@tearleads/client-sdk 0.1.15 → 0.1.17

package/workflows/organizations/retainAcknowledgedPrincipalCurrents.js

@@ -0,0 +1,159 @@
+import { KeyingVerificationError, restorePrincipalPolicyHistoryVerifier, verifyPrincipalPolicyCurrent, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { persistAcknowledgedPrincipalCurrents, } from "../../data/persistence/principalCurrentAcknowledgementPersistence.js";
+import { preparePrincipalHistoryEvidencePage } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { loadPrincipalHistoryPrefix } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import { principalHistoryEvidenceScopeId, principalHistoryPrefixProtection, } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
+import { parsePrincipalHistoryStageCurrent } from "../../data/principals/principalHistoryStageProtection.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../principals/policyVerification.js";
+import { assertPrincipalHistoryVerificationMode, principalHistoryVerificationContext, } from "../principals/principalHistoryRecoveryVerification.js";
+import { assertAcknowledgedDirectoryBindings } from "./acknowledgedDirectoryBindings.js";
+import { acknowledgeGroupPolicyState } from "./groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { prepareInitialGroupCurrentPublication } from "./initialPrincipalCurrentPublication.js";
+import { sealPrincipalCurrentPublication, sealPrincipalCurrentStage, } from "./principalCurrentPublicationSeal.js";
+import { assertPrincipalPolicyReceiptArtifacts } from "./principalPolicyReceiptArtifacts.js";
+async function restorePredecessor(options) {
+    const scopeId = await principalHistoryEvidenceScopeId({
+        organizationId: options.organizationId,
+        head: options.expectedHead,
+        protection: options.protection,
+    });
+    const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);
+    if (!saved || saved.organizationId !== options.organizationId)
+        throw new KeyingVerificationError("missing_dependency", "Acknowledgement requires its authenticated predecessor prefix");
+    const restored = await restorePrincipalPolicyHistoryVerifier({
+        principalId: options.expectedHead.principalId,
+        principalType: options.expectedHead.principalType,
+    }, saved.progress, await principalHistoryPrefixProtection(options.protection, saved));
+    if (!restored.ok)
+        throw restored.error;
+    const history = restored.value.finish(options.expectedHead);
+    if (!history.ok)
+        throw history.error;
+    const artifacts = parsePrincipalHistoryStageCurrent({
+        currentJson: saved.currentJson,
+        afterVersion: saved.version - 1,
+    });
+    if (!artifacts)
+        throw new KeyingVerificationError("invalid_shape", "Acknowledged predecessor artifacts are malformed");
+    const previous = await verifyPrincipalPolicyCurrent({
+        current: artifacts,
+        history: history.value,
+    });
+    if (!previous.ok)
+        throw previous.error;
+    return {
+        scopeId,
+        saved,
+        artifacts,
+        verifier: restored.value,
+        previous: previous.value,
+    };
+}
+async function preparePublication(options, request, response) {
+    options = {
+        ...options,
+        protection: {
+            ...options.protection,
+            context: principalHistoryVerificationContext(options),
+        },
+    };
+    const current = () => !options.signal?.aborted && options.stillCurrent();
+    assertProjectionVerificationCurrent(current);
+    const { scopeId, saved, artifacts, verifier, previous } = await restorePredecessor(options);
+    const expectedHead = await groupPolicyMutationHead(request);
+    assertPrincipalPolicyReceiptArtifacts({ expectedHead, request, response });
+    const keys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: { currentState: response.currentState, previousStates: [] },
+        resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,
+    });
+    assertProjectionVerificationCurrent(current);
+    if ("error" in keys)
+        throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Acknowledged principal signer could not be authenticated");
+    const externalAuthority = await options.loadExternalAuthority?.(request.state.externalAuthority ? [request.state.externalAuthority] : []);
+    assertProjectionVerificationCurrent(current);
+    const policy = await acknowledgeGroupPolicyState({
+        verifiedCurrentPolicy: previous,
+        expectedHead,
+        request,
+        response: response.currentState,
+        signerPublicKeys: keys.signerPublicKeys,
+        externalAuthority,
+        stillCurrent: current,
+    });
+    const entry = {
+        state: response.currentState,
+        projection: response.currentProjection,
+        grants: response.currentGrants,
+    };
+    assertPrincipalHistoryVerificationMode(options, [entry]);
+    const predecessorStage = await sealPrincipalCurrentStage(options, previous.state, verifier, artifacts);
+    const appended = await verifier.append({
+        entries: [entry],
+        signerPublicKeys: keys.signerPublicKeys,
+        ...(externalAuthority ? { externalAuthority } : {}),
+    });
+    if (!appended.ok)
+        throw appended.error;
+    const sealed = await sealPrincipalCurrentPublication(options, scopeId, expectedHead, verifier, response);
+    assertProjectionVerificationCurrent(current);
+    return {
+        policy,
+        previousPrefixProgress: saved.progress,
+        predecessorStage,
+        ...sealed,
+        evidence: await preparePrincipalHistoryEvidencePage({
+            scopeId,
+            organizationId: options.organizationId,
+            entries: [entry],
+            nodes: appended.value.indexNodes,
+        }),
+    };
+}
+/** Extend authenticated local progress and retain exact acknowledged artifacts atomically with pins. */
+export async function retainAcknowledgedPrincipalCurrents(input) {
+    const execSql = input.execSql;
+    const organizationId = input.organizationId;
+    const stillCurrent = input.stillCurrent;
+    const retirements = structuredClone(input.retirements ?? []);
+    const entries = [];
+    try {
+        assertProjectionVerificationCurrent(stillCurrent);
+        for (const entry of input.entries)
+            entries.push({
+                initialGroup: entry.initialGroup === true,
+                request: structuredClone(entry.request),
+                response: structuredClone(entry.response),
+                options: {
+                    ...entry.recovery,
+                    expectedHead: structuredClone(entry.recovery.expectedHead),
+                    protection: ownPrincipalHistoryProtection(entry.recovery.protection),
+                    execSql,
+                    organizationId,
+                    stillCurrent,
+                },
+            });
+        const publications = [];
+        for (const entry of entries)
+            publications.push(await (entry.initialGroup
+                ? prepareInitialGroupCurrentPublication
+                : preparePublication)(entry.options, entry.request, entry.response));
+        assertAcknowledgedDirectoryBindings(organizationId, entries.map(({ response }) => response));
+        await persistAcknowledgedPrincipalCurrents({
+            execSql,
+            organizationId,
+            entries: publications,
+            retirements,
+            stillCurrent: () => stillCurrent() &&
+                entries.every((entry) => !entry.options.signal?.aborted),
+        });
+        return publications.map(({ policy }) => policy);
+    }
+    finally {
+        for (const entry of entries)
+            entry.options.protection.localKey.fill(0);
+    }
+}
+//# sourceMappingURL=retainAcknowledgedPrincipalCurrents.js.map

