@tearleads/client-sdk 0.1.15 → 0.1.17

package/data/persistence/principalCurrentAcknowledgementPersistence.js

@@ -0,0 +1,116 @@
+import { KeyingVerificationError, verifyPrincipalPolicyCheckpoint, } from "../../internal/crypto/index.js";
+import { eq } from "drizzle-orm";
+import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
+import { principalHistoryPrefixes } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalHistoryStages } from "../sqlite/principalHistoryStageSchema.js";
+import { keyingCheckpointTables, principalPolicyTables, } from "../sqlite/schema.js";
+import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
+import { storePrincipalGrantRetirements } from "./principalGrantRetirementPersistence.js";
+import { writePrincipalHistoryEvidencePage, } from "./principalHistoryEvidencePersistence.js";
+function assertPublicationScope(entries, organizationId) {
+    const seen = new Set();
+    for (const entry of entries) {
+        const key = principalPolicyKey(entry.policy);
+        if (seen.has(key))
+            throw new KeyingVerificationError("duplicate_entry", "Acknowledged current batch repeats a principal");
+        seen.add(key);
+        if (entry.prefix.organizationId !== organizationId ||
+            entry.stage.organizationId !== organizationId ||
+            (entry.predecessorStage
+                ? entry.predecessorStage.organizationId !== organizationId ||
+                    !entry.predecessorStage.complete ||
+                    entry.predecessorStage.afterVersion !== entry.policy.version - 2
+                : entry.policy.principalType !== "group" ||
+                    entry.policy.version !== 1 ||
+                    entry.policy.state.prevStateHash !== null ||
+                    entry.previousPrefixProgress !== null) ||
+            entry.evidence.organizationId !== organizationId ||
+            entry.prefix.scopeId !== entry.evidence.scopeId ||
+            entry.prefix.version !== entry.policy.version ||
+            entry.stage.afterVersion !== entry.policy.version - 1 ||
+            !entry.stage.complete ||
+            entry.stage.currentJson !== entry.prefix.currentJson)
+            throw new KeyingVerificationError("object_mismatch", "Acknowledged current publication is outside its scope");
+    }
+}
+async function validatePublication(tx, entry) {
+    const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, entry.policy);
+    verifyPrincipalPolicyCheckpoint({
+        chain: entry.policy.retainedHistory,
+        currentState: entry.policy.state,
+        localCheckpoint: checkpoint,
+    });
+    if ((!checkpoint && entry.policy.version !== 1) ||
+        (checkpoint && entry.policy.version > checkpoint.version + 1))
+        throw new KeyingVerificationError("stale_predecessor", "Acknowledged current policy must directly extend its durable checkpoint");
+    const [prefix] = await tx
+        .select()
+        .from(principalHistoryPrefixes)
+        .where(eq(principalHistoryPrefixes.scopeId, entry.prefix.scopeId))
+        .limit(1);
+    if ((prefix?.progress ?? null) !== entry.previousPrefixProgress)
+        throw new KeyingVerificationError("stale_predecessor", "Authenticated principal prefix changed before acknowledgement");
+}
+/** Store current artifacts and resumable progress in the same transaction as their pins. */
+export async function persistAcknowledgedPrincipalCurrents(input) {
+    const entries = structuredClone(input.entries);
+    const retirements = structuredClone(input.retirements ?? []);
+    const organizationId = input.organizationId;
+    const stillCurrent = input.stillCurrent;
+    assertPublicationScope(entries, organizationId);
+    assertProjectionVerificationCurrent(stillCurrent);
+    await ensureSqlTables(input.execSql, [
+        ...principalPolicyTables,
+        ...keyingCheckpointTables,
+    ]);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const stored = await runtime.guardedTransaction(async (tx) => {
+        for (const entry of entries)
+            await validatePublication(tx, entry);
+        for (const retirement of retirements) {
+            const policy = entries.find((entry) => entry.policy.principalId === retirement.principalId &&
+                entry.policy.principalType === retirement.principalType)?.policy;
+            if (!policy)
+                throw new KeyingVerificationError("object_mismatch", "Retirement must accompany its acknowledged principal");
+            await storePrincipalGrantRetirements(tx, { ...retirement, policy, organizationId }, entries.map((entry) => entry.policy), organizationId);
+        }
+        for (const entry of entries) {
+            await writePrincipalHistoryEvidencePage(tx, entry.evidence);
+            // A prefix-only predecessor must keep its encrypted key envelopes
+            // before its reusable slot is replaced by the acknowledged successor.
+            if (entry.predecessorStage)
+                await tx
+                    .insert(principalHistoryStages)
+                    .values(entry.predecessorStage)
+                    .onConflictDoUpdate({
+                    target: principalHistoryStages.id,
+                    set: entry.predecessorStage,
+                    setWhere: eq(principalHistoryStages.complete, false),
+                })
+                    .run();
+            // A fully authenticated publication supersedes an in-flight stage for
+            // this exact head. Its other writer fails its progress CAS and resumes.
+            await tx
+                .insert(principalHistoryStages)
+                .values(entry.stage)
+                .onConflictDoUpdate({
+                target: principalHistoryStages.id,
+                set: entry.stage,
+            })
+                .run();
+            await tx
+                .insert(principalHistoryPrefixes)
+                .values(entry.prefix)
+                .onConflictDoUpdate({
+                target: principalHistoryPrefixes.scopeId,
+                set: entry.prefix,
+            })
+                .run();
+            await upsertPrincipalPolicyCheckpointInTransaction(tx, entry.policy.checkpoint, new Date().toISOString(), organizationId);
+        }
+    }, stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => stored.committed);
+}
+//# sourceMappingURL=principalCurrentAcknowledgementPersistence.js.map

