@tearleads/client-sdk 0.1.15 → 0.1.17

package/internal/crypto/keying/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n  assertSealedContainerKekKeyringLength,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  computeContainerKekKeyringHash,\n  expectedSealedContainerKekKeyringBytes,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n  verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  normalizeContainerKekPredecessorBridge,\n  unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n  type DocumentPurgeAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  type VerifyDocumentPurgeEventInput,\n  verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n  createPrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n  createPrincipalHistoryIndexProof,\n  principalHistoryIndexLeaf,\n  resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n  type VerifyTransparencyConsistencyProofInput,\n  type VerifyTransparencyInclusionProofInput,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n  computeTransparencyMerkleRoot,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,iDAAiD,EAAE,MAAM,+CAA+C,CAAC;AAClH,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAK1F,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n  assertSealedContainerKekKeyringLength,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  computeContainerKekKeyringHash,\n  expectedSealedContainerKekKeyringBytes,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n  verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  normalizeContainerKekPredecessorBridge,\n  unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n  type DocumentPurgeAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  type VerifyDocumentPurgeEventInput,\n  verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport { verifyPrincipalPolicyCurrentMutation } from \"./principalPolicyCurrentMutation\";\nexport { selectPrincipalPolicyCurrentPredecessorReferences } from \"./principalPolicyCurrentPredecessorReferences\";\nexport { verifyPrincipalPolicyCurrentSuccessor } from \"./principalPolicyCurrentSuccessor\";\nexport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n  createPrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n  createPrincipalHistoryIndexProof,\n  principalHistoryIndexLeaf,\n  resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n  type VerifyTransparencyConsistencyProofInput,\n  type VerifyTransparencyInclusionProofInput,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n  computeTransparencyMerkleRoot,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}

package/internal/crypto/keying/principalPolicyCurrent.d.ts

@@ -1,5 +1,5 @@
 import { type VerifiedPrincipalPolicyHistory } from "./principalPolicyHistoryTypes.js";
-import { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
 import type { KeyingVerificationResult } from "./types.js";
 export type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
 /**

package/internal/crypto/keying/principalPolicyCurrent.js

@@ -1,9 +1,9 @@
 import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent } from "./principalPolicyCurrentEvidence.js";
 import { ownVerifiedPrincipalPolicyHistory, } from "./principalPolicyHistoryTypes.js";
 import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
 import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
 import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
-import { makeVerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
 import { runVerifier, throwVerification } from "./shared.js";
 // Adapt owned readonly evidence to the mutable arrays in policy result types.
 function mutableEntry(entry) {
@@ -35,7 +35,7 @@ export function verifyPrincipalPolicyCurrent(input) {
             throwVerification("hash_mismatch", "current principal policy does not match verified history");
         await verifyPrincipalPolicyPayload({ bundle: current });
         await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
-        return makeVerifiedPrincipalPolicyCurrent({
+        return issueVerifiedPrincipalPolicyCurrent({
             principalType: entry.state.principalType,
             principalId: entry.state.principalId,
             version: entry.state.version,
@@ -51,7 +51,7 @@ export function verifyPrincipalPolicyCurrent(input) {
                 version: entry.state.version,
                 stateHash: entry.state.stateHash,
             },
-        });
+        }, history.latestAuthority);
     });
 }
 //# sourceMappingURL=principalPolicyCurrent.js.map

package/internal/crypto/keying/principalPolicyCurrent.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyCurrent.js","sourceRoot":"","sources":["principalPolicyCurrent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EACL,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,kCAAkC,GAGnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAW1D,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAqC;IACzD,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YAClE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;YAElD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,kCAAkC,CAAC;YACxC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport {\n  ownVerifiedPrincipalPolicyHistory,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport {\n  makeVerifiedPrincipalPolicyCurrent,\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n} from \"./types\";\n\nexport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\n\n// Adapt owned readonly evidence to the mutable arrays in policy result types.\nfunction mutableEntry(entry: PrincipalPolicyStateChainEntry) {\n  return {\n    state: structuredClone(entry.state),\n    projection: entry.projection.map((member) => ({ ...member })),\n    grants: entry.grants.map((grant) => ({ ...grant })),\n  };\n}\n\n/**\n * Authenticate current keying artifacts against a prefix already verified by\n * this runtime. The returned history contains only explicitly retained entries.\n */\nexport function verifyPrincipalPolicyCurrent(input: {\n  readonly current: PrincipalPolicyCurrent;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n  return runVerifier(async () => {\n    const current = structuredClone(input.current);\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const expected = history.currentEntry;\n    const retained = history.retainedEntries.map(mutableEntry);\n    const entry = await normalizePrincipalPolicyStateChainEntry({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n    // The state hash commits the signed header, not its signature bytes. Keep\n    // both tied to the accepted entry when validating rows read from storage.\n    if (\n      !principalPolicyStateMatchesReference(entry.state, expected.state) ||\n      entry.state.signature !== expected.state.signature\n    )\n      throwVerification(\n        \"hash_mismatch\",\n        \"current principal policy does not match verified history\",\n      );\n    await verifyPrincipalPolicyPayload({ bundle: current });\n    await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n    return makeVerifiedPrincipalPolicyCurrent({\n      principalType: entry.state.principalType,\n      principalId: entry.state.principalId,\n      version: entry.state.version,\n      keyEpoch: entry.state.keyEpoch,\n      stateHash: entry.state.stateHash,\n      state: entry.state,\n      projection: entry.projection,\n      grants: entry.grants,\n      retainedHistory: retained,\n      checkpoint: {\n        principalType: entry.state.principalType,\n        principalId: entry.state.principalId,\n        version: entry.state.version,\n        stateHash: entry.state.stateHash,\n      },\n    });\n  });\n}\n"]}
+{"version":3,"file":"principalPolicyCurrent.js","sourceRoot":"","sources":["principalPolicyCurrent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAKlF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAW1D,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAqC;IACzD,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YAClE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;YAElD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,mCAAmC,CACxC;YACE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { issueVerifiedPrincipalPolicyCurrent } from \"./principalPolicyCurrentEvidence\";\nimport {\n  ownVerifiedPrincipalPolicyHistory,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n} from \"./types\";\n\nexport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\n\n// Adapt owned readonly evidence to the mutable arrays in policy result types.\nfunction mutableEntry(entry: PrincipalPolicyStateChainEntry) {\n  return {\n    state: structuredClone(entry.state),\n    projection: entry.projection.map((member) => ({ ...member })),\n    grants: entry.grants.map((grant) => ({ ...grant })),\n  };\n}\n\n/**\n * Authenticate current keying artifacts against a prefix already verified by\n * this runtime. The returned history contains only explicitly retained entries.\n */\nexport function verifyPrincipalPolicyCurrent(input: {\n  readonly current: PrincipalPolicyCurrent;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n  return runVerifier(async () => {\n    const current = structuredClone(input.current);\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const expected = history.currentEntry;\n    const retained = history.retainedEntries.map(mutableEntry);\n    const entry = await normalizePrincipalPolicyStateChainEntry({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n    // The state hash commits the signed header, not its signature bytes. Keep\n    // both tied to the accepted entry when validating rows read from storage.\n    if (\n      !principalPolicyStateMatchesReference(entry.state, expected.state) ||\n      entry.state.signature !== expected.state.signature\n    )\n      throwVerification(\n        \"hash_mismatch\",\n        \"current principal policy does not match verified history\",\n      );\n    await verifyPrincipalPolicyPayload({ bundle: current });\n    await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n    return issueVerifiedPrincipalPolicyCurrent(\n      {\n        principalType: entry.state.principalType,\n        principalId: entry.state.principalId,\n        version: entry.state.version,\n        keyEpoch: entry.state.keyEpoch,\n        stateHash: entry.state.stateHash,\n        state: entry.state,\n        projection: entry.projection,\n        grants: entry.grants,\n        retainedHistory: retained,\n        checkpoint: {\n          principalType: entry.state.principalType,\n          principalId: entry.state.principalId,\n          version: entry.state.version,\n          stateHash: entry.state.stateHash,\n        },\n      },\n      history.latestAuthority,\n    );\n  });\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentEvidence.js

@@ -0,0 +1,16 @@
+import { makeVerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
+import { throwVerification } from "./shared.js";
+const issued = new WeakMap();
+/** Keep the verified predecessor and historical authority cursor private. */
+export function issueVerifiedPrincipalPolicyCurrent(value, latestAuthority) {
+    const result = makeVerifiedPrincipalPolicyCurrent(value);
+    issued.set(result, structuredClone({ policy: value, latestAuthority }));
+    return result;
+}
+export function ownVerifiedPrincipalPolicyCurrent(policy) {
+    const snapshot = issued.get(policy);
+    if (!snapshot)
+        throwVerification("invalid_shape", "current policy must come from a local verifier");
+    return structuredClone(snapshot);
+}
+//# sourceMappingURL=principalPolicyCurrentEvidence.js.map

package/internal/crypto/keying/principalPolicyCurrentEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCurrentEvidence.js","sourceRoot":"","sources":["principalPolicyCurrentEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,MAAM,MAAM,GAAG,IAAI,OAAO,EAMvB,CAAC;AAEJ,6EAA6E;AAC7E,MAAM,UAAU,mCAAmC,CACjD,KAAmB,EACnB,eAAuD;IAEvD,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ;QACX,iBAAiB,CACf,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { PrincipalStateExternalAuthority } from \"../principalState\";\nimport {\n  makeVerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { throwVerification } from \"./shared\";\n\ntype CurrentValue = Parameters<typeof makeVerifiedPrincipalPolicyCurrent>[0];\nconst issued = new WeakMap<\n  VerifiedPrincipalPolicyCurrent,\n  {\n    policy: CurrentValue;\n    latestAuthority: PrincipalStateExternalAuthority | null;\n  }\n>();\n\n/** Keep the verified predecessor and historical authority cursor private. */\nexport function issueVerifiedPrincipalPolicyCurrent(\n  value: CurrentValue,\n  latestAuthority: PrincipalStateExternalAuthority | null,\n): VerifiedPrincipalPolicyCurrent {\n  const result = makeVerifiedPrincipalPolicyCurrent(value);\n  issued.set(result, structuredClone({ policy: value, latestAuthority }));\n  return result;\n}\n\nexport function ownVerifiedPrincipalPolicyCurrent(\n  policy: VerifiedPrincipalPolicyCurrent,\n) {\n  const snapshot = issued.get(policy);\n  if (!snapshot)\n    throwVerification(\n      \"invalid_shape\",\n      \"current policy must come from a local verifier\",\n    );\n  return structuredClone(snapshot);\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentMutation.d.ts

