@tearleads/client-sdk 0.1.19 → 0.1.21

package/workflows/principals/loadRecoveredPrincipalHistoryPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadRecoveredPrincipalHistoryPage.js","sourceRoot":"","sources":["loadRecoveredPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,EACL,iCAAiC,GAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mCAAmC,EAAE,MAAM,wCAAwC,CAAC;AAE7F,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAStD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA6C,EAC7C,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;IAEhD,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAA6C,EAC7C,aAAqB;IAErB,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,IAAI,CAAC;QAClB,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QAEhD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QACjE,MAAM,IAAI,iCAAiC,CACzC,mEAAmE,CACpE,CAAC;IACJ,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAC/B,iBAAiB,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO;QACP,OAAO;QACP,OAAO;KACR,CAAC,CAAC;IACL,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,aAAa,GAAG,mCAAmC,CACpD,CAAC;IACF,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KACE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,EAC3C,OAAO,GAAG,aAAa,EACvB,OAAO,IAAI,CAAC,EACZ,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,mBAAmB;QACnB,mBAAmB,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,SAAS;QAEjE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8DAA8D,CAC/D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,8BAA8B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,OAAO,IAAI,YAAY,IAAI,KAAK,CAAC,OAAO,GAAG,aAAa,CACjE;QACD,WAAW,EACT,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,CAAC,CAAC,IAAI,IAAI;QAC1E,iBAAiB,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAA6C,EAC7C,UAAqE;IAErE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA0D;IAE1D,IAAI,CAAC;QACH,OAAO,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAqC;IAErC,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA6C,EAC7C,OAAsB;IAEtB,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO;QACV,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,UAAU;YACrB,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;SACtD;KACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,UAAU,EAAE,UAAU,CAAC,UAAU;KAClC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,UAAU,EACV;QACE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;QACjD,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;KAC9C,EACD,OAAO,CACR,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryReferenceProof,\n  type PrincipalPolicyStateChainEntry,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { principalHistoryVerificationContext } from \"./principalHistoryRecoveryVerification\";\n\nexport const PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE = 32;\n\nexport interface RecoveredPrincipalHistoryPage {\n  /** Ascending entries, with the immediate predecessor kept separately for diffs. */\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly predecessor: PrincipalPolicyStateChainEntryResponse | null;\n  readonly nextBeforeVersion: number | null;\n}\n\n/** Read a bounded historical window from an already recovered, exact private root. */\nexport async function loadRecoveredPrincipalHistoryPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion = options.expectedHead.version + 1,\n): Promise<RecoveredPrincipalHistoryPage> {\n  const owned = {\n    ...options,\n    expectedHead: structuredClone(options.expectedHead),\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    return await readPage(owned, beforeVersion);\n  } finally {\n    owned.protection.localKey.fill(0);\n  }\n}\n\nasync function readPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion: number,\n): Promise<RecoveredPrincipalHistoryPage> {\n  if (\n    !Number.isSafeInteger(beforeVersion) ||\n    beforeVersion <= 1 ||\n    beforeVersion > options.expectedHead.version + 1\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal history page cursor is outside the selected history\",\n    );\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const { scopeId, history } = await restoreReadRoot(options, current);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.expectedHead.principalType,\n    options.expectedHead.principalId,\n  );\n  if (checkpoint && checkpoint.version > options.expectedHead.version)\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Principal checkpoint advanced beyond the selected display history\",\n    );\n  const load = (version: number) =>\n    loadPageReference({\n      execSql: options.execSql,\n      scopeId,\n      history,\n      version,\n    });\n  const firstVersion = Math.max(\n    1,\n    beforeVersion - PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE,\n  );\n  const references: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (\n    let version = Math.max(1, firstVersion - 1);\n    version < beforeVersion;\n    version += 1\n  ) {\n    assertProjectionVerificationCurrent(current);\n    references.push(await load(version));\n  }\n  const checkpointReference = checkpoint\n    ? await load(checkpoint.version)\n    : undefined;\n  if (\n    checkpointReference &&\n    checkpointReference.reference.stateHash !== checkpoint?.stateHash\n  )\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Principal history page conflicts with its durable checkpoint\",\n    );\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history,\n    references,\n    checkpointReference,\n  });\n  if (!selected.ok)\n    throw new PrincipalHistoryEvidenceUnavailableError(selected.error);\n  await assertDisplayCheckpointCurrent(options, checkpoint);\n  assertProjectionVerificationCurrent(current);\n  // These exact rows passed inclusion and commitment verification above. Keep\n  // their display-only server timestamps, which the private current strips.\n  const retained = references.map(({ entry }) => responseEntry(entry));\n  return {\n    entries: retained.filter(\n      ({ state }) =>\n        state.version >= firstVersion && state.version < beforeVersion,\n    ),\n    predecessor:\n      retained.find(({ state }) => state.version === firstVersion - 1) ?? null,\n    nextBeforeVersion: firstVersion > 1 ? firstVersion : null,\n  };\n}\n\nasync function assertDisplayCheckpointCurrent(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  checkpoint: Awaited<ReturnType<typeof loadPrincipalPolicyCheckpoint>>,\n) {\n  const latest = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.expectedHead.principalType,\n    options.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Principal checkpoint changed while reading display history\",\n    );\n}\n\nasync function loadPageReference(\n  input: Parameters<typeof loadPrincipalHistoryReference>[0],\n) {\n  try {\n    return await loadPrincipalHistoryReference(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n}\n\nfunction responseEntry(\n  entry: PrincipalPolicyStateChainEntry,\n): PrincipalPolicyStateChainEntryResponse {\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history display metadata is unavailable\",\n    );\n  return entry;\n}\n\nasync function restoreReadRoot(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  current: () => boolean,\n) {\n  const normalized = {\n    ...options,\n    protection: {\n      ...options.protection,\n      context: principalHistoryVerificationContext(options),\n    },\n  };\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: options.organizationId,\n    head: options.expectedHead,\n    protection: normalized.protection,\n  });\n  const prefix = await loadVerifiedPrincipalHistoryPrefix(\n    normalized,\n    {\n      principalType: options.expectedHead.principalType,\n      principalId: options.expectedHead.principalId,\n    },\n    scopeId,\n  );\n  assertProjectionVerificationCurrent(current);\n  if (!prefix)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history page requires a recovered private prefix\",\n    );\n  const finished = prefix.verifier.finish(options.expectedHead);\n  if (!finished.ok) throw finished.error;\n  return { scopeId, history: finished.value };\n}\n"]}
