@tearleads/client-sdk 0.1.14 → 0.1.16

package/workflows/organizations/retainAcknowledgedPrincipalCurrents.js

@@ -0,0 +1,155 @@
+import { KeyingVerificationError, restorePrincipalPolicyHistoryVerifier, verifyPrincipalPolicyCurrent, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { persistAcknowledgedPrincipalCurrents, } from "../../data/persistence/principalCurrentAcknowledgementPersistence.js";
+import { preparePrincipalHistoryEvidencePage } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { loadPrincipalHistoryPrefix } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import { principalHistoryEvidenceScopeId, principalHistoryPrefixProtection, } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
+import { parsePrincipalHistoryStageCurrent } from "../../data/principals/principalHistoryStageProtection.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../principals/policyVerification.js";
+import { assertPrincipalHistoryVerificationMode, principalHistoryVerificationContext, } from "../principals/principalHistoryRecoveryVerification.js";
+import { assertAcknowledgedDirectoryBindings } from "./acknowledgedDirectoryBindings.js";
+import { acknowledgeGroupPolicyState } from "./groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { sealPrincipalCurrentPublication, sealPrincipalCurrentStage, } from "./principalCurrentPublicationSeal.js";
+import { assertPrincipalPolicyReceiptArtifacts } from "./principalPolicyReceiptArtifacts.js";
+async function restorePredecessor(options) {
+    const scopeId = await principalHistoryEvidenceScopeId({
+        organizationId: options.organizationId,
+        head: options.expectedHead,
+        protection: options.protection,
+    });
+    const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);
+    if (!saved || saved.organizationId !== options.organizationId)
+        throw new KeyingVerificationError("missing_dependency", "Acknowledgement requires its authenticated predecessor prefix");
+    const restored = await restorePrincipalPolicyHistoryVerifier({
+        principalId: options.expectedHead.principalId,
+        principalType: options.expectedHead.principalType,
+    }, saved.progress, await principalHistoryPrefixProtection(options.protection, saved));
+    if (!restored.ok)
+        throw restored.error;
+    const history = restored.value.finish(options.expectedHead);
+    if (!history.ok)
+        throw history.error;
+    const artifacts = parsePrincipalHistoryStageCurrent({
+        currentJson: saved.currentJson,
+        afterVersion: saved.version - 1,
+    });
+    if (!artifacts)
+        throw new KeyingVerificationError("invalid_shape", "Acknowledged predecessor artifacts are malformed");
+    const previous = await verifyPrincipalPolicyCurrent({
+        current: artifacts,
+        history: history.value,
+    });
+    if (!previous.ok)
+        throw previous.error;
+    return {
+        scopeId,
+        saved,
+        artifacts,
+        verifier: restored.value,
+        previous: previous.value,
+    };
+}
+async function preparePublication(options, request, response) {
+    options = {
+        ...options,
+        protection: {
+            ...options.protection,
+            context: principalHistoryVerificationContext(options),
+        },
+    };
+    const current = () => !options.signal?.aborted && options.stillCurrent();
+    assertProjectionVerificationCurrent(current);
+    const { scopeId, saved, artifacts, verifier, previous } = await restorePredecessor(options);
+    const expectedHead = await groupPolicyMutationHead(request);
+    assertPrincipalPolicyReceiptArtifacts({ expectedHead, request, response });
+    const keys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: { currentState: response.currentState, previousStates: [] },
+        resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,
+    });
+    assertProjectionVerificationCurrent(current);
+    if ("error" in keys)
+        throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Acknowledged principal signer could not be authenticated");
+    const externalAuthority = await options.loadExternalAuthority?.(request.state.externalAuthority ? [request.state.externalAuthority] : []);
+    assertProjectionVerificationCurrent(current);
+    const policy = await acknowledgeGroupPolicyState({
+        verifiedCurrentPolicy: previous,
+        expectedHead,
+        request,
+        response: response.currentState,
+        signerPublicKeys: keys.signerPublicKeys,
+        externalAuthority,
+        stillCurrent: current,
+    });
+    const entry = {
+        state: response.currentState,
+        projection: response.currentProjection,
+        grants: response.currentGrants,
+    };
+    assertPrincipalHistoryVerificationMode(options, [entry]);
+    const predecessorStage = await sealPrincipalCurrentStage(options, previous.state, verifier, artifacts);
+    const appended = await verifier.append({
+        entries: [entry],
+        signerPublicKeys: keys.signerPublicKeys,
+        ...(externalAuthority ? { externalAuthority } : {}),
+    });
+    if (!appended.ok)
+        throw appended.error;
+    const sealed = await sealPrincipalCurrentPublication(options, scopeId, expectedHead, verifier, response);
+    assertProjectionVerificationCurrent(current);
+    return {
+        policy,
+        previousPrefixProgress: saved.progress,
+        predecessorStage,
+        ...sealed,
+        evidence: await preparePrincipalHistoryEvidencePage({
+            scopeId,
+            organizationId: options.organizationId,
+            entries: [entry],
+            nodes: appended.value.indexNodes,
+        }),
+    };
+}
+/** Extend authenticated local progress and retain exact acknowledged artifacts atomically with pins. */
+export async function retainAcknowledgedPrincipalCurrents(input) {
+    const execSql = input.execSql;
+    const organizationId = input.organizationId;
+    const stillCurrent = input.stillCurrent;
+    const retirements = structuredClone(input.retirements ?? []);
+    const entries = [];
+    try {
+        assertProjectionVerificationCurrent(stillCurrent);
+        for (const entry of input.entries)
+            entries.push({
+                request: structuredClone(entry.request),
+                response: structuredClone(entry.response),
+                options: {
+                    ...entry.recovery,
+                    expectedHead: structuredClone(entry.recovery.expectedHead),
+                    protection: ownPrincipalHistoryProtection(entry.recovery.protection),
+                    execSql,
+                    organizationId,
+                    stillCurrent,
+                },
+            });
+        const publications = [];
+        for (const entry of entries)
+            publications.push(await preparePublication(entry.options, entry.request, entry.response));
+        assertAcknowledgedDirectoryBindings(organizationId, entries.map(({ response }) => response));
+        await persistAcknowledgedPrincipalCurrents({
+            execSql,
+            organizationId,
+            entries: publications,
+            retirements,
+            stillCurrent: () => stillCurrent() &&
+                entries.every((entry) => !entry.options.signal?.aborted),
+        });
+        return publications.map(({ policy }) => policy);
+    }
+    finally {
+        for (const entry of entries)
+            entry.options.protection.localKey.fill(0);
+    }
+}
+//# sourceMappingURL=retainAcknowledgedPrincipalCurrents.js.map

