@tearleads/client-sdk 0.1.14 → 0.1.15

package/workflows/principals/publicPrincipalHistoryPage.js

@@ -0,0 +1,87 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { preparePrincipalHistoryEvidencePage } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { savePrincipalHistoryStage } from "../../data/persistence/principalHistoryStagePersistence.js";
+import { principalHistoryStageProtection } from "../../data/principals/principalHistoryStageProtection.js";
+import { collectPrincipalPolicySignerPublicKeys } from "./policyVerification.js";
+import { loadPublicHistoryAuthority, publicHistoryAuthorityJson, publicHistoryAuthorityReference, } from "./publicPrincipalHistoryAuthority.js";
+export class PublicPrincipalHistoryPrefixDisconnectedError extends Error {
+    verificationError;
+    constructor(verificationError) {
+        super(verificationError.message);
+        this.verificationError = verificationError;
+        this.name = "PublicPrincipalHistoryPrefixDisconnectedError";
+    }
+}
+function assertPublicAuthorityScope(input, entries) {
+    if (input.strictAdmins &&
+        entries.some((entry) => entry.projection.length === 0 ||
+            entry.projection.some((member) => member.role !== "admin")))
+        throw new KeyingVerificationError("invalid_shape", "Public Admins history must contain only direct admin users");
+    if (entries.some(({ state }) => state.externalAuthority &&
+        state.externalAuthority.principalId !== input.authorityGroupId))
+        throw new KeyingVerificationError("object_mismatch", "Public history cites an authority outside its directory binding");
+}
+export async function appendPublicPrincipalHistoryPage(input, progress, page) {
+    const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();
+    const complete = page.historyPage.nextAfterVersion === null;
+    const entries = [...page.previousStates];
+    if (complete)
+        entries.push({
+            state: page.currentState,
+            projection: page.currentProjection,
+            grants: page.currentGrants,
+        });
+    assertPublicAuthorityScope(input, entries);
+    const keys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: page,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in keys)
+        throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Public history signer identity is unavailable or mismatched");
+    const references = entries.flatMap(({ state }) => state.externalAuthority ? [state.externalAuthority] : []);
+    const externalAuthority = await loadPublicHistoryAuthority(input, references);
+    assertProjectionVerificationCurrent(stillCurrent);
+    const appended = await progress.verifier.append({
+        entries,
+        signerPublicKeys: keys.signerPublicKeys,
+        ...(externalAuthority ? { externalAuthority } : {}),
+    });
+    if (!appended.ok) {
+        if (appended.error.code === "stale_predecessor")
+            throw new PublicPrincipalHistoryPrefixDisconnectedError(appended.error);
+        throw appended.error;
+    }
+    const row = {
+        id: progress.id,
+        organizationId: input.organizationId,
+        currentJson: publicHistoryAuthorityJson(publicHistoryAuthorityReference(progress.authorityReference, references)),
+        afterVersion: appended.value.throughVersion - (complete ? 1 : 0),
+        complete,
+    };
+    const sealed = await progress.verifier.exportProgress(await principalHistoryStageProtection(input.protection, input.source.head, row));
+    if (!sealed.ok)
+        throw sealed.error;
+    const saved = { ...row, progress: sealed.value };
+    await savePrincipalHistoryStage({
+        execSql: input.execSql,
+        stage: saved,
+        evidence: await preparePrincipalHistoryEvidencePage({
+            scopeId: progress.scopeId,
+            organizationId: input.organizationId,
+            entries,
+            nodes: appended.value.indexNodes,
+        }),
+        previousProgress: progress.saved?.progress ?? null,
+        stillCurrent,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    return {
+        ...progress,
+        afterVersion: row.afterVersion,
+        saved,
+        authorityReference: publicHistoryAuthorityReference(progress.authorityReference, references),
+        completedHead: complete ? input.source.head : null,
+    };
+}
+//# sourceMappingURL=publicPrincipalHistoryPage.js.map