+{"version":3,"file":"loadRecoveredPrincipalHistoryPage.js","sourceRoot":"","sources":["loadRecoveredPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,GAEpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,EACL,iCAAiC,GAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mCAAmC,EAAE,MAAM,wCAAwC,CAAC;AAS7F,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA6C,EAC7C,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;IAEhD,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAA6C,EAC7C,aAAqB;IAErB,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,IAAI,CAAC;QAClB,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QAEhD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QACjE,MAAM,IAAI,iCAAiC,CACzC,mEAAmE,CACpE,CAAC;IACJ,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAC/B,iBAAiB,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO;QACP,OAAO;QACP,OAAO;KACR,CAAC,CAAC;IACL,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,aAAa,GAAG,mCAAmC,CACpD,CAAC;IACF,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KACE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,EAC3C,OAAO,GAAG,aAAa,EACvB,OAAO,IAAI,CAAC,EACZ,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,mBAAmB;QACnB,mBAAmB,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,SAAS;QAEjE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8DAA8D,CAC/D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,8BAA8B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,OAAO,IAAI,YAAY,IAAI,KAAK,CAAC,OAAO,GAAG,aAAa,CACjE;QACD,WAAW,EACT,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,CAAC,CAAC,IAAI,IAAI;QAC1E,iBAAiB,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAA6C,EAC7C,UAAqE;IAErE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA0D;IAE1D,IAAI,CAAC;QACH,OAAO,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAqC;IAErC,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA6C,EAC7C,OAAsB;IAEtB,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO;QACV,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,UAAU;YACrB,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;SACtD;KACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,UAAU,EAAE,UAAU,CAAC,UAAU;KAClC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,UAAU,EACV;QACE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;QACjD,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;KAC9C,EACD,OAAO,CACR,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryReferenceProof,\n  type PrincipalPolicyStateChainEntry,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { principalHistoryVerificationContext } from \"./principalHistoryRecoveryVerification\";\n\nexport interface RecoveredPrincipalHistoryPage {\n  /** Ascending entries, with the immediate predecessor kept separately for diffs. */\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly predecessor: PrincipalPolicyStateChainEntryResponse | null;\n  readonly nextBeforeVersion: number | null;\n}\n\n/** Read a bounded historical window from an already recovered, exact private root. */\nexport async function loadRecoveredPrincipalHistoryPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion = options.expectedHead.version + 1,\n): Promise<RecoveredPrincipalHistoryPage> {\n  const owned = {\n    ...options,\n    expectedHead: structuredClone(options.expectedHead),\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    return await readPage(owned, beforeVersion);\n  } finally {\n    owned.protection.localKey.fill(0);\n  }\n}\n\nasync function readPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion: number,\n): Promise<RecoveredPrincipalHistoryPage> {\n  if (\n    !Number.isSafeInteger(beforeVersion) ||\n    beforeVersion <= 1 ||\n    beforeVersion > options.expectedHead.version + 1\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal history page cursor is outside the selected history\",\n    );\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const { scopeId, history } = await restoreReadRoot(options, current);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.expectedHead.principalType,\n    options.expectedHead.principalId,\n  );\n  if (checkpoint && checkpoint.version > options.expectedHead.version)\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Principal checkpoint advanced beyond the selected display history\",\n    );\n  const load = (version: number) =>\n    loadPageReference({\n      execSql: options.execSql,\n      scopeId,\n      history,\n      version,\n    });\n  const firstVersion = Math.max(\n    1,\n    beforeVersion - PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE,\n  );\n  const references: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (\n    let version = Math.max(1, firstVersion - 1);\n    version < beforeVersion;\n    version += 1\n  ) {\n    assertProjectionVerificationCurrent(current);\n    references.push(await load(version));\n  }\n  const checkpointReference = checkpoint\n    ? await load(checkpoint.version)\n    : undefined;\n  if (\n    checkpointReference &&\n    checkpointReference.reference.stateHash !== checkpoint?.stateHash\n  )\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Principal history page conflicts with its durable checkpoint\",\n    );\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history,\n    references,\n    checkpointReference,\n  });\n  if (!selected.ok)\n    throw new PrincipalHistoryEvidenceUnavailableError(selected.error);\n  await assertDisplayCheckpointCurrent(options, checkpoint);\n  assertProjectionVerificationCurrent(current);\n  // These exact rows passed inclusion and commitment verification above. Keep\n  // their display-only server timestamps, which the private current strips.\n  const retained = references.map(({ entry }) => responseEntry(entry));\n  return {\n    entries: retained.filter(\n      ({ state }) =>\n        state.version >= firstVersion && state.version < beforeVersion,\n    ),\n    predecessor:\n      retained.find(({ state }) => state.version === firstVersion - 1) ?? null,\n    nextBeforeVersion: firstVersion > 1 ? firstVersion : null,\n  };\n}\n\nasync function assertDisplayCheckpointCurrent(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  checkpoint: Awaited<ReturnType<typeof loadPrincipalPolicyCheckpoint>>,\n) {\n  const latest = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.expectedHead.principalType,\n    options.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Principal checkpoint changed while reading display history\",\n    );\n}\n\nasync function loadPageReference(\n  input: Parameters<typeof loadPrincipalHistoryReference>[0],\n) {\n  try {\n    return await loadPrincipalHistoryReference(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n}\n\nfunction responseEntry(\n  entry: PrincipalPolicyStateChainEntry,\n): PrincipalPolicyStateChainEntryResponse {\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history display metadata is unavailable\",\n    );\n  return entry;\n}\n\nasync function restoreReadRoot(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  current: () => boolean,\n) {\n  const normalized = {\n    ...options,\n    protection: {\n      ...options.protection,\n      context: principalHistoryVerificationContext(options),\n    },\n  };\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: options.organizationId,\n    head: options.expectedHead,\n    protection: normalized.protection,\n  });\n  const prefix = await loadVerifiedPrincipalHistoryPrefix(\n    normalized,\n    {\n      principalType: options.expectedHead.principalType,\n      principalId: options.expectedHead.principalId,\n    },\n    scopeId,\n  );\n  assertProjectionVerificationCurrent(current);\n  if (!prefix)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history page requires a recovered private prefix\",\n    );\n  const finished = prefix.verifier.finish(options.expectedHead);\n  if (!finished.ok) throw finished.error;\n  return { scopeId, history: finished.value };\n}\n"]}

