@tearleads/client-sdk 0.1.18 → 0.1.20

package/data/keyingProjectionVerification/types.d.ts

@@ -6,6 +6,8 @@ export type ProjectionUserKey = TrustedUserIdentity;
 export type ProjectionUserKeyResolver = (userId: string) => Promise<ProjectionUserKey | null>;
 export type PrincipalPolicyCache = Map<string, PrincipalPolicyCurrentEvidence>;
 export interface PrincipalPolicyResolveRequest {
+    /** Reuse authenticated local ancestry before an authorized online recovery. */
+    readonly preferLocalHistory?: boolean | undefined;
     /** Identity of one projection collection, never caller-supplied evidence. */
     readonly recoveryBatch?: object | undefined;
     readonly organizationId: string;
@@ -29,6 +31,8 @@ export interface PrincipalPolicyBundleCacheRequest {
     readonly stillCurrent?: (() => boolean) | undefined;
 }
 export interface ProjectionPolicyHistoryResolveRequest {
+    /** Authenticate terminal evidence first; its consumer must validate durable currency. */
+    readonly historicalProof?: boolean | undefined;
     readonly organizationId: string;
     readonly evidence: ProjectionPolicyEvidenceResponse;
     readonly references: readonly ReferencedPrincipalHead[];

package/data/keyingProjectionVerification/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AA+EA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,kCAAkC,GACtC,IAAI,oCAAoC,EAAE,CAAC;AAE7C,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,OAAO,KAAK,KAAK,kCAAkC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAAc;IACnE,IAAI,sCAAsC,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,SAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,YAAyC;IAEzC,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,kCAAkC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAmD,EACnD,YAAyC;IAEzC,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC5C,MAAM,KAAK,GACT,CAAC,SAA0C,EAAE,EAAE,CAC/C,KAAK,EAAE,KAA2C,EAAE,EAAE;QACpD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,CAAC;IACJ,MAAM,qBAAqB,GAAG,CAC5B,SAA0C,EACT,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,gBAAgB,CAAC;QAC3C,MAAM,wBAAwB,GAAG,SAAS,CAAC,wBAAwB,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;YAC5B,GAAG,CAAC,wBAAwB;gBAC1B,CAAC,CAAC;oBACE,wBAAwB,EAAE,KAAK,EAC7B,KAA4C,EAC5C,EAAE;wBACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;wBACrD,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;4BAC5C,GAAG,KAAK;4BACR,YAAY,EAAE,OAAO;yBACtB,CAAC,CAAC;wBACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,gBAAgB,EAAE,KAAK,EAAE,KAAoC,EAAE,EAAE;wBAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;wBACrD,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;wBAClE,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,YAAY;gBACxB,CAAC,CAAC;oBACE,YAAY,EAAE,KAAK,EAAE,KAAwC,EAAE,EAAE;wBAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;wBAClD,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;wBAC3D,mCAAmC,CAAC,YAAY,CAAC,CAAC;oBACpD,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAO/C,KAAY;IACZ,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,sCAAsC,CACrE,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyCurrent,\n  VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { TrustedUserIdentity } from \"../trustedUserIdentity\";\n\nexport type ProjectionUserKey = TrustedUserIdentity;\n\nexport type ProjectionUserKeyResolver = (\n  userId: string,\n) => Promise<ProjectionUserKey | null>;\n\nexport type PrincipalPolicyCache = Map<string, PrincipalPolicyCurrentEvidence>;\n\nexport interface PrincipalPolicyResolveRequest {\n  /** Identity of one projection collection, never caller-supplied evidence. */\n  readonly recoveryBatch?: object | undefined;\n  readonly organizationId: string;\n  readonly reference: ReferencedPrincipalHead;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ResolvedPrincipalPolicyEvidence {\n  readonly stillCurrent: () => boolean;\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n}\n\nexport interface ReferencedPrincipalPolicyWarmRequest {\n  readonly organizationId: string;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface PrincipalPolicyBundleCacheRequest {\n  readonly bundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ProjectionPolicyHistoryResolveRequest {\n  readonly organizationId: string;\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ResolvedProjectionPolicyHistory {\n  readonly policies: readonly VerifiedPrincipalPolicySelection[];\n  readonly stillCurrent: () => boolean;\n}\n\nexport type PrincipalPolicyBundleCacher = (\n  input: PrincipalPolicyBundleCacheRequest,\n) => Promise<void>;\n\nexport type ReferencedPrincipalPolicyWarmer = ((\n  input: ReferencedPrincipalPolicyWarmRequest,\n) => Promise<void>) & {\n  readonly cacheBundles?: PrincipalPolicyBundleCacher | undefined;\n  readonly resolveProjectionHistory?:\n    | ((\n        input: ProjectionPolicyHistoryResolveRequest,\n      ) => Promise<ResolvedProjectionPolicyHistory>)\n    | undefined;\n  readonly resolveReference?:\n    | ((\n        input: PrincipalPolicyResolveRequest,\n      ) => Promise<ResolvedPrincipalPolicyEvidence>)\n    | undefined;\n};\n\nexport class ProjectionVerificationCancelledError extends Error {\n  constructor() {\n    super(\"Projection verification generation expired\");\n    this.name = \"ProjectionVerificationCancelledError\";\n  }\n}\n\nconst projectionVerificationCancellation =\n  new ProjectionVerificationCancelledError();\n\nexport function isProjectionVerificationCancelledError(\n  error: unknown,\n): error is ProjectionVerificationCancelledError {\n  return error === projectionVerificationCancellation;\n}\n\nexport function rethrowProjectionVerificationCancelled(error: unknown): void {\n  if (isProjectionVerificationCancelledError(error)) throw error;\n}\n\nexport async function nullOnProjectionVerificationCancellation<T>(\n  operation: () => Promise<T>,\n): Promise<T | null> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (isProjectionVerificationCancelledError(error)) return null;\n    throw error;\n  }\n}\n\nexport function assertProjectionVerificationCurrent(\n  stillCurrent: (() => boolean) | undefined,\n): void {\n  if (stillCurrent?.() === false) {\n    throw projectionVerificationCancellation;\n  }\n}\n\nexport function generationGuardedPrincipalPolicyWarmer(\n  warmer: ReferencedPrincipalPolicyWarmer | undefined,\n  stillCurrent: (() => boolean) | undefined,\n): ReferencedPrincipalPolicyWarmer | undefined {\n  if (!warmer || !stillCurrent) return warmer;\n  const guard =\n    (operation: ReferencedPrincipalPolicyWarmer) =>\n    async (input: ReferencedPrincipalPolicyWarmRequest) => {\n      assertProjectionVerificationCurrent(stillCurrent);\n      await operation({ ...input, stillCurrent });\n      assertProjectionVerificationCurrent(stillCurrent);\n    };\n  const guardWithCapabilities = (\n    operation: ReferencedPrincipalPolicyWarmer,\n  ): ReferencedPrincipalPolicyWarmer => {\n    const guarded = guard(operation);\n    const resolve = operation.resolveReference;\n    const resolveProjectionHistory = operation.resolveProjectionHistory;\n    return Object.assign(guarded, {\n      ...(resolveProjectionHistory\n        ? {\n            resolveProjectionHistory: async (\n              input: ProjectionPolicyHistoryResolveRequest,\n            ) => {\n              const current = () =>\n                stillCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(current);\n              const result = await resolveProjectionHistory({\n                ...input,\n                stillCurrent: current,\n              });\n              assertProjectionVerificationCurrent(current);\n              return result;\n            },\n          }\n        : {}),\n      ...(resolve\n        ? {\n            resolveReference: async (input: PrincipalPolicyResolveRequest) => {\n              const current = () =>\n                stillCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(current);\n              const result = await resolve({ ...input, stillCurrent: current });\n              assertProjectionVerificationCurrent(current);\n              return result;\n            },\n          }\n        : {}),\n      ...(operation.cacheBundles\n        ? {\n            cacheBundles: async (input: PrincipalPolicyBundleCacheRequest) => {\n              assertProjectionVerificationCurrent(stillCurrent);\n              await operation.cacheBundles?.({ ...input, stillCurrent });\n              assertProjectionVerificationCurrent(stillCurrent);\n            },\n          }\n        : {}),\n    });\n  };\n  return guardWithCapabilities(warmer);\n}\n\nexport function withGenerationGuardedPolicyWarmer<\n  Input extends {\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  },\n>(input: Input): Input {\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    ),\n  };\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"AAmFA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,kCAAkC,GACtC,IAAI,oCAAoC,EAAE,CAAC;AAE7C,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,OAAO,KAAK,KAAK,kCAAkC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAAc;IACnE,IAAI,sCAAsC,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,SAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,YAAyC;IAEzC,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,kCAAkC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAmD,EACnD,YAAyC;IAEzC,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC5C,MAAM,KAAK,GACT,CAAC,SAA0C,EAAE,EAAE,CAC/C,KAAK,EAAE,KAA2C,EAAE,EAAE;QACpD,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,CAAC;IACJ,MAAM,qBAAqB,GAAG,CAC5B,SAA0C,EACT,EAAE;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,gBAAgB,CAAC;QAC3C,MAAM,wBAAwB,GAAG,SAAS,CAAC,wBAAwB,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;YAC5B,GAAG,CAAC,wBAAwB;gBAC1B,CAAC,CAAC;oBACE,wBAAwB,EAAE,KAAK,EAC7B,KAA4C,EAC5C,EAAE;wBACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;wBACrD,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;4BAC5C,GAAG,KAAK;4BACR,YAAY,EAAE,OAAO;yBACtB,CAAC,CAAC;wBACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,gBAAgB,EAAE,KAAK,EAAE,KAAoC,EAAE,EAAE;wBAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;wBACrD,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;wBAClE,mCAAmC,CAAC,OAAO,CAAC,CAAC;wBAC7C,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,YAAY;gBACxB,CAAC,CAAC;oBACE,YAAY,EAAE,KAAK,EAAE,KAAwC,EAAE,EAAE;wBAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;wBAClD,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;wBAC3D,mCAAmC,CAAC,YAAY,CAAC,CAAC;oBACpD,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAO/C,KAAY;IACZ,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,sCAAsC,CACrE,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyCurrent,\n  VerifiedPrincipalPolicySelection,\n} from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../principals/principalPolicyEvidence\";\nimport type { TrustedUserIdentity } from \"../trustedUserIdentity\";\n\nexport type ProjectionUserKey = TrustedUserIdentity;\n\nexport type ProjectionUserKeyResolver = (\n  userId: string,\n) => Promise<ProjectionUserKey | null>;\n\nexport type PrincipalPolicyCache = Map<string, PrincipalPolicyCurrentEvidence>;\n\nexport interface PrincipalPolicyResolveRequest {\n  /** Reuse authenticated local ancestry before an authorized online recovery. */\n  readonly preferLocalHistory?: boolean | undefined;\n  /** Identity of one projection collection, never caller-supplied evidence. */\n  readonly recoveryBatch?: object | undefined;\n  readonly organizationId: string;\n  readonly reference: ReferencedPrincipalHead;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ResolvedPrincipalPolicyEvidence {\n  readonly stillCurrent: () => boolean;\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n}\n\nexport interface ReferencedPrincipalPolicyWarmRequest {\n  readonly organizationId: string;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface PrincipalPolicyBundleCacheRequest {\n  readonly bundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ProjectionPolicyHistoryResolveRequest {\n  /** Authenticate terminal evidence first; its consumer must validate durable currency. */\n  readonly historicalProof?: boolean | undefined;\n  readonly organizationId: string;\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface ResolvedProjectionPolicyHistory {\n  readonly policies: readonly VerifiedPrincipalPolicySelection[];\n  readonly stillCurrent: () => boolean;\n}\n\nexport type PrincipalPolicyBundleCacher = (\n  input: PrincipalPolicyBundleCacheRequest,\n) => Promise<void>;\n\nexport type ReferencedPrincipalPolicyWarmer = ((\n  input: ReferencedPrincipalPolicyWarmRequest,\n) => Promise<void>) & {\n  readonly cacheBundles?: PrincipalPolicyBundleCacher | undefined;\n  readonly resolveProjectionHistory?:\n    | ((\n        input: ProjectionPolicyHistoryResolveRequest,\n      ) => Promise<ResolvedProjectionPolicyHistory>)\n    | undefined;\n  readonly resolveReference?:\n    | ((\n        input: PrincipalPolicyResolveRequest,\n      ) => Promise<ResolvedPrincipalPolicyEvidence>)\n    | undefined;\n};\n\nexport class ProjectionVerificationCancelledError extends Error {\n  constructor() {\n    super(\"Projection verification generation expired\");\n    this.name = \"ProjectionVerificationCancelledError\";\n  }\n}\n\nconst projectionVerificationCancellation =\n  new ProjectionVerificationCancelledError();\n\nexport function isProjectionVerificationCancelledError(\n  error: unknown,\n): error is ProjectionVerificationCancelledError {\n  return error === projectionVerificationCancellation;\n}\n\nexport function rethrowProjectionVerificationCancelled(error: unknown): void {\n  if (isProjectionVerificationCancelledError(error)) throw error;\n}\n\nexport async function nullOnProjectionVerificationCancellation<T>(\n  operation: () => Promise<T>,\n): Promise<T | null> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (isProjectionVerificationCancelledError(error)) return null;\n    throw error;\n  }\n}\n\nexport function assertProjectionVerificationCurrent(\n  stillCurrent: (() => boolean) | undefined,\n): void {\n  if (stillCurrent?.() === false) {\n    throw projectionVerificationCancellation;\n  }\n}\n\nexport function generationGuardedPrincipalPolicyWarmer(\n  warmer: ReferencedPrincipalPolicyWarmer | undefined,\n  stillCurrent: (() => boolean) | undefined,\n): ReferencedPrincipalPolicyWarmer | undefined {\n  if (!warmer || !stillCurrent) return warmer;\n  const guard =\n    (operation: ReferencedPrincipalPolicyWarmer) =>\n    async (input: ReferencedPrincipalPolicyWarmRequest) => {\n      assertProjectionVerificationCurrent(stillCurrent);\n      await operation({ ...input, stillCurrent });\n      assertProjectionVerificationCurrent(stillCurrent);\n    };\n  const guardWithCapabilities = (\n    operation: ReferencedPrincipalPolicyWarmer,\n  ): ReferencedPrincipalPolicyWarmer => {\n    const guarded = guard(operation);\n    const resolve = operation.resolveReference;\n    const resolveProjectionHistory = operation.resolveProjectionHistory;\n    return Object.assign(guarded, {\n      ...(resolveProjectionHistory\n        ? {\n            resolveProjectionHistory: async (\n              input: ProjectionPolicyHistoryResolveRequest,\n            ) => {\n              const current = () =>\n                stillCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(current);\n              const result = await resolveProjectionHistory({\n                ...input,\n                stillCurrent: current,\n              });\n              assertProjectionVerificationCurrent(current);\n              return result;\n            },\n          }\n        : {}),\n      ...(resolve\n        ? {\n            resolveReference: async (input: PrincipalPolicyResolveRequest) => {\n              const current = () =>\n                stillCurrent() && input.stillCurrent?.() !== false;\n              assertProjectionVerificationCurrent(current);\n              const result = await resolve({ ...input, stillCurrent: current });\n              assertProjectionVerificationCurrent(current);\n              return result;\n            },\n          }\n        : {}),\n      ...(operation.cacheBundles\n        ? {\n            cacheBundles: async (input: PrincipalPolicyBundleCacheRequest) => {\n              assertProjectionVerificationCurrent(stillCurrent);\n              await operation.cacheBundles?.({ ...input, stillCurrent });\n              assertProjectionVerificationCurrent(stillCurrent);\n            },\n          }\n        : {}),\n    });\n  };\n  return guardWithCapabilities(warmer);\n}\n\nexport function withGenerationGuardedPolicyWarmer<\n  Input extends {\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  },\n>(input: Input): Input {\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    ),\n  };\n}\n"]}

