            ...previous,\n            ...target,\n            wrappingMetadata: readCanonicalJson(\n              previous.wrappingMetadata,\n              \"Attachment wrap metadata\",\n            ),\n          };\n        const kek = keks.get(targetKey(target));\n        if (!kek)\n          throw new Error(\n            \"Attachment destination is not a verified current container head\",\n          );\n        if (!contentKey)\n          throw new Error(\"Attachment content key is unavailable\");\n        return wrapBlobKeyForTarget({\n          binding,\n          contentKey,\n          documentId,\n          kek,\n          target,\n        });\n      }),\n    );\n    const rewrap = rewrapByBlob.get(binding.blobId) ?? {\n      blobId: binding.blobId,\n      contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n      targets: [],\n    };\n    if (rewrap.contentKeyEpoch !== binding.contentKeyBundle.contentKeyEpoch)\n      throw new Error(\"Attachment content epoch changed during relinking\");\n    rewrap.targets.push(...targets);\n    rewrapByBlob.set(binding.blobId, rewrap);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  }\n  return [...rewrapByBlob.values()].sort(compareBlobIds);\n}\n\nasync function wrapBlobKeyForTarget(input: {\n  binding: BlobAttachmentSummary;\n  contentKey: Uint8Array;\n  documentId: string;\n  kek: Uint8Array;\n  target: DocumentContentKeyTarget;\n}) {\n  const { binding, target } = input;\n  const wrapped = await wrapContentKey(input.contentKey, input.kek, {\n    kind: \"Blob\",\n    objectId: binding.blobId,\n    contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n    containerId: target.containerId,\n    containerKeyEpochId: target.containerKeyEpochId,\n  });\n  return {\n    ...target,\n    bindingId: binding.bindingId,\n    documentId: input.documentId,\n    wrappedKey: bytesToBase64(wrapped.ciphertext),\n    wrappingMetadata: {\n      suite: BLOB_CONTENT_KEY_WRAP_SUITE,\n      iv: bytesToBase64(wrapped.iv),\n    },\n  };\n}\n\nfunction retainedTarget(\n  binding: BlobAttachmentSummary,\n  target: DocumentContentKeyTarget,\n  documentId: string,\n) {\n  return binding.contentKeyBundle.targets.find(\n    (candidate) =>\n      candidate.bindingId === binding.bindingId &&\n      candidate.documentId === documentId &&\n      candidate.containerId === target.containerId &&\n      candidate.containerKeyEpochId === target.containerKeyEpochId,\n  );\n}\n\nasync function collectRelinkKeks(\n  input: Parameters<typeof prepareDocumentLinkBlobRewraps>[0],\n): Promise<Map<string, Uint8Array>> {\n  const keks = new Map<string, Uint8Array>();\n  for (const projection of [\n    ...documentContainerProjections(input.writerProjection),\n    input.targetContainerProjection,\n  ]) {\n    const keys = await unwrapContainerKekPath({\n      projection,\n      secretKey: input.targetSecretKey,\n      execSql: input.execSql,\n      ...projectionVerificationOptions(input),\n    });\n    // Every node of this verified path has a current signed head. Historical\n    // keyring entries may open source bytes, but never enter the destination map.\n    for (const [index, head] of projection.containerKeks.entries()) {\n      const target = deriveDocumentTargetFromProjection({\n        ...projection,\n        containerId: head.containerId,\n        path: projection.path.slice(0, index + 1),\n        containerKeks: projection.containerKeks.slice(0, index + 1),\n      });\n      const key = keys.get(target.containerKeyEpochId);\n      // A direct child grantee need not possess any ancestor secret.\n      if (!key) continue;\n      const id = targetKey(target);\n      const previous = keks.get(id);\n      if (previous)\n        assertEqualBytes(\n          previous,\n          key,\n          \"Attachment link projections contain conflicting KEKs\",\n        );\n      keks.set(id, key);\n    }\n  }\n  return keks;\n}\n\nfunction compareBlobIds(a: { blobId: string }, b: { blobId: string }): number {\n  return a.blobId < b.blobId ? -1 : a.blobId > b.blobId ? 1 : 0;\n}\n"]}

package/workflows/documents/runtime.d.ts

@@ -1,5 +1,6 @@
 import type { ApiClient } from "../../internal/api-client/index.js";
 import { type DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
+import type { PrincipalHistoryProtectionLease } from "../../data/principals/principalHistoryProtection.js";
 import { type TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
 import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeInfraInput, WorkflowRuntimeStateInput, WorkflowRuntimeUtilInput } from "../runtimeInput.js";
 interface DocumentsWorkflowRuntimeUtilInput extends Omit<WorkflowRuntimeUtilInput, "logError"> {
@@ -27,6 +28,8 @@ export interface DocumentsWorkflowRuntimeInputGroups {
     readonly util: DocumentsWorkflowRuntimeUtilInput;
 }
 export interface DocumentsWorkflowRuntimeInput extends DocumentsWorkflowRuntimeInputGroups {
+    /** Private host custody, inherited without exposing it on runtime views. */
+    readonly withPrincipalHistoryProtection?: PrincipalHistoryProtectionLease | undefined;
     readonly apiClient: ApiClient;
     readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
 }

package/workflows/documents/runtime.js

@@ -1,4 +1,5 @@
 import { resolveDocumentProjectorRegistry, } from "../../data/documents/documentKinds.js";
+import { inheritPrincipalHistoryProtection } from "../../data/principals/principalHistoryRuntime.js";
 import { requireTrustedUserIdentityResolver, } from "../../data/trustedUserIdentity/index.js";
 export function createDocumentsWorkflowRuntime(input) {
     const documentProjectors = resolveDocumentProjectorRegistry(input.infra.documentProjectors);
@@ -6,7 +7,7 @@ export function createDocumentsWorkflowRuntime(input) {
         ...input.infra,
         documentProjectors,
     };
-    return {
+    return inheritPrincipalHistoryProtection(input, {
         apiClient: input.apiClient,
         auth: input.auth,
         crypto: input.crypto,
@@ -14,6 +15,6 @@ export function createDocumentsWorkflowRuntime(input) {
         resolveTrustedUserIdentity: requireTrustedUserIdentityResolver(input.resolveTrustedUserIdentity),
         state: input.state,
         util: input.util,
-    };
+    });
 }
 //# sourceMappingURL=runtime.js.map

package/workflows/documents/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAqDxC,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,KAAK;QACd,kBAAkB;KACnB,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,0BAA0B,EAAE,kCAAkC,CAC5D,KAAK,CAAC,0BAA0B,CACjC;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../runtimeInput\";\n\ninterface DocumentsWorkflowRuntimeUtilInput\n  extends Omit<WorkflowRuntimeUtilInput, \"logError\"> {\n  /** Receives handled quarantine errors without converting them to strings. */\n  readonly logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n}\n\nexport interface DocumentsWorkflowRuntimeInfra\n  extends Omit<WorkflowRuntimeInfraInput, \"dbStatus\"> {\n  readonly dbStatus: string;\n}\n\ninterface DocumentsWorkflowRuntimeInputInfra\n  extends Omit<DocumentsWorkflowRuntimeInfra, \"documentProjectors\"> {\n  readonly documentProjectors: DocumentProjectorRegistryInput;\n}\n\nexport interface DocumentsWorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInputGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInputInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInput\n  extends DocumentsWorkflowRuntimeInputGroups {\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface DocumentsWorkflowRuntime\n  extends DocumentsWorkflowRuntimeGroups {\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createDocumentsWorkflowRuntime(\n  input: DocumentsWorkflowRuntimeInput,\n): DocumentsWorkflowRuntime {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.infra.documentProjectors,\n  );\n  const infra = {\n    ...input.infra,\n    documentProjectors,\n  };\n\n  return {\n    apiClient: input.apiClient,\n    auth: input.auth,\n    crypto: input.crypto,\n    infra,\n    resolveTrustedUserIdentity: requireTrustedUserIdentityResolver(\n      input.resolveTrustedUserIdentity,\n    ),\n    state: input.state,\n    util: input.util,\n  };\n}\n"]}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAyDxC,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,KAAK;QACd,kBAAkB;KACnB,CAAC;IAEF,OAAO,iCAAiC,CAAC,KAAK,EAAE;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,0BAA0B,EAAE,kCAAkC,CAC5D,KAAK,CAAC,0BAA0B,CACjC;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { inheritPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../runtimeInput\";\n\ninterface DocumentsWorkflowRuntimeUtilInput\n  extends Omit<WorkflowRuntimeUtilInput, \"logError\"> {\n  /** Receives handled quarantine errors without converting them to strings. */\n  readonly logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n}\n\nexport interface DocumentsWorkflowRuntimeInfra\n  extends Omit<WorkflowRuntimeInfraInput, \"dbStatus\"> {\n  readonly dbStatus: string;\n}\n\ninterface DocumentsWorkflowRuntimeInputInfra\n  extends Omit<DocumentsWorkflowRuntimeInfra, \"documentProjectors\"> {\n  readonly documentProjectors: DocumentProjectorRegistryInput;\n}\n\nexport interface DocumentsWorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInputGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInputInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInput\n  extends DocumentsWorkflowRuntimeInputGroups {\n  /** Private host custody, inherited without exposing it on runtime views. */\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface DocumentsWorkflowRuntime\n  extends DocumentsWorkflowRuntimeGroups {\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createDocumentsWorkflowRuntime(\n  input: DocumentsWorkflowRuntimeInput,\n): DocumentsWorkflowRuntime {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.infra.documentProjectors,\n  );\n  const infra = {\n    ...input.infra,\n    documentProjectors,\n  };\n\n  return inheritPrincipalHistoryProtection(input, {\n    apiClient: input.apiClient,\n    auth: input.auth,\n    crypto: input.crypto,\n    infra,\n    resolveTrustedUserIdentity: requireTrustedUserIdentityResolver(\n      input.resolveTrustedUserIdentity,\n    ),\n    state: input.state,\n    util: input.util,\n  });\n}\n"]}

