@tearleads/client-sdk 0.1.14 → 0.1.16

package/data/principals/principalMutationJournal.d.ts

@@ -0,0 +1,26 @@
+import { type SigningKeyPair } from "../../internal/crypto/index.js";
+import { type CommitOrganizationGroupPolicyRequest } from "../../internal/validators/request/index.js";
+import type { PrincipalMutationJournalRow } from "../persistence/principalMutationJournalPersistence.js";
+export interface PrincipalMutationJournalScope {
+    readonly identityTrustDomain: string;
+    readonly organizationId: string;
+    readonly userId: string;
+    readonly signingFingerprint: string;
+}
+export interface AuthoredPrincipalMutation {
+    readonly groupId: string;
+    readonly request: CommitOrganizationGroupPolicyRequest;
+}
+export declare function principalMutationJournalScopeId(scope: PrincipalMutationJournalScope): Promise<string>;
+/** Sign the complete wire body, including artifacts outside policy signatures. */
+export declare function sealPrincipalMutation(input: {
+    readonly scope: PrincipalMutationJournalScope;
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<PrincipalMutationJournalRow>;
+/** Authentication precedes parsing or submission; corrupt authored work is retained. */
+export declare function openPrincipalMutation(input: {
+    readonly scope: PrincipalMutationJournalScope;
+    readonly row: PrincipalMutationJournalRow;
+    readonly signingPublicKey: Uint8Array;
+}): Promise<AuthoredPrincipalMutation>;

package/data/principals/principalMutationJournal.js

@@ -0,0 +1,90 @@
+import { KeyingVerificationError, sign, toFingerprint, verify, } from "../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { CommitOrganizationGroupPolicyRequestSchema, } from "../../internal/validators/request/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+const journalDomain = "tearleads.sdk.principal-mutation.v1";
+const encoder = new TextEncoder();
+function scopeJson(scope) {
+    const values = [
+        scope.identityTrustDomain,
+        scope.organizationId,
+        scope.userId,
+        scope.signingFingerprint,
+    ];
+    if (values.some((value) => typeof value !== "string" || value.length === 0))
+        throw new Error("Principal mutation journal requires a complete scope");
+    return JSON.stringify([journalDomain, ...values]);
+}
+export async function principalMutationJournalScopeId(scope) {
+    return bytesToBase64(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(scopeJson(scope)))));
+}
+function readMutation(value, scope) {
+    if (typeof value !== "object" || value === null)
+        throw new Error("Principal mutation journal payload is invalid");
+    const groupId = Reflect.get(value, "groupId");
+    const request = CommitOrganizationGroupPolicyRequestSchema.parse(Reflect.get(value, "request"));
+    const group = request.groupPolicy.state;
+    const organization = request.organizationPolicy.state;
+    if (typeof groupId !== "string" ||
+        group.principalType !== "group" ||
+        group.principalId !== groupId ||
+        organization.principalType !== "organization" ||
+        organization.principalId !== scope.organizationId ||
+        [group, organization].some((state) => state.signerUserId !== scope.userId ||
+            state.signerUserKeyFingerprint !== scope.signingFingerprint))
+        throw new Error("Principal mutation journal target or signer differs");
+    return { groupId, request };
+}
+function signedBytes(scope, request) {
+    // The domain-tagged scope and JSON tuple separate these identity-key
+    // signatures from policy state signatures and other authored formats.
+    return encoder.encode(JSON.stringify([scopeJson(scope), request]));
+}
+/** Sign the complete wire body, including artifacts outside policy signatures. */
+export async function sealPrincipalMutation(input) {
+    const scope = { ...input.scope };
+    const mutation = readMutation(JSON.parse(JSON.stringify(input.mutation)), scope);
+    const serializedRequest = canonicalKeyingJsonString(mutation, "authored principal mutation");
+    const publicKey = new Uint8Array(input.signingKeyPair.signingPublicKey);
+    const privateKey = new Uint8Array(input.signingKeyPair.signingPrivateKey);
+    try {
+        if ((await toFingerprint(publicKey)) !== scope.signingFingerprint)
+            throw new Error("Principal mutation journal signing key differs");
+        const bytes = signedBytes(scope, serializedRequest);
+        const signature = sign(bytes, privateKey);
+        if (!verify(signature, bytes, publicKey))
+            throw new KeyingVerificationError("signer_mismatch", "Principal mutation journal signing key pair differs");
+        return {
+            scopeId: await principalMutationJournalScopeId(scope),
+            organizationId: scope.organizationId,
+            serializedRequest,
+            signature: bytesToBase64(signature),
+        };
+    }
+    finally {
+        privateKey.fill(0);
+    }
+}
+/** Authentication precedes parsing or submission; corrupt authored work is retained. */
+export async function openPrincipalMutation(input) {
+    const scope = { ...input.scope };
+    const row = { ...input.row };
+    const publicKey = new Uint8Array(input.signingPublicKey);
+    try {
+        if (row.organizationId !== scope.organizationId ||
+            row.scopeId !== (await principalMutationJournalScopeId(scope)) ||
+            (await toFingerprint(publicKey)) !== scope.signingFingerprint ||
+            !verify(base64ToBytes(row.signature), signedBytes(scope, row.serializedRequest), publicKey))
+            throw new Error("Principal mutation journal authentication failed");
+    }
+    catch {
+        throw new KeyingVerificationError("signature_mismatch", "Saved principal mutation could not be authenticated");
+    }
+    try {
+        return readMutation(JSON.parse(row.serializedRequest), scope);
+    }
+    catch {
+        throw new KeyingVerificationError("invalid_shape", "Authenticated principal mutation has an unsupported or invalid format");
+    }
+}
+//# sourceMappingURL=principalMutationJournal.js.map