@@ -0,0 +1,10 @@
+import type { PrincipalPolicyExternalAuthority } from "./principalPolicyExternalAuthorityTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { KeyingVerificationResult } from "./types.js";
+/** Bind a group's current artifacts and next signer to privately issued evidence. */
+export declare function verifyPrincipalPolicyCurrentMutation(input: {
+    readonly current: PrincipalPolicyCurrent;
+    readonly policy: VerifiedPrincipalPolicyCurrent;
+    readonly signerUserId: string;
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
+}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>>;

package/internal/crypto/keying/principalPolicyCurrentMutation.js

@@ -0,0 +1,51 @@
+import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent, ownVerifiedPrincipalPolicyCurrent, } from "./principalPolicyCurrentEvidence.js";
+import { createPrincipalPolicyExternalAuthorityVerifier, externalAuthorityIncludesAdminSigner, verifyPrincipalPolicyExternalAuthorityProgress, } from "./principalPolicyExternalAuthority.js";
+import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
+import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
+import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
+import { runVerifier, throwVerification } from "./shared.js";
+/** Bind a group's current artifacts and next signer to privately issued evidence. */
+export function verifyPrincipalPolicyCurrentMutation(input) {
+    return runVerifier(async () => {
+        const prior = ownVerifiedPrincipalPolicyCurrent(input.policy);
+        const current = structuredClone(input.current);
+        const externalAuthority = structuredClone(input.externalAuthority);
+        const signerUserId = input.signerUserId;
+        const entry = await normalizePrincipalPolicyStateChainEntry({
+            state: current.currentState,
+            projection: current.currentProjection,
+            grants: current.currentGrants,
+        });
+        if (!principalPolicyStateMatchesReference(entry.state, prior.policy.state) ||
+            entry.state.signature !== prior.policy.state.signature)
+            throwVerification("hash_mismatch", "current artifacts differ from issued policy evidence");
+        if (entry.state.principalType !== "group")
+            throwVerification("object_mismatch", "group mutation requires a group policy");
+        await verifyPrincipalPolicyPayload({ bundle: current });
+        await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
+        if (!entry.projection.some((member) => member.userId === signerUserId && member.role === "admin")) {
+            const authority = createPrincipalPolicyExternalAuthorityVerifier({
+                authority: externalAuthority,
+            });
+            authority.latestReference = prior.latestAuthority;
+            const next = {
+                state: {
+                    signerUserId,
+                    externalAuthority: externalAuthority?.currentHead ?? null,
+                },
+            };
+            verifyPrincipalPolicyExternalAuthorityProgress({
+                entry: next,
+                verifier: authority,
+            });
+            if (!externalAuthorityIncludesAdminSigner({
+                entry: next,
+                verifier: authority,
+            }))
+                throwVerification("unauthorized", "group mutation signer is not an authority admin");
+        }
+        return issueVerifiedPrincipalPolicyCurrent(prior.policy, prior.latestAuthority);
+    });
+}
+//# sourceMappingURL=principalPolicyCurrentMutation.js.map

package/internal/crypto/keying/principalPolicyCurrentMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCurrentMutation.js","sourceRoot":"","sources":["principalPolicyCurrentMutation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8CAA8C,EAC9C,oCAAoC,EACpC,8CAA8C,GAC/C,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAKlF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG1D,qFAAqF;AACrF,MAAM,UAAU,oCAAoC,CAAC,KAKpD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,KAAK,GAAG,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,iBAAiB,GAAG,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACtE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS;YAEtD,iBAAiB,CACf,eAAe,EACf,sDAAsD,CACvD,CAAC;QACJ,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;YACvC,iBAAiB,CACf,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CACpB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CACtE,EACD,CAAC;YACD,MAAM,SAAS,GAAG,8CAA8C,CAAC;gBAC/D,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;YACH,SAAS,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;YAClD,MAAM,IAAI,GAAG;gBACX,KAAK,EAAE;oBACL,YAAY;oBACZ,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,IAAI,IAAI;iBAC1D;aACF,CAAC;YACF,8CAA8C,CAAC;gBAC7C,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;YACH,IACE,CAAC,oCAAoC,CAAC;gBACpC,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,SAAS;aACpB,CAAC;gBAEF,iBAAiB,CACf,cAAc,EACd,iDAAiD,CAClD,CAAC;QACN,CAAC;QACD,OAAO,mCAAmC,CACxC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,eAAe,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport {\n  issueVerifiedPrincipalPolicyCurrent,\n  ownVerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrentEvidence\";\nimport {\n  createPrincipalPolicyExternalAuthorityVerifier,\n  externalAuthorityIncludesAdminSigner,\n  verifyPrincipalPolicyExternalAuthorityProgress,\n} from \"./principalPolicyExternalAuthority\";\nimport type { PrincipalPolicyExternalAuthority } from \"./principalPolicyExternalAuthorityTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type { KeyingVerificationResult } from \"./types\";\n\n/** Bind a group's current artifacts and next signer to privately issued evidence. */\nexport function verifyPrincipalPolicyCurrentMutation(input: {\n  readonly current: PrincipalPolicyCurrent;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly signerUserId: string;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n  return runVerifier(async () => {\n    const prior = ownVerifiedPrincipalPolicyCurrent(input.policy);\n    const current = structuredClone(input.current);\n    const externalAuthority = structuredClone(input.externalAuthority);\n    const signerUserId = input.signerUserId;\n    const entry = await normalizePrincipalPolicyStateChainEntry({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n    if (\n      !principalPolicyStateMatchesReference(entry.state, prior.policy.state) ||\n      entry.state.signature !== prior.policy.state.signature\n    )\n      throwVerification(\n        \"hash_mismatch\",\n        \"current artifacts differ from issued policy evidence\",\n      );\n    if (entry.state.principalType !== \"group\")\n      throwVerification(\n        \"object_mismatch\",\n        \"group mutation requires a group policy\",\n      );\n    await verifyPrincipalPolicyPayload({ bundle: current });\n    await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n    if (\n      !entry.projection.some(\n        (member) => member.userId === signerUserId && member.role === \"admin\",\n      )\n    ) {\n      const authority = createPrincipalPolicyExternalAuthorityVerifier({\n        authority: externalAuthority,\n      });\n      authority.latestReference = prior.latestAuthority;\n      const next = {\n        state: {\n          signerUserId,\n          externalAuthority: externalAuthority?.currentHead ?? null,\n        },\n      };\n      verifyPrincipalPolicyExternalAuthorityProgress({\n        entry: next,\n        verifier: authority,\n      });\n      if (\n        !externalAuthorityIncludesAdminSigner({\n          entry: next,\n          verifier: authority,\n        })\n      )\n        throwVerification(\n          \"unauthorized\",\n          \"group mutation signer is not an authority admin\",\n        );\n    }\n    return issueVerifiedPrincipalPolicyCurrent(\n      prior.policy,\n      prior.latestAuthority,\n    );\n  });\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentPredecessorReferences.d.ts

@@ -0,0 +1,8 @@
+import type { VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { KeyingVerificationResult, ReferencedPrincipalHead } from "./types.js";
+/** Carry selected authenticated citations across one privately verified successor. */
+export declare function selectPrincipalPolicyCurrentPredecessorReferences(input: {
+    readonly current: VerifiedPrincipalPolicyCurrent;
+    readonly predecessor: VerifiedPrincipalPolicyCurrent;
+    readonly references: readonly ReferencedPrincipalHead[];
+}): KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>;

package/internal/crypto/keying/principalPolicyCurrentPredecessorReferences.js

@@ -0,0 +1,46 @@
+import { issueVerifiedPrincipalPolicyCurrent, ownVerifiedPrincipalPolicyCurrent, } from "./principalPolicyCurrentEvidence.js";
+import { normalizePrincipalHistoryInput } from "./principalPolicyHistoryChecks.js";
+import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
+import { ok, throwVerification, toVerificationResult } from "./shared.js";
+/** Carry selected authenticated citations across one privately verified successor. */
+export function selectPrincipalPolicyCurrentPredecessorReferences(input) {
+    try {
+        const current = ownVerifiedPrincipalPolicyCurrent(input.current);
+        const predecessor = ownVerifiedPrincipalPolicyCurrent(input.predecessor);
+        const { references } = normalizePrincipalHistoryInput({
+            principalId: current.policy.principalId,
+            principalType: current.policy.principalType,
+            retainedReferences: input.references,
+        });
+        if (predecessor.policy.principalType !== current.policy.principalType ||
+            predecessor.policy.principalId !== current.policy.principalId ||
+            predecessor.policy.version + 1 !== current.policy.version ||
+            predecessor.policy.stateHash !== current.policy.state.prevStateHash)
+            throwVerification("stale_predecessor", "Selected history must belong to the exact verified predecessor");
+        const retained = new Map();
+        for (const policy of [predecessor.policy, current.policy])
+            retained.set(policy.version, {
+                state: policy.state,
+                projection: policy.projection,
+                grants: policy.grants,
+            });
+        for (const reference of references) {
+            const entry = [
+                ...current.policy.retainedHistory,
+                ...predecessor.policy.retainedHistory,
+            ].find(({ state }) => principalPolicyStateMatchesReference(state, reference));
+            if (!entry)
+                throwVerification("missing_dependency", "Requested predecessor citation was not privately verified");
+            retained.set(entry.state.version, entry);
+        }
+        // At most the history reference budget plus the predecessor/successor pair.
+        return ok(issueVerifiedPrincipalPolicyCurrent({
+            ...current.policy,
+            retainedHistory: [...retained.values()].sort((left, right) => left.state.version - right.state.version),
+        }, current.latestAuthority));
+    }
+    catch (error) {
+        return toVerificationResult(error);
+    }
+}
+//# sourceMappingURL=principalPolicyCurrentPredecessorReferences.js.map