package/workflows/documents/syncFailureClassification.js

@@ -2,6 +2,7 @@ import { KeyingVerificationError } from "../../internal/crypto/index.js";
 import { DOCUMENT_MUTATION_ERROR_CODES, DOCUMENT_SYNC_ERROR_CODES, } from "../../internal/validators/response/index.js";
 import { ContainerKekRepairRequiredError } from "../../data/documents/shared/containerKekCurrency.js";
 import { isRetryableDocumentSyncConflict, isUpstreamDeletedDocumentSyncFailure, } from "../../data/documents/shared/responses.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { isKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
 /**
  * Read-only counterpart to describeDocumentSyncSubmitFailure: names a refused
@@ -56,7 +57,8 @@ export function projectionIntegrityErrorCode(error) {
 export function shouldRetryWithFreshProjection(error, messageMatches) {
     // A peer may already have repaired the chain. Refetch once; the same guard
     // rejects a still-stale response before any new ciphertext is produced.
-    if (error instanceof ContainerKekRepairRequiredError)
+    if (error instanceof ContainerKekRepairRequiredError ||
+        error instanceof ProjectionDependencyUnavailableError)
         return true;
     const integrityErrorCode = projectionIntegrityErrorCode(error);
     if (integrityErrorCode) {

package/workflows/documents/syncFailureClassification.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncFailureClassification.js","sourceRoot":"","sources":["syncFailureClassification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAqB1F;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,OAA8D;IAE9D,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,6BAA6B,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;IACrE,OAAO,+BAA+B,MAAM,GAAG,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAC/C,OAA8D;IAE9D,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7E,OAAO,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;AAC9E,CAAC;AAOD,SAAS,2BAA2B,CAAC,KAAc;IACjD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAc;IAEd,IACE,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;QAC3C,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,EACrE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,IAAI,KAAK,UAAU;QACxB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,mBAAmB;QAC5B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc,EACd,cAA4C;IAE5C,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,KAAK,YAAY,+BAA+B;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,KAAK,UAAU,CAAC;IAC3C,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,KAAK,eAAe,EAAE,CAAC;QAC3D,yEAAyE;QACzE,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,YAAY,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,KAAc;IAEd,OAAO,8BAA8B,CACnC,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAChB,gEAAgE,CACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,gBAAgB,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,0BAA0B,CACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uCAAuC,CAAC,OAIvD;IACC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,6BAA6B,CAAC,qBAAqB,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,OAAO,CACL,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW;QACjC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,OAAO,CACL,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW;QACjC,KAAK,CAAC,kBAAkB,GAAG,CAAC;QAC5B,qCAAqC,CAAC,KAAK,CAAC,OAAO,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAI9D;IACC,IAAI,CAAC,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport {\n  DOCUMENT_MUTATION_ERROR_CODES,\n  DOCUMENT_SYNC_ERROR_CODES,\n} from \"@tearleads/validators/response\";\nimport { ContainerKekRepairRequiredError } from \"../../data/documents/shared/containerKekCurrency\";\nimport {\n  isRetryableDocumentSyncConflict,\n  isUpstreamDeletedDocumentSyncFailure,\n} from \"../../data/documents/shared/responses\";\nimport type { DocumentSyncSubmitFailure } from \"../../data/documents/shared/types\";\nimport { isKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport type RemoteDocumentDeletionHandler = (input: {\n  /** Present only after the SDK has verified the signed terminal purge proof. */\n  readonly commitPurgeProof?:\n    | ((transactionExecSql: ExecSql) => Promise<void>)\n    | undefined;\n  readonly documentId: string;\n}) => Promise<void> | void;\n\n/**\n * Invoked when a submission fails terminally — the failure is neither a\n * retryable conflict nor a recoverable update-id conflict, so the sync pass\n * stops and the pending writes stay queued (e.g. a 403 after write access was\n * revoked). Callers persist the failure so the write queue can surface it.\n */\nexport type TerminalSubmitFailureHandler = (\n  failure: DocumentSyncSubmitFailure,\n) => Promise<void> | void;\n\n/**\n * Read-only counterpart to describeDocumentSyncSubmitFailure: names a refused\n * revalidation without implying a blocked write. 403s never reach this — a\n * read-only 403 is deliberately suppressed (edge-case row 9) so unattempted\n * local edits are never flagged.\n */\nexport function describeDocumentRevalidationFailure(\n  failure: Pick<DocumentSyncSubmitFailure, \"message\" | \"status\">,\n): string {\n  const detail =\n    failure.message.trim().length > 0\n      ? failure.message.trim()\n      : \"the server refused the read\";\n  const suffix = failure.status === null ? \"\" : ` (${failure.status})`;\n  return `Remote revalidation failed: ${detail}${suffix}`;\n}\n\n/** Human-readable description of a terminal submit failure for queue display. */\nexport function describeDocumentSyncSubmitFailure(\n  failure: Pick<DocumentSyncSubmitFailure, \"message\" | \"status\">,\n): string {\n  if (failure.status === 403) {\n    return \"Write access denied by the server (403)\";\n  }\n  const message =\n    failure.message.trim().length > 0 ? failure.message.trim() : \"Sync failed\";\n  return failure.status === null ? message : `${message} (${failure.status})`;\n}\n\ntype ProjectionIntegrityErrorCode =\n  | \"equivocation\"\n  | \"rollback\"\n  | \"stale_predecessor\";\n\nfunction keyingVerificationErrorCode(error: unknown): string | null {\n  if (!isKeyingVerificationError(error) || !(error instanceof Error)) {\n    return null;\n  }\n  const code = Reflect.get(error, \"code\");\n  return typeof code === \"string\" ? code : null;\n}\n\nexport function projectionIntegrityErrorCode(\n  error: unknown,\n): ProjectionIntegrityErrorCode | null {\n  if (\n    !(error instanceof KeyingVerificationError) &&\n    !(error instanceof Error && error.name === \"KeyingVerificationError\")\n  ) {\n    return null;\n  }\n\n  const code = keyingVerificationErrorCode(error);\n  return code === \"rollback\" ||\n    code === \"equivocation\" ||\n    code === \"stale_predecessor\"\n    ? code\n    : null;\n}\n\n/**\n * Shared shell for the stale-projection retry classifiers. A cached\n * projection older than a checkpoint we already recorded (\"rollback\") —\n * typical right after a peer shared/rotated a linked container — is resolved\n * by refetching the current projection. The refetch is safe: it cannot\n * bypass the anti-rollback check, because a genuinely rolled-back server\n * response re-throws on the rebuilt plan. Any other keying-verification\n * failure is terminal; anything else defers to the caller's message\n * predicate for its unwrap-failure shape.