package/workflows/organizations/retainAcknowledgedPrincipalCurrents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainAcknowledgedPrincipalCurrents.js","sourceRoot":"","sources":["retainAcknowledgedPrincipalCurrents.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qCAAqC,EAErC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAGL,oCAAoC,GACrC,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,0DAA0D,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAE1G,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAE1F,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAgB1F,KAAK,UAAU,kBAAkB,CAC/B,OAA6C;IAE7C,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D;QACE,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;QAC7C,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;KAClD,EACD,KAAK,CAAC,QAAQ,EACd,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAClE,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,SAAS,GAAG,iCAAiC,CAAC;QAClD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS;QACZ,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;QAClD,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,OAAO,CAAC,KAAK;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO;QACL,OAAO;QACP,KAAK;QACL,SAAS;QACT,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,QAAQ,EAAE,QAAQ,CAAC,KAAK;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAA6C,EAC7C,OAAkC,EAClC,QAAyC;IAEzC,OAAO,GAAG;QACR,GAAG,OAAO;QACV,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,UAAU;YACrB,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;SACtD;KACF,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GACrD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC5D,qCAAqC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QACnE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;KAC/D,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,0DAA0D,CAC3D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAC7D,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,qBAAqB,EAAE,QAAQ;QAC/B,YAAY;QACZ,OAAO;QACP,QAAQ,EAAE,QAAQ,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,iBAAiB;QACjB,YAAY,EAAE,OAAO;KACtB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,YAAY;QAC5B,UAAU,EAAE,QAAQ,CAAC,iBAAiB;QACtC,MAAM,EAAE,QAAQ,CAAC,aAAa;KAC/B,CAAC;IACF,sCAAsC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,MAAM,yBAAyB,CACtD,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,QAAQ,EACR,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACrC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAClD,OAAO,EACP,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,QAAQ;QACtC,gBAAgB;QAChB,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAQzD;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,OAAO,GAKP,EAAE,CAAC;IACT,IAAI,CAAC;QACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY,EAAE,KAAK,CAAC,YAAY,KAAK,IAAI;gBACzC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;gBACvC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzC,OAAO,EAAE;oBACP,GAAG,KAAK,CAAC,QAAQ;oBACjB,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC1D,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACpE,OAAO;oBACP,cAAc;oBACd,YAAY;iBACb;aACF,CAAC,CAAC;QACL,MAAM,YAAY,GAA8C,EAAE,CAAC;QACnE,KAAK,MAAM,KAAK,IAAI,OAAO;YACzB,YAAY,CAAC,IAAI,CACf,MAAM,CAAC,KAAK,CAAC,YAAY;gBACvB,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CACtE,CAAC;QACJ,mCAAmC,CACjC,cAAc,EACd,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,oCAAoC,CAAC;YACzC,OAAO;YACP,cAAc;YACd,OAAO,EAAE,YAAY;YACrB,WAAW;YACX,YAAY,EAAE,GAAG,EAAE,CACjB,YAAY,EAAE;gBACd,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  restorePrincipalPolicyHistoryVerifier,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport {\n  type AcknowledgedPrincipalCurrentPublication,\n  type AcknowledgedPrincipalCurrentRetirement,\n  persistAcknowledgedPrincipalCurrents,\n} from \"../../data/persistence/principalCurrentAcknowledgementPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { loadPrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport {\n  principalHistoryEvidenceScopeId,\n  principalHistoryPrefixProtection,\n} from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { parsePrincipalHistoryStageCurrent } from \"../../data/principals/principalHistoryStageProtection\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"../principals/principalHistoryRecoveryTypes\";\nimport {\n  assertPrincipalHistoryVerificationMode,\n  principalHistoryVerificationContext,\n} from \"../principals/principalHistoryRecoveryVerification\";\nimport { assertAcknowledgedDirectoryBindings } from \"./acknowledgedDirectoryBindings\";\nimport { acknowledgeGroupPolicyState } from \"./groupPolicyMutationAcknowledgement\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport { prepareInitialGroupCurrentPublication } from \"./initialPrincipalCurrentPublication\";\nimport {\n  sealPrincipalCurrentPublication,\n  sealPrincipalCurrentStage,\n} from \"./principalCurrentPublicationSeal\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"./principalPolicyReceiptArtifacts\";\n\nexport type { AcknowledgedPrincipalCurrentRetirement } from \"../../data/persistence/principalCurrentAcknowledgementPersistence\";\n\nexport interface AcknowledgedPrincipalCurrentInput {\n  /** Only a newly authored group at version one; never skips a predecessor. */\n  readonly initialGroup?: boolean | undefined;\n  /** The same scoped protection and verification mode used to recover the predecessor. */\n  readonly recovery: Omit<\n    RecoverPrincipalPolicyHistoryOptions,\n    \"execSql\" | \"organizationId\" | \"stillCurrent\"\n  >;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly response: PrincipalPolicyMutationResponse;\n}\n\nasync function restorePredecessor(\n  options: RecoverPrincipalPolicyHistoryOptions,\n) {\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: options.organizationId,\n    head: options.expectedHead,\n    protection: options.protection,\n  });\n  const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);\n  if (!saved || saved.organizationId !== options.organizationId)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Acknowledgement requires its authenticated predecessor prefix\",\n    );\n  const restored = await restorePrincipalPolicyHistoryVerifier(\n    {\n      principalId: options.expectedHead.principalId,\n      principalType: options.expectedHead.principalType,\n    },\n    saved.progress,\n    await principalHistoryPrefixProtection(options.protection, saved),\n  );\n  if (!restored.ok) throw restored.error;\n  const history = restored.value.finish(options.expectedHead);\n  if (!history.ok) throw history.error;\n  const artifacts = parsePrincipalHistoryStageCurrent({\n    currentJson: saved.currentJson,\n    afterVersion: saved.version - 1,\n  });\n  if (!artifacts)\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Acknowledged predecessor artifacts are malformed\",\n    );\n  const previous = await verifyPrincipalPolicyCurrent({\n    current: artifacts,\n    history: history.value,\n  });\n  if (!previous.ok) throw previous.error;\n  return {\n    scopeId,\n    saved,\n    artifacts,\n    verifier: restored.value,\n    previous: previous.value,\n  };\n}\n\nasync function preparePublication(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  request: PutPrincipalPolicyRequest,\n  response: PrincipalPolicyMutationResponse,\n): Promise<AcknowledgedPrincipalCurrentPublication> {\n  options = {\n    ...options,\n    protection: {\n      ...options.protection,\n      context: principalHistoryVerificationContext(options),\n    },\n  };\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const { scopeId, saved, artifacts, verifier, previous } =\n    await restorePredecessor(options);\n  const expectedHead = await groupPolicyMutationHead(request);\n  assertPrincipalPolicyReceiptArtifacts({ expectedHead, request, response });\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: { currentState: response.currentState, previousStates: [] },\n    resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,\n  });\n  assertProjectionVerificationCurrent(current);\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Acknowledged principal signer could not be authenticated\",\n    );\n  const externalAuthority = await options.loadExternalAuthority?.(\n    request.state.externalAuthority ? [request.state.externalAuthority] : [],\n  );\n  assertProjectionVerificationCurrent(current);\n  const policy = await acknowledgeGroupPolicyState({\n    verifiedCurrentPolicy: previous,\n    expectedHead,\n    request,\n    response: response.currentState,\n    signerPublicKeys: keys.signerPublicKeys,\n    externalAuthority,\n    stillCurrent: current,\n  });\n  const entry = {\n    state: response.currentState,\n    projection: response.currentProjection,\n    grants: response.currentGrants,\n  };\n  assertPrincipalHistoryVerificationMode(options, [entry]);\n  const predecessorStage = await sealPrincipalCurrentStage(\n    options,\n    previous.state,\n    verifier,\n    artifacts,\n  );\n  const appended = await verifier.append({\n    entries: [entry],\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) throw appended.error;\n  const sealed = await sealPrincipalCurrentPublication(\n    options,\n    scopeId,\n    expectedHead,\n    verifier,\n    response,\n  );\n  assertProjectionVerificationCurrent(current);\n  return {\n    policy,\n    previousPrefixProgress: saved.progress,\n    predecessorStage,\n    ...sealed,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      scopeId,\n      organizationId: options.organizationId,\n      entries: [entry],\n      nodes: appended.value.indexNodes,\n    }),\n  };\n}\n\n/** Extend authenticated local progress and retain exact acknowledged artifacts atomically with pins. */\nexport async function retainAcknowledgedPrincipalCurrents(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly entries: readonly AcknowledgedPrincipalCurrentInput[];\n  readonly retirements?:\n    | readonly AcknowledgedPrincipalCurrentRetirement[]\n    | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<VerifiedPrincipalPolicyCurrent[]> {\n  const execSql = input.execSql;\n  const organizationId = input.organizationId;\n  const stillCurrent = input.stillCurrent;\n  const retirements = structuredClone(input.retirements ?? []);\n  const entries: {\n    initialGroup: boolean;\n    request: PutPrincipalPolicyRequest;\n    response: PrincipalPolicyMutationResponse;\n    options: RecoverPrincipalPolicyHistoryOptions;\n  }[] = [];\n  try {\n    assertProjectionVerificationCurrent(stillCurrent);\n    for (const entry of input.entries)\n      entries.push({\n        initialGroup: entry.initialGroup === true,\n        request: structuredClone(entry.request),\n        response: structuredClone(entry.response),\n        options: {\n          ...entry.recovery,\n          expectedHead: structuredClone(entry.recovery.expectedHead),\n          protection: ownPrincipalHistoryProtection(entry.recovery.protection),\n          execSql,\n          organizationId,\n          stillCurrent,\n        },\n      });\n    const publications: AcknowledgedPrincipalCurrentPublication[] = [];\n    for (const entry of entries)\n      publications.push(\n        await (entry.initialGroup\n          ? prepareInitialGroupCurrentPublication\n          : preparePublication)(entry.options, entry.request, entry.response),\n      );\n    assertAcknowledgedDirectoryBindings(\n      organizationId,\n      entries.map(({ response }) => response),\n    );\n    await persistAcknowledgedPrincipalCurrents({\n      execSql,\n      organizationId,\n      entries: publications,\n      retirements,\n      stillCurrent: () =>\n        stillCurrent() &&\n        entries.every((entry) => !entry.options.signal?.aborted),\n    });\n    return publications.map(({ policy }) => policy);\n  } finally {\n    for (const entry of entries) entry.options.protection.localKey.fill(0);\n  }\n}\n"]}

