@tearleads/client-sdk 0.1.14 → 0.1.15

package/workflows/principals/runtimePolicyWarmer.js

@@ -1,5 +1,6 @@
 import { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
 import { createRuntimePrincipalPolicyResolver, } from "./runtimePolicyRecovery.js";
+import { createRuntimeProjectionPolicyResolver } from "./runtimeProjectionPolicyRecovery.js";
 export function createRuntimePrincipalPolicyWarmer(runtime) {
     const policyInput = ({ organizationId, references, stillCurrent, }) => {
         const input = {
@@ -28,6 +29,7 @@ export function createRuntimePrincipalPolicyWarmer(runtime) {
     return Object.assign(warmer, {
         cacheBundles,
         resolveReference: createRuntimePrincipalPolicyResolver(runtime),
+        resolveProjectionHistory: createRuntimeProjectionPolicyResolver(runtime),
     });
 }
 //# sourceMappingURL=runtimePolicyWarmer.js.map

package/workflows/principals/runtimePolicyWarmer.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oCAAoC,GAErC,MAAM,yBAAyB,CAAC;AAiBjC,MAAM,UAAU,kCAAkC,CAChD,OAAmC;IAEnC,MAAM,WAAW,GAAG,CAAC,EACnB,cAAc,EACd,UAAU,EACV,YAAY,GACmC,EAAE,EAAE;QACnD,MAAM,KAAK,GAA2D;YACpE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;YACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;YACrB,cAAc;YACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAC3D,UAAU;YACV,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,YAAY;SACb,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAClB,KAAqD,EACrD,EAAE,CAAC,gCAAgC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,KAAwC,EAAE,EAAE,CAChE,2BAA2B,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,YAAY;QACZ,gBAAgB,EAAE,oCAAoC,CAAC,OAAO,CAAC;KAChE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type {\n  PrincipalPolicyBundleCacheRequest,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nimport {\n  createRuntimePrincipalPolicyResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"./runtimePolicyRecovery\";\n\ninterface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] & {\n    getCurrentPrincipalPolicy(\n      principalType: \"group\" | \"organization\",\n      principalId: string,\n    ): Promise<PrincipalPolicyBundleResponse | null>;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n): ReferencedPrincipalPolicyWarmer {\n  const policyInput = ({\n    organizationId,\n    references,\n    stillCurrent,\n  }: Parameters<ReferencedPrincipalPolicyWarmer>[0]) => {\n    const input: Parameters<typeof cacheReferencedPrincipalPolicies>[0] = {\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      references,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent,\n    };\n    return input;\n  };\n  const warmer = async (\n    input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n  ) => cacheReferencedPrincipalPolicies(policyInput(input));\n  const cacheBundles = (input: PrincipalPolicyBundleCacheRequest) =>\n    cachePrincipalPolicyBundles({\n      bundles: input.bundles,\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId: input.organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent: input.stillCurrent,\n    });\n  return Object.assign(warmer, {\n    cacheBundles,\n    resolveReference: createRuntimePrincipalPolicyResolver(runtime),\n  });\n}\n"]}
+{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oCAAoC,GAErC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAiB1F,MAAM,UAAU,kCAAkC,CAChD,OAAmC;IAEnC,MAAM,WAAW,GAAG,CAAC,EACnB,cAAc,EACd,UAAU,EACV,YAAY,GACmC,EAAE,EAAE;QACnD,MAAM,KAAK,GAA2D;YACpE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;YACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;YACrB,cAAc;YACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAC3D,UAAU;YACV,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,YAAY;SACb,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAClB,KAAqD,EACrD,EAAE,CAAC,gCAAgC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,KAAwC,EAAE,EAAE,CAChE,2BAA2B,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,YAAY;QACZ,gBAAgB,EAAE,oCAAoC,CAAC,OAAO,CAAC;QAC/D,wBAAwB,EAAE,qCAAqC,CAAC,OAAO,CAAC;KACzE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type {\n  PrincipalPolicyBundleCacheRequest,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nimport {\n  createRuntimePrincipalPolicyResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"./runtimePolicyRecovery\";\nimport { createRuntimeProjectionPolicyResolver } from \"./runtimeProjectionPolicyRecovery\";\n\ninterface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] & {\n    getCurrentPrincipalPolicy(\n      principalType: \"group\" | \"organization\",\n      principalId: string,\n    ): Promise<PrincipalPolicyBundleResponse | null>;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n): ReferencedPrincipalPolicyWarmer {\n  const policyInput = ({\n    organizationId,\n    references,\n    stillCurrent,\n  }: Parameters<ReferencedPrincipalPolicyWarmer>[0]) => {\n    const input: Parameters<typeof cacheReferencedPrincipalPolicies>[0] = {\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      references,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent,\n    };\n    return input;\n  };\n  const warmer = async (\n    input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n  ) => cacheReferencedPrincipalPolicies(policyInput(input));\n  const cacheBundles = (input: PrincipalPolicyBundleCacheRequest) =>\n    cachePrincipalPolicyBundles({\n      bundles: input.bundles,\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId: input.organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent: input.stillCurrent,\n    });\n  return Object.assign(warmer, {\n    cacheBundles,\n    resolveReference: createRuntimePrincipalPolicyResolver(runtime),\n    resolveProjectionHistory: createRuntimeProjectionPolicyResolver(runtime),\n  });\n}\n"]}

