@tearleads/client-sdk 0.1.15 → 0.1.16

package/data/persistence/principalGrantRetirementPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAA4C,EAC5C,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly VerifiedPrincipalPolicy[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const previous = retirement.policy.history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}
+{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAGG,EACH,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,iBAAiB,IAAI,UAAU,CAAC,MAAM;QACpC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly (\n    | VerifiedPrincipalPolicy\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const history =\n    \"retainedHistory\" in retirement.policy\n      ? retirement.policy.retainedHistory\n      : retirement.policy.history;\n  const previous = history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}

package/data/persistence/principalKeyEnvelopeCandidates.js

@@ -1,6 +1,7 @@
 import { isCurrentPrincipalMemberEnvelopesResponse, } from "../../internal/validators/response/index.js";
-import { desc, eq, sql } from "drizzle-orm";
+import { and, desc, eq, sql } from "drizzle-orm";
 import { principalHistoryEvidenceTables, principalHistoryPrefixes, } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalHistoryStages } from "../sqlite/principalHistoryStageSchema.js";
 import { principalCurrentFingerprintJson, principalStateFingerprintJson, } from "../sqlite/principalKeyFingerprintJson.js";
 import { principalPolicies, principalPolicyBundleHistory, } from "../sqlite/principalPolicySchema.js";
 import { principalPolicyTables } from "../sqlite/schema.js";
@@ -41,6 +42,16 @@ export async function loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints)
             .limit(1);
         if (prefix)
             encoded.push(prefix.envelopes);
+        const [stage] = await db
+            .select({
+            envelopes: sql `json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,
+        })
+            .from(principalHistoryStages)
+            .where(and(eq(principalCurrentFingerprintJson(principalHistoryStages.currentJson), fingerprint), eq(principalHistoryStages.complete, true)))
+            .orderBy(desc(principalHistoryStages.afterVersion))
+            .limit(1);
+        if (stage)
+            encoded.push(stage.envelopes);
         for (const json of encoded) {
             let envelopes;
             try {

package/data/persistence/principalKeyEnvelopeCandidates.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}
+{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,sBAAsB,CAAC,WAAW,+BAA+B;SACxG,CAAC;aACD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,sBAAsB,CAAC,WAAW,CAAC,EACnE,WAAW,CACZ,EACD,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC1C,CACF;aACA,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;aAClD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { and, desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    const [stage] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryStages)\n      .where(\n        and(\n          eq(\n            principalCurrentFingerprintJson(principalHistoryStages.currentJson),\n            fingerprint,\n          ),\n          eq(principalHistoryStages.complete, true),\n        ),\n      )\n      .orderBy(desc(principalHistoryStages.afterVersion))\n      .limit(1);\n    if (stage) encoded.push(stage.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}

package/data/persistence/principalMutationJournalPersistence.d.ts

@@ -0,0 +1,19 @@
+import { principalMutationJournal } from "../sqlite/principalMutationJournalSchema.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+export type PrincipalMutationJournalRow = typeof principalMutationJournal.$inferSelect;
+export declare class PendingPrincipalMutationError extends Error {
+    constructor();
+}
+export declare function loadPrincipalMutationJournal(execSql: ExecSql, scopeId: string): Promise<PrincipalMutationJournalRow | null>;
+/** Claim the organization lane before dispatch; never overwrite unresolved work. */
+export declare function claimPrincipalMutationJournal(input: {
+    readonly execSql: ExecSql;
+    readonly row: PrincipalMutationJournalRow;
+    readonly stillCurrent: () => boolean;
+}): Promise<void>;
+/** A late acknowledgement cannot retire another operation's journal entry. */
+export declare function clearPrincipalMutationJournal(input: {
+    readonly execSql: ExecSql;
+    readonly row: PrincipalMutationJournalRow;
+    readonly stillCurrent: () => boolean;
+}): Promise<boolean>;

