npm - @tearleads/client-sdk - Versions diffs - 0.1.14 → 0.1.16 - Mend

@tearleads/client-sdk 0.1.14 → 0.1.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (354) hide show

package/workflows/principals/publicPrincipalHistoryProgress.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"publicPrincipalHistoryProgress.js","sourceRoot":"","sources":["publicPrincipalHistoryProgress.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,qCAAqC,EACrC,4BAA4B,EAE5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAE1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,sCAAsC,EACtC,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAM3C,KAAK,UAAU,mBAAmB,CAChC,KAAoC,EACpC,OAAe,EACf,EAAU,EACV,MAAqC;IAErC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC9C,kBAAkB,KAAK,SAAS;YAChC,kCAAkC,CAAC,UAAU,CAAC;YAC9C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAC3C,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC/C,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EACrC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,MAAM,CAAC,QAAQ,EACf,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBACxE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;oBACrE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;oBAC5D,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,MAAM;oBACpB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,6BAA6B,CAAC;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM;gBACN,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAoC,EACpC,UAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,IAAI,EACJ,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IACE,UAAU;YACV,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC7C,kBAAkB,KAAK,SAAS,EAChC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CACrE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvE,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBAChE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK;oBACL,YAAY,EAAE,IAAI;oBAClB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,OAAO,EACP,EAAE,EACF,MAAM,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CACzD,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,CAAC;QACf,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,uBAAuB,CACpC,KAAoC,EACpC,QAAwC,EACxC,OAAuC;IAEvC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QACvE,OAAO,IAAI,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,EAAE,EACX,SAAS,CACV,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,UAAU,EAAE,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACxE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,uBAAuB;YACxC,KAAK,YAAY,sCAAsC;YAEvD,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAoC,EACpC,QAAwC,EACxC,OAAuC,EACvC,cAA6C;IAE7C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,4BAA4B,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACrE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,QAAQ,GACZ,cAAc;QACd,CAAC,QAAQ,CAAC,YAAY;YACpB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,0BAA0B,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY;QACZ,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK;QAChB,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,KAAK,EACd,YAAY,CACb,CAAC;AACN,CAAC","sourcesContent":["import {\n createPrincipalPolicyHistoryVerifier,\n KeyingVerificationError,\n restorePrincipalPolicyHistoryVerifier,\n serializeKeyingCanonicalJson,\n type VerifiedPrincipalPolicyHistory,\n verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n discardPrincipalHistoryPrefix,\n loadPrincipalHistoryPrefix,\n type PrincipalHistoryPrefix,\n savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport {\n discardPrincipalHistoryStage,\n loadPrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n principalHistoryEvidenceScopeId,\n principalHistoryPrefixProtection,\n} from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n principalHistoryStageId,\n principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport {\n PublicHistoryAuthorityUnavailableError,\n parsePublicHistoryAuthority,\n publicHistoryAuthorityJson,\n validatePublicHistoryAuthority,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n PublicPrincipalHistoryOptions,\n PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nasync function restorePublicPrefix(\n input: PublicPrincipalHistoryOptions,\n scopeId: string,\n id: string,\n prefix: PrincipalHistoryPrefix | null,\n): Promise<PublicPrincipalHistoryProgress | null> {\n const head = input.source.head;\n const historyInput = {\n principalType: head.principalType,\n principalId: head.principalId,\n };\n const current = () => !input.signal?.aborted && input.stillCurrent();\n if (prefix) {\n const authorityReference = parsePublicHistoryAuthority(\n input,\n prefix.currentJson,\n );\n let prefixHead: unknown;\n try {\n prefixHead = JSON.parse(prefix.headJson);\n } catch {\n prefixHead = null;\n }\n if (\n prefix.organizationId === input.organizationId &&\n authorityReference !== undefined &&\n isReferencedPrincipalStateResponse(prefixHead) &&\n prefixHead.principalId === head.principalId &&\n prefixHead.principalType === head.principalType &&\n prefixHead.version === prefix.version\n ) {\n const restored = await restorePrincipalPolicyHistoryVerifier(\n historyInput,\n prefix.progress,\n await principalHistoryPrefixProtection(input.protection, prefix),\n );\n if (restored.ok && restored.value.finish(prefixHead).ok) {\n await validatePublicHistoryAuthority(input, authorityReference, prefix);\n return {\n id,\n scopeId,\n verifier: restored.value,\n completedHead: prefixHead.version >= head.version ? prefixHead : null,\n afterVersion: Math.min(prefixHead.version, head.version - 1),\n saved: null,\n cachedPrefix: prefix,\n authorityReference,\n };\n }\n }\n if (!input.offline)\n await discardPrincipalHistoryPrefix({\n execSql: input.execSql,\n prefix,\n stillCurrent: current,\n });\n }\n return null;\n}\n\nexport async function restorePublicPrincipalHistoryProgress(\n input: PublicPrincipalHistoryOptions,\n allowReuse: boolean,\n): Promise<PublicPrincipalHistoryProgress> {\n const head = input.source.head;\n const historyInput = {\n principalType: head.principalType,\n principalId: head.principalId,\n };\n const scopeId = await principalHistoryEvidenceScopeId({\n organizationId: input.organizationId,\n head,\n protection: input.protection,\n });\n const id = await principalHistoryStageId(\n input.organizationId,\n head,\n input.protection.context,\n );\n const current = () => !input.signal?.aborted && input.stillCurrent();\n const saved = await loadPrincipalHistoryStage(input.execSql, id);\n if (saved) {\n const authorityReference = parsePublicHistoryAuthority(\n input,\n saved.currentJson,\n );\n if (\n allowReuse &&\n saved.organizationId === input.organizationId &&\n authorityReference !== undefined\n ) {\n const restored = await restorePrincipalPolicyHistoryVerifier(\n historyInput,\n saved.progress,\n await principalHistoryStageProtection(input.protection, head, saved),\n );\n if (restored.ok && (!saved.complete || restored.value.finish(head).ok)) {\n await validatePublicHistoryAuthority(input, authorityReference);\n return {\n id,\n scopeId,\n verifier: restored.value,\n completedHead: saved.complete ? head : null,\n afterVersion: saved.afterVersion,\n saved,\n cachedPrefix: null,\n authorityReference,\n };\n }\n }\n if (!input.offline)\n await discardPrincipalHistoryStage(input.execSql, saved, current);\n }\n if (allowReuse) {\n const prefix = await restorePublicPrefix(\n input,\n scopeId,\n id,\n await loadPrincipalHistoryPrefix(input.execSql, scopeId),\n );\n if (prefix) return prefix;\n }\n return {\n id,\n scopeId,\n verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n completedHead: null,\n afterVersion: 0,\n saved: null,\n cachedPrefix: null,\n authorityReference: null,\n };\n}\n\n/** A resumed stage may finish after the reader that rejected the prefix exits. */\nasync function rejectedCompletedPrefix(\n input: PublicPrincipalHistoryOptions,\n progress: PublicPrincipalHistoryProgress,\n history: VerifiedPrincipalPolicyHistory,\n): Promise<PrincipalHistoryPrefix | null> {\n const candidate = await loadPrincipalHistoryPrefix(\n input.execSql,\n progress.scopeId,\n );\n if (!candidate || candidate.version <= history.currentEntry.state.version)\n return null;\n try {\n const cached = await restorePublicPrefix(\n input,\n progress.scopeId,\n progress.id,\n candidate,\n );\n if (!cached?.completedHead) return null;\n const finished = cached.verifier.finish(cached.completedHead);\n if (!finished.ok) throw finished.error;\n const proof = await loadPrincipalHistoryReference({\n execSql: input.execSql,\n scopeId: progress.scopeId,\n history: finished.value,\n version: input.source.head.version,\n });\n const verified = await verifyPrincipalPolicyHistoryReferences({\n history: finished.value,\n references: [proof],\n });\n if (!verified.ok) throw verified.error;\n return principalHeadMatchesReference(proof.entry.state, input.source.head)\n ? null\n : candidate;\n } catch (error) {\n if (\n error instanceof KeyingVerificationError ||\n error instanceof PublicHistoryAuthorityUnavailableError\n )\n return candidate;\n throw error;\n }\n}\n\nexport async function publishPublicPrincipalHistoryPrefix(\n input: PublicPrincipalHistoryOptions,\n progress: PublicPrincipalHistoryProgress,\n history: VerifiedPrincipalPolicyHistory,\n rejectedPrefix: PrincipalHistoryPrefix | null,\n): Promise<void> {\n const state = history.currentEntry.state;\n const head = {\n principalType: state.principalType,\n principalId: state.principalId,\n version: state.version,\n stateHash: state.stateHash,\n keyEpoch: state.keyEpoch,\n keyFingerprint: state.keyFingerprint,\n };\n const prefix = {\n scopeId: progress.scopeId,\n organizationId: input.organizationId,\n version: head.version,\n headJson: serializeKeyingCanonicalJson(head),\n currentJson: publicHistoryAuthorityJson(progress.authorityReference),\n };\n const sealed = await progress.verifier.exportProgress(\n await principalHistoryPrefixProtection(input.protection, prefix),\n );\n if (!sealed.ok) throw sealed.error;\n const rejected =\n rejectedPrefix ??\n (progress.cachedPrefix\n ? null\n : await rejectedCompletedPrefix(input, progress, history));\n const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n await savePrincipalHistoryPrefix({\n execSql: input.execSql,\n prefix: { ...prefix, progress: sealed.value },\n stillCurrent,\n rejectedPrefix: rejected,\n });\n if (progress.saved)\n await discardPrincipalHistoryStage(\n input.execSql,\n progress.saved,\n stillCurrent,\n );\n}\n"]}