package/workflows/principals/policyRepair.js

@@ -0,0 +1,38 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from "../../internal/validators/util/index.js";
+import { verifiedPrincipalPolicyContainsReference } from "../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { assertProjectionVerificationCurrent, } from "../../data/keyingProjectionVerification/types.js";
+/** Recover advisory repair heads; the consuming mutation still admits its pins. */
+export async function recoverPrincipalPolicyRepair(input) {
+    // Keep the requested organization and lifetime stable across host callbacks.
+    input = { ...input };
+    const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;
+    if (!input.heads?.length || !resolve || input.stillCurrent?.() === false)
+        return false;
+    if (input.heads.length > PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT)
+        throw new RangeError("Principal policy repair head limit exceeded");
+    const heads = input.heads.map((head) => ({ ...head }));
+    const recoveryBatch = {};
+    const recovered = [];
+    const assertCurrent = () => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        for (const result of recovered)
+            assertProjectionVerificationCurrent(result.stillCurrent);
+    };
+    for (const reference of heads) {
+        assertCurrent();
+        const result = await resolve({
+            recoveryBatch,
+            organizationId: input.organizationId,
+            reference: { ...reference },
+            stillCurrent: input.stillCurrent,
+        });
+        recovered.push(result);
+        assertCurrent();
+        if (result.organizationId !== input.organizationId ||
+            !verifiedPrincipalPolicyContainsReference(result.policy, reference))
+            throw new KeyingVerificationError("object_mismatch", "Recovered repair evidence does not contain the requested scoped head");
+    }
+    return true;
+}
+//# sourceMappingURL=policyRepair.js.map

