@tearleads/client-sdk 0.1.15 → 0.1.17

package/data/principals/principalMutationJournal.js

@@ -0,0 +1,90 @@
+import { KeyingVerificationError, sign, toFingerprint, verify, } from "../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { CommitOrganizationGroupPolicyRequestSchema, } from "../../internal/validators/request/index.js";
+import { canonicalKeyingJsonString } from "../keyingCanonicalJson.js";
+const journalDomain = "tearleads.sdk.principal-mutation.v1";
+const encoder = new TextEncoder();
+function scopeJson(scope) {
+    const values = [
+        scope.identityTrustDomain,
+        scope.organizationId,
+        scope.userId,
+        scope.signingFingerprint,
+    ];
+    if (values.some((value) => typeof value !== "string" || value.length === 0))
+        throw new Error("Principal mutation journal requires a complete scope");
+    return JSON.stringify([journalDomain, ...values]);
+}
+export async function principalMutationJournalScopeId(scope) {
+    return bytesToBase64(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(scopeJson(scope)))));
+}
+function readMutation(value, scope) {
+    if (typeof value !== "object" || value === null)
+        throw new Error("Principal mutation journal payload is invalid");
+    const groupId = Reflect.get(value, "groupId");
+    const request = CommitOrganizationGroupPolicyRequestSchema.parse(Reflect.get(value, "request"));
+    const group = request.groupPolicy.state;
+    const organization = request.organizationPolicy.state;
+    if (typeof groupId !== "string" ||
+        group.principalType !== "group" ||
+        group.principalId !== groupId ||
+        organization.principalType !== "organization" ||
+        organization.principalId !== scope.organizationId ||
+        [group, organization].some((state) => state.signerUserId !== scope.userId ||
+            state.signerUserKeyFingerprint !== scope.signingFingerprint))
+        throw new Error("Principal mutation journal target or signer differs");
+    return { groupId, request };
+}
+function signedBytes(scope, request) {
+    // The domain-tagged scope and JSON tuple separate these identity-key
+    // signatures from policy state signatures and other authored formats.
+    return encoder.encode(JSON.stringify([scopeJson(scope), request]));
+}
+/** Sign the complete wire body, including artifacts outside policy signatures. */
+export async function sealPrincipalMutation(input) {
+    const scope = { ...input.scope };
+    const mutation = readMutation(JSON.parse(JSON.stringify(input.mutation)), scope);
+    const serializedRequest = canonicalKeyingJsonString(mutation, "authored principal mutation");
+    const publicKey = new Uint8Array(input.signingKeyPair.signingPublicKey);
+    const privateKey = new Uint8Array(input.signingKeyPair.signingPrivateKey);
+    try {
+        if ((await toFingerprint(publicKey)) !== scope.signingFingerprint)
+            throw new Error("Principal mutation journal signing key differs");
+        const bytes = signedBytes(scope, serializedRequest);
+        const signature = sign(bytes, privateKey);
+        if (!verify(signature, bytes, publicKey))
+            throw new KeyingVerificationError("signer_mismatch", "Principal mutation journal signing key pair differs");
+        return {
+            scopeId: await principalMutationJournalScopeId(scope),
+            organizationId: scope.organizationId,
+            serializedRequest,
+            signature: bytesToBase64(signature),
+        };
+    }
+    finally {
+        privateKey.fill(0);
+    }
+}
+/** Authentication precedes parsing or submission; corrupt authored work is retained. */
+export async function openPrincipalMutation(input) {
+    const scope = { ...input.scope };
+    const row = { ...input.row };
+    const publicKey = new Uint8Array(input.signingPublicKey);
+    try {
+        if (row.organizationId !== scope.organizationId ||
+            row.scopeId !== (await principalMutationJournalScopeId(scope)) ||
+            (await toFingerprint(publicKey)) !== scope.signingFingerprint ||
+            !verify(base64ToBytes(row.signature), signedBytes(scope, row.serializedRequest), publicKey))
+            throw new Error("Principal mutation journal authentication failed");
+    }
+    catch {
+        throw new KeyingVerificationError("signature_mismatch", "Saved principal mutation could not be authenticated");
+    }
+    try {
+        return readMutation(JSON.parse(row.serializedRequest), scope);
+    }
+    catch {
+        throw new KeyingVerificationError("invalid_shape", "Authenticated principal mutation has an unsupported or invalid format");
+    }
+}
+//# sourceMappingURL=principalMutationJournal.js.map