package/workflows/principals/publicPrincipalHistoryTypes.d.ts ADDED Viewed

@@ -0,0 +1,39 @@
+import type { ApiClient } from "../../internal/api-client/index.js";
+import type { PrincipalPolicyExternalAuthority, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryVerifier, ReferencedPrincipalHead, VerifiedPrincipalPolicyHistory } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyHistorySourceResponse } from "../../internal/validators/response/index.js";
+import type { PrincipalHistoryPrefix } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import type { PrincipalHistoryStage } from "../../data/persistence/principalHistoryStagePersistence.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
+export interface PublicPrincipalHistoryOptions {
+    readonly apiClient: Pick<ApiClient, "getProjectionPolicyHistoryPages">;
+    readonly source: PrincipalPolicyHistorySourceResponse;
+    readonly organizationId: string;
+    readonly execSql: ExecSql;
+    readonly protection: PrincipalPolicyHistoryProgressOptions;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly stillCurrent: () => boolean;
+    readonly signal?: AbortSignal | undefined;
+    readonly offline?: boolean | undefined;
+    /** Retry disposable evidence loss once from signatures, without reusing hints. */
+    readonly replay?: boolean | undefined;
+    readonly strictAdmins?: boolean | undefined;
+    /** Already verified organization binding; included in the protected cache scope. */
+    readonly authorityGroupId?: string | undefined;
+    readonly loadExternalAuthority?: ((references: readonly ReferencedPrincipalHead[], cachedPrefix?: boolean) => Promise<PrincipalPolicyExternalAuthority | undefined>) | undefined;
+}
+export interface PublicPrincipalHistoryProgress {
+    readonly id: string;
+    readonly scopeId: string;
+    readonly verifier: PrincipalPolicyHistoryVerifier;
+    readonly completedHead: ReferencedPrincipalHead | null;
+    readonly afterVersion: number;
+    readonly saved: PrincipalHistoryStage | null;
+    readonly cachedPrefix: PrincipalHistoryPrefix | null;
+    readonly authorityReference: ReferencedPrincipalHead | null;
+}
+/** Public authorization only; caller must check directory binding and local pins. */
+export interface RecoveredPublicPrincipalHistory {
+    readonly scopeId: string;
+    readonly history: VerifiedPrincipalPolicyHistory;
+}

package/workflows/principals/publicPrincipalHistoryTypes.js ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=publicPrincipalHistoryTypes.js.map

package/workflows/principals/publicPrincipalHistoryTypes.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"publicPrincipalHistoryTypes.js","sourceRoot":"","sources":["publicPrincipalHistoryTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type {\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryVerifier,\n ReferencedPrincipalHead,\n VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyHistorySourceResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\nexport interface PublicPrincipalHistoryOptions {\n readonly apiClient: Pick<ApiClient, \"getProjectionPolicyHistoryPages\">;\n readonly source: PrincipalPolicyHistorySourceResponse;\n readonly organizationId: string;\n readonly execSql: ExecSql;\n readonly protection: PrincipalPolicyHistoryProgressOptions;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly stillCurrent: () => boolean;\n readonly signal?: AbortSignal | undefined;\n readonly offline?: boolean | undefined;\n /** Retry disposable evidence loss once from signatures, without reusing hints. */\n readonly replay?: boolean | undefined;\n readonly strictAdmins?: boolean | undefined;\n /** Already verified organization binding; included in the protected cache scope. */\n readonly authorityGroupId?: string | undefined;\n readonly loadExternalAuthority?:\n | ((\n references: readonly ReferencedPrincipalHead[],\n cachedPrefix?: boolean,\n ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n | undefined;\n}\n\nexport interface PublicPrincipalHistoryProgress {\n readonly id: string;\n readonly scopeId: string;\n readonly verifier: PrincipalPolicyHistoryVerifier;\n readonly completedHead: ReferencedPrincipalHead | null;\n readonly afterVersion: number;\n readonly saved: PrincipalHistoryStage | null;\n readonly cachedPrefix: PrincipalHistoryPrefix | null;\n readonly authorityReference: ReferencedPrincipalHead | null;\n}\n\n/** Public authorization only; caller must check directory binding and local pins. */\nexport interface RecoveredPublicPrincipalHistory {\n readonly scopeId: string;\n readonly history: VerifiedPrincipalPolicyHistory;\n}\n"]}

package/workflows/principals/publicProjectionDirectory.js ADDED Viewed

@@ -0,0 +1,40 @@
+import { computePrincipalStatePayloadCiphertextHash, } from "../../internal/crypto/index.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { rejectPublicProjection, selectPublicProjectionPrincipal, } from "./publicProjectionPrincipal.js";
+export async function publicProjectionDirectoryBindings(evidence, organization) {
+    const policies = await selectPublicProjectionPrincipal(organization);
+    const entries = policies.flatMap((policy) => policy.retainedHistory);
+    const descriptors = [];
+    const seen = new Set();
+    for (const { reference, payload } of evidence.organizationPayloads) {
+        const state = entries.find(({ state }) => principalHeadMatchesReference(state, reference))?.state;
+        if (!state ||
+            reference.version > organization.options.source.head.version ||
+            payload.principalType !== "organization" ||
+            payload.principalId !== organization.options.organizationId ||
+            payload.stateHash !== state.stateHash ||
+            seen.has(state.stateHash))
+            rejectPublicProjection("directory payload scope is invalid");
+        seen.add(state.stateHash);
+        const hash = await computePrincipalStatePayloadCiphertextHash(payload.ciphertext);
+        if (hash !== payload.ciphertextHash || hash !== state.payloadCiphertextHash)
+            rejectPublicProjection("directory payload differs from its signed hash");
+        const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);
+        if (descriptor.organizationId !== organization.options.organizationId)
+            rejectPublicProjection("directory belongs to another organization");
+        descriptors.push(descriptor);
+    }
+    const bindings = new Map();
+    for (const source of evidence.groups) {
+        if (source.head.principalType !== "group" ||
+            bindings.has(source.head.principalId))
+            rejectPublicProjection("group sources have invalid or repeated scopes");
+        const directory = descriptors.find((candidate) => candidate.groupHeads.some((head) => principalHeadMatchesReference(head, source.head)));
+        const adminHead = directory?.groupHeads.find((head) => head.principalId === directory.adminGroupId);
+        if (!adminHead)
+            rejectPublicProjection("group source lacks its signed directory binding");
+        bindings.set(source.head.principalId, { adminHead });
+    }
+    return bindings;
+}
+//# sourceMappingURL=publicProjectionDirectory.js.map