package/data/principals/principalMutationJournal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournal.js","sourceRoot":"","sources":["principalMutationJournal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,IAAI,EACJ,aAAa,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAEL,0CAA0C,GAC3C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAenE,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,SAAS,CAAC,KAAoC;IACrD,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,kBAAkB;KACzB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAoC;IAEpC,OAAO,aAAa,CAClB,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,KAAoC;IAEpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,0CAA0C,CAAC,KAAK,CAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAC9B,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACtD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,KAAK,CAAC,WAAW,KAAK,OAAO;QAC7B,YAAY,CAAC,aAAa,KAAK,cAAc;QAC7C,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;QACjD,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,IAAI,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;YACnC,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,kBAAkB,CAC9D;QAED,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC,EAAE,OAAe;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,YAAY,CAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC1C,KAAK,CACN,CAAC;IACF,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,QAAQ,EACR,6BAA6B,CAC9B,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;YACtC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;QACJ,OAAO;YACL,OAAO,EAAE,MAAM,+BAA+B,CAAC,KAAK,CAAC;YACrD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB;YACjB,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;SACpC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,IACE,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC3C,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAC7D,CAAC,MAAM,CACL,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAC5B,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,iBAAiB,CAAC,EACzC,SAAS,CACV;YAED,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,uEAAuE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type SigningKeyPair,\n  sign,\n  toFingerprint,\n  verify,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  type CommitOrganizationGroupPolicyRequest,\n  CommitOrganizationGroupPolicyRequestSchema,\n} from \"@tearleads/validators/request\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport type { PrincipalMutationJournalRow } from \"../persistence/principalMutationJournalPersistence\";\n\nexport interface PrincipalMutationJournalScope {\n  readonly identityTrustDomain: string;\n  readonly organizationId: string;\n  readonly userId: string;\n  readonly signingFingerprint: string;\n}\n\nexport interface AuthoredPrincipalMutation {\n  readonly groupId: string;\n  readonly request: CommitOrganizationGroupPolicyRequest;\n}\n\nconst journalDomain = \"tearleads.sdk.principal-mutation.v1\";\nconst encoder = new TextEncoder();\n\nfunction scopeJson(scope: PrincipalMutationJournalScope): string {\n  const values = [\n    scope.identityTrustDomain,\n    scope.organizationId,\n    scope.userId,\n    scope.signingFingerprint,\n  ];\n  if (values.some((value) => typeof value !== \"string\" || value.length === 0))\n    throw new Error(\"Principal mutation journal requires a complete scope\");\n  return JSON.stringify([journalDomain, ...values]);\n}\n\nexport async function principalMutationJournalScopeId(\n  scope: PrincipalMutationJournalScope,\n): Promise<string> {\n  return bytesToBase64(\n    new Uint8Array(\n      await crypto.subtle.digest(\"SHA-256\", encoder.encode(scopeJson(scope))),\n    ),\n  );\n}\n\nfunction readMutation(\n  value: unknown,\n  scope: PrincipalMutationJournalScope,\n): AuthoredPrincipalMutation {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Principal mutation journal payload is invalid\");\n  const groupId: unknown = Reflect.get(value, \"groupId\");\n  const request = CommitOrganizationGroupPolicyRequestSchema.parse(\n    Reflect.get(value, \"request\"),\n  );\n  const group = request.groupPolicy.state;\n  const organization = request.organizationPolicy.state;\n  if (\n    typeof groupId !== \"string\" ||\n    group.principalType !== \"group\" ||\n    group.principalId !== groupId ||\n    organization.principalType !== \"organization\" ||\n    organization.principalId !== scope.organizationId ||\n    [group, organization].some(\n      (state) =>\n        state.signerUserId !== scope.userId ||\n        state.signerUserKeyFingerprint !== scope.signingFingerprint,\n    )\n  )\n    throw new Error(\"Principal mutation journal target or signer differs\");\n  return { groupId, request };\n}\n\nfunction signedBytes(scope: PrincipalMutationJournalScope, request: string) {\n  // The domain-tagged scope and JSON tuple separate these identity-key\n  // signatures from policy state signatures and other authored formats.\n  return encoder.encode(JSON.stringify([scopeJson(scope), request]));\n}\n\n/** Sign the complete wire body, including artifacts outside policy signatures. */\nexport async function sealPrincipalMutation(input: {\n  readonly scope: PrincipalMutationJournalScope;\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalMutationJournalRow> {\n  const scope = { ...input.scope };\n  const mutation = readMutation(\n    JSON.parse(JSON.stringify(input.mutation)),\n    scope,\n  );\n  const serializedRequest = canonicalKeyingJsonString(\n    mutation,\n    \"authored principal mutation\",\n  );\n  const publicKey = new Uint8Array(input.signingKeyPair.signingPublicKey);\n  const privateKey = new Uint8Array(input.signingKeyPair.signingPrivateKey);\n  try {\n    if ((await toFingerprint(publicKey)) !== scope.signingFingerprint)\n      throw new Error(\"Principal mutation journal signing key differs\");\n    const bytes = signedBytes(scope, serializedRequest);\n    const signature = sign(bytes, privateKey);\n    if (!verify(signature, bytes, publicKey))\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        \"Principal mutation journal signing key pair differs\",\n      );\n    return {\n      scopeId: await principalMutationJournalScopeId(scope),\n      organizationId: scope.organizationId,\n      serializedRequest,\n      signature: bytesToBase64(signature),\n    };\n  } finally {\n    privateKey.fill(0);\n  }\n}\n\n/** Authentication precedes parsing or submission; corrupt authored work is retained. */\nexport async function openPrincipalMutation(input: {\n  readonly scope: PrincipalMutationJournalScope;\n  readonly row: PrincipalMutationJournalRow;\n  readonly signingPublicKey: Uint8Array;\n}): Promise<AuthoredPrincipalMutation> {\n  const scope = { ...input.scope };\n  const row = { ...input.row };\n  const publicKey = new Uint8Array(input.signingPublicKey);\n  try {\n    if (\n      row.organizationId !== scope.organizationId ||\n      row.scopeId !== (await principalMutationJournalScopeId(scope)) ||\n      (await toFingerprint(publicKey)) !== scope.signingFingerprint ||\n      !verify(\n        base64ToBytes(row.signature),\n        signedBytes(scope, row.serializedRequest),\n        publicKey,\n      )\n    )\n      throw new Error(\"Principal mutation journal authentication failed\");\n  } catch {\n    throw new KeyingVerificationError(\n      \"signature_mismatch\",\n      \"Saved principal mutation could not be authenticated\",\n    );\n  }\n  try {\n    return readMutation(JSON.parse(row.serializedRequest), scope);\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Authenticated principal mutation has an unsupported or invalid format\",\n    );\n  }\n}\n"]}