package/data/persistence/principalMutationJournalPersistence.js

@@ -0,0 +1,53 @@
+import { and, eq } from "drizzle-orm";
+import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
+import { principalMutationJournal, principalMutationJournalTables, } from "../sqlite/principalMutationJournalSchema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+export class PendingPrincipalMutationError extends Error {
+    constructor() {
+        super("Resolve the pending principal mutation or explicitly abandon its retry before submitting another");
+        this.name = "PendingPrincipalMutationError";
+    }
+}
+export async function loadPrincipalMutationJournal(execSql, scopeId) {
+    await ensureSqlTables(execSql, principalMutationJournalTables);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [row] = await db
+        .select()
+        .from(principalMutationJournal)
+        .where(eq(principalMutationJournal.scopeId, scopeId))
+        .limit(1);
+    return row ?? null;
+}
+/** Claim the organization lane before dispatch; never overwrite unresolved work. */
+export async function claimPrincipalMutationJournal(input) {
+    const row = { ...input.row };
+    await ensureSqlTables(input.execSql, principalMutationJournalTables);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const [existing] = await tx
+            .select({ scopeId: principalMutationJournal.scopeId })
+            .from(principalMutationJournal)
+            .where(eq(principalMutationJournal.scopeId, row.scopeId))
+            .limit(1);
+        if (existing)
+            throw new PendingPrincipalMutationError();
+        await tx.insert(principalMutationJournal).values(row).run();
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+}
+/** A late acknowledgement cannot retire another operation's journal entry. */
+export async function clearPrincipalMutationJournal(input) {
+    const row = { ...input.row };
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const deleted = await tx
+            .delete(principalMutationJournal)
+            .where(and(eq(principalMutationJournal.scopeId, row.scopeId), eq(principalMutationJournal.organizationId, row.organizationId), eq(principalMutationJournal.serializedRequest, row.serializedRequest), eq(principalMutationJournal.signature, row.signature)))
+            .returning({ scopeId: principalMutationJournal.scopeId });
+        return deleted.length > 0;
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+    return result.result === true;
+}
+//# sourceMappingURL=principalMutationJournalPersistence.js.map

package/data/persistence/principalMutationJournalPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalPersistence.js","sourceRoot":"","sources":["principalMutationJournalPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CACH,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;aACrD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,wBAAwB,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,EAC/D,EAAE,CACA,wBAAwB,CAAC,iBAAiB,EAC1C,GAAG,CAAC,iBAAiB,CACtB,EACD,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CACtD,CACF;aACA,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;AAChC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalMutationJournal,\n  principalMutationJournalTables,\n} from \"../sqlite/principalMutationJournalSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalMutationJournalRow =\n  typeof principalMutationJournal.$inferSelect;\n\nexport class PendingPrincipalMutationError extends Error {\n  constructor() {\n    super(\n      \"Resolve the pending principal mutation or explicitly abandon its retry before submitting another\",\n    );\n    this.name = \"PendingPrincipalMutationError\";\n  }\n}\n\nexport async function loadPrincipalMutationJournal(\n  execSql: ExecSql,\n  scopeId: string,\n): Promise<PrincipalMutationJournalRow | null> {\n  await ensureSqlTables(execSql, principalMutationJournalTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select()\n    .from(principalMutationJournal)\n    .where(eq(principalMutationJournal.scopeId, scopeId))\n    .limit(1);\n  return row ?? null;\n}\n\n/** Claim the organization lane before dispatch; never overwrite unresolved work. */\nexport async function claimPrincipalMutationJournal(input: {\n  readonly execSql: ExecSql;\n  readonly row: PrincipalMutationJournalRow;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const row = { ...input.row };\n  await ensureSqlTables(input.execSql, principalMutationJournalTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [existing] = await tx\n        .select({ scopeId: principalMutationJournal.scopeId })\n        .from(principalMutationJournal)\n        .where(eq(principalMutationJournal.scopeId, row.scopeId))\n        .limit(1);\n      if (existing) throw new PendingPrincipalMutationError();\n      await tx.insert(principalMutationJournal).values(row).run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** A late acknowledgement cannot retire another operation's journal entry. */\nexport async function clearPrincipalMutationJournal(input: {\n  readonly execSql: ExecSql;\n  readonly row: PrincipalMutationJournalRow;\n  readonly stillCurrent: () => boolean;\n}): Promise<boolean> {\n  const row = { ...input.row };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const deleted = await tx\n        .delete(principalMutationJournal)\n        .where(\n          and(\n            eq(principalMutationJournal.scopeId, row.scopeId),\n            eq(principalMutationJournal.organizationId, row.organizationId),\n            eq(\n              principalMutationJournal.serializedRequest,\n              row.serializedRequest,\n            ),\n            eq(principalMutationJournal.signature, row.signature),\n          ),\n        )\n        .returning({ scopeId: principalMutationJournal.scopeId });\n      return deleted.length > 0;\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n  return result.result === true;\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyBundle.js