package/workflows/principals/policyRepair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyRepair.js","sourceRoot":"","sources":["policyRepair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,wCAAwC,EAAE,MAAM,8DAA8D,CAAC;AACxH,OAAO,EACL,mCAAmC,GAGpC,MAAM,+CAA+C,CAAC;AAEvD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,6EAA6E;IAC7E,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,KAAK,CAAC,+BAA+B,EAAE,gBAAgB,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QACtE,OAAO,KAAK,CAAC;IACf,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,kCAAkC;QACzD,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,MAAM,SAAS,GAAsC,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,KAAK,MAAM,MAAM,IAAI,SAAS;YAC5B,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,aAAa,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,aAAa;YACb,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE;YAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,aAAa,EAAE,CAAC;QAChB,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC9C,CAAC,wCAAwC,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;YAEnE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sEAAsE,CACvE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { ReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT } from \"@tearleads/validators/util\";\nimport { verifiedPrincipalPolicyContainsReference } from \"../../data/keyingProjectionVerification/principalPolicyCache\";\nimport {\n  assertProjectionVerificationCurrent,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"../../data/keyingProjectionVerification/types\";\n\n/** Recover advisory repair heads; the consuming mutation still admits its pins. */\nexport async function recoverPrincipalPolicyRepair(input: {\n  readonly heads: readonly ReferencedPrincipalStateResponse[] | undefined;\n  readonly organizationId: string;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  // Keep the requested organization and lifetime stable across host callbacks.\n  input = { ...input };\n  const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;\n  if (!input.heads?.length || !resolve || input.stillCurrent?.() === false)\n    return false;\n  if (input.heads.length > PRINCIPAL_POLICY_REPAIR_HEAD_LIMIT)\n    throw new RangeError(\"Principal policy repair head limit exceeded\");\n  const heads = input.heads.map((head) => ({ ...head }));\n  const recoveryBatch = {};\n  const recovered: ResolvedPrincipalPolicyEvidence[] = [];\n  const assertCurrent = () => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    for (const result of recovered)\n      assertProjectionVerificationCurrent(result.stillCurrent);\n  };\n  for (const reference of heads) {\n    assertCurrent();\n    const result = await resolve({\n      recoveryBatch,\n      organizationId: input.organizationId,\n      reference: { ...reference },\n      stillCurrent: input.stillCurrent,\n    });\n    recovered.push(result);\n    assertCurrent();\n    if (\n      result.organizationId !== input.organizationId ||\n      !verifiedPrincipalPolicyContainsReference(result.policy, reference)\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Recovered repair evidence does not contain the requested scoped head\",\n      );\n  }\n  return true;\n}\n"]}

package/workflows/principals/policyRepairBudget.d.ts

@@ -1,7 +1,7 @@
-import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import type { ReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
 /** Bounded repair of paged stale-policy replies; identical pages never loop. */
 export declare class PrincipalPolicyRepairBudget {
     private attempts;
     private readonly seen;
-    take(bundles: readonly PrincipalPolicyBundleResponse[] | undefined): boolean;
+    take(references: readonly ReferencedPrincipalStateResponse[] | undefined): boolean;
 }

package/workflows/principals/policyRepairBudget.js

@@ -2,10 +2,10 @@
 export class PrincipalPolicyRepairBudget {
     attempts = 0;
     seen = new Set();
-    take(bundles) {
-        if (!bundles?.length || this.attempts >= 16)
+    take(references) {
+        if (!references?.length || this.attempts >= 16)
             return false;
-        const heads = bundles.map(({ currentState }) => `${currentState.principalType}:${currentState.principalId}:${currentState.stateHash}`);
+        const heads = references.map((head) => `${head.principalType}:${head.principalId}:${head.stateHash}`);
         if (heads.every((head) => this.seen.has(head)))
             return false;
         this.attempts++;

package/workflows/principals/policyRepairBudget.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyRepairBudget.js","sourceRoot":"","sources":["policyRepairBudget.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,MAAM,OAAO,2BAA2B;IAC9B,QAAQ,GAAG,CAAC,CAAC;IACJ,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,IAAI,CAAC,OAA6D;QAChE,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACvB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CACnB,GAAG,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,SAAS,EAAE,CACxF,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\n/** Bounded repair of paged stale-policy replies; identical pages never loop. */\nexport class PrincipalPolicyRepairBudget {\n  private attempts = 0;\n  private readonly seen = new Set<string>();\n\n  take(bundles: readonly PrincipalPolicyBundleResponse[] | undefined): boolean {\n    if (!bundles?.length || this.attempts >= 16) return false;\n    const heads = bundles.map(\n      ({ currentState }) =>\n        `${currentState.principalType}:${currentState.principalId}:${currentState.stateHash}`,\n    );\n    if (heads.every((head) => this.seen.has(head))) return false;\n    this.attempts++;\n    for (const head of heads) this.seen.add(head);\n    return true;\n  }\n}\n"]}
+{"version":3,"file":"policyRepairBudget.js","sourceRoot":"","sources":["policyRepairBudget.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,MAAM,OAAO,2BAA2B;IAC9B,QAAQ,GAAG,CAAC,CAAC;IACJ,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,IAAI,CACF,UAAmE;QAEnE,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,EAAE,CACxE,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import type { ReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\n\n/** Bounded repair of paged stale-policy replies; identical pages never loop. */\nexport class PrincipalPolicyRepairBudget {\n  private attempts = 0;\n  private readonly seen = new Set<string>();\n\n  take(\n    references: readonly ReferencedPrincipalStateResponse[] | undefined,\n  ): boolean {\n    if (!references?.length || this.attempts >= 16) return false;\n    const heads = references.map(\n      (head) => `${head.principalType}:${head.principalId}:${head.stateHash}`,\n    );\n    if (heads.every((head) => this.seen.has(head))) return false;\n    this.attempts++;\n    for (const head of heads) this.seen.add(head);\n    return true;\n  }\n}\n"]}

package/workflows/principals/principalHistoryRecoveryPrefix.js

@@ -56,7 +56,11 @@ export async function publishReusablePrincipalHistoryPrefix(options, scopeId, ve
     const sealed = await verifier.exportProgress(await principalHistoryPrefixProtection(options.protection, prefix));
     if (!sealed.ok)
         throw sealed.error;
+    const history = verifier.finish(options.expectedHead);
+    if (!history.ok)
+        throw history.error;
     await savePrincipalHistoryPrefix({
+        indexRootHash: history.value.indexRootHash,
         execSql: options.execSql,
         prefix: { ...prefix, progress: sealed.value },
         stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),

