@tearleads/client-sdk 0.1.14 → 0.1.15

package/data/persistence/principalHistoryPrefixPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryPrefixPersistence.js","sourceRoot":"","sources":["principalHistoryPrefixPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YAAE,OAAO;QAC1D,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,MAAM,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC;YAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;YACxC,GAAG,EAAE,MAAM;SACZ,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EACpD,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CACvD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalHistoryPrefix =\n  typeof principalHistoryPrefixes.$inferSelect;\n\nexport async function loadPrincipalHistoryPrefix(\n  execSql: ExecSql,\n  scopeId: string,\n) {\n  await ensureSqlTables(execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [prefix] = await db\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, scopeId))\n    .limit(1);\n  return prefix ?? null;\n}\n\n/** Keep one completed prefix per principal/trust scope; older readers cannot replace it. */\nexport async function savePrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select()\n        .from(principalHistoryPrefixes)\n        .where(eq(principalHistoryPrefixes.scopeId, prefix.scopeId))\n        .limit(1);\n      if (previous && previous.version > prefix.version) return;\n      await tx\n        .insert(principalHistoryPrefixes)\n        .values(prefix)\n        .onConflictDoUpdate({\n          target: principalHistoryPrefixes.scopeId,\n          set: prefix,\n        })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** Invalid hints are disposable, but a losing reader must preserve a newer hint. */\nexport async function discardPrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      await tx\n        .delete(principalHistoryPrefixes)\n        .where(\n          and(\n            eq(principalHistoryPrefixes.scopeId, prefix.scopeId),\n            eq(principalHistoryPrefixes.progress, prefix.progress),\n          ),\n        )\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n"]}
+{"version":3,"file":"principalHistoryPrefixPersistence.js","sourceRoot":"","sources":["principalHistoryPrefixPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAKhD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IACE,QAAQ;YACR,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACjC,CAAC,CACC,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACtC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC;YAED,OAAO;QACT,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,MAAM,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC;YAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;YACxC,GAAG,EAAE,MAAM;SACZ,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EACpD,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CACvD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalHistoryPrefix =\n  typeof principalHistoryPrefixes.$inferSelect;\n\nexport async function loadPrincipalHistoryPrefix(\n  execSql: ExecSql,\n  scopeId: string,\n) {\n  await ensureSqlTables(execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [prefix] = await db\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, scopeId))\n    .limit(1);\n  return prefix ?? null;\n}\n\n/** Keep the newest prefix unless replay replaces the exact rejected candidate. */\nexport async function savePrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n  readonly rejectedPrefix?: PrincipalHistoryPrefix | null;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  const rejected = input.rejectedPrefix ? { ...input.rejectedPrefix } : null;\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select()\n        .from(principalHistoryPrefixes)\n        .where(eq(principalHistoryPrefixes.scopeId, prefix.scopeId))\n        .limit(1);\n      if (\n        previous &&\n        previous.version > prefix.version &&\n        !(\n          rejected?.scopeId === previous.scopeId &&\n          rejected.progress === previous.progress\n        )\n      )\n        return;\n      await tx\n        .insert(principalHistoryPrefixes)\n        .values(prefix)\n        .onConflictDoUpdate({\n          target: principalHistoryPrefixes.scopeId,\n          set: prefix,\n        })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** Invalid hints are disposable, but a losing reader must preserve a newer hint. */\nexport async function discardPrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      await tx\n        .delete(principalHistoryPrefixes)\n        .where(\n          and(\n            eq(principalHistoryPrefixes.scopeId, prefix.scopeId),\n            eq(principalHistoryPrefixes.progress, prefix.progress),\n          ),\n        )\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n"]}

