@tearleads/client-sdk 0.1.14 → 0.1.16

package/workflows/principals/selectPublicPrincipalHistory.js

@@ -0,0 +1,90 @@
+import { KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, selectPrincipalPolicyAuthorization, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+async function selectBatch(input, versions, checkpointReference) {
+    const proofs = [];
+    for (const version of versions) {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        proofs.push(await loadPrincipalHistoryReference({
+            execSql: input.execSql,
+            ...input.recovered,
+            version,
+        }));
+    }
+    const selected = await verifyPrincipalPolicyHistoryReferences({
+        history: input.recovered.history,
+        references: proofs,
+        checkpointReference,
+    });
+    if (!selected.ok)
+        throw selected.error;
+    return selected.value;
+}
+async function loadCheckpointProof(input, checkpoint) {
+    let checkpointReference;
+    try {
+        if (checkpoint)
+            checkpointReference = await loadPrincipalHistoryReference({
+                execSql: input.execSql,
+                ...input.recovered,
+                version: checkpoint.version,
+            });
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw new PrincipalHistoryEvidenceUnavailableError(error);
+        throw error;
+    }
+    return checkpointReference;
+}
+/** Select bounded proof batches without admitting or advancing durable pins. */
+export async function selectPublicPrincipalHistory(input) {
+    const references = structuredClone(input.references);
+    const checkpoint = input.checkpoint && { ...input.checkpoint };
+    const head = input.recovered.history.currentEntry.state;
+    if (checkpoint && checkpoint.version > head.version)
+        throw new KeyingVerificationError("missing_dependency", "Public history cannot connect to the newer durable checkpoint");
+    if (references.some((reference) => reference.principalType !== head.principalType ||
+        reference.principalId !== head.principalId ||
+        reference.version > head.version))
+        throw new KeyingVerificationError("object_mismatch", "Public history reference is outside the verified prefix");
+    const versions = [
+        ...new Set([
+            ...(input.includeGenesis ? [1] : []),
+            ...references.map(({ version }) => version),
+            head.version,
+        ]),
+    ];
+    const policies = [];
+    const checkpointReference = await loadCheckpointProof(input, checkpoint);
+    for (let offset = 0; offset < versions.length; offset += PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT) {
+        const batch = versions.slice(offset, offset + PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT);
+        const selected = await selectBatch(input, batch, checkpointReference).catch((error) => {
+            if (error instanceof KeyingVerificationError)
+                throw new PrincipalHistoryEvidenceUnavailableError(error);
+            throw error;
+        });
+        // Authenticate the disposable proof before comparing caller citations or pins.
+        for (const reference of references.filter(({ version }) => batch.includes(version)))
+            if (!selected.retainedEntries.some(({ state }) => principalHeadMatchesReference(state, reference)))
+                throw new KeyingVerificationError("object_mismatch", "Public history citation differs from its verified entry");
+        verifyPrincipalPolicyCheckpoint({
+            chain: selected.retainedEntries.map((entry) => ({
+                ...entry,
+                projection: [...entry.projection],
+                grants: [...entry.grants],
+            })),
+            currentState: selected.currentEntry.state,
+            localCheckpoint: checkpoint,
+        });
+        const policy = await selectPrincipalPolicyAuthorization(selected);
+        if (!policy.ok)
+            throw policy.error;
+        policies.push(policy.value);
+    }
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    return policies;
+}
+//# sourceMappingURL=selectPublicPrincipalHistory.js.map