@@ -1,55 +1,8 @@
-import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
 import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
-function bundleMismatch(message) {
-    throw new KeyingVerificationError("equivocation", message);
-}
-async function memberEnvelopesRoot(bundle) {
-    try {
-        return await computePrincipalMemberEnvelopesRoot(bundle.currentMemberEnvelopes.envelopes);
-    }
-    catch (error) {
-        if (error instanceof PrincipalMemberEnvelopeValidationError) {
-            throw new KeyingVerificationError("invalid_shape", error.message);
-        }
-        throw error;
-    }
-}
-async function assertBundlePayloadMatches(input) {
-    const { bundle, policy } = input;
-    const payloadHash = await computePrincipalStatePayloadCiphertextHash(bundle.currentPayload.ciphertext);
-    const envelopesRoot = await memberEnvelopesRoot(bundle);
-    if (bundle.currentPayload.principalType !== policy.principalType ||
-        bundle.currentPayload.principalId !== policy.principalId ||
-        bundle.currentPayload.stateHash !== policy.stateHash ||
-        bundle.currentPayload.ciphertextHash !== payloadHash ||
-        policy.state.payloadCiphertextHash !== payloadHash ||
-        bundle.currentMemberEnvelopes.principalType !== policy.principalType ||
-        bundle.currentMemberEnvelopes.principalId !== policy.principalId ||
-        bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||
-        bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
-        envelopesRoot !== policy.state.memberEnvelopesRoot) {
-        bundleMismatch("Verified principal policy bundle payload mismatch");
-    }
-}
+import { assertCurrentMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyCurrent.js";
 export async function assertBundleMatchesVerifiedPolicy(input) {
     const { bundle, policy } = input;
-    if (bundle.currentState.principalType !== policy.principalType ||
-        bundle.currentState.principalId !== policy.principalId ||
-        bundle.currentState.version !== policy.version ||
-        bundle.currentState.keyEpoch !== policy.keyEpoch ||
-        bundle.currentState.stateHash !== policy.stateHash ||
-        policy.checkpoint.version !== policy.version ||
-        policy.checkpoint.stateHash !== policy.stateHash) {
-        bundleMismatch("Verified principal policy bundle head mismatch");
-    }
-    if (canonicalKeyingJsonString(bundle.currentState, "principal policy bundle state") !==
-        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
-        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(bundle.currentProjection), "principal policy bundle projection") !==
-            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
-        canonicalKeyingJsonString(normalizePrincipalContainerGrants(bundle.currentGrants), "principal policy bundle grants") !==
-            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
-        bundleMismatch("Verified principal policy bundle content mismatch");
-    }
     const history = policy.history ?? [];
     const expectedChain = [
         ...bundle.previousStates,
@@ -70,8 +23,11 @@ export async function assertBundleMatchesVerifiedPolicy(input) {
     }));
     if (canonicalKeyingJsonString(expectedChain, "principal policy bundle history") !==
         canonicalKeyingJsonString(verifiedHistory, "verified principal policy history")) {
-        bundleMismatch("Verified principal policy bundle history mismatch");
+        throw new KeyingVerificationError("equivocation", "Verified principal policy bundle history mismatch");
     }
-    await assertBundlePayloadMatches(input);
+    await assertCurrentMatchesVerifiedPolicy({
+        current: input.bundle,
+        policy: input.policy,
+    });
 }
 //# sourceMappingURL=verifiedPrincipalPolicyBundle.js.map

package/data/persistence/verifiedPrincipalPolicyBundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,IACE,MAAM,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC5D,MAAM,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACxD,MAAM,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACpD,MAAM,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACpD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,MAAM,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACpE,MAAM,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAChE,MAAM,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC5D,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACvD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC1D,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACtD,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC9C,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAChD,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAClD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,IACE,yBAAyB,CACvB,MAAM,CAAC,YAAY,EACnB,+BAA+B,CAChC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC7D,oCAAoC,CACrC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,aAAa,CAAC,EACvD,gCAAgC,CACjC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["import {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\n\nfunction bundleMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      bundle.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertBundlePayloadMatches(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    bundle.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(bundle);\n  if (\n    bundle.currentPayload.principalType !== policy.principalType ||\n    bundle.currentPayload.principalId !== policy.principalId ||\n    bundle.currentPayload.stateHash !== policy.stateHash ||\n    bundle.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    bundle.currentMemberEnvelopes.principalType !== policy.principalType ||\n    bundle.currentMemberEnvelopes.principalId !== policy.principalId ||\n    bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    bundleMismatch(\"Verified principal policy bundle payload mismatch\");\n  }\n}\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  if (\n    bundle.currentState.principalType !== policy.principalType ||\n    bundle.currentState.principalId !== policy.principalId ||\n    bundle.currentState.version !== policy.version ||\n    bundle.currentState.keyEpoch !== policy.keyEpoch ||\n    bundle.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    bundleMismatch(\"Verified principal policy bundle head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      bundle.currentState,\n      \"principal policy bundle state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(bundle.currentProjection),\n      \"principal policy bundle projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(bundle.currentGrants),\n      \"principal policy bundle grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle content mismatch\");\n  }\n\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle history mismatch\");\n  }\n  await assertBundlePayloadMatches(input);\n}\n"]}
+{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyCurrent\";\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Verified principal policy bundle history mismatch\",\n    );\n  }\n  await assertCurrentMatchesVerifiedPolicy({\n    current: input.bundle,\n    policy: input.policy,\n  });\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyCurrent.js

