@tearleads/client-sdk 0.1.14 → 0.1.16

package/data/persistence/principalGrantRetirementPersistence.d.ts

@@ -1,9 +1,9 @@
-import { type AccessManifestCheckpoint, type VerifiedPrincipalPolicy } from "../../internal/crypto/index.js";
+import { type AccessManifestCheckpoint, type VerifiedPrincipalPolicy, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
 import type { ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
 export interface AcknowledgedPrincipalGrantRetirements {
     readonly containerIds: readonly string[];
     readonly organizationId: string;
-    readonly policy: VerifiedPrincipalPolicy;
+    readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
 }
-export declare function storePrincipalGrantRetirements(tx: ClientSQLiteTransactionScope, retirement: AcknowledgedPrincipalGrantRetirements, policies: readonly VerifiedPrincipalPolicy[], organizationId: string | undefined): Promise<void>;
+export declare function storePrincipalGrantRetirements(tx: ClientSQLiteTransactionScope, retirement: AcknowledgedPrincipalGrantRetirements, policies: readonly (VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent)[], organizationId: string | undefined): Promise<void>;
 export declare function assertContainerNotRetired(tx: ClientSQLiteTransactionScope, checkpoint: AccessManifestCheckpoint): Promise<void>;

package/data/persistence/principalGrantRetirementPersistence.js

@@ -7,7 +7,10 @@ export async function storePrincipalGrantRetirements(tx, retirement, policies, o
         policy.stateHash === retirement.policy.stateHash)) {
         throw new KeyingVerificationError("object_mismatch", "Retirement must accompany its acknowledged policy");
     }
-    const previous = retirement.policy.history?.find((entry) => entry.state.stateHash === retirement.policy.state.prevStateHash);
+    const history = "retainedHistory" in retirement.policy
+        ? retirement.policy.retainedHistory
+        : retirement.policy.history;
+    const previous = history?.find((entry) => entry.state.stateHash === retirement.policy.state.prevStateHash);
     const granted = new Set([...retirement.policy.grants, ...(previous?.grants ?? [])].map((grant) => grant.containerId));
     if (retirement.organizationId !== organizationId ||
         retirement.containerIds.some((id) => !granted.has(id))) {

package/data/persistence/principalGrantRetirementPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAA4C,EAC5C,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly VerifiedPrincipalPolicy[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const previous = retirement.policy.history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}
+{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAGG,EACH,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,iBAAiB,IAAI,UAAU,CAAC,MAAM;QACpC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly (\n    | VerifiedPrincipalPolicy\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const history =\n    \"retainedHistory\" in retirement.policy\n      ? retirement.policy.retainedHistory\n      : retirement.policy.history;\n  const previous = history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}

package/data/persistence/principalHistoryEvidencePersistence.d.ts

@@ -0,0 +1,30 @@
+import { type PrincipalHistoryIndexNode, type PrincipalPolicyHistoryReferenceProof, type ReferencedPrincipalHead, type VerifiedPrincipalPolicyHistory } from "../../internal/crypto/index.js";
+import { type PrincipalPolicyStateChainEntryResponse } from "../../internal/validators/response/index.js";
+import { type ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+export interface PrincipalHistoryEvidencePage {
+    readonly scopeId: string;
+    readonly organizationId: string;
+    readonly entries: readonly {
+        readonly leafHash: string;
+        readonly entryJson: string;
+    }[];
+    readonly nodes: readonly PrincipalHistoryIndexNode[];
+}
+/** Prepare only a page accepted by the signature/authorization verifier. */
+export declare function preparePrincipalHistoryEvidencePage(input: {
+    readonly scopeId: string;
+    readonly organizationId: string;
+    readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];
+    readonly nodes: readonly PrincipalHistoryIndexNode[];
+}): Promise<PrincipalHistoryEvidencePage>;
+/** Publish in the same guarded transaction as the accepted page's progress. */
+export declare function writePrincipalHistoryEvidencePage(tx: ClientSQLiteTransactionScope, page: PrincipalHistoryEvidencePage): Promise<void>;
+/** Returns untrusted material. The caller must verify it against the issued root. */
+export declare function loadPrincipalHistoryReference(input: {
+    readonly execSql: ExecSql;
+    readonly scopeId: string;
+    readonly history: VerifiedPrincipalPolicyHistory;
+    readonly version: number;
+    readonly expectedReference?: ReferencedPrincipalHead | undefined;
+}): Promise<PrincipalPolicyHistoryReferenceProof>;