package/data/persistence/principalCurrentAcknowledgementPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalCurrentAcknowledgementPersistence.js","sourceRoot":"","sources":["principalCurrentAcknowledgementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,mCAAmC,EACnC,kBAAkB,EAClB,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAoB/C,SAAS,sBAAsB,CAC7B,OAA2D,EAC3D,cAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IACE,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc;YAC9C,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;YAC7C,CAAC,KAAK,CAAC,gBAAgB;gBACrB,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,cAAc;oBACxD,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ;oBAChC,KAAK,CAAC,gBAAgB,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;gBAClE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO;oBACtC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC;oBAC1B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI;oBACzC,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC;YAC1C,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,cAAc;YAChD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/C,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7C,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;YACrD,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;YACrB,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;YAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,KAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,EAAE,EACF,KAAK,CAAC,MAAM,CACb,CAAC;IACF,+BAA+B,CAAC;QAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QACnC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAChC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IACE,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC;QAC3C,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QAE7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,yEAAyE,CAC1E,CAAC;IACJ,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACjE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,sBAAsB;QAC7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,+DAA+D,CAChE,CAAC;AACN,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,sBAAsB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW;gBACnD,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,CAC1D,EAAE,MAAM,CAAC;YACV,IAAI,CAAC,MAAM;gBACT,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;YACJ,MAAM,8BAA8B,CAClC,EAAE,EACF,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,EACzC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EACpC,cAAc,CACf,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,iCAAiC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5D,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,KAAK,CAAC,gBAAgB;gBACxB,MAAM,EAAE;qBACL,MAAM,CAAC,sBAAsB,CAAC;qBAC9B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;qBAC9B,kBAAkB,CAAC;oBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;oBACjC,GAAG,EAAE,KAAK,CAAC,gBAAgB;oBAC3B,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC;iBACrD,CAAC;qBACD,GAAG,EAAE,CAAC;YACX,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,EAAE;iBACL,MAAM,CAAC,sBAAsB,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;iBACnB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;gBACjC,GAAG,EAAE,KAAK,CAAC,KAAK;aACjB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,EAAE;iBACL,MAAM,CAAC,wBAAwB,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBACpB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;gBACxC,GAAG,EAAE,KAAK,CAAC,MAAM;aAClB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,4CAA4C,CAChD,EAAE,EACF,KAAK,CAAC,MAAM,CAAC,UAAU,EACvB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport { principalHistoryPrefixes } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { storePrincipalGrantRetirements } from \"./principalGrantRetirementPersistence\";\nimport {\n  type PrincipalHistoryEvidencePage,\n  writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\nimport type { PrincipalHistoryPrefix } from \"./principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"./principalHistoryStagePersistence\";\n\n/** Owned output of authenticated prefix extension and exact receipt verification. */\nexport interface AcknowledgedPrincipalCurrentPublication {\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly previousPrefixProgress: string | null;\n  readonly stage: PrincipalHistoryStage;\n  readonly predecessorStage: PrincipalHistoryStage | null;\n  readonly evidence: PrincipalHistoryEvidencePage;\n}\n\nexport interface AcknowledgedPrincipalCurrentRetirement {\n  readonly principalId: string;\n  readonly principalType: VerifiedPrincipalPolicyCurrent[\"principalType\"];\n  readonly containerIds: readonly string[];\n}\n\nfunction assertPublicationScope(\n  entries: readonly AcknowledgedPrincipalCurrentPublication[],\n  organizationId: string,\n) {\n  const seen = new Set<string>();\n  for (const entry of entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key))\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        \"Acknowledged current batch repeats a principal\",\n      );\n    seen.add(key);\n    if (\n      entry.prefix.organizationId !== organizationId ||\n      entry.stage.organizationId !== organizationId ||\n      (entry.predecessorStage\n        ? entry.predecessorStage.organizationId !== organizationId ||\n          !entry.predecessorStage.complete ||\n          entry.predecessorStage.afterVersion !== entry.policy.version - 2\n        : entry.policy.principalType !== \"group\" ||\n          entry.policy.version !== 1 ||\n          entry.policy.state.prevStateHash !== null ||\n          entry.previousPrefixProgress !== null) ||\n      entry.evidence.organizationId !== organizationId ||\n      entry.prefix.scopeId !== entry.evidence.scopeId ||\n      entry.prefix.version !== entry.policy.version ||\n      entry.stage.afterVersion !== entry.policy.version - 1 ||\n      !entry.stage.complete ||\n      entry.stage.currentJson !== entry.prefix.currentJson\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Acknowledged current publication is outside its scope\",\n      );\n  }\n}\n\nasync function validatePublication(\n  tx: ClientSQLiteTransactionScope,\n  entry: AcknowledgedPrincipalCurrentPublication,\n) {\n  const checkpoint = await loadStoredPrincipalPolicyCheckpoint(\n    tx,\n    entry.policy,\n  );\n  verifyPrincipalPolicyCheckpoint({\n    chain: entry.policy.retainedHistory,\n    currentState: entry.policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (\n    (!checkpoint && entry.policy.version !== 1) ||\n    (checkpoint && entry.policy.version > checkpoint.version + 1)\n  )\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Acknowledged current policy must directly extend its durable checkpoint\",\n    );\n  const [prefix] = await tx\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, entry.prefix.scopeId))\n    .limit(1);\n  if ((prefix?.progress ?? null) !== entry.previousPrefixProgress)\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Authenticated principal prefix changed before acknowledgement\",\n    );\n}\n\n/** Store current artifacts and resumable progress in the same transaction as their pins. */\nexport async function persistAcknowledgedPrincipalCurrents(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly entries: readonly AcknowledgedPrincipalCurrentPublication[];\n  readonly retirements?:\n    | readonly AcknowledgedPrincipalCurrentRetirement[]\n    | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const entries = structuredClone(input.entries);\n  const retirements = structuredClone(input.retirements ?? []);\n  const organizationId = input.organizationId;\n  const stillCurrent = input.stillCurrent;\n  assertPublicationScope(entries, organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const stored = await runtime.guardedTransaction(\n    async (tx) => {\n      for (const entry of entries) await validatePublication(tx, entry);\n      for (const retirement of retirements) {\n        const policy = entries.find(\n          (entry) =>\n            entry.policy.principalId === retirement.principalId &&\n            entry.policy.principalType === retirement.principalType,\n        )?.policy;\n        if (!policy)\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Retirement must accompany its acknowledged principal\",\n          );\n        await storePrincipalGrantRetirements(\n          tx,\n          { ...retirement, policy, organizationId },\n          entries.map((entry) => entry.policy),\n          organizationId,\n        );\n      }\n      for (const entry of entries) {\n        await writePrincipalHistoryEvidencePage(tx, entry.evidence);\n        // A prefix-only predecessor must keep its encrypted key envelopes\n        // before its reusable slot is replaced by the acknowledged successor.\n        if (entry.predecessorStage)\n          await tx\n            .insert(principalHistoryStages)\n            .values(entry.predecessorStage)\n            .onConflictDoUpdate({\n              target: principalHistoryStages.id,\n              set: entry.predecessorStage,\n              setWhere: eq(principalHistoryStages.complete, false),\n            })\n            .run();\n        // A fully authenticated publication supersedes an in-flight stage for\n        // this exact head. Its other writer fails its progress CAS and resumes.\n        await tx\n          .insert(principalHistoryStages)\n          .values(entry.stage)\n          .onConflictDoUpdate({\n            target: principalHistoryStages.id,\n            set: entry.stage,\n          })\n          .run();\n        await tx\n          .insert(principalHistoryPrefixes)\n          .values(entry.prefix)\n          .onConflictDoUpdate({\n            target: principalHistoryPrefixes.scopeId,\n            set: entry.prefix,\n          })\n          .run();\n        await upsertPrincipalPolicyCheckpointInTransaction(\n          tx,\n          entry.policy.checkpoint,\n          new Date().toISOString(),\n          organizationId,\n        );\n      }\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => stored.committed);\n}\n"]}