package/internal/crypto/keying/principalPolicyCurrentPredecessorReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCurrentPredecessorReferences.js","sourceRoot":"","sources":["principalPolicyCurrentPredecessorReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAElF,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAOvE,sFAAsF;AACtF,MAAM,UAAU,iDAAiD,CAAC,KAIjE;IACC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,iCAAiC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,GAAG,8BAA8B,CAAC;YACpD,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;YACvC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;YAC3C,kBAAkB,EAAE,KAAK,CAAC,UAAU;SACrC,CAAC,CAAC;QACH,IACE,WAAW,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,aAAa;YACjE,WAAW,CAAC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW;YAC7D,WAAW,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO;YACzD,WAAW,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;YAEnE,iBAAiB,CACf,mBAAmB,EACnB,gEAAgE,CACjE,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;QACJ,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG;gBACZ,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe;gBACjC,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe;aACtC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACnB,oCAAoC,CAAC,KAAK,EAAE,SAAS,CAAC,CACvD,CAAC;YACF,IAAI,CAAC,KAAK;gBACR,iBAAiB,CACf,oBAAoB,EACpB,2DAA2D,CAC5D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,4EAA4E;QAC5E,OAAO,EAAE,CACP,mCAAmC,CACjC;YACE,GAAG,OAAO,CAAC,MAAM;YACjB,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC","sourcesContent":["import {\n  issueVerifiedPrincipalPolicyCurrent,\n  ownVerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrentEvidence\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport type { VerifiedPrincipalPolicyCurrent } from \"./principalPolicyTypes\";\nimport { ok, throwVerification, toVerificationResult } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  NormalizedPrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n} from \"./types\";\n\n/** Carry selected authenticated citations across one privately verified successor. */\nexport function selectPrincipalPolicyCurrentPredecessorReferences(input: {\n  readonly current: VerifiedPrincipalPolicyCurrent;\n  readonly predecessor: VerifiedPrincipalPolicyCurrent;\n  readonly references: readonly ReferencedPrincipalHead[];\n}): KeyingVerificationResult<VerifiedPrincipalPolicyCurrent> {\n  try {\n    const current = ownVerifiedPrincipalPolicyCurrent(input.current);\n    const predecessor = ownVerifiedPrincipalPolicyCurrent(input.predecessor);\n    const { references } = normalizePrincipalHistoryInput({\n      principalId: current.policy.principalId,\n      principalType: current.policy.principalType,\n      retainedReferences: input.references,\n    });\n    if (\n      predecessor.policy.principalType !== current.policy.principalType ||\n      predecessor.policy.principalId !== current.policy.principalId ||\n      predecessor.policy.version + 1 !== current.policy.version ||\n      predecessor.policy.stateHash !== current.policy.state.prevStateHash\n    )\n      throwVerification(\n        \"stale_predecessor\",\n        \"Selected history must belong to the exact verified predecessor\",\n      );\n    const retained = new Map<\n      number,\n      NormalizedPrincipalPolicyStateChainEntry\n    >();\n    for (const policy of [predecessor.policy, current.policy])\n      retained.set(policy.version, {\n        state: policy.state,\n        projection: policy.projection,\n        grants: policy.grants,\n      });\n    for (const reference of references) {\n      const entry = [\n        ...current.policy.retainedHistory,\n        ...predecessor.policy.retainedHistory,\n      ].find(({ state }) =>\n        principalPolicyStateMatchesReference(state, reference),\n      );\n      if (!entry)\n        throwVerification(\n          \"missing_dependency\",\n          \"Requested predecessor citation was not privately verified\",\n        );\n      retained.set(entry.state.version, entry);\n    }\n    // At most the history reference budget plus the predecessor/successor pair.\n    return ok(\n      issueVerifiedPrincipalPolicyCurrent(\n        {\n          ...current.policy,\n          retainedHistory: [...retained.values()].sort(\n            (left, right) => left.state.version - right.state.version,\n          ),\n        },\n        current.latestAuthority,\n      ),\n    );\n  } catch (error) {\n    return toVerificationResult(error);\n  }\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentSuccessor.d.ts

@@ -0,0 +1,10 @@
+import type { PrincipalPolicyExternalAuthority } from "./principalPolicyExternalAuthorityTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { KeyingVerificationResult, PrincipalPolicySignerPublicKey } from "./types.js";
+/** Verify one successor of locally verified current evidence, retaining only that pair. */
+export declare function verifyPrincipalPolicyCurrentSuccessor(input: {
+    readonly previous: VerifiedPrincipalPolicyCurrent;
+    readonly current: PrincipalPolicyCurrent;
+    readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
+}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>>;

package/internal/crypto/keying/principalPolicyCurrentSuccessor.js

@@ -0,0 +1,60 @@
+import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent, ownVerifiedPrincipalPolicyCurrent, } from "./principalPolicyCurrentEvidence.js";
+import { verifyPrincipalHistoryPage } from "./principalPolicyHistoryPage.js";
+import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
+import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
+import { runVerifier } from "./shared.js";
+/** Verify one successor of locally verified current evidence, retaining only that pair. */
+export function verifyPrincipalPolicyCurrentSuccessor(input) {
+    return runVerifier(async () => {
+        const prior = ownVerifiedPrincipalPolicyCurrent(input.previous);
+        const current = structuredClone(input.current);
+        const signerPublicKeys = structuredClone(input.signerPublicKeys);
+        const externalAuthority = structuredClone(input.externalAuthority);
+        const previous = await normalizePrincipalPolicyStateChainEntry({
+            state: prior.policy.state,
+            projection: prior.policy.projection,
+            grants: prior.policy.grants,
+        });
+        const checked = await verifyPrincipalHistoryPage({
+            principalId: prior.policy.principalId,
+            principalType: prior.policy.principalType,
+            previous,
+            latestAuthority: prior.latestAuthority,
+            references: [],
+            checkpoint: null,
+            page: {
+                entries: [
+                    {
+                        state: current.currentState,
+                        projection: current.currentProjection,
+                        grants: current.currentGrants,
+                    },
+                ],
+                signerPublicKeys,
+                ...(externalAuthority ? { externalAuthority } : {}),
+            },
+        });
+        await verifyPrincipalPolicyPayload({ bundle: current });
+        await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
+        const { state, projection, grants } = checked.last;
+        return issueVerifiedPrincipalPolicyCurrent({
+            principalId: state.principalId,
+            principalType: state.principalType,
+            version: state.version,
+            keyEpoch: state.keyEpoch,
+            stateHash: state.stateHash,
+            state,
+            projection,
+            grants,
+            retainedHistory: [previous, checked.last],
+            checkpoint: {
+                principalId: state.principalId,
+                principalType: state.principalType,
+                version: state.version,
+                stateHash: state.stateHash,
+            },
+        }, checked.latestAuthority);
+    });
+}
+//# sourceMappingURL=principalPolicyCurrentSuccessor.js.map

package/internal/crypto/keying/principalPolicyCurrentSuccessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCurrentSuccessor.js","sourceRoot":"","sources":["principalPolicyCurrentSuccessor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAKxE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAMvC,2FAA2F;AAC3F,MAAM,UAAU,qCAAqC,CAAC,KAKrD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,KAAK,GAAG,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,iBAAiB,GAAG,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAAC;YAC7D,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;YAC/C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YACzC,QAAQ;YACR,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE;gBACJ,OAAO,EAAE;oBACP;wBACE,KAAK,EAAE,OAAO,CAAC,YAAY;wBAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;wBACrC,MAAM,EAAE,OAAO,CAAC,aAAa;qBAC9B;iBACF;gBACD,gBAAgB;gBAChB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QACnD,OAAO,mCAAmC,CACxC;YACE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,UAAU;YACV,MAAM;YACN,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;YACzC,UAAU,EAAE;gBACV,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport {\n  issueVerifiedPrincipalPolicyCurrent,\n  ownVerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrentEvidence\";\nimport type { PrincipalPolicyExternalAuthority } from \"./principalPolicyExternalAuthorityTypes\";\nimport { verifyPrincipalHistoryPage } from \"./principalPolicyHistoryPage\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicySignerPublicKey,\n} from \"./types\";\n\n/** Verify one successor of locally verified current evidence, retaining only that pair. */\nexport function verifyPrincipalPolicyCurrentSuccessor(input: {\n  readonly previous: VerifiedPrincipalPolicyCurrent;\n  readonly current: PrincipalPolicyCurrent;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n  return runVerifier(async () => {\n    const prior = ownVerifiedPrincipalPolicyCurrent(input.previous);\n    const current = structuredClone(input.current);\n    const signerPublicKeys = structuredClone(input.signerPublicKeys);\n    const externalAuthority = structuredClone(input.externalAuthority);\n    const previous = await normalizePrincipalPolicyStateChainEntry({\n      state: prior.policy.state,\n      projection: prior.policy.projection,\n      grants: prior.policy.grants,\n    });\n    const checked = await verifyPrincipalHistoryPage({\n      principalId: prior.policy.principalId,\n      principalType: prior.policy.principalType,\n      previous,\n      latestAuthority: prior.latestAuthority,\n      references: [],\n      checkpoint: null,\n      page: {\n        entries: [\n          {\n            state: current.currentState,\n            projection: current.currentProjection,\n            grants: current.currentGrants,\n          },\n        ],\n        signerPublicKeys,\n        ...(externalAuthority ? { externalAuthority } : {}),\n      },\n    });\n    await verifyPrincipalPolicyPayload({ bundle: current });\n    await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n    const { state, projection, grants } = checked.last;\n    return issueVerifiedPrincipalPolicyCurrent(\n      {\n        principalId: state.principalId,\n        principalType: state.principalType,\n        version: state.version,\n        keyEpoch: state.keyEpoch,\n        stateHash: state.stateHash,\n        state,\n        projection,\n        grants,\n        retainedHistory: [previous, checked.last],\n        checkpoint: {\n          principalId: state.principalId,\n          principalType: state.principalType,\n          version: state.version,\n          stateHash: state.stateHash,\n        },\n      },\n      checked.latestAuthority,\n    );\n  });\n}\n"]}

package/internal/crypto/keying/principalPolicyHistory.js

@@ -118,7 +118,10 @@ class PrincipalPolicyHistoryVerifierImpl {
                     stateHash: state.stateHash,
                 },
             });
-            return { ok: true, value: makeVerifiedPrincipalPolicyHistory(owned) };
+            return {
+                ok: true,
+                value: makeVerifiedPrincipalPolicyHistory(owned, this.#latestAuthority),
+            };
         }
         catch (error) {
             return toVerificationResult(error);