package/workflows/organizations/runtimeCurrentGroupMutation.js

@@ -0,0 +1,85 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { scopedGroupHistoryProtection } from "../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { resolveCurrentGroupMutationReferences } from "./currentGroupMutationReferences.js";
+import { loadCurrentGroupPolicyMutationContext } from "./currentGroupPolicyMutationContext.js";
+import { createCurrentPrincipalMutationLease } from "./currentPrincipalMutationLease.js";
+import { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+/** Keep private prefix custody inside the entire mutation and its acknowledgement. */
+export function createRuntimeCurrentGroupMutation(runtime) {
+    const lease = createCurrentPrincipalMutationLease(runtime);
+    if (!lease)
+        return undefined;
+    return async (input, work) => {
+        input = { ...input };
+        return lease(input.stillCurrent, async ({ protection, stillCurrent, resolveCurrentPolicy, readPages, directoryRecovery, }) => {
+            const context = await loadCurrentGroupPolicyMutationContext({
+                ...input,
+                execSql: runtime.infra.execSql,
+                resolveCurrentPolicy,
+                recoverPendingPrincipalMutation: (organizationId) => runtime.apiClient.recoverPendingPrincipalMutation(organizationId),
+                stillCurrent,
+            });
+            const result = await work({
+                ...context,
+                resolveAuthoredPolicyReferences: (current, references) => resolveCurrentGroupMutationReferences({
+                    current,
+                    predecessor: context.verifiedCurrentPolicy,
+                    references,
+                    readPredecessorReference: context.readPredecessorReference,
+                    stillCurrent: context.stillCurrent,
+                }),
+                retainAcknowledged: createCurrentMutationRetention(runtime, input, context, protection, readPages, directoryRecovery(context.organizationCurrent.current)),
+            });
+            assertProjectionVerificationCurrent(context.stillCurrent);
+            return result;
+        });
+    };
+}
+function createCurrentMutationRetention(runtime, input, context, protection, readPages, directoryRecovery) {
+    const common = {
+        apiClient: { getPrincipalPolicyPages: readPages },
+        resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+    };
+    const groupRecovery = {
+        ...common,
+        expectedHead: principalPolicyReferenceFromBundle(context.currentPolicy),
+        protection: context.isOrganizationAdminsGroup
+            ? protection
+            : scopedGroupHistoryProtection(protection, input.organizationId, context.adminGroupId),
+        historyVerification: context.isOrganizationAdminsGroup
+            ? "direct-admins"
+            : "standard",
+        ...(context.isOrganizationAdminsGroup
+            ? {}
+            : { loadExternalAuthority: async () => context.externalAuthority }),
+    };
+    return async (receipt) => {
+        assertProjectionVerificationCurrent(context.stillCurrent);
+        await retainAcknowledgedPrincipalCurrents({
+            execSql: runtime.infra.execSql,
+            organizationId: input.organizationId,
+            entries: [
+                {
+                    recovery: groupRecovery,
+                    request: receipt.request,
+                    response: receipt.response.groupPolicy,
+                },
+                {
+                    recovery: directoryRecovery,
+                    request: receipt.organizationRequest,
+                    response: receipt.response.organizationPolicy,
+                },
+            ],
+            retirements: [
+                {
+                    principalId: input.groupId,
+                    principalType: "group",
+                    containerIds: receipt.retiredContainerIds ?? [],
+                },
+            ],
+            stillCurrent: context.stillCurrent,
+        });
+    };
+}
+//# sourceMappingURL=runtimeCurrentGroupMutation.js.map