package/workflows/principals/publicProjectionDirectory.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"publicProjectionDirectory.js","sourceRoot":"","sources":["publicProjectionDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,GAE3C,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAEL,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,QAA0C,EAC1C,YAAuC;IAEvC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACvC,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD,EAAE,KAAK,CAAC;QACT,IACE,CAAC,KAAK;YACN,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5D,OAAO,CAAC,aAAa,KAAK,cAAc;YACxC,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC,OAAO,CAAC,cAAc;YAC3D,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAEzB,sBAAsB,CAAC,oCAAoC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,IAAI,KAAK,OAAO,CAAC,cAAc,IAAI,IAAI,KAAK,KAAK,CAAC,qBAAqB;YACzE,sBAAsB,CAAC,gDAAgD,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,oCAAoC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,cAAc,KAAK,YAAY,CAAC,OAAO,CAAC,cAAc;YACnE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;QACtE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkD,CAAC;IAC3E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IACE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO;YACrC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAErC,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/C,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,6BAA6B,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CACjD,CACF,CAAC;QACF,MAAM,SAAS,GAAG,SAAS,EAAE,UAAU,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,YAAY,CACtD,CAAC;QACF,IAAI,CAAC,SAAS;YACZ,sBAAsB,CAAC,iDAAiD,CAAC,CAAC;QAC5E,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n computePrincipalStatePayloadCiphertextHash,\n type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport {\n parseOrganizationAuthorityDescriptor,\n principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n type PublicProjectionPrincipal,\n rejectPublicProjection,\n selectPublicProjectionPrincipal,\n} from \"./publicProjectionPrincipal\";\n\nexport async function publicProjectionDirectoryBindings(\n evidence: ProjectionPolicyEvidenceResponse,\n organization: PublicProjectionPrincipal,\n) {\n const policies = await selectPublicProjectionPrincipal(organization);\n const entries = policies.flatMap((policy) => policy.retainedHistory);\n const descriptors = [];\n const seen = new Set<string>();\n for (const { reference, payload } of evidence.organizationPayloads) {\n const state = entries.find(({ state }) =>\n principalHeadMatchesReference(state, reference),\n )?.state;\n if (\n !state ||\n reference.version > organization.options.source.head.version ||\n payload.principalType !== \"organization\" ||\n payload.principalId !== organization.options.organizationId ||\n payload.stateHash !== state.stateHash ||\n seen.has(state.stateHash)\n )\n rejectPublicProjection(\"directory payload scope is invalid\");\n seen.add(state.stateHash);\n const hash = await computePrincipalStatePayloadCiphertextHash(\n payload.ciphertext,\n );\n if (hash !== payload.ciphertextHash || hash !== state.payloadCiphertextHash)\n rejectPublicProjection(\"directory payload differs from its signed hash\");\n const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);\n if (descriptor.organizationId !== organization.options.organizationId)\n rejectPublicProjection(\"directory belongs to another organization\");\n descriptors.push(descriptor);\n }\n const bindings = new Map<string, { adminHead: ReferencedPrincipalHead }>();\n for (const source of evidence.groups) {\n if (\n source.head.principalType !== \"group\" ||\n bindings.has(source.head.principalId)\n )\n rejectPublicProjection(\"group sources have invalid or repeated scopes\");\n const directory = descriptors.find((candidate) =>\n candidate.groupHeads.some((head) =>\n principalHeadMatchesReference(head, source.head),\n ),\n );\n const adminHead = directory?.groupHeads.find(\n (head) => head.principalId === directory.adminGroupId,\n );\n if (!adminHead)\n rejectPublicProjection(\"group source lacks its signed directory binding\");\n bindings.set(source.head.principalId, { adminHead });\n }\n return bindings;\n}\n"]}

package/workflows/principals/publicProjectionPrincipal.js ADDED Viewed

@@ -0,0 +1,53 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+import { recoverPublicPrincipalHistory } from "./recoverPublicPrincipalHistory.js";
+import { selectPublicPrincipalHistory } from "./selectPublicPrincipalHistory.js";
+/** The source head and every citation remain bound independently of a newer prefix. */
+export async function selectPublicProjectionPrincipal(principal, references = principal.references) {
+    const { options } = principal;
+    const current = () => !options.signal?.aborted && options.stillCurrent();
+    assertProjectionVerificationCurrent(current);
+    const checkpoint = await loadPrincipalPolicyCheckpoint(options.execSql, options.source.head.principalType, options.source.head.principalId);
+    try {
+        return await selectPublicPrincipalHistory({
+            execSql: options.execSql,
+            recovered: principal.recovered,
+            references: [options.source.head, ...references],
+            checkpoint,
+            includeGenesis: options.source.head.principalType === "organization",
+            stillCurrent: current,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))
+            throw error;
+        if (options.offline || principal.replayed)
+            throw error.verificationError;
+        principal.replayed = true;
+        principal.recovered = await recoverPublicPrincipalHistory({
+            ...options,
+            replay: true,
+        });
+        return selectPublicProjectionPrincipal(principal, references);
+    }
+}
+export async function recoverPublicProjectionPrincipal(options, references) {
+    const selected = references.filter((head) => head.principalType === options.source.head.principalType &&
+        head.principalId === options.source.head.principalId);
+    if (selected.some((head) => head.version > options.source.head.version))
+        rejectPublicProjection("citation exceeds its supplied source head");
+    const principal = {
+        options,
+        references: structuredClone(selected),
+        recovered: await recoverPublicPrincipalHistory(options),
+        replayed: false,
+    };
+    await selectPublicProjectionPrincipal(principal);
+    return principal;
+}
+export function rejectPublicProjection(message) {
+    throw new KeyingVerificationError("object_mismatch", `Public projection history: ${message}`);
+}
+//# sourceMappingURL=publicProjectionPrincipal.js.map

package/workflows/principals/publicProjectionPrincipal.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"publicProjectionPrincipal.js","sourceRoot":"","sources":["publicProjectionPrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAKhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAS9E,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAoC,EACpC,aAAiD,SAAS,CAAC,UAAU;IAErE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAChC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC;YAChD,UAAU;YACV,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc;YACpE,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAwC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC,iBAAiB,CAAC;QACzE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,SAAS,GAAG,MAAM,6BAA6B,CAAC;YACxD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,+BAA+B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAsC,EACtC,UAA8C;IAE9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;QACxD,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACrE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC;QACvD,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8BAA8B,OAAO,EAAE,CACxC,CAAC;AACJ,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type {\n PublicPrincipalHistoryOptions,\n RecoveredPublicPrincipalHistory,\n} from \"./publicPrincipalHistoryTypes\";\nimport { recoverPublicPrincipalHistory } from \"./recoverPublicPrincipalHistory\";\nimport { selectPublicPrincipalHistory } from \"./selectPublicPrincipalHistory\";\n\nexport interface PublicProjectionPrincipal {\n readonly options: PublicPrincipalHistoryOptions;\n readonly references: readonly ReferencedPrincipalHead[];\n recovered: RecoveredPublicPrincipalHistory;\n replayed: boolean;\n}\n\n/** The source head and every citation remain bound independently of a newer prefix. */\nexport async function selectPublicProjectionPrincipal(\n principal: PublicProjectionPrincipal,\n references: readonly ReferencedPrincipalHead[] = principal.references,\n) {\n const { options } = principal;\n const current = () => !options.signal?.aborted && options.stillCurrent();\n assertProjectionVerificationCurrent(current);\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n options.execSql,\n options.source.head.principalType,\n options.source.head.principalId,\n );\n try {\n return await selectPublicPrincipalHistory({\n execSql: options.execSql,\n recovered: principal.recovered,\n references: [options.source.head, ...references],\n checkpoint,\n includeGenesis: options.source.head.principalType === \"organization\",\n stillCurrent: current,\n });\n } catch (error) {\n if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))\n throw error;\n if (options.offline || principal.replayed) throw error.verificationError;\n principal.replayed = true;\n principal.recovered = await recoverPublicPrincipalHistory({\n ...options,\n replay: true,\n });\n return selectPublicProjectionPrincipal(principal, references);\n }\n}\n\nexport async function recoverPublicProjectionPrincipal(\n options: PublicPrincipalHistoryOptions,\n references: readonly ReferencedPrincipalHead[],\n): Promise<PublicProjectionPrincipal> {\n const selected = references.filter(\n (head) =>\n head.principalType === options.source.head.principalType &&\n head.principalId === options.source.head.principalId,\n );\n if (selected.some((head) => head.version > options.source.head.version))\n rejectPublicProjection(\"citation exceeds its supplied source head\");\n const principal = {\n options,\n references: structuredClone(selected),\n recovered: await recoverPublicPrincipalHistory(options),\n replayed: false,\n };\n await selectPublicProjectionPrincipal(principal);\n return principal;\n}\n\nexport function rejectPublicProjection(message: string): never {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n `Public projection history: ${message}`,\n );\n}\n"]}