package/internal/crypto/keying/principalPolicyHistory.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyHistory.js","sourceRoot":"","sources":["principalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,8CAA8C,GAE/C,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,4BAA4B,EAC5B,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,kCAAkC,GAMnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAOhF,MAAM,kCAAkC;IAG7B,MAAM,CAAoD;IACnE,SAAS,CAAuD;IAChE,gBAAgB,GAA2C,IAAI,CAAC;IAChE,eAAe,CAAqB;IACpC,cAAc,GAA+B,EAAE,CAAC;IAChD,cAAc,GAAkB,IAAI,CAAC;IAC5B,SAAS,GAAG,IAAI,GAAG,EAGzB,CAAC;IACJ,UAAU,GAAG,KAAK,CAAC;IAEnB,YACE,KAAkC,EAClC,QAAmC;QAEnC,IAAI,CAAC,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,IAAI,SAAS,CAAC;YAChD,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,CAAC;YACjD,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,cAAc,IAAI,SAAS,CAAC;YAC5D,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ;gBACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,6BAA6B;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,IAAgC;QACrC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC;oBAChD,IAAI;oBACJ,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;oBACpC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;oBACxC,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;oBACtC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAClC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;iBACnC,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAC7C,IAAI,CAAC,cAAc,EACnB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAC7C,CAAC;gBACF,yEAAyE;gBACzE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO;wBACzD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;oBAC/C,IACE,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO;wBACvD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CACzB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,CACzD;wBAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACnD,CAAC;gBACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC/B,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,CAAC;gBACjD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACrC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACrC,OAAO;oBACL,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;oBAC3C,UAAU,EAAE,KAAK,CAAC,KAAK;iBACxB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,UAAU;YACjB,iBAAiB,CACf,eAAe,EACf,sCAAsC,CACvC,CAAC;IACN,CAAC;IAED,cAAc,CAAC,OAA8C;QAC3D,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,SAAS,GAAG,4BAA4B,CAC5C,2BAA2B,CACzB;gBACE,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACtB,CAAC,CAAC,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC;oBACtD,CAAC,CAAC,IAAI;gBACR,eAAe,EAAE,IAAI,CAAC,gBAAgB;oBACpC,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,gBAAgB,CAAC;oBACzD,CAAC,CAAC,IAAI;gBACR,cAAc,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;gBAC5C,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CACxC,oCAAoC,CACrC;aACF,EACD,4BAA4B,CAC7B,CACF,CAAC;YACF,OAAO,4BAA4B,CACjC,SAAS,EACT,qCAAqC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CACJ,YAAqC;QAErC,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,gCAAgC,CAAC,YAAY,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;YAChC,IACE,CAAC,QAAQ;gBACT,CAAC,IAAI,CAAC,cAAc;gBACpB,CAAC,oCAAoC,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;gBAEhE,iBAAiB,CACf,oBAAoB,EACpB,sDAAsD,CACvD,CAAC;YACJ,gCAAgC,CAC9B,QAAQ,CAAC,KAAK,EACd,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,eAAe,CACrB,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;YAC/C,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YACnD,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,YAAY,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE;gBAC3C,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;gBACD,UAAU,EAAE;oBACV,WAAW;oBACX,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oCAAoC,CAClD,KAAkC;IAElC,MAAM,QAAQ,GAAG,IAAI,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CACrB,QAA4C;IAE5C,OAAO;QACL,6BAA6B,EAAE,GAAG,EAAE,CAClC,QAAQ,CAAC,6BAA6B,EAAE;QAC1C,MAAM,EAAE,CAAC,IAAgC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACnE,MAAM,EAAE,CAAC,YAAqC,EAAE,EAAE,CAChD,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,cAAc,EAAE,CAAC,OAA8C,EAAE,EAAE,CACjE,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qCAAqC,CACnD,KAAkC,EAClC,QAAgB,EAChB,UAAiD;IAEjD,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,UAAU,GAAgC;YAC9C,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,eAAe,EAAE,UAAU,CAAC,UAAU;YACtC,kBAAkB,EAAE,UAAU,CAAC,UAAU;SAC1C,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,QAAQ,EACR,qCAAqC,CAAC,UAAU,EAAE,UAAU,CAAC,CAC9D,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,8CAA8C,CACxE,OAAO,EACP,UAAU,CACX,CAAC;QACF,OAAO,cAAc,CACnB,IAAI,kCAAkC,CAAC,UAAU,EAAE,aAAa,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalStateExternalAuthority } from \"../principalState\";\nimport { normalizeReferencedPrincipalHead } from \"./accessEvent\";\nimport {\n  normalizeCanonicalJsonValue,\n  serializeKeyingCanonicalJson,\n} from \"./canonical\";\nimport {\n  normalizePrincipalHistoryInput,\n  verifyPrincipalHistoryCheckpoint,\n} from \"./principalPolicyHistoryChecks\";\nimport { appendPrincipalHistoryIndex } from \"./principalPolicyHistoryIndex\";\nimport { verifyPrincipalHistoryPage } from \"./principalPolicyHistoryPage\";\nimport {\n  normalizeAuthenticatedPrincipalHistoryProgress,\n  type PrincipalHistoryProgress,\n} from \"./principalPolicyHistoryProgress\";\nimport {\n  capturePrincipalHistoryAuthority,\n  capturePrincipalHistoryProgressEntry,\n} from \"./principalPolicyHistoryProgressEntry\";\nimport {\n  openPrincipalHistoryProgress,\n  ownPrincipalHistoryProgressProtection,\n  sealPrincipalHistoryProgress,\n} from \"./principalPolicyHistoryProgressProtection\";\nimport {\n  makeVerifiedPrincipalPolicyHistory,\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryPage,\n  type PrincipalPolicyHistoryProgressOptions,\n  type PrincipalPolicyHistoryVerifier,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification, toVerificationResult } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  NormalizedPrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n} from \"./types\";\n\nclass PrincipalPolicyHistoryVerifierImpl\n  implements PrincipalPolicyHistoryVerifier\n{\n  readonly #input: ReturnType<typeof normalizePrincipalHistoryInput>;\n  #previous: NormalizedPrincipalPolicyStateChainEntry | undefined;\n  #latestAuthority: PrincipalStateExternalAuthority | null = null;\n  #checkpointHash: string | undefined;\n  #indexFrontier: readonly (string | null)[] = [];\n  #indexRootHash: string | null = null;\n  readonly #retained = new Map<\n    number,\n    NormalizedPrincipalPolicyStateChainEntry\n  >();\n  #appending = false;\n\n  constructor(\n    input: PrincipalPolicyHistoryInput,\n    progress?: PrincipalHistoryProgress,\n  ) {\n    this.#input = normalizePrincipalHistoryInput(input);\n    if (progress) {\n      this.#previous = progress.previous ?? undefined;\n      this.#latestAuthority = progress.latestAuthority;\n      this.#checkpointHash = progress.checkpointHash ?? undefined;\n      this.#indexFrontier = progress.indexFrontier;\n      this.#indexRootHash = progress.indexRootHash;\n      for (const entry of progress.retained)\n        this.#retained.set(entry.state.version, entry);\n    }\n  }\n\n  getExternalAuthorityReference(): ReferencedPrincipalHead | null {\n    return this.#latestAuthority ? { ...this.#latestAuthority } : null;\n  }\n\n  append(page: PrincipalPolicyHistoryPage) {\n    return runVerifier(async () => {\n      this.#assertIdle();\n      this.#appending = true;\n      try {\n        const verified = await verifyPrincipalHistoryPage({\n          page,\n          principalId: this.#input.principalId,\n          principalType: this.#input.principalType,\n          previous: this.#previous,\n          latestAuthority: this.#latestAuthority,\n          references: this.#input.references,\n          checkpoint: this.#input.checkpoint,\n        });\n        const index = await appendPrincipalHistoryIndex(\n          this.#indexFrontier,\n          verified.entries.map((entry) => entry.state),\n        );\n        // Publish only after every check, including the final signature, passes.\n        for (const entry of verified.entries) {\n          if (entry.state.version === this.#input.checkpoint?.version)\n            this.#checkpointHash = entry.state.stateHash;\n          if (\n            entry.state.version === this.#input.checkpoint?.version ||\n            this.#input.references.some(\n              (reference) => reference.version === entry.state.version,\n            )\n          )\n            this.#retained.set(entry.state.version, entry);\n        }\n        this.#previous = verified.last;\n        this.#latestAuthority = verified.latestAuthority;\n        this.#indexFrontier = index.frontier;\n        this.#indexRootHash = index.rootHash;\n        return {\n          throughVersion: verified.last.state.version,\n          indexNodes: index.nodes,\n        };\n      } finally {\n        this.#appending = false;\n      }\n    });\n  }\n\n  #assertIdle(): void {\n    if (this.#appending)\n      throwVerification(\n        \"invalid_shape\",\n        \"principal history append in progress\",\n      );\n  }\n\n  exportProgress(options: PrincipalPolicyHistoryProgressOptions) {\n    return runVerifier(async () => {\n      this.