package/data/persistence/principalHistoryStagePersistence.d.ts

@@ -0,0 +1,21 @@
+import { principalHistoryStages } from "../sqlite/principalHistoryStageSchema.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+import { type PrincipalHistoryEvidencePage } from "./principalHistoryEvidencePersistence.js";
+export type PrincipalHistoryStage = typeof principalHistoryStages.$inferSelect;
+export declare function loadPrincipalHistoryStage(execSql: ExecSql, id: string): Promise<{
+    id: string;
+    organizationId: string;
+    currentJson: string;
+    afterVersion: number;
+    complete: boolean;
+    progress: string;
+} | null>;
+/** Publish accepted entries and index nodes atomically with authenticated progress. */
+export declare function savePrincipalHistoryStage(input: {
+    readonly execSql: ExecSql;
+    readonly stage: PrincipalHistoryStage;
+    readonly evidence: PrincipalHistoryEvidencePage;
+    readonly previousProgress: string | null;
+    readonly stillCurrent: () => boolean;
+}): Promise<void>;
+export declare function discardPrincipalHistoryStage(execSql: ExecSql, stage: PrincipalHistoryStage, stillCurrent: () => boolean): Promise<void>;

package/data/principals/principalHistoryRuntime.js

@@ -0,0 +1,12 @@
+const leases = new WeakMap();
+/** Internal workflow adapters carry custody without exposing it on public views. */
+export function readPrincipalHistoryProtection(runtime) {
+    return leases.get(runtime) ?? runtime.withPrincipalHistoryProtection;
+}
+export function inheritPrincipalHistoryProtection(source, target) {
+    const lease = readPrincipalHistoryProtection(source);
+    if (lease)
+        leases.set(target, lease);
+    return target;
+}
+//# sourceMappingURL=principalHistoryRuntime.js.map

package/data/principals/principalHistoryRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryRuntime.js","sourceRoot":"","sources":["principalHistoryRuntime.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAG,IAAI,OAAO,EAA2C,CAAC;AAEtE,oFAAoF;AACpF,MAAM,UAAU,8BAA8B,CAC5C,OAIC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,8BAA8B,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAc,EACd,MAAS;IAET,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { PrincipalHistoryProtectionLease } from \"./principalHistoryProtection\";\n\nconst leases = new WeakMap<object, PrincipalHistoryProtectionLease>();\n\n/** Internal workflow adapters carry custody without exposing it on public views. */\nexport function readPrincipalHistoryProtection(\n  runtime: object & {\n    readonly withPrincipalHistoryProtection?:\n      | PrincipalHistoryProtectionLease\n      | undefined;\n  },\n) {\n  return leases.get(runtime) ?? runtime.withPrincipalHistoryProtection;\n}\n\nexport function inheritPrincipalHistoryProtection<T extends object>(\n  source: object,\n  target: T,\n): T {\n  const lease = readPrincipalHistoryProtection(source);\n  if (lease) leases.set(target, lease);\n  return target;\n}\n"]}

package/data/principals/principalHistoryStageProtection.js

@@ -1,8 +1,8 @@
 import { serializeKeyingCanonicalJson, toFingerprint, } from "../../internal/crypto/index.js";
 import { isPrincipalPolicyPageResponse } from "../../internal/validators/response/index.js";
-export function principalHistoryStageId(organizationId, head, context, retainedReferences) {
+export function principalHistoryStageId(organizationId, head, context) {
     return toFingerprint(new TextEncoder().encode(serializeKeyingCanonicalJson([
-        "tearleads.sdk.principal-history-stage.v1",
+        "tearleads.sdk.principal-history-stage.v2",
         organizationId,
         head.principalType,
         head.principalId,
@@ -11,16 +11,6 @@ export function principalHistoryStageId(organizationId, head, context, retainedR
         head.stateHash,
         head.keyFingerprint,
         context,
-        [...retainedReferences]
-            .sort((a, b) => a.version - b.version)
-            .map((reference) => [
-            reference.principalType,
-            reference.principalId,
-            reference.version,
-            reference.keyEpoch,
-            reference.stateHash,
-            reference.keyFingerprint,
-        ]),
     ])));
 }
 export async function principalHistoryStageProtection(protection, expectedHead, stage) {