package/workflows/principals/publicPrincipalHistoryPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicPrincipalHistoryPage.js","sourceRoot":"","sources":["publicPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAM3C,MAAM,OAAO,6CAA8C,SAAQ,KAAK;IACjD;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,+CAA+C,CAAC;IAC9D,CAAC;CACF;AAED,SAAS,0BAA0B,CACjC,KAAoC,EACpC,OAAkD;IAElD,IACE,KAAK,CAAC,YAAY;QAClB,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4DAA4D,CAC7D,CAAC;IACJ,IACE,OAAO,CAAC,IAAI,CACV,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CACjE;QAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAoC,EACpC,QAAwC,EACxC,IAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAClC,MAAM,EAAE,IAAI,CAAC,aAAa;SAC3B,CAAC,CAAC;IACL,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,IAAI;QACZ,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,6DAA6D,CAC9D,CAAC;IACJ,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/C,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,6CAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,0BAA0B,CACrC,+BAA+B,CAAC,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC,CACzE;QACD,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,GAAG,CACJ,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjD,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAClD,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK;QACL,kBAAkB,EAAE,+BAA+B,CACjD,QAAQ,CAAC,kBAAkB,EAC3B,UAAU,CACX;QACD,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicySnapshotPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { savePrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport {\n  loadPublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  publicHistoryAuthorityReference,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nexport class PublicPrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PublicPrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\nfunction assertPublicAuthorityScope(\n  input: PublicPrincipalHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (\n    input.strictAdmins &&\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Public Admins history must contain only direct admin users\",\n    );\n  if (\n    entries.some(\n      ({ state }) =>\n        state.externalAuthority &&\n        state.externalAuthority.principalId !== input.authorityGroupId,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history cites an authority outside its directory binding\",\n    );\n}\n\nexport async function appendPublicPrincipalHistoryPage(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  page: PrincipalPolicySnapshotPageResponse,\n): Promise<PublicPrincipalHistoryProgress> {\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  const complete = page.historyPage.nextAfterVersion === null;\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: page.currentState,\n      projection: page.currentProjection,\n      grants: page.currentGrants,\n    });\n  assertPublicAuthorityScope(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: page,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Public history signer identity is unavailable or mismatched\",\n    );\n  const references = entries.flatMap(({ state }) =>\n    state.externalAuthority ? [state.externalAuthority] : [],\n  );\n  const externalAuthority = await loadPublicHistoryAuthority(input, references);\n  assertProjectionVerificationCurrent(stillCurrent);\n  const appended = await progress.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PublicPrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const row = {\n    id: progress.id,\n    organizationId: input.organizationId,\n    currentJson: publicHistoryAuthorityJson(\n      publicHistoryAuthorityReference(progress.authorityReference, references),\n    ),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.source.head,\n      row,\n    ),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const saved = { ...row, progress: sealed.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      scopeId: progress.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: progress.saved?.progress ?? null,\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return {\n    ...progress,\n    afterVersion: row.afterVersion,\n    saved,\n    authorityReference: publicHistoryAuthorityReference(\n      progress.authorityReference,\n      references,\n    ),\n    completedHead: complete ? input.source.head : null,\n  };\n}\n"]}