package/data/principals/principalMutationJournalRecord.d.ts

@@ -0,0 +1,8 @@
+import type { PrincipalMutationJournalRow } from "../persistence/principalMutationJournalPersistence.js";
+/** Identifies exact local bytes for an acknowledged discard, never for replay. */
+export declare function principalMutationJournalRecordId(row: PrincipalMutationJournalRow): Promise<string>;
+export declare class UnreadablePrincipalMutationError extends Error {
+    readonly recordId: string;
+    readonly reason: "authentication" | "format";
+    constructor(recordId: string, reason: "authentication" | "format");
+}

package/data/principals/principalMutationJournalRecord.js

@@ -0,0 +1,25 @@
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+/** Identifies exact local bytes for an acknowledged discard, never for replay. */
+export async function principalMutationJournalRecordId(row) {
+    const bytes = new TextEncoder().encode(JSON.stringify([
+        "tearleads.sdk.unreadable-principal-mutation.v1",
+        row.scopeId,
+        row.organizationId,
+        row.serializedRequest,
+        row.signature,
+    ]));
+    return bytesToBase64(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+export class UnreadablePrincipalMutationError extends Error {
+    recordId;
+    reason;
+    constructor(recordId, reason) {
+        super(reason === "authentication"
+            ? "Saved principal mutation could not be authenticated"
+            : "Saved principal mutation has an unsupported or invalid format");
+        this.recordId = recordId;
+        this.reason = reason;
+        this.name = "UnreadablePrincipalMutationError";
+    }
+}
+//# sourceMappingURL=principalMutationJournalRecord.js.map