@@ -0,0 +1,56 @@
+import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+function currentMismatch(message) {
+    throw new KeyingVerificationError("equivocation", message);
+}
+async function memberEnvelopesRoot(current) {
+    try {
+        return await computePrincipalMemberEnvelopesRoot(current.currentMemberEnvelopes.envelopes);
+    }
+    catch (error) {
+        if (error instanceof PrincipalMemberEnvelopeValidationError) {
+            throw new KeyingVerificationError("invalid_shape", error.message);
+        }
+        throw error;
+    }
+}
+async function assertCurrentPayloadMatches(input) {
+    const { current, policy } = input;
+    const payloadHash = await computePrincipalStatePayloadCiphertextHash(current.currentPayload.ciphertext);
+    const envelopesRoot = await memberEnvelopesRoot(current);
+    if (current.currentPayload.principalType !== policy.principalType ||
+        current.currentPayload.principalId !== policy.principalId ||
+        current.currentPayload.stateHash !== policy.stateHash ||
+        current.currentPayload.ciphertextHash !== payloadHash ||
+        policy.state.payloadCiphertextHash !== payloadHash ||
+        current.currentMemberEnvelopes.principalType !== policy.principalType ||
+        current.currentMemberEnvelopes.principalId !== policy.principalId ||
+        current.currentMemberEnvelopes.stateHash !== policy.stateHash ||
+        current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
+        envelopesRoot !== policy.state.memberEnvelopesRoot) {
+        currentMismatch("Verified principal policy current payload mismatch");
+    }
+}
+/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */
+export async function assertCurrentMatchesVerifiedPolicy(input) {
+    const { current, policy } = input;
+    if (current.currentState.principalType !== policy.principalType ||
+        current.currentState.principalId !== policy.principalId ||
+        current.currentState.version !== policy.version ||
+        current.currentState.keyEpoch !== policy.keyEpoch ||
+        current.currentState.stateHash !== policy.stateHash ||
+        policy.checkpoint.version !== policy.version ||
+        policy.checkpoint.stateHash !== policy.stateHash) {
+        currentMismatch("Verified principal policy current head mismatch");
+    }
+    if (canonicalKeyingJsonString(current.currentState, "principal policy current state") !==
+        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
+        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(current.currentProjection), "principal policy current projection") !==
+            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
+        canonicalKeyingJsonString(normalizePrincipalContainerGrants(current.currentGrants), "principal policy current grants") !==
+            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
+        currentMismatch("Verified principal policy current content mismatch");
+    }
+    await assertCurrentPayloadMatches(input);
+}
+//# sourceMappingURL=verifiedPrincipalPolicyCurrent.js.map

package/data/persistence/verifiedPrincipalPolicyCurrent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyCurrent.js","sourceRoot":"","sources":["verifiedPrincipalPolicyCurrent.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAGvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAMnE,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAmC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,OAAO,CAAC,sBAAsB,CAAC,SAAS,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAG1C;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,OAAO,CAAC,cAAc,CAAC,UAAU,CAClC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzD,IACE,OAAO,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC7D,OAAO,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACzD,OAAO,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACrD,OAAO,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACrD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,OAAO,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACrE,OAAO,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACjE,OAAO,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC7D,OAAO,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACxD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,IACE,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC3D,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACvD,OAAO,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/C,OAAO,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACjD,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACnD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,eAAe,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,yBAAyB,CACvB,OAAO,CAAC,YAAY,EACpB,gCAAgC,CACjC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9D,qCAAqC,CACtC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,OAAO,CAAC,aAAa,CAAC,EACxD,iCAAiC,CAClC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\n\ntype VerifiedCurrentPolicy =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nfunction currentMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  current: PrincipalPolicyPageCurrent,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      current.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertCurrentPayloadMatches(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    current.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(current);\n  if (\n    current.currentPayload.principalType !== policy.principalType ||\n    current.currentPayload.principalId !== policy.principalId ||\n    current.currentPayload.stateHash !== policy.stateHash ||\n    current.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    current.currentMemberEnvelopes.principalType !== policy.principalType ||\n    current.currentMemberEnvelopes.principalId !== policy.principalId ||\n    current.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    currentMismatch(\"Verified principal policy current payload mismatch\");\n  }\n}\n\n/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */\nexport async function assertCurrentMatchesVerifiedPolicy(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  if (\n    current.currentState.principalType !== policy.principalType ||\n    current.currentState.principalId !== policy.principalId ||\n    current.currentState.version !== policy.version ||\n    current.currentState.keyEpoch !== policy.keyEpoch ||\n    current.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    currentMismatch(\"Verified principal policy current head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      current.currentState,\n      \"principal policy current state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(current.currentProjection),\n      \"principal policy current projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(current.currentGrants),\n      \"principal policy current grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    currentMismatch(\"Verified principal policy current content mismatch\");\n  }\n\n  await assertCurrentPayloadMatches(input);\n}\n"]}