package/data/principals/principalMutationJournal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournal.js","sourceRoot":"","sources":["principalMutationJournal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,IAAI,EACJ,aAAa,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAEL,0CAA0C,GAC3C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAenE,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,SAAS,CAAC,KAAoC;IACrD,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,kBAAkB;KACzB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAoC;IAEpC,OAAO,aAAa,CAClB,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,KAAoC;IAEpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,0CAA0C,CAAC,KAAK,CAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAC9B,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACtD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,KAAK,CAAC,WAAW,KAAK,OAAO;QAC7B,YAAY,CAAC,aAAa,KAAK,cAAc;QAC7C,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;QACjD,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,IAAI,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;YACnC,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,kBAAkB,CAC9D;QAED,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC,EAAE,OAAe;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,YAAY,CAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC1C,KAAK,CACN,CAAC;IACF,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,QAAQ,EACR,6BAA6B,CAC9B,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;YACtC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;QACJ,OAAO;YACL,OAAO,EAAE,MAAM,+BAA+B,CAAC,KAAK,CAAC;YACrD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB;YACjB,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;SACpC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,IACE,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC3C,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAC7D,CAAC,MAAM,CACL,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAC5B,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,iBAAiB,CAAC,EACzC,SAAS,CACV;YAED,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,uEAAuE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type SigningKeyPair,\n  sign,\n  toFingerprint,\n  verify,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  type CommitOrganizationGroupPolicyRequest,\n  CommitOrganizationGroupPolicyRequestSchema,\n} from \"@tearleads/validators/request\";\nimport { canonicalKeyingJsonString } from \"../keyingCanonicalJson\";\nimport type { PrincipalMutationJournalRow } from \"../persistence/principalMutationJournalPersistence\";\n\nexport interface PrincipalMutationJournalScope {\n  readonly identityTrustDomain: string;\n  readonly organizationId: string;\n  readonly userId: string;\n  readonly signingFingerprint: string;\n}\n\nexport interface AuthoredPrincipalMutation {\n  readonly groupId: string;\n  readonly request: CommitOrganizationGroupPolicyRequest;\n}\n\nconst journalDomain = \"tearleads.sdk.principal-mutation.v1\";\nconst encoder = new TextEncoder();\n\nfunction scopeJson(scope: PrincipalMutationJournalScope): string {\n  const values = [\n    scope.identityTrustDomain,\n    scope.organizationId,\n    scope.userId,\n    scope.signingFingerprint,\n  ];\n  if (values.some((value) => typeof value !== \"string\" || value.length === 0))\n    throw new Error(\"Principal mutation journal requires a complete scope\");\n  return JSON.stringify([journalDomain, ...values]);\n}\n\nexport async function principalMutationJournalScopeId(\n  scope: PrincipalMutationJournalScope,\n): Promise<string> {\n  return bytesToBase64(\n    new Uint8Array(\n      await crypto.subtle.digest(\"SHA-256\", encoder.encode(scopeJson(scope))),\n    ),\n  );\n}\n\nfunction readMutation(\n  value: unknown,\n  scope: PrincipalMutationJournalScope,\n): AuthoredPrincipalMutation {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Principal mutation journal payload is invalid\");\n  const groupId: unknown = Reflect.get(value, \"groupId\");\n  const request = CommitOrganizationGroupPolicyRequestSchema.parse(\n    Reflect.get(value, \"request\"),\n  );\n  const group = request.groupPolicy.state;\n  const organization = request.organizationPolicy.state;\n  if (\n    typeof groupId !