package/workflows/principals/publicPrincipalHistoryProgress.js

@@ -0,0 +1,178 @@
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, restorePrincipalPolicyHistoryVerifier, serializeKeyingCanonicalJson, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
+import { isReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
+import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { discardPrincipalHistoryPrefix, loadPrincipalHistoryPrefix, savePrincipalHistoryPrefix, } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import { discardPrincipalHistoryStage, loadPrincipalHistoryStage, } from "../../data/persistence/principalHistoryStagePersistence.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { principalHistoryEvidenceScopeId, principalHistoryPrefixProtection, } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { principalHistoryStageId, principalHistoryStageProtection, } from "../../data/principals/principalHistoryStageProtection.js";
+import { PublicHistoryAuthorityUnavailableError, parsePublicHistoryAuthority, publicHistoryAuthorityJson, validatePublicHistoryAuthority, } from "./publicPrincipalHistoryAuthority.js";
+async function restorePublicPrefix(input, scopeId, id, prefix) {
+    const head = input.source.head;
+    const historyInput = {
+        principalType: head.principalType,
+        principalId: head.principalId,
+    };
+    const current = () => !input.signal?.aborted && input.stillCurrent();
+    if (prefix) {
+        const authorityReference = parsePublicHistoryAuthority(input, prefix.currentJson);
+        let prefixHead;
+        try {
+            prefixHead = JSON.parse(prefix.headJson);
+        }
+        catch {
+            prefixHead = null;
+        }
+        if (prefix.organizationId === input.organizationId &&
+            authorityReference !== undefined &&
+            isReferencedPrincipalStateResponse(prefixHead) &&
+            prefixHead.principalId === head.principalId &&
+            prefixHead.principalType === head.principalType &&
+            prefixHead.version === prefix.version) {
+            const restored = await restorePrincipalPolicyHistoryVerifier(historyInput, prefix.progress, await principalHistoryPrefixProtection(input.protection, prefix));
+            if (restored.ok && restored.value.finish(prefixHead).ok) {
+                await validatePublicHistoryAuthority(input, authorityReference, prefix);
+                return {
+                    id,
+                    scopeId,
+                    verifier: restored.value,
+                    completedHead: prefixHead.version >= head.version ? prefixHead : null,
+                    afterVersion: Math.min(prefixHead.version, head.version - 1),
+                    saved: null,
+                    cachedPrefix: prefix,
+                    authorityReference,
+                };
+            }
+        }
+        if (!input.offline)
+            await discardPrincipalHistoryPrefix({
+                execSql: input.execSql,
+                prefix,
+                stillCurrent: current,
+            });
+    }
+    return null;
+}
+export async function restorePublicPrincipalHistoryProgress(input, allowReuse) {
+    const head = input.source.head;
+    const historyInput = {
+        principalType: head.principalType,
+        principalId: head.principalId,
+    };
+    const scopeId = await principalHistoryEvidenceScopeId({
+        organizationId: input.organizationId,
+        head,
+        protection: input.protection,
+    });
+    const id = await principalHistoryStageId(input.organizationId, head, input.protection.context);
+    const current = () => !input.signal?.aborted && input.stillCurrent();
+    const saved = await loadPrincipalHistoryStage(input.execSql, id);
+    if (saved) {
+        const authorityReference = parsePublicHistoryAuthority(input, saved.currentJson);
+        if (allowReuse &&
+            saved.organizationId === input.organizationId &&
+            authorityReference !== undefined) {
+            const restored = await restorePrincipalPolicyHistoryVerifier(historyInput, saved.progress, await principalHistoryStageProtection(input.protection, head, saved));
+            if (restored.ok && (!saved.complete || restored.value.finish(head).ok)) {
+                await validatePublicHistoryAuthority(input, authorityReference);
+                return {
+                    id,
+                    scopeId,
+                    verifier: restored.value,
+                    completedHead: saved.complete ? head : null,
+                    afterVersion: saved.afterVersion,
+                    saved,
+                    cachedPrefix: null,
+                    authorityReference,
+                };
+            }
+        }
+        if (!input.offline)
+            await discardPrincipalHistoryStage(input.execSql, saved, current);
+    }
+    if (allowReuse) {
+        const prefix = await restorePublicPrefix(input, scopeId, id, await loadPrincipalHistoryPrefix(input.execSql, scopeId));
+        if (prefix)
+            return prefix;
+    }
+    return {
+        id,
+        scopeId,
+        verifier: createPrincipalPolicyHistoryVerifier(historyInput),
+        completedHead: null,
+        afterVersion: 0,
+        saved: null,
+        cachedPrefix: null,
+        authorityReference: null,
+    };
+}
+/** A resumed stage may finish after the reader that rejected the prefix exits. */
+async function rejectedCompletedPrefix(input, progress, history) {
+    const candidate = await loadPrincipalHistoryPrefix(input.execSql, progress.scopeId);
+    if (!candidate || candidate.version <= history.currentEntry.state.version)
+        return null;
+    try {
+        const cached = await restorePublicPrefix(input, progress.scopeId, progress.id, candidate);
+        if (!cached?.completedHead)
+            return null;
+        const finished = cached.verifier.finish(cached.completedHead);
+        if (!finished.ok)
+            throw finished.error;
+        const proof = await loadPrincipalHistoryReference({
+            execSql: input.execSql,
+            scopeId: progress.scopeId,
+            history: finished.value,
+            version: input.source.head.version,
+        });
+        const verified = await verifyPrincipalPolicyHistoryReferences({
+            history: finished.value,
+            references: [proof],
+        });
+        if (!verified.ok)
+            throw verified.error;
+        return principalHeadMatchesReference(proof.entry.state, input.source.head)
+            ? null
+            : candidate;
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError ||
+            error instanceof PublicHistoryAuthorityUnavailableError)
+            return candidate;
+        throw error;
+    }
+}
+export async function publishPublicPrincipalHistoryPrefix(input, progress, history, rejectedPrefix) {
+    const state = history.currentEntry.state;
+    const head = {
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        stateHash: state.stateHash,
+        keyEpoch: state.keyEpoch,
+        keyFingerprint: state.keyFingerprint,
+    };
+    const prefix = {
+        scopeId: progress.scopeId,
+        organizationId: input.organizationId,
+        version: head.version,
+        headJson: serializeKeyingCanonicalJson(head),
+        currentJson: publicHistoryAuthorityJson(progress.authorityReference),
+    };
+    const sealed = await progress.verifier.exportProgress(await principalHistoryPrefixProtection(input.protection, prefix));
+    if (!sealed.ok)
+        throw sealed.error;
+    const rejected = rejectedPrefix ??
+        (progress.cachedPrefix
+            ? null
+            : await rejectedCompletedPrefix(input, progress, history));
+    const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();
+    await savePrincipalHistoryPrefix({
+        execSql: input.execSql,
+        prefix: { ...prefix, progress: sealed.value },
+        stillCurrent,
+        rejectedPrefix: rejected,
+    });
+    if (progress.saved)
+        await discardPrincipalHistoryStage(input.execSql, progress.saved, stillCurrent);
+}
+//# sourceMappingURL=publicPrincipalHistoryProgress.js.map