package/data/principals/principalMutationJournal.d.ts

@@ -0,0 +1,26 @@
+import { type SigningKeyPair } from "../../internal/crypto/index.js";
+import { type CommitOrganizationGroupPolicyRequest } from "../../internal/validators/request/index.js";
+import type { PrincipalMutationJournalRow } from "../persistence/principalMutationJournalPersistence.js";
+export interface PrincipalMutationJournalScope {
+    readonly identityTrustDomain: string;
+    readonly organizationId: string;
+    readonly userId: string;
+    readonly signingFingerprint: string;
+}
+export interface AuthoredPrincipalMutation {
+    readonly groupId: string;
+    readonly request: CommitOrganizationGroupPolicyRequest;
+}
+export declare function principalMutationJournalScopeId(scope: PrincipalMutationJournalScope): Promise<string>;
+/** Sign the complete wire body, including artifacts outside policy signatures. */
+export declare function sealPrincipalMutation(input: {
+    readonly scope: PrincipalMutationJournalScope;
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<PrincipalMutationJournalRow>;
+/** Authentication precedes parsing or submission; corrupt authored work is retained. */
+export declare function openPrincipalMutation(input: {
+    readonly scope: PrincipalMutationJournalScope;
+    readonly row: PrincipalMutationJournalRow;
+    readonly signingPublicKey: Uint8Array;
+}): Promise<AuthoredPrincipalMutation>;

package/data/principals/principalMutationJournal.js

@@ -0,0 +1,90 @@
+import { KeyingVerificationError, sign, toFingerprint, verify, } from "../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { CommitOrganizationGroupPolicyRequestSchema, } from "../../internal/validators/request/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+const journalDomain = "tearleads.sdk.principal-mutation.v1";
+const encoder = new TextEncoder();
+function scopeJson(scope) {
+    const values = [
+        scope.identityTrustDomain,
+        scope.organizationId,
+        scope.userId,
+        scope.signingFingerprint,
+    ];
+    if (values.some((value) => typeof value !== "string" || value.length === 0))
+        throw new Error("Principal mutation journal requires a complete scope");
+    return JSON.stringify([journalDomain, ...values]);
+}
+export async function principalMutationJournalScopeId(scope) {
+    return bytesToBase64(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(scopeJson(scope)))));
+}
+function readMutation(value, scope) {
+    if (typeof value !== "object" || value === null)
+        throw new Error("Principal mutation journal payload is invalid");
+    const groupId = Reflect.get(value, "groupId");
+    const request = CommitOrganizationGroupPolicyRequestSchema.parse(Reflect.get(value, "request"));
+    const group = request.groupPolicy.state;
+    const organization = request.organizationPolicy.state;
+    if (typeof groupId !== "string" ||
+        group.principalType !== "group" ||
+        group.principalId !== groupId ||
+        organization.principalType !== "organization" ||
+        organization.principalId !== scope.organizationId ||
+        [group, organization].some((state) => state.signerUserId !== scope.userId ||
+            state.signerUserKeyFingerprint !== scope.signingFingerprint))
+        throw new Error("Principal mutation journal target or signer differs");
+    return { groupId, request };
+}
+function signedBytes(scope, request) {
+    // The domain-tagged scope and JSON tuple separate these identity-key
+    // signatures from policy state signatures and other authored formats.
+    return encoder.encode(JSON.stringify([scopeJson(scope), request]));
+}
+/** Sign the complete wire body, including artifacts outside policy signatures. */
+export async function sealPrincipalMutation(input) {
+    const scope = { ...input.scope };
+    const mutation = readMutation(JSON.parse(JSON.stringify(input.mutation)), scope);
+    const serializedRequest = canonicalKeyingJsonString(mutation, "authored principal mutation");
+    const publicKey = new Uint8Array(input.signingKeyPair.signingPublicKey);
+    const privateKey = new Uint8Array(input.signingKeyPair.signingPrivateKey);
+    try {
+        if ((await toFingerprint(publicKey)) !== scope.signingFingerprint)
+            throw new Error("Principal mutation journal signing key differs");
+        const bytes = signedBytes(scope, serializedRequest);
+        const signature = sign(bytes, privateKey);
+        if (!verify(signature, bytes, publicKey))
+            throw new KeyingVerificationError("signer_mismatch", "Principal mutation journal signing key pair differs");
+        return {
+            scopeId: await principalMutationJournalScopeId(scope),
+            organizationId: scope.organizationId,
+            serializedRequest,
+            signature: bytesToBase64(signature),
+        };
+    }
+    finally {
+        privateKey.fill(0);
+    }
+}
+/** Authentication precedes parsing or submission; corrupt authored work is retained. */
+export async function openPrincipalMutation(input) {
+    const scope = { ...input.scope };
+    const row = { ...input.row };
+    const publicKey = new Uint8Array(input.signingPublicKey);
+    try {
+        if (row.organizationId !== scope.organizationId ||
+            row.scopeId !== (await principalMutationJournalScopeId(scope)) ||
+            (await toFingerprint(publicKey)) !== scope.signingFingerprint ||
+            !verify(base64ToBytes(row.signature), signedBytes(scope, row.serializedRequest), publicKey))
+            throw new Error("Principal mutation journal authentication failed");
+    }
+    catch {
+        throw new KeyingVerificationError("signature_mismatch", "Saved principal mutation could not be authenticated");
+    }
+    try {
+        return readMutation(JSON.parse(row.serializedRequest), scope);
+    }
+    catch {
+        throw new KeyingVerificationError("invalid_shape", "Authenticated principal mutation has an unsupported or invalid format");
+    }
+}
+//# sourceMappingURL=principalMutationJournal.js.map