package/data/persistence/principalHistoryPrefixPersistence.d.ts

@@ -0,0 +1,24 @@
+import { principalHistoryPrefixes } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+export type PrincipalHistoryPrefix = typeof principalHistoryPrefixes.$inferSelect;
+export declare function loadPrincipalHistoryPrefix(execSql: ExecSql, scopeId: string): Promise<{
+    scopeId: string;
+    organizationId: string;
+    version: number;
+    headJson: string;
+    currentJson: string;
+    progress: string;
+} | null>;
+/** Keep the newest prefix unless replay replaces the exact rejected candidate. */
+export declare function savePrincipalHistoryPrefix(input: {
+    readonly execSql: ExecSql;
+    readonly prefix: PrincipalHistoryPrefix;
+    readonly stillCurrent: () => boolean;
+    readonly rejectedPrefix?: PrincipalHistoryPrefix | null;
+}): Promise<void>;
+/** Invalid hints are disposable, but a losing reader must preserve a newer hint. */
+export declare function discardPrincipalHistoryPrefix(input: {
+    readonly execSql: ExecSql;
+    readonly prefix: PrincipalHistoryPrefix;
+    readonly stillCurrent: () => boolean;
+}): Promise<void>;

package/data/persistence/principalHistoryPrefixPersistence.js

@@ -13,9 +13,10 @@ export async function loadPrincipalHistoryPrefix(execSql, scopeId) {
         .limit(1);
     return prefix ?? null;
 }
-/** Keep one completed prefix per principal/trust scope; older readers cannot replace it. */
+/** Keep the newest prefix unless replay replaces the exact rejected candidate. */
 export async function savePrincipalHistoryPrefix(input) {
     const prefix = { ...input.prefix };
+    const rejected = input.rejectedPrefix ? { ...input.rejectedPrefix } : null;
     await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);
     const runtime = getClientSQLitePersistenceRuntime(input.execSql);
     const result = await runtime.guardedTransaction(async (tx) => {
@@ -24,7 +25,10 @@ export async function savePrincipalHistoryPrefix(input) {
             .from(principalHistoryPrefixes)
             .where(eq(principalHistoryPrefixes.scopeId, prefix.scopeId))
             .limit(1);
-        if (previous && previous.version > prefix.version)
+        if (previous &&
+            previous.version > prefix.version &&
+            !(rejected?.scopeId === previous.scopeId &&
+                rejected.progress === previous.progress))
             return;
         await tx
             .insert(principalHistoryPrefixes)

package/data/persistence/principalHistoryPrefixPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryPrefixPersistence.js","sourceRoot":"","sources":["principalHistoryPrefixPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YAAE,OAAO;QAC1D,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,MAAM,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC;YAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;YACxC,GAAG,EAAE,MAAM;SACZ,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EACpD,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CACvD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalHistoryPrefix =\n  typeof principalHistoryPrefixes.$inferSelect;\n\nexport async function loadPrincipalHistoryPrefix(\n  execSql: ExecSql,\n  scopeId: string,\n) {\n  await ensureSqlTables(execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [prefix] = await db\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, scopeId))\n    .limit(1);\n  return prefix ?? null;\n}\n\n/** Keep one completed prefix per principal/trust scope; older readers cannot replace it. */\nexport async function savePrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select()\n        .from(principalHistoryPrefixes)\n        .where(eq(principalHistoryPrefixes.scopeId, prefix.scopeId))\n        .limit(1);\n      if (previous && previous.version > prefix.version) return;\n      await tx\n        .insert(principalHistoryPrefixes)\n        .values(prefix)\n        .onConflictDoUpdate({\n          target: principalHistoryPrefixes.scopeId,\n          set: prefix,\n        })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** Invalid hints are disposable, but a losing reader must preserve a newer hint. */\nexport async function discardPrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      await tx\n        .delete(principalHistoryPrefixes)\n        .where(\n          and(\n            eq(principalHistoryPrefixes.scopeId, prefix.scopeId),\n            eq(principalHistoryPrefixes.progress, prefix.progress),\n          ),\n        )\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n"]}
+{"version":3,"file":"principalHistoryPrefixPersistence.js","sourceRoot":"","sources":["principalHistoryPrefixPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAKhD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IACE,QAAQ;YACR,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACjC,CAAC,CACC,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACtC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC;YAED,OAAO;QACT,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,MAAM,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC;YAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;YACxC,GAAG,EAAE,MAAM;SACZ,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE;aACL,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EACpD,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CACvD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalHistoryPrefix =\n  typeof principalHistoryPrefixes.$inferSelect;\n\nexport async function loadPrincipalHistoryPrefix(\n  execSql: ExecSql,\n  scopeId: string,\n) {\n  await ensureSqlTables(execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [prefix] = await db\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, scopeId))\n    .limit(1);\n  return prefix ?? null;\n}\n\n/** Keep the newest prefix unless replay replaces the exact rejected candidate. */\nexport async function savePrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n  readonly rejectedPrefix?: PrincipalHistoryPrefix | null;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  const rejected = input.rejectedPrefix ? { ...input.rejectedPrefix } : null;\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [previous] = await tx\n        .select()\n        .from(principalHistoryPrefixes)\n        .where(eq(principalHistoryPrefixes.scopeId, prefix.scopeId))\n        .limit(1);\n      if (\n        previous &&\n        previous.version > prefix.version &&\n        !(\n          rejected?.scopeId === previous.scopeId &&\n          rejected.progress === previous.progress\n        )\n      )\n        return;\n      await tx\n        .insert(principalHistoryPrefixes)\n        .values(prefix)\n        .onConflictDoUpdate({\n          target: principalHistoryPrefixes.scopeId,\n          set: prefix,\n        })\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** Invalid hints are disposable, but a losing reader must preserve a newer hint. */\nexport async function discardPrincipalHistoryPrefix(input: {\n  readonly execSql: ExecSql;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const prefix = { ...input.prefix };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      await tx\n        .delete(principalHistoryPrefixes)\n        .where(\n          and(\n            eq(principalHistoryPrefixes.scopeId, prefix.scopeId),\n            eq(principalHistoryPrefixes.progress, prefix.progress),\n          ),\n        )\n        .run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n"]}