package/workflows/organizations/retainAcknowledgedPrincipalCurrents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainAcknowledgedPrincipalCurrents.js","sourceRoot":"","sources":["retainAcknowledgedPrincipalCurrents.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qCAAqC,EAErC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAGL,oCAAoC,GACrC,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,0DAA0D,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAE1G,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAE1F,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAc1F,KAAK,UAAU,kBAAkB,CAC/B,OAA6C;IAE7C,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D;QACE,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;QAC7C,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;KAClD,EACD,KAAK,CAAC,QAAQ,EACd,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAClE,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,SAAS,GAAG,iCAAiC,CAAC;QAClD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS;QACZ,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;QAClD,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,OAAO,CAAC,KAAK;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO;QACL,OAAO;QACP,KAAK;QACL,SAAS;QACT,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,QAAQ,EAAE,QAAQ,CAAC,KAAK;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAA6C,EAC7C,OAAkC,EAClC,QAAyC;IAEzC,OAAO,GAAG;QACR,GAAG,OAAO;QACV,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,UAAU;YACrB,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;SACtD;KACF,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GACrD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC5D,qCAAqC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QACnE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;KAC/D,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,0DAA0D,CAC3D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAC7D,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,qBAAqB,EAAE,QAAQ;QAC/B,YAAY;QACZ,OAAO;QACP,QAAQ,EAAE,QAAQ,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,iBAAiB;QACjB,YAAY,EAAE,OAAO;KACtB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,YAAY;QAC5B,UAAU,EAAE,QAAQ,CAAC,iBAAiB;QACtC,MAAM,EAAE,QAAQ,CAAC,aAAa;KAC/B,CAAC;IACF,sCAAsC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,MAAM,yBAAyB,CACtD,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,QAAQ,EACR,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACrC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAClD,OAAO,EACP,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,QAAQ;QACtC,gBAAgB;QAChB,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAQzD;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,OAAO,GAIP,EAAE,CAAC;IACT,IAAI,CAAC;QACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;gBACvC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzC,OAAO,EAAE;oBACP,GAAG,KAAK,CAAC,QAAQ;oBACjB,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC1D,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACpE,OAAO;oBACP,cAAc;oBACd,YAAY;iBACb;aACF,CAAC,CAAC;QACL,MAAM,YAAY,GAA8C,EAAE,CAAC;QACnE,KAAK,MAAM,KAAK,IAAI,OAAO;YACzB,YAAY,CAAC,IAAI,CACf,MAAM,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CACvE,CAAC;QACJ,mCAAmC,CACjC,cAAc,EACd,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,oCAAoC,CAAC;YACzC,OAAO;YACP,cAAc;YACd,OAAO,EAAE,YAAY;YACrB,WAAW;YACX,YAAY,EAAE,GAAG,EAAE,CACjB,YAAY,EAAE;gBACd,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  restorePrincipalPolicyHistoryVerifier,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport {\n  type AcknowledgedPrincipalCurrentPublication,\n  type AcknowledgedPrincipalCurrentRetirement,\n  persistAcknowledgedPrincipalCurrents,\n} from \"../../data/persistence/principalCurrentAcknowledgementPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { loadPrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport {\n  principalHistoryEvidenceScopeId,\n  principalHistoryPrefixProtection,\n} from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { parsePrincipalHistoryStageCurrent } from \"../../data/principals/principalHistoryStageProtection\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"../principals/principalHistoryRecoveryTypes\";\nimport {\n  assertPrincipalHistoryVerificationMode,\n  principalHistoryVerificationContext,\n} from \"../principals/principalHistoryRecoveryVerification\";\nimport { assertAcknowledgedDirectoryBindings } from \"./acknowledgedDirectoryBindings\";\nimport { acknowledgeGroupPolicyState } from \"./groupPolicyMutationAcknowledgement\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  sealPrincipalCurrentPublication,\n  sealPrincipalCurrentStage,\n} from \"./principalCurrentPublicationSeal\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"./principalPolicyReceiptArtifacts\";\n\nexport type { AcknowledgedPrincipalCurrentRetirement } from \"../../data/persistence/principalCurrentAcknowledgementPersistence\";\n\nexport interface AcknowledgedPrincipalCurrentInput {\n  /** The same scoped protection and verification mode used to recover the predecessor. */\n  readonly recovery: Omit<\n    RecoverPrincipalPolicyHistoryOptions,\n    \"execSql\" | \"organizationId\" | \"stillCurrent\"\n  >;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly response: PrincipalPolicyMutationResponse;\n}\n\nasync function restorePredecessor(\n  options: RecoverPrincipalPolicyHistoryOptions,\n) {\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: options.organizationId,\n    head: options.expectedHead,\n    protection: options.protection,\n  });\n  const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);\n  if (!saved || saved.organizationId !== options.organizationId)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Acknowledgement requires its authenticated predecessor prefix\",\n    );\n  const restored = await restorePrincipalPolicyHistoryVerifier(\n    {\n      principalId: options.expectedHead.principalId,\n      principalType: options.expectedHead.principalType,\n    },\n    saved.progress,\n    await principalHistoryPrefixProtection(options.protection, saved),\n  );\n  if (!restored.ok) throw restored.error;\n  const history = restored.value.finish(options.expectedHead);\n  if (!history.ok) throw history.error;\n  const artifacts = parsePrincipalHistoryStageCurrent({\n    currentJson: saved.currentJson,\n    afterVersion: saved.version - 1,\n  });\n  if (!artifacts)\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Acknowledged predecessor artifacts are malformed\",\n    );\n  const previous = await verifyPrincipalPolicyCurrent({\n    current: artifacts,\n    history: history.value,\n  });\n  if (!previous.ok) throw previous.error;\n  return {\n    scopeId,\n    saved,\n    artifacts,\n    verifier: restored.value,\n    previous: previous.value,\n  };\n}\n\nasync function preparePublication(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  request: PutPrincipalPolicyRequest,\n  response: PrincipalPolicyMutationResponse,\n): Promise<AcknowledgedPrincipalCurrentPublication> {\n  options = {\n    ...options,\n    protection: {\n      ...options.protection,\n      context: principalHistoryVerificationContext(options),\n    },\n  };\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const { scopeId, saved, artifacts, verifier, previous } =\n    await restorePredecessor(options);\n  const expectedHead = await groupPolicyMutationHead(request);\n  assertPrincipalPolicyReceiptArtifacts({ expectedHead, request, response });\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: { currentState: response.currentState, previousStates: [] },\n    resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,\n  });\n  assertProjectionVerificationCurrent(current);\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Acknowledged principal signer could not be authenticated\",\n    );\n  const externalAuthority = await options.loadExternalAuthority?.(\n    request.state.externalAuthority ? [request.state.externalAuthority] : [],\n  );\n  assertProjectionVerificationCurrent(current);\n  const policy = await acknowledgeGroupPolicyState({\n    verifiedCurrentPolicy: previous,\n    expectedHead,\n    request,\n    response: response.currentState,\n    signerPublicKeys: keys.signerPublicKeys,\n    externalAuthority,\n    stillCurrent: current,\n  });\n  const entry = {\n    state: response.currentState,\n    projection: response.currentProjection,\n    grants: response.currentGrants,\n  };\n  assertPrincipalHistoryVerificationMode(options, [entry]);\n  const predecessorStage = await sealPrincipalCurrentStage(\n    options,\n    previous.state,\n    verifier,\n    artifacts,\n  );\n  const appended = await verifier.append({\n    entries: [entry],\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) throw appended.error;\n  const sealed = await sealPrincipalCurrentPublication(\n    options,\n    scopeId,\n    expectedHead,\n    verifier,\n    response,\n  );\n  assertProjectionVerificationCurrent(current);\n  return {\n    policy,\n    previousPrefixProgress: saved.progress,\n    predecessorStage,\n    ...sealed,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      scopeId,\n      organizationId: options.organizationId,\n      entries: [entry],\n      nodes: appended.value.indexNodes,\n    }),\n  };\n}\n\n/** Extend authenticated local progress and retain exact acknowledged artifacts atomically with pins. */\nexport async function retainAcknowledgedPrincipalCurrents(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly entries: readonly AcknowledgedPrincipalCurrentInput[];\n  readonly retirements?:\n    | readonly AcknowledgedPrincipalCurrentRetirement[]\n    | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<VerifiedPrincipalPolicyCurrent[]> {\n  const execSql = input.execSql;\n  const organizationId = input.organizationId;\n  const stillCurrent = input.stillCurrent;\n  const retirements = structuredClone(input.retirements ?? []);\n  const entries: {\n    request: PutPrincipalPolicyRequest;\n    response: PrincipalPolicyMutationResponse;\n    options: RecoverPrincipalPolicyHistoryOptions;\n  }[] = [];\n  try {\n    assertProjectionVerificationCurrent(stillCurrent);\n    for (const entry of input.entries)\n      entries.push({\n        request: structuredClone(entry.request),\n        response: structuredClone(entry.response),\n        options: {\n          ...entry.recovery,\n          expectedHead: structuredClone(entry.recovery.expectedHead),\n          protection: ownPrincipalHistoryProtection(entry.recovery.protection),\n          execSql,\n          organizationId,\n          stillCurrent,\n        },\n      });\n    const publications: AcknowledgedPrincipalCurrentPublication[] = [];\n    for (const entry of entries)\n      publications.push(\n        await preparePublication(entry.options, entry.request, entry.response),\n      );\n    assertAcknowledgedDirectoryBindings(\n      organizationId,\n      entries.map(({ response }) => response),\n    );\n    await persistAcknowledgedPrincipalCurrents({\n      execSql,\n      organizationId,\n      entries: publications,\n      retirements,\n      stillCurrent: () =>\n        stillCurrent() &&\n        entries.every((entry) => !entry.options.signal?.aborted),\n    });\n    return publications.map(({ policy }) => policy);\n  } finally {\n    for (const entry of entries) entry.options.protection.localKey.fill(0);\n  }\n}\n"]}