== \"string\" ||\n    group.principalType !== \"group\" ||\n    group.principalId !== groupId ||\n    organization.principalType !== \"organization\" ||\n    organization.principalId !== scope.organizationId ||\n    [group, organization].some(\n      (state) =>\n        state.signerUserId !== scope.userId ||\n        state.signerUserKeyFingerprint !== scope.signingFingerprint,\n    )\n  )\n    throw new Error(\"Principal mutation journal target or signer differs\");\n  return { groupId, request };\n}\n\nfunction signedBytes(scope: PrincipalMutationJournalScope, request: string) {\n  // The domain-tagged scope and JSON tuple separate these identity-key\n  // signatures from policy state signatures and other authored formats.\n  return encoder.encode(JSON.stringify([scopeJson(scope), request]));\n}\n\n/** Sign the complete wire body, including artifacts outside policy signatures. */\nexport async function sealPrincipalMutation(input: {\n  readonly scope: PrincipalMutationJournalScope;\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalMutationJournalRow> {\n  const scope = { ...input.scope };\n  const mutation = readMutation(\n    JSON.parse(JSON.stringify(input.mutation)),\n    scope,\n  );\n  const serializedRequest = canonicalKeyingJsonString(\n    mutation,\n    \"authored principal mutation\",\n  );\n  const publicKey = new Uint8Array(input.signingKeyPair.signingPublicKey);\n  const privateKey = new Uint8Array(input.signingKeyPair.signingPrivateKey);\n  try {\n    if ((await toFingerprint(publicKey)) !== scope.signingFingerprint)\n      throw new Error(\"Principal mutation journal signing key differs\");\n    const bytes = signedBytes(scope, serializedRequest);\n    const signature = sign(bytes, privateKey);\n    if (!verify(signature, bytes, publicKey))\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        \"Principal mutation journal signing key pair differs\",\n      );\n    return {\n      scopeId: await principalMutationJournalScopeId(scope),\n      organizationId: scope.organizationId,\n      serializedRequest,\n      signature: bytesToBase64(signature),\n    };\n  } finally {\n    privateKey.fill(0);\n  }\n}\n\n/** Authentication precedes parsing or submission; corrupt authored work is retained. */\nexport async function openPrincipalMutation(input: {\n  readonly scope: PrincipalMutationJournalScope;\n  readonly row: PrincipalMutationJournalRow;\n  readonly signingPublicKey: Uint8Array;\n}): Promise<AuthoredPrincipalMutation> {\n  const scope = { ...input.scope };\n  const row = { ...input.row };\n  const publicKey = new Uint8Array(input.signingPublicKey);\n  try {\n    if (\n      row.organizationId !== scope.organizationId ||\n      row.scopeId !== (await principalMutationJournalScopeId(scope)) ||\n      (await toFingerprint(publicKey)) !== scope.signingFingerprint ||\n      !verify(\n        base64ToBytes(row.signature),\n        signedBytes(scope, row.serializedRequest),\n        publicKey,\n      )\n    )\n      throw new Error(\"Principal mutation journal authentication failed\");\n  } catch {\n    throw new KeyingVerificationError(\n      \"signature_mismatch\",\n      \"Saved principal mutation could not be authenticated\",\n    );\n  }\n  try {\n    return readMutation(JSON.parse(row.serializedRequest), scope);\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Authenticated principal mutation has an unsupported or invalid format\",\n    );\n  }\n}\n"]}