package/workflows/principals/principalHistoryRecoveryPrefix.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryRecoveryPrefix.js","sourceRoot":"","sources":["principalHistoryRecoveryPrefix.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAG1G,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAmE,EACnE,YAAyC,EACzC,OAAe;IAMf,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC/C,kCAAkC,CAAC,IAAI,CAAC;QACxC,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QACjD,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC7C,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAC9B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,MAAM,OAAO,GAAG,iCAAiC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO;YAC1D,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,YAAyC,EACzC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,OAAO,EACP,YAAY,EACZ,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAC/D,OAAO,IAAI,CAAC;IACd,IACE,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAClD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE;QAE/C,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACrD,yEAAyE;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,OAAe,EACf,QAAwC,EACxC,OAAmC;IAEnC,MAAM,MAAM,GAAG;QACb,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,OAAO;QACrC,QAAQ,EAAE,4BAA4B,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CACnE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,0BAA0B,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryVerifier,\n  type ReferencedPrincipalHead,\n  restorePrincipalPolicyHistoryVerifier,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport {\n  discardPrincipalHistoryPrefix,\n  loadPrincipalHistoryPrefix,\n  savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHistoryPrefixProtection } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { parsePrincipalHistoryStageCurrent } from \"../../data/principals/principalHistoryStageProtection\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport async function loadVerifiedPrincipalHistoryPrefix(\n  options: Omit<RecoverPrincipalPolicyHistoryOptions, \"expectedHead\">,\n  historyInput: PrincipalPolicyHistoryInput,\n  scopeId: string,\n): Promise<{\n  verifier: PrincipalPolicyHistoryVerifier;\n  head: ReferencedPrincipalHead;\n  current: PrincipalPolicyPageCurrent;\n} | null> {\n  const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);\n  if (!saved) return null;\n  let head: unknown;\n  try {\n    head = JSON.parse(saved.headJson);\n  } catch {\n    head = null;\n  }\n  if (\n    saved.organizationId === options.organizationId &&\n    isReferencedPrincipalStateResponse(head) &&\n    head.principalType === historyInput.principalType &&\n    head.principalId === historyInput.principalId &&\n    head.version === saved.version\n  ) {\n    const restored = await restorePrincipalPolicyHistoryVerifier(\n      historyInput,\n      saved.progress,\n      await principalHistoryPrefixProtection(options.protection, saved),\n    );\n    const current = parsePrincipalHistoryStageCurrent({\n      currentJson: saved.currentJson,\n      afterVersion: saved.version - 1,\n    });\n    if (restored.ok && restored.value.finish(head).ok && current)\n      return { verifier: restored.value, head, current };\n  }\n  await discardPrincipalHistoryPrefix({\n    execSql: options.execSql,\n    prefix: saved,\n    stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n  });\n  return null;\n}\n\nexport async function restoreReusablePrincipalHistoryPrefix(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  historyInput: PrincipalPolicyHistoryInput,\n  scopeId: string,\n) {\n  const prefix = await loadVerifiedPrincipalHistoryPrefix(\n    options,\n    historyInput,\n    scopeId,\n  );\n  if (!prefix || prefix.head.version > options.expectedHead.version)\n    return null;\n  if (\n    prefix.head.version < options.expectedHead.version ||\n    prefix.verifier.finish(options.expectedHead).ok\n  )\n    return { ...prefix, version: prefix.head.version };\n  // An incompatible target cannot erase an independently valid local hint.\n  return null;\n}\n\n/** The verifier must use stable empty selection/checkpoint inputs. */\nexport async function publishReusablePrincipalHistoryPrefix(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  scopeId: string,\n  verifier: PrincipalPolicyHistoryVerifier,\n  current: PrincipalPolicyPageCurrent,\n): Promise<void> {\n  const prefix = {\n    scopeId,\n    organizationId: options.organizationId,\n    version: options.expectedHead.version,\n    headJson: serializeKeyingCanonicalJson({ ...options.expectedHead }),\n    currentJson: JSON.stringify(current),\n  };\n  const sealed = await verifier.exportProgress(\n    await principalHistoryPrefixProtection(options.protection, prefix),\n  );\n  if (!sealed.ok) throw sealed.error;\n  await savePrincipalHistoryPrefix({\n    execSql: options.execSql,\n    prefix: { ...prefix, progress: sealed.value },\n    stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n  });\n}\n"]}