package/data/persistence/principalHistoryStagePersistence.d.ts

@@ -0,0 +1,21 @@
+import { principalHistoryStages } from "../sqlite/principalHistoryStageSchema.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+import { type PrincipalHistoryEvidencePage } from "./principalHistoryEvidencePersistence.js";
+export type PrincipalHistoryStage = typeof principalHistoryStages.$inferSelect;
+export declare function loadPrincipalHistoryStage(execSql: ExecSql, id: string): Promise<{
+    id: string;
+    organizationId: string;
+    currentJson: string;
+    afterVersion: number;
+    complete: boolean;
+    progress: string;
+} | null>;
+/** Publish accepted entries and index nodes atomically with authenticated progress. */
+export declare function savePrincipalHistoryStage(input: {
+    readonly execSql: ExecSql;
+    readonly stage: PrincipalHistoryStage;
+    readonly evidence: PrincipalHistoryEvidencePage;
+    readonly previousProgress: string | null;
+    readonly stillCurrent: () => boolean;
+}): Promise<void>;
+export declare function discardPrincipalHistoryStage(execSql: ExecSql, stage: PrincipalHistoryStage, stillCurrent: () => boolean): Promise<void>;

package/data/persistence/principalKeyEnvelopeCandidates.js

@@ -1,6 +1,7 @@
 import { isCurrentPrincipalMemberEnvelopesResponse, } from "../../internal/validators/response/index.js";
-import { desc, eq, sql } from "drizzle-orm";
+import { and, desc, eq, sql } from "drizzle-orm";
 import { principalHistoryEvidenceTables, principalHistoryPrefixes, } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalHistoryStages } from "../sqlite/principalHistoryStageSchema.js";
 import { principalCurrentFingerprintJson, principalStateFingerprintJson, } from "../sqlite/principalKeyFingerprintJson.js";
 import { principalPolicies, principalPolicyBundleHistory, } from "../sqlite/principalPolicySchema.js";
 import { principalPolicyTables } from "../sqlite/schema.js";
@@ -41,6 +42,16 @@ export async function loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints)
             .limit(1);
         if (prefix)
             encoded.push(prefix.envelopes);
+        const [stage] = await db
+            .select({
+            envelopes: sql `json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,
+        })
+            .from(principalHistoryStages)
+            .where(and(eq(principalCurrentFingerprintJson(principalHistoryStages.currentJson), fingerprint), eq(principalHistoryStages.complete, true)))
+            .orderBy(desc(principalHistoryStages.afterVersion))
+            .limit(1);
+        if (stage)
+            encoded.push(stage.envelopes);
         for (const json of encoded) {
             let envelopes;
             try {

package/data/persistence/principalKeyEnvelopeCandidates.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}
+{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,sBAAsB,CAAC,WAAW,+BAA+B;SACxG,CAAC;aACD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,sBAAsB,CAAC,WAAW,CAAC,EACnE,WAAW,CACZ,EACD,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC1C,CACF;aACA,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;aAClD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { and, desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    const [stage] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryStages)\n      .where(\n        and(\n          eq(\n            principalCurrentFingerprintJson(principalHistoryStages.currentJson),\n            fingerprint,\n          ),\n          eq(principalHistoryStages.complete, true),\n        ),\n      )\n      .orderBy(desc(principalHistoryStages.afterVersion))\n      .limit(1);\n    if (stage) encoded.push(stage.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}