package/workflows/principals/publicPrincipalHistoryProgress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicPrincipalHistoryProgress.js","sourceRoot":"","sources":["publicPrincipalHistoryProgress.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,qCAAqC,EACrC,4BAA4B,EAE5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAE1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,sCAAsC,EACtC,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAM3C,KAAK,UAAU,mBAAmB,CAChC,KAAoC,EACpC,OAAe,EACf,EAAU,EACV,MAAqC;IAErC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC9C,kBAAkB,KAAK,SAAS;YAChC,kCAAkC,CAAC,UAAU,CAAC;YAC9C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAC3C,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC/C,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EACrC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,MAAM,CAAC,QAAQ,EACf,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBACxE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;oBACrE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;oBAC5D,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,MAAM;oBACpB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,6BAA6B,CAAC;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM;gBACN,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAoC,EACpC,UAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,IAAI,EACJ,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IACE,UAAU;YACV,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC7C,kBAAkB,KAAK,SAAS,EAChC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CACrE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvE,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBAChE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK;oBACL,YAAY,EAAE,IAAI;oBAClB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,OAAO,EACP,EAAE,EACF,MAAM,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CACzD,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,CAAC;QACf,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,uBAAuB,CACpC,KAAoC,EACpC,QAAwC,EACxC,OAAuC;IAEvC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QACvE,OAAO,IAAI,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,EAAE,EACX,SAAS,CACV,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,UAAU,EAAE,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACxE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,uBAAuB;YACxC,KAAK,YAAY,sCAAsC;YAEvD,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAoC,EACpC,QAAwC,EACxC,OAAuC,EACvC,cAA6C;IAE7C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,4BAA4B,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACrE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,QAAQ,GACZ,cAAc;QACd,CAAC,QAAQ,CAAC,YAAY;YACpB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,0BAA0B,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY;QACZ,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK;QAChB,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,KAAK,EACd,YAAY,CACb,CAAC;AACN,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  restorePrincipalPolicyHistoryVerifier,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyHistory,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryPrefix,\n  loadPrincipalHistoryPrefix,\n  type PrincipalHistoryPrefix,\n  savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalHistoryEvidenceScopeId,\n  principalHistoryPrefixProtection,\n} from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport {\n  PublicHistoryAuthorityUnavailableError,\n  parsePublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  validatePublicHistoryAuthority,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nasync function restorePublicPrefix(\n  input: PublicPrincipalHistoryOptions,\n  scopeId: string,\n  id: string,\n  prefix: PrincipalHistoryPrefix | null,\n): Promise<PublicPrincipalHistoryProgress | null> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  if (prefix) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      prefix.currentJson,\n    );\n    let prefixHead: unknown;\n    try {\n      prefixHead = JSON.parse(prefix.headJson);\n    } catch {\n      prefixHead = null;\n    }\n    if (\n      prefix.organizationId === input.organizationId &&\n      authorityReference !== undefined &&\n      isReferencedPrincipalStateResponse(prefixHead) &&\n      prefixHead.principalId === head.principalId &&\n      prefixHead.principalType === head.principalType &&\n      prefixHead.version === prefix.version\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        prefix.progress,\n        await principalHistoryPrefixProtection(input.protection, prefix),\n      );\n      if (restored.ok && restored.value.finish(prefixHead).ok) {\n        await validatePublicHistoryAuthority(input, authorityReference, prefix);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: prefixHead.version >= head.version ? prefixHead : null,\n          afterVersion: Math.min(prefixHead.version, head.version - 1),\n          saved: null,\n          cachedPrefix: prefix,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryPrefix({\n        execSql: input.execSql,\n        prefix,\n        stillCurrent: current,\n      });\n  }\n  return null;\n}\n\nexport async function restorePublicPrincipalHistoryProgress(\n  input: PublicPrincipalHistoryOptions,\n  allowReuse: boolean,\n): Promise<PublicPrincipalHistoryProgress> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    head,\n    input.protection.context,\n  );\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      saved.currentJson,\n    );\n    if (\n      allowReuse &&\n      saved.organizationId === input.organizationId &&\n      authorityReference !== undefined\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(input.protection, head, saved),\n      );\n      if (restored.ok && (!saved.complete || restored.value.finish(head).ok)) {\n        await validatePublicHistoryAuthority(input, authorityReference);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: saved.complete ? head : null,\n          afterVersion: saved.afterVersion,\n          saved,\n          cachedPrefix: null,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryStage(input.execSql, saved, current);\n  }\n  if (allowReuse) {\n    const prefix = await restorePublicPrefix(\n      input,\n      scopeId,\n      id,\n      await loadPrincipalHistoryPrefix(input.execSql, scopeId),\n    );\n    if (prefix) return prefix;\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    completedHead: null,\n    afterVersion: 0,\n    saved: null,\n    cachedPrefix: null,\n    authorityReference: null,\n  };\n}\n\n/** A resumed stage may finish after the reader that rejected the prefix exits. */\nasync function rejectedCompletedPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n): Promise<PrincipalHistoryPrefix | null> {\n  const candidate = await loadPrincipalHistoryPrefix(\n    input.execSql,\n    progress.scopeId,\n  );\n  if (!candidate || candidate.version <= history.currentEntry.state.version)\n    return null;\n  try {\n    const cached = await restorePublicPrefix(\n      input,\n      progress.scopeId,\n      progress.id,\n      candidate,\n    );\n    if (!cached?.completedHead) return null;\n    const finished = cached.verifier.finish(cached.completedHead);\n    if (!finished.ok) throw finished.error;\n    const proof = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId: progress.scopeId,\n      history: finished.value,\n      version: input.source.head.version,\n    });\n    const verified = await verifyPrincipalPolicyHistoryReferences({\n      history: finished.value,\n      references: [proof],\n    });\n    if (!verified.ok) throw verified.error;\n    return principalHeadMatchesReference(proof.entry.state, input.source.head)\n      ? null\n      : candidate;\n  } catch (error) {\n    if (\n      error instanceof KeyingVerificationError ||\n      error instanceof PublicHistoryAuthorityUnavailableError\n    )\n      return candidate;\n    throw error;\n  }\n}\n\nexport async function publishPublicPrincipalHistoryPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n  rejectedPrefix: PrincipalHistoryPrefix | null,\n): Promise<void> {\n  const state = history.currentEntry.state;\n  const head = {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n  const prefix = {\n    scopeId: progress.scopeId,\n    organizationId: input.organizationId,\n    version: head.version,\n    headJson: serializeKeyingCanonicalJson(head),\n    currentJson: publicHistoryAuthorityJson(progress.authorityReference),\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryPrefixProtection(input.protection, prefix),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const rejected =\n    rejectedPrefix ??\n    (progress.cachedPrefix\n      ? null\n      : await rejectedCompletedPrefix(input, progress, history));\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  await savePrincipalHistoryPrefix({\n    execSql: input.execSql,\n    prefix: { ...prefix, progress: sealed.value },\n    stillCurrent,\n    rejectedPrefix: rejected,\n  });\n  if (progress.saved)\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      progress.saved,\n      stillCurrent,\n    );\n}\n"]}