package/workflows/organizations/runtimeCurrentGroupMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCurrentGroupMutation.js","sourceRoot":"","sources":["runtimeCurrentGroupMutation.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAEvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,OAAO,EAEL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAgC/C,sFAAsF;AACtF,MAAM,UAAU,iCAAiC,CAAC,OAAwB;IACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAoB,EACpB,IAAiE,EACrD,EAAE;QACd,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EACL,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,SAAS,EACT,iBAAiB,GAClB,EAAE,EAAE;YACH,MAAM,OAAO,GAAG,MAAM,qCAAqC,CAAC;gBAC1D,GAAG,KAAK;gBACR,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,oBAAoB;gBACpB,+BAA+B,EAAE,CAAC,cAAc,EAAE,EAAE,CAClD,OAAO,CAAC,SAAS,CAAC,+BAA+B,CAAC,cAAc,CAAC;gBACnE,YAAY;aACb,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,GAAG,OAAO;gBACV,+BAA+B,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CACvD,qCAAqC,CAAC;oBACpC,OAAO;oBACP,WAAW,EAAE,OAAO,CAAC,qBAAqB;oBAC1C,UAAU;oBACV,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;oBAC1D,YAAY,EAAE,OAAO,CAAC,YAAY;iBACnC,CAAC;gBACJ,kBAAkB,EAAE,8BAA8B,CAChD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,SAAS,EACT,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CACvD;aACF,CAAC,CAAC;YACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,OAAwB,EACxB,KAAoB,EACpB,OAA+B,EAC/B,UAAiD,EACjD,SAA+C,EAC/C,iBAAgE;IAEhE,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE;QACjD,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;KAC/D,CAAC;IACF,MAAM,aAAa,GAAkD;QACnE,GAAG,MAAM;QACT,YAAY,EAAE,kCAAkC,CAAC,OAAO,CAAC,aAAa,CAAC;QACvE,UAAU,EAAE,OAAO,CAAC,yBAAyB;YAC3C,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,4BAA4B,CAC1B,UAAU,EACV,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,CACrB;QACL,mBAAmB,EAAE,OAAO,CAAC,yBAAyB;YACpD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,UAAU;QACd,GAAG,CAAC,OAAO,CAAC,yBAAyB;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;KACtE,CAAC;IACF,OAAO,KAAK,EAAE,OAA+B,EAAiB,EAAE;QAC9D,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE;gBACP;oBACE,QAAQ,EAAE,aAAa;oBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;iBACvC;gBACD;oBACE,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,OAAO,CAAC,mBAAmB;oBACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;iBAC9C;aACF;YACD,WAAW,EAAE;gBACX;oBACE,WAAW,EAAE,KAAK,CAAC,OAAO;oBAC1B,aAAa,EAAE,OAAO;oBACtB,YAAY,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE;iBAChD;aACF;YACD,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { CommitOrganizationGroupPolicyResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport { scopedGroupHistoryProtection } from \"../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"../principals/runtimePolicyRecovery\";\nimport { resolveCurrentGroupMutationReferences } from \"./currentGroupMutationReferences\";\nimport { loadCurrentGroupPolicyMutationContext } from \"./currentGroupPolicyMutationContext\";\nimport { createCurrentPrincipalMutationLease } from \"./currentPrincipalMutationLease\";\nimport type { PrincipalMutationRecoveryApi } from \"./principalMutationJournalManagement\";\nimport {\n  type AcknowledgedPrincipalCurrentInput,\n  retainAcknowledgedPrincipalCurrents,\n} from \"./retainAcknowledgedPrincipalCurrents\";\n\ntype MutationRuntime = PrincipalPolicyRecoveryRuntime & {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] &\n    Pick<PrincipalMutationRecoveryApi, \"recoverPendingPrincipalMutation\">;\n};\n\ntype CurrentMutationContext = Awaited<\n  ReturnType<typeof loadCurrentGroupPolicyMutationContext>\n>;\n\nexport type RuntimeCurrentGroupMutationContext = CurrentMutationContext & {\n  readonly resolveAuthoredPolicyReferences: CurrentPolicyReferenceResolver;\n  readonly retainAcknowledged: (\n    receipt: CurrentMutationReceipt,\n  ) => Promise<void>;\n};\n\ninterface CurrentMutationReceipt {\n  readonly request: PutPrincipalPolicyRequest;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  readonly response: CommitOrganizationGroupPolicyResponse;\n  readonly retiredContainerIds?: readonly string[] | undefined;\n}\n\ninterface MutationInput {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly stillCurrent: () => boolean;\n}\n\n/** Keep private prefix custody inside the entire mutation and its acknowledgement. */\nexport function createRuntimeCurrentGroupMutation(runtime: MutationRuntime) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: MutationInput,\n    work: (context: RuntimeCurrentGroupMutationContext) => Promise<T>,\n  ): Promise<T> => {\n    input = { ...input };\n    return lease(\n      input.stillCurrent,\n      async ({\n        protection,\n        stillCurrent,\n        resolveCurrentPolicy,\n        readPages,\n        directoryRecovery,\n      }) => {\n        const context = await loadCurrentGroupPolicyMutationContext({\n          ...input,\n          execSql: runtime.infra.execSql,\n          resolveCurrentPolicy,\n          recoverPendingPrincipalMutation: (organizationId) =>\n            runtime.apiClient.recoverPendingPrincipalMutation(organizationId),\n          stillCurrent,\n        });\n        const result = await work({\n          ...context,\n          resolveAuthoredPolicyReferences: (current, references) =>\n            resolveCurrentGroupMutationReferences({\n              current,\n              predecessor: context.verifiedCurrentPolicy,\n              references,\n              readPredecessorReference: context.readPredecessorReference,\n              stillCurrent: context.stillCurrent,\n            }),\n          retainAcknowledged: createCurrentMutationRetention(\n            runtime,\n            input,\n            context,\n            protection,\n            readPages,\n            directoryRecovery(context.organizationCurrent.current),\n          ),\n        });\n        assertProjectionVerificationCurrent(context.stillCurrent);\n        return result;\n      },\n    );\n  };\n}\n\nfunction createCurrentMutationRetention(\n  runtime: MutationRuntime,\n  input: MutationInput,\n  context: CurrentMutationContext,\n  protection: PrincipalPolicyHistoryProgressOptions,\n  readPages: ApiClient[\"getPrincipalPolicyPages\"],\n  directoryRecovery: AcknowledgedPrincipalCurrentInput[\"recovery\"],\n) {\n  const common = {\n    apiClient: { getPrincipalPolicyPages: readPages },\n    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n  };\n  const groupRecovery: AcknowledgedPrincipalCurrentInput[\"recovery\"] = {\n    ...common,\n    expectedHead: principalPolicyReferenceFromBundle(context.currentPolicy),\n    protection: context.isOrganizationAdminsGroup\n      ? protection\n      : scopedGroupHistoryProtection(\n          protection,\n          input.organizationId,\n          context.adminGroupId,\n        ),\n    historyVerification: context.isOrganizationAdminsGroup\n      ? \"direct-admins\"\n      : \"standard\",\n    ...(context.isOrganizationAdminsGroup\n      ? {}\n      : { loadExternalAuthority: async () => context.externalAuthority }),\n  };\n  return async (receipt: CurrentMutationReceipt): Promise<void> => {\n    assertProjectionVerificationCurrent(context.stillCurrent);\n    await retainAcknowledgedPrincipalCurrents({\n      execSql: runtime.infra.execSql,\n      organizationId: input.organizationId,\n      entries: [\n        {\n          recovery: groupRecovery,\n          request: receipt.request,\n          response: receipt.response.groupPolicy,\n        },\n        {\n          recovery: directoryRecovery,\n          request: receipt.organizationRequest,\n          response: receipt.response.organizationPolicy,\n        },\n      ],\n      retirements: [\n        {\n          principalId: input.groupId,\n          principalType: \"group\",\n          containerIds: receipt.retiredContainerIds ?? [],\n        },\n      ],\n      stillCurrent: context.stillCurrent,\n    });\n  };\n}\n"]}