package/data/persistence/principalMutationJournalPersistence.d.ts

@@ -0,0 +1,19 @@
+import { principalMutationJournal } from "../sqlite/principalMutationJournalSchema.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+export type PrincipalMutationJournalRow = typeof principalMutationJournal.$inferSelect;
+export declare class PendingPrincipalMutationError extends Error {
+    constructor();
+}
+export declare function loadPrincipalMutationJournal(execSql: ExecSql, scopeId: string): Promise<PrincipalMutationJournalRow | null>;
+/** Claim the organization lane before dispatch; never overwrite unresolved work. */
+export declare function claimPrincipalMutationJournal(input: {
+    readonly execSql: ExecSql;
+    readonly row: PrincipalMutationJournalRow;
+    readonly stillCurrent: () => boolean;
+}): Promise<void>;
+/** A late acknowledgement cannot retire another operation's journal entry. */
+export declare function clearPrincipalMutationJournal(input: {
+    readonly execSql: ExecSql;
+    readonly row: PrincipalMutationJournalRow;
+    readonly stillCurrent: () => boolean;
+}): Promise<boolean>;

package/data/persistence/principalMutationJournalPersistence.js

@@ -0,0 +1,53 @@
+import { and, eq } from "drizzle-orm";
+import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
+import { principalMutationJournal, principalMutationJournalTables, } from "../sqlite/principalMutationJournalSchema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+export class PendingPrincipalMutationError extends Error {
+    constructor() {
+        super("Resolve the pending principal mutation or explicitly abandon its retry before submitting another");
+        this.name = "PendingPrincipalMutationError";
+    }
+}
+export async function loadPrincipalMutationJournal(execSql, scopeId) {
+    await ensureSqlTables(execSql, principalMutationJournalTables);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [row] = await db
+        .select()
+        .from(principalMutationJournal)
+        .where(eq(principalMutationJournal.scopeId, scopeId))
+        .limit(1);
+    return row ?? null;
+}
+/** Claim the organization lane before dispatch; never overwrite unresolved work. */
+export async function claimPrincipalMutationJournal(input) {
+    const row = { ...input.row };
+    await ensureSqlTables(input.execSql, principalMutationJournalTables);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const [existing] = await tx
+            .select({ scopeId: principalMutationJournal.scopeId })
+            .from(principalMutationJournal)
+            .where(eq(principalMutationJournal.scopeId, row.scopeId))
+            .limit(1);
+        if (existing)
+            throw new PendingPrincipalMutationError();
+        await tx.insert(principalMutationJournal).values(row).run();
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+}
+/** A late acknowledgement cannot retire another operation's journal entry. */
+export async function clearPrincipalMutationJournal(input) {
+    const row = { ...input.row };
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const deleted = await tx
+            .delete(principalMutationJournal)
+            .where(and(eq(principalMutationJournal.scopeId, row.scopeId), eq(principalMutationJournal.organizationId, row.organizationId), eq(principalMutationJournal.serializedRequest, row.serializedRequest), eq(principalMutationJournal.signature, row.signature)))
+            .returning({ scopeId: principalMutationJournal.scopeId });
+        return deleted.length > 0;
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+    return result.result === true;
+}
+//# sourceMappingURL=principalMutationJournalPersistence.js.map

package/data/persistence/principalMutationJournalPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalPersistence.js","sourceRoot":"","sources":["principalMutationJournalPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CACH,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;aACrD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,wBAAwB,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,EAC/D,EAAE,CACA,wBAAwB,CAAC,iBAAiB,EAC1C,GAAG,CAAC,iBAAiB,CACtB,EACD,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CACtD,CACF;aACA,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;AAChC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalMutationJournal,\n  principalMutationJournalTables,\n} from \"../sqlite/principalMutationJournalSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalMutationJournalRow =\n  typeof principalMutationJournal.$inferSelect;\n\nexport class PendingPrincipalMutationError extends Error {\n  constructor() {\n    super(\n      \"Resolve the pending principal mutation or explicitly abandon its retry before submitting another\",\n    );\n    this.name = \"PendingPrincipalMutationError\";\n  }\n}\n\nexport async function loadPrincipalMutationJournal(\n  execSql: ExecSql,\n  scopeId: string,\n): Promise<PrincipalMutationJournalRow | null> {\n  await ensureSqlTables(execSql, principalMutationJournalTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select()\n    .from(principalMutationJournal)\n    .where(eq(principalMutationJournal.scopeId, scopeId))\n    .limit(1);\n  return row ?? null;\n}\n\n/** Claim the organization lane before dispatch; never overwrite unresolved work. */\nexport async function claimPrincipalMutationJournal(input: {\n  readonly execSql: ExecSql;\n  readonly row: PrincipalMutationJournalRow;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const row = { ...input.row };\n  await ensureSqlTables(input.execSql, principalMutationJournalTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [existing] = await tx\n        .select({ scopeId: principalMutationJournal.scopeId })\n        .from(principalMutationJournal)\n        .where(eq(principalMutationJournal.scopeId, row.scopeId))\n        .limit(1);\n      if (existing) throw new PendingPrincipalMutationError();\n      await tx.insert(principalMutationJournal).values(row).run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** A late acknowledgement cannot retire another operation's journal entry. */\nexport async function clearPrincipalMutationJournal(input: {\n  readonly execSql: ExecSql;\n  readonly row: PrincipalMutationJournalRow;\n  readonly stillCurrent: () => boolean;\n}): Promise<boolean> {\n  const row = { ...input.row };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const deleted = await tx\n        .delete(principalMutationJournal)\n        .where(\n          and(\n            eq(principalMutationJournal.scopeId, row.scopeId),\n            eq(principalMutationJournal.organizationId, row.organizationId),\n            eq(\n              principalMutationJournal.serializedRequest,\n              row.serializedRequest,\n            ),\n            eq(principalMutationJournal.signature, row.signature),\n          ),\n        )\n        .returning({ scopeId: principalMutationJournal.scopeId });\n      return deleted.length > 0;\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n  return result.result === true;\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyBundle.js