package/data/persistence/container-contents/documentMoveIntentPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentMoveIntentPersistence.js","sourceRoot":"","sources":["documentMoveIntentPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAEL,eAAe,EACf,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,MAAM,+BAA+B,GAAG;IACtC,yBAAyB;IACzB,yBAAyB;CAC1B,CAAC;AAEF,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,oEAAoE;AACpE,6EAA6E;AAC7E,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,8BAA8B,GAAG;;;;EAIrC,CAAC;AAEH,MAAM,oCAAoC,GAAG;;;;;;yDAMY,CAAC;AAuD1D,SAAS,iCAAiC,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAIlC;IACC,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,aAAa,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,2BAA2B,CAClC,GAAqC;IAErC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EACR,GAAG,CAAC,UAAU,KAAK,yBAAyB;YAC1C,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,yBAAyB;QAC/B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,UAAU,EAAE,iCAAiC,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IAED,iBAAiB,EAAE,yBAAyB;IAC5C,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAEhD,KAAK,CAAC,sBAAsB,CAC1B,OAAgB;QAEhB,OAAO,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YAC/D,MAAM,eAAe,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC,aAAa,CAAC,CAAC,WAAW,CACjE,KAAK,EAAE,EAAE,EAAE,EAAE;gBACX,MAAM,IAAI,GAAG,MAAM,EAAE;qBAClB,MAAM,EAAE;qBACR,IAAI,CAAC,mBAAmB,CAAC;oBAC1B,kEAAkE;oBAClE,qEAAqE;oBACrE,uEAAuE;oBACvE,qEAAqE;oBACrE,2DAA2D;oBAC3D,wEAAwE;oBACxE,mEAAmE;oBACnE,uEAAuE;qBACtE,KAAK,CACJ,GAAG,CACD,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAC/D,OAAO,CACL,mBAAmB,CAAC,UAAU,EAC9B,+BAA+B,CAChC,CACF,CACF;qBACA,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;gBAE/C,OAAO,OAAO,CAAC,GAAG,CAChB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACrB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,aAAa,EACb,GAAG,CAAC,EAAE,IAAI,EAAE,CACb,CAAC;oBACF,MAAM,KAAK,GAAG,OAAO;yBAClB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC;yBAC/C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;yBACnC,IAAI,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,OAAO;yBACpB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;yBACjD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;yBACnC,IAAI,EAAE,CAAC;oBACV,OAAO;wBACL,GAAG,2BAA2B,CAAC,GAAG,CAAC;wBACnC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC9D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChE,CAAC;gBACJ,CAAC,CAAC,CACH,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAgB,EAChB,KAIC;QAED,OAAO,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YAC/D,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC;;;;aAIK,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;sBACjC,EACd;gBACE,KAAK,CAAC,UAAU;gBAChB,GAAG,+BAA+B;gBAClC,KAAK,CAAC,iBAAiB;gBACvB,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CACF,CAAC;YACF,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,iCAAiC,CAAC,aAAa,CAAC;qBACnD,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC;qBACpC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;qBACzD,GAAG,EAAE,CAAC;YACX,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,OAAgB,EAChB,KA2BC;QAED,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CACjE,KAAK,EAAE,EAAE,EAAE,EAAE;YACX,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,EAAE;iBACL,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,GAAG,CAAC;gBACH,eAAe,EAAE,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,OAAO;gBACxB,UAAU,EAAE,yBAAyB,CAAC,KAAK,CAAC;gBAC5C,SAAS;aACV,CAAC;iBACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;YACpD,4DAA4D;YAC5D,8DAA8D;YAC9D,kDAAkD;YAClD,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE;gBACtC,SAAS;gBACT,SAAS;gBACT,QAAQ;aACT,CAAC,EACF,OAAO,CACL,mBAAmB,CAAC,UAAU,EAC9B,+BAA+B,CAChC,EACD,GAAG,CAAC,KAAK,CAAC,gBAAgB;gBACxB,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACtD,CAAC,CAAC,EAAE,CAAC,EACP,GAAG,CAAC,KAAK,CAAC,iBAAiB;gBACzB,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC9D,CAAC,CAAC,EAAE,CAAC,CACR,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC,EACD,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAClC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAgB,EAChB,KAAmC;QAEnC,MAAM,gCAAgC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,eAAe,CAAC,OAAO,EAAE;YAC7B,GAAG,wBAAwB;YAC3B,GAAG,eAAe;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB;;SAEG,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE;;;WAG/D,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,8BAA8B,WAAW,8BAA8B,WAAW,CAAC,CAAC,CAAC,EAAE;eACnH,EACT,KAAK,EAAE,cAAc;YACnB,CAAC,CAAC,CAAC,GAAG,+BAA+B,EAAE,KAAK,CAAC,cAAc,CAAC;YAC5D,CAAC,CAAC,+BAA+B,CACpC,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAAgB,EAChB,KAAqD;QAErD,MAAM,gCAAgC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,eAAe,CAAC,OAAO,EAAE;YAC7B,GAAG,wBAAwB;YAC3B,GAAG,eAAe;SACnB,CAAC,CAAC;QACH,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YAC9D,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,aAAa,CACjB;;;;aAIK,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;aAExC,KAAK,EAAE,cAAc;gBACnB,CAAC,CAAC;;sBAEK,oCAAoC;4BAC9B,8BAA8B;2BAC/B,8BAA8B;oBACrC;gBACL,CAAC,CAAC,EACjB,EAAE,EACM;gBACE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACxB,GAAG,+BAA+B;gBAClC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC","sourcesContent":["import { and, asc, eq, inArray } from \"drizzle-orm\";\nimport { documentIntentLinkTargets } from \"../../sqlite/documentPlacementIntentSchema\";\nimport {\n  containerTables,\n  documentMoveIntents,\n  documentMoveIntentTables,\n  documentProjectionTables,\n} from \"../../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport {\n  type ExecSql,\n  ensureSqlTables,\n  runSerializedSqlMutation,\n} from \"../../sqlite/sqlSchema\";\nimport {\n  enqueueDocumentLinkIntent,\n  enqueueDocumentMoveIntent,\n  enqueueDocumentUnlinkIntent,\n  loadDocumentIntentLinkTargets,\n} from \"./documentPlacementIntentEnqueue\";\n\nexport const DOCUMENT_MOVE_INTENT_TYPE = \"document.move\";\nexport const DOCUMENT_LINK_INTENT_TYPE = \"document.link\";\nconst DOCUMENT_PLACEMENT_INTENT_TYPES = [\n  DOCUMENT_MOVE_INTENT_TYPE,\n  DOCUMENT_LINK_INTENT_TYPE,\n];\n\n// Resolves the organization a parked move belongs to, in confidence order:\n// the move's target container, the document's preserved projection\n// attribution, then the container the document currently sits in. Normal\n// saves routinely leave projection attribution empty (deferred-tail\n// reporting resolves through the same container join), so the container rows\n// carry the common case; rows with no resolvable organization stay in every\n// scope (device-first shapes, matching orphan priming).\nconst DENIED_INTENT_ORGANIZATION_SQL = `COALESCE(\n  NULLIF(target_container.organization_id, ''),\n  NULLIF(projection.organization_id, ''),\n  NULLIF(projection_container.organization_id, '')\n)`;\n\nconst DENIED_INTENT_ORGANIZATION_JOINS_SQL = `\n  LEFT JOIN containers target_container\n    ON target_container.id = intent.target_container_id\n  LEFT JOIN document_projection projection\n    ON projection.local_id = intent.local_id\n  LEFT JOIN containers projection_container\n    ON projection_container.id = projection.container_id`;\n\n/**\n * - `pending`: replays on every structural pass.\n * - `blocked`: the last pass could not proceed locally (missing local\n *   document / destination); replays, since hydration can heal it.\n * - `denied`: parked on a 403 until the access-restored replay (row 7).\n * - `unavailable`: terminal — after a projection refresh the destination\n *   itself is proven deleted (coded 404 on its own projection probe). No\n *   mutation 409 is ever terminal: with the destination live it can only\n *   name an ancestor or source, and the next pass's fresh paths outrun it.\n *   Container ids never return, so no replay can commit the intent as\n *   written; it leaves the replay set until the local container tombstone\n *   cascade retargets it or the user re-enqueues the move.\n */\nexport type DocumentMoveIntentSyncStatus =\n  | \"pending\"\n  | \"blocked\"\n  | \"denied\"\n  | \"unavailable\";\n\nexport interface DocumentMoveIntentRecord {\n  additionalLinkContainerIds?: readonly string[] | undefined;\n  removedLinkContainerIds?: readonly string[] | undefined;\n  id: string;\n  documentId: string;\n  intentType:\n    | typeof DOCUMENT_MOVE_INTENT_TYPE\n    | typeof DOCUMENT_LINK_INTENT_TYPE;\n  lastAttemptedAt: string | null;\n  lastError: string | null;\n  localId: string;\n  replaceLinkedContainers: boolean;\n  sourceContainerId: string | null;\n  syncStatus: DocumentMoveIntentSyncStatus;\n  targetContainerId: string;\n  createdAt: string;\n  updatedAt: string;\n}\n\ninterface SelectedDocumentMoveIntentRecord {\n  id: string | null;\n  documentId: string;\n  intentType: string;\n  lastAttemptedAt: string | null;\n  lastError: string | null;\n  localId: string;\n  replaceLinkedContainers: boolean;\n  sourceContainerId: string | null;\n  syncStatus: string;\n  targetContainerId: string;\n  createdAt: string;\n  updatedAt: string;\n}\n\nfunction parseDocumentMoveIntentSyncStatus(\n  value: unknown,\n): DocumentMoveIntentSyncStatus {\n  if (value === \"blocked\" || value === \"denied\" || value === \"unavailable\") {\n    return value;\n  }\n  return \"pending\";\n}\n\nfunction resolveRecordedSyncStatus(input: {\n  blocked?: boolean | undefined;\n  denied?: boolean | undefined;\n  unavailable?: boolean | undefined;\n}): DocumentMoveIntentSyncStatus {\n  if (input.unavailable) return \"unavailable\";\n  if (input.denied) return \"denied\";\n  return input.blocked ? \"blocked\" : \"pending\";\n}\n\nfunction mapDocumentMoveIntentRecord(\n  row: SelectedDocumentMoveIntentRecord,\n): DocumentMoveIntentRecord {\n  return {\n    id: String(row.id ?? \"\"),\n    documentId: row.documentId,\n    intentType:\n      row.intentType === DOCUMENT_LINK_INTENT_TYPE\n        ? DOCUMENT_LINK_INTENT_TYPE\n        : DOCUMENT_MOVE_INTENT_TYPE,\n    lastAttemptedAt: row.lastAttemptedAt,\n    lastError: row.lastError,\n    localId: row.localId,\n    replaceLinkedContainers: Boolean(row.replaceLinkedContainers),\n    sourceContainerId: row.sourceContainerId,\n    syncStatus: parseDocumentMoveIntentSyncStatus(row.syncStatus),\n    targetContainerId: row.targetContainerId,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport const sqlDocumentMoveIntentPersistence = {\n  async ensureSchema(execSql: ExecSql): Promise<void> {\n    await ensureSqlTables(execSql, documentMoveIntentTables);\n  },\n\n  enqueueMoveIntent: enqueueDocumentMoveIntent,\n  enqueueLinkIntent: enqueueDocumentLinkIntent,\n  enqueueUnlinkIntent: enqueueDocumentUnlinkIntent,\n\n  async listPendingMoveIntents(\n    execSql: ExecSql,\n  ): Promise<DocumentMoveIntentRecord[]> {\n    return runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n      await ensureSqlTables(lockedExecSql, documentMoveIntentTables);\n      return getClientSQLitePersistenceRuntime(lockedExecSql).transaction(\n        async (tx) => {\n          const rows = await tx\n            .select()\n            .from(documentMoveIntents)\n            // Blocked intents replay too: \"blocked\" names the reason the last\n            // attempt could not proceed (missing local doc / destination), not a\n            // terminal verdict. The blocking condition can heal after hydration or\n            // recovery, and re-checking is cheap — a still-blocked intent simply\n            // re-records its reason without counting as lane progress.\n            // Unavailable intents never replay: the server proved a cited container\n            // is gone, so every replay would re-issue the same doomed requests\n            // (#2278 #4). Only the tombstone cascade or a re-enqueue revives them.\n            .where(\n              and(\n                inArray(documentMoveIntents.syncStatus, [\"pending\", \"blocked\"]),\n                inArray(\n                  documentMoveIntents.intentType,\n                  DOCUMENT_PLACEMENT_INTENT_TYPES,\n                ),\n              ),\n            )\n            .orderBy(asc(documentMoveIntents.createdAt));\n\n          return Promise.all(\n            rows.map(async (row) => {\n              const targets = await loadDocumentIntentLinkTargets(\n                lockedExecSql,\n                row.id ?? \"\",\n              );\n              const added = targets\n                .filter((target) => target.operation === \"link\")\n                .map((target) => target.containerId)\n                .sort();\n              const removed = targets\n                .filter((target) => target.operation === \"unlink\")\n                .map((target) => target.containerId)\n                .sort();\n              return {\n                ...mapDocumentMoveIntentRecord(row),\n                ...(added.length ? { additionalLinkContainerIds: added } : {}),\n                ...