package/workflows/principals/recoverCurrentOrganizationPolicy.js ADDED Viewed

@@ -0,0 +1,33 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
+import { createPrincipalRecoveryReader, } from "./principalRecoveryMemo.js";
+import { isPrincipalRecoveryOutage } from "./principalRecoveryOutage.js";
+/** Discover and verify current directory artifacts, including protected offline recovery. */
+export async function recoverCurrentOrganizationPolicy(options, memo) {
+    const input = {
+        ...options,
+        protection: ownPrincipalHistoryProtection(options.protection),
+    };
+    try {
+        let directory;
+        try {
+            directory = await createPrincipalRecoveryReader(input, memo).directory([]);
+        }
+        catch (error) {
+            assertProjectionVerificationCurrent(input.stillCurrent);
+            if (input.offline || !isPrincipalRecoveryOutage(error))
+                throw error;
+            directory = await createPrincipalRecoveryReader({ ...input, offline: true }, memo).directory([]);
+        }
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        return {
+            current: directory.current,
+            policy: directory.policy,
+            dependencies: [],
+        };
+    }
+    finally {
+        input.protection.localKey.fill(0);
+    }
+}
+//# sourceMappingURL=recoverCurrentOrganizationPolicy.js.map

package/workflows/principals/recoverCurrentOrganizationPolicy.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"recoverCurrentOrganizationPolicy.js","sourceRoot":"","sources":["recoverCurrentOrganizationPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAKjG,OAAO,EACL,6BAA6B,GAE9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAiC,EACjC,IAA4B;IAE5B,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,IAAI,SAA6D,CAAC;QAClE,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,CACpE,EAAE,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACpE,SAAS,GAAG,MAAM,6BAA6B,CAC7C,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,IAAI,CACL,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport type {\n PrincipalRecoveryContext,\n recoverPolicyDirectory,\n} from \"./principalRecoveryDirectory\";\nimport {\n createPrincipalRecoveryReader,\n type PrincipalRecoveryMemo,\n} from \"./principalRecoveryMemo\";\nimport { isPrincipalRecoveryOutage } from \"./principalRecoveryOutage\";\n\n/** Discover and verify current directory artifacts, including protected offline recovery. */\nexport async function recoverCurrentOrganizationPolicy(\n options: PrincipalRecoveryContext,\n memo?: PrincipalRecoveryMemo,\n) {\n const input = {\n ...options,\n protection: ownPrincipalHistoryProtection(options.protection),\n };\n try {\n let directory: Awaited<ReturnType<typeof recoverPolicyDirectory>>;\n try {\n directory = await createPrincipalRecoveryReader(input, memo).directory(\n [],\n );\n } catch (error) {\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (input.offline || !isPrincipalRecoveryOutage(error)) throw error;\n directory = await createPrincipalRecoveryReader(\n { ...input, offline: true },\n memo,\n ).directory([]);\n }\n assertProjectionVerificationCurrent(input.stillCurrent);\n return {\n current: directory.current,\n policy: directory.policy,\n dependencies: [],\n };\n } finally {\n input.protection.localKey.fill(0);\n }\n}\n"]}

package/workflows/principals/recoverPrincipalPolicyHistory.js CHANGED Viewed

@@ -6,6 +6,7 @@ import { discardPrincipalHistoryStage, savePrincipalHistoryStage, } from "../../
 import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
 import { principalHistoryStageProtection } from "../../data/principals/principalHistoryStageProtection.js";
 import { collectPrincipalPolicySignerPublicKeys } from "./policyVerification.js";
+import { validatePrincipalHistoryRecoveryAuthority } from "./principalHistoryRecoveryAuthority.js";
 import { publishReusablePrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
 import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "./principalHistoryRecoveryReferences.js";
 import { restorePrincipalHistoryRecoveryStage, } from "./principalHistoryRecoveryStage.js";
@@ -74,7 +75,7 @@ async function acceptPage(input, stage, response) {
     });
     if ("error" in keys)
         throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Principal history signer identity could not be authenticated");
-    const externalAuthority = await input.loadExternalAuthority?.(entries);
+    const externalAuthority = await input.loadExternalAuthority?.(entries.flatMap(({ state }) => state.externalAuthority ? [state.externalAuthority] : []));
     const appended = await stage.verifier.append({
         entries,
         signerPublicKeys: keys.signerPublicKeys,
@@ -196,6 +197,8 @@ async function recover(input, allowEvidenceRebuild = true) {
     };
     const stage = await restorePrincipalHistoryRecoveryStage(input, historyInput, allowEvidenceRebuild);
     try {
+        if (stage.fromCache)
+            await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);
         await readRecoveryPages(input, stage);
         return await finishRecovery(input, stage, checkpoint);
     }