package/workflows/principals/publicPrincipalHistoryTypes.d.ts

@@ -0,0 +1,39 @@
+import type { ApiClient } from "../../internal/api-client/index.js";
+import type { PrincipalPolicyExternalAuthority, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryVerifier, ReferencedPrincipalHead, VerifiedPrincipalPolicyHistory } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyHistorySourceResponse } from "../../internal/validators/response/index.js";
+import type { PrincipalHistoryPrefix } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import type { PrincipalHistoryStage } from "../../data/persistence/principalHistoryStagePersistence.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
+export interface PublicPrincipalHistoryOptions {
+    readonly apiClient: Pick<ApiClient, "getProjectionPolicyHistoryPages">;
+    readonly source: PrincipalPolicyHistorySourceResponse;
+    readonly organizationId: string;
+    readonly execSql: ExecSql;
+    readonly protection: PrincipalPolicyHistoryProgressOptions;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly stillCurrent: () => boolean;
+    readonly signal?: AbortSignal | undefined;
+    readonly offline?: boolean | undefined;
+    /** Retry disposable evidence loss once from signatures, without reusing hints. */
+    readonly replay?: boolean | undefined;
+    readonly strictAdmins?: boolean | undefined;
+    /** Already verified organization binding; included in the protected cache scope. */
+    readonly authorityGroupId?: string | undefined;
+    readonly loadExternalAuthority?: ((references: readonly ReferencedPrincipalHead[], cachedPrefix?: boolean) => Promise<PrincipalPolicyExternalAuthority | undefined>) | undefined;
+}
+export interface PublicPrincipalHistoryProgress {
+    readonly id: string;
+    readonly scopeId: string;
+    readonly verifier: PrincipalPolicyHistoryVerifier;
+    readonly completedHead: ReferencedPrincipalHead | null;
+    readonly afterVersion: number;
+    readonly saved: PrincipalHistoryStage | null;
+    readonly cachedPrefix: PrincipalHistoryPrefix | null;
+    readonly authorityReference: ReferencedPrincipalHead | null;
+}
+/** Public authorization only; caller must check directory binding and local pins. */
+export interface RecoveredPublicPrincipalHistory {
+    readonly scopeId: string;
+    readonly history: VerifiedPrincipalPolicyHistory;
+}

package/workflows/principals/publicPrincipalHistoryTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=publicPrincipalHistoryTypes.js.map