package/data/persistence/principalGrantRetirementPersistence.d.ts

@@ -1,9 +1,9 @@
-import { type AccessManifestCheckpoint, type VerifiedPrincipalPolicy } from "../../internal/crypto/index.js";
+import { type AccessManifestCheckpoint, type VerifiedPrincipalPolicy, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
 import type { ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
 export interface AcknowledgedPrincipalGrantRetirements {
     readonly containerIds: readonly string[];
     readonly organizationId: string;
-    readonly policy: VerifiedPrincipalPolicy;
+    readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
 }
-export declare function storePrincipalGrantRetirements(tx: ClientSQLiteTransactionScope, retirement: AcknowledgedPrincipalGrantRetirements, policies: readonly VerifiedPrincipalPolicy[], organizationId: string | undefined): Promise<void>;
+export declare function storePrincipalGrantRetirements(tx: ClientSQLiteTransactionScope, retirement: AcknowledgedPrincipalGrantRetirements, policies: readonly (VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent)[], organizationId: string | undefined): Promise<void>;
 export declare function assertContainerNotRetired(tx: ClientSQLiteTransactionScope, checkpoint: AccessManifestCheckpoint): Promise<void>;

package/data/persistence/principalGrantRetirementPersistence.js

@@ -7,7 +7,10 @@ export async function storePrincipalGrantRetirements(tx, retirement, policies, o
         policy.stateHash === retirement.policy.stateHash)) {
         throw new KeyingVerificationError("object_mismatch", "Retirement must accompany its acknowledged policy");
     }
-    const previous = retirement.policy.history?.find((entry) => entry.state.stateHash === retirement.policy.state.prevStateHash);
+    const history = "retainedHistory" in retirement.policy
+        ? retirement.policy.retainedHistory
+        : retirement.policy.history;
+    const previous = history?.find((entry) => entry.state.stateHash === retirement.policy.state.prevStateHash);
     const granted = new Set([...retirement.policy.grants, ...(previous?.grants ?? [])].map((grant) => grant.containerId));
     if (retirement.organizationId !== organizationId ||
         retirement.containerIds.some((id) => !granted.has(id))) {