package/workflows/principals/index.d.ts

@@ -1,4 +1,6 @@
+export type { PrincipalHistoryProtectionLease } from "../../data/principals/principalHistoryProtection.js";
 export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
 export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./principalHistoryRecoveryTypes.js";
 export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+export { type ProjectionPolicyHistoryRecoveryOptions, recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
 export { type RecoveredScopedPrincipalPolicyHistory, type RecoverScopedPrincipalPolicyHistoryOptions, recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";

package/workflows/principals/index.js

@@ -1,5 +1,6 @@
 export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
 export { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
 export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+export { recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
 export { recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
 //# sourceMappingURL=index.js.map

package/workflows/principals/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC","sourcesContent":["export {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\nexport {\n  type RecoveredScopedPrincipalPolicyHistory,\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC","sourcesContent":["export type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nexport {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\nexport {\n  type ProjectionPolicyHistoryRecoveryOptions,\n  recoverProjectionPolicyHistory,\n} from \"./recoverProjectionPolicyHistory\";\nexport {\n  type RecoveredScopedPrincipalPolicyHistory,\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n"]}

package/workflows/principals/policyVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyVerification.js","sourceRoot":"","sources":["policyVerification.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAMxC,MAAM,UAAU,qBAAqB,CACnC,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,MAAM,CAAC,YAAY;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAGvB;IACC,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IAIC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACtD,KAAK,CAAC,KAAK,CAAC,YAAY,CACzB,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,IACE,SAAS,CAAC,qBAAqB,KAAK,KAAK,CAAC,KAAK,CAAC,wBAAwB,EACxE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,eAAe,EAAE;YACf,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC3D,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAG5D;IAIC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,wBAAwB;SACnD,CAAC,CAAC;QACH,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,0BAA0B,CAAC;YAC7D,0BAA0B;YAC1B,KAAK;SACN,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicySignerPublicKey } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\n\nexport type PrincipalPolicySignerPublicKeyLoadErrorCode =\n  | \"fingerprint-mismatch\"\n  | \"not-found\";\n\nexport function principalPolicyStates(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"currentState\"][] {\n  return [\n    ...bundle.previousStates.map((entry) => entry.state),\n    bundle.currentState,\n  ];\n}\n\nfunction signerCacheKey(input: {\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n}): string {\n  return `${input.signerUserId}:${input.signingFingerprint}`;\n}\n\nasync function loadTrustedSignerPublicKey(input: {\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly state: PrincipalPolicyBundleResponse[\"currentState\"];\n}): Promise<\n  | { readonly signerPublicKey: PrincipalPolicySignerPublicKey }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const signerKey = await input.resolveTrustedUserIdentity(\n    input.state.signerUserId,\n  );\n\n  if (!signerKey) {\n    return { error: \"not-found\" };\n  }\n\n  if (\n    signerKey.signingKeyFingerprint !== input.state.signerUserKeyFingerprint\n  ) {\n    return { error: \"fingerprint-mismatch\" };\n  }\n\n  return {\n    signerPublicKey: {\n      userId: input.state.signerUserId,\n      signingKeyFingerprint: input.state.signerUserKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    },\n  };\n}\n\nexport async function collectPrincipalPolicySignerPublicKeys(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<\n  | { readonly signerPublicKeys: PrincipalPolicySignerPublicKey[] }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyStates(input.bundle)) {\n    const cacheKey = signerCacheKey({\n      signerUserId: state.signerUserId,\n      signingFingerprint: state.signerUserKeyFingerprint,\n    });\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const remoteSignerPublicKey = await loadTrustedSignerPublicKey({\n      resolveTrustedUserIdentity,\n      state,\n    });\n    if (\"error\" in remoteSignerPublicKey) {\n      return { error: remoteSignerPublicKey.error };\n    }\n\n    signerPublicKeysByKey.set(cacheKey, remoteSignerPublicKey.signerPublicKey);\n  }\n\n  return {\n    signerPublicKeys: Array.from(signerPublicKeysByKey.values()),\n  };\n}\n"]}
+{"version":3,"file":"policyVerification.js","sourceRoot":"","sources":["policyVerification.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAMxC,MAAM,UAAU,qBAAqB,CACnC,MAGC;IAED,OAAO;QACL,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,MAAM,CAAC,YAAY;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAGvB;IACC,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IAIC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACtD,KAAK,CAAC,KAAK,CAAC,YAAY,CACzB,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,IACE,SAAS,CAAC,qBAAqB,KAAK,KAAK,CAAC,KAAK,CAAC,wBAAwB,EACxE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,eAAe,EAAE;YACf,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC3D,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAM5D;IAIC,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,wBAAwB;SACnD,CAAC,CAAC;QACH,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,0BAA0B,CAAC;YAC7D,0BAA0B;YAC1B,KAAK;SACN,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicySignerPublicKey } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\n\nexport type PrincipalPolicySignerPublicKeyLoadErrorCode =\n  | \"fingerprint-mismatch\"\n  | \"not-found\";\n\nexport function principalPolicyStates(\n  bundle: Pick<\n    PrincipalPolicyBundleResponse,\n    \"currentState\" | \"previousStates\"\n  >,\n): PrincipalPolicyBundleResponse[\"currentState\"][] {\n  return [\n    ...bundle.previousStates.map((entry) => entry.state),\n    bundle.currentState,\n  ];\n}\n\nfunction signerCacheKey(input: {\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n}): string {\n  return `${input.signerUserId}:${input.signingFingerprint}`;\n}\n\nasync function loadTrustedSignerPublicKey(input: {\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly state: PrincipalPolicyBundleResponse[\"currentState\"];\n}): Promise<\n  | { readonly signerPublicKey: PrincipalPolicySignerPublicKey }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const signerKey = await input.resolveTrustedUserIdentity(\n    input.state.signerUserId,\n  );\n\n  if (!signerKey) {\n    return { error: \"not-found\" };\n  }\n\n  if (\n    signerKey.signingKeyFingerprint !== input.state.signerUserKeyFingerprint\n  ) {\n    return { error: \"fingerprint-mismatch\" };\n  }\n\n  return {\n    signerPublicKey: {\n      userId: input.state.signerUserId,\n      signingKeyFingerprint: input.state.signerUserKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    },\n  };\n}\n\nexport async function collectPrincipalPolicySignerPublicKeys(input: {\n  readonly bundle: Pick<\n    PrincipalPolicyBundleResponse,\n    \"currentState\" | \"previousStates\"\n  >;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<\n  | { readonly signerPublicKeys: PrincipalPolicySignerPublicKey[] }\n  | { readonly error: PrincipalPolicySignerPublicKeyLoadErrorCode }\n> {\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyStates(input.bundle)) {\n    const cacheKey = signerCacheKey({\n      signerUserId: state.signerUserId,\n      signingFingerprint: state.signerUserKeyFingerprint,\n    });\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const remoteSignerPublicKey = await loadTrustedSignerPublicKey({\n      resolveTrustedUserIdentity,\n      state,\n    });\n    if (\"error\" in remoteSignerPublicKey) {\n      return { error: remoteSignerPublicKey.error };\n    }\n\n    signerPublicKeysByKey.set(cacheKey, remoteSignerPublicKey.signerPublicKey);\n  }\n\n  return {\n    signerPublicKeys: Array.from(signerPublicKeysByKey.values()),\n  };\n}\n"]}