package/workflows/principals/publicPrincipalHistoryTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicPrincipalHistoryTypes.js","sourceRoot":"","sources":["publicPrincipalHistoryTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyHistorySourceResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\nexport interface PublicPrincipalHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getProjectionPolicyHistoryPages\">;\n  readonly source: PrincipalPolicyHistorySourceResponse;\n  readonly organizationId: string;\n  readonly execSql: ExecSql;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n  readonly offline?: boolean | undefined;\n  /** Retry disposable evidence loss once from signatures, without reusing hints. */\n  readonly replay?: boolean | undefined;\n  readonly strictAdmins?: boolean | undefined;\n  /** Already verified organization binding; included in the protected cache scope. */\n  readonly authorityGroupId?: string | undefined;\n  readonly loadExternalAuthority?:\n    | ((\n        references: readonly ReferencedPrincipalHead[],\n        cachedPrefix?: boolean,\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n}\n\nexport interface PublicPrincipalHistoryProgress {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly completedHead: ReferencedPrincipalHead | null;\n  readonly afterVersion: number;\n  readonly saved: PrincipalHistoryStage | null;\n  readonly cachedPrefix: PrincipalHistoryPrefix | null;\n  readonly authorityReference: ReferencedPrincipalHead | null;\n}\n\n/** Public authorization only; caller must check directory binding and local pins. */\nexport interface RecoveredPublicPrincipalHistory {\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}\n"]}

package/workflows/principals/publicProjectionDirectory.js

@@ -0,0 +1,40 @@
+import { computePrincipalStatePayloadCiphertextHash, } from "../../internal/crypto/index.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { rejectPublicProjection, selectPublicProjectionPrincipal, } from "./publicProjectionPrincipal.js";
+export async function publicProjectionDirectoryBindings(evidence, organization) {
+    const policies = await selectPublicProjectionPrincipal(organization);
+    const entries = policies.flatMap((policy) => policy.retainedHistory);
+    const descriptors = [];
+    const seen = new Set();
+    for (const { reference, payload } of evidence.organizationPayloads) {
+        const state = entries.find(({ state }) => principalHeadMatchesReference(state, reference))?.state;
+        if (!state ||
+            reference.version > organization.options.source.head.version ||
+            payload.principalType !== "organization" ||
+            payload.principalId !== organization.options.organizationId ||
+            payload.stateHash !== state.stateHash ||
+            seen.has(state.stateHash))
+            rejectPublicProjection("directory payload scope is invalid");
+        seen.add(state.stateHash);
+        const hash = await computePrincipalStatePayloadCiphertextHash(payload.ciphertext);
+        if (hash !== payload.ciphertextHash || hash !== state.payloadCiphertextHash)
+            rejectPublicProjection("directory payload differs from its signed hash");
+        const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);
+        if (descriptor.organizationId !== organization.options.organizationId)
+            rejectPublicProjection("directory belongs to another organization");
+        descriptors.push(descriptor);
+    }
+    const bindings = new Map();
+    for (const source of evidence.groups) {
+        if (source.head.principalType !== "group" ||
+            bindings.has(source.head.principalId))
+            rejectPublicProjection("group sources have invalid or repeated scopes");
+        const directory = descriptors.find((candidate) => candidate.groupHeads.some((head) => principalHeadMatchesReference(head, source.head)));
+        const adminHead = directory?.groupHeads.find((head) => head.principalId === directory.adminGroupId);
+        if (!adminHead)
+            rejectPublicProjection("group source lacks its signed directory binding");
+        bindings.set(source.head.principalId, { adminHead });
+    }
+    return bindings;
+}
+//# sourceMappingURL=publicProjectionDirectory.js.map