#assertIdle();\n      // Capture a complete accepted prefix before the first yield. A later\n      // append cannot change this snapshot or publish a partial page into it.\n      const plaintext = serializeKeyingCanonicalJson(\n        normalizeCanonicalJsonValue(\n          {\n            previous: this.#previous\n              ? capturePrincipalHistoryProgressEntry(this.#previous)\n              : null,\n            latestAuthority: this.#latestAuthority\n              ? capturePrincipalHistoryAuthority(this.#latestAuthority)\n              : null,\n            checkpointHash: this.#checkpointHash ?? null,\n            indexFrontier: this.#indexFrontier,\n            retained: [...this.#retained.values()].map(\n              capturePrincipalHistoryProgressEntry,\n            ),\n          },\n          \"principal history progress\",\n        ),\n      );\n      return sealPrincipalHistoryProgress(\n        plaintext,\n        ownPrincipalHistoryProgressProtection(this.#input, options),\n      );\n    });\n  }\n\n  finish(\n    expectedHead: ReferencedPrincipalHead,\n  ): KeyingVerificationResult<VerifiedPrincipalPolicyHistory> {\n    try {\n      this.#assertIdle();\n      const reference = normalizeReferencedPrincipalHead(expectedHead);\n      const previous = this.#previous;\n      if (\n        !previous ||\n        !this.#indexRootHash ||\n        !principalPolicyStateMatchesReference(previous.state, reference)\n      )\n        throwVerification(\n          \"missing_dependency\",\n          \"principal history has not reached the requested head\",\n        );\n      verifyPrincipalHistoryCheckpoint(\n        previous.state,\n        this.#input.checkpoint,\n        this.#checkpointHash,\n      );\n      const history = new Map(this.#retained);\n      history.set(previous.state.version, previous);\n      const { state, projection, grants } = previous;\n      const { principalId, principalType } = this.#input;\n      const owned = structuredClone({\n        indexRootHash: this.#indexRootHash,\n        currentEntry: { state, projection, grants },\n        retainedEntries: [...history.values()].sort(\n          (left, right) => left.state.version - right.state.version,\n        ),\n        checkpoint: {\n          principalId,\n          principalType,\n          version: state.version,\n          stateHash: state.stateHash,\n        },\n      });\n      return { ok: true, value: makeVerifiedPrincipalPolicyHistory(owned) };\n    } catch (error) {\n      return toVerificationResult(error);\n    }\n  }\n}\n\n/**\n * Verify from genesis with bounded retained state. A rejected page cannot\n * advance authorization or continuity. Progress is local to this verifier;\n * a remote cursor/checkpoint is never accepted as verified history.\n * Callers bound serialized page bytes and authenticate external authority.\n * Throws KeyingVerificationError for invalid local scope, checkpoint or references.\n */\nexport function createPrincipalPolicyHistoryVerifier(\n  input: PrincipalPolicyHistoryInput,\n): PrincipalPolicyHistoryVerifier {\n  const verifier = new PrincipalPolicyHistoryVerifierImpl(input);\n  return publicVerifier(verifier);\n}\n\nfunction publicVerifier(\n  verifier: PrincipalPolicyHistoryVerifierImpl,\n): PrincipalPolicyHistoryVerifier {\n  return {\n    getExternalAuthorityReference: () =>\n      verifier.getExternalAuthorityReference(),\n    append: (page: PrincipalPolicyHistoryPage) => verifier.append(page),\n    finish: (expectedHead: ReferencedPrincipalHead) =>\n      verifier.finish(expectedHead),\n    exportProgress: (options: PrincipalPolicyHistoryProgressOptions) =>\n      verifier.exportProgress(options),\n  };\n}\n\n/** Restore only progress authenticated by this verifier's own local key. */\nexport function restorePrincipalPolicyHistoryVerifier(\n  input: PrincipalPolicyHistoryInput,\n  progress: string,\n  protection: PrincipalPolicyHistoryProgressOptions,\n): Promise<KeyingVerificationResult<PrincipalPolicyHistoryVerifier>> {\n  return runVerifier(async () => {\n    const normalized = normalizePrincipalHistoryInput(input);\n    const ownedInput: PrincipalPolicyHistoryInput = {\n      principalId: normalized.principalId,\n      principalType: normalized.principalType,\n      localCheckpoint: normalized.checkpoint,\n      retainedReferences: normalized.references,\n    };\n    const decoded = await openPrincipalHistoryProgress(\n      progress,\n      ownPrincipalHistoryProgressProtection(normalized, protection),\n    );\n    const authenticated = await normalizeAuthenticatedPrincipalHistoryProgress(\n      decoded,\n      normalized,\n    );\n    return publicVerifier(\n      new PrincipalPolicyHistoryVerifierImpl(ownedInput, authenticated),\n    );\n  });\n}\n"]}
+{"version":3,"file":"principalPolicyHistory.js","sourceRoot":"","sources":["principalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,8CAA8C,GAE/C,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,4BAA4B,EAC5B,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,kCAAkC,GAMnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAOhF,MAAM,kCAAkC;IAG7B,MAAM,CAAoD;IACnE,SAAS,CAAuD;IAChE,gBAAgB,GAA2C,IAAI,CAAC;IAChE,eAAe,CAAqB;IACpC,cAAc,GAA+B,EAAE,CAAC;IAChD,cAAc,GAAkB,IAAI,CAAC;IAC5B,SAAS,GAAG,IAAI,GAAG,EAGzB,CAAC;IACJ,UAAU,GAAG,KAAK,CAAC;IAEnB,YACE,KAAkC,EAClC,QAAmC;QAEnC,IAAI,CAAC,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,IAAI,SAAS,CAAC;YAChD,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,CAAC;YACjD,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,cAAc,IAAI,SAAS,CAAC;YAC5D,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ;gBACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,6BAA6B;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,IAAgC;QACrC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC;oBAChD,IAAI;oBACJ,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;oBACpC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;oBACxC,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;oBACtC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAClC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;iBACnC,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAC7C,IAAI,CAAC,cAAc,EACnB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAC7C,CAAC;gBACF,yEAAyE;gBACzE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO;wBACzD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;oBAC/C,IACE,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO;wBACvD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CACzB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,CACzD;wBAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACnD,CAAC;gBACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC/B,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,eAAe,CAAC;gBACjD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACrC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACrC,OAAO;oBACL,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;oBAC3C,UAAU,EAAE,KAAK,CAAC,KAAK;iBACxB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,UAAU;YACjB,iBAAiB,CACf,eAAe,EACf,sCAAsC,CACvC,CAAC;IACN,CAAC;IAED,cAAc,CAAC,OAA8C;QAC3D,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,SAAS,GAAG,4BAA4B,CAC5C,2BAA2B,CACzB;gBACE,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACtB,CAAC,CAAC,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC;oBACtD,CAAC,CAAC,IAAI;gBACR,eAAe,EAAE,IAAI,CAAC,gBAAgB;oBACpC,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,gBAAgB,CAAC;oBACzD,CAAC,CAAC,IAAI;gBACR,cAAc,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;gBAC5C,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CACxC,oCAAoC,CACrC;aACF,EACD,4BAA4B,CAC7B,CACF,CAAC;YACF,OAAO,4BAA4B,CACjC,SAAS,EACT,qCAAqC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CACJ,YAAqC;QAErC,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,gCAAgC,CAAC,YAAY,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;YAChC,IACE,CAAC,QAAQ;gBACT,CAAC,IAAI,CAAC,cAAc;gBACpB,CAAC,oCAAoC,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;gBAEhE,iBAAiB,CACf,oBAAoB,EACpB,sDAAsD,CACvD,CAAC;YACJ,gCAAgC,CAC9B,QAAQ,CAAC,KAAK,EACd,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,eAAe,CACrB,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;YAC/C,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YACnD,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,YAAY,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE;gBAC3C,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;gBACD,UAAU,EAAE;oBACV,WAAW;oBACX,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,kCAAkC,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC;aACxE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oCAAoC,CAClD,KAAkC;IAElC,MAAM,QAAQ,GAAG,IAAI,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CACrB,QAA4C;IAE5C,OAAO;QACL,6BAA6B,EAAE,GAAG,EAAE,CAClC,QAAQ,CAAC,6BAA6B,EAAE;QAC1C,MAAM,EAAE,CAAC,IAAgC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACnE,MAAM,EAAE,CAAC,YAAqC,EAAE,EAAE,CAChD,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,cAAc,EAAE,CAAC,OAA8C,EAAE,EAAE,CACjE,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qCAAqC,CACnD,KAAkC,EAClC,QAAgB,EAChB,UAAiD;IAEjD,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,UAAU,GAAgC;YAC9C,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,eAAe,EAAE,UAAU,CAAC,UAAU;YACtC,kBAAkB,EAAE,UAAU,CAAC,UAAU;SAC1C,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,QAAQ,EACR,qCAAqC,CAAC,UAAU,EAAE,UAAU,CAAC,CAC9D,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,8CAA8C,CACxE,OAAO,EACP,UAAU,CACX,CAAC;QACF,OAAO,cAAc,CACnB,IAAI,kCAAkC,CAAC,UAAU,EAAE,aAAa,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalStateExternalAuthority } from \"../principalState\";\nimport { normalizeReferencedPrincipalHead } from \"./accessEvent\";\nimport {\n  normalizeCanonicalJsonValue,\n  serializeKeyingCanonicalJson,\n} from \"./canonical\";\nimport {\n  normalizePrincipalHistoryInput,\n  verifyPrincipalHistoryCheckpoint,\n} from \"./principalPolicyHistoryChecks\";\nimport { appendPrincipalHistoryIndex } from \"./principalPolicyHistoryIndex\";\nimport { verifyPrincipalHistoryPage } from \"./principalPolicyHistoryPage\";\nimport {\n  normalizeAuthenticatedPrincipalHistoryProgress,\n  type PrincipalHistoryProgress,\n} from \"./principalPolicyHistoryProgress\";\nimport {\n  capturePrincipalHistoryAuthority,\n  capturePrincipalHistoryProgressEntry,\n} from \"./principalPolicyHistoryProgressEntry\";\nimport {\n  openPrincipalHistoryProgress,\n  ownPrincipalHistoryProgressProtection,\n  sealPrincipalHistoryProgress,\n} from \"./principalPolicyHistoryProgressProtection\";\nimport {\n  makeVerifiedPrincipalPolicyHistory,\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryPage,\n  type PrincipalPolicyHistoryProgressOptions,\n  type PrincipalPolicyHistoryVerifier,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification, toVerificationResult } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  NormalizedPrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n} from \"./types\";\n\nclass PrincipalPolicyHistoryVerifierImpl\n  implements PrincipalPolicyHistoryVerifier\n{\n  readonly #input: ReturnType<typeof normalizePrincipalHistoryInput>;\n  #previous: NormalizedPrincipalPolicyStateChainEntry | undefined;\n  #latestAuthority: PrincipalStateExternalAuthority | null = null;\n  #checkpointHash: string | undefined;\n  #indexFrontier: readonly (string | null)[] = [];\n  #indexRootHash: string | null = null;\n  readonly #retained = new Map<\n    number,\n    NormalizedPrincipalPolicyStateChainEntry\n  >();\n  #appending = false;\n\n  constructor(\n    input: PrincipalPolicyHistoryInput,\n    progress?: PrincipalHistoryProgress,\n  ) {\n    this.#input = normalizePrincipalHistoryInput(input);\n    if (progress) {\n      this.#previous = progress.previous ?? undefined;\n      this.#latestAuthority = progress.latestAuthority;\n      this.#checkpointHash = progress.checkpointHash ?? undefined;\n      this.#indexFrontier = progress.indexFrontier;\n      this.#indexRootHash = progress.indexRootHash;\n      for (const entry of progress.retained)\n        this.#retained.set(entry.state.version, entry);\n    }\n  }\n\n  getExternalAuthorityReference(): ReferencedPrincipalHead | null {\n    return this.#latestAuthority ? { ...this.#latestAuthority } : null;\n  }\n\n  append(page: PrincipalPolicyHistoryPage) {\n    return runVerifier(async () => {\n      this.#assertIdle();\n      this.#appending = true;\n      try {\n        const verified = await verifyPrincipalHistoryPage({\n          page,\n          principalId: this.#input.principalId,\n          principalType: this.#input.principalType,\n          previous: this.#previous,\n          latestAuthority: this.#latestAuthority,\n          references: this.#input.references,\n          checkpoint: this.#input.checkpoint,\n        });\n        const index = await appendPrincipalHistoryIndex(\n          this.#indexFrontier,\n          verified.entries.map((entry) => entry.state),\n        );\n        // Publish only after every check, including the final signature, passes.\n        for (const entry of verified.entries) {\n          if (entry.state.version === this.#input.checkpoint?.version)\n            this.#checkpointHash = entry.state.stateHash;\n          if (\n            entry.state.version === this.#input.checkpoint?.version ||\n            this.#input.references.some(\n              (reference) => reference.version === entry.state.version,\n            )\n          )\n            this.#retained.set(entry.state.version, entry);\n        }\n        this.#previous = verified.last;\n        this.#latestAuthority = verified.latestAuthority;\n        this.#indexFrontier = index.frontier;\n        this.#indexRootHash = index.rootHash;\n        return {\n          throughVersion: verified.last.state.version,\n          indexNodes: index.nodes,\n        };\n      } finally {\n        this.#appending = false;\n      }\n    });\n  }\n\n  #assertIdle(): void {\n    if (this.#appending)\n      throwVerification(\n        \"invalid_shape\",\n        \"principal history append in progress\",\n      );\n  }\n\n  exportProgress(options: PrincipalPolicyHistoryProgressOptions) {\n    return runVerifier(async () => {\n      this.#assertIdle();\n      // Capture a complete accepted prefix before the first yield. A later\n      // append cannot change this snapshot or publish a partial page into it.\n      const plaintext = serializeKeyingCanonicalJson(\n        normalizeCanonicalJsonValue(\n          {\n            previous: this.#previous\n              ? capturePrincipalHistoryProgressEntry(this.#previous)\n              : null,\n            latestAuthority: this.#latestAuthority\n              ? capturePrincipalHistoryAuthority(this.#latestAuthority)\n              : null,\n            checkpointHash: this.#checkpointHash ?? null,\n            indexFrontier: this.#indexFrontier,\n            retained: [...this.#retained.values()].map(\n              capturePrincipalHistoryProgressEntry,\n            ),\n          },\n          \"principal history progress\",\n        ),\n      );\n      return sealPrincipalHistoryProgress(\n        plaintext,\n        ownPrincipalHistoryProgressProtection(this.#input, options),\n      );\n    });\n  }\n\n  finish(\n    expectedHead: ReferencedPrincipalHead,\n  ): KeyingVerificationResult<VerifiedPrincipalPolicyHistory> {\n    try {\n      this.#assertIdle();\n      const reference = normalizeReferencedPrincipalHead(expectedHead);\n      const previous = this.#previous;\n      if (\n        !previous ||\n        !this.#indexRootHash ||\n        !principalPolicyStateMatchesReference(previous.state, reference)\n      )\n        throwVerification(\n          \"missing_dependency\",\n          \"principal history has not reached the requested head\",\n        );\n      verifyPrincipalHistoryCheckpoint(\n        previous.state,\n        this.#input.checkpoint,\n        this.#checkpointHash,\n      );\n      const history = new Map(this.#retained);\n      history.set(previous.state.version, previous);\n      const { state, projection, grants } = previous;\n      const { principalId, principalType } = this.#input;\n      const owned = structuredClone({\n        indexRootHash: this.#indexRootHash,\n        currentEntry: { state, projection, grants },\n        retainedEntries: [...history.values()].sort(\n          (left, right) => left.state.version - right.state.version,\n        ),\n        checkpoint: {\n          principalId,\n          principalType,\n          version: state.version,\n          stateHash: state.stateHash,\n        },\n      });\n      return {\n        ok: true,\n        value: makeVerifiedPrincipalPolicyHistory(owned, this.#latestAuthority),\n      };\n    } catch (error) {\n      return toVerificationResult(error);\n    }\n  }\n}\n\n/**\n * Verify from genesis with bounded retained state. A rejected page cannot\n * advance authorization or continuity. Progress is local to this verifier;\n * a remote cursor/checkpoint is never accepted as verified history.\n * Callers bound serialized page bytes and authenticate external authority.\n * Throws KeyingVerificationError for invalid local scope, checkpoint or references.\n */\nexport function createPrincipalPolicyHistoryVerifier(\n  input: PrincipalPolicyHistoryInput,\n): PrincipalPolicyHistoryVerifier {\n  const verifier = new PrincipalPolicyHistoryVerifierImpl(input);\n  return publicVerifier(verifier);\n}\n\nfunction publicVerifier(\n  verifier: PrincipalPolicyHistoryVerifierImpl,\n): PrincipalPolicyHistoryVerifier {\n  return {\n    getExternalAuthorityReference: () =>\n      verifier.getExternalAuthorityReference(),\n    append: (page: PrincipalPolicyHistoryPage) => verifier.append(page),\n    finish: (expectedHead: ReferencedPrincipalHead) =>\n      verifier.finish(expectedHead),\n    exportProgress: (options: PrincipalPolicyHistoryProgressOptions) =>\n      verifier.exportProgress(options),\n  };\n}\n\n/** Restore only progress authenticated by this verifier's own local key. */\nexport function restorePrincipalPolicyHistoryVerifier(\n  input: PrincipalPolicyHistoryInput,\n  progress: string,\n  protection: PrincipalPolicyHistoryProgressOptions,\n): Promise<KeyingVerificationResult<PrincipalPolicyHistoryVerifier>> {\n  return runVerifier(async () => {\n    const normalized = normalizePrincipalHistoryInput(input);\n    const ownedInput: PrincipalPolicyHistoryInput = {\n      principalId: normalized.principalId,\n      principalType: normalized.principalType,\n      localCheckpoint: normalized.checkpoint,\n      retainedReferences: normalized.references,\n    };\n    const decoded = await openPrincipalHistoryProgress(\n      progress,\n      ownPrincipalHistoryProgressProtection(normalized, protection),\n    );\n    const authenticated = await normalizeAuthenticatedPrincipalHistoryProgress(\n      decoded,\n      normalized,\n    );\n    return publicVerifier(\n      new PrincipalPolicyHistoryVerifierImpl(ownedInput, authenticated),\n    );\n  });\n}\n"]}