(removed.length ? { removedLinkContainerIds: removed } : {}),\n              };\n            }),\n          );\n        },\n      );\n    });\n  },\n\n  async markMoveIntentSynced(\n    execSql: ExecSql,\n    input: {\n      documentId: string;\n      expectedIntentId?: string | undefined;\n      expectedUpdatedAt: string;\n    },\n  ): Promise<boolean> {\n    return runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n      const deleted = await lockedExecSql(\n        `DELETE FROM document_move_intents\n         WHERE document_id = ?\n           AND intent_type IN (?, ?)\n           AND updated_at = ?\n           ${input.expectedIntentId ? \"AND id = ?\" : \"\"}\n         RETURNING id`,\n        [\n          input.documentId,\n          ...DOCUMENT_PLACEMENT_INTENT_TYPES,\n          input.expectedUpdatedAt,\n          ...(input.expectedIntentId ? [input.expectedIntentId] : []),\n        ],\n      );\n      for (const { id } of deleted) {\n        await getClientSQLitePersistenceRuntime(lockedExecSql)\n          .db.delete(documentIntentLinkTargets)\n          .where(eq(documentIntentLinkTargets.intentId, String(id)))\n          .run();\n      }\n      return deleted.length > 0;\n    });\n  },\n\n  async recordMoveIntentError(\n    execSql: ExecSql,\n    input: {\n      blocked?: boolean | undefined;\n      /**\n       * A permission denial (403): the intent parks as `denied` — excluded\n       * from routine structural replays — until the org-access-restored\n       * signal or a manual retry flips it back to pending (edge-case row 7).\n       */\n      denied?: boolean | undefined;\n      documentId: string;\n      /** Exact intent revision read by the pass; preferred over wall-clock CAS. */\n      expectedIntentId?: string | undefined;\n      /**\n       * Optimistic concurrency: when given, the error only records against\n       * the intent revision the pass read — a re-enqueued move (new\n       * updatedAt) is never parked by a stale in-flight failure.\n       */\n      expectedUpdatedAt?: string | undefined;\n      message: string;\n      stillCurrent?: (() => boolean) | undefined;\n      /**\n       * Server proof that a cited container was deleted (coded 404 or\n       * `container_unavailable` 409): the intent parks terminally as\n       * `unavailable`, outside every replay, until the tombstone cascade\n       * retargets it or a re-enqueue replaces it. Outranks `denied`: a\n       * restored permission cannot revive a deleted container.\n       */\n      unavailable?: boolean | undefined;\n    },\n  ): Promise<void> {\n    await getClientSQLitePersistenceRuntime(execSql).guardedTransaction(\n      async (db) => {\n        const updatedAt = new Date().toISOString();\n        await db\n          .update(documentMoveIntents)\n          .set({\n            lastAttemptedAt: updatedAt,\n            lastError: input.message,\n            syncStatus: resolveRecordedSyncStatus(input),\n            updatedAt,\n          })\n          .where(\n            and(\n              eq(documentMoveIntents.documentId, input.documentId),\n              // Blocked/denied rows must stay updatable: a retried intent\n              // records its fresh outcome, and a transient failure flips it\n              // back to pending instead of freezing it forever.\n              inArray(documentMoveIntents.syncStatus, [\n                \"pending\",\n                \"blocked\",\n                \"denied\",\n              ]),\n              inArray(\n                documentMoveIntents.intentType,\n                DOCUMENT_PLACEMENT_INTENT_TYPES,\n              ),\n              ...(input.expectedIntentId\n                ? [eq(documentMoveIntents.id, input.expectedIntentId)]\n                : []),\n              ...(input.expectedUpdatedAt\n                ? [eq(documentMoveIntents.updatedAt, input.expectedUpdatedAt)]\n                : []),\n            ),\n          )\n          .run();\n      },\n      input.stillCurrent ?? (() => true),\n      { behavior: \"immediate\" },\n    );\n  },\n  /**\n   * Evidence for the org-access-restored re-arm gate: a parked\n   * permission-denied move proves a queued write was refused.\n   */\n  async hasDeniedMoveIntents(\n    execSql: ExecSql,\n    input?: { organizationId?: string },\n  ): Promise<boolean> {\n    await sqlDocumentMoveIntentPersistence.ensureSchema(execSql);\n    await ensureSqlTables(execSql, [\n      ...documentProjectionTables,\n      ...containerTables,\n    ]);\n    const rows = await execSql(\n      `SELECT intent.document_id AS document_id\n       FROM document_move_intents intent\n       ${input?.organizationId ? DENIED_INTENT_ORGANIZATION_JOINS_SQL : \"\"}\n       WHERE intent.sync_status = 'denied'\n         AND intent.intent_type IN (?, ?)\n         ${input?.organizationId ? `AND (${DENIED_INTENT_ORGANIZATION_SQL} = ? OR ${DENIED_INTENT_ORGANIZATION_SQL} IS NULL)` : \"\"}\n       LIMIT 1`,\n      input?.organizationId\n        ? [...DOCUMENT_PLACEMENT_INTENT_TYPES, input.organizationId]\n        : DOCUMENT_PLACEMENT_INTENT_TYPES,\n    );\n    return rows.length > 0;\n  },\n  /**\n   * Flip parked permission-denied moves back to pending so the re-armed\n   * structural pass replays them (access restored, or a manual retry scoped\n   * to one document).\n   */\n  async resetDeniedMoveIntents(\n    execSql: ExecSql,\n    input?: { localId?: string; organizationId?: string },\n  ): Promise<void> {\n    await sqlDocumentMoveIntentPersistence.ensureSchema(execSql);\n    await ensureSqlTables(execSql, [\n      ...documentProjectionTables,\n      ...containerTables,\n    ]);\n    await runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n      // Organization scoping resolves each intent's organization through the\n      // container joins above: restoring one organization's access must not\n      // un-park moves that another organization still denies. Rows with no\n      // resolvable organization are included (device-first shapes).\n      await lockedExecSql(\n        `UPDATE document_move_intents\n         SET sync_status = 'pending', updated_at = ?\n         WHERE sync_status = 'denied'\n           AND intent_type IN (?, ?)\n           ${input?.localId ? \"AND local_id = ?\" : \"\"}\n           ${\n             input?.organizationId\n               ? `AND local_id IN (\n                    SELECT intent.local_id FROM document_move_intents intent\n                    ${DENIED_INTENT_ORGANIZATION_JOINS_SQL}\n                    WHERE ${DENIED_INTENT_ORGANIZATION_SQL} = ?\n                      OR ${DENIED_INTENT_ORGANIZATION_SQL} IS NULL\n                  )`\n               : \"\"\n}`,\n        [\n          new Date().toISOString(),\n          ...DOCUMENT_PLACEMENT_INTENT_TYPES,\n          ...(input?.localId ? [input.localId] : []),\n          ...(input?.organizationId ? [input.organizationId] : []),\n        ],\n      );\n    });\n  },\n};\n"]}
+{"version":3,"file":"documentMoveIntentPersistence.js","sourceRoot":"","sources":["documentMoveIntentPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAEL,eAAe,EACf,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,MAAM,+BAA+B,GAAG;IACtC,yBAAyB;IACzB,yBAAyB;CAC1B,CAAC;AAEF,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,oEAAoE;AACpE,6EAA6E;AAC7E,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,8BAA8B,GAAG;;;;EAIrC,CAAC;AAEH,MAAM,oCAAoC,GAAG;;;;;;yDAMY,CAAC;AAuD1D,SAAS,iCAAiC,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAIlC;IACC,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,aAAa,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,2BAA2B,CAClC,GAAqC;IAErC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EACR,GAAG,CAAC,UAAU,KAAK,yBAAyB;YAC1C,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,yBAAyB;QAC/B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,UAAU,EAAE,iCAAiC,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IAED,iBAAiB,EAAE,yBAAyB;IAC5C,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAEhD,KAAK,CAAC,sBAAsB,CAC1B,OAAgB;QAEhB,OAAO,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YAC/D,MAAM,eAAe,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC,aAAa,CAAC,CAAC,WAAW,CACjE,KAAK,EAAE,EAAE,EAAE,EAAE;gBACX,MAAM,IAAI,GAAG,MAAM,EAAE;qBAClB,MAAM,EAAE;qBACR,IAAI,CAAC,mBAAmB,CAAC;oBAC1B,kEAAkE;oBAClE,qEAAqE;oBACrE,uEAAuE;oBACvE,qEAAqE;oBACrE,2DAA2D;oBAC3D,wEAAwE;oBACxE,mEAAmE;oBACnE,uEAAuE;qBACtE,KAAK,CACJ,GAAG,CACD,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAC/D,OAAO,CACL,mBAAmB,CAAC,UAAU,EAC9B,+BAA+B,CAChC,CACF,CACF;qBACA,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;gBAE/C,OAAO,OAAO,CAAC,GAAG,CAChB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACrB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,aAAa,EACb,GAAG,CAAC,EAAE,IAAI,EAAE,CACb,CAAC;oBACF,MAAM,KAAK,GAAG,OAAO;yBAClB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC;yBAC/C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;yBACnC,IAAI,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,OAAO;yBACpB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;yBACjD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;yBACnC,IAAI,EAAE,CAAC;oBACV,OAAO;wBACL,GAAG,2BAA2B,CAAC,GAAG,CAAC;wBACnC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC9D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChE,CAAC;gBACJ,CAAC,CAAC,CACH,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAgB,EAChB,KAIC;QAED,OAAO,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YAC/D,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC;;;;aAIK,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;sBACjC,EACd;gBACE,KAAK,CAAC,UAAU;gBAChB,GAAG,+BAA+B;gBAClC,KAAK,CAAC,iBAAiB;gBACvB,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CACF,CAAC;YACF,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,iCAAiC,CAAC,aAAa,CAAC;qBACnD,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC;qBACpC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;qBACzD,GAAG,EAAE,CAAC;YACX,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,OAAgB,EAChB,KA2BC;QAED,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CACjE,KAAK,EAAE,EAAE,EAAE,EAAE;YACX,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,EAAE;iBACL,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,GAAG,CAAC;gBACH,eAAe,EAAE,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,OAAO;gBACxB,UAAU,EAAE,yBAAyB,CAAC,KAAK,CAAC;gBAC5C,SAAS;aACV,CAAC;iBACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;YACpD,4DAA4D;YAC5D,8DAA8D;YAC9D,kDAAkD;YAClD,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE;gBACtC,SAAS;gBACT,SAAS;gBACT,QAAQ;aACT,CAAC,EACF,OAAO,CACL,mBAAmB,CAAC,UAAU,EAC9B,+BAA+B,CAChC,EACD,GAAG,CAAC,KAAK,CAAC,gBAAgB;gBACxB,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACtD,CAAC,CAAC,EAAE,CAAC,EACP,GAAG,CAAC,KAAK,CAAC,iBAAiB;gBACzB,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC9D,CAAC,CAAC,EAAE,CAAC,CACR,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC,EACD,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAClC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAgB,EAChB,KAAmC;QAEnC,MAAM,gCAAgC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,eAAe,CAAC,OAAO,EAAE;YAC7B,GAAG,wBAAwB;YAC3B,GAAG,eAAe;SACnB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB;;SAEG,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE;;;WAG/D,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,8BAA8B,WAAW,8BAA8B,WAAW,CAAC,CAAC,CAAC,EAAE;eACnH,EACT,KAAK,EAAE,cAAc;YACnB,CAAC,CAAC,CAAC,GAAG,+BAA+B,EAAE,KAAK,CAAC,cAAc,CAAC;YAC5D,CAAC,CAAC,+BAA+B,CACpC,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAAgB,EAChB,KAAqD;QAErD,MAAM,gCAAgC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,eAAe,CAAC,OAAO,EAAE;YAC7B,GAAG,wBAAwB;YAC3B,GAAG,eAAe;SACnB,CAAC,CAAC;QACH,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YAC9D,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,aAAa,CACjB;;;;aAIK,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;aAExC,KAAK,EAAE,cAAc;gBACnB,CAAC,CAAC;;sBAEK,oCAAoC;4BAC9B,8BAA8B;2BAC/B,8BAA8B;oBACrC;gBACL,CAAC,CAAC,EACN,EAAE,EACL;gBACE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACxB,GAAG,+BAA+B;gBAClC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC","sourcesContent":["import { and, asc, eq, inArray } from \"drizzle-orm\";\nimport { documentIntentLinkTargets } from \"../../sqlite/documentPlacementIntentSchema\";\nimport {\n  containerTables,\n  documentMoveIntents,\n  documentMoveIntentTables,\n  documentProjectionTables,\n} from \"../../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport {\n  type ExecSql,\n  ensureSqlTables,\n  runSerializedSqlMutation,\n} from \"../../sqlite/sqlSchema\";\nimport {\n  enqueueDocumentLinkIntent,\n  enqueueDocumentMoveIntent,\n  enqueueDocumentUnlinkIntent,\n  loadDocumentIntentLinkTargets,\n} from \"./documentPlacementIntentEnqueue\";\n\nexport const DOCUMENT_MOVE_INTENT_TYPE = \"document.move\";\nexport const DOCUMENT_LINK_INTENT_TYPE = \"document.link\";\nconst DOCUMENT_PLACEMENT_INTENT_TYPES = [\n  DOCUMENT_MOVE_INTENT_TYPE,\n  DOCUMENT_LINK_INTENT_TYPE,\n];\n\n// Resolves the organization a parked move belongs to, in confidence order:\n// the move's target container, the document's preserved projection\n// attribution, then the container the document currently sits in. Normal\n// saves routinely leave projection attribution empty (deferred-tail\n// reporting resolves through the same container join), so the container rows\n// carry the common case; rows with no resolvable organization stay in every\n// scope (device-first shapes, matching orphan priming).