package/data/principals/principalMutationJournal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournal.js","sourceRoot":"","sources":["principalMutationJournal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,IAAI,EACJ,aAAa,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAEL,0CAA0C,GAC3C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAenE,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,SAAS,CAAC,KAAoC;IACrD,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,kBAAkB;KACzB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAoC;IAEpC,OAAO,aAAa,CAClB,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,KAAoC;IAEpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,0CAA0C,CAAC,KAAK,CAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAC9B,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACtD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,KAAK,CAAC,WAAW,KAAK,OAAO;QAC7B,YAAY,CAAC,aAAa,KAAK,cAAc;QAC7C,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;QACjD,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,IAAI,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;YACnC,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,kBAAkB,CAC9D;QAED,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC,EAAE,OAAe;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,YAAY,CAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC1C,KAAK,CACN,CAAC;IACF,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,QAAQ,EACR,6BAA6B,CAC9B,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;YACtC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;QACJ,OAAO;YACL,OAAO,EAAE,MAAM,+BAA+B,CAAC,KAAK,CAAC;YACrD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB;YACjB,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;SACpC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,IACE,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC3C,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAC7D,CAAC,MAAM,CACL,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAC5B,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,iBAAiB,CAAC,EACzC,SAAS,CACV;YAED,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,uEAAuE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type SigningKeyPair,\n  sign,\n  toFingerprint,\n  verify,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  type CommitOrganizationGroupPolicyRequest,\n  CommitOrganizationGroupPolicyRequestSchema,\n} from \"@tearleads/validators/request\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport type { PrincipalMutationJournalRow } from \"../persistence/principalMutationJournalPersistence\";\n\nexport interface PrincipalMutationJournalScope {\n  readonly identityTrustDomain: string;\n  readonly organizationId: string;\n  readonly userId: string;\n  readonly signingFingerprint: string;\n}\n\nexport interface AuthoredPrincipalMutation {\n  readonly groupId: string;\n  readonly request: CommitOrganizationGroupPolicyRequest;\n}\n\nconst journalDomain = \"tearleads.sdk.principal-mutation.v1\";\nconst encoder = new TextEncoder();\n\nfunction scopeJson(scope: PrincipalMutationJournalScope): string {\n  const values = [\n    scope.identityTrustDomain,\n    scope.organizationId,\n    scope.userId,\n    scope.signingFingerprint,\n  ];\n  if (values.some((value) => typeof value !== \"string\" || value.length === 0))\n    throw new Error(\"Principal mutation journal requires a complete scope\");\n  return JSON.stringify([journalDomain, ...values]);\n}\n\nexport async function principalMutationJournalScopeId(\n  scope: PrincipalMutationJournalScope,\n): Promise<string> {\n  return bytesToBase64(\n    new Uint8Array(\n      await crypto.subtle.digest(\"SHA-256\", encoder.encode(scopeJson(scope))),\n    ),\n  );\n}\n\nfunction readMutation(\n  value: unknown,\n  scope: PrincipalMutationJournalScope,\n): AuthoredPrincipalMutation {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Principal mutation journal payload is invalid\");\n  const groupId: unknown = Reflect.get(value, \"groupId\");\n  const request = CommitOrganizationGroupPolicyRequestSchema.parse(\n    Reflect.get(value, \"request\"),\n  );\n  const group = request.groupPolicy.state;\n  const organization = request.organizationPolicy.state;\n  if (\n    typeof groupId !== \"string\" ||\n    group.principalType !== \"group\" ||\n    group.principalId !== groupId ||\n    organization.principalType !== \"organization\" ||\n    organization.principalId !== scope.organizationId ||\n    [group, organization].some(\n      (state) =>\n        state.signerUserId !== scope.userId ||\n        state.signerUserKeyFingerprint !== scope.signingFingerprint,\n    )\n  )\n    throw new Error(\"Principal mutation journal target or signer differs\");\n  return { groupId, request };\n}\n\nfunction signedBytes(scope: PrincipalMutationJournalScope, request: string) {\n  // The domain-tagged scope and JSON tuple separate these identity-key\n  // signatures from policy state signatures and other authored formats.\n  return encoder.encode(JSON.stringify([scopeJson(scope), request]));\n}\n\n/** Sign the complete wire body, including artifacts outside policy signatures. */\nexport async function sealPrincipalMutation(input: {\n  readonly scope: PrincipalMutationJournalScope;\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalMutationJournalRow> {\n  const scope = { ...input.scope };\n  const mutation = readMutation(\n    JSON.parse(JSON.stringify(input.mutation)),\n    scope,\n  );\n  const serializedRequest = canonicalKeyingJsonString(\n    mutation,\n    \"authored principal mutation\",\n  );\n  const publicKey = new Uint8Array(input.signingKeyPair.signingPublicKey);\n  const privateKey = new Uint8Array(input.signingKeyPair.signingPrivateKey);\n  try {\n    if ((await toFingerprint(publicKey)) !== scope.signingFingerprint)\n      throw new Error(\"Principal mutation journal signing key differs\");\n    const bytes = signedBytes(scope, serializedRequest);\n    const signature = sign(bytes, privateKey);\n    if (!verify(signature, bytes, publicKey))\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        \"Principal mutation journal signing key pair differs\",\n      );\n    return {\n      scopeId: await principalMutationJournalScopeId(scope),\n      organizationId: scope.organizationId,\n      serializedRequest,\n      signature: bytesToBase64(signature),\n    };\n  } finally {\n    privateKey.fill(0);\n  }\n}\n\n/** Authentication precedes parsing or submission; corrupt authored work is retained. */\nexport async function openPrincipalMutation(input: {\n  readonly scope: PrincipalMutationJournalScope;\n  readonly row: PrincipalMutationJournalRow;\n  readonly signingPublicKey: Uint8Array;\n}): Promise<AuthoredPrincipalMutation> {\n  const scope = { ...input.scope };\n  const row = { ...input.row };\n  const publicKey = new Uint8Array(input.signingPublicKey);\n  try {\n    if (\n      row.organizationId !== scope.organizationId ||\n      row.scopeId !== (await principalMutationJournalScopeId(scope)) ||\n      (await toFingerprint(publicKey)) !== scope.signingFingerprint ||\n      !verify(\n        base64ToBytes(row.signature),\n        signedBytes(scope, row.serializedRequest),\n        publicKey,\n      )\n    )\n      throw new Error(\"Principal mutation journal authentication failed\");\n  } catch {\n    throw new KeyingVerificationError(\n      \"signature_mismatch\",\n      \"Saved principal mutation could not be authenticated\",\n    );\n  }\n  try {\n    return readMutation(JSON.parse(row.serializedRequest), scope);\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Authenticated principal mutation has an unsupported or invalid format\",\n    );\n  }\n}\n"]}