package/data/principals/principalMutationJournalRecord.d.ts

@@ -0,0 +1,8 @@
+import type { PrincipalMutationJournalRow } from "../persistence/principalMutationJournalPersistence.js";
+/** Identifies exact local bytes for an acknowledged discard, never for replay. */
+export declare function principalMutationJournalRecordId(row: PrincipalMutationJournalRow): Promise<string>;
+export declare class UnreadablePrincipalMutationError extends Error {
+    readonly recordId: string;
+    readonly reason: "authentication" | "format";
+    constructor(recordId: string, reason: "authentication" | "format");
+}

package/data/principals/principalMutationJournalRecord.js

@@ -0,0 +1,25 @@
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+/** Identifies exact local bytes for an acknowledged discard, never for replay. */
+export async function principalMutationJournalRecordId(row) {
+    const bytes = new TextEncoder().encode(JSON.stringify([
+        "tearleads.sdk.unreadable-principal-mutation.v1",
+        row.scopeId,
+        row.organizationId,
+        row.serializedRequest,
+        row.signature,
+    ]));
+    return bytesToBase64(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+export class UnreadablePrincipalMutationError extends Error {
+    recordId;
+    reason;
+    constructor(recordId, reason) {
+        super(reason === "authentication"
+            ? "Saved principal mutation could not be authenticated"
+            : "Saved principal mutation has an unsupported or invalid format");
+        this.recordId = recordId;
+        this.reason = reason;
+        this.name = "UnreadablePrincipalMutationError";
+    }
+}
+//# sourceMappingURL=principalMutationJournalRecord.js.map

package/data/principals/principalMutationJournalRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalRecord.js","sourceRoot":"","sources":["principalMutationJournalRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAgC;IAEhC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,IAAI,CAAC,SAAS,CAAC;QACb,gDAAgD;QAChD,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,iBAAiB;QACrB,GAAG,CAAC,SAAS;KACd,CAAC,CACH,CAAC;IACF,OAAO,aAAa,CAClB,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAE9C;IACA;IAFX,YACW,QAAgB,EAChB,MAAmC;QAE5C,KAAK,CACH,MAAM,KAAK,gBAAgB;YACzB,CAAC,CAAC,qDAAqD;YACvD,CAAC,CAAC,+DAA+D,CACpE,CAAC;QAPO,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAA6B;QAO5C,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { PrincipalMutationJournalRow } from \"../persistence/principalMutationJournalPersistence\";\n\n/** Identifies exact local bytes for an acknowledged discard, never for replay. */\nexport async function principalMutationJournalRecordId(\n  row: PrincipalMutationJournalRow,\n): Promise<string> {\n  const bytes = new TextEncoder().encode(\n    JSON.stringify([\n      \"tearleads.sdk.unreadable-principal-mutation.v1\",\n      row.scopeId,\n      row.organizationId,\n      row.serializedRequest,\n      row.signature,\n    ]),\n  );\n  return bytesToBase64(\n    new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes)),\n  );\n}\n\nexport class UnreadablePrincipalMutationError extends Error {\n  constructor(\n    readonly recordId: string,\n    readonly reason: \"authentication\" | \"format\",\n  ) {\n    super(\n      reason === \"authentication\"\n        ? \"Saved principal mutation could not be authenticated\"\n        : \"Saved principal mutation has an unsupported or invalid format\",\n    );\n    this.name = \"UnreadablePrincipalMutationError\";\n  }\n}\n"]}