package/workflows/principals/runtimeProjectionPolicyRecovery.js

@@ -0,0 +1,56 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
+import { assertProjectionVerificationCurrent, } from "../../data/keyingProjectionVerification/types.js";
+import { readPrincipalHistoryProtection } from "../../data/principals/principalHistoryRuntime.js";
+import { PrincipalPolicyHistoryReadError } from "./principalHistoryRecoveryTypes.js";
+import { isPrincipalRecoveryOutage } from "./principalRecoveryOutage.js";
+import { queuePrincipalRecovery } from "./principalRecoveryQueue.js";
+import { recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
+async function recoverWithOutageFallback(options) {
+    try {
+        return await recoverProjectionPolicyHistory(options);
+    }
+    catch (error) {
+        assertProjectionVerificationCurrent(options.stillCurrent);
+        if (options.offline || !isPrincipalRecoveryOutage(error))
+            throw error;
+        return recoverProjectionPolicyHistory({ ...options, offline: true });
+    }
+}
+export function createRuntimeProjectionPolicyResolver(runtime) {
+    const lease = readPrincipalHistoryProtection(runtime);
+    const readPages = runtime.apiClient.getProjectionPolicyHistoryPages?.bind(runtime.apiClient);
+    if (!lease || !readPages)
+        return undefined;
+    return (input) => queuePrincipalRecovery(runtime.infra.execSql, input.organizationId, () => runWithSecurityIncidentReporting(runtime.util.reportSecurityIncident, {
+        objectId: input.organizationId,
+        objectKind: "principal",
+        operation: "principal.projection.recover",
+        organizationId: input.organizationId,
+    }, () => lease(async ({ protection, stillCurrent: leaseCurrent }) => {
+        const stillCurrent = () => leaseCurrent() && input.stillCurrent?.() !== false;
+        assertProjectionVerificationCurrent(stillCurrent);
+        try {
+            const policies = await recoverWithOutageFallback({
+                ...input,
+                apiClient: { getProjectionPolicyHistoryPages: readPages },
+                execSql: runtime.infra.execSql,
+                protection,
+                stillCurrent,
+                offline: runtime.state?.online === false,
+                resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+            });
+            return { policies, stillCurrent };
+        }
+        catch (error) {
+            assertProjectionVerificationCurrent(stillCurrent);
+            if (error instanceof PrincipalPolicyHistoryReadError ||
+                (error instanceof KeyingVerificationError &&
+                    error.code === "missing_dependency"))
+                throw new ProjectionDependencyUnavailableError(error.message);
+            throw error;
+        }
+    })));
+}
+//# sourceMappingURL=runtimeProjectionPolicyRecovery.js.map