package/data/persistence/principalGrantRetirementPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAA4C,EAC5C,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly VerifiedPrincipalPolicy[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const previous = retirement.policy.history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}
+{"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAGG,EACH,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,iBAAiB,IAAI,UAAU,CAAC,MAAM;QACpC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../sqlite/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n  readonly containerIds: readonly string[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;\n}\n\nexport async function storePrincipalGrantRetirements(\n  tx: ClientSQLiteTransactionScope,\n  retirement: AcknowledgedPrincipalGrantRetirements,\n  policies: readonly (\n    | VerifiedPrincipalPolicy\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n  organizationId: string | undefined,\n): Promise<void> {\n  if (\n    !policies.some(\n      (policy) =>\n        policy.principalId === retirement.policy.principalId &&\n        policy.principalType === retirement.policy.principalType &&\n        policy.stateHash === retirement.policy.stateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must accompany its acknowledged policy\",\n    );\n  }\n  const history =\n    \"retainedHistory\" in retirement.policy\n      ? retirement.policy.retainedHistory\n      : retirement.policy.history;\n  const previous = history?.find(\n    (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n  );\n  const granted = new Set(\n    [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n      (grant) => grant.containerId,\n    ),\n  );\n  if (\n    retirement.organizationId !== organizationId ||\n    retirement.containerIds.some((id) => !granted.has(id))\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Retirement must match the acknowledged organization and signed grants\",\n    );\n  }\n  for (const containerId of new Set(retirement.containerIds)) {\n    await tx\n      .insert(principalGrantRetirements)\n      .values({\n        organizationId: retirement.organizationId,\n        containerId,\n        principalId: retirement.policy.principalId,\n        policyStateHash: retirement.policy.stateHash,\n      })\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\nexport async function assertContainerNotRetired(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n  if (checkpoint.objectKind !== \"container\") return;\n  const [retired] = await tx\n    .select({ containerId: principalGrantRetirements.containerId })\n    .from(principalGrantRetirements)\n    .where(\n      and(\n        eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n        eq(principalGrantRetirements.containerId, checkpoint.objectId),\n      ),\n    )\n    .limit(1);\n  if (retired)\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      `Container ${checkpoint.objectId} was retired during principal rotation`,\n    );\n}\n"]}

package/data/persistence/principalKeyEnvelopeCandidates.js

@@ -1,6 +1,7 @@
 import { isCurrentPrincipalMemberEnvelopesResponse, } from "../../internal/validators/response/index.js";
-import { desc, eq, sql } from "drizzle-orm";
+import { and, desc, eq, sql } from "drizzle-orm";
 import { principalHistoryEvidenceTables, principalHistoryPrefixes, } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalHistoryStages } from "../sqlite/principalHistoryStageSchema.js";
 import { principalCurrentFingerprintJson, principalStateFingerprintJson, } from "../sqlite/principalKeyFingerprintJson.js";
 import { principalPolicies, principalPolicyBundleHistory, } from "../sqlite/principalPolicySchema.js";
 import { principalPolicyTables } from "../sqlite/schema.js";
@@ -41,6 +42,16 @@ export async function loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints)
             .limit(1);
         if (prefix)
             encoded.push(prefix.envelopes);
+        const [stage] = await db
+            .select({
+            envelopes: sql `json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,
+        })
+            .from(principalHistoryStages)
+            .where(and(eq(principalCurrentFingerprintJson(principalHistoryStages.currentJson), fingerprint), eq(principalHistoryStages.complete, true)))
+            .orderBy(desc(principalHistoryStages.afterVersion))
+            .limit(1);
+        if (stage)
+            encoded.push(stage.envelopes);
         for (const json of encoded) {
             let envelopes;
             try {

package/data/persistence/principalKeyEnvelopeCandidates.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}
+{"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,sBAAsB,CAAC,WAAW,+BAA+B;SACxG,CAAC;aACD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,sBAAsB,CAAC,WAAW,CAAC,EACnE,WAAW,CACZ,EACD,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC1C,CACF;aACA,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;aAClD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type CurrentPrincipalMemberEnvelopesResponse,\n  isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { and, desc, eq, sql } from \"drizzle-orm\";\nimport {\n  principalHistoryEvidenceTables,\n  principalHistoryPrefixes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  principalCurrentFingerprintJson,\n  principalStateFingerprintJson,\n} from \"../sqlite/principalKeyFingerprintJson\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n} from \"../sqlite/principalPolicySchema\";\nimport { principalPolicyTables } from \"../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n  readonly currentState: {\n    readonly principalType: \"group\" | \"organization\";\n    readonly principalId: string;\n    readonly stateHash: string;\n    readonly keyFingerprint: string;\n  };\n  readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n  execSql: ExecSql,\n  fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n  await ensureSqlTables(execSql, [\n    ...principalPolicyTables,\n    ...principalHistoryEvidenceTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n  for (const fingerprint of new Set(fingerprints)) {\n    const encoded: string[] = [];\n    for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n      const [row] = await db\n        .select({ envelopes: table.currentMemberEnvelopesJson })\n        .from(table)\n        .where(\n          eq(\n            principalStateFingerprintJson(table.currentStateJson),\n            fingerprint,\n          ),\n        )\n        .orderBy(desc(table.updatedAt))\n        .limit(1);\n      if (row) encoded.push(row.envelopes);\n    }\n    const [prefix] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryPrefixes)\n      .where(\n        eq(\n          principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n          fingerprint,\n        ),\n      )\n      .orderBy(desc(principalHistoryPrefixes.version))\n      .limit(1);\n    if (prefix) encoded.push(prefix.envelopes);\n    const [stage] = await db\n      .select({\n        envelopes: sql<string>`json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,\n      })\n      .from(principalHistoryStages)\n      .where(\n        and(\n          eq(\n            principalCurrentFingerprintJson(principalHistoryStages.currentJson),\n            fingerprint,\n          ),\n          eq(principalHistoryStages.complete, true),\n        ),\n      )\n      .orderBy(desc(principalHistoryStages.afterVersion))\n      .limit(1);\n    if (stage) encoded.push(stage.envelopes);\n    for (const json of encoded) {\n      let envelopes: unknown;\n      try {\n        envelopes = JSON.parse(json);\n      } catch {\n        continue;\n      }\n      if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n      candidates.push({\n        currentState: {\n          principalType: envelopes.principalType,\n          principalId: envelopes.principalId,\n          stateHash: envelopes.stateHash,\n          keyFingerprint: fingerprint,\n        },\n        currentMemberEnvelopes: envelopes,\n      });\n    }\n  }\n  return candidates;\n}\n"]}