package/workflows/principals/publicProjectionDirectory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicProjectionDirectory.js","sourceRoot":"","sources":["publicProjectionDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,GAE3C,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAEL,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,QAA0C,EAC1C,YAAuC;IAEvC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACvC,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD,EAAE,KAAK,CAAC;QACT,IACE,CAAC,KAAK;YACN,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5D,OAAO,CAAC,aAAa,KAAK,cAAc;YACxC,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC,OAAO,CAAC,cAAc;YAC3D,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAEzB,sBAAsB,CAAC,oCAAoC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,IAAI,KAAK,OAAO,CAAC,cAAc,IAAI,IAAI,KAAK,KAAK,CAAC,qBAAqB;YACzE,sBAAsB,CAAC,gDAAgD,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,oCAAoC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,cAAc,KAAK,YAAY,CAAC,OAAO,CAAC,cAAc;YACnE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;QACtE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkD,CAAC;IAC3E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IACE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO;YACrC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAErC,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,6BAA6B,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CACjD,CACF,CAAC;QACF,MAAM,SAAS,GAAG,SAAS,EAAE,UAAU,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,YAAY,CACtD,CAAC;QACF,IAAI,CAAC,SAAS;YACZ,sBAAsB,CAAC,iDAAiD,CAAC,CAAC;QAC5E,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  computePrincipalStatePayloadCiphertextHash,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  type PublicProjectionPrincipal,\n  rejectPublicProjection,\n  selectPublicProjectionPrincipal,\n} from \"./publicProjectionPrincipal\";\n\nexport async function publicProjectionDirectoryBindings(\n  evidence: ProjectionPolicyEvidenceResponse,\n  organization: PublicProjectionPrincipal,\n) {\n  const policies = await selectPublicProjectionPrincipal(organization);\n  const entries = policies.flatMap((policy) => policy.retainedHistory);\n  const descriptors = [];\n  const seen = new Set<string>();\n  for (const { reference, payload } of evidence.organizationPayloads) {\n    const state = entries.find(({ state }) =>\n      principalHeadMatchesReference(state, reference),\n    )?.state;\n    if (\n      !state ||\n      reference.version > organization.options.source.head.version ||\n      payload.principalType !== \"organization\" ||\n      payload.principalId !== organization.options.organizationId ||\n      payload.stateHash !== state.stateHash ||\n      seen.has(state.stateHash)\n    )\n      rejectPublicProjection(\"directory payload scope is invalid\");\n    seen.add(state.stateHash);\n    const hash = await computePrincipalStatePayloadCiphertextHash(\n      payload.ciphertext,\n    );\n    if (hash !== payload.ciphertextHash || hash !== state.payloadCiphertextHash)\n      rejectPublicProjection(\"directory payload differs from its signed hash\");\n    const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);\n    if (descriptor.organizationId !== organization.options.organizationId)\n      rejectPublicProjection(\"directory belongs to another organization\");\n    descriptors.push(descriptor);\n  }\n  const bindings = new Map<string, { adminHead: ReferencedPrincipalHead }>();\n  for (const source of evidence.groups) {\n    if (\n      source.head.principalType !== \"group\" ||\n      bindings.has(source.head.principalId)\n    )\n      rejectPublicProjection(\"group sources have invalid or repeated scopes\");\n    const directory = descriptors.find((candidate) =>\n      candidate.groupHeads.some((head) =>\n        principalHeadMatchesReference(head, source.head),\n      ),\n    );\n    const adminHead = directory?.groupHeads.find(\n      (head) => head.principalId === directory.adminGroupId,\n    );\n    if (!adminHead)\n      rejectPublicProjection(\"group source lacks its signed directory binding\");\n    bindings.set(source.head.principalId, { adminHead });\n  }\n  return bindings;\n}\n"]}

package/workflows/principals/publicProjectionPrincipal.js

@@ -0,0 +1,53 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+import { recoverPublicPrincipalHistory } from "./recoverPublicPrincipalHistory.js";
+import { selectPublicPrincipalHistory } from "./selectPublicPrincipalHistory.js";
+/** The source head and every citation remain bound independently of a newer prefix. */
+export async function selectPublicProjectionPrincipal(principal, references = principal.references) {
+    const { options } = principal;
+    const current = () => !options.signal?.aborted && options.stillCurrent();
+    assertProjectionVerificationCurrent(current);
+    const checkpoint = await loadPrincipalPolicyCheckpoint(options.execSql, options.source.head.principalType, options.source.head.principalId);
+    try {
+        return await selectPublicPrincipalHistory({
+            execSql: options.execSql,
+            recovered: principal.recovered,
+            references: [options.source.head, ...references],
+            checkpoint,
+            includeGenesis: options.source.head.principalType === "organization",
+            stillCurrent: current,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))
+            throw error;
+        if (options.offline || principal.replayed)
+            throw error.verificationError;
+        principal.replayed = true;
+        principal.recovered = await recoverPublicPrincipalHistory({
+            ...options,
+            replay: true,
+        });
+        return selectPublicProjectionPrincipal(principal, references);
+    }
+}
+export async function recoverPublicProjectionPrincipal(options, references) {
+    const selected = references.filter((head) => head.principalType === options.source.head.principalType &&
+        head.principalId === options.source.head.principalId);
+    if (selected.some((head) => head.version > options.source.head.version))
+        rejectPublicProjection("citation exceeds its supplied source head");
+    const principal = {
+        options,
+        references: structuredClone(selected),
+        recovered: await recoverPublicPrincipalHistory(options),
+        replayed: false,
+    };
+    await selectPublicProjectionPrincipal(principal);
+    return principal;
+}
+export function rejectPublicProjection(message) {
+    throw new KeyingVerificationError("object_mismatch", `Public projection history: ${message}`);
+}
+//# sourceMappingURL=publicProjectionPrincipal.js.map