package/workflows/organizations/runtimeCurrentOrganizationMutation.js

@@ -0,0 +1,48 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { loadCurrentOrganizationMutationAuthority } from "./currentOrganizationMutationAuthority.js";
+import { createCurrentOrganizationMutationRetention } from "./currentOrganizationMutationRetention.js";
+import { createCurrentPrincipalMutationLease } from "./currentPrincipalMutationLease.js";
+/** Keep directory authoring and exact acknowledgement inside one private lease. */
+export function createRuntimeCurrentOrganizationMutation(runtime) {
+    const lease = createCurrentPrincipalMutationLease(runtime);
+    if (!lease)
+        return undefined;
+    return async (input, work) => {
+        const owned = { ...input };
+        return lease(owned.stillCurrent, async ({ protection, readPages, stillCurrent, resolveCurrentPolicy, directoryRecovery, }) => {
+            const { authority } = await loadCurrentOrganizationMutationAuthority({
+                execSql: runtime.infra.execSql,
+                organizationId: owned.organizationId,
+                signerUserId: owned.signerUserId,
+                recoverPendingPrincipalMutation: (organizationId) => runtime.apiClient.recoverPendingPrincipalMutation(organizationId),
+                resolveCurrentPolicy,
+                stillCurrent,
+            });
+            const current = () => stillCurrent() && authority.stillCurrent();
+            await advanceKeyingCheckpointsAtomically({
+                access: [],
+                execSql: runtime.infra.execSql,
+                organizationId: owned.organizationId,
+                policies: [authority.directory.policy, authority.admins.policy],
+                stillCurrent: current,
+            });
+            const result = await work({
+                ...authority,
+                stillCurrent: current,
+                ...createCurrentOrganizationMutationRetention({
+                    runtime,
+                    authority,
+                    protection,
+                    readPages,
+                    organizationId: owned.organizationId,
+                    directoryRecovery: directoryRecovery(authority.directory.current),
+                    stillCurrent: current,
+                }),
+            });
+            assertProjectionVerificationCurrent(current);
+            return result;
+        });
+    };
+}
+//# sourceMappingURL=runtimeCurrentOrganizationMutation.js.map

package/workflows/organizations/runtimeCurrentOrganizationMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCurrentOrganizationMutation.js","sourceRoot":"","sources":["runtimeCurrentOrganizationMutation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAG/G,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAmBtF,mFAAmF;AACnF,MAAM,UAAU,wCAAwC,CAAC,OAAgB;IACvE,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAY,EACZ,IAAiE,EACrD,EAAE;QACd,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,GAClB,EAAE,EAAE;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wCAAwC,CAAC;gBACnE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,CAAC,cAAc,EAAE,EAAE,CAClD,OAAO,CAAC,SAAS,CAAC,+BAA+B,CAAC,cAAc,CAAC;gBACnE,oBAAoB;gBACpB,YAAY;aACb,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACjE,MAAM,kCAAkC,CAAC;gBACvC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC/D,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,GAAG,SAAS;gBACZ,YAAY,EAAE,OAAO;gBACrB,GAAG,0CAA0C,CAAC;oBAC5C,OAAO;oBACP,SAAS;oBACT,UAAU;oBACV,SAAS;oBACT,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,iBAAiB,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;oBACjE,YAAY,EAAE,OAAO;iBACtB,CAAC;aACH,CAAC,CAAC;YACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"../principals/runtimePolicyRecovery\";\nimport type { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { loadCurrentOrganizationMutationAuthority } from \"./currentOrganizationMutationAuthority\";\nimport { createCurrentOrganizationMutationRetention } from \"./currentOrganizationMutationRetention\";\nimport { createCurrentPrincipalMutationLease } from \"./currentPrincipalMutationLease\";\nimport type { PrincipalMutationRecoveryApi } from \"./principalMutationJournalManagement\";\n\ntype Runtime = PrincipalPolicyRecoveryRuntime & {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] &\n    Pick<PrincipalMutationRecoveryApi, \"recoverPendingPrincipalMutation\">;\n};\n\ninterface Input {\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly stillCurrent: () => boolean;\n}\n\ntype Authority = Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>;\n\nexport type CurrentOrganizationMutationContext = Authority &\n  ReturnType<typeof createCurrentOrganizationMutationRetention>;\n\n/** Keep directory authoring and exact acknowledgement inside one private lease. */\nexport function createRuntimeCurrentOrganizationMutation(runtime: Runtime) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: Input,\n    work: (context: CurrentOrganizationMutationContext) => Promise<T>,\n  ): Promise<T> => {\n    const owned = { ...input };\n    return lease(\n      owned.stillCurrent,\n      async ({\n        protection,\n        readPages,\n        stillCurrent,\n        resolveCurrentPolicy,\n        directoryRecovery,\n      }) => {\n        const { authority } = await loadCurrentOrganizationMutationAuthority({\n          execSql: runtime.infra.execSql,\n          organizationId: owned.organizationId,\n          signerUserId: owned.signerUserId,\n          recoverPendingPrincipalMutation: (organizationId) =>\n            runtime.apiClient.recoverPendingPrincipalMutation(organizationId),\n          resolveCurrentPolicy,\n          stillCurrent,\n        });\n        const current = () => stillCurrent() && authority.stillCurrent();\n        await advanceKeyingCheckpointsAtomically({\n          access: [],\n          execSql: runtime.infra.execSql,\n          organizationId: owned.organizationId,\n          policies: [authority.directory.policy, authority.admins.policy],\n          stillCurrent: current,\n        });\n        const result = await work({\n          ...authority,\n          stillCurrent: current,\n          ...createCurrentOrganizationMutationRetention({\n            runtime,\n            authority,\n            protection,\n            readPages,\n            organizationId: owned.organizationId,\n            directoryRecovery: directoryRecovery(authority.directory.current),\n            stillCurrent: current,\n          }),\n        });\n        assertProjectionVerificationCurrent(current);\n        return result;\n      },\n    );\n  };\n}\n"]}