package/data/persistence/principalMutationJournalPersistence.d.ts

@@ -0,0 +1,19 @@
+import { principalMutationJournal } from "../sqlite/principalMutationJournalSchema.js";
+import { type ExecSql } from "../sqlite/sqlSchema.js";
+export type PrincipalMutationJournalRow = typeof principalMutationJournal.$inferSelect;
+export declare class PendingPrincipalMutationError extends Error {
+    constructor();
+}
+export declare function loadPrincipalMutationJournal(execSql: ExecSql, scopeId: string): Promise<PrincipalMutationJournalRow | null>;
+/** Claim the organization lane before dispatch; never overwrite unresolved work. */
+export declare function claimPrincipalMutationJournal(input: {
+    readonly execSql: ExecSql;
+    readonly row: PrincipalMutationJournalRow;
+    readonly stillCurrent: () => boolean;
+}): Promise<void>;
+/** A late acknowledgement cannot retire another operation's journal entry. */
+export declare function clearPrincipalMutationJournal(input: {
+    readonly execSql: ExecSql;
+    readonly row: PrincipalMutationJournalRow;
+    readonly stillCurrent: () => boolean;
+}): Promise<boolean>;

package/data/persistence/principalMutationJournalPersistence.js

@@ -0,0 +1,53 @@
+import { and, eq } from "drizzle-orm";
+import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
+import { principalMutationJournal, principalMutationJournalTables, } from "../sqlite/principalMutationJournalSchema.js";
+import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+export class PendingPrincipalMutationError extends Error {
+    constructor() {
+        super("Resolve the pending principal mutation or explicitly abandon its retry before submitting another");
+        this.name = "PendingPrincipalMutationError";
+    }
+}
+export async function loadPrincipalMutationJournal(execSql, scopeId) {
+    await ensureSqlTables(execSql, principalMutationJournalTables);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [row] = await db
+        .select()
+        .from(principalMutationJournal)
+        .where(eq(principalMutationJournal.scopeId, scopeId))
+        .limit(1);
+    return row ?? null;
+}
+/** Claim the organization lane before dispatch; never overwrite unresolved work. */
+export async function claimPrincipalMutationJournal(input) {
+    const row = { ...input.row };
+    await ensureSqlTables(input.execSql, principalMutationJournalTables);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const [existing] = await tx
+            .select({ scopeId: principalMutationJournal.scopeId })
+            .from(principalMutationJournal)
+            .where(eq(principalMutationJournal.scopeId, row.scopeId))
+            .limit(1);
+        if (existing)
+            throw new PendingPrincipalMutationError();
+        await tx.insert(principalMutationJournal).values(row).run();
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+}
+/** A late acknowledgement cannot retire another operation's journal entry. */
+export async function clearPrincipalMutationJournal(input) {
+    const row = { ...input.row };
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const result = await runtime.guardedTransaction(async (tx) => {
+        const deleted = await tx
+            .delete(principalMutationJournal)
+            .where(and(eq(principalMutationJournal.scopeId, row.scopeId), eq(principalMutationJournal.organizationId, row.organizationId), eq(principalMutationJournal.serializedRequest, row.serializedRequest), eq(principalMutationJournal.signature, row.signature)))
+            .returning({ scopeId: principalMutationJournal.scopeId });
+        return deleted.length > 0;
+    }, input.stillCurrent, { behavior: "immediate" });
+    assertProjectionVerificationCurrent(() => result.committed);
+    return result.result === true;
+}
+//# sourceMappingURL=principalMutationJournalPersistence.js.map