\nconst DENIED_INTENT_ORGANIZATION_SQL = `COALESCE(\n  NULLIF(target_container.organization_id, ''),\n  NULLIF(projection.organization_id, ''),\n  NULLIF(projection_container.organization_id, '')\n)`;\n\nconst DENIED_INTENT_ORGANIZATION_JOINS_SQL = `\n  LEFT JOIN containers target_container\n    ON target_container.id = intent.target_container_id\n  LEFT JOIN document_projection projection\n    ON projection.local_id = intent.local_id\n  LEFT JOIN containers projection_container\n    ON projection_container.id = projection.container_id`;\n\n/**\n * - `pending`: replays on every structural pass.\n * - `blocked`: the last pass could not proceed locally (missing local\n *   document / destination); replays, since hydration can heal it.\n * - `denied`: parked on a 403 until the access-restored replay (row 7).\n * - `unavailable`: terminal — after a projection refresh the destination\n *   itself is proven deleted (coded 404 on its own projection probe). No\n *   mutation 409 is ever terminal: with the destination live it can only\n *   name an ancestor or source, and the next pass's fresh paths outrun it.\n *   Container ids never return, so no replay can commit the intent as\n *   written; it leaves the replay set until the local container tombstone\n *   cascade retargets it or the user re-enqueues the move.\n */\nexport type DocumentMoveIntentSyncStatus =\n  | \"pending\"\n  | \"blocked\"\n  | \"denied\"\n  | \"unavailable\";\n\nexport interface DocumentMoveIntentRecord {\n  additionalLinkContainerIds?: readonly string[] | undefined;\n  removedLinkContainerIds?: readonly string[] | undefined;\n  id: string;\n  documentId: string;\n  intentType:\n    | typeof DOCUMENT_MOVE_INTENT_TYPE\n    | typeof DOCUMENT_LINK_INTENT_TYPE;\n  lastAttemptedAt: string | null;\n  lastError: string | null;\n  localId: string;\n  replaceLinkedContainers: boolean;\n  sourceContainerId: string | null;\n  syncStatus: DocumentMoveIntentSyncStatus;\n  targetContainerId: string;\n  createdAt: string;\n  updatedAt: string;\n}\n\ninterface SelectedDocumentMoveIntentRecord {\n  id: string | null;\n  documentId: string;\n  intentType: string;\n  lastAttemptedAt: string | null;\n  lastError: string | null;\n  localId: string;\n  replaceLinkedContainers: boolean;\n  sourceContainerId: string | null;\n  syncStatus: string;\n  targetContainerId: string;\n  createdAt: string;\n  updatedAt: string;\n}\n\nfunction parseDocumentMoveIntentSyncStatus(\n  value: unknown,\n): DocumentMoveIntentSyncStatus {\n  if (value === \"blocked\" || value === \"denied\" || value === \"unavailable\") {\n    return value;\n  }\n  return \"pending\";\n}\n\nfunction resolveRecordedSyncStatus(input: {\n  blocked?: boolean | undefined;\n  denied?: boolean | undefined;\n  unavailable?: boolean | undefined;\n}): DocumentMoveIntentSyncStatus {\n  if (input.unavailable) return \"unavailable\";\n  if (input.denied) return \"denied\";\n  return input.blocked ? \"blocked\" : \"pending\";\n}\n\nfunction mapDocumentMoveIntentRecord(\n  row: SelectedDocumentMoveIntentRecord,\n): DocumentMoveIntentRecord {\n  return {\n    id: String(row.id ?? \"\"),\n    documentId: row.documentId,\n    intentType:\n      row.intentType === DOCUMENT_LINK_INTENT_TYPE\n        ? DOCUMENT_LINK_INTENT_TYPE\n        : DOCUMENT_MOVE_INTENT_TYPE,\n    lastAttemptedAt: row.lastAttemptedAt,\n    lastError: row.lastError,\n    localId: row.localId,\n    replaceLinkedContainers: Boolean(row.replaceLinkedContainers),\n    sourceContainerId: row.sourceContainerId,\n    syncStatus: parseDocumentMoveIntentSyncStatus(row.syncStatus),\n    targetContainerId: row.targetContainerId,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport const sqlDocumentMoveIntentPersistence = {\n  async ensureSchema(execSql: ExecSql): Promise<void> {\n    await ensureSqlTables(execSql, documentMoveIntentTables);\n  },\n\n  enqueueMoveIntent: enqueueDocumentMoveIntent,\n  enqueueLinkIntent: enqueueDocumentLinkIntent,\n  enqueueUnlinkIntent: enqueueDocumentUnlinkIntent,\n\n  async listPendingMoveIntents(\n    execSql: ExecSql,\n  ): Promise<DocumentMoveIntentRecord[]> {\n    return runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n      await ensureSqlTables(lockedExecSql, documentMoveIntentTables);\n      return getClientSQLitePersistenceRuntime(lockedExecSql).transaction(\n        async (tx) => {\n          const rows = await tx\n            .select()\n            .from(documentMoveIntents)\n            // Blocked intents replay too: \"blocked\" names the reason the last\n            // attempt could not proceed (missing local doc / destination), not a\n            // terminal verdict. The blocking condition can heal after hydration or\n            // recovery, and re-checking is cheap — a still-blocked intent simply\n            // re-records its reason without counting as lane progress.\n            // Unavailable intents never replay: the server proved a cited container\n            // is gone, so every replay would re-issue the same doomed requests\n            // (#2278 #4). Only the tombstone cascade or a re-enqueue revives them.\n            .where(\n              and(\n                inArray(documentMoveIntents.syncStatus, [\"pending\", \"blocked\"]),\n                inArray(\n                  documentMoveIntents.intentType,\n                  DOCUMENT_PLACEMENT_INTENT_TYPES,\n                ),\n              ),\n            )\n            .orderBy(asc(documentMoveIntents.createdAt));\n\n          return Promise.all(\n            rows.map(async (row) => {\n              const targets = await loadDocumentIntentLinkTargets(\n                lockedExecSql,\n                row.id ?? \"\",\n              );\n              const added = targets\n                .filter((target) => target.operation === \"link\")\n                .map((target) => target.containerId)\n                .sort();\n              const removed = targets\n                .filter((target) => target.operation === \"unlink\")\n                .map((target) => target.containerId)\n                .sort();\n              return {\n                ...mapDocumentMoveIntentRecord(row),\n                ...(added.length ? { additionalLinkContainerIds: added } : {}),\n                ...(removed.length ? { removedLinkContainerIds: removed } : {}),\n              };\n            }),\n          );\n        },\n      );\n    });\n  },\n\n  async markMoveIntentSynced(\n    execSql: ExecSql,\n    input: {\n      documentId: string;\n      expectedIntentId?: string | undefined;\n      expectedUpdatedAt: string;\n    },\n  ): Promise<boolean> {\n    return runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n      const deleted = await lockedExecSql(\n        `DELETE FROM document_move_intents\n         WHERE document_id = ?\n           AND intent_type IN (?, ?)\n           AND updated_at = ?\n           ${input.expectedIntentId ? \"AND id = ?\" : \"\"}\n         RETURNING id`,\n        [\n          input.documentId,\n          ...DOCUMENT_PLACEMENT_INTENT_TYPES,\n          input.expectedUpdatedAt,\n          ...(input.expectedIntentId ? [input.expectedIntentId] : []),\n        ],\n      );\n      for (const { id } of deleted) {\n        await getClientSQLitePersistenceRuntime(lockedExecSql)\n          .db.delete(documentIntentLinkTargets)\n          .where(eq(documentIntentLinkTargets.intentId, String(id)))\n          .run();\n      }\n      return deleted.length > 0;\n    });\n  },\n\n  async recordMoveIntentError(\n    execSql: ExecSql,\n    input: {\n      blocked?: boolean | undefined;\n      /**\n       * A permission denial (403): the intent parks as `denied` — excluded\n       * from routine structural replays — until the org-access-restored\n       * signal or a manual retry flips it back to pending (edge-case row 7).\n       */\n      denied?: boolean | undefined;\n      documentId: string;\n      /** Exact intent revision read by the pass; preferred over wall-clock CAS. */\n      expectedIntentId?: string | undefined;\n      /**\n       * Optimistic concurrency: when given, the error only records against\n       * the intent revision the pass read — a re-enqueued move (new\n       * updatedAt) is never parked by a stale in-flight failure.\n       */\n      expectedUpdatedAt?: string | undefined;\n      message: string;\n      stillCurrent?: (() => boolean) | undefined;\n      /**\n       * Server proof that a cited container was deleted (coded 404 or\n       * `container_unavailable` 409): the intent parks terminally as\n       * `unavailable`, outside every replay, until the tombstone cascade\n       * retargets it or a re-enqueue replaces it. Outranks `denied`: a\n       * restored permission cannot revive a deleted container.\n       */\n      unavailable?: boolean | undefined;\n    },\n  ): Promise<void> {\n    await getClientSQLitePersistenceRuntime(execSql).guardedTransaction(\n      async (db) => {\n        const updatedAt = new Date().toISOString();\n        await db\n          .update(documentMoveIntents)\n          .set({\n            lastAttemptedAt: updatedAt,\n            lastError: input.message,\n            syncStatus: resolveRecordedSyncStatus(input),\n            updatedAt,\n          })\n          .where(\n            and(\n              eq(documentMoveIntents.documentId, input.documentId),\n              // Blocked/denied rows must stay updatable: a retried intent\n              // records its fresh outcome, and a transient failure flips it\n              // back to pending instead of freezing it forever.\n              inArray(documentMoveIntents.syncStatus, [\n                \"pending\",\n                \"blocked\",\n                \"denied\",\n              ]),\n              inArray(\n                documentMoveIntents.intentType,\n                DOCUMENT_PLACEMENT_INTENT_TYPES,\n              ),\n              ...(input.expectedIntentId\n                ? [eq(documentMoveIntents.id, input.expectedIntentId)]\n                : []),\n              ...(input.expectedUpdatedAt\n                ? [eq(documentMoveIntents.updatedAt, input.expectedUpdatedAt)]\n                : []),\n            ),\n          )\n          .run();\n      },\n      input.stillCurrent ?? (() => true),\n      { behavior: \"immediate\" },\n    );\n  },\n  /**\n   * Evidence for the org-access-restored re-arm gate: a parked\n   * permission-denied move proves a queued write was refused.\n   */\n  async hasDeniedMoveIntents(\n    execSql: ExecSql,\n    input?: { organizationId?: string },\n  ): Promise<boolean> {\n    await sqlDocumentMoveIntentPersistence.ensureSchema(execSql);\n    await ensureSqlTables(execSql, [\n      ...documentProjectionTables,\n      ...containerTables,\n    ]);\n    const rows = await execSql(\n      `SELECT intent.document_id AS document_id\n       FROM document_move_intents intent\n       ${input?.organizationId ? DENIED_INTENT_ORGANIZATION_JOINS_SQL : \"\"}\n       WHERE intent.sync_status = 'denied'\n         AND intent.intent_type IN (?, ?)\n         ${input?.organizationId ? `AND (${DENIED_INTENT_ORGANIZATION_SQL} = ? OR ${DENIED_INTENT_ORGANIZATION_SQL} IS NULL)` : \"\"}\n       LIMIT 1`,\n      input?.organizationId\n        ? [...DOCUMENT_PLACEMENT_INTENT_TYPES, input.organizationId]\n        : DOCUMENT_PLACEMENT_INTENT_TYPES,\n    );\n    return rows.length > 0;\n  },\n  /**\n   * Flip parked permission-denied moves back to pending so the re-armed\n   * structural pass replays them (access restored, or a manual retry scoped\n   * to one document).\n   */\n  async resetDeniedMoveIntents(\n    execSql: ExecSql,\n    input?: { localId?: string; organizationId?: string },\n  ): Promise<void> {\n    await sqlDocumentMoveIntentPersistence.ensureSchema(execSql);\n    await ensureSqlTables(execSql, [\n      ...documentProjectionTables,\n      ...containerTables,\n    ]);\n    await runSerializedSqlMutation(execSql, async (lockedExecSql) => {\n      // Organization scoping resolves each intent's organization through the\n      // container joins above: restoring one organization's access must not\n      // un-park moves that another organization still denies. Rows with no\n      // resolvable organization are included (device-first shapes).\n      await lockedExecSql(\n        `UPDATE document_move_intents\n         SET sync_status = 'pending', updated_at = ?\n         WHERE sync_status = 'denied'\n           AND intent_type IN (?, ?)\n           ${input?.localId ? \"AND local_id = ?\" : \"\"}\n           ${\n             input?.organizationId\n               ? `AND local_id IN (\n                    SELECT intent.local_id FROM document_move_intents intent\n                    ${DENIED_INTENT_ORGANIZATION_JOINS_SQL}\n                    WHERE ${DENIED_INTENT_ORGANIZATION_SQL} = ?\n                      OR ${DENIED_INTENT_ORGANIZATION_SQL} IS NULL\n                  )`\n               : \"\"\n           }`,\n        [\n          new Date().toISOString(),\n          ...DOCUMENT_PLACEMENT_INTENT_TYPES,\n          ...(input?.localId ? [input.localId] : []),\n          ...(input?.organizationId ? [input.organizationId] : []),\n        ],\n      );\n    });\n  },\n};\n"]}