package/data/principals/principalMutationJournalRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalRecord.js","sourceRoot":"","sources":["principalMutationJournalRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAgC;IAEhC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,IAAI,CAAC,SAAS,CAAC;QACb,gDAAgD;QAChD,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,iBAAiB;QACrB,GAAG,CAAC,SAAS;KACd,CAAC,CACH,CAAC;IACF,OAAO,aAAa,CAClB,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAE9C;IACA;IAFX,YACW,QAAgB,EAChB,MAAmC;QAE5C,KAAK,CACH,MAAM,KAAK,gBAAgB;YACzB,CAAC,CAAC,qDAAqD;YACvD,CAAC,CAAC,+DAA+D,CACpE,CAAC;QAPO,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAA6B;QAO5C,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { PrincipalMutationJournalRow } from \"../persistence/principalMutationJournalPersistence\";\n\n/** Identifies exact local bytes for an acknowledged discard, never for replay. */\nexport async function principalMutationJournalRecordId(\n  row: PrincipalMutationJournalRow,\n): Promise<string> {\n  const bytes = new TextEncoder().encode(\n    JSON.stringify([\n      \"tearleads.sdk.unreadable-principal-mutation.v1\",\n      row.scopeId,\n      row.organizationId,\n      row.serializedRequest,\n      row.signature,\n    ]),\n  );\n  return bytesToBase64(\n    new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes)),\n  );\n}\n\nexport class UnreadablePrincipalMutationError extends Error {\n  constructor(\n    readonly recordId: string,\n    readonly reason: \"authentication\" | \"format\",\n  ) {\n    super(\n      reason === \"authentication\"\n        ? \"Saved principal mutation could not be authenticated\"\n        : \"Saved principal mutation has an unsupported or invalid format\",\n    );\n    this.name = \"UnreadablePrincipalMutationError\";\n  }\n}\n"]}

package/data/principals/principalPolicyEvidence.d.ts

@@ -1,4 +1,4 @@
-import type { AnyVerifiedPrincipalPolicy, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+import type { AnyVerifiedPrincipalPolicy, PrincipalPolicyAuthorization, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
 export type PrincipalPolicyCurrentEvidence = VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
 export type PrincipalPolicyCheckpointEvidence = AnyVerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
-export declare function principalPolicyEvidenceEntries(policy: PrincipalPolicyCheckpointEvidence): NonNullable<VerifiedPrincipalPolicy["history"]>;
+export declare function principalPolicyEvidenceEntries(policy: PrincipalPolicyAuthorization): NonNullable<VerifiedPrincipalPolicy["history"]>;

package/data/principals/principalPolicyEvidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyEvidence.js","sourceRoot":"","sources":["principalPolicyEvidence.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,8BAA8B,CAC5C,MAAyC;IAEzC,OAAO,iBAAiB,IAAI,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI;YACjB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type {\n  AnyVerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalPolicyCurrentEvidence =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\nexport type PrincipalPolicyCheckpointEvidence =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nexport function principalPolicyEvidenceEntries(\n  policy: PrincipalPolicyCheckpointEvidence,\n): NonNullable<VerifiedPrincipalPolicy[\"history\"]> {\n  return \"retainedHistory\" in policy\n    ? policy.retainedHistory\n    : (policy.history ?? [\n        {\n          state: policy.state,\n          projection: policy.projection,\n          grants: policy.grants,\n        },\n      ]);\n}\n"]}
+{"version":3,"file":"principalPolicyEvidence.js","sourceRoot":"","sources":["principalPolicyEvidence.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,8BAA8B,CAC5C,MAAoC;IAEpC,OAAO,iBAAiB,IAAI,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI;YACjB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC,CAAC;AACT,CAAC","sourcesContent":["import type {\n  AnyVerifiedPrincipalPolicy,\n  PrincipalPolicyAuthorization,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\nexport type PrincipalPolicyCurrentEvidence =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\nexport type PrincipalPolicyCheckpointEvidence =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nexport function principalPolicyEvidenceEntries(\n  policy: PrincipalPolicyAuthorization,\n): NonNullable<VerifiedPrincipalPolicy[\"history\"]> {\n  return \"retainedHistory\" in policy\n    ? policy.retainedHistory\n    : (policy.history ?? [\n        {\n          state: policy.state,\n          projection: policy.projection,\n          grants: policy.grants,\n        },\n      ]);\n}\n"]}