package/internal/crypto/keying/principalPolicyHistoryReferences.js

@@ -75,7 +75,7 @@ export function verifyPrincipalPolicyHistoryReferences(input) {
         return makeVerifiedPrincipalPolicyHistory({
             ...history,
             retainedEntries: [...entries.values()].sort((left, right) => left.state.version - right.state.version),
-        });
+        }, history.latestAuthority);
     });
 }
 //# sourceMappingURL=principalPolicyHistoryReferences.js.map

package/internal/crypto/keying/principalPolicyHistoryReferences.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyHistoryReferences.js","sourceRoot":"","sources":["principalPolicyHistoryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,GAEnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAe9B,SAAS,iBAAiB,CACxB,UAA2D;IAE3D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,MAAM,GAAG,kCAAkC;QAEtD,iBAAiB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAC1C,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;QAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,kBAAkB,KAAK,SAAS;YAClC,iBAAiB,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACvD,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG;YACZ,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW;YACnD,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa;SACxD,CAAC;QACF,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,iBAAiB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAChC,8BAA8B,CAAC;gBAC7B,GAAG,KAAK;gBACR,kBAAkB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;aAC3C,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,QAAQ;gBAC9B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC;gBAE3C,iBAAiB,CACf,iBAAiB,EACjB,4CAA4C,CAC7C,CAAC;YACJ,MAAM,2BAA2B,CAAC;gBAChC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;gBACtD,UAAU,EAAE;oBACV,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,OAAO,CAAC,aAAa;oBAC/B,QAAQ;iBACT;gBACD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,kCAAkC,CAAC;YACxC,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalHistoryIndexLeaf } from \"./principalPolicyHistoryIndex\";\nimport {\n  makeVerifiedPrincipalPolicyHistory,\n  ownVerifiedPrincipalPolicyHistory,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport {\n  assertTransparencyInclusion,\n  normalizeTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n  TransparencyInclusionProof,\n} from \"./types\";\n\n/** Untrusted material to select an entry from a locally verified prefix. */\nexport interface PrincipalPolicyHistoryReferenceProof {\n  readonly reference: ReferencedPrincipalHead;\n  readonly entry: PrincipalPolicyStateChainEntry;\n  readonly proof: TransparencyInclusionProof;\n}\n\nfunction assertProofBudget(\n  references: readonly PrincipalPolicyHistoryReferenceProof[],\n): void {\n  if (\n    !Array.isArray(references) ||\n    references.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throwVerification(\"invalid_shape\", \"too many principal history proofs\");\n  const count = references.length;\n  for (let index = 0; index < count; index += 1) {\n    const path = references[index]?.proof.auditPath;\n    if (!Array.isArray(path) || path.length > 53)\n      throwVerification(\n        \"invalid_shape\",\n        \"principal history proof exceeds its budget\",\n      );\n  }\n}\n\n/**\n * Select new retained references without replaying signatures. Inclusion is\n * checked against the private root owned by a local verifier, never a peer's\n * claimed root. Each leaf commits to the exact signed entry already accepted.\n * Replaces the retained selection; the current entry is always included.\n * A separate checkpoint proof preserves the full 128-citation selection budget.\n */\nexport function verifyPrincipalPolicyHistoryReferences(input: {\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly references: readonly PrincipalPolicyHistoryReferenceProof[];\n  readonly checkpointReference?:\n    | PrincipalPolicyHistoryReferenceProof\n    | undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>> {\n  return runVerifier(async () => {\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const supplied = input.references;\n    const suppliedCheckpoint = input.checkpointReference;\n    assertProofBudget(supplied);\n    if (suppliedCheckpoint !== undefined)\n      assertProofBudget([suppliedCheckpoint]);\n    const references = structuredClone(supplied);\n    const checkpoint = structuredClone(suppliedCheckpoint);\n    assertProofBudget(references);\n    const scope = {\n      principalId: history.currentEntry.state.principalId,\n      principalType: history.currentEntry.state.principalType,\n    };\n    normalizePrincipalHistoryInput({\n      ...scope,\n      retainedReferences: references.map((item) => item.reference),\n    });\n    const selected = [...references];\n    if (checkpoint !== undefined) {\n      assertProofBudget([checkpoint]);\n      normalizePrincipalHistoryInput({\n        ...scope,\n        retainedReferences: [checkpoint.reference],\n      });\n      selected.push(checkpoint);\n    }\n    const entries = new Map<number, PrincipalPolicyStateChainEntry>();\n    const treeSize = history.currentEntry.state.version;\n    for (const item of selected) {\n      const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);\n      const proof = normalizeTransparencyInclusionProof(item.proof);\n      if (\n        !principalPolicyStateMatchesReference(entry.state, item.reference) ||\n        entry.state.version > treeSize ||\n        proof.leafIndex !== entry.state.version - 1\n      )\n        throwVerification(\n          \"object_mismatch\",\n          \"principal history proof reference mismatch\",\n        );\n      await assertTransparencyInclusion({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        checkpoint: {\n          logId: \"principal-history\",\n          rootHash: history.indexRootHash,\n          treeSize,\n        },\n        proof,\n      });\n      entries.set(entry.state.version, entry);\n    }\n    entries.set(treeSize, history.currentEntry);\n    return makeVerifiedPrincipalPolicyHistory({\n      ...history,\n      retainedEntries: [...entries.values()].sort(\n        (left, right) => left.state.version - right.state.version,\n      ),\n    });\n  });\n}\n"]}
+{"version":3,"file":"principalPolicyHistoryReferences.js","sourceRoot":"","sources":["principalPolicyHistoryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,GAEnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAe9B,SAAS,iBAAiB,CACxB,UAA2D;IAE3D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,MAAM,GAAG,kCAAkC;QAEtD,iBAAiB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAC1C,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;QAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,kBAAkB,KAAK,SAAS;YAClC,iBAAiB,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACvD,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG;YACZ,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW;YACnD,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa;SACxD,CAAC;QACF,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,iBAAiB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAChC,8BAA8B,CAAC;gBAC7B,GAAG,KAAK;gBACR,kBAAkB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;aAC3C,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,QAAQ;gBAC9B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC;gBAE3C,iBAAiB,CACf,iBAAiB,EACjB,4CAA4C,CAC7C,CAAC;YACJ,MAAM,2BAA2B,CAAC;gBAChC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;gBACtD,UAAU,EAAE;oBACV,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,OAAO,CAAC,aAAa;oBAC/B,QAAQ;iBACT;gBACD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,kCAAkC,CACvC;YACE,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalHistoryIndexLeaf } from \"./principalPolicyHistoryIndex\";\nimport {\n  makeVerifiedPrincipalPolicyHistory,\n  ownVerifiedPrincipalPolicyHistory,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport {\n  assertTransparencyInclusion,\n  normalizeTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n  TransparencyInclusionProof,\n} from \"./types\";\n\n/** Untrusted material to select an entry from a locally verified prefix. */\nexport interface PrincipalPolicyHistoryReferenceProof {\n  readonly reference: ReferencedPrincipalHead;\n  readonly entry: PrincipalPolicyStateChainEntry;\n  readonly proof: TransparencyInclusionProof;\n}\n\nfunction assertProofBudget(\n  references: readonly PrincipalPolicyHistoryReferenceProof[],\n): void {\n  if (\n    !Array.isArray(references) ||\n    references.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throwVerification(\"invalid_shape\", \"too many principal history proofs\");\n  const count = references.length;\n  for (let index = 0; index < count; index += 1) {\n    const path = references[index]?.proof.auditPath;\n    if (!Array.isArray(path) || path.length > 53)\n      throwVerification(\n        \"invalid_shape\",\n        \"principal history proof exceeds its budget\",\n      );\n  }\n}\n\n/**\n * Select new retained references without replaying signatures. Inclusion is\n * checked against the private root owned by a local verifier, never a peer's\n * claimed root. Each leaf commits to the exact signed entry already accepted.\n * Replaces the retained selection; the current entry is always included.\n * A separate checkpoint proof preserves the full 128-citation selection budget.\n */\nexport function verifyPrincipalPolicyHistoryReferences(input: {\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly references: readonly PrincipalPolicyHistoryReferenceProof[];\n  readonly checkpointReference?:\n    | PrincipalPolicyHistoryReferenceProof\n    | undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>> {\n  return runVerifier(async () => {\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const supplied = input.references;\n    const suppliedCheckpoint = input.checkpointReference;\n    assertProofBudget(supplied);\n    if (suppliedCheckpoint !== undefined)\n      assertProofBudget([suppliedCheckpoint]);\n    const references = structuredClone(supplied);\n    const checkpoint = structuredClone(suppliedCheckpoint);\n    assertProofBudget(references);\n    const scope = {\n      principalId: history.currentEntry.state.principalId,\n      principalType: history.currentEntry.state.principalType,\n    };\n    normalizePrincipalHistoryInput({\n      ...scope,\n      retainedReferences: references.map((item) => item.reference),\n    });\n    const selected = [...references];\n    if (checkpoint !== undefined) {\n      assertProofBudget([checkpoint]);\n      normalizePrincipalHistoryInput({\n        ...scope,\n        retainedReferences: [checkpoint.reference],\n      });\n      selected.push(checkpoint);\n    }\n    const entries = new Map<number, PrincipalPolicyStateChainEntry>();\n    const treeSize = history.currentEntry.state.version;\n    for (const item of selected) {\n      const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);\n      const proof = normalizeTransparencyInclusionProof(item.proof);\n      if (\n        !principalPolicyStateMatchesReference(entry.state, item.reference) ||\n        entry.state.version > treeSize ||\n        proof.leafIndex !== entry.state.version - 1\n      )\n        throwVerification(\n          \"object_mismatch\",\n          \"principal history proof reference mismatch\",\n        );\n      await assertTransparencyInclusion({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        checkpoint: {\n          logId: \"principal-history\",\n          rootHash: history.indexRootHash,\n          treeSize,\n        },\n        proof,\n      });\n      entries.set(entry.state.version, entry);\n    }\n    entries.set(treeSize, history.currentEntry);\n    return makeVerifiedPrincipalPolicyHistory(\n      {\n        ...history,\n        retainedEntries: [...entries.values()].sort(\n          (left, right) => left.state.version - right.state.version,\n        ),\n      },\n      history.latestAuthority,\n    );\n  });\n}\n"]}

package/internal/crypto/keying/principalPolicyHistoryTypes.d.ts

@@ -1,3 +1,4 @@
+import type { PrincipalStateExternalAuthority } from "../principalState.js";
 import type { PrincipalPolicyExternalAuthority } from "./principalPolicyExternalAuthorityTypes.js";
 import type { PrincipalHistoryIndexNode } from "./principalPolicyHistoryIndex.js";
 import type { KeyingVerificationResult, PrincipalPolicyCheckpoint, PrincipalPolicySignerPublicKey, PrincipalPolicyStateChainEntry, ReferencedPrincipalHead } from "./types.js";
@@ -32,8 +33,10 @@ export interface VerifiedPrincipalPolicyHistory {
     /** Computed only from locally accepted entries; never supplied by a peer. */
     readonly indexRootHash: string;
 }
-type HistorySnapshot = Omit<VerifiedPrincipalPolicyHistory, typeof verifiedHistoryBrand>;
-export declare function makeVerifiedPrincipalPolicyHistory(value: Omit<VerifiedPrincipalPolicyHistory, typeof verifiedHistoryBrand>): VerifiedPrincipalPolicyHistory;
+type HistorySnapshot = Omit<VerifiedPrincipalPolicyHistory, typeof verifiedHistoryBrand> & {
+    readonly latestAuthority: PrincipalStateExternalAuthority | null;
+};
+export declare function makeVerifiedPrincipalPolicyHistory(value: Omit<VerifiedPrincipalPolicyHistory, typeof verifiedHistoryBrand>, latestAuthority: PrincipalStateExternalAuthority | null): VerifiedPrincipalPolicyHistory;
 export declare function ownVerifiedPrincipalPolicyHistory(history: VerifiedPrincipalPolicyHistory): HistorySnapshot;
 export interface PrincipalPolicyHistoryVerifier {
     /** Owned copy of the latest accepted citation, including across uncited pages. */

package/internal/crypto/keying/principalPolicyHistoryTypes.js

@@ -4,12 +4,15 @@ const verifiedHistoryBrand = Symbol("verifiedPrincipalPolicyHistory");
 // Public copies are useful for inspection, but their fields are not authority.
 // A later verifier consumes the privately held snapshot issued by finish().
 const issuedHistories = new WeakMap();
-export function makeVerifiedPrincipalPolicyHistory(value) {
+export function makeVerifiedPrincipalPolicyHistory(value, latestAuthority) {
     const result = {
-        ...value,
+        currentEntry: value.currentEntry,
+        retainedEntries: value.retainedEntries,
+        checkpoint: value.checkpoint,
+        indexRootHash: value.indexRootHash,
         [verifiedHistoryBrand]: true,
     };
-    issuedHistories.set(result, structuredClone(value));
+    issuedHistories.set(result, structuredClone({ ...value, latestAuthority }));
     return result;
 }
 export function ownVerifiedPrincipalPolicyHistory(history) {