package/data/principals/principalHistoryStageProtection.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryStageProtection.js","sourceRoot":"","sources":["principalHistoryStageProtection.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAG/E,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,IAA6B,EAC7B,OAAe,EACf,kBAAsD;IAEtD,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,0CAA0C;QAC1C,cAAc;QACd,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc;QACnB,OAAO;QACP,CAAC,GAAG,kBAAkB,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAClB,SAAS,CAAC,aAAa;YACvB,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,OAAO;YACjB,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,SAAS;YACnB,SAAS,CAAC,cAAc;SACzB,CAAC;KACL,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAiD,EACjD,YAAqC,EACrC,KAA8C;IAE9C,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAkE;IAElE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;KAC1E,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO;QAE/C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryStage } from \"../persistence/principalHistoryStagePersistence\";\n\nexport function principalHistoryStageId(\n  organizationId: string,\n  head: ReferencedPrincipalHead,\n  context: string,\n  retainedReferences: readonly ReferencedPrincipalHead[],\n) {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-stage.v1\",\n        organizationId,\n        head.principalType,\n        head.principalId,\n        head.version,\n        head.keyEpoch,\n        head.stateHash,\n        head.keyFingerprint,\n        context,\n        [...retainedReferences]\n          .sort((a, b) => a.version - b.version)\n          .map((reference) => [\n            reference.principalType,\n            reference.principalId,\n            reference.version,\n            reference.keyEpoch,\n            reference.stateHash,\n            reference.keyFingerprint,\n          ]),\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryStageProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  expectedHead: ReferencedPrincipalHead,\n  stage: Omit<PrincipalHistoryStage, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-stage.v1\",\n      context: protection.context,\n      id: stage.id,\n      organizationId: stage.organizationId,\n      expectedHead: { ...expectedHead },\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(stage.currentJson),\n      ),\n    }),\n  };\n}\n\nexport function parsePrincipalHistoryStageCurrent(\n  stage: Pick<PrincipalHistoryStage, \"currentJson\" | \"afterVersion\">,\n): PrincipalPolicyPageCurrent | null {\n  let current: unknown;\n  try {\n    current = JSON.parse(stage.currentJson);\n  } catch {\n    return null;\n  }\n  if (!current || typeof current !== \"object\" || Array.isArray(current))\n    return null;\n  const page = {\n    ...current,\n    previousStates: [],\n    historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },\n  };\n  if (\n    !isPrincipalPolicyPageResponse(page) ||\n    stage.afterVersion >= page.currentState.version\n  )\n    return null;\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n"]}
+{"version":3,"file":"principalHistoryStageProtection.js","sourceRoot":"","sources":["principalHistoryStageProtection.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAG/E,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,IAA6B,EAC7B,OAAe;IAEf,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,0CAA0C;QAC1C,cAAc;QACd,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc;QACnB,OAAO;KACR,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAiD,EACjD,YAAqC,EACrC,KAA8C;IAE9C,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAkE;IAElE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;KAC1E,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO;QAE/C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryStage } from \"../persistence/principalHistoryStagePersistence\";\n\nexport function principalHistoryStageId(\n  organizationId: string,\n  head: ReferencedPrincipalHead,\n  context: string,\n) {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-stage.v2\",\n        organizationId,\n        head.principalType,\n        head.principalId,\n        head.version,\n        head.keyEpoch,\n        head.stateHash,\n        head.keyFingerprint,\n        context,\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryStageProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  expectedHead: ReferencedPrincipalHead,\n  stage: Omit<PrincipalHistoryStage, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-stage.v1\",\n      context: protection.context,\n      id: stage.id,\n      organizationId: stage.organizationId,\n      expectedHead: { ...expectedHead },\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(stage.currentJson),\n      ),\n    }),\n  };\n}\n\nexport function parsePrincipalHistoryStageCurrent(\n  stage: Pick<PrincipalHistoryStage, \"currentJson\" | \"afterVersion\">,\n): PrincipalPolicyPageCurrent | null {\n  let current: unknown;\n  try {\n    current = JSON.parse(stage.currentJson);\n  } catch {\n    return null;\n  }\n  if (!current || typeof current !== \"object\" || Array.isArray(current))\n    return null;\n  const page = {\n    ...current,\n    previousStates: [],\n    historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },\n  };\n  if (\n    !isPrincipalPolicyPageResponse(page) ||\n    stage.afterVersion >= page.currentState.version\n  )\n    return null;\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n"]}