package/data/sqlite/principalHistoryEvidenceSchema.d.ts

@@ -0,0 +1,308 @@
+/** A completed, locally authenticated prefix; never an application trust pin. */
+export declare const principalHistoryPrefixes: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_prefixes";
+    schema: undefined;
+    columns: {
+        scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scope_id";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        version: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "version";
+            tableName: "principal_history_prefixes";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        headJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "head_json";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        currentJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "current_json";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        progress: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "progress";
+            tableName: "principal_history_prefixes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+/** Entries are selected by their exact signed leaf, including signature bytes. */
+export declare const principalHistoryEntries: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_entries";
+    schema: undefined;
+    columns: {
+        scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scope_id";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        leafHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "leaf_hash";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        entryJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "entry_json";
+            tableName: "principal_history_entries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+/** Untrusted proof material, checked against a locally restored private root. */
+export declare const principalHistoryNodes: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_nodes";
+    schema: undefined;
+    columns: {
+        scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scope_id";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        hash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "hash";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        leftHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "left_hash";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        rightHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "right_hash";
+            tableName: "principal_history_nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const principalHistoryEvidenceTables: import("./sqlTableSchema.js").SqlTableSchema[];

package/data/sqlite/principalHistoryStageSchema.d.ts

@@ -0,0 +1,119 @@
+/** Provisional, locally authenticated verification work; never an app checkpoint. */
+export declare const principalHistoryStages: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_history_stages";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        currentJson: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "current_json";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        afterVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "after_version";
+            tableName: "principal_history_stages";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        complete: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "complete";
+            tableName: "principal_history_stages";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        progress: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "progress";
+            tableName: "principal_history_stages";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const principalHistoryStageTables: import("./sqlTableSchema.js").SqlTableSchema[];

package/data/sqlite/principalHistoryStageSchema.js

@@ -1,4 +1,6 @@
+import { desc } from "drizzle-orm";
 import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { principalCurrentFingerprintJson } from "./principalKeyFingerprintJson.js";
 import { defineSqlTableSchema } from "./sqlTableSchema.js";
 /** Provisional, locally authenticated verification work; never an app checkpoint. */
 export const principalHistoryStages = sqliteTable("principal_history_stages", {
@@ -9,6 +11,7 @@ export const principalHistoryStages = sqliteTable("principal_history_stages", {
     complete: integer("complete", { mode: "boolean" }).notNull(),
     progress: text("progress").notNull(),
 }, (table) => [
+    index("principal_history_stages_key_fingerprint_idx").on(principalCurrentFingerprintJson(table.currentJson), table.complete, desc(table.afterVersion)),
     index("principal_history_stages_organization_idx").on(table.organizationId),
 ]);
 export const principalHistoryStageTables = [

package/data/sqlite/principalHistoryStageSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryStageSchema.js","sourceRoot":"","sources":["principalHistoryStageSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB,CAAC,sBAAsB,CAAC;CAC7C,CAAC","sourcesContent":["import { index, integer, sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** Provisional, locally authenticated verification work; never an app checkpoint. */\nexport const principalHistoryStages = sqliteTable(\n  \"principal_history_stages\",\n  {\n    id: text(\"id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    afterVersion: integer(\"after_version\").notNull(),\n    complete: integer(\"complete\", { mode: \"boolean\" }).notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_stages_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryStageTables = [\n  defineSqlTableSchema(principalHistoryStages),\n];\n"]}
+{"version":3,"file":"principalHistoryStageSchema.js","sourceRoot":"","sources":["principalHistoryStageSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,CACtD,+BAA+B,CAAC,KAAK,CAAC,WAAW,CAAC,EAClD,KAAK,CAAC,QAAQ,EACd,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CACzB;IACD,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB,CAAC,sBAAsB,CAAC;CAC7C,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport { index, integer, sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { principalCurrentFingerprintJson } from \"./principalKeyFingerprintJson\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** Provisional, locally authenticated verification work; never an app checkpoint. */\nexport const principalHistoryStages = sqliteTable(\n  \"principal_history_stages\",\n  {\n    id: text(\"id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    afterVersion: integer(\"after_version\").notNull(),\n    complete: integer(\"complete\", { mode: \"boolean\" }).notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_stages_key_fingerprint_idx\").on(\n      principalCurrentFingerprintJson(table.currentJson),\n      table.complete,\n      desc(table.afterVersion),\n    ),\n    index(\"principal_history_stages_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryStageTables = [\n  defineSqlTableSchema(principalHistoryStages),\n];\n"]}