package/data/persistence/principalMutationJournalPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalPersistence.js","sourceRoot":"","sources":["principalMutationJournalPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CACH,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;aACrD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,wBAAwB,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,EAC/D,EAAE,CACA,wBAAwB,CAAC,iBAAiB,EAC1C,GAAG,CAAC,iBAAiB,CACtB,EACD,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CACtD,CACF;aACA,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;AAChC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n  principalMutationJournal,\n  principalMutationJournalTables,\n} from \"../sqlite/principalMutationJournalSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalMutationJournalRow =\n  typeof principalMutationJournal.$inferSelect;\n\nexport class PendingPrincipalMutationError extends Error {\n  constructor() {\n    super(\n      \"Resolve the pending principal mutation or explicitly abandon its retry before submitting another\",\n    );\n    this.name = \"PendingPrincipalMutationError\";\n  }\n}\n\nexport async function loadPrincipalMutationJournal(\n  execSql: ExecSql,\n  scopeId: string,\n): Promise<PrincipalMutationJournalRow | null> {\n  await ensureSqlTables(execSql, principalMutationJournalTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select()\n    .from(principalMutationJournal)\n    .where(eq(principalMutationJournal.scopeId, scopeId))\n    .limit(1);\n  return row ?? null;\n}\n\n/** Claim the organization lane before dispatch; never overwrite unresolved work. */\nexport async function claimPrincipalMutationJournal(input: {\n  readonly execSql: ExecSql;\n  readonly row: PrincipalMutationJournalRow;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const row = { ...input.row };\n  await ensureSqlTables(input.execSql, principalMutationJournalTables);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const [existing] = await tx\n        .select({ scopeId: principalMutationJournal.scopeId })\n        .from(principalMutationJournal)\n        .where(eq(principalMutationJournal.scopeId, row.scopeId))\n        .limit(1);\n      if (existing) throw new PendingPrincipalMutationError();\n      await tx.insert(principalMutationJournal).values(row).run();\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/** A late acknowledgement cannot retire another operation's journal entry. */\nexport async function clearPrincipalMutationJournal(input: {\n  readonly execSql: ExecSql;\n  readonly row: PrincipalMutationJournalRow;\n  readonly stillCurrent: () => boolean;\n}): Promise<boolean> {\n  const row = { ...input.row };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const result = await runtime.guardedTransaction(\n    async (tx) => {\n      const deleted = await tx\n        .delete(principalMutationJournal)\n        .where(\n          and(\n            eq(principalMutationJournal.scopeId, row.scopeId),\n            eq(principalMutationJournal.organizationId, row.organizationId),\n            eq(\n              principalMutationJournal.serializedRequest,\n              row.serializedRequest,\n            ),\n            eq(principalMutationJournal.signature, row.signature),\n          ),\n        )\n        .returning({ scopeId: principalMutationJournal.scopeId });\n      return deleted.length > 0;\n    },\n    input.stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => result.committed);\n  return result.result === true;\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyBundle.js

@@ -1,55 +1,8 @@
-import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
 import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
-function bundleMismatch(message) {
-    throw new KeyingVerificationError("equivocation", message);
-}
-async function memberEnvelopesRoot(bundle) {
-    try {
-        return await computePrincipalMemberEnvelopesRoot(bundle.currentMemberEnvelopes.envelopes);
-    }
-    catch (error) {
-        if (error instanceof PrincipalMemberEnvelopeValidationError) {
-            throw new KeyingVerificationError("invalid_shape", error.message);
-        }
-        throw error;
-    }
-}
-async function assertBundlePayloadMatches(input) {
-    const { bundle, policy } = input;
-    const payloadHash = await computePrincipalStatePayloadCiphertextHash(bundle.currentPayload.ciphertext);
-    const envelopesRoot = await memberEnvelopesRoot(bundle);
-    if (bundle.currentPayload.principalType !== policy.principalType ||
-        bundle.currentPayload.principalId !== policy.principalId ||
-        bundle.currentPayload.stateHash !== policy.stateHash ||
-        bundle.currentPayload.ciphertextHash !== payloadHash ||
-        policy.state.payloadCiphertextHash !== payloadHash ||
-        bundle.currentMemberEnvelopes.principalType !== policy.principalType ||
-        bundle.currentMemberEnvelopes.principalId !== policy.principalId ||
-        bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||
-        bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
-        envelopesRoot !== policy.state.memberEnvelopesRoot) {
-        bundleMismatch("Verified principal policy bundle payload mismatch");
-    }
-}
+import { assertCurrentMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyCurrent.js";
 export async function assertBundleMatchesVerifiedPolicy(input) {
     const { bundle, policy } = input;
-    if (bundle.currentState.principalType !== policy.principalType ||
-        bundle.currentState.principalId !== policy.principalId ||
-        bundle.currentState.version !== policy.version ||
-        bundle.currentState.keyEpoch !== policy.keyEpoch ||
-        bundle.currentState.stateHash !== policy.stateHash ||
-        policy.checkpoint.version !== policy.version ||
-        policy.checkpoint.stateHash !== policy.stateHash) {
-        bundleMismatch("Verified principal policy bundle head mismatch");
-    }
-    if (canonicalKeyingJsonString(bundle.currentState, "principal policy bundle state") !==
-        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
-        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(bundle.currentProjection), "principal policy bundle projection") !==
-            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
-        canonicalKeyingJsonString(normalizePrincipalContainerGrants(bundle.currentGrants), "principal policy bundle grants") !==
-            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
-        bundleMismatch("Verified principal policy bundle content mismatch");
-    }
     const history = policy.history ?? [];
     const expectedChain = [
         ...bundle.previousStates,
@@ -70,8 +23,11 @@ export async function assertBundleMatchesVerifiedPolicy(input) {
     }));
     if (canonicalKeyingJsonString(expectedChain, "principal policy bundle history") !==
         canonicalKeyingJsonString(verifiedHistory, "verified principal policy history")) {
-        bundleMismatch("Verified principal policy bundle history mismatch");
+        throw new KeyingVerificationError("equivocation", "Verified principal policy bundle history mismatch");
     }
-    await assertBundlePayloadMatches(input);
+    await assertCurrentMatchesVerifiedPolicy({
+        current: input.bundle,
+        policy: input.policy,
+    });
 }
 //# sourceMappingURL=verifiedPrincipalPolicyBundle.js.map