package/workflows/principals/runtimeProjectionPolicyRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeProjectionPolicyRecovery.js","sourceRoot":"","sources":["runtimeProjectionPolicyRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,mCAAmC,GAEpC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAEL,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAG1C,KAAK,UAAU,yBAAyB,CACtC,OAA+C;IAE/C,IAAI,CAAC;QACH,OAAO,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACtE,OAAO,8BAA8B,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAuC;IAEvC,MAAM,KAAK,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,+BAA+B,EAAE,IAAI,CACvE,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,CACvE,gCAAgC,CAC9B,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,8BAA8B;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,EACD,GAAG,EAAE,CACH,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QACzD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;QACrD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;gBAC/C,GAAG,KAAK;gBACR,SAAS,EAAE,EAAE,+BAA+B,EAAE,SAAS,EAAE;gBACzD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,UAAU;gBACV,YAAY;gBACZ,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK;gBACxC,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;aAC/D,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,YAAY,+BAA+B;gBAChD,CAAC,KAAK,YAAY,uBAAuB;oBACvC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBAEtC,MAAM,IAAI,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACL,CACF,CAAC;AACN,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  assertProjectionVerificationCurrent,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification/types\";\nimport { readPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport { PrincipalPolicyHistoryReadError } from \"./principalHistoryRecoveryTypes\";\nimport { isPrincipalRecoveryOutage } from \"./principalRecoveryOutage\";\nimport { queuePrincipalRecovery } from \"./principalRecoveryQueue\";\nimport {\n  type ProjectionPolicyHistoryRecoveryOptions,\n  recoverProjectionPolicyHistory,\n} from \"./recoverProjectionPolicyHistory\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"./runtimePolicyRecovery\";\n\nasync function recoverWithOutageFallback(\n  options: ProjectionPolicyHistoryRecoveryOptions,\n) {\n  try {\n    return await recoverProjectionPolicyHistory(options);\n  } catch (error) {\n    assertProjectionVerificationCurrent(options.stillCurrent);\n    if (options.offline || !isPrincipalRecoveryOutage(error)) throw error;\n    return recoverProjectionPolicyHistory({ ...options, offline: true });\n  }\n}\n\nexport function createRuntimeProjectionPolicyResolver(\n  runtime: PrincipalPolicyRecoveryRuntime,\n): ReferencedPrincipalPolicyWarmer[\"resolveProjectionHistory\"] {\n  const lease = readPrincipalHistoryProtection(runtime);\n  const readPages = runtime.apiClient.getProjectionPolicyHistoryPages?.bind(\n    runtime.apiClient,\n  );\n  if (!lease || !readPages) return undefined;\n  return (input) =>\n    queuePrincipalRecovery(runtime.infra.execSql, input.organizationId, () =>\n      runWithSecurityIncidentReporting(\n        runtime.util.reportSecurityIncident,\n        {\n          objectId: input.organizationId,\n          objectKind: \"principal\",\n          operation: \"principal.projection.recover\",\n          organizationId: input.organizationId,\n        },\n        () =>\n          lease(async ({ protection, stillCurrent: leaseCurrent }) => {\n            const stillCurrent = () =>\n              leaseCurrent() && input.stillCurrent?.() !== false;\n            assertProjectionVerificationCurrent(stillCurrent);\n            try {\n              const policies = await recoverWithOutageFallback({\n                ...input,\n                apiClient: { getProjectionPolicyHistoryPages: readPages },\n                execSql: runtime.infra.execSql,\n                protection,\n                stillCurrent,\n                offline: runtime.state?.online === false,\n                resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n              });\n              return { policies, stillCurrent };\n            } catch (error) {\n              assertProjectionVerificationCurrent(stillCurrent);\n              if (\n                error instanceof PrincipalPolicyHistoryReadError ||\n                (error instanceof KeyingVerificationError &&\n                  error.code === \"missing_dependency\")\n              )\n                throw new ProjectionDependencyUnavailableError(error.message);\n              throw error;\n            }\n          }),\n      ),\n    );\n}\n"]}