package/workflows/principals/loadRecoveredPrincipalHistoryPage.d.ts

@@ -0,0 +1,11 @@
+import { type PrincipalPolicyStateChainEntryResponse } from "../../internal/validators/response/index.js";
+import { type RecoverPrincipalPolicyHistoryOptions } from "./principalHistoryRecoveryTypes.js";
+export declare const PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE = 32;
+export interface RecoveredPrincipalHistoryPage {
+    /** Ascending entries, with the immediate predecessor kept separately for diffs. */
+    readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];
+    readonly predecessor: PrincipalPolicyStateChainEntryResponse | null;
+    readonly nextBeforeVersion: number | null;
+}
+/** Read a bounded historical window from an already recovered, exact private root. */
+export declare function loadRecoveredPrincipalHistoryPage(options: RecoverPrincipalPolicyHistoryOptions, beforeVersion?: number): Promise<RecoveredPrincipalHistoryPage>;

package/workflows/principals/loadRecoveredPrincipalHistoryPage.js

@@ -0,0 +1,120 @@
+import { KeyingVerificationError, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
+import { isPrincipalPolicyStateChainEntryResponse, } from "../../internal/validators/response/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { principalHistoryEvidenceScopeId } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
+import { loadVerifiedPrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
+import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
+import { PrincipalHistoryRecoveryRaceError, } from "./principalHistoryRecoveryTypes.js";
+import { principalHistoryVerificationContext } from "./principalHistoryRecoveryVerification.js";
+export const PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE = 32;
+/** Read a bounded historical window from an already recovered, exact private root. */
+export async function loadRecoveredPrincipalHistoryPage(options, beforeVersion = options.expectedHead.version + 1) {
+    const owned = {
+        ...options,
+        expectedHead: structuredClone(options.expectedHead),
+        protection: ownPrincipalHistoryProtection(options.protection),
+    };
+    try {
+        return await readPage(owned, beforeVersion);
+    }
+    finally {
+        owned.protection.localKey.fill(0);
+    }
+}
+async function readPage(options, beforeVersion) {
+    if (!Number.isSafeInteger(beforeVersion) ||
+        beforeVersion <= 1 ||
+        beforeVersion > options.expectedHead.version + 1)
+        throw new KeyingVerificationError("invalid_shape", "Principal history page cursor is outside the selected history");
+    const current = () => !options.signal?.aborted && options.stillCurrent();
+    assertProjectionVerificationCurrent(current);
+    const { scopeId, history } = await restoreReadRoot(options, current);
+    const checkpoint = await loadPrincipalPolicyCheckpoint(options.execSql, options.expectedHead.principalType, options.expectedHead.principalId);
+    if (checkpoint && checkpoint.version > options.expectedHead.version)
+        throw new PrincipalHistoryRecoveryRaceError("Principal checkpoint advanced beyond the selected display history");
+    const load = (version) => loadPageReference({
+        execSql: options.execSql,
+        scopeId,
+        history,
+        version,
+    });
+    const firstVersion = Math.max(1, beforeVersion - PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE);
+    const references = [];
+    for (let version = Math.max(1, firstVersion - 1); version < beforeVersion; version += 1) {
+        assertProjectionVerificationCurrent(current);
+        references.push(await load(version));
+    }
+    const checkpointReference = checkpoint
+        ? await load(checkpoint.version)
+        : undefined;
+    if (checkpointReference &&
+        checkpointReference.reference.stateHash !== checkpoint?.stateHash)
+        throw new KeyingVerificationError("equivocation", "Principal history page conflicts with its durable checkpoint");
+    const selected = await verifyPrincipalPolicyHistoryReferences({
+        history,
+        references,
+        checkpointReference,
+    });
+    if (!selected.ok)
+        throw new PrincipalHistoryEvidenceUnavailableError(selected.error);
+    await assertDisplayCheckpointCurrent(options, checkpoint);
+    assertProjectionVerificationCurrent(current);
+    // These exact rows passed inclusion and commitment verification above. Keep
+    // their display-only server timestamps, which the private current strips.
+    const retained = references.map(({ entry }) => responseEntry(entry));
+    return {
+        entries: retained.filter(({ state }) => state.version >= firstVersion && state.version < beforeVersion),
+        predecessor: retained.find(({ state }) => state.version === firstVersion - 1) ?? null,
+        nextBeforeVersion: firstVersion > 1 ? firstVersion : null,
+    };
+}
+async function assertDisplayCheckpointCurrent(options, checkpoint) {
+    const latest = await loadPrincipalPolicyCheckpoint(options.execSql, options.expectedHead.principalType, options.expectedHead.principalId);
+    if (latest?.version !== checkpoint?.version ||
+        latest?.stateHash !== checkpoint?.stateHash)
+        throw new PrincipalHistoryRecoveryRaceError("Principal checkpoint changed while reading display history");
+}
+async function loadPageReference(input) {
+    try {
+        return await loadPrincipalHistoryReference(input);
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw new PrincipalHistoryEvidenceUnavailableError(error);
+        throw error;
+    }
+}
+function responseEntry(entry) {
+    if (!isPrincipalPolicyStateChainEntryResponse(entry))
+        throw new KeyingVerificationError("missing_dependency", "Principal history display metadata is unavailable");
+    return entry;
+}
+async function restoreReadRoot(options, current) {
+    const normalized = {
+        ...options,
+        protection: {
+            ...options.protection,
+            context: principalHistoryVerificationContext(options),
+        },
+    };
+    const scopeId = await principalHistoryEvidenceScopeId({
+        organizationId: options.organizationId,
+        head: options.expectedHead,
+        protection: normalized.protection,
+    });
+    const prefix = await loadVerifiedPrincipalHistoryPrefix(normalized, {
+        principalType: options.expectedHead.principalType,
+        principalId: options.expectedHead.principalId,
+    }, scopeId);
+    assertProjectionVerificationCurrent(current);
+    if (!prefix)
+        throw new KeyingVerificationError("missing_dependency", "Principal history page requires a recovered private prefix");
+    const finished = prefix.verifier.finish(options.expectedHead);
+    if (!finished.ok)
+        throw finished.error;
+    return { scopeId, history: finished.value };
+}
+//# sourceMappingURL=loadRecoveredPrincipalHistoryPage.js.map