package/workflows/principals/principalCurrentRecoveryBatch.js

@@ -0,0 +1,14 @@
+import { recoverCurrentOrganizationPolicy } from "./recoverCurrentOrganizationPolicy.js";
+import { createScopedPrincipalPolicyHistoryBatch } from "./recoverScopedPrincipalPolicyHistory.js";
+/** Discovery and selected references share one authenticated collection view. */
+export function createPrincipalCurrentRecoveryBatch() {
+    const memo = {
+        directories: new Map(),
+        admins: new Map(),
+    };
+    return {
+        recover: createScopedPrincipalPolicyHistoryBatch(memo),
+        discover: (input) => recoverCurrentOrganizationPolicy(input, memo),
+    };
+}
+//# sourceMappingURL=principalCurrentRecoveryBatch.js.map

package/workflows/principals/principalCurrentRecoveryBatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalCurrentRecoveryBatch.js","sourceRoot":"","sources":["principalCurrentRecoveryBatch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAEhG,iFAAiF;AACjF,MAAM,UAAU,mCAAmC;IACjD,MAAM,IAAI,GAA0B;QAClC,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,MAAM,EAAE,IAAI,GAAG,EAAE;KAClB,CAAC;IACF,OAAO;QACL,OAAO,EAAE,uCAAuC,CAAC,IAAI,CAAC;QACtD,QAAQ,EAAE,CAAC,KAA+B,EAAE,EAAE,CAC5C,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC;KAChD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalRecoveryContext } from \"./principalRecoveryDirectory\";\nimport type { PrincipalRecoveryMemo } from \"./principalRecoveryMemo\";\nimport { recoverCurrentOrganizationPolicy } from \"./recoverCurrentOrganizationPolicy\";\nimport { createScopedPrincipalPolicyHistoryBatch } from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Discovery and selected references share one authenticated collection view. */\nexport function createPrincipalCurrentRecoveryBatch() {\n  const memo: PrincipalRecoveryMemo = {\n    directories: new Map(),\n    admins: new Map(),\n  };\n  return {\n    recover: createScopedPrincipalPolicyHistoryBatch(memo),\n    discover: (input: PrincipalRecoveryContext) =>\n      recoverCurrentOrganizationPolicy(input, memo),\n  };\n}\n"]}

package/workflows/principals/principalHistoryRecoveryAuthority.js

@@ -0,0 +1,20 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+/** Reusable signatures remain conditional on their authenticated authority lineage. */
+export async function validatePrincipalHistoryRecoveryAuthority(input, verifier) {
+    const reference = verifier.getExternalAuthorityReference();
+    if (!reference)
+        return;
+    try {
+        const authority = await input.loadExternalAuthority?.([reference]);
+        if (!authority?.states.some(({ head }) => principalHeadMatchesReference(head, reference)))
+            throw new KeyingVerificationError("stale_predecessor", "Cached principal history has a different authority lineage");
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw new PrincipalHistoryEvidenceUnavailableError(error);
+        throw error;
+    }
+}
+//# sourceMappingURL=principalHistoryRecoveryAuthority.js.map

package/workflows/principals/principalHistoryRecoveryAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryRecoveryAuthority.js","sourceRoot":"","sources":["principalHistoryRecoveryAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAGhG,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAA2C,EAC3C,QAAwC;IAExC,MAAM,SAAS,GAAG,QAAQ,CAAC,6BAA6B,EAAE,CAAC;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,IACE,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/C;YAED,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,CAC7D,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\n/** Reusable signatures remain conditional on their authenticated authority lineage. */\nexport async function validatePrincipalHistoryRecoveryAuthority(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  verifier: PrincipalPolicyHistoryVerifier,\n): Promise<void> {\n  const reference = verifier.getExternalAuthorityReference();\n  if (!reference) return;\n  try {\n    const authority = await input.loadExternalAuthority?.([reference]);\n    if (\n      !authority?.states.some(({ head }) =>\n        principalHeadMatchesReference(head, reference),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"stale_predecessor\",\n        \"Cached principal history has a different authority lineage\",\n      );\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n}\n"]}

package/workflows/principals/principalHistoryRecoveryStage.js

@@ -9,7 +9,7 @@ export async function restorePrincipalHistoryRecoveryStage(input, historyInput,
         head: input.expectedHead,
         protection: input.protection,
     });
-    const id = await principalHistoryStageId(input.organizationId, input.expectedHead, input.protection.context, input.retainedReferences ?? []);
+    const id = await principalHistoryStageId(input.organizationId, input.expectedHead, input.protection.context);
     const saved = await loadPrincipalHistoryStage(input.execSql, id);
     if (saved) {
         const current = parsePrincipalHistoryStageCurrent(saved);

package/workflows/principals/principalHistoryRecoveryStage.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryStage.js","sourceRoot":"","sources":["principalHistoryRecoveryStage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EAGpC,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AAczF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA2C,EAC3C,YAAyC,EACzC,iBAAiB,GAAG,IAAI;IAExB,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CAAC,OAAO,EACxB,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,KAAK,CACN,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE;gBACb,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,mBAAmB,EAAE,KAAK,CAAC,YAAY;oBACvC,SAAS,EAAE,IAAI;iBAChB,CAAC;QACN,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,KAAK,EACL,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB;QAC9B,CAAC,CAAC,MAAM,qCAAqC,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;QAC/D,OAAO;YACL,EAAE;YACF,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzC,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,mBAAmB,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;QACf,mBAAmB,EAAE,CAAC;QACtB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n  type PrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  parsePrincipalHistoryStageCurrent,\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport { restoreReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport interface PrincipalHistoryRecoveryStage {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly initialAfterVersion: number;\n  readonly fromCache: boolean;\n  complete: boolean;\n  current: PrincipalPolicyPageCurrent | null;\n  saved: PrincipalHistoryStage | null;\n}\n\nexport async function restorePrincipalHistoryRecoveryStage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  historyInput: PrincipalPolicyHistoryInput,\n  useReusablePrefix = true,\n): Promise<PrincipalHistoryRecoveryStage> {\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head: input.expectedHead,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    input.expectedHead,\n    input.protection.context,\n    input.retainedReferences ?? [],\n  );\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const current = parsePrincipalHistoryStageCurrent(saved);\n    if (current && saved.organizationId === input.organizationId) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(\n          input.protection,\n          input.expectedHead,\n          saved,\n        ),\n      );\n      if (restored.ok)\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          current,\n          saved,\n          complete: saved.complete,\n          initialAfterVersion: saved.afterVersion,\n          fromCache: true,\n        };\n    }\n    // Saved bytes are a disposable hint. Only a locally authenticated restore\n    // can skip signed history; missing keys or changed inputs replay genesis.\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      saved,\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n  }\n  const prefix = useReusablePrefix\n    ? await restoreReusablePrincipalHistoryPrefix(input, historyInput, scopeId)\n    : null;\n  if (prefix) {\n    const complete = prefix.version === input.expectedHead.version;\n    return {\n      id,\n      scopeId,\n      verifier: prefix.verifier,\n      current: complete ? prefix.current : null,\n      saved: null,\n      complete,\n      initialAfterVersion: prefix.version - (complete ? 1 : 0),\n      fromCache: true,\n    };\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    current: null,\n    saved: null,\n    complete: false,\n    initialAfterVersion: 0,\n    fromCache: false,\n  };\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryStage.js","sourceRoot":"","sources":["principalHistoryRecoveryStage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EAGpC,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AAczF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA2C,EAC3C,YAAyC,EACzC,iBAAiB,GAAG,IAAI;IAExB,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,KAAK,CACN,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE;gBACb,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,mBAAmB,EAAE,KAAK,CAAC,YAAY;oBACvC,SAAS,EAAE,IAAI;iBAChB,CAAC;QACN,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,KAAK,EACL,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB;QAC9B,CAAC,CAAC,MAAM,qCAAqC,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;QAC/D,OAAO;YACL,EAAE;YACF,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzC,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,mBAAmB,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;QACf,mBAAmB,EAAE,CAAC;QACtB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n  type PrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  parsePrincipalHistoryStageCurrent,\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport { restoreReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport interface PrincipalHistoryRecoveryStage {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly initialAfterVersion: number;\n  readonly fromCache: boolean;\n  complete: boolean;\n  current: PrincipalPolicyPageCurrent | null;\n  saved: PrincipalHistoryStage | null;\n}\n\nexport async function restorePrincipalHistoryRecoveryStage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  historyInput: PrincipalPolicyHistoryInput,\n  useReusablePrefix = true,\n): Promise<PrincipalHistoryRecoveryStage> {\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head: input.expectedHead,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    input.expectedHead,\n    input.protection.context,\n  );\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const current = parsePrincipalHistoryStageCurrent(saved);\n    if (current && saved.organizationId === input.organizationId) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(\n          input.protection,\n          input.expectedHead,\n          saved,\n        ),\n      );\n      if (restored.ok)\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          current,\n          saved,\n          complete: saved.complete,\n          initialAfterVersion: saved.afterVersion,\n          fromCache: true,\n        };\n    }\n    // Saved bytes are a disposable hint. Only a locally authenticated restore\n    // can skip signed history; missing keys or changed inputs replay genesis.\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      saved,\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n  }\n  const prefix = useReusablePrefix\n    ? await restoreReusablePrincipalHistoryPrefix(input, historyInput, scopeId)\n    : null;\n  if (prefix) {\n    const complete = prefix.version === input.expectedHead.version;\n    return {\n      id,\n      scopeId,\n      verifier: prefix.verifier,\n      current: complete ? prefix.current : null,\n      saved: null,\n      complete,\n      initialAfterVersion: prefix.version - (complete ? 1 : 0),\n      fromCache: true,\n    };\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    current: null,\n    saved: null,\n    complete: false,\n    initialAfterVersion: 0,\n    fromCache: false,\n  };\n}\n"]}