+{"version":3,"file":"principalHistoryRecoveryPrefix.js","sourceRoot":"","sources":["principalHistoryRecoveryPrefix.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAG1G,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAmE,EACnE,YAAyC,EACzC,OAAe;IAMf,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC/C,kCAAkC,CAAC,IAAI,CAAC;QACxC,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QACjD,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC7C,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAC9B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,MAAM,OAAO,GAAG,iCAAiC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO;YAC1D,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,YAAyC,EACzC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,OAAO,EACP,YAAY,EACZ,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAC/D,OAAO,IAAI,CAAC;IACd,IACE,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAClD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE;QAE/C,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACrD,yEAAyE;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,OAAe,EACf,QAAwC,EACxC,OAAmC;IAEnC,MAAM,MAAM,GAAG;QACb,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,OAAO;QACrC,QAAQ,EAAE,4BAA4B,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CACnE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,0BAA0B,CAAC;QAC/B,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryVerifier,\n  type ReferencedPrincipalHead,\n  restorePrincipalPolicyHistoryVerifier,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport {\n  discardPrincipalHistoryPrefix,\n  loadPrincipalHistoryPrefix,\n  savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHistoryPrefixProtection } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { parsePrincipalHistoryStageCurrent } from \"../../data/principals/principalHistoryStageProtection\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport async function loadVerifiedPrincipalHistoryPrefix(\n  options: Omit<RecoverPrincipalPolicyHistoryOptions, \"expectedHead\">,\n  historyInput: PrincipalPolicyHistoryInput,\n  scopeId: string,\n): Promise<{\n  verifier: PrincipalPolicyHistoryVerifier;\n  head: ReferencedPrincipalHead;\n  current: PrincipalPolicyPageCurrent;\n} | null> {\n  const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);\n  if (!saved) return null;\n  let head: unknown;\n  try {\n    head = JSON.parse(saved.headJson);\n  } catch {\n    head = null;\n  }\n  if (\n    saved.organizationId === options.organizationId &&\n    isReferencedPrincipalStateResponse(head) &&\n    head.principalType === historyInput.principalType &&\n    head.principalId === historyInput.principalId &&\n    head.version === saved.version\n  ) {\n    const restored = await restorePrincipalPolicyHistoryVerifier(\n      historyInput,\n      saved.progress,\n      await principalHistoryPrefixProtection(options.protection, saved),\n    );\n    const current = parsePrincipalHistoryStageCurrent({\n      currentJson: saved.currentJson,\n      afterVersion: saved.version - 1,\n    });\n    if (restored.ok && restored.value.finish(head).ok && current)\n      return { verifier: restored.value, head, current };\n  }\n  await discardPrincipalHistoryPrefix({\n    execSql: options.execSql,\n    prefix: saved,\n    stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n  });\n  return null;\n}\n\nexport async function restoreReusablePrincipalHistoryPrefix(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  historyInput: PrincipalPolicyHistoryInput,\n  scopeId: string,\n) {\n  const prefix = await loadVerifiedPrincipalHistoryPrefix(\n    options,\n    historyInput,\n    scopeId,\n  );\n  if (!prefix || prefix.head.version > options.expectedHead.version)\n    return null;\n  if (\n    prefix.head.version < options.expectedHead.version ||\n    prefix.verifier.finish(options.expectedHead).ok\n  )\n    return { ...prefix, version: prefix.head.version };\n  // An incompatible target cannot erase an independently valid local hint.\n  return null;\n}\n\n/** The verifier must use stable empty selection/checkpoint inputs. */\nexport async function publishReusablePrincipalHistoryPrefix(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  scopeId: string,\n  verifier: PrincipalPolicyHistoryVerifier,\n  current: PrincipalPolicyPageCurrent,\n): Promise<void> {\n  const prefix = {\n    scopeId,\n    organizationId: options.organizationId,\n    version: options.expectedHead.version,\n    headJson: serializeKeyingCanonicalJson({ ...options.expectedHead }),\n    currentJson: JSON.stringify(current),\n  };\n  const sealed = await verifier.exportProgress(\n    await principalHistoryPrefixProtection(options.protection, prefix),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const history = verifier.finish(options.expectedHead);\n  if (!history.ok) throw history.error;\n  await savePrincipalHistoryPrefix({\n    indexRootHash: history.value.indexRootHash,\n    execSql: options.execSql,\n    prefix: { ...prefix, progress: sealed.value },\n    stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n  });\n}\n"]}