package/data/persistence/principalAuthorizationCheckpoints.js

@@ -5,7 +5,7 @@ export class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVeri
         super("missing_dependency", "Public authorization cannot connect to the latest durable checkpoint");
     }
 }
-/** Historical capabilities validate trust but never advance current-policy pins. */
+/** Validate public evidence or a verified private ancestry bridge without admitting pins. */
 export async function validatePrincipalAuthorizationCheckpoints(tx, policies) {
     for (const policy of policies) {
         const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);

package/data/persistence/principalAuthorizationCheckpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalAuthorizationCheckpoints.js","sourceRoot":"","sources":["principalAuthorizationCheckpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,MAAM,OAAO,gDAAiD,SAAQ,uBAAuB;IAC3F;QACE,KAAK,CACH,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAAqD;IAErD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC5C,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACvC,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,IACE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAM,IAAI,gDAAgD,EAAE,CAAC;QAC/D,+BAA+B,CAAC;YAC9B,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { loadStoredPrincipalPolicyCheckpoint } from \"./keyingCheckpointPersistence\";\n\nexport class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {\n  constructor() {\n    super(\n      \"missing_dependency\",\n      \"Public authorization cannot connect to the latest durable checkpoint\",\n    );\n  }\n}\n\n/** Historical capabilities validate trust but never advance current-policy pins. */\nexport async function validatePrincipalAuthorizationCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly VerifiedPrincipalPolicySelection[],\n): Promise<void> {\n  for (const policy of policies) {\n    const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n    if (!checkpoint) continue;\n    const matchingHead = policies.filter(\n      (other) =>\n        other.principalType === policy.principalType &&\n        other.principalId === policy.principalId &&\n        other.stateHash === policy.stateHash,\n    );\n    const chain = matchingHead.flatMap((other) => other.retainedHistory);\n    if (\n      checkpoint.version > policy.version ||\n      (checkpoint.version < policy.version &&\n        !chain.some(({ state }) => state.version === checkpoint.version))\n    )\n      throw new PrincipalAuthorizationCheckpointUnavailableError();\n    verifyPrincipalPolicyCheckpoint({\n      chain,\n      currentState: policy.state,\n      localCheckpoint: checkpoint,\n    });\n  }\n}\n"]}
+{"version":3,"file":"principalAuthorizationCheckpoints.js","sourceRoot":"","sources":["principalAuthorizationCheckpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,MAAM,OAAO,gDAAiD,SAAQ,uBAAuB;IAC3F;QACE,KAAK,CACH,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAGG;IAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC5C,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACvC,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,IACE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAM,IAAI,gDAAgD,EAAE,CAAC;QAC/D,+BAA+B,CAAC;YAC9B,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { loadStoredPrincipalPolicyCheckpoint } from \"./keyingCheckpointPersistence\";\n\nexport class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {\n  constructor() {\n    super(\n      \"missing_dependency\",\n      \"Public authorization cannot connect to the latest durable checkpoint\",\n    );\n  }\n}\n\n/** Validate public evidence or a verified private ancestry bridge without admitting pins. */\nexport async function validatePrincipalAuthorizationCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly (\n    | VerifiedPrincipalPolicySelection\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n): Promise<void> {\n  for (const policy of policies) {\n    const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n    if (!checkpoint) continue;\n    const matchingHead = policies.filter(\n      (other) =>\n        other.principalType === policy.principalType &&\n        other.principalId === policy.principalId &&\n        other.stateHash === policy.stateHash,\n    );\n    const chain = matchingHead.flatMap((other) => other.retainedHistory);\n    if (\n      checkpoint.version > policy.version ||\n      (checkpoint.version < policy.version &&\n        !chain.some(({ state }) => state.version === checkpoint.version))\n    )\n      throw new PrincipalAuthorizationCheckpointUnavailableError();\n    verifyPrincipalPolicyCheckpoint({\n      chain,\n      currentState: policy.state,\n      localCheckpoint: checkpoint,\n    });\n  }\n}\n"]}

package/data/persistence/principalCurrentAcknowledgementPersistence.d.ts

@@ -10,6 +10,7 @@ export interface AcknowledgedPrincipalCurrentPublication {
     readonly previousPrefixProgress: string | null;
     readonly stage: PrincipalHistoryStage;
     readonly predecessorStage: PrincipalHistoryStage | null;
+    readonly predecessorIndexRootHash: string | null;
     readonly evidence: PrincipalHistoryEvidencePage;
 }
 export interface AcknowledgedPrincipalCurrentRetirement {

package/data/persistence/principalCurrentAcknowledgementPersistence.js

@@ -9,6 +9,10 @@ import { ensureSqlTables } from "../sqlite/sqlSchema.js";
 import { loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
 import { storePrincipalGrantRetirements } from "./principalGrantRetirementPersistence.js";
 import { writePrincipalHistoryEvidencePage, } from "./principalHistoryEvidencePersistence.js";
+import { reclaimPrincipalHistoryNodes } from "./principalHistoryNodeRetention.js";
+import { retainPrincipalHistoryRoot } from "./principalHistoryRootOwnership.js";
+import { reclaimCompletedPrincipalHistoryStages, recordPrincipalHistoryStageScope, } from "./principalHistoryStageRetention.js";
+import { archivePrincipalHistoryKeyEnvelopes } from "./principalKeyEnvelopeArchivePersistence.js";
 function assertPublicationScope(entries, organizationId) {
     const seen = new Set();
     for (const entry of entries) {
@@ -17,6 +21,8 @@ function assertPublicationScope(entries, organizationId) {
             throw new KeyingVerificationError("duplicate_entry", "Acknowledged current batch repeats a principal");
         seen.add(key);
         if (entry.prefix.organizationId !== organizationId ||
+            (entry.predecessorStage === null) !==
+                (entry.predecessorIndexRootHash === null) ||
             entry.stage.organizationId !== organizationId ||
             (entry.predecessorStage
                 ? entry.predecessorStage.organizationId !== organizationId ||
@@ -53,6 +59,44 @@ async function validatePublication(tx, entry) {
     if ((prefix?.progress ?? null) !== entry.previousPrefixProgress)
         throw new KeyingVerificationError("stale_predecessor", "Authenticated principal prefix changed before acknowledgement");
 }
+async function archiveAcknowledgedStageKeys(tx, entry) {
+    for (const stage of [entry.predecessorStage, entry.stage]) {
+        if (!stage)
+            continue;
+        await recordPrincipalHistoryStageScope(tx, {
+            id: stage.id,
+            afterVersion: stage.afterVersion,
+            complete: stage.complete,
+            organizationId: entry.prefix.organizationId,
+            scopeId: entry.prefix.scopeId,
+        });
+        await archivePrincipalHistoryKeyEnvelopes(tx, {
+            ...stage,
+            version: stage.afterVersion + 1,
+        });
+    }
+}
+async function retainPredecessorStage(tx, entry) {
+    // Preserve a prefix-only predecessor without replacing an existing completion.
+    if (!entry.predecessorStage || !entry.predecessorIndexRootHash)
+        return;
+    const inserted = await tx
+        .insert(principalHistoryStages)
+        .values(entry.predecessorStage)
+        .onConflictDoUpdate({
+        target: principalHistoryStages.id,
+        set: entry.predecessorStage,
+        setWhere: eq(principalHistoryStages.complete, false),
+    })
+        .returning({ id: principalHistoryStages.id });
+    if (inserted.length > 0)
+        await retainPrincipalHistoryRoot(tx, {
+            id: `stage:${entry.predecessorStage.id}`,
+            scopeId: entry.prefix.scopeId,
+            organizationId: entry.prefix.organizationId,
+            rootHash: entry.predecessorIndexRootHash,
+        });
+}
 /** Store current artifacts and resumable progress in the same transaction as their pins. */
 export async function persistAcknowledgedPrincipalCurrents(input) {
     const entries = structuredClone(input.entries);
@@ -78,18 +122,7 @@ export async function persistAcknowledgedPrincipalCurrents(input) {
         }
         for (const entry of entries) {
             await writePrincipalHistoryEvidencePage(tx, entry.evidence);
-            // A prefix-only predecessor must keep its encrypted key envelopes
-            // before its reusable slot is replaced by the acknowledged successor.
-            if (entry.predecessorStage)
-                await tx
-                    .insert(principalHistoryStages)
-                    .values(entry.predecessorStage)
-                    .onConflictDoUpdate({
-                    target: principalHistoryStages.id,
-                    set: entry.predecessorStage,
-                    setWhere: eq(principalHistoryStages.complete, false),
-                })
-                    .run();
+            await retainPredecessorStage(tx, entry);
             // A fully authenticated publication supersedes an in-flight stage for
             // this exact head. Its other writer fails its progress CAS and resumes.
             await tx
@@ -100,6 +133,7 @@ export async function persistAcknowledgedPrincipalCurrents(input) {
                 set: entry.stage,
             })
                 .run();
+            await archiveAcknowledgedStageKeys(tx, entry);
             await tx
                 .insert(principalHistoryPrefixes)
                 .values(entry.prefix)
@@ -108,6 +142,18 @@ export async function persistAcknowledgedPrincipalCurrents(input) {
                 set: entry.prefix,
             })
                 .run();
+            await reclaimCompletedPrincipalHistoryStages(tx, entry.prefix);
+            for (const id of [
+                `stage:${entry.stage.id}`,
+                `prefix:${entry.prefix.scopeId}`,
+            ])
+                await retainPrincipalHistoryRoot(tx, {
+                    id,
+                    scopeId: entry.prefix.scopeId,
+                    organizationId,
+                    rootHash: entry.evidence.indexRootHash,
+                });
+            await reclaimPrincipalHistoryNodes(tx, entry.prefix);
             await upsertPrincipalPolicyCheckpointInTransaction(tx, entry.policy.checkpoint, new Date().toISOString(), organizationId);
         }
     }, stillCurrent, { behavior: "immediate" });