\n */\nexport function shouldRetryWithFreshProjection(\n  error: unknown,\n  messageMatches: (message: string) => boolean,\n): boolean {\n  // A peer may already have repaired the chain. Refetch once; the same guard\n  // rejects a still-stale response before any new ciphertext is produced.\n  if (error instanceof ContainerKekRepairRequiredError) return true;\n  const integrityErrorCode = projectionIntegrityErrorCode(error);\n  if (integrityErrorCode) {\n    return integrityErrorCode === \"rollback\";\n  }\n  if (keyingVerificationErrorCode(error) === \"invalid_shape\") {\n    // Verification boundaries normalize malformed/stale projection data to a\n    // terminal error. One cache eviction is still safe: a dishonest or broken\n    // fresh response fails again outside this retry boundary.\n    return true;\n  }\n  if (isKeyingVerificationError(error)) {\n    return false;\n  }\n\n  return error instanceof Error && messageMatches(error.message);\n}\n\nexport function shouldRetrySyncWithFreshWriterProjection(\n  error: unknown,\n): boolean {\n  return shouldRetryWithFreshProjection(\n    error,\n    (message) =>\n      message.startsWith(\n        \"Document authorizing container KEK path could not be unwrapped\",\n      ) && message.includes(\"Container writer projection KEK\"),\n  );\n}\n\nexport function isRecoverableDocumentUpdateIdConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.updateIdConflict\n  );\n}\n\n/**\n * The server's covering-baseline gate refused a queued rotation checkpoint\n * (e.g. a leftover from an interrupted recovery or a lost heal ack) because\n * it no longer covers the committed frontier. The pass can repair itself by\n * regenerating a fresh covering baseline from the live document instead of\n * resubmitting the stale payload — which would fail terminally forever.\n */\nexport function isCheckpointCoverageConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.checkpointCoverageConflict\n  );\n}\n\n/**\n * A create submitted with a stable documentId whose first attempt already\n * committed server-side comes back as this 409 (see the server's\n * `assertCreateCanAdvanceDocumentHead`). It is not a failure — the caller adopts\n * the existing remote document instead of creating a duplicate.\n */\nexport function isDocumentManifestAlreadyExistsConflict(failure: {\n  readonly code?: string | undefined;\n  readonly message: string;\n  readonly status: number | null;\n}): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_MUTATION_ERROR_CODES.manifestAlreadyExists\n  );\n}\n\nexport function canRetryDocumentSyncConflict(input: {\n  attempt: number;\n  failure: DocumentSyncSubmitFailure;\n  maxAttempts: number;\n}): boolean {\n  return (\n    input.attempt < input.maxAttempts &&\n    isRetryableDocumentSyncConflict(input.failure)\n  );\n}\n\nexport function canRecoverDocumentUpdateIdConflict(input: {\n  attempt: number;\n  failure: DocumentSyncSubmitFailure;\n  maxAttempts: number;\n  pendingUpdateCount: number;\n}): boolean {\n  return (\n    input.attempt < input.maxAttempts &&\n    input.pendingUpdateCount > 0 &&\n    isRecoverableDocumentUpdateIdConflict(input.failure)\n  );\n}\n\nexport async function handleUpstreamDeletedDocumentSyncFailure(input: {\n  documentId: string;\n  failure: DocumentSyncSubmitFailure;\n  onRemoteDocumentDeleted?: RemoteDocumentDeletionHandler | undefined;\n}): Promise<boolean> {\n  if (!isUpstreamDeletedDocumentSyncFailure(input.failure)) {\n    return false;\n  }\n\n  await input.onRemoteDocumentDeleted?.({ documentId: input.documentId });\n  return true;\n}\n"]}
+{"version":3,"file":"syncFailureClassification.js","sourceRoot":"","sources":["syncFailureClassification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAqB1F;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,OAA8D;IAE9D,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,6BAA6B,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;IACrE,OAAO,+BAA+B,MAAM,GAAG,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAC/C,OAA8D;IAE9D,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7E,OAAO,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;AAC9E,CAAC;AAOD,SAAS,2BAA2B,CAAC,KAAc;IACjD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAc;IAEd,IACE,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;QAC3C,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,EACrE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,IAAI,KAAK,UAAU;QACxB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,mBAAmB;QAC5B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc,EACd,cAA4C;IAE5C,2EAA2E;IAC3E,wEAAwE;IACxE,IACE,KAAK,YAAY,+BAA+B;QAChD,KAAK,YAAY,oCAAoC;QAErD,OAAO,IAAI,CAAC;IACd,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,KAAK,UAAU,CAAC;IAC3C,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,KAAK,eAAe,EAAE,CAAC;QAC3D,yEAAyE;QACzE,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,YAAY,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,KAAc;IAEd,OAAO,8BAA8B,CACnC,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,CAChB,gEAAgE,CACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,gBAAgB,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAkC;IAElC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,0BAA0B,CACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uCAAuC,CAAC,OAIvD;IACC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO,CAAC,IAAI,KAAK,6BAA6B,CAAC,qBAAqB,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,OAAO,CACL,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW;QACjC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,OAAO,CACL,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW;QACjC,KAAK,CAAC,kBAAkB,GAAG,CAAC;QAC5B,qCAAqC,CAAC,KAAK,CAAC,OAAO,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAI9D;IACC,IAAI,CAAC,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport {\n  DOCUMENT_MUTATION_ERROR_CODES,\n  DOCUMENT_SYNC_ERROR_CODES,\n} from \"@tearleads/validators/response\";\nimport { ContainerKekRepairRequiredError } from \"../../data/documents/shared/containerKekCurrency\";\nimport {\n  isRetryableDocumentSyncConflict,\n  isUpstreamDeletedDocumentSyncFailure,\n} from \"../../data/documents/shared/responses\";\nimport type { DocumentSyncSubmitFailure } from \"../../data/documents/shared/types\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { isKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport type RemoteDocumentDeletionHandler = (input: {\n  /** Present only after the SDK has verified the signed terminal purge proof. */\n  readonly commitPurgeProof?:\n    | ((transactionExecSql: ExecSql) => Promise<void>)\n    | undefined;\n  readonly documentId: string;\n}) => Promise<void> | void;\n\n/**\n * Invoked when a submission fails terminally — the failure is neither a\n * retryable conflict nor a recoverable update-id conflict, so the sync pass\n * stops and the pending writes stay queued (e.g. a 403 after write access was\n * revoked). Callers persist the failure so the write queue can surface it.