package/data/persistence/verifiedPrincipalPolicyBundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,MAAM,CAAC,sBAAsB,CAAC,SAAS,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,IACE,MAAM,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC5D,MAAM,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACxD,MAAM,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACpD,MAAM,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACpD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,MAAM,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACpE,MAAM,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAChE,MAAM,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC5D,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACvD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC1D,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACtD,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC9C,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAChD,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAClD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,IACE,yBAAyB,CACvB,MAAM,CAAC,YAAY,EACnB,+BAA+B,CAChC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC7D,oCAAoC,CACrC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,aAAa,CAAC,EACvD,gCAAgC,CACjC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,cAAc,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["import {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\n\nfunction bundleMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      bundle.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertBundlePayloadMatches(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    bundle.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(bundle);\n  if (\n    bundle.currentPayload.principalType !== policy.principalType ||\n    bundle.currentPayload.principalId !== policy.principalId ||\n    bundle.currentPayload.stateHash !== policy.stateHash ||\n    bundle.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    bundle.currentMemberEnvelopes.principalType !== policy.principalType ||\n    bundle.currentMemberEnvelopes.principalId !== policy.principalId ||\n    bundle.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    bundle.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    bundleMismatch(\"Verified principal policy bundle payload mismatch\");\n  }\n}\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  if (\n    bundle.currentState.principalType !== policy.principalType ||\n    bundle.currentState.principalId !== policy.principalId ||\n    bundle.currentState.version !== policy.version ||\n    bundle.currentState.keyEpoch !== policy.keyEpoch ||\n    bundle.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    bundleMismatch(\"Verified principal policy bundle head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      bundle.currentState,\n      \"principal policy bundle state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(bundle.currentProjection),\n      \"principal policy bundle projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(bundle.currentGrants),\n      \"principal policy bundle grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle content mismatch\");\n  }\n\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    bundleMismatch(\"Verified principal policy bundle history mismatch\");\n  }\n  await assertBundlePayloadMatches(input);\n}\n"]}
+{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyCurrent\";\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Verified principal policy bundle history mismatch\",\n    );\n  }\n  await assertCurrentMatchesVerifiedPolicy({\n    current: input.bundle,\n    policy: input.policy,\n  });\n}\n"]}

package/data/persistence/verifiedPrincipalPolicyCurrent.js

@@ -0,0 +1,56 @@
+import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+function currentMismatch(message) {
+    throw new KeyingVerificationError("equivocation", message);
+}
+async function memberEnvelopesRoot(current) {
+    try {
+        return await computePrincipalMemberEnvelopesRoot(current.currentMemberEnvelopes.envelopes);
+    }
+    catch (error) {
+        if (error instanceof PrincipalMemberEnvelopeValidationError) {
+            throw new KeyingVerificationError("invalid_shape", error.message);
+        }
+        throw error;
+    }
+}
+async function assertCurrentPayloadMatches(input) {
+    const { current, policy } = input;
+    const payloadHash = await computePrincipalStatePayloadCiphertextHash(current.currentPayload.ciphertext);
+    const envelopesRoot = await memberEnvelopesRoot(current);
+    if (current.currentPayload.principalType !== policy.principalType ||
+        current.currentPayload.principalId !== policy.principalId ||
+        current.currentPayload.stateHash !== policy.stateHash ||
+        current.currentPayload.ciphertextHash !== payloadHash ||
+        policy.state.payloadCiphertextHash !== payloadHash ||
+        current.currentMemberEnvelopes.principalType !== policy.principalType ||
+        current.currentMemberEnvelopes.principalId !== policy.principalId ||
+        current.currentMemberEnvelopes.stateHash !== policy.stateHash ||
+        current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
+        envelopesRoot !== policy.state.memberEnvelopesRoot) {
+        currentMismatch("Verified principal policy current payload mismatch");
+    }
+}
+/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */
+export async function assertCurrentMatchesVerifiedPolicy(input) {
+    const { current, policy } = input;
+    if (current.currentState.principalType !== policy.principalType ||
+        current.currentState.principalId !== policy.principalId ||
+        current.currentState.version !== policy.version ||
+        current.currentState.keyEpoch !== policy.keyEpoch ||
+        current.currentState.stateHash !== policy.stateHash ||
+        policy.checkpoint.version !== policy.version ||
+        policy.checkpoint.stateHash !== policy.stateHash) {
+        currentMismatch("Verified principal policy current head mismatch");
+    }
+    if (canonicalKeyingJsonString(current.currentState, "principal policy current state") !==
+        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
+        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(current.currentProjection), "principal policy current projection") !==
+            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
+        canonicalKeyingJsonString(normalizePrincipalContainerGrants(current.currentGrants), "principal policy current grants") !==
+            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
+        currentMismatch("Verified principal policy current content mismatch");
+    }
+    await assertCurrentPayloadMatches(input);
+}
+//# sourceMappingURL=verifiedPrincipalPolicyCurrent.js.map