package/workflows/principals/selectPublicPrincipalHistory.js

@@ -0,0 +1,90 @@
+import { KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, selectPrincipalPolicyAuthorization, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+async function selectBatch(input, versions, checkpointReference) {
+    const proofs = [];
+    for (const version of versions) {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        proofs.push(await loadPrincipalHistoryReference({
+            execSql: input.execSql,
+            ...input.recovered,
+            version,
+        }));
+    }
+    const selected = await verifyPrincipalPolicyHistoryReferences({
+        history: input.recovered.history,
+        references: proofs,
+        checkpointReference,
+    });
+    if (!selected.ok)
+        throw selected.error;
+    return selected.value;
+}
+async function loadCheckpointProof(input, checkpoint) {
+    let checkpointReference;
+    try {
+        if (checkpoint)
+            checkpointReference = await loadPrincipalHistoryReference({
+                execSql: input.execSql,
+                ...input.recovered,
+                version: checkpoint.version,
+            });
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw new PrincipalHistoryEvidenceUnavailableError(error);
+        throw error;
+    }
+    return checkpointReference;
+}
+/** Select bounded proof batches without admitting or advancing durable pins. */
+export async function selectPublicPrincipalHistory(input) {
+    const references = structuredClone(input.references);
+    const checkpoint = input.checkpoint && { ...input.checkpoint };
+    const head = input.recovered.history.currentEntry.state;
+    if (checkpoint && checkpoint.version > head.version)
+        throw new KeyingVerificationError("missing_dependency", "Public history cannot connect to the newer durable checkpoint");
+    if (references.some((reference) => reference.principalType !== head.principalType ||
+        reference.principalId !== head.principalId ||
+        reference.version > head.version))
+        throw new KeyingVerificationError("object_mismatch", "Public history reference is outside the verified prefix");
+    const versions = [
+        ...new Set([
+            ...(input.includeGenesis ? [1] : []),
+            ...references.map(({ version }) => version),
+            head.version,
+        ]),
+    ];
+    const policies = [];
+    const checkpointReference = await loadCheckpointProof(input, checkpoint);
+    for (let offset = 0; offset < versions.length; offset += PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT) {
+        const batch = versions.slice(offset, offset + PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT);
+        const selected = await selectBatch(input, batch, checkpointReference).catch((error) => {
+            if (error instanceof KeyingVerificationError)
+                throw new PrincipalHistoryEvidenceUnavailableError(error);
+            throw error;
+        });
+        // Authenticate the disposable proof before comparing caller citations or pins.
+        for (const reference of references.filter(({ version }) => batch.includes(version)))
+            if (!selected.retainedEntries.some(({ state }) => principalHeadMatchesReference(state, reference)))
+                throw new KeyingVerificationError("object_mismatch", "Public history citation differs from its verified entry");
+        verifyPrincipalPolicyCheckpoint({
+            chain: selected.retainedEntries.map((entry) => ({
+                ...entry,
+                projection: [...entry.projection],
+                grants: [...entry.grants],
+            })),
+            currentState: selected.currentEntry.state,
+            localCheckpoint: checkpoint,
+        });
+        const policy = await selectPrincipalPolicyAuthorization(selected);
+        if (!policy.ok)
+            throw policy.error;
+        policies.push(policy.value);
+    }
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    return policies;
+}
+//# sourceMappingURL=selectPublicPrincipalHistory.js.map