package/data/persistence/principalCurrentAcknowledgementPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalCurrentAcknowledgementPersistence.js","sourceRoot":"","sources":["principalCurrentAcknowledgementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,mCAAmC,EACnC,kBAAkB,EAClB,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAoB/C,SAAS,sBAAsB,CAC7B,OAA2D,EAC3D,cAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IACE,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc;YAC9C,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;YAC7C,CAAC,KAAK,CAAC,gBAAgB;gBACrB,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,cAAc;oBACxD,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ;oBAChC,KAAK,CAAC,gBAAgB,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;gBAClE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO;oBACtC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC;oBAC1B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI;oBACzC,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC;YAC1C,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,cAAc;YAChD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/C,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7C,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;YACrD,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;YACrB,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;YAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,KAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,EAAE,EACF,KAAK,CAAC,MAAM,CACb,CAAC;IACF,+BAA+B,CAAC;QAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QACnC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAChC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IACE,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC;QAC3C,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QAE7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,yEAAyE,CAC1E,CAAC;IACJ,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACjE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,sBAAsB;QAC7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,+DAA+D,CAChE,CAAC;AACN,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,sBAAsB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW;gBACnD,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,CAC1D,EAAE,MAAM,CAAC;YACV,IAAI,CAAC,MAAM;gBACT,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;YACJ,MAAM,8BAA8B,CAClC,EAAE,EACF,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,EACzC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EACpC,cAAc,CACf,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,iCAAiC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5D,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,KAAK,CAAC,gBAAgB;gBACxB,MAAM,EAAE;qBACL,MAAM,CAAC,sBAAsB,CAAC;qBAC9B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;qBAC9B,kBAAkB,CAAC;oBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;oBACjC,GAAG,EAAE,KAAK,CAAC,gBAAgB;oBAC3B,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC;iBACrD,CAAC;qBACD,GAAG,EAAE,CAAC;YACX,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,EAAE;iBACL,MAAM,CAAC,sBAAsB,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;iBACnB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;gBACjC,GAAG,EAAE,KAAK,CAAC,KAAK;aACjB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,EAAE;iBACL,MAAM,CAAC,wBAAwB,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBACpB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;gBACxC,GAAG,EAAE,KAAK,CAAC,MAAM;aAClB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,4CAA4C,CAChD,EAAE,EACF,KAAK,CAAC,MAAM,CAAC,UAAU,EACvB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport { principalHistoryPrefixes } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { storePrincipalGrantRetirements } from \"./principalGrantRetirementPersistence\";\nimport {\n  type PrincipalHistoryEvidencePage,\n  writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\nimport type { PrincipalHistoryPrefix } from \"./principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"./principalHistoryStagePersistence\";\n\n/** Owned output of authenticated prefix extension and exact receipt verification. */\nexport interface AcknowledgedPrincipalCurrentPublication {\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly previousPrefixProgress: string | null;\n  readonly stage: PrincipalHistoryStage;\n  readonly predecessorStage: PrincipalHistoryStage | null;\n  readonly evidence: PrincipalHistoryEvidencePage;\n}\n\nexport interface AcknowledgedPrincipalCurrentRetirement {\n  readonly principalId: string;\n  readonly principalType: VerifiedPrincipalPolicyCurrent[\"principalType\"];\n  readonly containerIds: readonly string[];\n}\n\nfunction assertPublicationScope(\n  entries: readonly AcknowledgedPrincipalCurrentPublication[],\n  organizationId: string,\n) {\n  const seen = new Set<string>();\n  for (const entry of entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key))\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        \"Acknowledged current batch repeats a principal\",\n      );\n    seen.add(key);\n    if (\n      entry.prefix.organizationId !== organizationId ||\n      entry.stage.organizationId !== organizationId ||\n      (entry.predecessorStage\n        ? entry.predecessorStage.organizationId !== organizationId ||\n          !entry.predecessorStage.complete ||\n          entry.predecessorStage.afterVersion !== entry.policy.version - 2\n        : entry.policy.principalType !== \"group\" ||\n          entry.policy.version !== 1 ||\n          entry.policy.state.prevStateHash !== null ||\n          entry.previousPrefixProgress !== null) ||\n      entry.evidence.organizationId !== organizationId ||\n      entry.prefix.scopeId !== entry.evidence.scopeId ||\n      entry.prefix.version !== entry.policy.version ||\n      entry.stage.afterVersion !== entry.policy.version - 1 ||\n      !entry.stage.complete ||\n      entry.stage.currentJson !== entry.prefix.currentJson\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Acknowledged current publication is outside its scope\",\n      );\n  }\n}\n\nasync function validatePublication(\n  tx: ClientSQLiteTransactionScope,\n  entry: AcknowledgedPrincipalCurrentPublication,\n) {\n  const checkpoint = await loadStoredPrincipalPolicyCheckpoint(\n    tx,\n    entry.policy,\n  );\n  verifyPrincipalPolicyCheckpoint({\n    chain: entry.policy.retainedHistory,\n    currentState: entry.policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (\n    (!checkpoint && entry.policy.version !== 1) ||\n    (checkpoint && entry.policy.version > checkpoint.version + 1)\n  )\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Acknowledged current policy must directly extend its durable checkpoint\",\n    );\n  const [prefix] = await tx\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, entry.prefix.scopeId))\n    .limit(1);\n  if ((prefix?.progress ?? null) !== entry.previousPrefixProgress)\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Authenticated principal prefix changed before acknowledgement\",\n    );\n}\n\n/** Store current artifacts and resumable progress in the same transaction as their pins. */\nexport async function persistAcknowledgedPrincipalCurrents(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly entries: readonly AcknowledgedPrincipalCurrentPublication[];\n  readonly retirements?:\n    | readonly AcknowledgedPrincipalCurrentRetirement[]\n    | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const entries = structuredClone(input.entries);\n  const retirements = structuredClone(input.retirements ?? []);\n  const organizationId = input.organizationId;\n  const stillCurrent = input.stillCurrent;\n  assertPublicationScope(entries, organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const stored = await runtime.guardedTransaction(\n    async (tx) => {\n      for (const entry of entries) await validatePublication(tx, entry);\n      for (const retirement of retirements) {\n        const policy = entries.find(\n          (entry) =>\n            entry.policy.principalId === retirement.principalId &&\n            entry.policy.principalType === retirement.principalType,\n        )?.policy;\n        if (!policy)\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Retirement must accompany its acknowledged principal\",\n          );\n        await storePrincipalGrantRetirements(\n          tx,\n          { ...retirement, policy, organizationId },\n          entries.map((entry) => entry.policy),\n          organizationId,\n        );\n      }\n      for (const entry of entries) {\n        await writePrincipalHistoryEvidencePage(tx, entry.evidence);\n        // A prefix-only predecessor must keep its encrypted key envelopes\n        // before its reusable slot is replaced by the acknowledged successor.\n        if (entry.predecessorStage)\n          await tx\n            .insert(principalHistoryStages)\n            .values(entry.predecessorStage)\n            .onConflictDoUpdate({\n              target: principalHistoryStages.id,\n              set: entry.predecessorStage,\n              setWhere: eq(principalHistoryStages.complete, false),\n            })\n            .run();\n        // A fully authenticated publication supersedes an in-flight stage for\n        // this exact head. Its other writer fails its progress CAS and resumes.\n        await tx\n          .insert(principalHistoryStages)\n          .values(entry.stage)\n          .onConflictDoUpdate({\n            target: principalHistoryStages.id,\n            set: entry.stage,\n          })\n          .run();\n        await tx\n          .insert(principalHistoryPrefixes)\n          .values(entry.prefix)\n          .onConflictDoUpdate({\n            target: principalHistoryPrefixes.scopeId,\n            set: entry.prefix,\n          })\n          .run();\n        await upsertPrincipalPolicyCheckpointInTransaction(\n          tx,\n          entry.policy.checkpoint,\n          new Date().toISOString(),\n          organizationId,\n        );\n      }\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => stored.committed);\n}\n"]}
+{"version":3,"file":"principalCurrentAcknowledgementPersistence.js","sourceRoot":"","sources":["principalCurrentAcknowledgementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,mCAAmC,EACnC,kBAAkB,EAClB,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,EACL,sCAAsC,EACtC,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAmB/F,SAAS,sBAAsB,CAC7B,OAA2D,EAC3D,cAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IACE,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc;YAC9C,CAAC,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC;gBAC/B,CAAC,KAAK,CAAC,wBAAwB,KAAK,IAAI,CAAC;YAC3C,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;YAC7C,CAAC,KAAK,CAAC,gBAAgB;gBACrB,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,cAAc;oBACxD,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ;oBAChC,KAAK,CAAC,gBAAgB,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;gBAClE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO;oBACtC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC;oBAC1B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI;oBACzC,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC;YAC1C,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,cAAc;YAChD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/C,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7C,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;YACrD,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;YACrB,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;YAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,KAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,EAAE,EACF,KAAK,CAAC,MAAM,CACb,CAAC;IACF,+BAA+B,CAAC;QAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QACnC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAChC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IACE,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC;QAC3C,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QAE7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,yEAAyE,CAC1E,CAAC;IACJ,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACjE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,sBAAsB;QAC7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,+DAA+D,CAChE,CAAC;AACN,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,EAAgC,EAChC,KAA8C;IAE9C,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,gCAAgC,CAAC,EAAE,EAAE;YACzC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,MAAM,mCAAmC,CAAC,EAAE,EAAE;YAC5C,GAAG,KAAK;YACR,OAAO,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,KAA8C;IAE9C,+EAA+E;IAC/E,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,wBAAwB;QAAE,OAAO;IACvE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,sBAAsB,CAAC;SAC9B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;SAC9B,kBAAkB,CAAC;QAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;QACjC,GAAG,EAAE,KAAK,CAAC,gBAAgB;QAC3B,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC;KACrD,CAAC;SACD,SAAS,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrB,MAAM,0BAA0B,CAAC,EAAE,EAAE;YACnC,EAAE,EAAE,SAAS,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE;YACxC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,QAAQ,EAAE,KAAK,CAAC,wBAAwB;SACzC,CAAC,CAAC;AACP,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,sBAAsB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW;gBACnD,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,CAC1D,EAAE,MAAM,CAAC;YACV,IAAI,CAAC,MAAM;gBACT,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;YACJ,MAAM,8BAA8B,CAClC,EAAE,EACF,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,EACzC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EACpC,cAAc,CACf,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,iCAAiC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxC,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,EAAE;iBACL,MAAM,CAAC,sBAAsB,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;iBACnB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;gBACjC,GAAG,EAAE,KAAK,CAAC,KAAK;aACjB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,4BAA4B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,EAAE;iBACL,MAAM,CAAC,wBAAwB,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBACpB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;gBACxC,GAAG,EAAE,KAAK,CAAC,MAAM;aAClB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,sCAAsC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,KAAK,MAAM,EAAE,IAAI;gBACf,SAAS,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE;gBACzB,UAAU,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;aACjC;gBACC,MAAM,0BAA0B,CAAC,EAAE,EAAE;oBACnC,EAAE;oBACF,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;oBAC7B,cAAc;oBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;iBACvC,CAAC,CAAC;YACL,MAAM,4BAA4B,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,4CAA4C,CAChD,EAAE,EACF,KAAK,CAAC,MAAM,CAAC,UAAU,EACvB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport { principalHistoryPrefixes } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { storePrincipalGrantRetirements } from \"./principalGrantRetirementPersistence\";\nimport {\n  type PrincipalHistoryEvidencePage,\n  writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\nimport { reclaimPrincipalHistoryNodes } from \"./principalHistoryNodeRetention\";\nimport type { PrincipalHistoryPrefix } from \"./principalHistoryPrefixPersistence\";\nimport { retainPrincipalHistoryRoot } from \"./principalHistoryRootOwnership\";\nimport type { PrincipalHistoryStage } from \"./principalHistoryStagePersistence\";\nimport {\n  reclaimCompletedPrincipalHistoryStages,\n  recordPrincipalHistoryStageScope,\n} from \"./principalHistoryStageRetention\";\nimport { archivePrincipalHistoryKeyEnvelopes } from \"./principalKeyEnvelopeArchivePersistence\";\n\n/** Owned output of authenticated prefix extension and exact receipt verification. */\nexport interface AcknowledgedPrincipalCurrentPublication {\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly previousPrefixProgress: string | null;\n  readonly stage: PrincipalHistoryStage;\n  readonly predecessorStage: PrincipalHistoryStage | null;\n  readonly predecessorIndexRootHash: string | null;\n  readonly evidence: PrincipalHistoryEvidencePage;\n}\n\nexport interface AcknowledgedPrincipalCurrentRetirement {\n  readonly principalId: string;\n  readonly principalType: VerifiedPrincipalPolicyCurrent[\"principalType\"];\n  readonly containerIds: readonly string[];\n}\n\nfunction assertPublicationScope(\n  entries: readonly AcknowledgedPrincipalCurrentPublication[],\n  organizationId: string,\n) {\n  const seen = new Set<string>();\n  for (const entry of entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key))\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        \"Acknowledged current batch repeats a principal\",\n      );\n    seen.add(key);\n    if (\n      entry.prefix.organizationId !== organizationId ||\n      (entry.predecessorStage === null) !==\n        (entry.predecessorIndexRootHash === null) ||\n      entry.stage.organizationId !== organizationId ||\n      (entry.predecessorStage\n        ? entry.predecessorStage.organizationId !== organizationId ||\n          !entry.predecessorStage.complete ||\n          entry.predecessorStage.afterVersion !== entry.policy.version - 2\n        : entry.policy.principalType !== \"group\" ||\n          entry.policy.version !== 1 ||\n          entry.policy.state.prevStateHash !== null ||\n          entry.previousPrefixProgress !== null) ||\n      entry.evidence.organizationId !== organizationId ||\n      entry.prefix.scopeId !== entry.evidence.scopeId ||\n      entry.prefix.version !== entry.policy.version ||\n      entry.stage.afterVersion !== entry.policy.version - 1 ||\n      !entry.stage.complete ||\n      entry.stage.currentJson !== entry.prefix.currentJson\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Acknowledged current publication is outside its scope\",\n      );\n  }\n}\n\nasync function validatePublication(\n  tx: ClientSQLiteTransactionScope,\n  entry: AcknowledgedPrincipalCurrentPublication,\n) {\n  const checkpoint = await loadStoredPrincipalPolicyCheckpoint(\n    tx,\n    entry.policy,\n  );\n  verifyPrincipalPolicyCheckpoint({\n    chain: entry.policy.retainedHistory,\n    currentState: entry.policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (\n    (!checkpoint && entry.policy.version !== 1) ||\n    (checkpoint && entry.policy.version > checkpoint.version + 1)\n  )\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Acknowledged current policy must directly extend its durable checkpoint\",\n    );\n  const [prefix] = await tx\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, entry.prefix.scopeId))\n    .limit(1);\n  if ((prefix?.progress ?? null) !== entry.previousPrefixProgress)\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Authenticated principal prefix changed before acknowledgement\",\n    );\n}\n\nasync function archiveAcknowledgedStageKeys(\n  tx: ClientSQLiteTransactionScope,\n  entry: AcknowledgedPrincipalCurrentPublication,\n) {\n  for (const stage of [entry.predecessorStage, entry.stage]) {\n    if (!stage) continue;\n    await recordPrincipalHistoryStageScope(tx, {\n      id: stage.id,\n      afterVersion: stage.afterVersion,\n      complete: stage.complete,\n      organizationId: entry.prefix.organizationId,\n      scopeId: entry.prefix.scopeId,\n    });\n    await archivePrincipalHistoryKeyEnvelopes(tx, {\n      ...stage,\n      version: stage.afterVersion + 1,\n    });\n  }\n}\n\nasync function retainPredecessorStage(\n  tx: ClientSQLiteTransactionScope,\n  entry: AcknowledgedPrincipalCurrentPublication,\n) {\n  // Preserve a prefix-only predecessor without replacing an existing completion.\n  if (!entry.predecessorStage || !entry.predecessorIndexRootHash) return;\n  const inserted = await tx\n    .insert(principalHistoryStages)\n    .values(entry.predecessorStage)\n    .onConflictDoUpdate({\n      target: principalHistoryStages.id,\n      set: entry.predecessorStage,\n      setWhere: eq(principalHistoryStages.complete, false),\n    })\n    .returning({ id: principalHistoryStages.id });\n  if (inserted.length > 0)\n    await retainPrincipalHistoryRoot(tx, {\n      id: `stage:${entry.predecessorStage.id}`,\n      scopeId: entry.prefix.scopeId,\n      organizationId: entry.prefix.organizationId,\n      rootHash: entry.predecessorIndexRootHash,\n    });\n}\n\n/** Store current artifacts and resumable progress in the same transaction as their pins. */\nexport async function persistAcknowledgedPrincipalCurrents(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly entries: readonly AcknowledgedPrincipalCurrentPublication[];\n  readonly retirements?:\n    | readonly AcknowledgedPrincipalCurrentRetirement[]\n    | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const entries = structuredClone(input.entries);\n  const retirements = structuredClone(input.retirements ?? []);\n  const organizationId = input.organizationId;\n  const stillCurrent = input.stillCurrent;\n  assertPublicationScope(entries, organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const stored = await runtime.guardedTransaction(\n    async (tx) => {\n      for (const entry of entries) await validatePublication(tx, entry);\n      for (const retirement of retirements) {\n        const policy = entries.find(\n          (entry) =>\n            entry.policy.principalId === retirement.principalId &&\n            entry.policy.principalType === retirement.principalType,\n        )?.policy;\n        if (!policy)\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Retirement must accompany its acknowledged principal\",\n          );\n        await storePrincipalGrantRetirements(\n          tx,\n          { ...retirement, policy, organizationId },\n          entries.map((entry) => entry.policy),\n          organizationId,\n        );\n      }\n      for (const entry of entries) {\n        await writePrincipalHistoryEvidencePage(tx, entry.evidence);\n        await retainPredecessorStage(tx, entry);\n        // A fully authenticated publication supersedes an in-flight stage for\n        // this exact head. Its other writer fails its progress CAS and resumes.\n        await tx\n          .insert(principalHistoryStages)\n          .values(entry.stage)\n          .onConflictDoUpdate({\n            target: principalHistoryStages.id,\n            set: entry.stage,\n          })\n          .run();\n        await archiveAcknowledgedStageKeys(tx, entry);\n        await tx\n          .insert(principalHistoryPrefixes)\n          .values(entry.prefix)\n          .onConflictDoUpdate({\n            target: principalHistoryPrefixes.scopeId,\n            set: entry.prefix,\n          })\n          .run();\n        await reclaimCompletedPrincipalHistoryStages(tx, entry.prefix);\n        for (const id of [\n          `stage:${entry.stage.id}`,\n          `prefix:${entry.prefix.scopeId}`,\n        ])\n          await retainPrincipalHistoryRoot(tx, {\n            id,\n            scopeId: entry.prefix.scopeId,\n            organizationId,\n            rootHash: entry.evidence.indexRootHash,\n          });\n        await reclaimPrincipalHistoryNodes(tx, entry.prefix);\n        await upsertPrincipalPolicyCheckpointInTransaction(\n          tx,\n          entry.policy.checkpoint,\n          new Date().toISOString(),\n          organizationId,\n        );\n      }\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => stored.committed);\n}\n"]}