\n */\nexport type TerminalSubmitFailureHandler = (\n  failure: DocumentSyncSubmitFailure,\n) => Promise<void> | void;\n\n/**\n * Read-only counterpart to describeDocumentSyncSubmitFailure: names a refused\n * revalidation without implying a blocked write. 403s never reach this — a\n * read-only 403 is deliberately suppressed (edge-case row 9) so unattempted\n * local edits are never flagged.\n */\nexport function describeDocumentRevalidationFailure(\n  failure: Pick<DocumentSyncSubmitFailure, \"message\" | \"status\">,\n): string {\n  const detail =\n    failure.message.trim().length > 0\n      ? failure.message.trim()\n      : \"the server refused the read\";\n  const suffix = failure.status === null ? \"\" : ` (${failure.status})`;\n  return `Remote revalidation failed: ${detail}${suffix}`;\n}\n\n/** Human-readable description of a terminal submit failure for queue display. */\nexport function describeDocumentSyncSubmitFailure(\n  failure: Pick<DocumentSyncSubmitFailure, \"message\" | \"status\">,\n): string {\n  if (failure.status === 403) {\n    return \"Write access denied by the server (403)\";\n  }\n  const message =\n    failure.message.trim().length > 0 ? failure.message.trim() : \"Sync failed\";\n  return failure.status === null ? message : `${message} (${failure.status})`;\n}\n\ntype ProjectionIntegrityErrorCode =\n  | \"equivocation\"\n  | \"rollback\"\n  | \"stale_predecessor\";\n\nfunction keyingVerificationErrorCode(error: unknown): string | null {\n  if (!isKeyingVerificationError(error) || !(error instanceof Error)) {\n    return null;\n  }\n  const code = Reflect.get(error, \"code\");\n  return typeof code === \"string\" ? code : null;\n}\n\nexport function projectionIntegrityErrorCode(\n  error: unknown,\n): ProjectionIntegrityErrorCode | null {\n  if (\n    !(error instanceof KeyingVerificationError) &&\n    !(error instanceof Error && error.name === \"KeyingVerificationError\")\n  ) {\n    return null;\n  }\n\n  const code = keyingVerificationErrorCode(error);\n  return code === \"rollback\" ||\n    code === \"equivocation\" ||\n    code === \"stale_predecessor\"\n    ? code\n    : null;\n}\n\n/**\n * Shared shell for the stale-projection retry classifiers. A cached\n * projection older than a checkpoint we already recorded (\"rollback\") —\n * typical right after a peer shared/rotated a linked container — is resolved\n * by refetching the current projection. The refetch is safe: it cannot\n * bypass the anti-rollback check, because a genuinely rolled-back server\n * response re-throws on the rebuilt plan. Any other keying-verification\n * failure is terminal; anything else defers to the caller's message\n * predicate for its unwrap-failure shape.\n */\nexport function shouldRetryWithFreshProjection(\n  error: unknown,\n  messageMatches: (message: string) => boolean,\n): boolean {\n  // A peer may already have repaired the chain. Refetch once; the same guard\n  // rejects a still-stale response before any new ciphertext is produced.\n  if (\n    error instanceof ContainerKekRepairRequiredError ||\n    error instanceof ProjectionDependencyUnavailableError\n  )\n    return true;\n  const integrityErrorCode = projectionIntegrityErrorCode(error);\n  if (integrityErrorCode) {\n    return integrityErrorCode === \"rollback\";\n  }\n  if (keyingVerificationErrorCode(error) === \"invalid_shape\") {\n    // Verification boundaries normalize malformed/stale projection data to a\n    // terminal error. One cache eviction is still safe: a dishonest or broken\n    // fresh response fails again outside this retry boundary.\n    return true;\n  }\n  if (isKeyingVerificationError(error)) {\n    return false;\n  }\n\n  return error instanceof Error && messageMatches(error.message);\n}\n\nexport function shouldRetrySyncWithFreshWriterProjection(\n  error: unknown,\n): boolean {\n  return shouldRetryWithFreshProjection(\n    error,\n    (message) =>\n      message.startsWith(\n        \"Document authorizing container KEK path could not be unwrapped\",\n      ) && message.includes(\"Container writer projection KEK\"),\n  );\n}\n\nexport function isRecoverableDocumentUpdateIdConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.updateIdConflict\n  );\n}\n\n/**\n * The server's covering-baseline gate refused a queued rotation checkpoint\n * (e.g. a leftover from an interrupted recovery or a lost heal ack) because\n * it no longer covers the committed frontier. The pass can repair itself by\n * regenerating a fresh covering baseline from the live document instead of\n * resubmitting the stale payload — which would fail terminally forever.\n */\nexport function isCheckpointCoverageConflict(\n  failure: DocumentSyncSubmitFailure,\n): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_SYNC_ERROR_CODES.checkpointCoverageConflict\n  );\n}\n\n/**\n * A create submitted with a stable documentId whose first attempt already\n * committed server-side comes back as this 409 (see the server's\n * `assertCreateCanAdvanceDocumentHead`). It is not a failure — the caller adopts\n * the existing remote document instead of creating a duplicate.\n */\nexport function isDocumentManifestAlreadyExistsConflict(failure: {\n  readonly code?: string | undefined;\n  readonly message: string;\n  readonly status: number | null;\n}): boolean {\n  return (\n    failure.status === 409 &&\n    failure.code === DOCUMENT_MUTATION_ERROR_CODES.manifestAlreadyExists\n  );\n}\n\nexport function canRetryDocumentSyncConflict(input: {\n  attempt: number;\n  failure: DocumentSyncSubmitFailure;\n  maxAttempts: number;\n}): boolean {\n  return (\n    input.attempt < input.maxAttempts &&\n    isRetryableDocumentSyncConflict(input.failure)\n  );\n}\n\nexport function canRecoverDocumentUpdateIdConflict(input: {\n  attempt: number;\n  failure: DocumentSyncSubmitFailure;\n  maxAttempts: number;\n  pendingUpdateCount: number;\n}): boolean {\n  return (\n    input.attempt < input.maxAttempts &&\n    input.pendingUpdateCount > 0 &&\n    isRecoverableDocumentUpdateIdConflict(input.failure)\n  );\n}\n\nexport async function handleUpstreamDeletedDocumentSyncFailure(input: {\n  documentId: string;\n  failure: DocumentSyncSubmitFailure;\n  onRemoteDocumentDeleted?: RemoteDocumentDeletionHandler | undefined;\n}): Promise<boolean> {\n  if (!isUpstreamDeletedDocumentSyncFailure(input.failure)) {\n    return false;\n  }\n\n  await input.onRemoteDocumentDeleted?.({ documentId: input.documentId });\n  return true;\n}\n"]}