package/data/principals/principalPolicyEvidence.d.ts

@@ -1,4 +1,4 @@
-import type { AnyVerifiedPrincipalPolicy, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+import type { AnyVerifiedPrincipalPolicy, PrincipalPolicyAuthorization, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
 export type PrincipalPolicyCurrentEvidence = VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
 export type PrincipalPolicyCheckpointEvidence = AnyVerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
-export declare function principalPolicyEvidenceEntries(policy: PrincipalPolicyCheckpointEvidence): NonNullable<VerifiedPrincipalPolicy["history"]>;
+export declare function principalPolicyEvidenceEntries(policy: PrincipalPolicyAuthorization): NonNullable<VerifiedPrincipalPolicy["history"]>;

package/data/principals/principalPolicyEvidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyEvidence.js","sourceRoot":"","sources":["principalPolicyEvidence.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,8BAA8B,CAC5C,MAAyC;IAEzC,OAAO,iBAAiB,IAAI,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI;YACjB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type {\n  AnyVerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalPolicyCurrentEvidence =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\nexport type PrincipalPolicyCheckpointEvidence =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nexport function principalPolicyEvidenceEntries(\n  policy: PrincipalPolicyCheckpointEvidence,\n): NonNullable<VerifiedPrincipalPolicy[\"history\"]> {\n  return \"retainedHistory\" in policy\n    ? policy.retainedHistory\n    : (policy.history ?? [\n        {\n          state: policy.state,\n          projection: policy.projection,\n          grants: policy.grants,\n        },\n      ]);\n}\n"]}
+{"version":3,"file":"principalPolicyEvidence.js","sourceRoot":"","sources":["principalPolicyEvidence.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,8BAA8B,CAC5C,MAAoC;IAEpC,OAAO,iBAAiB,IAAI,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI;YACjB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type {\n  AnyVerifiedPrincipalPolicy,\n  PrincipalPolicyAuthorization,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalPolicyCurrentEvidence =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\nexport type PrincipalPolicyCheckpointEvidence =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nexport function principalPolicyEvidenceEntries(\n  policy: PrincipalPolicyAuthorization,\n): NonNullable<VerifiedPrincipalPolicy[\"history\"]> {\n  return \"retainedHistory\" in policy\n    ? policy.retainedHistory\n    : (policy.history ?? [\n        {\n          state: policy.state,\n          projection: policy.projection,\n          grants: policy.grants,\n        },\n      ]);\n}\n"]}

package/data/sqlite/principalHistoryEvidenceSchema.d.ts

@@ -0,0 +1,308 @@
+/** A completed, locally authenticated prefix; never an application trust pin. */
+export declare const principalHistoryPrefixes: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_prefixes";
+    schema: undefined;
+    columns: {
+        scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scope_id";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        version: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "version";
+            tableName: "principal_history_prefixes";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        headJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "head_json";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        currentJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "current_json";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        progress: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "progress";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+/** Entries are selected by their exact signed leaf, including signature bytes. */
+export declare const principalHistoryEntries: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_entries";
+    schema: undefined;
+    columns: {
+        scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scope_id";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        leafHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "leaf_hash";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        entryJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "entry_json";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+/** Untrusted proof material, checked against a locally restored private root. */
+export declare const principalHistoryNodes: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_nodes";
+    schema: undefined;
+    columns: {
+        scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scope_id";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        hash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "hash";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        leftHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "left_hash";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        rightHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "right_hash";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const principalHistoryEvidenceTables: import("./sqlTableSchema.js").SqlTableSchema[];