package/data/persistence/principalHistoryEvidencePersistence.d.ts

@@ -3,6 +3,7 @@ import { type PrincipalPolicyStateChainEntryResponse } from "../../internal/vali
 import { type ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
 import { type ExecSql } from "../sqlite/sqlSchema.js";
 export interface PrincipalHistoryEvidencePage {
+    readonly indexRootHash: string;
     readonly scopeId: string;
     readonly organizationId: string;
     readonly entries: readonly {
@@ -13,6 +14,7 @@ export interface PrincipalHistoryEvidencePage {
 }
 /** Prepare only a page accepted by the signature/authorization verifier. */
 export declare function preparePrincipalHistoryEvidencePage(input: {
+    readonly indexRootHash: string;
     readonly scopeId: string;
     readonly organizationId: string;
     readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];

package/data/persistence/principalHistoryEvidencePersistence.js

@@ -4,6 +4,7 @@ import { and, eq } from "drizzle-orm";
 import { principalHistoryEntries, principalHistoryEvidenceTables, principalHistoryNodes, } from "../sqlite/principalHistoryEvidenceSchema.js";
 import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../sqlite/sqlSchema.js";
+import { recordPrincipalHistoryNodeEdges } from "./principalHistoryNodeRetention.js";
 /** Prepare only a page accepted by the signature/authorization verifier. */
 export async function preparePrincipalHistoryEvidencePage(input) {
     if (input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||
@@ -36,6 +37,7 @@ export async function writePrincipalHistoryEvidencePage(tx, page) {
             .run();
     }
     for (const node of [...page.nodes].sort((a, b) => compareCanonicalStrings(a.hash, b.hash))) {
+        await recordPrincipalHistoryNodeEdges(tx, scope, node);
         const row = { ...scope, ...node };
         await tx
             .insert(principalHistoryNodes)

package/data/persistence/principalHistoryEvidencePersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryEvidencePersistence.js","sourceRoot":"","sources":["principalHistoryEvidencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAGlC,yBAAyB,EAEzB,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYpE,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAKzD;IACC,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,kCAAkC;QACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,kCAAkC;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,EAAgC,EAChC,IAAkC;IAElC,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClD,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAChD,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QACnC,MAAM,EAAE;aACL,MAAM,CAAC,uBAAuB,CAAC;aAC/B,MAAM,CAAC,GAAG,CAAC;aACX,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,uBAAuB,CAAC,OAAO;gBAC/B,uBAAuB,CAAC,QAAQ;aACjC;YACD,GAAG,EAAE,GAAG;SACT,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC/C,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACxC,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE;aACL,MAAM,CAAC,qBAAqB,CAAC;aAC7B,MAAM,CAAC,GAAG,CAAC;aACX,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC;YACnE,GAAG,EAAE,GAAG;SACT,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC;QACvD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CACrC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAClD,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CACxD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;IACJ,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI;QAC3C,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;QAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;KAC3C,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalHistoryIndexNode,\n  type PrincipalPolicyHistoryReferenceProof,\n  principalHistoryIndexLeaf,\n  type ReferencedPrincipalHead,\n  resolvePrincipalHistoryIndexProof,\n  type VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryEvidenceTables,\n  principalHistoryNodes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface PrincipalHistoryEvidencePage {\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly {\n    readonly leafHash: string;\n    readonly entryJson: string;\n  }[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\n/** Prepare only a page accepted by the signature/authorization verifier. */\nexport async function preparePrincipalHistoryEvidencePage(input: {\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}): Promise<PrincipalHistoryEvidencePage> {\n  if (\n    input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n    input.nodes.length > 2 * PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal evidence page exceeds its batch budget\",\n    );\n  const owned = structuredClone(input);\n  return {\n    ...owned,\n    entries: await Promise.all(\n      owned.entries.map(async (entry) => ({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        entryJson: JSON.stringify(entry),\n      })),\n    ),\n  };\n}\n\n/** Publish in the same guarded transaction as the accepted page's progress. */\nexport async function writePrincipalHistoryEvidencePage(\n  tx: ClientSQLiteTransactionScope,\n  page: PrincipalHistoryEvidencePage,\n): Promise<void> {\n  const scope = { scopeId: page.scopeId, organizationId: page.organizationId };\n  for (const entry of [...page.entries].sort((a, b) =>\n    compareCanonicalStrings(a.leafHash, b.leafHash),\n  )) {\n    const row = { ...scope, ...entry };\n    await tx\n      .insert(principalHistoryEntries)\n      .values(row)\n      .onConflictDoUpdate({\n        target: [\n          principalHistoryEntries.scopeId,\n          principalHistoryEntries.leafHash,\n        ],\n        set: row,\n      })\n      .run();\n  }\n  for (const node of [...page.nodes].sort((a, b) =>\n    compareCanonicalStrings(a.hash, b.hash),\n  )) {\n    const row = { ...scope, ...node };\n    await tx\n      .insert(principalHistoryNodes)\n      .values(row)\n      .onConflictDoUpdate({\n        target: [principalHistoryNodes.scopeId, principalHistoryNodes.hash],\n        set: row,\n      })\n      .run();\n  }\n}\n\n/** Returns untrusted material. The caller must verify it against the issued root. */\nexport async function loadPrincipalHistoryReference(input: {\n  readonly execSql: ExecSql;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly version: number;\n  readonly expectedReference?: ReferencedPrincipalHead | undefined;\n}): Promise<PrincipalPolicyHistoryReferenceProof> {\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(input.execSql);\n  const resolved = await resolvePrincipalHistoryIndexProof({\n    rootHash: input.history.indexRootHash,\n    treeSize: input.history.currentEntry.state.version,\n    version: input.version,\n    readNode: async (hash) => {\n      const [row] = await db\n        .select()\n        .from(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, input.scopeId),\n            eq(principalHistoryNodes.hash, hash),\n          ),\n        )\n        .limit(1);\n      return row ?? null;\n    },\n  });\n  const [row] = await db\n    .select()\n    .from(principalHistoryEntries)\n    .where(\n      and(\n        eq(principalHistoryEntries.scopeId, input.scopeId),\n        eq(principalHistoryEntries.leafHash, resolved.leafHash),\n      ),\n    )\n    .limit(1);\n  let entry: unknown;\n  try {\n    entry = row ? JSON.parse(row.entryJson) : null;\n  } catch {\n    entry = null;\n  }\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history entry is missing or corrupt\",\n    );\n  const reference = input.expectedReference ?? {\n    principalType: entry.state.principalType,\n    principalId: entry.state.principalId,\n    version: entry.state.version,\n    keyEpoch: entry.state.keyEpoch,\n    stateHash: entry.state.stateHash,\n    keyFingerprint: entry.state.keyFingerprint,\n  };\n  return { reference, entry, proof: resolved.proof };\n}\n"]}
+{"version":3,"file":"principalHistoryEvidencePersistence.js","sourceRoot":"","sources":["principalHistoryEvidencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAGlC,yBAAyB,EAEzB,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAalF,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,kCAAkC;QACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,kCAAkC;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,EAAgC,EAChC,IAAkC;IAElC,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClD,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAChD,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QACnC,MAAM,EAAE;aACL,MAAM,CAAC,uBAAuB,CAAC;aAC/B,MAAM,CAAC,GAAG,CAAC;aACX,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,uBAAuB,CAAC,OAAO;gBAC/B,uBAAuB,CAAC,QAAQ;aACjC;YACD,GAAG,EAAE,GAAG;SACT,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC/C,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACxC,EAAE,CAAC;QACF,MAAM,+BAA+B,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE;aACL,MAAM,CAAC,qBAAqB,CAAC;aAC7B,MAAM,CAAC,GAAG,CAAC;aACX,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC;YACnE,GAAG,EAAE,GAAG;SACT,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC;QACvD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CACrC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAClD,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CACxD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;IACJ,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI;QAC3C,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;QAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;KAC3C,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalHistoryIndexNode,\n  type PrincipalPolicyHistoryReferenceProof,\n  principalHistoryIndexLeaf,\n  type ReferencedPrincipalHead,\n  resolvePrincipalHistoryIndexProof,\n  type VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryEvidenceTables,\n  principalHistoryNodes,\n} from \"../sqlite/principalHistoryEvidenceSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { recordPrincipalHistoryNodeEdges } from \"./principalHistoryNodeRetention\";\n\nexport interface PrincipalHistoryEvidencePage {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly {\n    readonly leafHash: string;\n    readonly entryJson: string;\n  }[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\n/** Prepare only a page accepted by the signature/authorization verifier. */\nexport async function preparePrincipalHistoryEvidencePage(input: {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}): Promise<PrincipalHistoryEvidencePage> {\n  if (\n    input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n    input.nodes.length > 2 * PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal evidence page exceeds its batch budget\",\n    );\n  const owned = structuredClone(input);\n  return {\n    ...owned,\n    entries: await Promise.all(\n      owned.entries.map(async (entry) => ({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        entryJson: JSON.stringify(entry),\n      })),\n    ),\n  };\n}\n\n/** Publish in the same guarded transaction as the accepted page's progress. */\nexport async function writePrincipalHistoryEvidencePage(\n  tx: ClientSQLiteTransactionScope,\n  page: PrincipalHistoryEvidencePage,\n): Promise<void> {\n  const scope = { scopeId: page.scopeId, organizationId: page.organizationId };\n  for (const entry of [...page.entries].sort((a, b) =>\n    compareCanonicalStrings(a.leafHash, b.leafHash),\n  )) {\n    const row = { ...scope, ...entry };\n    await tx\n      .insert(principalHistoryEntries)\n      .values(row)\n      .onConflictDoUpdate({\n        target: [\n          principalHistoryEntries.scopeId,\n          principalHistoryEntries.leafHash,\n        ],\n        set: row,\n      })\n      .run();\n  }\n  for (const node of [...page.nodes].sort((a, b) =>\n    compareCanonicalStrings(a.hash, b.hash),\n  )) {\n    await recordPrincipalHistoryNodeEdges(tx, scope, node);\n    const row = { ...scope, ...node };\n    await tx\n      .insert(principalHistoryNodes)\n      .values(row)\n      .onConflictDoUpdate({\n        target: [principalHistoryNodes.scopeId, principalHistoryNodes.hash],\n        set: row,\n      })\n      .run();\n  }\n}\n\n/** Returns untrusted material. The caller must verify it against the issued root. */\nexport async function loadPrincipalHistoryReference(input: {\n  readonly execSql: ExecSql;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly version: number;\n  readonly expectedReference?: ReferencedPrincipalHead | undefined;\n}): Promise<PrincipalPolicyHistoryReferenceProof> {\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(input.execSql);\n  const resolved = await resolvePrincipalHistoryIndexProof({\n    rootHash: input.history.indexRootHash,\n    treeSize: input.history.currentEntry.state.version,\n    version: input.version,\n    readNode: async (hash) => {\n      const [row] = await db\n        .select()\n        .from(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, input.scopeId),\n            eq(principalHistoryNodes.hash, hash),\n          ),\n        )\n        .limit(1);\n      return row ?? null;\n    },\n  });\n  const [row] = await db\n    .select()\n    .from(principalHistoryEntries)\n    .where(\n      and(\n        eq(principalHistoryEntries.scopeId, input.scopeId),\n        eq(principalHistoryEntries.leafHash, resolved.leafHash),\n      ),\n    )\n    .limit(1);\n  let entry: unknown;\n  try {\n    entry = row ? JSON.parse(row.entryJson) : null;\n  } catch {\n    entry = null;\n  }\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history entry is missing or corrupt\",\n    );\n  const reference = input.expectedReference ?? {\n    principalType: entry.state.principalType,\n    principalId: entry.state.principalId,\n    version: entry.state.version,\n    keyEpoch: entry.state.keyEpoch,\n    stateHash: entry.state.stateHash,\n    keyFingerprint: entry.state.keyFingerprint,\n  };\n  return { reference, entry, proof: resolved.proof };\n}\n"]}