package/workflows/principals/selectPublicPrincipalHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectPublicPrincipalHistory.js","sourceRoot":"","sources":["selectPublicPrincipalHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAIlC,kCAAkC,EAElC,+BAA+B,EAC/B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAEtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAYhG,KAAK,UAAU,WAAW,CACxB,KAAkC,EAClC,QAA2B,EAC3B,mBAAqE;IAErE,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,MAAM,6BAA6B,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,KAAK,CAAC,SAAS;YAClB,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;QAChC,UAAU,EAAE,MAAM;QAClB,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkC,EAClC,UAA4C;IAE5C,IAAI,mBAAqE,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,UAAU;YACZ,mBAAmB,GAAG,MAAM,6BAA6B,CAAC;gBACxD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,KAAK,CAAC,SAAS;gBAClB,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAkC;IAElC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACxD,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;QACjD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;IACJ,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC9C,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAC1C,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CACnC;QAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC;YAC3C,IAAI,CAAC,OAAO;SACb,CAAC;KACH,CAAC;IACF,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,mBAAmB,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,KACE,IAAI,MAAM,GAAG,CAAC,EACd,MAAM,GAAG,QAAQ,CAAC,MAAM,EACxB,MAAM,IAAI,kCAAkC,EAC5C,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAC1B,MAAM,EACN,MAAM,GAAG,kCAAkC,CAC5C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC,KAAK,CACzE,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,KAAK,YAAY,uBAAuB;gBAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC,CACF,CAAC;QACF,+EAA+E;QAC/E,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CACxB;YACC,IACE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD;gBAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;QACN,+BAA+B,CAAC;YAC9B,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC9C,GAAG,KAAK;gBACR,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;gBACjC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;aAC1B,CAAC,CAAC;YACH,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;YACzC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryReferenceProof,\n  type ReferencedPrincipalHead,\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoveredPublicPrincipalHistory } from \"./publicPrincipalHistoryTypes\";\n\ninterface PublicHistorySelectionInput {\n  readonly execSql: ExecSql;\n  readonly recovered: RecoveredPublicPrincipalHistory;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly checkpoint: PrincipalPolicyCheckpoint | null;\n  readonly includeGenesis?: boolean;\n  readonly stillCurrent: () => boolean;\n}\n\nasync function selectBatch(\n  input: PublicHistorySelectionInput,\n  versions: readonly number[],\n  checkpointReference: PrincipalPolicyHistoryReferenceProof | undefined,\n) {\n  const proofs: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (const version of versions) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    proofs.push(\n      await loadPrincipalHistoryReference({\n        execSql: input.execSql,\n        ...input.recovered,\n        version,\n      }),\n    );\n  }\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history: input.recovered.history,\n    references: proofs,\n    checkpointReference,\n  });\n  if (!selected.ok) throw selected.error;\n  return selected.value;\n}\n\nasync function loadCheckpointProof(\n  input: PublicHistorySelectionInput,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<PrincipalPolicyHistoryReferenceProof | undefined> {\n  let checkpointReference: PrincipalPolicyHistoryReferenceProof | undefined;\n  try {\n    if (checkpoint)\n      checkpointReference = await loadPrincipalHistoryReference({\n        execSql: input.execSql,\n        ...input.recovered,\n        version: checkpoint.version,\n      });\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n  return checkpointReference;\n}\n\n/** Select bounded proof batches without admitting or advancing durable pins. */\nexport async function selectPublicPrincipalHistory(\n  input: PublicHistorySelectionInput,\n): Promise<VerifiedPrincipalPolicySelection[]> {\n  const references = structuredClone(input.references);\n  const checkpoint = input.checkpoint && { ...input.checkpoint };\n  const head = input.recovered.history.currentEntry.state;\n  if (checkpoint && checkpoint.version > head.version)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Public history cannot connect to the newer durable checkpoint\",\n    );\n  if (\n    references.some(\n      (reference) =>\n        reference.principalType !== head.principalType ||\n        reference.principalId !== head.principalId ||\n        reference.version > head.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history reference is outside the verified prefix\",\n    );\n  const versions = [\n    ...new Set([\n      ...(input.includeGenesis ? [1] : []),\n      ...references.map(({ version }) => version),\n      head.version,\n    ]),\n  ];\n  const policies: VerifiedPrincipalPolicySelection[] = [];\n  const checkpointReference = await loadCheckpointProof(input, checkpoint);\n  for (\n    let offset = 0;\n    offset < versions.length;\n    offset += PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  ) {\n    const batch = versions.slice(\n      offset,\n      offset + PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n    );\n    const selected = await selectBatch(input, batch, checkpointReference).catch(\n      (error: unknown) => {\n        if (error instanceof KeyingVerificationError)\n          throw new PrincipalHistoryEvidenceUnavailableError(error);\n        throw error;\n      },\n    );\n    // Authenticate the disposable proof before comparing caller citations or pins.\n    for (const reference of references.filter(({ version }) =>\n      batch.includes(version),\n    ))\n      if (\n        !selected.retainedEntries.some(({ state }) =>\n          principalHeadMatchesReference(state, reference),\n        )\n      )\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Public history citation differs from its verified entry\",\n        );\n    verifyPrincipalPolicyCheckpoint({\n      chain: selected.retainedEntries.map((entry) => ({\n        ...entry,\n        projection: [...entry.projection],\n        grants: [...entry.grants],\n      })),\n      currentState: selected.currentEntry.state,\n      localCheckpoint: checkpoint,\n    });\n    const policy = await selectPrincipalPolicyAuthorization(selected);\n    if (!policy.ok) throw policy.error;\n    policies.push(policy.value);\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return policies;\n}\n"]}