package/workflows/principals/recoverPrincipalPolicyHistory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EAGvB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,uCAAwC,SAAQ,KAAK;IACpC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAC;IACxD,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C;IAE3C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC,EACnC,YAAkE;IAElE,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,sCAAsC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,uCAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAA2C,EAC3C,KAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,+BAA+B,CAAC;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;QACpC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QACjC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,qCAAqC,CACzC,KAAK,EACL,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2C,EAC3C,KAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;YACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACjD,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;AACN,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAA2C,EAC3C,oBAAoB,GAAG,IAAI;IAE3B,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,EACjD,2DAA2D,CAC5D,CAAC;IACJ,8EAA8E;IAC9E,oCAAoC,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CACtD,KAAK,EACL,YAAY,EACZ,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAChB,KAAK,YAAY,wCAAwC,CAAC;QAC5D,MAAM,YAAY,GAChB,KAAK,YAAY,uCAAuC,CAAC;QAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;YAAE,MAAM,KAAK,CAAC;QAChD,IAAI,KAAK,CAAC,KAAK;YACb,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;QACJ,IACE,CAAC,KAAK,CAAC,OAAO;YACd,oBAAoB;YACpB,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,CAAC;YAEjC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,UAAU;QAC9D,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n createPrincipalPolicyHistoryVerifier,\n KeyingVerificationError,\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyHistoryInput,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n discardPrincipalHistoryStage,\n savePrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport { publishReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n PrincipalHistoryEvidenceUnavailableError,\n selectRecoveredPrincipalHistory,\n} from \"./principalHistoryRecoveryReferences\";\nimport {\n type PrincipalHistoryRecoveryStage,\n restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n PrincipalHistoryRecoveryRaceError,\n PrincipalPolicyHistoryReadError,\n type RecoveredPrincipalPolicyHistory,\n type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n assertPrincipalHistoryVerificationMode,\n principalHistoryVerificationContext,\n} from \"./principalHistoryRecoveryVerification\";\n\nclass PrincipalHistoryPrefixDisconnectedError extends Error {\n constructor(readonly verificationError: KeyingVerificationError) {\n super(verificationError.message);\n this.name = \"PrincipalHistoryPrefixDisconnectedError\";\n }\n}\n\nfunction currentArtifacts(\n page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n return {\n currentState: page.currentState,\n currentPayload: page.currentPayload,\n currentProjection: page.currentProjection,\n currentGrants: page.currentGrants,\n currentMemberEnvelopes: page.currentMemberEnvelopes,\n };\n}\n\nfunction recoveryIsCurrent(\n input: RecoverPrincipalPolicyHistoryOptions,\n): boolean {\n return !input.signal?.aborted && input.stillCurrent();\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));\n}\n\nfunction assertExpectedHead(\n current: PrincipalPolicyPageCurrent,\n expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): void {\n for (const field of [\n \"principalType\",\n \"principalId\",\n \"version\",\n \"stateHash\",\n \"keyEpoch\",\n \"keyFingerprint\",\n ] as const) {\n if (current.currentState[field] !== expectedHead[field])\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Principal history page does not match its requested head\",\n );\n }\n}\n\nasync function acceptPage(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n response: PrincipalPolicyPageResponse,\n): Promise<void> {\n const page = structuredClone(response);\n assertCurrent(input);\n assertExpectedHead(page, input.expectedHead);\n if (stage.complete) {\n if (\n page.previousStates.length !== 0 \|\|\n page.historyPage.nextAfterVersion !== null\n )\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Completed history returned additional entries\",\n );\n stage.current = currentArtifacts(page);\n return;\n }\n const complete = page.historyPage.nextAfterVersion === null;\n const current = currentArtifacts(page);\n const entries = [...page.previousStates];\n if (complete)\n entries.push({\n state: current.currentState,\n projection: current.currentProjection,\n grants: current.currentGrants,\n });\n assertPrincipalHistoryVerificationMode(input, entries);\n const keys = await collectPrincipalPolicySignerPublicKeys({\n bundle: { ...current, previousStates: page.previousStates },\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (\"error\" in keys)\n throw new KeyingVerificationError(\n keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n \"Principal history signer identity could not be authenticated\",\n );\n const externalAuthority = await input.loadExternalAuthority?.(entries);\n const appended = await stage.verifier.append({\n entries,\n signerPublicKeys: keys.signerPublicKeys,\n ...(externalAuthority ? { externalAuthority } : {}),\n });\n if (!appended.ok) {\n if (appended.error.code === \"stale_predecessor\")\n throw new PrincipalHistoryPrefixDisconnectedError(appended.error);\n throw appended.error;\n }\n const next = {\n id: stage.id,\n organizationId: input.organizationId,\n currentJson: JSON.stringify(current),\n afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n complete,\n };\n const protectedProgress = await stage.verifier.exportProgress(\n await principalHistoryStageProtection(\n input.protection,\n input.expectedHead,\n next,\n ),\n );\n if (!protectedProgress.ok) throw protectedProgress.error;\n const saved = { ...next, progress: protectedProgress.value };\n await savePrincipalHistoryStage({\n execSql: input.execSql,\n stage: saved,\n evidence: await preparePrincipalHistoryEvidencePage({\n scopeId: stage.scopeId,\n organizationId: input.organizationId,\n entries,\n nodes: appended.value.indexNodes,\n }),\n previousProgress: stage.saved?.progress ?? null,\n stillCurrent: () => recoveryIsCurrent(input),\n });\n stage.current = current;\n stage.saved = saved;\n stage.complete = complete;\n}\n\nasync function finishRecovery(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n checkpoint: PrincipalPolicyCheckpoint \| null,\n): Promise<RecoveredPrincipalPolicyHistory> {\n if (!stage.current \|\| !stage.complete)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history ended before its pinned head\",\n );\n const history = stage.verifier.finish(input.expectedHead);\n if (!history.ok) throw history.error;\n const selected = await selectRecoveredPrincipalHistory({\n options: input,\n scopeId: stage.scopeId,\n history: history.value,\n checkpoint,\n });\n const current = await verifyPrincipalPolicyCurrent({\n current: stage.current,\n history: selected,\n });\n if (!current.ok) throw current.error;\n verifyPrincipalPolicyCheckpoint({\n chain: current.value.retainedHistory,\n currentState: current.value.state,\n localCheckpoint: checkpoint,\n });\n const latest = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n );\n if (\n latest?.version !== checkpoint?.version \|\|\n latest?.stateHash !== checkpoint?.stateHash\n )\n throw new PrincipalHistoryRecoveryRaceError(\n \"Local principal checkpoint changed during history recovery\",\n );\n assertCurrent(input);\n if (!input.offline)\n await publishReusablePrincipalHistoryPrefix(\n input,\n stage.scopeId,\n stage.verifier,\n stage.current,\n );\n assertCurrent(input);\n return { current: stage.current, policy: current.value };\n}\n\nasync function readRecoveryPages(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n): Promise<void> {\n if (input.offline) {\n if (!stage.complete \|\| !stage.current)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Completed principal history is unavailable offline\",\n );\n assertExpectedHead(stage.current, input.expectedHead);\n return;\n }\n let receivedFinalPage = false;\n for await (const result of input.apiClient.getPrincipalPolicyPages(\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n {\n signal: input.signal,\n stateHash: input.expectedHead.stateHash,\n ...(stage.saved && stage.current\n ? {\n resume: {\n current: stage.current,\n afterVersion: stage.saved.afterVersion,\n },\n }\n : { afterVersion: stage.initialAfterVersion }),\n },\n )) {\n if (!result.ok) {\n // A rejected transport pin cannot justify skipping history on retry.\n // Discard only this operation's progress, then let a new call replay it.\n if (result.kind === \"shape\" && stage.saved)\n await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n recoveryIsCurrent(input),\n );\n throw new PrincipalPolicyHistoryReadError(result);\n }\n await acceptPage(input, stage, result.data);\n receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n }\n if (!receivedFinalPage)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history transport did not complete\",\n );\n}\n\nasync function recover(\n input: RecoverPrincipalPolicyHistoryOptions,\n allowEvidenceRebuild = true,\n): Promise<RecoveredPrincipalPolicyHistory> {\n assertCurrent(input);\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n );\n if (checkpoint && input.expectedHead.version < checkpoint.version)\n throw new KeyingVerificationError(\n input.offline ? \"missing_dependency\" : \"rollback\",\n \"Requested principal history predates the local checkpoint\",\n );\n // Validate the requested pin/selection before creating any disposable caches.\n createPrincipalPolicyHistoryVerifier({\n principalType: input.expectedHead.principalType,\n principalId: input.expectedHead.principalId,\n localCheckpoint: checkpoint,\n retainedReferences: input.retainedReferences ?? [],\n });\n const historyInput: PrincipalPolicyHistoryInput = {\n principalType: input.expectedHead.principalType,\n principalId: input.expectedHead.principalId,\n };\n const stage = await restorePrincipalHistoryRecoveryStage(\n input,\n historyInput,\n allowEvidenceRebuild,\n );\n try {\n await readRecoveryPages(input, stage);\n return await finishRecovery(input, stage, checkpoint);\n } catch (error) {\n const lostEvidence =\n error instanceof PrincipalHistoryEvidenceUnavailableError;\n const disconnected =\n error instanceof PrincipalHistoryPrefixDisconnectedError;\n if (!lostEvidence && !disconnected) throw error;\n if (stage.saved)\n await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n recoveryIsCurrent(input),\n );\n if (\n !input.offline &&\n allowEvidenceRebuild &&\n (lostEvidence \|\| stage.fromCache)\n )\n return recover(input, false);\n throw lostEvidence \|\| disconnected ? error.verificationError : error;\n }\n}\n\n/*\n Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n * Retain organization version 1 when the result will establish founder binding.\n */\nexport async function recoverPrincipalPolicyHistory(\n options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Invalid principal history transport mode\",\n );\n if (\n !options.organizationId \|\|\n (options.expectedHead.principalType === \"organization\" &&\n options.expectedHead.principalId !== options.organizationId)\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Principal history organization scope is invalid\",\n );\n if (\n options.retainedReferences?.some(\n (reference) => reference.version > options.expectedHead.version,\n )\n )\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Requested history reference is beyond the recovery head\",\n );\n const input = {\n ...options,\n historyVerification: options.historyVerification ?? \"standard\",\n expectedHead: structuredClone(options.expectedHead),\n retainedReferences: structuredClone(options.retainedReferences ?? []),\n protection: ownPrincipalHistoryProtection(options.protection),\n };\n try {\n input.protection.context = principalHistoryVerificationContext(input);\n return await recover(input);\n } finally {\n input.protection.localKey.fill(0);\n }\n}\n"]}