package/data/principals/principalPolicyAdminSigners.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyAdminSigners.js","sourceRoot":"","sources":["principalPolicyAdminSigners.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAOvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,kCAAkC,CAChD,MAAqC;IAErC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAA+B;IAE/B,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,UAAU;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;aAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAClC;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI;QAChC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE,CAAC,CAAC;QAC5D,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IACE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,8DAA8D,CAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,2BAA2B,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yDAAyD,CAAC,KAM/E;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function principalPolicyReferenceFromBundle(\n  bundle: PrincipalPolicyBundleResponse,\n): ReferencedPrincipalHead {\n  return {\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    keyFingerprint: bundle.currentState.keyFingerprint,\n  };\n}\n\nexport function organizationAdminSignerUserIds(\n  policy: VerifiedPrincipalPolicy,\n): string[] {\n  return [\n    ...new Set(\n      policy.projection\n        .filter((member) => member.role === \"admin\")\n        .map((member) => member.userId),\n    ),\n  ].sort();\n}\n\nexport function organizationAdminExternalAuthority(\n  policy: VerifiedPrincipalPolicy,\n): PrincipalPolicyExternalAuthority {\n  const history = policy.history ?? [\n    {\n      state: policy.state,\n      projection: policy.projection,\n      grants: policy.grants,\n    },\n  ];\n  const toHead = (state: (typeof history)[number][\"state\"]) => ({\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  });\n  return {\n    currentHead: toHead(policy.state),\n    states: history.map((entry) => ({\n      head: toHead(entry.state),\n      projection: entry.projection,\n    })),\n  };\n}\n\nexport async function verifyOrganizationAdminPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly organizationId: string;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  if (\n    input.bundle.currentState.principalType !== \"organization\" ||\n    input.bundle.currentState.principalId !== input.organizationId\n  ) {\n    return {\n      ok: false,\n      error: new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization policy does not match the expected organization\",\n      ),\n    };\n  }\n\n  return verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: principalPolicyReferenceFromBundle(input.bundle),\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n}\n\nexport async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly expectedReference: ReferencedPrincipalHead;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n  if (verified.ok || verified.error.code !== \"unauthorized\") {\n    return verified;\n  }\n\n  const externalAuthority = await input.loadExternalAuthority();\n  if (!externalAuthority) {\n    return verified;\n  }\n\n  const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    externalAuthority,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  return verifiedWithExternalAdmins;\n}\n"]}
+{"version":3,"file":"principalPolicyAdminSigners.js","sourceRoot":"","sources":["principalPolicyAdminSigners.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAOvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,kCAAkC,CAChD,MAA2D;IAE3D,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAmD;IAEnD,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,UAAU;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;aAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAClC;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI;QAChC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE,CAAC,CAAC;QAC5D,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IACE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,8DAA8D,CAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,2BAA2B,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yDAAyD,CAAC,KAM/E;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function principalPolicyReferenceFromBundle(\n  bundle: Pick<PrincipalPolicyBundleResponse, \"currentState\">,\n): ReferencedPrincipalHead {\n  return {\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    keyFingerprint: bundle.currentState.keyFingerprint,\n  };\n}\n\nexport function organizationAdminSignerUserIds(\n  policy: Pick<VerifiedPrincipalPolicy, \"projection\">,\n): string[] {\n  return [\n    ...new Set(\n      policy.projection\n        .filter((member) => member.role === \"admin\")\n        .map((member) => member.userId),\n    ),\n  ].sort();\n}\n\nexport function organizationAdminExternalAuthority(\n  policy: VerifiedPrincipalPolicy,\n): PrincipalPolicyExternalAuthority {\n  const history = policy.history ?? [\n    {\n      state: policy.state,\n      projection: policy.projection,\n      grants: policy.grants,\n    },\n  ];\n  const toHead = (state: (typeof history)[number][\"state\"]) => ({\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  });\n  return {\n    currentHead: toHead(policy.state),\n    states: history.map((entry) => ({\n      head: toHead(entry.state),\n      projection: entry.projection,\n    })),\n  };\n}\n\nexport async function verifyOrganizationAdminPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly organizationId: string;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  if (\n    input.bundle.currentState.principalType !== \"organization\" ||\n    input.bundle.currentState.principalId !== input.organizationId\n  ) {\n    return {\n      ok: false,\n      error: new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization policy does not match the expected organization\",\n      ),\n    };\n  }\n\n  return verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: principalPolicyReferenceFromBundle(input.bundle),\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n}\n\nexport async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly expectedReference: ReferencedPrincipalHead;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n  if (verified.ok || verified.error.code !== \"unauthorized\") {\n    return verified;\n  }\n\n  const externalAuthority = await input.loadExternalAuthority();\n  if (!externalAuthority) {\n    return verified;\n  }\n\n  const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    externalAuthority,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  return verifiedWithExternalAdmins;\n}\n"]}