package/workflows/principals/principalRecoveryLocalPreference.js

@@ -4,7 +4,7 @@ import { principalHeadMatchesReference } from "../../data/principals/organizatio
 import { PrincipalHistoryRecoveryRaceError } from "./principalHistoryRecoveryTypes.js";
 import { recoverWithPrincipalOutageFallback } from "./principalRecoveryOutage.js";
 /** Reuse exact current artifacts, or a proved historical page within a newer prefix. */
-export async function recoverWithPrincipalLocalPreference(recover, options, preferLocalCurrent) {
+export async function recoverWithPrincipalLocalPreference(recover, options, preferLocalCurrent, allowHistoricalReference = false) {
     if (preferLocalCurrent && !options.offline) {
         try {
             const local = await recover({
@@ -12,7 +12,8 @@ export async function recoverWithPrincipalLocalPreference(recover, options, pref
                 offline: true,
             });
             assertProjectionVerificationCurrent(options.stillCurrent);
-            if (options.historyPage ||
+            if (allowHistoricalReference ||
+                options.historyPage ||
                 principalHeadMatchesReference(local.policy.state, options.reference))
                 return local;
         }

package/workflows/principals/principalRecoveryLocalPreference.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalRecoveryLocalPreference.js","sourceRoot":"","sources":["principalRecoveryLocalPreference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAG/E,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAAmD,EACnD,OAAkE,EAClE,kBAA2B;IAE3B,IAAI,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;gBAC1B,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,IACE,OAAO,CAAC,WAAW;gBACnB,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC;gBAEpE,OAAO,KAAK,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,IACE,CAAC,CAAC,KAAK,YAAY,iCAAiC,CAAC;gBACrD,CAAC,CACC,KAAK,YAAY,uBAAuB;oBACxC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CACpC;gBAED,MAAM,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { PrincipalHistoryRecoveryRaceError } from \"./principalHistoryRecoveryTypes\";\nimport { recoverWithPrincipalOutageFallback } from \"./principalRecoveryOutage\";\nimport type { recoverScopedPrincipalPolicyHistory } from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Reuse exact current artifacts, or a proved historical page within a newer prefix. */\nexport async function recoverWithPrincipalLocalPreference(\n  recover: typeof recoverScopedPrincipalPolicyHistory,\n  options: Parameters<typeof recoverScopedPrincipalPolicyHistory>[0],\n  preferLocalCurrent: boolean,\n) {\n  if (preferLocalCurrent && !options.offline) {\n    try {\n      const local = await recover({\n        ...options,\n        offline: true,\n      });\n      assertProjectionVerificationCurrent(options.stillCurrent);\n      if (\n        options.historyPage ||\n        principalHeadMatchesReference(local.policy.state, options.reference)\n      )\n        return local;\n    } catch (error) {\n      assertProjectionVerificationCurrent(options.stillCurrent);\n      if (\n        !(error instanceof PrincipalHistoryRecoveryRaceError) &&\n        !(\n          error instanceof KeyingVerificationError &&\n          error.code === \"missing_dependency\"\n        )\n      )\n        throw error;\n    }\n  }\n  return recoverWithPrincipalOutageFallback(recover, options);\n}\n"]}
+{"version":3,"file":"principalRecoveryLocalPreference.js","sourceRoot":"","sources":["principalRecoveryLocalPreference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAG/E,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAAmD,EACnD,OAAkE,EAClE,kBAA2B,EAC3B,wBAAwB,GAAG,KAAK;IAEhC,IAAI,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;gBAC1B,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,IACE,wBAAwB;gBACxB,OAAO,CAAC,WAAW;gBACnB,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC;gBAEpE,OAAO,KAAK,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,IACE,CAAC,CAAC,KAAK,YAAY,iCAAiC,CAAC;gBACrD,CAAC,CACC,KAAK,YAAY,uBAAuB;oBACxC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CACpC;gBAED,MAAM,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { PrincipalHistoryRecoveryRaceError } from \"./principalHistoryRecoveryTypes\";\nimport { recoverWithPrincipalOutageFallback } from \"./principalRecoveryOutage\";\nimport type { recoverScopedPrincipalPolicyHistory } from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Reuse exact current artifacts, or a proved historical page within a newer prefix. */\nexport async function recoverWithPrincipalLocalPreference(\n  recover: typeof recoverScopedPrincipalPolicyHistory,\n  options: Parameters<typeof recoverScopedPrincipalPolicyHistory>[0],\n  preferLocalCurrent: boolean,\n  allowHistoricalReference = false,\n) {\n  if (preferLocalCurrent && !options.offline) {\n    try {\n      const local = await recover({\n        ...options,\n        offline: true,\n      });\n      assertProjectionVerificationCurrent(options.stillCurrent);\n      if (\n        allowHistoricalReference ||\n        options.historyPage ||\n        principalHeadMatchesReference(local.policy.state, options.reference)\n      )\n        return local;\n    } catch (error) {\n      assertProjectionVerificationCurrent(options.stillCurrent);\n      if (\n        !(error instanceof PrincipalHistoryRecoveryRaceError) &&\n        !(\n          error instanceof KeyingVerificationError &&\n          error.code === \"missing_dependency\"\n        )\n      )\n        throw error;\n    }\n  }\n  return recoverWithPrincipalOutageFallback(recover, options);\n}\n"]}

package/workflows/principals/publicPrincipalHistoryPage.js

@@ -67,6 +67,7 @@ export async function appendPublicPrincipalHistoryPage(input, progress, page) {
         execSql: input.execSql,
         stage: saved,
         evidence: await preparePrincipalHistoryEvidencePage({
+            indexRootHash: appended.value.indexRootHash,
             scopeId: progress.scopeId,
             organizationId: input.organizationId,
             entries,