package/data/principals/principalMutationJournalRecord.d.ts

@@ -0,0 +1,8 @@
+import type { PrincipalMutationJournalRow } from "../persistence/principalMutationJournalPersistence.js";
+/** Identifies exact local bytes for an acknowledged discard, never for replay. */
+export declare function principalMutationJournalRecordId(row: PrincipalMutationJournalRow): Promise<string>;
+export declare class UnreadablePrincipalMutationError extends Error {
+    readonly recordId: string;
+    readonly reason: "authentication" | "format";
+    constructor(recordId: string, reason: "authentication" | "format");
+}

package/data/principals/principalMutationJournalRecord.js

@@ -0,0 +1,25 @@
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+/** Identifies exact local bytes for an acknowledged discard, never for replay. */
+export async function principalMutationJournalRecordId(row) {
+    const bytes = new TextEncoder().encode(JSON.stringify([
+        "tearleads.sdk.unreadable-principal-mutation.v1",
+        row.scopeId,
+        row.organizationId,
+        row.serializedRequest,
+        row.signature,
+    ]));
+    return bytesToBase64(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+export class UnreadablePrincipalMutationError extends Error {
+    recordId;
+    reason;
+    constructor(recordId, reason) {
+        super(reason === "authentication"
+            ? "Saved principal mutation could not be authenticated"
+            : "Saved principal mutation has an unsupported or invalid format");
+        this.recordId = recordId;
+        this.reason = reason;
+        this.name = "UnreadablePrincipalMutationError";
+    }
+}
+//# sourceMappingURL=principalMutationJournalRecord.js.map