package/workflows/principals/principalHistoryRecoveryTypes.d.ts

@@ -1,5 +1,5 @@
 import type { ApiClient, PrincipalPolicyPageCurrent, RequestFailure } from "../../internal/api-client/index.js";
-import { KeyingVerificationError, type PrincipalPolicyExternalAuthority, type PrincipalPolicyHistoryProgressOptions, type PrincipalPolicyStateChainEntry, type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, type PrincipalPolicyExternalAuthority, type PrincipalPolicyHistoryProgressOptions, type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
 /** A locally observed race, distinct from a rejected signed predecessor. */
@@ -19,8 +19,8 @@ export interface RecoverPrincipalPolicyHistoryOptions {
     /** Strict Admins mode checks every historical projection in a separate cache scope. */
     readonly historyVerification?: "standard" | "direct-admins" | undefined;
     readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    /** Return only authority already authenticated by this client. */
-    readonly loadExternalAuthority?: ((entries: readonly PrincipalPolicyStateChainEntry[]) => Promise<PrincipalPolicyExternalAuthority | undefined>) | undefined;
+    /** Authenticate these exact authority references, including cached-prefix citations. */
+    readonly loadExternalAuthority?: ((references: readonly ReferencedPrincipalHead[]) => Promise<PrincipalPolicyExternalAuthority | undefined>) | undefined;
     readonly stillCurrent: () => boolean;
     readonly signal?: AbortSignal | undefined;
 }

package/workflows/principals/principalHistoryRecoveryTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryTypes.js","sourceRoot":"","sources":["principalHistoryRecoveryTypes.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uBAAuB,GAMxB,MAAM,mBAAmB,CAAC;AAI3B,4EAA4E;AAC5E,MAAM,OAAO,iCAAkC,SAAQ,uBAAuB;IAC5E,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AA8BD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAArB,YAAqB,OAAuB;QAC1C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QADJ,YAAO,GAAP,OAAO,CAAgB;QAE1C,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF","sourcesContent":["import type {\n  ApiClient,\n  PrincipalPolicyPageCurrent,\n  RequestFailure,\n} from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicyHistoryProgressOptions,\n  type PrincipalPolicyStateChainEntry,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\n/** A locally observed race, distinct from a rejected signed predecessor. */\nexport class PrincipalHistoryRecoveryRaceError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"stale_predecessor\", message);\n  }\n}\n\nexport interface RecoverPrincipalPolicyHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getPrincipalPolicyPages\">;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly expectedHead: ReferencedPrincipalHead;\n  /** Only use locally authenticated completed evidence; never perform HTTP. */\n  readonly offline?: boolean | undefined;\n  /** Device-controlled key and stable identity/trust-policy context, never supplied by the API. */\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly retainedReferences?: readonly ReferencedPrincipalHead[] | undefined;\n  /** Strict Admins mode checks every historical projection in a separate cache scope. */\n  readonly historyVerification?: \"standard\" | \"direct-admins\" | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  /** Return only authority already authenticated by this client. */\n  readonly loadExternalAuthority?:\n    | ((\n        entries: readonly PrincipalPolicyStateChainEntry[],\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n}\n\nexport interface RecoveredPrincipalPolicyHistory {\n  readonly current: PrincipalPolicyPageCurrent;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n}\n\nexport class PrincipalPolicyHistoryReadError extends Error {\n  constructor(readonly failure: RequestFailure) {\n    super(failure.message);\n    this.name = \"PrincipalPolicyHistoryReadError\";\n  }\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryTypes.js","sourceRoot":"","sources":["principalHistoryRecoveryTypes.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uBAAuB,GAKxB,MAAM,mBAAmB,CAAC;AAI3B,4EAA4E;AAC5E,MAAM,OAAO,iCAAkC,SAAQ,uBAAuB;IAC5E,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AA8BD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAArB,YAAqB,OAAuB;QAC1C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QADJ,YAAO,GAAP,OAAO,CAAgB;QAE1C,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF","sourcesContent":["import type {\n  ApiClient,\n  PrincipalPolicyPageCurrent,\n  RequestFailure,\n} from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\n/** A locally observed race, distinct from a rejected signed predecessor. */\nexport class PrincipalHistoryRecoveryRaceError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"stale_predecessor\", message);\n  }\n}\n\nexport interface RecoverPrincipalPolicyHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getPrincipalPolicyPages\">;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly expectedHead: ReferencedPrincipalHead;\n  /** Only use locally authenticated completed evidence; never perform HTTP. */\n  readonly offline?: boolean | undefined;\n  /** Device-controlled key and stable identity/trust-policy context, never supplied by the API. */\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly retainedReferences?: readonly ReferencedPrincipalHead[] | undefined;\n  /** Strict Admins mode checks every historical projection in a separate cache scope. */\n  readonly historyVerification?: \"standard\" | \"direct-admins\" | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  /** Authenticate these exact authority references, including cached-prefix citations. */\n  readonly loadExternalAuthority?:\n    | ((\n        references: readonly ReferencedPrincipalHead[],\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n}\n\nexport interface RecoveredPrincipalPolicyHistory {\n  readonly current: PrincipalPolicyPageCurrent;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n}\n\nexport class PrincipalPolicyHistoryReadError extends Error {\n  constructor(readonly failure: RequestFailure) {\n    super(failure.message);\n    this.name = \"PrincipalPolicyHistoryReadError\";\n  }\n}\n"]}

package/workflows/principals/principalHistoryRecoveryVerification.js

@@ -4,7 +4,12 @@ export function principalHistoryVerificationContext(input) {
     if (mode !== "standard" && mode !== "direct-admins")
         throw new KeyingVerificationError("invalid_shape", "Unknown principal history verification mode");
     if (mode === "standard")
-        return input.protection.context;
+        return input.loadExternalAuthority
+            ? serializeKeyingCanonicalJson([
+                "tearleads.sdk.principal-history.external-authority.v1",
+                input.protection.context,
+            ])
+            : input.protection.context;
     if (input.expectedHead.principalType !== "group" ||
         input.loadExternalAuthority)
         throw new KeyingVerificationError("invalid_shape", "Strict Admins history requires a group without external authority fallback");