package/workflows/principals/index.d.ts

@@ -1,4 +1,6 @@
+export type { PrincipalHistoryProtectionLease } from "../../data/principals/principalHistoryProtection.js";
 export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
 export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./principalHistoryRecoveryTypes.js";
 export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+export { type ProjectionPolicyHistoryRecoveryOptions, recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
 export { type RecoveredScopedPrincipalPolicyHistory, type RecoverScopedPrincipalPolicyHistoryOptions, recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";

package/workflows/principals/index.js

@@ -1,5 +1,6 @@
 export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
 export { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
 export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+export { recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
 export { recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
 //# sourceMappingURL=index.js.map

package/workflows/principals/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC","sourcesContent":["export {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\nexport {\n  type RecoveredScopedPrincipalPolicyHistory,\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC","sourcesContent":["export type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nexport {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\nexport {\n  type ProjectionPolicyHistoryRecoveryOptions,\n  recoverProjectionPolicyHistory,\n} from \"./recoverProjectionPolicyHistory\";\nexport {\n  type RecoveredScopedPrincipalPolicyHistory,\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n"]}

package/workflows/principals/policyVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyVerification.js","sourceRoot":"","sources":["policyVerification.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAMxC,MAAM,UAAU,qBAAqB,CACnC,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,MAAM,CAAC,YAAY;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAGvB;IACC,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IAIC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACtD,KAAK,CAAC,KAAK,CAAC,YAAY,CACzB,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,IACE,SAAS,CAAC,qBAAqB,KAAK,KAAK,CAAC,KAAK,CAAC,wBAAwB,EACxE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,eAAe,EAAE;YACf,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC3D,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAG5D;IAIC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,wBAAwB;SACnD,CAAC,CAAC;QACH,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,0BAA0B,CAAC;YAC7D,0BAA0B;YAC1B,KAAK;SACN,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicySignerPublicKey } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\n\nexport type PrincipalPolicySignerPublicKeyLoadErrorCode =\n  | \"fingerprint-mismatch\"\n  | \"not-found\";\n\nexport function principalPolicyStates(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"currentState\"][] {\n  return [\n    ...bundle.previousStates.map((entry) => entry.state),\n    bundle.currentState,\n  ];\n}\n\nfunction signerCacheKey(input: {\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n}): string {\n  return `${input.signerUserId}:${input.signingFingerprint}`;\n}\n\nasync function loadTrustedSignerPublicKey(input: {\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly state: PrincipalPolicyBundleResponse[\"currentState\"];\n}): Promise<\n  | { readonly signerPublicKey: PrincipalPolicySignerPublicKey }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const signerKey = await input.resolveTrustedUserIdentity(\n    input.state.signerUserId,\n  );\n\n  if (!signerKey) {\n    return { error: \"not-found\" };\n  }\n\n  if (\n    signerKey.signingKeyFingerprint !== input.state.signerUserKeyFingerprint\n  ) {\n    return { error: \"fingerprint-mismatch\" };\n  }\n\n  return {\n    signerPublicKey: {\n      userId: input.state.signerUserId,\n      signingKeyFingerprint: input.state.signerUserKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    },\n  };\n}\n\nexport async function collectPrincipalPolicySignerPublicKeys(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<\n  | { readonly signerPublicKeys: PrincipalPolicySignerPublicKey[] }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyStates(input.bundle)) {\n    const cacheKey = signerCacheKey({\n      signerUserId: state.signerUserId,\n      signingFingerprint: state.signerUserKeyFingerprint,\n    });\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const remoteSignerPublicKey = await loadTrustedSignerPublicKey({\n      resolveTrustedUserIdentity,\n      state,\n    });\n    if (\"error\" in remoteSignerPublicKey) {\n      return { error: remoteSignerPublicKey.error };\n    }\n\n    signerPublicKeysByKey.set(cacheKey, remoteSignerPublicKey.signerPublicKey);\n  }\n\n  return {\n    signerPublicKeys: Array.from(signerPublicKeysByKey.values()),\n  };\n}\n"]}
+{"version":3,"file":"policyVerification.js","sourceRoot":"","sources":["policyVerification.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAMxC,MAAM,UAAU,qBAAqB,CACnC,MAGC;IAED,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,MAAM,CAAC,YAAY;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAGvB;IACC,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IAIC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACtD,KAAK,CAAC,KAAK,CAAC,YAAY,CACzB,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,IACE,SAAS,CAAC,qBAAqB,KAAK,KAAK,CAAC,KAAK,CAAC,wBAAwB,EACxE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,eAAe,EAAE;YACf,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC3D,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAM5D;IAIC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,wBAAwB;SACnD,CAAC,CAAC;QACH,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,0BAA0B,CAAC;YAC7D,0BAA0B;YAC1B,KAAK;SACN,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicySignerPublicKey } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\n\nexport type PrincipalPolicySignerPublicKeyLoadErrorCode =\n  | \"fingerprint-mismatch\"\n  | \"not-found\";\n\nexport function principalPolicyStates(\n  bundle: Pick<\n    PrincipalPolicyBundleResponse,\n    \"currentState\" | \"previousStates\"\n  >,\n): PrincipalPolicyBundleResponse[\"currentState\"][] {\n  return [\n    ...bundle.previousStates.map((entry) => entry.state),\n    bundle.currentState,\n  ];\n}\n\nfunction signerCacheKey(input: {\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n}): string {\n  return `${input.signerUserId}:${input.signingFingerprint}`;\n}\n\nasync function loadTrustedSignerPublicKey(input: {\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly state: PrincipalPolicyBundleResponse[\"currentState\"];\n}): Promise<\n  | { readonly signerPublicKey: PrincipalPolicySignerPublicKey }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const signerKey = await input.resolveTrustedUserIdentity(\n    input.state.signerUserId,\n  );\n\n  if (!signerKey) {\n    return { error: \"not-found\" };\n  }\n\n  if (\n    signerKey.signingKeyFingerprint !== input.state.signerUserKeyFingerprint\n  ) {\n    return { error: \"fingerprint-mismatch\" };\n  }\n\n  return {\n    signerPublicKey: {\n      userId: input.state.signerUserId,\n      signingKeyFingerprint: input.state.signerUserKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    },\n  };\n}\n\nexport async function collectPrincipalPolicySignerPublicKeys(input: {\n  readonly bundle: Pick<\n    PrincipalPolicyBundleResponse,\n    \"currentState\" | \"previousStates\"\n  >;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<\n  | { readonly signerPublicKeys: PrincipalPolicySignerPublicKey[] }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyStates(input.bundle)) {\n    const cacheKey = signerCacheKey({\n      signerUserId: state.signerUserId,\n      signingFingerprint: state.signerUserKeyFingerprint,\n    });\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const remoteSignerPublicKey = await loadTrustedSignerPublicKey({\n      resolveTrustedUserIdentity,\n      state,\n    });\n    if (\"error\" in remoteSignerPublicKey) {\n      return { error: remoteSignerPublicKey.error };\n    }\n\n    signerPublicKeysByKey.set(cacheKey, remoteSignerPublicKey.signerPublicKey);\n  }\n\n  return {\n    signerPublicKeys: Array.from(signerPublicKeysByKey.values()),\n  };\n}\n"]}

package/workflows/principals/principalHistoryRecoveryAuthority.js

@@ -0,0 +1,20 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+/** Reusable signatures remain conditional on their authenticated authority lineage. */
+export async function validatePrincipalHistoryRecoveryAuthority(input, verifier) {
+    const reference = verifier.getExternalAuthorityReference();
+    if (!reference)
+        return;
+    try {
+        const authority = await input.loadExternalAuthority?.([reference]);
+        if (!authority?.states.some(({ head }) => principalHeadMatchesReference(head, reference)))
+            throw new KeyingVerificationError("stale_predecessor", "Cached principal history has a different authority lineage");
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw new PrincipalHistoryEvidenceUnavailableError(error);
+        throw error;
+    }
+}
+//# sourceMappingURL=principalHistoryRecoveryAuthority.js.map

package/workflows/principals/principalHistoryRecoveryAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryRecoveryAuthority.js","sourceRoot":"","sources":["principalHistoryRecoveryAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAGhG,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAA2C,EAC3C,QAAwC;IAExC,MAAM,SAAS,GAAG,QAAQ,CAAC,6BAA6B,EAAE,CAAC;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,IACE,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/C;YAED,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,CAC7D,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\n/** Reusable signatures remain conditional on their authenticated authority lineage. */\nexport async function validatePrincipalHistoryRecoveryAuthority(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  verifier: PrincipalPolicyHistoryVerifier,\n): Promise<void> {\n  const reference = verifier.getExternalAuthorityReference();\n  if (!reference) return;\n  try {\n    const authority = await input.loadExternalAuthority?.([reference]);\n    if (\n      !authority?.states.some(({ head }) =>\n        principalHeadMatchesReference(head, reference),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"stale_predecessor\",\n        \"Cached principal history has a different authority lineage\",\n      );\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n}\n"]}

package/workflows/principals/principalHistoryRecoveryStage.js

@@ -9,7 +9,7 @@ export async function restorePrincipalHistoryRecoveryStage(input, historyInput,
         head: input.expectedHead,
         protection: input.protection,
     });
-    const id = await principalHistoryStageId(input.organizationId, input.expectedHead, input.protection.context, input.retainedReferences ?? []);
+    const id = await principalHistoryStageId(input.organizationId, input.expectedHead, input.protection.context);
     const saved = await loadPrincipalHistoryStage(input.execSql, id);
     if (saved) {
         const current = parsePrincipalHistoryStageCurrent(saved);