package/data/sqlite/principalHistoryStageSchema.d.ts

@@ -0,0 +1,119 @@
+/** Provisional, locally authenticated verification work; never an app checkpoint. */
+export declare const principalHistoryStages: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_stages";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        currentJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "current_json";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        afterVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "after_version";
+            tableName: "principal_history_stages";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        complete: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "complete";
+            tableName: "principal_history_stages";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        progress: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "progress";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const principalHistoryStageTables: import("./sqlTableSchema.js").SqlTableSchema[];

package/index.d.ts

@@ -16,8 +16,8 @@ export type { DocumentRecord, DocumentSyncContainerRekeyBuilder, DocumentSyncPul
 export { buildMaterializedDocumentCreatePlan, createDocumentProjectionUserKeyResolver, createDocumentsWorkflowRuntime, createRemoteDocument, DOCUMENT_SYNC_TRACE_FRAGMENT, DOCUMENT_SYNC_TRACE_PATTERN, DOCUMENTS_APP_KIND, DocumentRawHistoryUnavailableError, defaultDocumentsPersistence, deletePersistedDocument, isDatabaseUnavailableError, isDocumentSyncUpdateIsolationError, persistedDocumentCreateStateFromResponse, readPullContinuation, syncRemoteDocument, unwrapContainerKekPath, unwrapDocumentContentKeyTarget, validateDocumentSyncUpdateImports, } from "./workflows/documents/index.js";
 export type { OrganizationGroupPolicyHistoryEntry, OrganizationNativePurchaseEligibility, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, ReconcileOrganizationDataUsageInput, } from "./workflows/organizations/index.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, buildOrganizationGroupPolicyHistory, buildOrganizationProfileDocumentPatch, buildRosterProfileDocumentPatch, checkNativePurchaseEligibility, createInitializedRosterProfileDocument, createOrganizationGroup, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, GroupMembershipNameMismatchError, getOrganizationProfileDocumentLocalId, getRosterProfileDocumentLocalId, importOrganizationUser, loadLocalOrganizationDataUsage, loadLocalOrganizationDirectoryAndGroups, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_PROFILE_DOCUMENT_KIND, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, reconcileOrganizationDataUsage, reconcileOrganizationDirectoryAndGroups, removeOrganizationGroupUser, resolveOrganizationBillingView, revokeOrganizationContainerGrant, startOrganizationTrial, subscribeOrganizationReadModelInvalidation, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./workflows/organizations/index.js";
-export type { CacheReferencedPrincipalPoliciesOptions, RecoveredPrincipalPolicyHistory, RecoveredScopedPrincipalPolicyHistory, RecoverPrincipalPolicyHistoryOptions, RecoverScopedPrincipalPolicyHistoryOptions, } from "./workflows/principals/index.js";
-export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, recoverScopedPrincipalPolicyHistory, } from "./workflows/principals/index.js";
+export type { CacheReferencedPrincipalPoliciesOptions, PrincipalHistoryProtectionLease, ProjectionPolicyHistoryRecoveryOptions, RecoveredPrincipalPolicyHistory, RecoveredScopedPrincipalPolicyHistory, RecoverPrincipalPolicyHistoryOptions, RecoverScopedPrincipalPolicyHistoryOptions, } from "./workflows/principals/index.js";
+export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, recoverProjectionPolicyHistory, recoverScopedPrincipalPolicyHistory, } from "./workflows/principals/index.js";
 export type { InitialRootMetadataBootstrap, ProvisionedSystemContainerSpec, RegisterIdentityInput, RegistrationApi, } from "./workflows/registration/index.js";
 export { bootstrapRootContainer, buildInitialOrganizationPolicyRequest, createInitialRootMetadataBootstrap, persistRegistrationBootstrap, registerIdentity, } from "./workflows/registration/index.js";
 export type { RootIdentitiesApi, RootIdentitiesPage, RootIdentitiesQueryInput, RootIdentity, RootIdentityDetail, RootIdentityOrganization, RootIdentitySession, RootRequestOutcome, } from "./workflows/root/index.js";