package/workflows/principals/principalHistoryRecoveryVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryVerification.js","sourceRoot":"","sources":["principalHistoryRecoveryVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,mCAAmC,CACjD,KAA2C;IAE3C,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB,IAAI,UAAU,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,eAAe;QACjD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6CAA6C,CAC9C,CAAC;IACJ,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;IACzD,IACE,KAAK,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC5C,KAAK,CAAC,qBAAqB;QAE3B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4EAA4E,CAC7E,CAAC;IACJ,2EAA2E;IAC3E,OAAO,4BAA4B,CAAC;QAClC,kDAAkD;QAClD,KAAK,CAAC,UAAU,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAA2C,EAC3C,OAAkD;IAElD,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe;QAAE,OAAO;IAC1D,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport function principalHistoryVerificationContext(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): string {\n  const mode = input.historyVerification ?? \"standard\";\n  if (mode !== \"standard\" && mode !== \"direct-admins\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Unknown principal history verification mode\",\n    );\n  if (mode === \"standard\") return input.protection.context;\n  if (\n    input.expectedHead.principalType !== \"group\" ||\n    input.loadExternalAuthority\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Strict Admins history requires a group without external authority fallback\",\n    );\n  // Retire this local attestation domain whenever strict validation changes.\n  return serializeKeyingCanonicalJson([\n    \"tearleads.sdk.principal-history.direct-admins.v1\",\n    input.protection.context,\n  ]);\n}\n\nexport function assertPrincipalHistoryVerificationMode(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (input.historyVerification !== \"direct-admins\") return;\n  if (\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Reserved Admins history must contain only direct admin users\",\n    );\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryVerification.js","sourceRoot":"","sources":["principalHistoryRecoveryVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,mCAAmC,CACjD,KAA2C;IAE3C,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB,IAAI,UAAU,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,eAAe;QACjD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6CAA6C,CAC9C,CAAC;IACJ,IAAI,IAAI,KAAK,UAAU;QACrB,OAAO,KAAK,CAAC,qBAAqB;YAChC,CAAC,CAAC,4BAA4B,CAAC;gBAC3B,uDAAuD;gBACvD,KAAK,CAAC,UAAU,CAAC,OAAO;aACzB,CAAC;YACJ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/B,IACE,KAAK,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC5C,KAAK,CAAC,qBAAqB;QAE3B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4EAA4E,CAC7E,CAAC;IACJ,2EAA2E;IAC3E,OAAO,4BAA4B,CAAC;QAClC,kDAAkD;QAClD,KAAK,CAAC,UAAU,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAA2C,EAC3C,OAAkD;IAElD,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe;QAAE,OAAO;IAC1D,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport function principalHistoryVerificationContext(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): string {\n  const mode = input.historyVerification ?? \"standard\";\n  if (mode !== \"standard\" && mode !== \"direct-admins\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Unknown principal history verification mode\",\n    );\n  if (mode === \"standard\")\n    return input.loadExternalAuthority\n      ? serializeKeyingCanonicalJson([\n          \"tearleads.sdk.principal-history.external-authority.v1\",\n          input.protection.context,\n        ])\n      : input.protection.context;\n  if (\n    input.expectedHead.principalType !== \"group\" ||\n    input.loadExternalAuthority\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Strict Admins history requires a group without external authority fallback\",\n    );\n  // Retire this local attestation domain whenever strict validation changes.\n  return serializeKeyingCanonicalJson([\n    \"tearleads.sdk.principal-history.direct-admins.v1\",\n    input.protection.context,\n  ]);\n}\n\nexport function assertPrincipalHistoryVerificationMode(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (input.historyVerification !== \"direct-admins\") return;\n  if (\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Reserved Admins history must contain only direct admin users\",\n    );\n}\n"]}

package/workflows/principals/principalRecoveryDirectory.d.ts

@@ -7,4 +7,4 @@ export interface RecoveredPolicyDirectory extends RecoveredPrincipalPolicyHistor
 }
 export declare class PrincipalRecoveryDirectoryAdvanced extends Error {
 }
-export declare function recoverPolicyDirectory(input: PrincipalRecoveryContext, references: readonly ReferencedPrincipalHead[]): Promise<RecoveredPolicyDirectory>;
+export declare function recoverPolicyDirectory(input: PrincipalRecoveryContext, references: readonly ReferencedPrincipalHead[], selected?: RecoveredPolicyDirectory): Promise<RecoveredPolicyDirectory>;

package/workflows/principals/principalRecoveryDirectory.js

@@ -5,9 +5,20 @@ import { parseOrganizationAuthorityDescriptor, } from "../../data/principals/org
 import { principalHistoryEvidenceScopeId } from "../../data/principals/principalHistoryPrefixProtection.js";
 import { loadVerifiedPrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
 import { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
+import { reusePrincipalDiscoveryPage } from "./principalRecoveryDiscoveryPage.js";
 import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
 export class PrincipalRecoveryDirectoryAdvanced extends Error {
 }
+function exactHead(state) {
+    return {
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        stateHash: state.stateHash,
+        keyEpoch: state.keyEpoch,
+        keyFingerprint: state.keyFingerprint,
+    };
+}
 /** An unverified discovery read chooses a pin; recovery must authenticate it. */
 async function discoverDirectoryHead(input) {
     assertProjectionVerificationCurrent(() => !input.signal?.aborted && input.stillCurrent());
@@ -39,7 +50,11 @@ async function discoverDirectoryHead(input) {
         });
         if (!selected.ok)
             throw selected.error;
-        return { head: prefix.head, genesis: genesis.reference };
+        return {
+            head: prefix.head,
+            genesis: genesis.reference,
+            apiClient: input.apiClient,
+        };
     }
     for await (const result of input.apiClient.getPrincipalPolicyPages("organization", input.organizationId, { signal: input.signal })) {
         if (!result.ok)
@@ -52,6 +67,7 @@ async function discoverDirectoryHead(input) {
             first.principalId !== input.organizationId)
             throw new KeyingVerificationError("missing_dependency", "Organization directory discovery requires genesis");
         return {
+            apiClient: reusePrincipalDiscoveryPage(input.apiClient, result),
             genesis: {
                 principalType: first.principalType,
                 principalId: first.principalId,
@@ -72,7 +88,7 @@ async function discoverDirectoryHead(input) {
     }
     throw new KeyingVerificationError("missing_dependency", "Organization directory head is unavailable");
 }
-export async function recoverPolicyDirectory(input, references) {
+export async function recoverPolicyDirectory(input, references, selected) {
     const scoped = {
         ...input,
         protection: {
@@ -83,15 +99,24 @@ export async function recoverPolicyDirectory(input, references) {
             ]),
         },
     };
-    const { head: expectedHead, genesis } = await discoverDirectoryHead(scoped);
+    const { head: expectedHead, genesis, apiClient, } = selected
+        ? {
+            head: exactHead(selected.policy.state),
+            genesis: selected.policy.retainedHistory[0]?.state,
+            apiClient: input.apiClient,
+        }
+        : await discoverDirectoryHead(scoped);
+    if (genesis?.version !== 1)
+        throw new KeyingVerificationError("missing_dependency", "Organization directory recovery requires verified genesis");
     if (references.some((reference) => reference.version > expectedHead.version))
         throw new PrincipalRecoveryDirectoryAdvanced();
     const recovered = await recoverPrincipalPolicyHistory({
         ...scoped,
+        apiClient,
         expectedHead,
         retainedReferences: references.some((reference) => reference.version === 1)
             ? references
-            : [genesis, ...references],
+            : [exactHead(genesis), ...references],
     });
     let descriptor;
     try {