@@ -1,55 +1,8 @@
-import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
 import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
-function bundleMismatch(message) {
-    throw new KeyingVerificationError("equivocation", message);
-}
-async function memberEnvelopesRoot(bundle) {
-    try {
-        return await computePrincipalMemberEnvelopesRoot(bundle.currentMemberEnvelopes.envelopes);
-    }
-    catch (error) {
-        if (error instanceof PrincipalMemberEnvelopeValidationError) {
-            throw new KeyingVerificationError("invalid_shape", error.message);
-        }
-        throw error;
-    }
-}
-async function assertBundlePayloadMatches(input) {
-    const { bundle, policy } = input;
-    const payloadHash = await computePrincipalStatePayloadCiphertextHash(bundle.currentPayload.ciphertext);
-    const envelopesRoot = await memberEnvelopesRoot(bundle);
-    if (bundle.currentPayload.principalType !== policy.principalType ||
-        bundle.currentPayload.principalId !== policy.principalId ||
-        bundle.currentPayload.stateHash !== policy.stateHash ||
-        bundle.currentPayload.ciphertextHash !== payloadHash ||
-        policy.state.payloadCiphertextHash !== payloadHash ||
-        bundle.currentMemberEnvelopes.principalType !== policy.principalType ||
-        bundle.currentMemberEnvelopes.principalId !== policy.principalId ||
-        bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||
-        bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
-        envelopesRoot !== policy.state.memberEnvelopesRoot) {
-        bundleMismatch("Verified principal policy bundle payload mismatch");
-    }
-}
+import { assertCurrentMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyCurrent.js";
 export async function assertBundleMatchesVerifiedPolicy(input) {
     const { bundle, policy } = input;
-    if (bundle.currentState.principalType !== policy.principalType ||
-        bundle.currentState.principalId !== policy.principalId ||
-        bundle.currentState.version !== policy.version ||
-        bundle.currentState.keyEpoch !== policy.keyEpoch ||
-        bundle.currentState.stateHash !== policy.stateHash ||
-        policy.checkpoint.version !== policy.version ||
-        policy.checkpoint.stateHash !== policy.stateHash) {
-        bundleMismatch("Verified principal policy bundle head mismatch");
-    }
-    if (canonicalKeyingJsonString(bundle.currentState, "principal policy bundle state") !==
-        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
-        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(bundle.currentProjection), "principal policy bundle projection") !==
-            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
-        canonicalKeyingJsonString(normalizePrincipalContainerGrants(bundle.currentGrants), "principal policy bundle grants") !==
-            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
-        bundleMismatch("Verified principal policy bundle content mismatch");
-    }
     const history = policy.history ?? [];
     const expectedChain = [
         ...bundle.previousStates,
@@ -70,8 +23,11 @@ export async function assertBundleMatchesVerifiedPolicy(input) {
     }));
     if (canonicalKeyingJsonString(expectedChain, "principal policy bundle history") !==
         canonicalKeyingJsonString(verifiedHistory, "verified principal policy history")) {
-        bundleMismatch("Verified principal policy bundle history mismatch");
+        throw new KeyingVerificationError("equivocation", "Verified principal policy bundle history mismatch");
     }
-    await assertBundlePayloadMatches(input);
+    await assertCurrentMatchesVerifiedPolicy({
+        current: input.bundle,
+        policy: input.policy,
+    });
 }
 //# sourceMappingURL=verifiedPrincipalPolicyBundle.js.map