package/workflows/principals/loadRecoveredPrincipalHistoryPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadRecoveredPrincipalHistoryPage.js","sourceRoot":"","sources":["loadRecoveredPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,EACL,iCAAiC,GAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mCAAmC,EAAE,MAAM,wCAAwC,CAAC;AAE7F,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAStD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA6C,EAC7C,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;IAEhD,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAA6C,EAC7C,aAAqB;IAErB,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,IAAI,CAAC;QAClB,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QAEhD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QACjE,MAAM,IAAI,iCAAiC,CACzC,mEAAmE,CACpE,CAAC;IACJ,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAC/B,iBAAiB,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO;QACP,OAAO;QACP,OAAO;KACR,CAAC,CAAC;IACL,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,aAAa,GAAG,mCAAmC,CACpD,CAAC;IACF,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KACE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,EAC3C,OAAO,GAAG,aAAa,EACvB,OAAO,IAAI,CAAC,EACZ,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,mBAAmB;QACnB,mBAAmB,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,SAAS;QAEjE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8DAA8D,CAC/D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,8BAA8B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,OAAO,IAAI,YAAY,IAAI,KAAK,CAAC,OAAO,GAAG,aAAa,CACjE;QACD,WAAW,EACT,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,CAAC,CAAC,IAAI,IAAI;QAC1E,iBAAiB,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAA6C,EAC7C,UAAqE;IAErE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA0D;IAE1D,IAAI,CAAC;QACH,OAAO,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAqC;IAErC,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA6C,EAC7C,OAAsB;IAEtB,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO;QACV,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,UAAU;YACrB,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;SACtD;KACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,UAAU,EAAE,UAAU,CAAC,UAAU;KAClC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,UAAU,EACV;QACE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;QACjD,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;KAC9C,EACD,OAAO,CACR,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryReferenceProof,\n  type PrincipalPolicyStateChainEntry,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { principalHistoryVerificationContext } from \"./principalHistoryRecoveryVerification\";\n\nexport const PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE = 32;\n\nexport interface RecoveredPrincipalHistoryPage {\n  /** Ascending entries, with the immediate predecessor kept separately for diffs. */\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly predecessor: PrincipalPolicyStateChainEntryResponse | null;\n  readonly nextBeforeVersion: number | null;\n}\n\n/** Read a bounded historical window from an already recovered, exact private root. */\nexport async function loadRecoveredPrincipalHistoryPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion = options.expectedHead.version + 1,\n): Promise<RecoveredPrincipalHistoryPage> {\n  const owned = {\n    ...options,\n    expectedHead: structuredClone(options.expectedHead),\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    return await readPage(owned, beforeVersion);\n  } finally {\n    owned.protection.localKey.fill(0);\n  }\n}\n\nasync function readPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion: number,\n): Promise<RecoveredPrincipalHistoryPage> {\n  if (\n    !Number.isSafeInteger(beforeVersion) ||\n    beforeVersion <= 1 ||\n    beforeVersion > options.expectedHead.version + 1\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal history page cursor is outside the selected history\",\n    );\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const { scopeId, history } = await restoreReadRoot(options, current);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.expectedHead.principalType,\n    options.expectedHead.principalId,\n  );\n  if (checkpoint && checkpoint.version > options.expectedHead.version)\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Principal checkpoint advanced beyond the selected display history\",\n    );\n  const load = (version: number) =>\n    loadPageReference({\n      execSql: options.execSql,\n      scopeId,\n      history,\n      version,\n    });\n  const firstVersion = Math.max(\n    1,\n    beforeVersion - PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE,\n  );\n  const references: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (\n    let version = Math.max(1, firstVersion - 1);\n    version < beforeVersion;\n    version += 1\n  ) {\n    assertProjectionVerificationCurrent(current);\n    references.push(await load(version));\n  }\n  const checkpointReference = checkpoint\n    ? await load(checkpoint.version)\n    : undefined;\n  if (\n    checkpointReference &&\n    checkpointReference.reference.stateHash !== checkpoint?.stateHash\n  )\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Principal history page conflicts with its durable checkpoint\",\n    );\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history,\n    references,\n    checkpointReference,\n  });\n  if (!selected.ok)\n    throw new PrincipalHistoryEvidenceUnavailableError(selected.error);\n  await assertDisplayCheckpointCurrent(options, checkpoint);\n  assertProjectionVerificationCurrent(current);\n  // These exact rows passed inclusion and commitment verification above. Keep\n  // their display-only server timestamps, which the private current strips.\n  const retained = references.map(({ entry }) => responseEntry(entry));\n  return {\n    entries: retained.filter(\n      ({ state }) =>\n        state.version >= firstVersion && state.version < beforeVersion,\n    ),\n    predecessor:\n      retained.find(({ state }) => state.version === firstVersion - 1) ?? null,\n    nextBeforeVersion: firstVersion > 1 ? firstVersion : null,\n  };\n}\n\nasync function assertDisplayCheckpointCurrent(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  checkpoint: Awaited<ReturnType<typeof loadPrincipalPolicyCheckpoint>>,\n) {\n  const latest = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.expectedHead.principalType,\n    options.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Principal checkpoint changed while reading display history\",\n    );\n}\n\nasync function loadPageReference(\n  input: Parameters<typeof loadPrincipalHistoryReference>[0],\n) {\n  try {\n    return await loadPrincipalHistoryReference(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n}\n\nfunction responseEntry(\n  entry: PrincipalPolicyStateChainEntry,\n): PrincipalPolicyStateChainEntryResponse {\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history display metadata is unavailable\",\n    );\n  return entry;\n}\n\nasync function restoreReadRoot(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  current: () => boolean,\n) {\n  const normalized = {\n    ...options,\n    protection: {\n      ...options.protection,\n      context: principalHistoryVerificationContext(options),\n    },\n  };\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: options.organizationId,\n    head: options.expectedHead,\n    protection: normalized.protection,\n  });\n  const prefix = await loadVerifiedPrincipalHistoryPrefix(\n    normalized,\n    {\n      principalType: options.expectedHead.principalType,\n      principalId: options.expectedHead.principalId,\n    },\n    scopeId,\n  );\n  assertProjectionVerificationCurrent(current);\n  if (!prefix)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history page requires a recovered private prefix\",\n    );\n  const finished = prefix.verifier.finish(options.expectedHead);\n  if (!finished.ok) throw finished.error;\n  return { scopeId, history: finished.value };\n}\n"]}

package/workflows/principals/principalCurrentRecoveryBatch.js

@@ -0,0 +1,14 @@
+import { recoverCurrentOrganizationPolicy } from "./recoverCurrentOrganizationPolicy.js";
+import { createScopedPrincipalPolicyHistoryBatch } from "./recoverScopedPrincipalPolicyHistory.js";
+/** Discovery and selected references share one authenticated collection view. */
+export function createPrincipalCurrentRecoveryBatch() {
+    const memo = {
+        directories: new Map(),
+        admins: new Map(),
+    };
+    return {
+        recover: createScopedPrincipalPolicyHistoryBatch(memo),
+        discover: (input) => recoverCurrentOrganizationPolicy(input, memo),
+    };
+}
+//# sourceMappingURL=principalCurrentRecoveryBatch.js.map

package/workflows/principals/principalCurrentRecoveryBatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalCurrentRecoveryBatch.js","sourceRoot":"","sources":["principalCurrentRecoveryBatch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAEhG,iFAAiF;AACjF,MAAM,UAAU,mCAAmC;IACjD,MAAM,IAAI,GAA0B;QAClC,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,MAAM,EAAE,IAAI,GAAG,EAAE;KAClB,CAAC;IACF,OAAO;QACL,OAAO,EAAE,uCAAuC,CAAC,IAAI,CAAC;QACtD,QAAQ,EAAE,CAAC,KAA+B,EAAE,EAAE,CAC5C,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC;KAChD,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalRecoveryContext } from \"./principalRecoveryDirectory\";\nimport type { PrincipalRecoveryMemo } from \"./principalRecoveryMemo\";\nimport { recoverCurrentOrganizationPolicy } from \"./recoverCurrentOrganizationPolicy\";\nimport { createScopedPrincipalPolicyHistoryBatch } from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Discovery and selected references share one authenticated collection view. */\nexport function createPrincipalCurrentRecoveryBatch() {\n  const memo: PrincipalRecoveryMemo = {\n    directories: new Map(),\n    admins: new Map(),\n  };\n  return {\n    recover: createScopedPrincipalPolicyHistoryBatch(memo),\n    discover: (input: PrincipalRecoveryContext) =>\n      recoverCurrentOrganizationPolicy(input, memo),\n  };\n}\n"]}