1	+ {"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EAGvB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,uCAAwC,SAAQ,KAAK;IACpC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAC;IACxD,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C;IAE3C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC,EACnC,YAAkE;IAElE,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,sCAAsC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC5B,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,uCAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAA2C,EAC3C,KAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,+BAA+B,CAAC;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;QACpC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QACjC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,qCAAqC,CACzC,KAAK,EACL,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2C,EAC3C,KAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;YACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAChE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACjD,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;AACN,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAA2C,EAC3C,oBAAoB,GAAG,IAAI;IAE3B,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,EACjD,2DAA2D,CAC5D,CAAC;IACJ,8EAA8E;IAC9E,oCAAoC,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CACtD,KAAK,EACL,YAAY,EACZ,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,SAAS;YACjB,MAAM,yCAAyC,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAChB,KAAK,YAAY,wCAAwC,CAAC;QAC5D,MAAM,YAAY,GAChB,KAAK,YAAY,uCAAuC,CAAC;QAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;YAAE,MAAM,KAAK,CAAC;QAChD,IAAI,KAAK,CAAC,KAAK;YACb,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;QACJ,IACE,CAAC,KAAK,CAAC,OAAO;YACd,oBAAoB;YACpB,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,CAAC;YAEjC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA6C;IAE7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,UAAU;QAC9D,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n createPrincipalPolicyHistoryVerifier,\n KeyingVerificationError,\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyHistoryInput,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n discardPrincipalHistoryStage,\n savePrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport { validatePrincipalHistoryRecoveryAuthority } from \"./principalHistoryRecoveryAuthority\";\nimport { publishReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n PrincipalHistoryEvidenceUnavailableError,\n selectRecoveredPrincipalHistory,\n} from \"./principalHistoryRecoveryReferences\";\nimport {\n type PrincipalHistoryRecoveryStage,\n restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n PrincipalHistoryRecoveryRaceError,\n PrincipalPolicyHistoryReadError,\n type RecoveredPrincipalPolicyHistory,\n type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n assertPrincipalHistoryVerificationMode,\n principalHistoryVerificationContext,\n} from \"./principalHistoryRecoveryVerification\";\n\nclass PrincipalHistoryPrefixDisconnectedError extends Error {\n constructor(readonly verificationError: KeyingVerificationError) {\n super(verificationError.message);\n this.name = \"PrincipalHistoryPrefixDisconnectedError\";\n }\n}\n\nfunction currentArtifacts(\n page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n return {\n currentState: page.currentState,\n currentPayload: page.currentPayload,\n currentProjection: page.currentProjection,\n currentGrants: page.currentGrants,\n currentMemberEnvelopes: page.currentMemberEnvelopes,\n };\n}\n\nfunction recoveryIsCurrent(\n input: RecoverPrincipalPolicyHistoryOptions,\n): boolean {\n return !input.signal?.aborted && input.stillCurrent();\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));\n}\n\nfunction assertExpectedHead(\n current: PrincipalPolicyPageCurrent,\n expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): void {\n for (const field of [\n \"principalType\",\n \"principalId\",\n \"version\",\n \"stateHash\",\n \"keyEpoch\",\n \"keyFingerprint\",\n ] as const) {\n if (current.currentState[field] !== expectedHead[field])\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Principal history page does not match its requested head\",\n );\n }\n}\n\nasync function acceptPage(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n response: PrincipalPolicyPageResponse,\n): Promise<void> {\n const page = structuredClone(response);\n assertCurrent(input);\n assertExpectedHead(page, input.expectedHead);\n if (stage.complete) {\n if (\n page.previousStates.length !== 0 \|\|\n page.historyPage.nextAfterVersion !== null\n )\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Completed history returned additional entries\",\n );\n stage.current = currentArtifacts(page);\n return;\n }\n const complete = page.historyPage.nextAfterVersion === null;\n const current = currentArtifacts(page);\n const entries = [...page.previousStates];\n if (complete)\n entries.push({\n state: current.currentState,\n projection: current.currentProjection,\n grants: current.currentGrants,\n });\n assertPrincipalHistoryVerificationMode(input, entries);\n const keys = await collectPrincipalPolicySignerPublicKeys({\n bundle: { ...current, previousStates: page.previousStates },\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (\"error\" in keys)\n throw new KeyingVerificationError(\n keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n \"Principal history signer identity could not be authenticated\",\n );\n const externalAuthority = await input.loadExternalAuthority?.(\n entries.flatMap(({ state }) =>\n state.externalAuthority ? [state.externalAuthority] : [],\n ),\n );\n const appended = await stage.verifier.append({\n entries,\n signerPublicKeys: keys.signerPublicKeys,\n ...(externalAuthority ? { externalAuthority } : {}),\n });\n if (!appended.ok) {\n if (appended.error.code === \"stale_predecessor\")\n throw new PrincipalHistoryPrefixDisconnectedError(appended.error);\n throw appended.error;\n }\n const next = {\n id: stage.id,\n organizationId: input.organizationId,\n currentJson: JSON.stringify(current),\n afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n complete,\n };\n const protectedProgress = await stage.verifier.exportProgress(\n await principalHistoryStageProtection(\n input.protection,\n input.expectedHead,\n next,\n ),\n );\n if (!protectedProgress.ok) throw protectedProgress.error;\n const saved = { ...next, progress: protectedProgress.value };\n await savePrincipalHistoryStage({\n execSql: input.execSql,\n stage: saved,\n evidence: await preparePrincipalHistoryEvidencePage({\n scopeId: stage.scopeId,\n organizationId: input.organizationId,\n entries,\n nodes: appended.value.indexNodes,\n }),\n previousProgress: stage.saved?.progress ?? null,\n stillCurrent: () => recoveryIsCurrent(input),\n });\n stage.current = current;\n stage.saved = saved;\n stage.complete = complete;\n}\n\nasync function finishRecovery(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n checkpoint: PrincipalPolicyCheckpoint \| null,\n): Promise<RecoveredPrincipalPolicyHistory> {\n if (!stage.current \|\| !stage.complete)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history ended before its pinned head\",\n );\n const history = stage.verifier.finish(input.expectedHead);\n if (!history.ok) throw history.error;\n const selected = await selectRecoveredPrincipalHistory({\n options: input,\n scopeId: stage.scopeId,\n history: history.value,\n checkpoint,\n });\n const current = await verifyPrincipalPolicyCurrent({\n current: stage.current,\n history: selected,\n });\n if (!current.ok) throw current.error;\n verifyPrincipalPolicyCheckpoint({\n chain: current.value.retainedHistory,\n currentState: current.value.state,\n localCheckpoint: checkpoint,\n });\n const latest = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n );\n if (\n latest?.version !== checkpoint?.version \|\|\n latest?.stateHash !== checkpoint?.stateHash\n )\n throw new PrincipalHistoryRecoveryRaceError(\n \"Local principal checkpoint changed during history recovery\",\n );\n assertCurrent(input);\n if (!input.offline)\n await publishReusablePrincipalHistoryPrefix(\n input,\n stage.scopeId,\n stage.verifier,\n stage.current,\n );\n assertCurrent(input);\n return { current: stage.current, policy: current.value };\n}\n\nasync function readRecoveryPages(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n): Promise<void> {\n if (input.offline) {\n if (!stage.complete \|\| !stage.current)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Completed principal history is unavailable offline\",\n );\n assertExpectedHead(stage.current, input.expectedHead);\n return;\n }\n let receivedFinalPage = false;\n for await (const result of input.apiClient.getPrincipalPolicyPages(\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n {\n signal: input.signal,\n stateHash: input.expectedHead.stateHash,\n ...(stage.saved && stage.current\n ? {\n resume: {\n current: stage.current,\n afterVersion: stage.saved.afterVersion,\n },\n }\n : { afterVersion: stage.initialAfterVersion }),\n },\n )) {\n if (!result.ok) {\n // A rejected transport pin cannot justify skipping history on retry.\n // Discard only this operation's progress, then let a new call replay it.\n if (result.kind === \"shape\" && stage.saved)\n await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n recoveryIsCurrent(input),\n );\n throw new PrincipalPolicyHistoryReadError(result);\n }\n await acceptPage(input, stage, result.data);\n receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n }\n if (!receivedFinalPage)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history transport did not complete\",\n );\n}\n\nasync function recover(\n input: RecoverPrincipalPolicyHistoryOptions,\n allowEvidenceRebuild = true,\n): Promise<RecoveredPrincipalPolicyHistory> {\n assertCurrent(input);\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n );\n if (checkpoint && input.expectedHead.version < checkpoint.version)\n throw new KeyingVerificationError(\n input.offline ? \"missing_dependency\" : \"rollback\",\n \"Requested principal history predates the local checkpoint\",\n );\n // Validate the requested pin/selection before creating any disposable caches.\n createPrincipalPolicyHistoryVerifier({\n principalType: input.expectedHead.principalType,\n principalId: input.expectedHead.principalId,\n localCheckpoint: checkpoint,\n retainedReferences: input.retainedReferences ?? [],\n });\n const historyInput: PrincipalPolicyHistoryInput = {\n principalType: input.expectedHead.principalType,\n principalId: input.expectedHead.principalId,\n };\n const stage = await restorePrincipalHistoryRecoveryStage(\n input,\n historyInput,\n allowEvidenceRebuild,\n );\n try {\n if (stage.fromCache)\n await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);\n await readRecoveryPages(input, stage);\n return await finishRecovery(input, stage, checkpoint);\n } catch (error) {\n const lostEvidence =\n error instanceof PrincipalHistoryEvidenceUnavailableError;\n const disconnected =\n error instanceof PrincipalHistoryPrefixDisconnectedError;\n if (!lostEvidence && !disconnected) throw error;\n if (stage.saved)\n await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n recoveryIsCurrent(input),\n );\n if (\n !input.offline &&\n allowEvidenceRebuild &&\n (lostEvidence \|\| stage.fromCache)\n )\n return recover(input, false);\n throw lostEvidence \|\| disconnected ? error.verificationError : error;\n }\n}\n\n/*\n Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n * Retain organization version 1 when the result will establish founder binding.\n */\nexport async function recoverPrincipalPolicyHistory(\n options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Invalid principal history transport mode\",\n );\n if (\n !options.organizationId \|\|\n (options.expectedHead.principalType === \"organization\" &&\n options.expectedHead.principalId !== options.organizationId)\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Principal history organization scope is invalid\",\n );\n if (\n options.retainedReferences?.some(\n (reference) => reference.version > options.expectedHead.version,\n )\n )\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Requested history reference is beyond the recovery head\",\n );\n const input = {\n ...options,\n historyVerification: options.historyVerification ?? \"standard\",\n expectedHead: structuredClone(options.expectedHead),\n retainedReferences: structuredClone(options.retainedReferences ?? []),\n protection: ownPrincipalHistoryProtection(options.protection),\n };\n try {\n input.protection.context = principalHistoryVerificationContext(input);\n return await recover(input);\n } finally {\n input.protection.localKey.fill(0);\n }\n}\n"]}