package/data/principals/principalMutationJournalRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalRecord.js","sourceRoot":"","sources":["principalMutationJournalRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAgC;IAEhC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,IAAI,CAAC,SAAS,CAAC;QACb,gDAAgD;QAChD,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,iBAAiB;QACrB,GAAG,CAAC,SAAS;KACd,CAAC,CACH,CAAC;IACF,OAAO,aAAa,CAClB,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAE9C;IACA;IAFX,YACW,QAAgB,EAChB,MAAmC;QAE5C,KAAK,CACH,MAAM,KAAK,gBAAgB;YACzB,CAAC,CAAC,qDAAqD;YACvD,CAAC,CAAC,+DAA+D,CACpE,CAAC;QAPO,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAA6B;QAO5C,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { PrincipalMutationJournalRow } from \"../persistence/principalMutationJournalPersistence\";\n\n/** Identifies exact local bytes for an acknowledged discard, never for replay. */\nexport async function principalMutationJournalRecordId(\n  row: PrincipalMutationJournalRow,\n): Promise<string> {\n  const bytes = new TextEncoder().encode(\n    JSON.stringify([\n      \"tearleads.sdk.unreadable-principal-mutation.v1\",\n      row.scopeId,\n      row.organizationId,\n      row.serializedRequest,\n      row.signature,\n    ]),\n  );\n  return bytesToBase64(\n    new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes)),\n  );\n}\n\nexport class UnreadablePrincipalMutationError extends Error {\n  constructor(\n    readonly recordId: string,\n    readonly reason: \"authentication\" | \"format\",\n  ) {\n    super(\n      reason === \"authentication\"\n        ? \"Saved principal mutation could not be authenticated\"\n        : \"Saved principal mutation has an unsupported or invalid format\",\n    );\n    this.name = \"UnreadablePrincipalMutationError\";\n  }\n}\n"]}

package/data/sqlite/principalHistoryStageSchema.js

@@ -1,4 +1,6 @@
+import { desc } from "drizzle-orm";
 import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { principalCurrentFingerprintJson } from "./principalKeyFingerprintJson.js";
 import { defineSqlTableSchema } from "./sqlTableSchema.js";
 /** Provisional, locally authenticated verification work; never an app checkpoint. */
 export const principalHistoryStages = sqliteTable("principal_history_stages", {
@@ -9,6 +11,7 @@ export const principalHistoryStages = sqliteTable("principal_history_stages", {
     complete: integer("complete", { mode: "boolean" }).notNull(),
     progress: text("progress").notNull(),
 }, (table) => [
+    index("principal_history_stages_key_fingerprint_idx").on(principalCurrentFingerprintJson(table.currentJson), table.complete, desc(table.afterVersion)),
     index("principal_history_stages_organization_idx").on(table.organizationId),
 ]);
 export const principalHistoryStageTables = [

package/data/sqlite/principalHistoryStageSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryStageSchema.js","sourceRoot":"","sources":["principalHistoryStageSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB,CAAC,sBAAsB,CAAC;CAC7C,CAAC","sourcesContent":["import { index, integer, sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** Provisional, locally authenticated verification work; never an app checkpoint. */\nexport const principalHistoryStages = sqliteTable(\n  \"principal_history_stages\",\n  {\n    id: text(\"id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    afterVersion: integer(\"after_version\").notNull(),\n    complete: integer(\"complete\", { mode: \"boolean\" }).notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_stages_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryStageTables = [\n  defineSqlTableSchema(principalHistoryStages),\n];\n"]}
+{"version":3,"file":"principalHistoryStageSchema.js","sourceRoot":"","sources":["principalHistoryStageSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,CACtD,+BAA+B,CAAC,KAAK,CAAC,WAAW,CAAC,EAClD,KAAK,CAAC,QAAQ,EACd,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CACzB;IACD,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB,CAAC,sBAAsB,CAAC;CAC7C,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport { index, integer, sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { principalCurrentFingerprintJson } from \"./principalKeyFingerprintJson\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** Provisional, locally authenticated verification work; never an app checkpoint. */\nexport const principalHistoryStages = sqliteTable(\n  \"principal_history_stages\",\n  {\n    id: text(\"id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    afterVersion: integer(\"after_version\").notNull(),\n    complete: integer(\"complete\", { mode: \"boolean\" }).notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_stages_key_fingerprint_idx\").on(\n      principalCurrentFingerprintJson(table.currentJson),\n      table.complete,\n      desc(table.afterVersion),\n    ),\n    index(\"principal_history_stages_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryStageTables = [\n  defineSqlTableSchema(principalHistoryStages),\n];\n"]}