package/data/persistence/verifiedPrincipalPolicyCurrent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyCurrent.js","sourceRoot":"","sources":["verifiedPrincipalPolicyCurrent.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAGvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAMnE,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAmC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,OAAO,CAAC,sBAAsB,CAAC,SAAS,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAG1C;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,OAAO,CAAC,cAAc,CAAC,UAAU,CAClC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzD,IACE,OAAO,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC7D,OAAO,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACzD,OAAO,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACrD,OAAO,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACrD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,OAAO,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACrE,OAAO,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACjE,OAAO,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC7D,OAAO,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACxD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,IACE,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC3D,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACvD,OAAO,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/C,OAAO,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACjD,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACnD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,eAAe,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,yBAAyB,CACvB,OAAO,CAAC,YAAY,EACpB,gCAAgC,CACjC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9D,qCAAqC,CACtC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,OAAO,CAAC,aAAa,CAAC,EACxD,iCAAiC,CAClC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\n\ntype VerifiedCurrentPolicy =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nfunction currentMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  current: PrincipalPolicyPageCurrent,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      current.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertCurrentPayloadMatches(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    current.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(current);\n  if (\n    current.currentPayload.principalType !== policy.principalType ||\n    current.currentPayload.principalId !== policy.principalId ||\n    current.currentPayload.stateHash !== policy.stateHash ||\n    current.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    current.currentMemberEnvelopes.principalType !== policy.principalType ||\n    current.currentMemberEnvelopes.principalId !== policy.principalId ||\n    current.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    currentMismatch(\"Verified principal policy current payload mismatch\");\n  }\n}\n\n/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */\nexport async function assertCurrentMatchesVerifiedPolicy(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  if (\n    current.currentState.principalType !== policy.principalType ||\n    current.currentState.principalId !== policy.principalId ||\n    current.currentState.version !== policy.version ||\n    current.currentState.keyEpoch !== policy.keyEpoch ||\n    current.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    currentMismatch(\"Verified principal policy current head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      current.currentState,\n      \"principal policy current state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(current.currentProjection),\n      \"principal policy current projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(current.currentGrants),\n      \"principal policy current grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    currentMismatch(\"Verified principal policy current content mismatch\");\n  }\n\n  await assertCurrentPayloadMatches(input);\n}\n"]}

package/data/principals/currentPolicyReferenceResolver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=currentPolicyReferenceResolver.js.map

package/data/principals/currentPolicyReferenceResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentPolicyReferenceResolver.js","sourceRoot":"","sources":["currentPolicyReferenceResolver.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\n/** Privately authenticated historical citations selected for one authored head. */\nexport type CurrentPolicyReferenceResolver = (\n  current: VerifiedPrincipalPolicyCurrent,\n  references: readonly ReferencedPrincipalHead[],\n) => Promise<VerifiedPrincipalPolicyCurrent>;\n"]}

package/data/principals/principalHistoryScopeProtection.js

@@ -0,0 +1,23 @@
+import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+/** Stable authenticated scopes shared by paged recovery and acknowledged extension. */
+export function directoryHistoryProtection(protection) {
+    return {
+        localKey: protection.localKey,
+        context: serializeKeyingCanonicalJson([
+            "tearleads.sdk.principal-history.directory.v1",
+            protection.context,
+        ]),
+    };
+}
+export function scopedGroupHistoryProtection(protection, organizationId, adminGroupId) {
+    return {
+        localKey: protection.localKey,
+        context: serializeKeyingCanonicalJson([
+            "tearleads.sdk.principal-history.scoped-group.v1",
+            protection.context,
+            organizationId,
+            adminGroupId,
+        ]),
+    };
+}
+//# sourceMappingURL=principalHistoryScopeProtection.js.map

package/data/principals/principalHistoryScopeProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryScopeProtection.js","sourceRoot":"","sources":["principalHistoryScopeProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,uFAAuF;AACvF,MAAM,UAAU,0BAA0B,CACxC,UAAiD;IAEjD,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,8CAA8C;YAC9C,UAAU,CAAC,OAAO;SACnB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,UAAiD,EACjD,cAAsB,EACtB,YAAoB;IAEpB,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,iDAAiD;YACjD,UAAU,CAAC,OAAO;YAClB,cAAc;YACd,YAAY;SACb,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyHistoryProgressOptions,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\n\n/** Stable authenticated scopes shared by paged recovery and acknowledged extension. */\nexport function directoryHistoryProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n) {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson([\n      \"tearleads.sdk.principal-history.directory.v1\",\n      protection.context,\n    ]),\n  };\n}\n\nexport function scopedGroupHistoryProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  organizationId: string,\n  adminGroupId: string,\n) {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson([\n      \"tearleads.sdk.principal-history.scoped-group.v1\",\n      protection.context,\n      organizationId,\n      adminGroupId,\n    ]),\n  };\n}\n"]}

package/data/principals/principalMutationJournal.d.ts

@@ -0,0 +1,26 @@
+import { type SigningKeyPair } from "../../internal/crypto/index.js";
+import { type CommitOrganizationGroupPolicyRequest } from "../../internal/validators/request/index.js";
+import type { PrincipalMutationJournalRow } from "../persistence/principalMutationJournalPersistence.js";
+export interface PrincipalMutationJournalScope {
+    readonly identityTrustDomain: string;
+    readonly organizationId: string;
+    readonly userId: string;
+    readonly signingFingerprint: string;
+}
+export interface AuthoredPrincipalMutation {
+    readonly groupId: string;
+    readonly request: CommitOrganizationGroupPolicyRequest;
+}
+export declare function principalMutationJournalScopeId(scope: PrincipalMutationJournalScope): Promise<string>;
+/** Sign the complete wire body, including artifacts outside policy signatures. */
+export declare function sealPrincipalMutation(input: {
+    readonly scope: PrincipalMutationJournalScope;
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<PrincipalMutationJournalRow>;
+/** Authentication precedes parsing or submission; corrupt authored work is retained. */
+export declare function openPrincipalMutation(input: {
+    readonly scope: PrincipalMutationJournalScope;
+    readonly row: PrincipalMutationJournalRow;
+    readonly signingPublicKey: Uint8Array;
+}): Promise<AuthoredPrincipalMutation>;