package/workflows/principals/selectPublicPrincipalHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectPublicPrincipalHistory.js","sourceRoot":"","sources":["selectPublicPrincipalHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAIlC,kCAAkC,EAElC,+BAA+B,EAC/B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAEtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAYhG,KAAK,UAAU,WAAW,CACxB,KAAkC,EAClC,QAA2B,EAC3B,mBAAqE;IAErE,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,MAAM,6BAA6B,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,KAAK,CAAC,SAAS;YAClB,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;QAChC,UAAU,EAAE,MAAM;QAClB,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkC,EAClC,UAA4C;IAE5C,IAAI,mBAAqE,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,UAAU;YACZ,mBAAmB,GAAG,MAAM,6BAA6B,CAAC;gBACxD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,KAAK,CAAC,SAAS;gBAClB,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAkC;IAElC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACxD,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;QACjD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;IACJ,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC9C,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAC1C,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CACnC;QAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC;YAC3C,IAAI,CAAC,OAAO;SACb,CAAC;KACH,CAAC;IACF,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,mBAAmB,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,KACE,IAAI,MAAM,GAAG,CAAC,EACd,MAAM,GAAG,QAAQ,CAAC,MAAM,EACxB,MAAM,IAAI,kCAAkC,EAC5C,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAC1B,MAAM,EACN,MAAM,GAAG,kCAAkC,CAC5C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC,KAAK,CACzE,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,KAAK,YAAY,uBAAuB;gBAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC,CACF,CAAC;QACF,+EAA+E;QAC/E,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CACxB;YACC,IACE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD;gBAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;QACN,+BAA+B,CAAC;YAC9B,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC9C,GAAG,KAAK;gBACR,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;gBACjC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;aAC1B,CAAC,CAAC;YACH,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;YACzC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryReferenceProof,\n  type ReferencedPrincipalHead,\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoveredPublicPrincipalHistory } from \"./publicPrincipalHistoryTypes\";\n\ninterface PublicHistorySelectionInput {\n  readonly execSql: ExecSql;\n  readonly recovered: RecoveredPublicPrincipalHistory;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly checkpoint: PrincipalPolicyCheckpoint | null;\n  readonly includeGenesis?: boolean;\n  readonly stillCurrent: () => boolean;\n}\n\nasync function selectBatch(\n  input: PublicHistorySelectionInput,\n  versions: readonly number[],\n  checkpointReference: PrincipalPolicyHistoryReferenceProof | undefined,\n) {\n  const proofs: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (const version of versions) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    proofs.push(\n      await loadPrincipalHistoryReference({\n        execSql: input.execSql,\n        ...input.recovered,\n        version,\n      }),\n    );\n  }\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history: input.recovered.history,\n    references: proofs,\n    checkpointReference,\n  });\n  if (!selected.ok) throw selected.error;\n  return selected.value;\n}\n\nasync function loadCheckpointProof(\n  input: PublicHistorySelectionInput,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<PrincipalPolicyHistoryReferenceProof | undefined> {\n  let checkpointReference: PrincipalPolicyHistoryReferenceProof | undefined;\n  try {\n    if (checkpoint)\n      checkpointReference = await loadPrincipalHistoryReference({\n        execSql: input.execSql,\n        ...input.recovered,\n        version: checkpoint.version,\n      });\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n  return checkpointReference;\n}\n\n/** Select bounded proof batches without admitting or advancing durable pins. */\nexport async function selectPublicPrincipalHistory(\n  input: PublicHistorySelectionInput,\n): Promise<VerifiedPrincipalPolicySelection[]> {\n  const references = structuredClone(input.references);\n  const checkpoint = input.checkpoint && { ...input.checkpoint };\n  const head = input.recovered.history.currentEntry.state;\n  if (checkpoint && checkpoint.version > head.version)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Public history cannot connect to the newer durable checkpoint\",\n    );\n  if (\n    references.some(\n      (reference) =>\n        reference.principalType !== head.principalType ||\n        reference.principalId !== head.principalId ||\n        reference.version > head.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history reference is outside the verified prefix\",\n    );\n  const versions = [\n    ...new Set([\n      ...(input.includeGenesis ? [1] : []),\n      ...references.map(({ version }) => version),\n      head.version,\n    ]),\n  ];\n  const policies: VerifiedPrincipalPolicySelection[] = [];\n  const checkpointReference = await loadCheckpointProof(input, checkpoint);\n  for (\n    let offset = 0;\n    offset < versions.length;\n    offset += PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  ) {\n    const batch = versions.slice(\n      offset,\n      offset + PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n    );\n    const selected = await selectBatch(input, batch, checkpointReference).catch(\n      (error: unknown) => {\n        if (error instanceof KeyingVerificationError)\n          throw new PrincipalHistoryEvidenceUnavailableError(error);\n        throw error;\n      },\n    );\n    // Authenticate the disposable proof before comparing caller citations or pins.\n    for (const reference of references.filter(({ version }) =>\n      batch.includes(version),\n    ))\n      if (\n        !selected.retainedEntries.some(({ state }) =>\n          principalHeadMatchesReference(state, reference),\n        )\n      )\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Public history citation differs from its verified entry\",\n        );\n    verifyPrincipalPolicyCheckpoint({\n      chain: selected.retainedEntries.map((entry) => ({\n        ...entry,\n        projection: [...entry.projection],\n        grants: [...entry.grants],\n      })),\n      currentState: selected.currentEntry.state,\n      localCheckpoint: checkpoint,\n    });\n    const policy = await selectPrincipalPolicyAuthorization(selected);\n    if (!policy.ok) throw policy.error;\n    policies.push(policy.value);\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return policies;\n}\n"]}