package/workflows/principals/principalHistoryRecoveryStage.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryStage.js","sourceRoot":"","sources":["principalHistoryRecoveryStage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EAGpC,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AAczF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA2C,EAC3C,YAAyC,EACzC,iBAAiB,GAAG,IAAI;IAExB,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CAAC,OAAO,EACxB,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,KAAK,CACN,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE;gBACb,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,mBAAmB,EAAE,KAAK,CAAC,YAAY;oBACvC,SAAS,EAAE,IAAI;iBAChB,CAAC;QACN,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,KAAK,EACL,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB;QAC9B,CAAC,CAAC,MAAM,qCAAqC,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;QAC/D,OAAO;YACL,EAAE;YACF,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzC,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,mBAAmB,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;QACf,mBAAmB,EAAE,CAAC;QACtB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n  type PrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  parsePrincipalHistoryStageCurrent,\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport { restoreReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport interface PrincipalHistoryRecoveryStage {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly initialAfterVersion: number;\n  readonly fromCache: boolean;\n  complete: boolean;\n  current: PrincipalPolicyPageCurrent | null;\n  saved: PrincipalHistoryStage | null;\n}\n\nexport async function restorePrincipalHistoryRecoveryStage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  historyInput: PrincipalPolicyHistoryInput,\n  useReusablePrefix = true,\n): Promise<PrincipalHistoryRecoveryStage> {\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head: input.expectedHead,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    input.expectedHead,\n    input.protection.context,\n    input.retainedReferences ?? [],\n  );\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const current = parsePrincipalHistoryStageCurrent(saved);\n    if (current && saved.organizationId === input.organizationId) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(\n          input.protection,\n          input.expectedHead,\n          saved,\n        ),\n      );\n      if (restored.ok)\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          current,\n          saved,\n          complete: saved.complete,\n          initialAfterVersion: saved.afterVersion,\n          fromCache: true,\n        };\n    }\n    // Saved bytes are a disposable hint. Only a locally authenticated restore\n    // can skip signed history; missing keys or changed inputs replay genesis.\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      saved,\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n  }\n  const prefix = useReusablePrefix\n    ? await restoreReusablePrincipalHistoryPrefix(input, historyInput, scopeId)\n    : null;\n  if (prefix) {\n    const complete = prefix.version === input.expectedHead.version;\n    return {\n      id,\n      scopeId,\n      verifier: prefix.verifier,\n      current: complete ? prefix.current : null,\n      saved: null,\n      complete,\n      initialAfterVersion: prefix.version - (complete ? 1 : 0),\n      fromCache: true,\n    };\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    current: null,\n    saved: null,\n    complete: false,\n    initialAfterVersion: 0,\n    fromCache: false,\n  };\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryStage.js","sourceRoot":"","sources":["principalHistoryRecoveryStage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EAGpC,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AAczF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA2C,EAC3C,YAAyC,EACzC,iBAAiB,GAAG,IAAI;IAExB,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,KAAK,CACN,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE;gBACb,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,mBAAmB,EAAE,KAAK,CAAC,YAAY;oBACvC,SAAS,EAAE,IAAI;iBAChB,CAAC;QACN,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,KAAK,EACL,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB;QAC9B,CAAC,CAAC,MAAM,qCAAqC,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;QAC/D,OAAO;YACL,EAAE;YACF,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzC,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,mBAAmB,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;QACf,mBAAmB,EAAE,CAAC;QACtB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n  type PrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  parsePrincipalHistoryStageCurrent,\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport { restoreReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport interface PrincipalHistoryRecoveryStage {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly initialAfterVersion: number;\n  readonly fromCache: boolean;\n  complete: boolean;\n  current: PrincipalPolicyPageCurrent | null;\n  saved: PrincipalHistoryStage | null;\n}\n\nexport async function restorePrincipalHistoryRecoveryStage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  historyInput: PrincipalPolicyHistoryInput,\n  useReusablePrefix = true,\n): Promise<PrincipalHistoryRecoveryStage> {\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head: input.expectedHead,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    input.expectedHead,\n    input.protection.context,\n  );\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const current = parsePrincipalHistoryStageCurrent(saved);\n    if (current && saved.organizationId === input.organizationId) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(\n          input.protection,\n          input.expectedHead,\n          saved,\n        ),\n      );\n      if (restored.ok)\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          current,\n          saved,\n          complete: saved.complete,\n          initialAfterVersion: saved.afterVersion,\n          fromCache: true,\n        };\n    }\n    // Saved bytes are a disposable hint. Only a locally authenticated restore\n    // can skip signed history; missing keys or changed inputs replay genesis.\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      saved,\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n  }\n  const prefix = useReusablePrefix\n    ? await restoreReusablePrincipalHistoryPrefix(input, historyInput, scopeId)\n    : null;\n  if (prefix) {\n    const complete = prefix.version === input.expectedHead.version;\n    return {\n      id,\n      scopeId,\n      verifier: prefix.verifier,\n      current: complete ? prefix.current : null,\n      saved: null,\n      complete,\n      initialAfterVersion: prefix.version - (complete ? 1 : 0),\n      fromCache: true,\n    };\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    current: null,\n    saved: null,\n    complete: false,\n    initialAfterVersion: 0,\n    fromCache: false,\n  };\n}\n"]}

package/workflows/principals/principalHistoryRecoveryTypes.d.ts

@@ -1,5 +1,5 @@
 import type { ApiClient, PrincipalPolicyPageCurrent, RequestFailure } from "../../internal/api-client/index.js";
-import { KeyingVerificationError, type PrincipalPolicyExternalAuthority, type PrincipalPolicyHistoryProgressOptions, type PrincipalPolicyStateChainEntry, type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, type PrincipalPolicyExternalAuthority, type PrincipalPolicyHistoryProgressOptions, type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
 /** A locally observed race, distinct from a rejected signed predecessor. */
@@ -19,8 +19,8 @@ export interface RecoverPrincipalPolicyHistoryOptions {
     /** Strict Admins mode checks every historical projection in a separate cache scope. */
     readonly historyVerification?: "standard" | "direct-admins" | undefined;
     readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    /** Return only authority already authenticated by this client. */
-    readonly loadExternalAuthority?: ((entries: readonly PrincipalPolicyStateChainEntry[]) => Promise<PrincipalPolicyExternalAuthority | undefined>) | undefined;
+    /** Authenticate these exact authority references, including cached-prefix citations. */
+    readonly loadExternalAuthority?: ((references: readonly ReferencedPrincipalHead[]) => Promise<PrincipalPolicyExternalAuthority | undefined>) | undefined;
     readonly stillCurrent: () => boolean;
     readonly signal?: AbortSignal | undefined;
 }

package/workflows/principals/principalHistoryRecoveryTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryTypes.js","sourceRoot":"","sources":["principalHistoryRecoveryTypes.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uBAAuB,GAMxB,MAAM,mBAAmB,CAAC;AAI3B,4EAA4E;AAC5E,MAAM,OAAO,iCAAkC,SAAQ,uBAAuB;IAC5E,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AA8BD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAArB,YAAqB,OAAuB;QAC1C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QADJ,YAAO,GAAP,OAAO,CAAgB;QAE1C,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF","sourcesContent":["import type {\n  ApiClient,\n  PrincipalPolicyPageCurrent,\n  RequestFailure,\n} from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicyHistoryProgressOptions,\n  type PrincipalPolicyStateChainEntry,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\n/** A locally observed race, distinct from a rejected signed predecessor. */\nexport class PrincipalHistoryRecoveryRaceError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"stale_predecessor\", message);\n  }\n}\n\nexport interface RecoverPrincipalPolicyHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getPrincipalPolicyPages\">;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly expectedHead: ReferencedPrincipalHead;\n  /** Only use locally authenticated completed evidence; never perform HTTP. */\n  readonly offline?: boolean | undefined;\n  /** Device-controlled key and stable identity/trust-policy context, never supplied by the API. */\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly retainedReferences?: readonly ReferencedPrincipalHead[] | undefined;\n  /** Strict Admins mode checks every historical projection in a separate cache scope. */\n  readonly historyVerification?: \"standard\" | \"direct-admins\" | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  /** Return only authority already authenticated by this client. */\n  readonly loadExternalAuthority?:\n    | ((\n        entries: readonly PrincipalPolicyStateChainEntry[],\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n}\n\nexport interface RecoveredPrincipalPolicyHistory {\n  readonly current: PrincipalPolicyPageCurrent;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n}\n\nexport class PrincipalPolicyHistoryReadError extends Error {\n  constructor(readonly failure: RequestFailure) {\n    super(failure.message);\n    this.name = \"PrincipalPolicyHistoryReadError\";\n  }\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryTypes.js","sourceRoot":"","sources":["principalHistoryRecoveryTypes.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uBAAuB,GAKxB,MAAM,mBAAmB,CAAC;AAI3B,4EAA4E;AAC5E,MAAM,OAAO,iCAAkC,SAAQ,uBAAuB;IAC5E,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AA8BD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAArB,YAAqB,OAAuB;QAC1C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QADJ,YAAO,GAAP,OAAO,CAAgB;QAE1C,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF","sourcesContent":["import type {\n  ApiClient,\n  PrincipalPolicyPageCurrent,\n  RequestFailure,\n} from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\n/** A locally observed race, distinct from a rejected signed predecessor. */\nexport class PrincipalHistoryRecoveryRaceError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"stale_predecessor\", message);\n  }\n}\n\nexport interface RecoverPrincipalPolicyHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getPrincipalPolicyPages\">;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly expectedHead: ReferencedPrincipalHead;\n  /** Only use locally authenticated completed evidence; never perform HTTP. */\n  readonly offline?: boolean | undefined;\n  /** Device-controlled key and stable identity/trust-policy context, never supplied by the API. */\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly retainedReferences?: readonly ReferencedPrincipalHead[] | undefined;\n  /** Strict Admins mode checks every historical projection in a separate cache scope. */\n  readonly historyVerification?: \"standard\" | \"direct-admins\" | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  /** Authenticate these exact authority references, including cached-prefix citations. */\n  readonly loadExternalAuthority?:\n    | ((\n        references: readonly ReferencedPrincipalHead[],\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n}\n\nexport interface RecoveredPrincipalPolicyHistory {\n  readonly current: PrincipalPolicyPageCurrent;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n}\n\nexport class PrincipalPolicyHistoryReadError extends Error {\n  constructor(readonly failure: RequestFailure) {\n    super(failure.message);\n    this.name = \"PrincipalPolicyHistoryReadError\";\n  }\n}\n"]}