package/index.js

@@ -7,7 +7,7 @@ export { createContainerContentsDocumentsRuntime, createContainerContentsProject
 export { buildMaterializedContainerRekeyPlan, buildRootContainerCreatePlan, ContainerAuthorAccessError, ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, ContainerKeyringOverrideStaleError, ContainerPathTooDeepError, classifyContainerWriteRefusal, containerWriterProjectionFromRekeyPlan, createRemoteContainer, fetchContainerKekLog, GroupShareNameMismatchError, HistoricalWrapUnavailableError, isProjectionVerificationCancelledError, moveRemoteContainer, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, rekeyRemoteContainer, revokeRemoteContainer, rootContainerWriterProjectionFromCreatePlan, shareRemoteContainer, shareRemoteContainerWithGroup, } from "./workflows/containers/index.js";
 export { buildMaterializedDocumentCreatePlan, createDocumentProjectionUserKeyResolver, createDocumentsWorkflowRuntime, createRemoteDocument, DOCUMENT_SYNC_TRACE_FRAGMENT, DOCUMENT_SYNC_TRACE_PATTERN, DOCUMENTS_APP_KIND, DocumentRawHistoryUnavailableError, defaultDocumentsPersistence, deletePersistedDocument, isDatabaseUnavailableError, isDocumentSyncUpdateIsolationError, persistedDocumentCreateStateFromResponse, readPullContinuation, syncRemoteDocument, unwrapContainerKekPath, unwrapDocumentContentKeyTarget, validateDocumentSyncUpdateImports, } from "./workflows/documents/index.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, buildOrganizationGroupPolicyHistory, buildOrganizationProfileDocumentPatch, buildRosterProfileDocumentPatch, checkNativePurchaseEligibility, createInitializedRosterProfileDocument, createOrganizationGroup, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, GroupMembershipNameMismatchError, getOrganizationProfileDocumentLocalId, getRosterProfileDocumentLocalId, importOrganizationUser, loadLocalOrganizationDataUsage, loadLocalOrganizationDirectoryAndGroups, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_PROFILE_DOCUMENT_KIND, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, reconcileOrganizationDataUsage, reconcileOrganizationDirectoryAndGroups, removeOrganizationGroupUser, resolveOrganizationBillingView, revokeOrganizationContainerGrant, startOrganizationTrial, subscribeOrganizationReadModelInvalidation, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./workflows/organizations/index.js";
-export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, recoverScopedPrincipalPolicyHistory, } from "./workflows/principals/index.js";
+export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, recoverProjectionPolicyHistory, recoverScopedPrincipalPolicyHistory, } from "./workflows/principals/index.js";
 export { bootstrapRootContainer, buildInitialOrganizationPolicyRequest, createInitialRootMetadataBootstrap, persistRegistrationBootstrap, registerIdentity, } from "./workflows/registration/index.js";
 export { listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOrganization, loadRootOrganizationDataUsage, } from "./workflows/root/index.js";
 export { clearRemoteSyncState, getDomainSyncCoordinatorSnapshot, getOrCreateDomainSyncCoordinator, hasDomainSyncCoordinatorPendingWork, requestAllDomainSyncLanes, subscribeToDomainSyncCoordinator, waitForDomainSyncCoordinatorToSettle, } from "./workflows/sync/index.js";