package/data/persistence/verifiedPrincipalPolicyBundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,IACE,MAAM,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC5D,MAAM,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACxD,MAAM,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACpD,MAAM,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACpD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,MAAM,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACpE,MAAM,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAChE,MAAM,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC5D,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACvD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC1D,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACtD,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC9C,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAChD,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAClD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,IACE,yBAAyB,CACvB,MAAM,CAAC,YAAY,EACnB,+BAA+B,CAChC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC7D,oCAAoC,CACrC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,aAAa,CAAC,EACvD,gCAAgC,CACjC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["import {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\n\nfunction bundleMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      bundle.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertBundlePayloadMatches(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    bundle.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(bundle);\n  if (\n    bundle.currentPayload.principalType !== policy.principalType ||\n    bundle.currentPayload.principalId !== policy.principalId ||\n    bundle.currentPayload.stateHash !== policy.stateHash ||\n    bundle.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    bundle.currentMemberEnvelopes.principalType !== policy.principalType ||\n    bundle.currentMemberEnvelopes.principalId !== policy.principalId ||\n    bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    bundleMismatch(\"Verified principal policy bundle payload mismatch\");\n  }\n}\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  if (\n    bundle.currentState.principalType !== policy.principalType ||\n    bundle.currentState.principalId !== policy.principalId ||\n    bundle.currentState.version !== policy.version ||\n    bundle.currentState.keyEpoch !== policy.keyEpoch ||\n    bundle.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    bundleMismatch(\"Verified principal policy bundle head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      bundle.currentState,\n      \"principal policy bundle state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(bundle.currentProjection),\n      \"principal policy bundle projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(bundle.currentGrants),\n      \"principal policy bundle grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle content mismatch\");\n  }\n\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle history mismatch\");\n  }\n  await assertBundlePayloadMatches(input);\n}\n"]}
+{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyCurrent\";\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Verified principal policy bundle history mismatch\",\n    );\n  }\n  await assertCurrentMatchesVerifiedPolicy({\n    current: input.bundle,\n    policy: input.policy,\n  });\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyCurrent.js

@@ -0,0 +1,56 @@
+import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+function currentMismatch(message) {
+    throw new KeyingVerificationError("equivocation", message);
+}
+async function memberEnvelopesRoot(current) {
+    try {
+        return await computePrincipalMemberEnvelopesRoot(current.currentMemberEnvelopes.envelopes);
+    }
+    catch (error) {
+        if (error instanceof PrincipalMemberEnvelopeValidationError) {
+            throw new KeyingVerificationError("invalid_shape", error.message);
+        }
+        throw error;
+    }
+}
+async function assertCurrentPayloadMatches(input) {
+    const { current, policy } = input;
+    const payloadHash = await computePrincipalStatePayloadCiphertextHash(current.currentPayload.ciphertext);
+    const envelopesRoot = await memberEnvelopesRoot(current);
+    if (current.currentPayload.principalType !== policy.principalType ||
+        current.currentPayload.principalId !== policy.principalId ||
+        current.currentPayload.stateHash !== policy.stateHash ||
+        current.currentPayload.ciphertextHash !== payloadHash ||
+        policy.state.payloadCiphertextHash !== payloadHash ||
+        current.currentMemberEnvelopes.principalType !== policy.principalType ||
+        current.currentMemberEnvelopes.principalId !== policy.principalId ||
+        current.currentMemberEnvelopes.stateHash !== policy.stateHash ||
+        current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
+        envelopesRoot !== policy.state.memberEnvelopesRoot) {
+        currentMismatch("Verified principal policy current payload mismatch");
+    }
+}
+/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */
+export async function assertCurrentMatchesVerifiedPolicy(input) {
+    const { current, policy } = input;
+    if (current.currentState.principalType !== policy.principalType ||
+        current.currentState.principalId !== policy.principalId ||
+        current.currentState.version !== policy.version ||
+        current.currentState.keyEpoch !== policy.keyEpoch ||
+        current.currentState.stateHash !== policy.stateHash ||
+        policy.checkpoint.version !== policy.version ||
+        policy.checkpoint.stateHash !== policy.stateHash) {
+        currentMismatch("Verified principal policy current head mismatch");
+    }
+    if (canonicalKeyingJsonString(current.currentState, "principal policy current state") !==
+        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
+        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(current.currentProjection), "principal policy current projection") !==
+            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
+        canonicalKeyingJsonString(normalizePrincipalContainerGrants(current.currentGrants), "principal policy current grants") !==
+            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
+        currentMismatch("Verified principal policy current content mismatch");
+    }
+    await assertCurrentPayloadMatches(input);
+}
+//# sourceMappingURL=verifiedPrincipalPolicyCurrent.js.map