package/workflows/principals/principalRecoveryDirectory.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalRecoveryDirectory.js","sourceRoot":"","sources":["principalRecoveryDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,EAC5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAEL,oCAAoC,GACrC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAehF,MAAM,OAAO,kCAAmC,SAAQ,KAAK;CAAG;AAEhE,iFAAiF;AACjF,KAAK,UAAU,qBAAqB,CAAC,KAA+B;IAIlE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG;YAChB,aAAa,EAAE,cAAuB;YACtC,WAAW,EAAE,KAAK,CAAC,cAAc;SAClC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,OAAO,EAAE,CAAC;SACX,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAClE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC5D,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,KAAK,CAAC,aAAa,KAAK,cAAc;YACtC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,OAAO;YACL,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;YACD,IAAI,EAAE;gBACJ,aAAa,EAAE,cAAc;gBAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA+B,EAC/B,UAA8C;IAE9C,MAAM,MAAM,GAAG;QACb,GAAG,KAAK;QACR,UAAU,EAAE;YACV,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;YACnC,OAAO,EAAE,4BAA4B,CAAC;gBACpC,8CAA8C;gBAC9C,KAAK,CAAC,UAAU,CAAC,OAAO;aACzB,CAAC;SACH;KACF,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QAC1E,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,GAAG,MAAM;QACT,YAAY;QACZ,kBAAkB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;KAC7B,CAAC,CAAC;IACH,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,oCAAoC,CAC/C,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,OAAO,EAAE,GAAG,SAAS,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport type PrincipalRecoveryContext = Omit<\n  RecoverPrincipalPolicyHistoryOptions,\n  | \"expectedHead\"\n  | \"retainedReferences\"\n  | \"historyVerification\"\n  | \"loadExternalAuthority\"\n>;\n\nexport interface RecoveredPolicyDirectory\n  extends RecoveredPrincipalPolicyHistory {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n}\n\nexport class PrincipalRecoveryDirectoryAdvanced extends Error {}\n\n/** An unverified discovery read chooses a pin; recovery must authenticate it. */\nasync function discoverDirectoryHead(input: PrincipalRecoveryContext): Promise<{\n  head: ReferencedPrincipalHead;\n  genesis: ReferencedPrincipalHead;\n}> {\n  assertProjectionVerificationCurrent(\n    () => !input.signal?.aborted && input.stillCurrent(),\n  );\n  if (input.offline) {\n    const principal = {\n      principalType: \"organization\" as const,\n      principalId: input.organizationId,\n    };\n    const scopeId = await principalHistoryEvidenceScopeId({\n      organizationId: input.organizationId,\n      head: principal,\n      protection: input.protection,\n    });\n    const prefix = await loadVerifiedPrincipalHistoryPrefix(\n      input,\n      principal,\n      scopeId,\n    );\n    if (!prefix)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory is unavailable offline\",\n      );\n    const history = prefix.verifier.finish(prefix.head);\n    if (!history.ok) throw history.error;\n    const genesis = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId,\n      history: history.value,\n      version: 1,\n    });\n    const selected = await verifyPrincipalPolicyHistoryReferences({\n      history: history.value,\n      references: [genesis],\n    });\n    if (!selected.ok) throw selected.error;\n    return { head: prefix.head, genesis: genesis.reference };\n  }\n  for await (const result of input.apiClient.getPrincipalPolicyPages(\n    \"organization\",\n    input.organizationId,\n    { signal: input.signal },\n  )) {\n    if (!result.ok) throw new PrincipalPolicyHistoryReadError(result);\n    assertProjectionVerificationCurrent(\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n    const state = result.data.currentState;\n    const first = result.data.previousStates[0]?.state ?? state;\n    if (\n      first.version !== 1 ||\n      first.principalType !== \"organization\" ||\n      first.principalId !== input.organizationId\n    )\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory discovery requires genesis\",\n      );\n    return {\n      genesis: {\n        principalType: first.principalType,\n        principalId: first.principalId,\n        version: first.version,\n        stateHash: first.stateHash,\n        keyEpoch: first.keyEpoch,\n        keyFingerprint: first.keyFingerprint,\n      },\n      head: {\n        principalType: \"organization\",\n        principalId: input.organizationId,\n        version: state.version,\n        stateHash: state.stateHash,\n        keyEpoch: state.keyEpoch,\n        keyFingerprint: state.keyFingerprint,\n      },\n    };\n  }\n  throw new KeyingVerificationError(\n    \"missing_dependency\",\n    \"Organization directory head is unavailable\",\n  );\n}\n\nexport async function recoverPolicyDirectory(\n  input: PrincipalRecoveryContext,\n  references: readonly ReferencedPrincipalHead[],\n): Promise<RecoveredPolicyDirectory> {\n  const scoped = {\n    ...input,\n    protection: {\n      localKey: input.protection.localKey,\n      context: serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history.directory.v1\",\n        input.protection.context,\n      ]),\n    },\n  };\n  const { head: expectedHead, genesis } = await discoverDirectoryHead(scoped);\n  if (references.some((reference) => reference.version > expectedHead.version))\n    throw new PrincipalRecoveryDirectoryAdvanced();\n  const recovered = await recoverPrincipalPolicyHistory({\n    ...scoped,\n    expectedHead,\n    retainedReferences: references.some((reference) => reference.version === 1)\n      ? references\n      : [genesis, ...references],\n  });\n  let descriptor: OrganizationAuthorityDescriptor;\n  try {\n    descriptor = parseOrganizationAuthorityDescriptor(\n      recovered.current.currentPayload.ciphertext,\n    );\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Organization directory payload is invalid\",\n    );\n  }\n  if (descriptor.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Organization directory scope does not match\",\n    );\n  return { ...recovered, descriptor };\n}\n"]}
+{"version":3,"file":"principalRecoveryDirectory.js","sourceRoot":"","sources":["principalRecoveryDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,EAC5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAEL,oCAAoC,GACrC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAehF,MAAM,OAAO,kCAAmC,SAAQ,KAAK;CAAG;AAEhE,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,qBAAqB,CAAC,KAA+B;IAKlE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG;YAChB,aAAa,EAAE,cAAuB;YACtC,WAAW,EAAE,KAAK,CAAC,cAAc;SAClC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,OAAO,EAAE,CAAC;SACX,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAClE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC5D,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,KAAK,CAAC,aAAa,KAAK,cAAc;YACtC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,OAAO;YACL,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;YAC/D,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;YACD,IAAI,EAAE;gBACJ,aAAa,EAAE,cAAc;gBAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA+B,EAC/B,UAA8C,EAC9C,QAAmC;IAEnC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK;QACR,UAAU,EAAE;YACV,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;YACnC,OAAO,EAAE,4BAA4B,CAAC;gBACpC,8CAA8C;gBAC9C,KAAK,CAAC,UAAU,CAAC,OAAO;aACzB,CAAC;SACH;KACF,CAAC;IACF,MAAM,EACJ,IAAI,EAAE,YAAY,EAClB,OAAO,EACP,SAAS,GACV,GAAG,QAAQ;QACV,CAAC,CAAC;YACE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK;YAClD,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACH,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,2DAA2D,CAC5D,CAAC;IACJ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QAC1E,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,GAAG,MAAM;QACT,SAAS;QACT,YAAY;QACZ,kBAAkB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,oCAAoC,CAC/C,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,OAAO,EAAE,GAAG,SAAS,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { reusePrincipalDiscoveryPage } from \"./principalRecoveryDiscoveryPage\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport type PrincipalRecoveryContext = Omit<\n  RecoverPrincipalPolicyHistoryOptions,\n  | \"expectedHead\"\n  | \"retainedReferences\"\n  | \"historyVerification\"\n  | \"loadExternalAuthority\"\n>;\n\nexport interface RecoveredPolicyDirectory\n  extends RecoveredPrincipalPolicyHistory {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n}\n\nexport class PrincipalRecoveryDirectoryAdvanced extends Error {}\n\nfunction exactHead(state: ReferencedPrincipalHead): ReferencedPrincipalHead {\n  return {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\n/** An unverified discovery read chooses a pin; recovery must authenticate it. */\nasync function discoverDirectoryHead(input: PrincipalRecoveryContext): Promise<{\n  head: ReferencedPrincipalHead;\n  genesis: ReferencedPrincipalHead;\n  apiClient: PrincipalRecoveryContext[\"apiClient\"];\n}> {\n  assertProjectionVerificationCurrent(\n    () => !input.signal?.aborted && input.stillCurrent(),\n  );\n  if (input.offline) {\n    const principal = {\n      principalType: \"organization\" as const,\n      principalId: input.organizationId,\n    };\n    const scopeId = await principalHistoryEvidenceScopeId({\n      organizationId: input.organizationId,\n      head: principal,\n      protection: input.protection,\n    });\n    const prefix = await loadVerifiedPrincipalHistoryPrefix(\n      input,\n      principal,\n      scopeId,\n    );\n    if (!prefix)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory is unavailable offline\",\n      );\n    const history = prefix.verifier.finish(prefix.head);\n    if (!history.ok) throw history.error;\n    const genesis = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId,\n      history: history.value,\n      version: 1,\n    });\n    const selected = await verifyPrincipalPolicyHistoryReferences({\n      history: history.value,\n      references: [genesis],\n    });\n    if (!selected.ok) throw selected.error;\n    return {\n      head: prefix.head,\n      genesis: genesis.reference,\n      apiClient: input.apiClient,\n    };\n  }\n  for await (const result of input.apiClient.getPrincipalPolicyPages(\n    \"organization\",\n    input.organizationId,\n    { signal: input.signal },\n  )) {\n    if (!result.ok) throw new PrincipalPolicyHistoryReadError(result);\n    assertProjectionVerificationCurrent(\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n    const state = result.data.currentState;\n    const first = result.data.previousStates[0]?.state ?? state;\n    if (\n      first.version !== 1 ||\n      first.principalType !== \"organization\" ||\n      first.principalId !== input.organizationId\n    )\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory discovery requires genesis\",\n      );\n    return {\n      apiClient: reusePrincipalDiscoveryPage(input.apiClient, result),\n      genesis: {\n        principalType: first.principalType,\n        principalId: first.principalId,\n        version: first.version,\n        stateHash: first.stateHash,\n        keyEpoch: first.keyEpoch,\n        keyFingerprint: first.keyFingerprint,\n      },\n      head: {\n        principalType: \"organization\",\n        principalId: input.organizationId,\n        version: state.version,\n        stateHash: state.stateHash,\n        keyEpoch: state.keyEpoch,\n        keyFingerprint: state.keyFingerprint,\n      },\n    };\n  }\n  throw new KeyingVerificationError(\n    \"missing_dependency\",\n    \"Organization directory head is unavailable\",\n  );\n}\n\nexport async function recoverPolicyDirectory(\n  input: PrincipalRecoveryContext,\n  references: readonly ReferencedPrincipalHead[],\n  selected?: RecoveredPolicyDirectory,\n): Promise<RecoveredPolicyDirectory> {\n  const scoped = {\n    ...input,\n    protection: {\n      localKey: input.protection.localKey,\n      context: serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history.directory.v1\",\n        input.protection.context,\n      ]),\n    },\n  };\n  const {\n    head: expectedHead,\n    genesis,\n    apiClient,\n  } = selected\n    ? {\n        head: exactHead(selected.policy.state),\n        genesis: selected.policy.retainedHistory[0]?.state,\n        apiClient: input.apiClient,\n      }\n    : await discoverDirectoryHead(scoped);\n  if (genesis?.version !== 1)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization directory recovery requires verified genesis\",\n    );\n  if (references.some((reference) => reference.version > expectedHead.version))\n    throw new PrincipalRecoveryDirectoryAdvanced();\n  const recovered = await recoverPrincipalPolicyHistory({\n    ...scoped,\n    apiClient,\n    expectedHead,\n    retainedReferences: references.some((reference) => reference.version === 1)\n      ? references\n      : [exactHead(genesis), ...references],\n  });\n  let descriptor: OrganizationAuthorityDescriptor;\n  try {\n    descriptor = parseOrganizationAuthorityDescriptor(\n      recovered.current.currentPayload.ciphertext,\n    );\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Organization directory payload is invalid\",\n    );\n  }\n  if (descriptor.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Organization directory scope does not match\",\n    );\n  return { ...recovered, descriptor };\n}\n"]}