package/workflows/registration/provisioningBootstrapBuilders.d.ts

@@ -66,177 +66,45 @@ export declare function buildInitialRootProvisioning(input: {
     rootContainerProjection: {
         policyEvidence: {
             organization: {
-                currentGrants: {
-                    accessLevel: "admin" | "read" | "write";
-                    containerId: string;
-                }[];
-                currentProjection: {
-                    role: "member" | "admin";
-                    userId: string;
-                }[];
-                currentState: {
-                    createdAt: string;
-                    encapsulationPublicKey: string;
-                    externalAuthority: {
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        principalId: string;
-                        principalType: "group";
-                        stateHash: string;
-                        version: number;
-                    } | null;
-                    grantCount: number;
-                    grantRoot: string;
+                head: {
                     keyEpoch: number;
                     keyFingerprint: string;
-                    memberCount: number;
-                    memberEnvelopesRoot: string;
-                    membershipMode: "projection";
-                    membershipRoot: string;
-                    payloadCiphertextHash: string;
-                    prevStateHash: string | null;
                     principalId: string;
                     principalType: "group" | "organization";
-                    projectionRoot: string;
-                    signature: string;
-                    signedAt: string;
-                    signerUserId: string;
-                    signerUserKeyFingerprint: string;
                     stateHash: string;
                     version: number;
                 };
-                previousStates: {
-                    grants: {
-                        accessLevel: "admin" | "read" | "write";
-                        containerId: string;
-                    }[];
-                    projection: {
-                        role: "member" | "admin";
-                        userId: string;
-                    }[];
-                    state: {
-                        createdAt: string;
-                        encapsulationPublicKey: string;
-                        externalAuthority: {
-                            keyEpoch: number;
-                            keyFingerprint: string;
-                            principalId: string;
-                            principalType: "group";
-                            stateHash: string;
-                            version: number;
-                        } | null;
-                        grantCount: number;
-                        grantRoot: string;
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        memberCount: number;
-                        memberEnvelopesRoot: string;
-                        membershipMode: "projection";
-                        membershipRoot: string;
-                        payloadCiphertextHash: string;
-                        prevStateHash: string | null;
-                        principalId: string;
-                        principalType: "group" | "organization";
-                        projectionRoot: string;
-                        signature: string;
-                        signedAt: string;
-                        signerUserId: string;
-                        signerUserKeyFingerprint: string;
-                        stateHash: string;
-                        version: number;
-                    };
-                }[];
+                grant: string;
             } | null;
             organizationPayloads: {
-                cipherSuite: "aes-256-gcm";
-                ciphertext: string;
-                ciphertextHash: string;
-                createdAt: string;
-                principalId: string;
-                principalType: "group" | "organization";
-                stateHash: string;
+                reference: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group" | "organization";
+                    stateHash: string;
+                    version: number;
+                };
+                payload: {
+                    cipherSuite: "aes-256-gcm";
+                    ciphertext: string;
+                    ciphertextHash: string;
+                    createdAt: string;
+                    principalId: string;
+                    principalType: "group" | "organization";
+                    stateHash: string;
+                };
             }[];
             groups: {
-                currentGrants: {
-                    accessLevel: "admin" | "read" | "write";
-                    containerId: string;
-                }[];
-                currentProjection: {
-                    role: "member" | "admin";
-                    userId: string;
-                }[];
-                currentState: {
-                    createdAt: string;
-                    encapsulationPublicKey: string;
-                    externalAuthority: {
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        principalId: string;
-                        principalType: "group";
-                        stateHash: string;
-                        version: number;
-                    } | null;
-                    grantCount: number;
-                    grantRoot: string;
+                head: {
                     keyEpoch: number;
                     keyFingerprint: string;
-                    memberCount: number;
-                    memberEnvelopesRoot: string;
-                    membershipMode: "projection";
-                    membershipRoot: string;
-                    payloadCiphertextHash: string;
-                    prevStateHash: string | null;
                     principalId: string;
                     principalType: "group" | "organization";
-                    projectionRoot: string;
-                    signature: string;
-                    signedAt: string;
-                    signerUserId: string;
-                    signerUserKeyFingerprint: string;
                     stateHash: string;
                     version: number;
                 };
-                previousStates: {
-                    grants: {
-                        accessLevel: "admin" | "read" | "write";
-                        containerId: string;
-                    }[];
-                    projection: {
-                        role: "member" | "admin";
-                        userId: string;
-                    }[];
-                    state: {
-                        createdAt: string;
-                        encapsulationPublicKey: string;
-                        externalAuthority: {
-                            keyEpoch: number;
-                            keyFingerprint: string;
-                            principalId: string;
-                            principalType: "group";
-                            stateHash: string;
-                            version: number;
-                        } | null;
-                        grantCount: number;
-                        grantRoot: string;
-                        keyEpoch: number;
-                        keyFingerprint: string;
-                        memberCount: number;
-                        memberEnvelopesRoot: string;
-                        membershipMode: "projection";
-                        membershipRoot: string;
-                        payloadCiphertextHash: string;
-                        prevStateHash: string | null;
-                        principalId: string;
-                        principalType: "group" | "organization";
-                        projectionRoot: string;
-                        signature: string;
-                        signedAt: string;
-                        signerUserId: string;
-                        signerUserKeyFingerprint: string;
-                        stateHash: string;
-                        version: number;
-                    };
-                }[];
+                grant: string;
             }[];
         };
         containerId: string;