package/data/persistence/verifiedPrincipalPolicyCurrent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyCurrent.js","sourceRoot":"","sources":["verifiedPrincipalPolicyCurrent.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAGvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAMnE,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAmC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,OAAO,CAAC,sBAAsB,CAAC,SAAS,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAG1C;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,OAAO,CAAC,cAAc,CAAC,UAAU,CAClC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzD,IACE,OAAO,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC7D,OAAO,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACzD,OAAO,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACrD,OAAO,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACrD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,OAAO,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACrE,OAAO,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACjE,OAAO,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC7D,OAAO,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACxD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,IACE,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC3D,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACvD,OAAO,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/C,OAAO,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACjD,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACnD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,eAAe,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,yBAAyB,CACvB,OAAO,CAAC,YAAY,EACpB,gCAAgC,CACjC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9D,qCAAqC,CACtC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,OAAO,CAAC,aAAa,CAAC,EACxD,iCAAiC,CAClC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\n\ntype VerifiedCurrentPolicy =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nfunction currentMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  current: PrincipalPolicyPageCurrent,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      current.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertCurrentPayloadMatches(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    current.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(current);\n  if (\n    current.currentPayload.principalType !== policy.principalType ||\n    current.currentPayload.principalId !== policy.principalId ||\n    current.currentPayload.stateHash !== policy.stateHash ||\n    current.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    current.currentMemberEnvelopes.principalType !== policy.principalType ||\n    current.currentMemberEnvelopes.principalId !== policy.principalId ||\n    current.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    currentMismatch(\"Verified principal policy current payload mismatch\");\n  }\n}\n\n/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */\nexport async function assertCurrentMatchesVerifiedPolicy(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  if (\n    current.currentState.principalType !== policy.principalType ||\n    current.currentState.principalId !== policy.principalId ||\n    current.currentState.version !== policy.version ||\n    current.currentState.keyEpoch !== policy.keyEpoch ||\n    current.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    currentMismatch(\"Verified principal policy current head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      current.currentState,\n      \"principal policy current state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(current.currentProjection),\n      \"principal policy current projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(current.currentGrants),\n      \"principal policy current grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    currentMismatch(\"Verified principal policy current content mismatch\");\n  }\n\n  await assertCurrentPayloadMatches(input);\n}\n"]}

package/data/principals/principalHistoryRuntime.js

@@ -0,0 +1,12 @@
+const leases = new WeakMap();
+/** Internal workflow adapters carry custody without exposing it on public views. */
+export function readPrincipalHistoryProtection(runtime) {
+    return leases.get(runtime) ?? runtime.withPrincipalHistoryProtection;
+}
+export function inheritPrincipalHistoryProtection(source, target) {
+    const lease = readPrincipalHistoryProtection(source);
+    if (lease)
+        leases.set(target, lease);
+    return target;
+}
+//# sourceMappingURL=principalHistoryRuntime.js.map

package/data/principals/principalHistoryRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryRuntime.js","sourceRoot":"","sources":["principalHistoryRuntime.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAG,IAAI,OAAO,EAA2C,CAAC;AAEtE,oFAAoF;AACpF,MAAM,UAAU,8BAA8B,CAC5C,OAIC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,8BAA8B,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAc,EACd,MAAS;IAET,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { PrincipalHistoryProtectionLease } from \"./principalHistoryProtection\";\n\nconst leases = new WeakMap<object, PrincipalHistoryProtectionLease>();\n\n/** Internal workflow adapters carry custody without exposing it on public views. */\nexport function readPrincipalHistoryProtection(\n  runtime: object & {\n    readonly withPrincipalHistoryProtection?:\n      | PrincipalHistoryProtectionLease\n      | undefined;\n  },\n) {\n  return leases.get(runtime) ?? runtime.withPrincipalHistoryProtection;\n}\n\nexport function inheritPrincipalHistoryProtection<T extends object>(\n  source: object,\n  target: T,\n): T {\n  const lease = readPrincipalHistoryProtection(source);\n  if (lease) leases.set(target, lease);\n  return target;\n}\n"]}

package/data/principals/principalHistoryStageProtection.js

@@ -1,8 +1,8 @@
 import { serializeKeyingCanonicalJson, toFingerprint, } from "../../internal/crypto/index.js";
 import { isPrincipalPolicyPageResponse } from "../../internal/validators/response/index.js";
-export function principalHistoryStageId(organizationId, head, context, retainedReferences) {
+export function principalHistoryStageId(organizationId, head, context) {
     return toFingerprint(new TextEncoder().encode(serializeKeyingCanonicalJson([
-        "tearleads.sdk.principal-history-stage.v1",
+        "tearleads.sdk.principal-history-stage.v2",
         organizationId,
         head.principalType,
         head.principalId,
@@ -11,16 +11,6 @@ export function principalHistoryStageId(organizationId, head, context, retainedR
         head.stateHash,
         head.keyFingerprint,
         context,
-        [...retainedReferences]
-            .sort((a, b) => a.version - b.version)
-            .map((reference) => [
-            reference.principalType,
-            reference.principalId,
-            reference.version,
-            reference.keyEpoch,
-            reference.stateHash,
-            reference.keyFingerprint,
-        ]),
     ])));
 }
 export async function principalHistoryStageProtection(protection, expectedHead, stage) {