package/data/sqlite/principalHistoryStageSchema.js

@@ -1,4 +1,6 @@
+import { desc } from "drizzle-orm";
 import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { principalCurrentFingerprintJson } from "./principalKeyFingerprintJson.js";
 import { defineSqlTableSchema } from "./sqlTableSchema.js";
 /** Provisional, locally authenticated verification work; never an app checkpoint. */
 export const principalHistoryStages = sqliteTable("principal_history_stages", {
@@ -9,6 +11,7 @@ export const principalHistoryStages = sqliteTable("principal_history_stages", {
     complete: integer("complete", { mode: "boolean" }).notNull(),
     progress: text("progress").notNull(),
 }, (table) => [
+    index("principal_history_stages_key_fingerprint_idx").on(principalCurrentFingerprintJson(table.currentJson), table.complete, desc(table.afterVersion)),
     index("principal_history_stages_organization_idx").on(table.organizationId),
 ]);
 export const principalHistoryStageTables = [

package/data/sqlite/principalHistoryStageSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryStageSchema.js","sourceRoot":"","sources":["principalHistoryStageSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB,CAAC,sBAAsB,CAAC;CAC7C,CAAC","sourcesContent":["import { index, integer, sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** Provisional, locally authenticated verification work; never an app checkpoint. */\nexport const principalHistoryStages = sqliteTable(\n  \"principal_history_stages\",\n  {\n    id: text(\"id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    afterVersion: integer(\"after_version\").notNull(),\n    complete: integer(\"complete\", { mode: \"boolean\" }).notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_stages_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryStageTables = [\n  defineSqlTableSchema(principalHistoryStages),\n];\n"]}
+{"version":3,"file":"principalHistoryStageSchema.js","sourceRoot":"","sources":["principalHistoryStageSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAC/C,0BAA0B,EAC1B;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,CACtD,+BAA+B,CAAC,KAAK,CAAC,WAAW,CAAC,EAClD,KAAK,CAAC,QAAQ,EACd,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CACzB;IACD,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB,CAAC,sBAAsB,CAAC;CAC7C,CAAC","sourcesContent":["import { desc } from \"drizzle-orm\";\nimport { index, integer, sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { principalCurrentFingerprintJson } from \"./principalKeyFingerprintJson\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** Provisional, locally authenticated verification work; never an app checkpoint. */\nexport const principalHistoryStages = sqliteTable(\n  \"principal_history_stages\",\n  {\n    id: text(\"id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    currentJson: text(\"current_json\").notNull(),\n    afterVersion: integer(\"after_version\").notNull(),\n    complete: integer(\"complete\", { mode: \"boolean\" }).notNull(),\n    progress: text(\"progress\").notNull(),\n  },\n  (table) => [\n    index(\"principal_history_stages_key_fingerprint_idx\").on(\n      principalCurrentFingerprintJson(table.currentJson),\n      table.complete,\n      desc(table.afterVersion),\n    ),\n    index(\"principal_history_stages_organization_idx\").on(table.organizationId),\n  ],\n);\n\nexport const principalHistoryStageTables = [\n  defineSqlTableSchema(principalHistoryStages),\n];\n"]}

package/data/sqlite/principalMutationJournalSchema.d.ts

@@ -0,0 +1,85 @@
+/** Authored work survives cache resets and remains until its outcome is known. */
+export declare const principalMutationJournal: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "principal_mutation_journal";
+    schema: undefined;
+    columns: {
+        scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scope_id";
+            tableName: "principal_mutation_journal";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "organization_id";
+            tableName: "principal_mutation_journal";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        serializedRequest: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "serialized_request";
+            tableName: "principal_mutation_journal";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        signature: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "signature";
+            tableName: "principal_mutation_journal";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const principalMutationJournalTables: import("./sqlTableSchema.js").SqlTableSchema[];