package/workflows/principals/publicProjectionPrincipal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicProjectionPrincipal.js","sourceRoot":"","sources":["publicProjectionPrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAKhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAS9E,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAoC,EACpC,aAAiD,SAAS,CAAC,UAAU;IAErE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAChC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC;YAChD,UAAU;YACV,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc;YACpE,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAwC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC,iBAAiB,CAAC;QACzE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,SAAS,GAAG,MAAM,6BAA6B,CAAC;YACxD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,+BAA+B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAsC,EACtC,UAA8C;IAE9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;QACxD,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACrE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC;QACvD,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8BAA8B,OAAO,EAAE,CACxC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  RecoveredPublicPrincipalHistory,\n} from \"./publicPrincipalHistoryTypes\";\nimport { recoverPublicPrincipalHistory } from \"./recoverPublicPrincipalHistory\";\nimport { selectPublicPrincipalHistory } from \"./selectPublicPrincipalHistory\";\n\nexport interface PublicProjectionPrincipal {\n  readonly options: PublicPrincipalHistoryOptions;\n  readonly references: readonly ReferencedPrincipalHead[];\n  recovered: RecoveredPublicPrincipalHistory;\n  replayed: boolean;\n}\n\n/** The source head and every citation remain bound independently of a newer prefix. */\nexport async function selectPublicProjectionPrincipal(\n  principal: PublicProjectionPrincipal,\n  references: readonly ReferencedPrincipalHead[] = principal.references,\n) {\n  const { options } = principal;\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.source.head.principalType,\n    options.source.head.principalId,\n  );\n  try {\n    return await selectPublicPrincipalHistory({\n      execSql: options.execSql,\n      recovered: principal.recovered,\n      references: [options.source.head, ...references],\n      checkpoint,\n      includeGenesis: options.source.head.principalType === \"organization\",\n      stillCurrent: current,\n    });\n  } catch (error) {\n    if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))\n      throw error;\n    if (options.offline || principal.replayed) throw error.verificationError;\n    principal.replayed = true;\n    principal.recovered = await recoverPublicPrincipalHistory({\n      ...options,\n      replay: true,\n    });\n    return selectPublicProjectionPrincipal(principal, references);\n  }\n}\n\nexport async function recoverPublicProjectionPrincipal(\n  options: PublicPrincipalHistoryOptions,\n  references: readonly ReferencedPrincipalHead[],\n): Promise<PublicProjectionPrincipal> {\n  const selected = references.filter(\n    (head) =>\n      head.principalType === options.source.head.principalType &&\n      head.principalId === options.source.head.principalId,\n  );\n  if (selected.some((head) => head.version > options.source.head.version))\n    rejectPublicProjection(\"citation exceeds its supplied source head\");\n  const principal = {\n    options,\n    references: structuredClone(selected),\n    recovered: await recoverPublicPrincipalHistory(options),\n    replayed: false,\n  };\n  await selectPublicProjectionPrincipal(principal);\n  return principal;\n}\n\nexport function rejectPublicProjection(message: string): never {\n  throw new KeyingVerificationError(\n    \"object_mismatch\",\n    `Public projection history: ${message}`,\n  );\n}\n"]}

package/workflows/principals/recoverPrincipalPolicyHistory.js

@@ -6,6 +6,7 @@ import { discardPrincipalHistoryStage, savePrincipalHistoryStage, } from "../../
 import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
 import { principalHistoryStageProtection } from "../../data/principals/principalHistoryStageProtection.js";
 import { collectPrincipalPolicySignerPublicKeys } from "./policyVerification.js";
+import { validatePrincipalHistoryRecoveryAuthority } from "./principalHistoryRecoveryAuthority.js";
 import { publishReusablePrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
 import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "./principalHistoryRecoveryReferences.js";
 import { restorePrincipalHistoryRecoveryStage, } from "./principalHistoryRecoveryStage.js";
@@ -74,7 +75,7 @@ async function acceptPage(input, stage, response) {
     });
     if ("error" in keys)
         throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Principal history signer identity could not be authenticated");
-    const externalAuthority = await input.loadExternalAuthority?.(entries);
+    const externalAuthority = await input.loadExternalAuthority?.(entries.flatMap(({ state }) => state.externalAuthority ? [state.externalAuthority] : []));
     const appended = await stage.verifier.append({
         entries,
         signerPublicKeys: keys.signerPublicKeys,
@@ -196,6 +197,8 @@ async function recover(input, allowEvidenceRebuild = true) {
     };
     const stage = await restorePrincipalHistoryRecoveryStage(input, historyInput, allowEvidenceRebuild);
     try {
+        if (stage.fromCache)
+            await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);
         await readRecoveryPages(input, stage);
         return await finishRecovery(input, stage, checkpoint);
     }