package/data/principals/principalHistoryStageProtection.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryStageProtection.js","sourceRoot":"","sources":["principalHistoryStageProtection.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAG/E,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,IAA6B,EAC7B,OAAe,EACf,kBAAsD;IAEtD,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,0CAA0C;QAC1C,cAAc;QACd,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc;QACnB,OAAO;QACP,CAAC,GAAG,kBAAkB,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAClB,SAAS,CAAC,aAAa;YACvB,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,OAAO;YACjB,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,SAAS;YACnB,SAAS,CAAC,cAAc;SACzB,CAAC;KACL,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAiD,EACjD,YAAqC,EACrC,KAA8C;IAE9C,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAkE;IAElE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;KAC1E,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO;QAE/C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryStage } from \"../persistence/principalHistoryStagePersistence\";\n\nexport function principalHistoryStageId(\n  organizationId: string,\n  head: ReferencedPrincipalHead,\n  context: string,\n  retainedReferences: readonly ReferencedPrincipalHead[],\n) {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-stage.v1\",\n        organizationId,\n        head.principalType,\n        head.principalId,\n        head.version,\n        head.keyEpoch,\n        head.stateHash,\n        head.keyFingerprint,\n        context,\n        [...retainedReferences]\n          .sort((a, b) => a.version - b.version)\n          .map((reference) => [\n            reference.principalType,\n            reference.principalId,\n            reference.version,\n            reference.keyEpoch,\n            reference.stateHash,\n            reference.keyFingerprint,\n          ]),\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryStageProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  expectedHead: ReferencedPrincipalHead,\n  stage: Omit<PrincipalHistoryStage, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-stage.v1\",\n      context: protection.context,\n      id: stage.id,\n      organizationId: stage.organizationId,\n      expectedHead: { ...expectedHead },\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(stage.currentJson),\n      ),\n    }),\n  };\n}\n\nexport function parsePrincipalHistoryStageCurrent(\n  stage: Pick<PrincipalHistoryStage, \"currentJson\" | \"afterVersion\">,\n): PrincipalPolicyPageCurrent | null {\n  let current: unknown;\n  try {\n    current = JSON.parse(stage.currentJson);\n  } catch {\n    return null;\n  }\n  if (!current || typeof current !== \"object\" || Array.isArray(current))\n    return null;\n  const page = {\n    ...current,\n    previousStates: [],\n    historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },\n  };\n  if (\n    !isPrincipalPolicyPageResponse(page) ||\n    stage.afterVersion >= page.currentState.version\n  )\n    return null;\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n"]}
+{"version":3,"file":"principalHistoryStageProtection.js","sourceRoot":"","sources":["principalHistoryStageProtection.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAG/E,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,IAA6B,EAC7B,OAAe;IAEf,OAAO,aAAa,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,4BAA4B,CAAC;QAC3B,0CAA0C;QAC1C,cAAc;QACd,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,cAAc;QACnB,OAAO;KACR,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAiD,EACjD,YAAqC,EACrC,KAA8C;IAE9C,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,aAAa,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAkE;IAElE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;KAC1E,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO;QAE/C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryProgressOptions,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryStage } from \"../persistence/principalHistoryStagePersistence\";\n\nexport function principalHistoryStageId(\n  organizationId: string,\n  head: ReferencedPrincipalHead,\n  context: string,\n) {\n  return toFingerprint(\n    new TextEncoder().encode(\n      serializeKeyingCanonicalJson([\n        \"tearleads.sdk.principal-history-stage.v2\",\n        organizationId,\n        head.principalType,\n        head.principalId,\n        head.version,\n        head.keyEpoch,\n        head.stateHash,\n        head.keyFingerprint,\n        context,\n      ]),\n    ),\n  );\n}\n\nexport async function principalHistoryStageProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  expectedHead: ReferencedPrincipalHead,\n  stage: Omit<PrincipalHistoryStage, \"progress\">,\n): Promise<PrincipalPolicyHistoryProgressOptions> {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson({\n      domain: \"tearleads.sdk.principal-history-stage.v1\",\n      context: protection.context,\n      id: stage.id,\n      organizationId: stage.organizationId,\n      expectedHead: { ...expectedHead },\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      currentDigest: await toFingerprint(\n        new TextEncoder().encode(stage.currentJson),\n      ),\n    }),\n  };\n}\n\nexport function parsePrincipalHistoryStageCurrent(\n  stage: Pick<PrincipalHistoryStage, \"currentJson\" | \"afterVersion\">,\n): PrincipalPolicyPageCurrent | null {\n  let current: unknown;\n  try {\n    current = JSON.parse(stage.currentJson);\n  } catch {\n    return null;\n  }\n  if (!current || typeof current !== \"object\" || Array.isArray(current))\n    return null;\n  const page = {\n    ...current,\n    previousStates: [],\n    historyPage: { afterVersion: stage.afterVersion, nextAfterVersion: null },\n  };\n  if (\n    !isPrincipalPolicyPageResponse(page) ||\n    stage.afterVersion >= page.currentState.version\n  )\n    return null;\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n"]}