package/internal/crypto/keying/principalPolicyHistoryTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyHistoryTypes.js","sourceRoot":"","sources":["principalPolicyHistoryTypes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAS7C,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAyBtD,MAAM,oBAAoB,GAAkB,MAAM,CAChD,gCAAgC,CACjC,CAAC;AAiBF,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,OAAO,EAGhC,CAAC;AAEJ,MAAM,UAAU,kCAAkC,CAChD,KAAwE;IAExE,MAAM,MAAM,GAAmC;QAC7C,GAAG,KAAK;QACR,CAAC,oBAAoB,CAAC,EAAE,IAAI;KAC7B,CAAC;IACF,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAAuC;IAEvC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QACX,iBAAiB,CACf,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { PrincipalPolicyExternalAuthority } from \"./principalPolicyExternalAuthorityTypes\";\nimport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nimport { throwVerification } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicySignerPublicKey,\n  PrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n} from \"./types\";\n\nexport const PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT = 128;\n\n/** A crypto verification batch, not a wire-response DTO. */\nexport interface PrincipalPolicyHistoryPage {\n  readonly entries: readonly PrincipalPolicyStateChainEntry[];\n  /** Keys resolved through the caller's trusted user-identity mechanism. */\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  /** Already authenticated authority; never trust a server page directly. */\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority;\n}\n\nexport interface PrincipalPolicyHistoryInput {\n  readonly principalId: string;\n  readonly principalType: ReferencedPrincipalHead[\"principalType\"];\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly retainedReferences?: readonly ReferencedPrincipalHead[];\n}\n\n/** Local verifier protection; never obtain this key from a remote API. */\nexport interface PrincipalPolicyHistoryProgressOptions {\n  readonly localKey: Uint8Array;\n  /** Stable local operation identity, bound into authenticated progress. */\n  readonly context: string;\n}\n\nconst verifiedHistoryBrand: unique symbol = Symbol(\n  \"verifiedPrincipalPolicyHistory\",\n);\n\n/** A verified prefix with explicitly retained references, not a full snapshot. */\nexport interface VerifiedPrincipalPolicyHistory {\n  readonly [verifiedHistoryBrand]: true;\n  readonly currentEntry: PrincipalPolicyStateChainEntry;\n  readonly retainedEntries: readonly PrincipalPolicyStateChainEntry[];\n  readonly checkpoint: PrincipalPolicyCheckpoint;\n  /** Computed only from locally accepted entries; never supplied by a peer. */\n  readonly indexRootHash: string;\n}\n\ntype HistorySnapshot = Omit<\n  VerifiedPrincipalPolicyHistory,\n  typeof verifiedHistoryBrand\n>;\n\n// Public copies are useful for inspection, but their fields are not authority.\n// A later verifier consumes the privately held snapshot issued by finish().\nconst issuedHistories = new WeakMap<\n  VerifiedPrincipalPolicyHistory,\n  HistorySnapshot\n>();\n\nexport function makeVerifiedPrincipalPolicyHistory(\n  value: Omit<VerifiedPrincipalPolicyHistory, typeof verifiedHistoryBrand>,\n): VerifiedPrincipalPolicyHistory {\n  const result: VerifiedPrincipalPolicyHistory = {\n    ...value,\n    [verifiedHistoryBrand]: true,\n  };\n  issuedHistories.set(result, structuredClone(value));\n  return result;\n}\n\nexport function ownVerifiedPrincipalPolicyHistory(\n  history: VerifiedPrincipalPolicyHistory,\n): HistorySnapshot {\n  const snapshot = issuedHistories.get(history);\n  if (!snapshot)\n    throwVerification(\n      \"invalid_shape\",\n      \"principal history must come from a local verifier\",\n    );\n  return structuredClone(snapshot);\n}\n\nexport interface PrincipalPolicyHistoryVerifier {\n  /** Owned copy of the latest accepted citation, including across uncited pages. */\n  getExternalAuthorityReference(): ReferencedPrincipalHead | null;\n  append(page: PrincipalPolicyHistoryPage): Promise<\n    KeyingVerificationResult<{\n      readonly throughVersion: number;\n      readonly indexNodes: readonly PrincipalHistoryIndexNode[];\n    }>\n  >;\n  finish(\n    expectedHead: ReferencedPrincipalHead,\n  ): KeyingVerificationResult<VerifiedPrincipalPolicyHistory>;\n  exportProgress(\n    options: PrincipalPolicyHistoryProgressOptions,\n  ): Promise<KeyingVerificationResult<string>>;\n}\n"]}
+{"version":3,"file":"principalPolicyHistoryTypes.js","sourceRoot":"","sources":["principalPolicyHistoryTypes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAS7C,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAyBtD,MAAM,oBAAoB,GAAkB,MAAM,CAChD,gCAAgC,CACjC,CAAC;AAiBF,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,OAAO,EAGhC,CAAC;AAEJ,MAAM,UAAU,kCAAkC,CAChD,KAAwE,EACxE,eAAuD;IAEvD,MAAM,MAAM,GAAmC;QAC7C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,CAAC,oBAAoB,CAAC,EAAE,IAAI;KAC7B,CAAC;IACF,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAAuC;IAEvC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QACX,iBAAiB,CACf,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { PrincipalStateExternalAuthority } from \"../principalState\";\nimport type { PrincipalPolicyExternalAuthority } from \"./principalPolicyExternalAuthorityTypes\";\nimport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nimport { throwVerification } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicySignerPublicKey,\n  PrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n} from \"./types\";\n\nexport const PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT = 128;\n\n/** A crypto verification batch, not a wire-response DTO. */\nexport interface PrincipalPolicyHistoryPage {\n  readonly entries: readonly PrincipalPolicyStateChainEntry[];\n  /** Keys resolved through the caller's trusted user-identity mechanism. */\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  /** Already authenticated authority; never trust a server page directly. */\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority;\n}\n\nexport interface PrincipalPolicyHistoryInput {\n  readonly principalId: string;\n  readonly principalType: ReferencedPrincipalHead[\"principalType\"];\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly retainedReferences?: readonly ReferencedPrincipalHead[];\n}\n\n/** Local verifier protection; never obtain this key from a remote API. */\nexport interface PrincipalPolicyHistoryProgressOptions {\n  readonly localKey: Uint8Array;\n  /** Stable local operation identity, bound into authenticated progress. */\n  readonly context: string;\n}\n\nconst verifiedHistoryBrand: unique symbol = Symbol(\n  \"verifiedPrincipalPolicyHistory\",\n);\n\n/** A verified prefix with explicitly retained references, not a full snapshot. */\nexport interface VerifiedPrincipalPolicyHistory {\n  readonly [verifiedHistoryBrand]: true;\n  readonly currentEntry: PrincipalPolicyStateChainEntry;\n  readonly retainedEntries: readonly PrincipalPolicyStateChainEntry[];\n  readonly checkpoint: PrincipalPolicyCheckpoint;\n  /** Computed only from locally accepted entries; never supplied by a peer. */\n  readonly indexRootHash: string;\n}\n\ntype HistorySnapshot = Omit<\n  VerifiedPrincipalPolicyHistory,\n  typeof verifiedHistoryBrand\n> & { readonly latestAuthority: PrincipalStateExternalAuthority | null };\n\n// Public copies are useful for inspection, but their fields are not authority.\n// A later verifier consumes the privately held snapshot issued by finish().\nconst issuedHistories = new WeakMap<\n  VerifiedPrincipalPolicyHistory,\n  HistorySnapshot\n>();\n\nexport function makeVerifiedPrincipalPolicyHistory(\n  value: Omit<VerifiedPrincipalPolicyHistory, typeof verifiedHistoryBrand>,\n  latestAuthority: PrincipalStateExternalAuthority | null,\n): VerifiedPrincipalPolicyHistory {\n  const result: VerifiedPrincipalPolicyHistory = {\n    currentEntry: value.currentEntry,\n    retainedEntries: value.retainedEntries,\n    checkpoint: value.checkpoint,\n    indexRootHash: value.indexRootHash,\n    [verifiedHistoryBrand]: true,\n  };\n  issuedHistories.set(result, structuredClone({ ...value, latestAuthority }));\n  return result;\n}\n\nexport function ownVerifiedPrincipalPolicyHistory(\n  history: VerifiedPrincipalPolicyHistory,\n): HistorySnapshot {\n  const snapshot = issuedHistories.get(history);\n  if (!snapshot)\n    throwVerification(\n      \"invalid_shape\",\n      \"principal history must come from a local verifier\",\n    );\n  return structuredClone(snapshot);\n}\n\nexport interface PrincipalPolicyHistoryVerifier {\n  /** Owned copy of the latest accepted citation, including across uncited pages. */\n  getExternalAuthorityReference(): ReferencedPrincipalHead | null;\n  append(page: PrincipalPolicyHistoryPage): Promise<\n    KeyingVerificationResult<{\n      readonly throughVersion: number;\n      readonly indexNodes: readonly PrincipalHistoryIndexNode[];\n    }>\n  >;\n  finish(\n    expectedHead: ReferencedPrincipalHead,\n  ): KeyingVerificationResult<VerifiedPrincipalPolicyHistory>;\n  exportProgress(\n    options: PrincipalPolicyHistoryProgressOptions,\n  ): Promise<KeyingVerificationResult<string>>;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/containers/child/carriedDescendantRekeys.js

@@ -2,6 +2,7 @@ import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../internal/validators/util
 import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification.js";
 import { buildMaterializedContainerRekeyPlan } from "./rekey.js";
 import { rebaseContainerWriterProjection } from "./rekeyProjection.js";
+import { selectReplacementPrincipalPolicyReferences } from "./replacementPrincipalPolicyReferences.js";
 /**
  * Re-root a served projection on the deepest not-yet-accepted proper ancestor
  * among `speculativePaths`. Each carried plan's own path was built the same
@@ -67,7 +68,14 @@ export async function planCarriedDescendantRekey(input) {
         persistVerificationCheckpoints: false,
         previousProjection: rebased.projection,
         principalPolicyCache: input.principalPolicyCache,
-        replacementPrincipalPolicy: input.replacementPrincipalPolicy,
+        replacementPrincipalPolicy: input.replacementPrincipalPolicy
+            ? await selectReplacementPrincipalPolicyReferences({
+                policy: input.replacementPrincipalPolicy,
+                projection: rebased.projection,
+                principalPolicyCache: input.principalPolicyCache,
+                resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,
+            })
+            : undefined,
         resolveProjectionUserKey: input.resolveProjectionUserKey,
         stillCurrent: input.stillCurrent,
         targetSecretKey: input.targetSecretKey,