package/data/persistence/principalHistoryIncompleteRetention.js

@@ -0,0 +1,32 @@
+import { and, asc, desc, eq, inArray, ne } from "drizzle-orm";
+import { principalHistoryStageScopes } from "../sqlite/principalHistoryRetentionSchema.js";
+import { principalHistoryStages } from "../sqlite/principalHistoryStageSchema.js";
+import { releasePrincipalHistoryRoot } from "./principalHistoryRootOwnership.js";
+const INCOMPLETE_STAGE_LIMIT = 8;
+const RECLAIM_BATCH_LIMIT = 16;
+/** Disposable work only: completed artifacts and trust pins are unaffected. */
+export async function reclaimIncompletePrincipalHistoryStages(tx, current) {
+    const obsolete = await tx
+        .select({ id: principalHistoryStages.id })
+        .from(principalHistoryStageScopes)
+        .innerJoin(principalHistoryStages, eq(principalHistoryStageScopes.id, principalHistoryStages.id))
+        .where(and(eq(principalHistoryStageScopes.scopeId, current.scopeId), eq(principalHistoryStageScopes.organizationId, current.organizationId), eq(principalHistoryStageScopes.complete, false), eq(principalHistoryStages.organizationId, current.organizationId), eq(principalHistoryStages.complete, false), ne(principalHistoryStageScopes.id, current.id)))
+        .orderBy(desc(principalHistoryStageScopes.touchedAt), asc(principalHistoryStageScopes.id))
+        // The writer always keeps its own stage, even when recency hints tie.
+        .offset(INCOMPLETE_STAGE_LIMIT - (current.complete ? 0 : 1))
+        .limit(RECLAIM_BATCH_LIMIT);
+    const ids = obsolete.map(({ id }) => id);
+    for (const id of ids)
+        await releasePrincipalHistoryRoot(tx, `stage:${id}`);
+    if (ids.length === 0)
+        return;
+    await tx
+        .delete(principalHistoryStages)
+        .where(inArray(principalHistoryStages.id, ids))
+        .run();
+    await tx
+        .delete(principalHistoryStageScopes)
+        .where(inArray(principalHistoryStageScopes.id, ids))
+        .run();
+}
+//# sourceMappingURL=principalHistoryIncompleteRetention.js.map

package/data/persistence/principalHistoryIncompleteRetention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryIncompleteRetention.js","sourceRoot":"","sources":["principalHistoryIncompleteRetention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAE9E,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,EAAgC,EAChC,OAKC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC;SACzC,IAAI,CAAC,2BAA2B,CAAC;SACjC,SAAS,CACR,sBAAsB,EACtB,EAAE,CAAC,2BAA2B,CAAC,EAAE,EAAE,sBAAsB,CAAC,EAAE,CAAC,CAC9D;SACA,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACxD,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,EACtE,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,EAC/C,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,EACjE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAC1C,EAAE,CAAC,2BAA2B,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAC/C,CACF;SACA,OAAO,CACN,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAC3C,GAAG,CAAC,2BAA2B,CAAC,EAAE,CAAC,CACpC;QACD,sEAAsE;SACrE,MAAM,CAAC,sBAAsB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3D,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,MAAM,2BAA2B,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7B,MAAM,EAAE;SACL,MAAM,CAAC,sBAAsB,CAAC;SAC9B,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;SAC9C,GAAG,EAAE,CAAC;IACT,MAAM,EAAE;SACL,MAAM,CAAC,2BAA2B,CAAC;SACnC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;SACnD,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import { and, asc, desc, eq, inArray, ne } from \"drizzle-orm\";\nimport { principalHistoryStageScopes } from \"../sqlite/principalHistoryRetentionSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { releasePrincipalHistoryRoot } from \"./principalHistoryRootOwnership\";\n\nconst INCOMPLETE_STAGE_LIMIT = 8;\nconst RECLAIM_BATCH_LIMIT = 16;\n\n/** Disposable work only: completed artifacts and trust pins are unaffected. */\nexport async function reclaimIncompletePrincipalHistoryStages(\n  tx: ClientSQLiteTransactionScope,\n  current: {\n    readonly id: string;\n    readonly scopeId: string;\n    readonly organizationId: string;\n    readonly complete: boolean;\n  },\n) {\n  const obsolete = await tx\n    .select({ id: principalHistoryStages.id })\n    .from(principalHistoryStageScopes)\n    .innerJoin(\n      principalHistoryStages,\n      eq(principalHistoryStageScopes.id, principalHistoryStages.id),\n    )\n    .where(\n      and(\n        eq(principalHistoryStageScopes.scopeId, current.scopeId),\n        eq(principalHistoryStageScopes.organizationId, current.organizationId),\n        eq(principalHistoryStageScopes.complete, false),\n        eq(principalHistoryStages.organizationId, current.organizationId),\n        eq(principalHistoryStages.complete, false),\n        ne(principalHistoryStageScopes.id, current.id),\n      ),\n    )\n    .orderBy(\n      desc(principalHistoryStageScopes.touchedAt),\n      asc(principalHistoryStageScopes.id),\n    )\n    // The writer always keeps its own stage, even when recency hints tie.\n    .offset(INCOMPLETE_STAGE_LIMIT - (current.complete ? 0 : 1))\n    .limit(RECLAIM_BATCH_LIMIT);\n  const ids = obsolete.map(({ id }) => id);\n  for (const id of ids) await releasePrincipalHistoryRoot(tx, `stage:${id}`);\n  if (ids.length === 0) return;\n  await tx\n    .delete(principalHistoryStages)\n    .where(inArray(principalHistoryStages.id, ids))\n    .run();\n  await tx\n    .delete(principalHistoryStageScopes)\n    .where(inArray(principalHistoryStageScopes.id, ids))\n    .run();\n}\n"]}

package/data/persistence/principalHistoryNodeRetention.js

@@ -0,0 +1,76 @@
+import { and, asc, eq } from "drizzle-orm";
+import { principalHistoryNodes } from "../sqlite/principalHistoryEvidenceSchema.js";
+import { principalHistoryNodeReferences } from "../sqlite/principalHistoryNodeRetentionSchema.js";
+import { decrementPrincipalHistoryNodeReference, incrementPrincipalHistoryNodeReference, } from "./principalHistoryRootOwnership.js";
+/** Register edges before inserting their proof node, preserving pre-index evidence. */
+export async function recordPrincipalHistoryNodeEdges(tx, scope, node) {
+    const key = and(eq(principalHistoryNodeReferences.scopeId, scope.scopeId), eq(principalHistoryNodeReferences.hash, node.hash));
+    const [previous] = await tx
+        .select()
+        .from(principalHistoryNodeReferences)
+        .where(key)
+        .limit(1);
+    if (previous?.leftHash === node.leftHash &&
+        previous.rightHash === node.rightHash)
+        return;
+    const [existing] = await tx
+        .select({ hash: principalHistoryNodes.hash })
+        .from(principalHistoryNodes)
+        .where(and(eq(principalHistoryNodes.scopeId, scope.scopeId), eq(principalHistoryNodes.hash, node.hash)))
+        .limit(1);
+    for (const hash of [node.leftHash, node.rightHash])
+        await incrementPrincipalHistoryNodeReference(tx, scope, hash);
+    await tx
+        .insert(principalHistoryNodeReferences)
+        .values({
+        ...scope,
+        ...node,
+        referenceCount: previous?.referenceCount ?? 0,
+        managed: previous?.managed || !existing,
+    })
+        .onConflictDoUpdate({
+        target: [
+            principalHistoryNodeReferences.scopeId,
+            principalHistoryNodeReferences.hash,
+        ],
+        set: {
+            leftHash: node.leftHash,
+            rightHash: node.rightHash,
+            managed: previous?.managed || !existing,
+        },
+    })
+        .run();
+    for (const hash of [previous?.leftHash, previous?.rightHash])
+        if (hash)
+            await decrementPrincipalHistoryNodeReference(tx, scope, hash);
+}
+/** A bounded cascade releases only managed proof nodes with no live incoming edge. */
+export async function reclaimPrincipalHistoryNodes(tx, scope) {
+    let reclaimed = 0;
+    while (reclaimed < 64) {
+        const obsolete = await tx
+            .select()
+            .from(principalHistoryNodeReferences)
+            .where(and(eq(principalHistoryNodeReferences.scopeId, scope.scopeId), eq(principalHistoryNodeReferences.organizationId, scope.organizationId), eq(principalHistoryNodeReferences.managed, true), eq(principalHistoryNodeReferences.referenceCount, 0)))
+            .orderBy(asc(principalHistoryNodeReferences.hash))
+            .limit(64 - reclaimed);
+        if (obsolete.length === 0)
+            break;
+        for (const node of obsolete) {
+            await tx
+                .delete(principalHistoryNodes)
+                .where(and(eq(principalHistoryNodes.scopeId, scope.scopeId), eq(principalHistoryNodes.organizationId, scope.organizationId), eq(principalHistoryNodes.hash, node.hash)))
+                .run();
+            await tx
+                .delete(principalHistoryNodeReferences)
+                .where(and(eq(principalHistoryNodeReferences.scopeId, scope.scopeId), eq(principalHistoryNodeReferences.hash, node.hash)))
+                .run();
+            for (const hash of [node.leftHash, node.rightHash])
+                if (hash)
+                    await decrementPrincipalHistoryNodeReference(tx, scope, hash);
+            reclaimed += 1;
+        }
+    }
+    return reclaimed;
+}
+//# sourceMappingURL=principalHistoryNodeRetention.js.map