package/workflows/principals/recoverProjectionPolicyHistory.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import { type ReferencedPrincipalHead, type VerifiedPrincipalPolicySelection } from "../../internal/crypto/index.js";
+import type { ProjectionPolicyEvidenceResponse } from "../../internal/validators/response/index.js";
+import type { PublicPrincipalHistoryOptions } from "./publicPrincipalHistoryTypes.js";
+export interface ProjectionPolicyHistoryRecoveryOptions extends Omit<PublicPrincipalHistoryOptions, "source" | "loadExternalAuthority" | "strictAdmins" | "authorityGroupId" | "replay"> {
+    readonly evidence: ProjectionPolicyEvidenceResponse;
+    readonly references: readonly ReferencedPrincipalHead[];
+}
+/** Public authorization only; no current-policy cache or checkpoint is written. */
+export declare function recoverProjectionPolicyHistory(input: ProjectionPolicyHistoryRecoveryOptions): Promise<VerifiedPrincipalPolicySelection[]>;

package/workflows/principals/recoverProjectionPolicyHistory.js ADDED Viewed

@@ -0,0 +1,98 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { publicProjectionDirectoryBindings } from "./publicProjectionDirectory.js";
+import { recoverPublicProjectionPrincipal, rejectPublicProjection, selectPublicProjectionPrincipal, } from "./publicProjectionPrincipal.js";
+function assertSourceCoverage(evidence, references) {
+    const sources = [evidence.organization, ...evidence.groups];
+    for (const reference of references)
+        if (!sources.some((source) => source &&
+            source.head.principalType === reference.principalType &&
+            source.head.principalId === reference.principalId &&
+            source.head.version >= reference.version))
+            rejectPublicProjection("required citation has no covering source");
+}
+async function externalAuthority(admins, references, cachedPrefix = false) {
+    const head = admins.options.source.head;
+    if (!references.length)
+        return undefined;
+    if (cachedPrefix &&
+        references.some((reference) => reference.version > head.version))
+        throw new KeyingVerificationError("missing_dependency", "Cached group history requires a newer Admins source");
+    if (references.some((reference) => reference.principalId !== head.principalId ||
+        reference.version > head.version))
+        rejectPublicProjection("external authority exceeds the bound Admins source");
+    const policies = await selectPublicProjectionPrincipal(admins, references);
+    const states = new Map(policies.flatMap((policy) =>
+    // Only this page's citations and the bound source head are authority for
+    // this verification step. A retained newer prefix is not another citation.
+    policy.retainedHistory
+        .filter(({ state }) => [head, ...references].some((reference) => principalHeadMatchesReference(state, reference)))
+        .map(({ state, projection }) => [
+        state.version,
+        {
+            head: {
+                principalType: "group",
+                principalId: state.principalId,
+                version: state.version,
+                stateHash: state.stateHash,
+                keyEpoch: state.keyEpoch,
+                keyFingerprint: state.keyFingerprint,
+            },
+            projection,
+        },
+    ])));
+    return {
+        currentHead: { ...head, principalType: "group" },
+        states: [...states.values()],
+    };
+}
+/** Public authorization only; no current-policy cache or checkpoint is written. */
+export async function recoverProjectionPolicyHistory(input) {
+    assertProjectionVerificationCurrent(() => !input.signal?.aborted && input.stillCurrent());
+    input = { ...input, references: structuredClone(input.references) };
+    const evidence = structuredClone(input.evidence);
+    assertSourceCoverage(evidence, input.references);
+    if (!evidence.organization) {
+        if (evidence.groups.length || evidence.organizationPayloads.length)
+            rejectPublicProjection("group evidence requires organization history");
+        return [];
+    }
+    if (evidence.organization.head.principalType !== "organization")
+        rejectPublicProjection("organization source has the wrong principal type");
+    const organization = await recoverPublicProjectionPrincipal({
+        ...input,
+        source: evidence.organization,
+    }, [
+        ...input.references,
+        ...evidence.organizationPayloads.map(({ reference }) => reference),
+    ]);
+    const bindings = await publicProjectionDirectoryBindings(evidence, organization);
+    const principals = new Map();
+    const adminHeads = [...bindings.values()].map(({ adminHead }) => adminHead);
+    for (const adminId of new Set(adminHeads.map((head) => head.principalId))) {
+        const source = evidence.groups.find((group) => group.head.principalId === adminId);
+        if (!source)
+            rejectPublicProjection("signed Admins source is missing");
+        principals.set(adminId, await recoverPublicProjectionPrincipal({ ...input, source, strictAdmins: true }, [...input.references, ...adminHeads]));
+    }
+    for (const source of evidence.groups) {
+        if (principals.has(source.head.principalId))
+            continue;
+        const binding = bindings.get(source.head.principalId);
+        const admins = binding && principals.get(binding.adminHead.principalId);
+        if (!admins)
+            rejectPublicProjection("verified Admins history is missing");
+        principals.set(source.head.principalId, await recoverPublicProjectionPrincipal({
+            ...input,
+            source,
+            authorityGroupId: admins.options.source.head.principalId,
+            loadExternalAuthority: (references, cachedPrefix) => externalAuthority(admins, references, cachedPrefix),
+        }, input.references));
+    }
+    const policies = [];
+    for (const principal of [organization, ...principals.values()])
+        policies.push(...(await selectPublicProjectionPrincipal(principal)));
+    return policies;
+}
+//# sourceMappingURL=recoverProjectionPolicyHistory.js.map