package/workflows/principals/principalHistoryRecoveryVerification.js

@@ -4,7 +4,12 @@ export function principalHistoryVerificationContext(input) {
     if (mode !== "standard" && mode !== "direct-admins")
         throw new KeyingVerificationError("invalid_shape", "Unknown principal history verification mode");
     if (mode === "standard")
-        return input.protection.context;
+        return input.loadExternalAuthority
+            ? serializeKeyingCanonicalJson([
+                "tearleads.sdk.principal-history.external-authority.v1",
+                input.protection.context,
+            ])
+            : input.protection.context;
     if (input.expectedHead.principalType !== "group" ||
         input.loadExternalAuthority)
         throw new KeyingVerificationError("invalid_shape", "Strict Admins history requires a group without external authority fallback");

package/workflows/principals/principalHistoryRecoveryVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryVerification.js","sourceRoot":"","sources":["principalHistoryRecoveryVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,mCAAmC,CACjD,KAA2C;IAE3C,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB,IAAI,UAAU,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,eAAe;QACjD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6CAA6C,CAC9C,CAAC;IACJ,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;IACzD,IACE,KAAK,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC5C,KAAK,CAAC,qBAAqB;QAE3B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4EAA4E,CAC7E,CAAC;IACJ,2EAA2E;IAC3E,OAAO,4BAA4B,CAAC;QAClC,kDAAkD;QAClD,KAAK,CAAC,UAAU,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAA2C,EAC3C,OAAkD;IAElD,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe;QAAE,OAAO;IAC1D,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport function principalHistoryVerificationContext(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): string {\n  const mode = input.historyVerification ?? \"standard\";\n  if (mode !== \"standard\" && mode !== \"direct-admins\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Unknown principal history verification mode\",\n    );\n  if (mode === \"standard\") return input.protection.context;\n  if (\n    input.expectedHead.principalType !== \"group\" ||\n    input.loadExternalAuthority\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Strict Admins history requires a group without external authority fallback\",\n    );\n  // Retire this local attestation domain whenever strict validation changes.\n  return serializeKeyingCanonicalJson([\n    \"tearleads.sdk.principal-history.direct-admins.v1\",\n    input.protection.context,\n  ]);\n}\n\nexport function assertPrincipalHistoryVerificationMode(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (input.historyVerification !== \"direct-admins\") return;\n  if (\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Reserved Admins history must contain only direct admin users\",\n    );\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryVerification.js","sourceRoot":"","sources":["principalHistoryRecoveryVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,mCAAmC,CACjD,KAA2C;IAE3C,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB,IAAI,UAAU,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,eAAe;QACjD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6CAA6C,CAC9C,CAAC;IACJ,IAAI,IAAI,KAAK,UAAU;QACrB,OAAO,KAAK,CAAC,qBAAqB;YAChC,CAAC,CAAC,4BAA4B,CAAC;gBAC3B,uDAAuD;gBACvD,KAAK,CAAC,UAAU,CAAC,OAAO;aACzB,CAAC;YACJ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/B,IACE,KAAK,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC5C,KAAK,CAAC,qBAAqB;QAE3B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4EAA4E,CAC7E,CAAC;IACJ,2EAA2E;IAC3E,OAAO,4BAA4B,CAAC;QAClC,kDAAkD;QAClD,KAAK,CAAC,UAAU,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAA2C,EAC3C,OAAkD;IAElD,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe;QAAE,OAAO;IAC1D,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport function principalHistoryVerificationContext(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): string {\n  const mode = input.historyVerification ?? \"standard\";\n  if (mode !== \"standard\" && mode !== \"direct-admins\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Unknown principal history verification mode\",\n    );\n  if (mode === \"standard\")\n    return input.loadExternalAuthority\n      ? serializeKeyingCanonicalJson([\n          \"tearleads.sdk.principal-history.external-authority.v1\",\n          input.protection.context,\n        ])\n      : input.protection.context;\n  if (\n    input.expectedHead.principalType !== \"group\" ||\n    input.loadExternalAuthority\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Strict Admins history requires a group without external authority fallback\",\n    );\n  // Retire this local attestation domain whenever strict validation changes.\n  return serializeKeyingCanonicalJson([\n    \"tearleads.sdk.principal-history.direct-admins.v1\",\n    input.protection.context,\n  ]);\n}\n\nexport function assertPrincipalHistoryVerificationMode(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (input.historyVerification !== \"direct-admins\") return;\n  if (\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Reserved Admins history must contain only direct admin users\",\n    );\n}\n"]}

package/workflows/principals/principalRecoveryOutage.js

@@ -4,7 +4,7 @@ import { assertProjectionVerificationCurrent } from "../../data/keyingProjection
 import { PrincipalPolicyHistoryReadError } from "./principalHistoryRecoveryTypes.js";
 import { recoverScopedPrincipalPolicyHistory } from "./recoverScopedPrincipalPolicyHistory.js";
 /** Refusals and invalid evidence must never silently select a cached policy. */
-function isPrincipalRecoveryOutage(error) {
+export function isPrincipalRecoveryOutage(error) {
     if (!(error instanceof PrincipalPolicyHistoryReadError))
         return false;
     const { failure } = error;

package/workflows/principals/principalRecoveryOutage.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalRecoveryOutage.js","sourceRoot":"","sources":["principalRecoveryOutage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAE5F,gFAAgF;AAChF,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,+BAA+B,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;YACtB,OAAO,CAAC,MAAM,KAAK,IAAI;YACvB,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACxB,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;YAC3B,OAAO,CAAC,IAAI,KAAK,qCAAqC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAmD,EACnD,OAAkE;IAElE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,mCAAmC,CAAC;gBAC/C,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IACE,UAAU,YAAY,uBAAuB;gBAC7C,UAAU,CAAC,IAAI,KAAK,oBAAoB;gBAExC,MAAM,IAAI,oCAAoC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { PrincipalPolicyHistoryReadError } from \"./principalHistoryRecoveryTypes\";\nimport { recoverScopedPrincipalPolicyHistory } from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Refusals and invalid evidence must never silently select a cached policy. */\nfunction isPrincipalRecoveryOutage(error: unknown): boolean {\n  if (!(error instanceof PrincipalPolicyHistoryReadError)) return false;\n  const { failure } = error;\n  return (\n    failure.kind === \"network\" ||\n    (failure.kind === \"http\" &&\n      failure.status !== null &&\n      failure.status >= 500) ||\n    (failure.kind === \"cancelled\" &&\n      failure.code === \"principal_history_request_timed_out\")\n  );\n}\n\nexport async function recoverWithPrincipalOutageFallback(\n  recover: typeof recoverScopedPrincipalPolicyHistory,\n  options: Parameters<typeof recoverScopedPrincipalPolicyHistory>[0],\n) {\n  try {\n    return await recover(options);\n  } catch (error) {\n    assertProjectionVerificationCurrent(options.stillCurrent);\n    if (options.offline || !isPrincipalRecoveryOutage(error)) throw error;\n    try {\n      return await recoverScopedPrincipalPolicyHistory({\n        ...options,\n        offline: true,\n      });\n    } catch (localError) {\n      if (\n        localError instanceof KeyingVerificationError &&\n        localError.code === \"missing_dependency\"\n      )\n        throw new ProjectionDependencyUnavailableError(localError.message);\n      throw localError;\n    }\n  }\n}\n"]}
+{"version":3,"file":"principalRecoveryOutage.js","sourceRoot":"","sources":["principalRecoveryOutage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAE5F,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,CAAC,KAAK,YAAY,+BAA+B,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;YACtB,OAAO,CAAC,MAAM,KAAK,IAAI;YACvB,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACxB,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;YAC3B,OAAO,CAAC,IAAI,KAAK,qCAAqC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAmD,EACnD,OAAkE;IAElE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,mCAAmC,CAAC;gBAC/C,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IACE,UAAU,YAAY,uBAAuB;gBAC7C,UAAU,CAAC,IAAI,KAAK,oBAAoB;gBAExC,MAAM,IAAI,oCAAoC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { PrincipalPolicyHistoryReadError } from \"./principalHistoryRecoveryTypes\";\nimport { recoverScopedPrincipalPolicyHistory } from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Refusals and invalid evidence must never silently select a cached policy. */\nexport function isPrincipalRecoveryOutage(error: unknown): boolean {\n  if (!(error instanceof PrincipalPolicyHistoryReadError)) return false;\n  const { failure } = error;\n  return (\n    failure.kind === \"network\" ||\n    (failure.kind === \"http\" &&\n      failure.status !== null &&\n      failure.status >= 500) ||\n    (failure.kind === \"cancelled\" &&\n      failure.code === \"principal_history_request_timed_out\")\n  );\n}\n\nexport async function recoverWithPrincipalOutageFallback(\n  recover: typeof recoverScopedPrincipalPolicyHistory,\n  options: Parameters<typeof recoverScopedPrincipalPolicyHistory>[0],\n) {\n  try {\n    return await recover(options);\n  } catch (error) {\n    assertProjectionVerificationCurrent(options.stillCurrent);\n    if (options.offline || !isPrincipalRecoveryOutage(error)) throw error;\n    try {\n      return await recoverScopedPrincipalPolicyHistory({\n        ...options,\n        offline: true,\n      });\n    } catch (localError) {\n      if (\n        localError instanceof KeyingVerificationError &&\n        localError.code === \"missing_dependency\"\n      )\n        throw new ProjectionDependencyUnavailableError(localError.message);\n      throw localError;\n    }\n  }\n}\n"]}