package/workflows/principals/principalRecoveryDiscoveryPage.js

@@ -0,0 +1,36 @@
+/** Reuse the discovery bytes as untrusted input to the ordinary verifier. */
+export function reusePrincipalDiscoveryPage(apiClient, discovery) {
+    const first = structuredClone(discovery);
+    const page = first.data;
+    const current = {
+        currentState: page.currentState,
+        currentPayload: page.currentPayload,
+        currentProjection: page.currentProjection,
+        currentGrants: page.currentGrants,
+        currentMemberEnvelopes: page.currentMemberEnvelopes,
+    };
+    return {
+        async *getPrincipalPolicyPages(principalType, principalId, options = {}) {
+            if (options.resume !== undefined ||
+                (options.afterVersion ?? 0) !== 0 ||
+                options.stateHash !== current.currentState.stateHash ||
+                principalType !== current.currentState.principalType ||
+                principalId !== current.currentState.principalId) {
+                yield* apiClient.getPrincipalPolicyPages(principalType, principalId, options);
+                return;
+            }
+            yield structuredClone(first);
+            const next = page.historyPage.nextAfterVersion;
+            if (next === null)
+                return;
+            // Resume binds every later page to these exact artifacts, including bytes
+            // outside the signed head. The API client's cursor/shape checks still run.
+            yield* apiClient.getPrincipalPolicyPages(principalType, principalId, {
+                ...options,
+                afterVersion: undefined,
+                resume: { current, afterVersion: next },
+            });
+        },
+    };
+}
+//# sourceMappingURL=principalRecoveryDiscoveryPage.js.map

package/workflows/principals/principalRecoveryDiscoveryPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalRecoveryDiscoveryPage.js","sourceRoot":"","sources":["principalRecoveryDiscoveryPage.ts"],"names":[],"mappings":"AAGA,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CACzC,SAAqD,EACrD,SAAsD;IAEtD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;IACF,OAAO;QACL,KAAK,CAAC,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YACrE,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;gBACjC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,SAAS;gBACpD,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,aAAa;gBACpD,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,WAAW,EAChD,CAAC;gBACD,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CACtC,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;YAC/C,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO;YAC1B,0EAA0E;YAC1E,2EAA2E;YAC3E,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE;gBACnE,GAAG,OAAO;gBACV,YAAY,EAAE,SAAS;gBACvB,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient, RequestSuccess } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\n\n/** Reuse the discovery bytes as untrusted input to the ordinary verifier. */\nexport function reusePrincipalDiscoveryPage(\n  apiClient: Pick<ApiClient, \"getPrincipalPolicyPages\">,\n  discovery: RequestSuccess<PrincipalPolicyPageResponse>,\n): Pick<ApiClient, \"getPrincipalPolicyPages\"> {\n  const first = structuredClone(discovery);\n  const page = first.data;\n  const current = {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n  return {\n    async *getPrincipalPolicyPages(principalType, principalId, options = {}) {\n      if (\n        options.resume !== undefined ||\n        (options.afterVersion ?? 0) !== 0 ||\n        options.stateHash !== current.currentState.stateHash ||\n        principalType !== current.currentState.principalType ||\n        principalId !== current.currentState.principalId\n      ) {\n        yield* apiClient.getPrincipalPolicyPages(\n          principalType,\n          principalId,\n          options,\n        );\n        return;\n      }\n      yield structuredClone(first);\n      const next = page.historyPage.nextAfterVersion;\n      if (next === null) return;\n      // Resume binds every later page to these exact artifacts, including bytes\n      // outside the signed head. The API client's cursor/shape checks still run.\n      yield* apiClient.getPrincipalPolicyPages(principalType, principalId, {\n        ...options,\n        afterVersion: undefined,\n        resume: { current, afterVersion: next },\n      });\n    },\n  };\n}\n"]}