package/workflows/registration/provisioningBootstrapBuilders.d.ts

@@ -66,177 +66,45 @@ export declare function buildInitialRootProvisioning(input: {
     rootContainerProjection: {
         policyEvidence: {
             organization: {
-                currentGrants: {
-                    accessLevel: "admin" | "read" | "write";
-                    containerId: string;
-                }[];
-                currentProjection: {
-                    role: "member" | "admin";
-                    userId: string;
-                }[];
-                currentState: {
-                    createdAt: string;
-                    encapsulationPublicKey: string;
-                    externalAuthority: {
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        principalId: string;
-                        principalType: "group";
-                        stateHash: string;
-                        version: number;
-                    } | null;
-                    grantCount: number;
-                    grantRoot: string;
+                head: {
                     keyEpoch: number;
                     keyFingerprint: string;
-                    memberCount: number;
-                    memberEnvelopesRoot: string;
-                    membershipMode: "projection";
-                    membershipRoot: string;
-                    payloadCiphertextHash: string;
-                    prevStateHash: string | null;
                     principalId: string;
                     principalType: "group" | "organization";
-                    projectionRoot: string;
-                    signature: string;
-                    signedAt: string;
-                    signerUserId: string;
-                    signerUserKeyFingerprint: string;
                     stateHash: string;
                     version: number;
                 };
-                previousStates: {
-                    grants: {
-                        accessLevel: "admin" | "read" | "write";
-                        containerId: string;
-                    }[];
-                    projection: {
-                        role: "member" | "admin";
-                        userId: string;
-                    }[];
-                    state: {
-                        createdAt: string;
-                        encapsulationPublicKey: string;
-                        externalAuthority: {
-                            keyEpoch: number;
-                            keyFingerprint: string;
-                            principalId: string;
-                            principalType: "group";
-                            stateHash: string;
-                            version: number;
-                        } | null;
-                        grantCount: number;
-                        grantRoot: string;
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        memberCount: number;
-                        memberEnvelopesRoot: string;
-                        membershipMode: "projection";
-                        membershipRoot: string;
-                        payloadCiphertextHash: string;
-                        prevStateHash: string | null;
-                        principalId: string;
-                        principalType: "group" | "organization";
-                        projectionRoot: string;
-                        signature: string;
-                        signedAt: string;
-                        signerUserId: string;
-                        signerUserKeyFingerprint: string;
-                        stateHash: string;
-                        version: number;
-                    };
-                }[];
+                grant: string;
             } | null;
             organizationPayloads: {
-                cipherSuite: "aes-256-gcm";
-                ciphertext: string;
-                ciphertextHash: string;
-                createdAt: string;
-                principalId: string;
-                principalType: "group" | "organization";
-                stateHash: string;
+                reference: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group" | "organization";
+                    stateHash: string;
+                    version: number;
+                };
+                payload: {
+                    cipherSuite: "aes-256-gcm";
+                    ciphertext: string;
+                    ciphertextHash: string;
+                    createdAt: string;
+                    principalId: string;
+                    principalType: "group" | "organization";
+                    stateHash: string;
+                };
             }[];
             groups: {
-                currentGrants: {
-                    accessLevel: "admin" | "read" | "write";
-                    containerId: string;
-                }[];
-                currentProjection: {
-                    role: "member" | "admin";
-                    userId: string;
-                }[];
-                currentState: {
-                    createdAt: string;
-                    encapsulationPublicKey: string;
-                    externalAuthority: {
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        principalId: string;
-                        principalType: "group";
-                        stateHash: string;
-                        version: number;
-                    } | null;
-                    grantCount: number;
-                    grantRoot: string;
+                head: {
                     keyEpoch: number;
                     keyFingerprint: string;
-                    memberCount: number;
-                    memberEnvelopesRoot: string;
-                    membershipMode: "projection";
-                    membershipRoot: string;
-                    payloadCiphertextHash: string;
-                    prevStateHash: string | null;
                     principalId: string;
                     principalType: "group" | "organization";
-                    projectionRoot: string;
-                    signature: string;
-                    signedAt: string;
-                    signerUserId: string;
-                    signerUserKeyFingerprint: string;
                     stateHash: string;
                     version: number;
                 };
-                previousStates: {
-                    grants: {
-                        accessLevel: "admin" | "read" | "write";
-                        containerId: string;
-                    }[];
-                    projection: {
-                        role: "member" | "admin";
-                        userId: string;
-                    }[];
-                    state: {
-                        createdAt: string;
-                        encapsulationPublicKey: string;
-                        externalAuthority: {
-                            keyEpoch: number;
-                            keyFingerprint: string;
-                            principalId: string;
-                            principalType: "group";
-                            stateHash: string;
-                            version: number;
-                        } | null;
-                        grantCount: number;
-                        grantRoot: string;
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        memberCount: number;
-                        memberEnvelopesRoot: string;
-                        membershipMode: "projection";
-                        membershipRoot: string;
-                        payloadCiphertextHash: string;
-                        prevStateHash: string | null;
-                        principalId: string;
-                        principalType: "group" | "organization";
-                        projectionRoot: string;
-                        signature: string;
-                        signedAt: string;
-                        signerUserId: string;
-                        signerUserKeyFingerprint: string;
-                        stateHash: string;
-                        version: number;
-                    };
-                }[];
+                grant: string;
             }[];
         };
         containerId: string;