package/workflows/principals/publicPrincipalHistoryAuthority.js

@@ -0,0 +1,60 @@
+import { KeyingVerificationError, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { isReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+/** The greatest cited Admins head commits to the lineage of every earlier citation. */
+export function publicHistoryAuthorityReference(previous, references) {
+    return references.reduce((head, reference) => !head || reference.version > head.version ? reference : head, previous);
+}
+export function publicHistoryAuthorityJson(reference) {
+    return serializeKeyingCanonicalJson(reference ? { ...reference } : null);
+}
+export function parsePublicHistoryAuthority(input, json) {
+    try {
+        const value = JSON.parse(json);
+        if (value === null)
+            return null;
+        if (isReferencedPrincipalStateResponse(value) &&
+            value.principalType === "group" &&
+            value.principalId === input.authorityGroupId)
+            return value;
+    }
+    catch {
+        /* Invalid disposable metadata cannot restore verified progress. */
+    }
+    return undefined;
+}
+export async function loadPublicHistoryAuthority(input, references, cachedPrefix = false) {
+    if (!references.length)
+        return undefined;
+    const authority = await input.loadExternalAuthority?.(references, cachedPrefix);
+    if (authority &&
+        (authority.currentHead.principalId !== input.authorityGroupId ||
+            authority.states.some(({ head }) => head.principalId !== input.authorityGroupId)))
+        throw new KeyingVerificationError("object_mismatch", "Authority callback differs from the directory binding");
+    if (references.some((reference) => !authority?.states.some(({ head }) => principalHeadMatchesReference(head, reference))))
+        throw new KeyingVerificationError("stale_predecessor", "Public history authority differs from its verified Admins lineage");
+    return authority;
+}
+export async function validatePublicHistoryAuthority(input, reference, rejectedPrefix = null) {
+    try {
+        if (reference)
+            await loadPublicHistoryAuthority(input, [reference], true);
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw new PublicHistoryAuthorityUnavailableError(error, rejectedPrefix);
+        throw error;
+    }
+}
+/** Only cache restoration can request a replay after an authority mismatch. */
+export class PublicHistoryAuthorityUnavailableError extends Error {
+    verificationError;
+    rejectedPrefix;
+    constructor(verificationError, rejectedPrefix) {
+        super(verificationError.message);
+        this.verificationError = verificationError;
+        this.rejectedPrefix = rejectedPrefix;
+        this.name = "PublicHistoryAuthorityUnavailableError";
+    }
+}
+//# sourceMappingURL=publicPrincipalHistoryAuthority.js.map

package/workflows/principals/publicPrincipalHistoryAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicPrincipalHistoryAuthority.js","sourceRoot":"","sources":["publicPrincipalHistoryAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AAEpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAGtG,uFAAuF;AACvF,MAAM,UAAU,+BAA+B,CAC7C,QAAwC,EACxC,UAA8C;IAE9C,OAAO,UAAU,CAAC,MAAM,CACtB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAClB,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAC9D,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,SAAyC;IAEzC,OAAO,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAoC,EACpC,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IACE,kCAAkC,CAAC,KAAK,CAAC;YACzC,KAAK,CAAC,aAAa,KAAK,OAAO;YAC/B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB;YAE5C,OAAO,KAAK,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAoC,EACpC,UAA8C,EAC9C,YAAY,GAAG,KAAK;IAEpB,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CACnD,UAAU,EACV,YAAY,CACb,CAAC;IACF,IACE,SAAS;QACT,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB;YAC3D,SAAS,CAAC,MAAM,CAAC,IAAI,CACnB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CAC1D,CAAC;QAEJ,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/C,CACJ;QAED,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;IACJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAoC,EACpC,SAAyC,EACzC,iBAAgD,IAAI;IAEpD,IAAI,CAAC;QACH,IAAI,SAAS;YAAE,MAAM,0BAA0B,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,sCAAsC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,OAAO,sCAAuC,SAAQ,KAAK;IAEpD;IACA;IAFX,YACW,iBAA0C,EAC1C,cAA6C;QAEtD,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAHxB,sBAAiB,GAAjB,iBAAiB,CAAyB;QAC1C,mBAAc,GAAd,cAAc,CAA+B;QAGtD,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAC;IACvD,CAAC;CACF","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { PublicPrincipalHistoryOptions } from \"./publicPrincipalHistoryTypes\";\n\n/** The greatest cited Admins head commits to the lineage of every earlier citation. */\nexport function publicHistoryAuthorityReference(\n  previous: ReferencedPrincipalHead | null,\n  references: readonly ReferencedPrincipalHead[],\n) {\n  return references.reduce<ReferencedPrincipalHead | null>(\n    (head, reference) =>\n      !head || reference.version > head.version ? reference : head,\n    previous,\n  );\n}\n\nexport function publicHistoryAuthorityJson(\n  reference: ReferencedPrincipalHead | null,\n) {\n  return serializeKeyingCanonicalJson(reference ? { ...reference } : null);\n}\n\nexport function parsePublicHistoryAuthority(\n  input: PublicPrincipalHistoryOptions,\n  json: string,\n): ReferencedPrincipalHead | null | undefined {\n  try {\n    const value: unknown = JSON.parse(json);\n    if (value === null) return null;\n    if (\n      isReferencedPrincipalStateResponse(value) &&\n      value.principalType === \"group\" &&\n      value.principalId === input.authorityGroupId\n    )\n      return value;\n  } catch {\n    /* Invalid disposable metadata cannot restore verified progress. */\n  }\n  return undefined;\n}\n\nexport async function loadPublicHistoryAuthority(\n  input: PublicPrincipalHistoryOptions,\n  references: readonly ReferencedPrincipalHead[],\n  cachedPrefix = false,\n) {\n  if (!references.length) return undefined;\n  const authority = await input.loadExternalAuthority?.(\n    references,\n    cachedPrefix,\n  );\n  if (\n    authority &&\n    (authority.currentHead.principalId !== input.authorityGroupId ||\n      authority.states.some(\n        ({ head }) => head.principalId !== input.authorityGroupId,\n      ))\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Authority callback differs from the directory binding\",\n    );\n  if (\n    references.some(\n      (reference) =>\n        !authority?.states.some(({ head }) =>\n          principalHeadMatchesReference(head, reference),\n        ),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Public history authority differs from its verified Admins lineage\",\n    );\n  return authority;\n}\n\nexport async function validatePublicHistoryAuthority(\n  input: PublicPrincipalHistoryOptions,\n  reference: ReferencedPrincipalHead | null,\n  rejectedPrefix: PrincipalHistoryPrefix | null = null,\n): Promise<void> {\n  try {\n    if (reference) await loadPublicHistoryAuthority(input, [reference], true);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PublicHistoryAuthorityUnavailableError(error, rejectedPrefix);\n    throw error;\n  }\n}\n\n/** Only cache restoration can request a replay after an authority mismatch. */\nexport class PublicHistoryAuthorityUnavailableError extends Error {\n  constructor(\n    readonly verificationError: KeyingVerificationError,\n    readonly rejectedPrefix: PrincipalHistoryPrefix | null,\n  ) {\n    super(verificationError.message);\n    this.name = \"PublicHistoryAuthorityUnavailableError\";\n  }\n}\n"]}