package/workflows/principals/recoverProjectionPolicyHistory.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"recoverProjectionPolicyHistory.js","sourceRoot":"","sources":["recoverProjectionPolicyHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAEtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAEL,gCAAgC,EAChC,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AAerC,SAAS,oBAAoB,CAC3B,QAA0C,EAC1C,UAA8C;IAE9C,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IACE,CAAC,OAAO,CAAC,IAAI,CACX,CAAC,MAAM,EAAE,EAAE,CACT,MAAM;YACN,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YACrD,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YACjD,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAC3C;YAED,sBAAsB,CAAC,0CAA0C,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAiC,EACjC,UAA8C,EAC9C,YAAY,GAAG,KAAK;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACzC,IACE,YAAY;QACZ,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAC1C,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CACnC;QAED,sBAAsB,CACpB,oDAAoD,CACrD,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IAC1B,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,CAAC,eAAe;SACnB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACpB,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD,CACF;SACA,GAAG,CACF,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CACxB;QACE,KAAK,CAAC,OAAO;QACb;YACE,IAAI,EAAE;gBACJ,aAAa,EAAE,OAAgB;gBAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;YACD,UAAU;SACX;KACO,CACb,CACJ,CACF,CAAC;IACF,OAAO;QACL,WAAW,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE;QAChD,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA6C;IAE7C,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACF,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,oBAAoB,CAAC,MAAM;YAChE,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc;QAC7D,sBAAsB,CAAC,kDAAkD,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,MAAM,gCAAgC,CACzD;QACE,GAAG,KAAK;QACR,MAAM,EAAE,QAAQ,CAAC,YAAY;KAC9B,EACD;QACE,GAAG,KAAK,CAAC,UAAU;QACnB,GAAG,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC;KACnE,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CACtD,QAAQ,EACR,YAAY,CACb,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqC,CAAC;IAChE,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,OAAO,CAC9C,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,sBAAsB,CAAC,iCAAiC,CAAC,CAAC;QACvE,UAAU,CAAC,GAAG,CACZ,OAAO,EACP,MAAM,gCAAgC,CACpC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EACxC,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,CACrC,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,sBAAsB,CAAC,oCAAoC,CAAC,CAAC;QAC1E,UAAU,CAAC,GAAG,CACZ,MAAM,CAAC,IAAI,CAAC,WAAW,EACvB,MAAM,gCAAgC,CACpC;YACE,GAAG,KAAK;YACR,MAAM;YACN,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW;YACxD,qBAAqB,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,CAClD,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC;SACtD,EACD,KAAK,CAAC,UAAU,CACjB,CACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,CAAC,YAAY,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { PublicPrincipalHistoryOptions } from \"./publicPrincipalHistoryTypes\";\nimport { publicProjectionDirectoryBindings } from \"./publicProjectionDirectory\";\nimport {\n type PublicProjectionPrincipal,\n recoverPublicProjectionPrincipal,\n rejectPublicProjection,\n selectPublicProjectionPrincipal,\n} from \"./publicProjectionPrincipal\";\n\nexport interface ProjectionPolicyHistoryRecoveryOptions\n extends Omit<\n PublicPrincipalHistoryOptions,\n | \"source\"\n | \"loadExternalAuthority\"\n | \"strictAdmins\"\n | \"authorityGroupId\"\n | \"replay\"\n > {\n readonly evidence: ProjectionPolicyEvidenceResponse;\n readonly references: readonly ReferencedPrincipalHead[];\n}\n\nfunction assertSourceCoverage(\n evidence: ProjectionPolicyEvidenceResponse,\n references: readonly ReferencedPrincipalHead[],\n): void {\n const sources = [evidence.organization, ...evidence.groups];\n for (const reference of references)\n if (\n !sources.some(\n (source) =>\n source &&\n source.head.principalType === reference.principalType &&\n source.head.principalId === reference.principalId &&\n source.head.version >= reference.version,\n )\n )\n rejectPublicProjection(\"required citation has no covering source\");\n}\n\nasync function externalAuthority(\n admins: PublicProjectionPrincipal,\n references: readonly ReferencedPrincipalHead[],\n cachedPrefix = false,\n): Promise<PrincipalPolicyExternalAuthority | undefined> {\n const head = admins.options.source.head;\n if (!references.length) return undefined;\n if (\n cachedPrefix &&\n references.some((reference) => reference.version > head.version)\n )\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Cached group history requires a newer Admins source\",\n );\n if (\n references.some(\n (reference) =>\n reference.principalId !== head.principalId ||\n reference.version > head.version,\n )\n )\n rejectPublicProjection(\n \"external authority exceeds the bound Admins source\",\n );\n const policies = await selectPublicProjectionPrincipal(admins, references);\n const states = new Map(\n policies.flatMap((policy) =>\n // Only this page's citations and the bound source head are authority for\n // this verification step. A retained newer prefix is not another citation.\n policy.retainedHistory\n .filter(({ state }) =>\n [head, ...references].some((reference) =>\n principalHeadMatchesReference(state, reference),\n ),\n )\n .map(\n ({ state, projection }) =>\n [\n state.version,\n {\n head: {\n principalType: \"group\" as const,\n principalId: state.principalId,\n version: state.version,\n stateHash: state.stateHash,\n keyEpoch: state.keyEpoch,\n keyFingerprint: state.keyFingerprint,\n },\n projection,\n },\n ] as const,\n ),\n ),\n );\n return {\n currentHead: { ...head, principalType: \"group\" },\n states: [...states.values()],\n };\n}\n\n/** Public authorization only; no current-policy cache or checkpoint is written. */\nexport async function recoverProjectionPolicyHistory(\n input: ProjectionPolicyHistoryRecoveryOptions,\n): Promise<VerifiedPrincipalPolicySelection[]> {\n assertProjectionVerificationCurrent(\n () => !input.signal?.aborted && input.stillCurrent(),\n );\n input = { ...input, references: structuredClone(input.references) };\n const evidence = structuredClone(input.evidence);\n assertSourceCoverage(evidence, input.references);\n if (!evidence.organization) {\n if (evidence.groups.length || evidence.organizationPayloads.length)\n rejectPublicProjection(\"group evidence requires organization history\");\n return [];\n }\n if (evidence.organization.head.principalType !== \"organization\")\n rejectPublicProjection(\"organization source has the wrong principal type\");\n const organization = await recoverPublicProjectionPrincipal(\n {\n ...input,\n source: evidence.organization,\n },\n [\n ...input.references,\n ...evidence.organizationPayloads.map(({ reference }) => reference),\n ],\n );\n const bindings = await publicProjectionDirectoryBindings(\n evidence,\n organization,\n );\n const principals = new Map<string, PublicProjectionPrincipal>();\n const adminHeads = [...bindings.values()].map(({ adminHead }) => adminHead);\n for (const adminId of new Set(adminHeads.map((head) => head.principalId))) {\n const source = evidence.groups.find(\n (group) => group.head.principalId === adminId,\n );\n if (!source) rejectPublicProjection(\"signed Admins source is missing\");\n principals.set(\n adminId,\n await recoverPublicProjectionPrincipal(\n { ...input, source, strictAdmins: true },\n [...input.references, ...adminHeads],\n ),\n );\n }\n for (const source of evidence.groups) {\n if (principals.has(source.head.principalId)) continue;\n const binding = bindings.get(source.head.principalId);\n const admins = binding && principals.get(binding.adminHead.principalId);\n if (!admins) rejectPublicProjection(\"verified Admins history is missing\");\n principals.set(\n source.head.principalId,\n await recoverPublicProjectionPrincipal(\n {\n ...input,\n source,\n authorityGroupId: admins.options.source.head.principalId,\n loadExternalAuthority: (references, cachedPrefix) =>\n externalAuthority(admins, references, cachedPrefix),\n },\n input.references,\n ),\n );\n }\n const policies: VerifiedPrincipalPolicySelection[] = [];\n for (const principal of [organization, ...principals.values()])\n policies.push(...(await selectPublicProjectionPrincipal(principal)));\n return policies;\n}\n"]}