package/workflows/principals/principalHistoryRecoveryReferences.js

@@ -22,6 +22,14 @@ async function selectReferences(input) {
             version: reference.version,
         }));
     }
+    const versions = new Set((options.retainedReferences ?? []).map((reference) => reference.version));
+    for (const version of options.retainedVersions ?? []) {
+        if (versions.has(version))
+            continue;
+        versions.add(version);
+        assertProjectionVerificationCurrent(current);
+        references.push(await loadPrincipalHistoryReference({ ...base, version }));
+    }
     assertProjectionVerificationCurrent(current);
     const checkpointReference = input.checkpoint
         ? await loadPrincipalHistoryReference({

package/workflows/principals/principalHistoryRecoveryReferences.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryReferences.js","sourceRoot":"","sources":["principalHistoryRecoveryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAIvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAGtG,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IAC5C;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAAC,KAK/B;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACzD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CACb,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,KAAK,CAAC,UAAU;QAC1C,CAAC,CAAC,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;SAClC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA6C;IAE7C,IAAI,QAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,gFAAgF;IAChF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAC/D,IACE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD;YAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryReferenceProof,\n  type VerifiedPrincipalPolicyHistory,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport class PrincipalHistoryEvidenceUnavailableError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PrincipalHistoryEvidenceUnavailableError\";\n  }\n}\n\nasync function selectReferences(input: {\n  readonly options: RecoverPrincipalPolicyHistoryOptions;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly checkpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<VerifiedPrincipalPolicyHistory> {\n  const { options, scopeId, history } = input;\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  const base = { execSql: options.execSql, scopeId, history };\n  const references: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (const reference of options.retainedReferences ?? []) {\n    assertProjectionVerificationCurrent(current);\n    references.push(\n      await loadPrincipalHistoryReference({\n        ...base,\n        version: reference.version,\n      }),\n    );\n  }\n  assertProjectionVerificationCurrent(current);\n  const checkpointReference = input.checkpoint\n    ? await loadPrincipalHistoryReference({\n        ...base,\n        version: input.checkpoint.version,\n      })\n    : undefined;\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history,\n    references,\n    checkpointReference,\n  });\n  if (!selected.ok) throw selected.error;\n  assertProjectionVerificationCurrent(current);\n  return selected.value;\n}\n\nexport async function selectRecoveredPrincipalHistory(\n  input: Parameters<typeof selectReferences>[0],\n): Promise<VerifiedPrincipalPolicyHistory> {\n  let selected: VerifiedPrincipalPolicyHistory;\n  try {\n    selected = await selectReferences(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n  // First authenticate the stored entry against the private root. Only then\n  // compare the caller's citation, so a bad request is not treated as cache loss.\n  for (const reference of input.options.retainedReferences ?? []) {\n    if (\n      !selected.retainedEntries.some(({ state }) =>\n        principalHeadMatchesReference(state, reference),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Requested citation does not match the verified principal history\",\n      );\n  }\n  return selected;\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryReferences.js","sourceRoot":"","sources":["principalHistoryRecoveryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAIvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAStG,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IAC5C;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAAC,KAK/B;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACzD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CACb,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CACzE,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QACpC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,MAAM,6BAA6B,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,KAAK,CAAC,UAAU;QAC1C,CAAC,CAAC,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;SAClC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA6C;IAE7C,IAAI,QAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,gFAAgF;IAChF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAC/D,IACE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD;YAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryReferenceProof,\n  type VerifiedPrincipalPolicyHistory,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport interface PrincipalHistorySelectionOptions\n  extends RecoverPrincipalPolicyHistoryOptions {\n  /** Internal page selection by version; every selected row still needs a private-root proof. */\n  readonly retainedVersions?: readonly number[] | undefined;\n}\n\nexport class PrincipalHistoryEvidenceUnavailableError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PrincipalHistoryEvidenceUnavailableError\";\n  }\n}\n\nasync function selectReferences(input: {\n  readonly options: PrincipalHistorySelectionOptions;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly checkpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<VerifiedPrincipalPolicyHistory> {\n  const { options, scopeId, history } = input;\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  const base = { execSql: options.execSql, scopeId, history };\n  const references: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (const reference of options.retainedReferences ?? []) {\n    assertProjectionVerificationCurrent(current);\n    references.push(\n      await loadPrincipalHistoryReference({\n        ...base,\n        version: reference.version,\n      }),\n    );\n  }\n  const versions = new Set(\n    (options.retainedReferences ?? []).map((reference) => reference.version),\n  );\n  for (const version of options.retainedVersions ?? []) {\n    if (versions.has(version)) continue;\n    versions.add(version);\n    assertProjectionVerificationCurrent(current);\n    references.push(await loadPrincipalHistoryReference({ ...base, version }));\n  }\n  assertProjectionVerificationCurrent(current);\n  const checkpointReference = input.checkpoint\n    ? await loadPrincipalHistoryReference({\n        ...base,\n        version: input.checkpoint.version,\n      })\n    : undefined;\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history,\n    references,\n    checkpointReference,\n  });\n  if (!selected.ok) throw selected.error;\n  assertProjectionVerificationCurrent(current);\n  return selected.value;\n}\n\nexport async function selectRecoveredPrincipalHistory(\n  input: Parameters<typeof selectReferences>[0],\n): Promise<VerifiedPrincipalPolicyHistory> {\n  let selected: VerifiedPrincipalPolicyHistory;\n  try {\n    selected = await selectReferences(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n  // First authenticate the stored entry against the private root. Only then\n  // compare the caller's citation, so a bad request is not treated as cache loss.\n  for (const reference of input.options.retainedReferences ?? []) {\n    if (\n      !selected.retainedEntries.some(({ state }) =>\n        principalHeadMatchesReference(state, reference),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Requested citation does not match the verified principal history\",\n      );\n  }\n  return selected;\n}\n"]}

package/workflows/principals/principalRecoveryDirectory.d.ts

@@ -7,4 +7,4 @@ export interface RecoveredPolicyDirectory extends RecoveredPrincipalPolicyHistor
 }
 export declare class PrincipalRecoveryDirectoryAdvanced extends Error {
 }
-export declare function recoverPolicyDirectory(input: PrincipalRecoveryContext, references: readonly ReferencedPrincipalHead[]): Promise<RecoveredPolicyDirectory>;
+export declare function recoverPolicyDirectory(input: PrincipalRecoveryContext, references: readonly ReferencedPrincipalHead[], selected?: RecoveredPolicyDirectory): Promise<RecoveredPolicyDirectory>;