package/data/sqlite/principalMutationJournalSchema.js

@@ -0,0 +1,13 @@
+import { sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { defineSqlTableSchema } from "./sqlTableSchema.js";
+/** Authored work survives cache resets and remains until its outcome is known. */
+export const principalMutationJournal = sqliteTable("principal_mutation_journal", {
+    scopeId: text("scope_id").primaryKey(),
+    organizationId: text("organization_id").notNull(),
+    serializedRequest: text("serialized_request").notNull(),
+    signature: text("signature").notNull(),
+});
+export const principalMutationJournalTables = [
+    defineSqlTableSchema(principalMutationJournal),
+];
+//# sourceMappingURL=principalMutationJournalSchema.js.map

package/data/sqlite/principalMutationJournalSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalSchema.js","sourceRoot":"","sources":["principalMutationJournalSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CACjD,4BAA4B,EAC5B;IACE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE;IACtC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACvD,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CACvC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,oBAAoB,CAAC,wBAAwB,CAAC;CAC/C,CAAC","sourcesContent":["import { sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema } from \"./sqlTableSchema\";\n\n/** Authored work survives cache resets and remains until its outcome is known. */\nexport const principalMutationJournal = sqliteTable(\n  \"principal_mutation_journal\",\n  {\n    scopeId: text(\"scope_id\").primaryKey(),\n    organizationId: text(\"organization_id\").notNull(),\n    serializedRequest: text(\"serialized_request\").notNull(),\n    signature: text(\"signature\").notNull(),\n  },\n);\n\nexport const principalMutationJournalTables = [\n  defineSqlTableSchema(principalMutationJournal),\n];\n"]}

package/data/sqlite/schema.d.ts

@@ -6510,6 +6510,89 @@ export declare const clientSQLiteSchema: {
         };
         dialect: "sqlite";
     }>;
+    principalMutationJournal: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+        name: "principal_mutation_journal";
+        schema: undefined;
+        columns: {
+            scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "scope_id";
+                tableName: "principal_mutation_journal";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_id";
+                tableName: "principal_mutation_journal";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            serializedRequest: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "serialized_request";
+                tableName: "principal_mutation_journal";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            signature: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "signature";
+                tableName: "principal_mutation_journal";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+        };
+        dialect: "sqlite";
+    }>;
     principalHistoryEntries: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
         name: "principal_history_entries";
         schema: undefined;

package/data/sqlite/schema.js

@@ -13,6 +13,7 @@ import { organizationReadModelSQLiteSchema, organizationReadModelTables, } from
 import { principalGrantRetirements } from "./principalGrantRetirementSchema.js";
 import { principalHistoryEntries, principalHistoryEvidenceTables, principalHistoryNodes, principalHistoryPrefixes, } from "./principalHistoryEvidenceSchema.js";
 import { principalHistoryStages, principalHistoryStageTables, } from "./principalHistoryStageSchema.js";
+import { principalMutationJournal, principalMutationJournalTables, } from "./principalMutationJournalSchema.js";
 import { principalPolicies, principalPolicyBundleHistory, principalPolicyBundleReferences, principalPolicyCheckpoints, principalPolicyOrganizations, } from "./principalPolicySchema.js";
 import { securityIncidents, securityIncidentTable, } from "./securityIncidentSchema.js";
 import { defineSqlTableSchema } from "./sqlTableSchema.js";
@@ -581,6 +582,7 @@ export const containerSyncWatermarkTables = [
     defineSqlTableSchema(containerSyncLaneChecks),
 ];
 export const clientSqlTables = [
+    ...principalMutationJournalTables,
     ...documentTables,
     ...principalPolicyTables,
     ...keyingCheckpointTables,
@@ -598,6 +600,7 @@ export const clientSqlTables = [
     ...provisioningAttempt.organizationProvisioningAttemptTables,
 ];
 export const clientSQLiteSchema = {
+    principalMutationJournal,
     principalHistoryEntries,
     principalHistoryNodes,
     principalHistoryPrefixes,