package/workflows/principals/publicPrincipalHistoryPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicPrincipalHistoryPage.js","sourceRoot":"","sources":["publicPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAM3C,MAAM,OAAO,6CAA8C,SAAQ,KAAK;IACjD;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,+CAA+C,CAAC;IAC9D,CAAC;CACF;AAED,SAAS,0BAA0B,CACjC,KAAoC,EACpC,OAAkD;IAElD,IACE,KAAK,CAAC,YAAY;QAClB,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4DAA4D,CAC7D,CAAC;IACJ,IACE,OAAO,CAAC,IAAI,CACV,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CACjE;QAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAoC,EACpC,QAAwC,EACxC,IAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAClC,MAAM,EAAE,IAAI,CAAC,aAAa;SAC3B,CAAC,CAAC;IACL,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,IAAI;QACZ,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,6DAA6D,CAC9D,CAAC;IACJ,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/C,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,6CAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,0BAA0B,CACrC,+BAA+B,CAAC,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC,CACzE;QACD,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,GAAG,CACJ,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjD,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAClD,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK;QACL,kBAAkB,EAAE,+BAA+B,CACjD,QAAQ,CAAC,kBAAkB,EAC3B,UAAU,CACX;QACD,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicySnapshotPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { savePrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport {\n  loadPublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  publicHistoryAuthorityReference,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nexport class PublicPrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PublicPrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\nfunction assertPublicAuthorityScope(\n  input: PublicPrincipalHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (\n    input.strictAdmins &&\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Public Admins history must contain only direct admin users\",\n    );\n  if (\n    entries.some(\n      ({ state }) =>\n        state.externalAuthority &&\n        state.externalAuthority.principalId !== input.authorityGroupId,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history cites an authority outside its directory binding\",\n    );\n}\n\nexport async function appendPublicPrincipalHistoryPage(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  page: PrincipalPolicySnapshotPageResponse,\n): Promise<PublicPrincipalHistoryProgress> {\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  const complete = page.historyPage.nextAfterVersion === null;\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: page.currentState,\n      projection: page.currentProjection,\n      grants: page.currentGrants,\n    });\n  assertPublicAuthorityScope(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: page,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Public history signer identity is unavailable or mismatched\",\n    );\n  const references = entries.flatMap(({ state }) =>\n    state.externalAuthority ? [state.externalAuthority] : [],\n  );\n  const externalAuthority = await loadPublicHistoryAuthority(input, references);\n  assertProjectionVerificationCurrent(stillCurrent);\n  const appended = await progress.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PublicPrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const row = {\n    id: progress.id,\n    organizationId: input.organizationId,\n    currentJson: publicHistoryAuthorityJson(\n      publicHistoryAuthorityReference(progress.authorityReference, references),\n    ),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.source.head,\n      row,\n    ),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const saved = { ...row, progress: sealed.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      scopeId: progress.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: progress.saved?.progress ?? null,\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return {\n    ...progress,\n    afterVersion: row.afterVersion,\n    saved,\n    authorityReference: publicHistoryAuthorityReference(\n      progress.authorityReference,\n      references,\n    ),\n    completedHead: complete ? input.source.head : null,\n  };\n}\n"]}
+{"version":3,"file":"publicPrincipalHistoryPage.js","sourceRoot":"","sources":["publicPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAM3C,MAAM,OAAO,6CAA8C,SAAQ,KAAK;IACjD;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,+CAA+C,CAAC;IAC9D,CAAC;CACF;AAED,SAAS,0BAA0B,CACjC,KAAoC,EACpC,OAAkD;IAElD,IACE,KAAK,CAAC,YAAY;QAClB,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4DAA4D,CAC7D,CAAC;IACJ,IACE,OAAO,CAAC,IAAI,CACV,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CACjE;QAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAoC,EACpC,QAAwC,EACxC,IAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAClC,MAAM,EAAE,IAAI,CAAC,aAAa;SAC3B,CAAC,CAAC;IACL,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,IAAI;QACZ,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,6DAA6D,CAC9D,CAAC;IACJ,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/C,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,6CAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,0BAA0B,CACrC,+BAA+B,CAAC,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC,CACzE;QACD,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,GAAG,CACJ,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjD,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAClD,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK;QACL,kBAAkB,EAAE,+BAA+B,CACjD,QAAQ,CAAC,kBAAkB,EAC3B,UAAU,CACX;QACD,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicySnapshotPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { savePrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport {\n  loadPublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  publicHistoryAuthorityReference,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nexport class PublicPrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PublicPrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\nfunction assertPublicAuthorityScope(\n  input: PublicPrincipalHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (\n    input.strictAdmins &&\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Public Admins history must contain only direct admin users\",\n    );\n  if (\n    entries.some(\n      ({ state }) =>\n        state.externalAuthority &&\n        state.externalAuthority.principalId !== input.authorityGroupId,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history cites an authority outside its directory binding\",\n    );\n}\n\nexport async function appendPublicPrincipalHistoryPage(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  page: PrincipalPolicySnapshotPageResponse,\n): Promise<PublicPrincipalHistoryProgress> {\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  const complete = page.historyPage.nextAfterVersion === null;\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: page.currentState,\n      projection: page.currentProjection,\n      grants: page.currentGrants,\n    });\n  assertPublicAuthorityScope(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: page,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Public history signer identity is unavailable or mismatched\",\n    );\n  const references = entries.flatMap(({ state }) =>\n    state.externalAuthority ? [state.externalAuthority] : [],\n  );\n  const externalAuthority = await loadPublicHistoryAuthority(input, references);\n  assertProjectionVerificationCurrent(stillCurrent);\n  const appended = await progress.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PublicPrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const row = {\n    id: progress.id,\n    organizationId: input.organizationId,\n    currentJson: publicHistoryAuthorityJson(\n      publicHistoryAuthorityReference(progress.authorityReference, references),\n    ),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.source.head,\n      row,\n    ),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const saved = { ...row, progress: sealed.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      indexRootHash: appended.value.indexRootHash,\n      scopeId: progress.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: progress.saved?.progress ?? null,\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return {\n    ...progress,\n    afterVersion: row.afterVersion,\n    saved,\n    authorityReference: publicHistoryAuthorityReference(\n      progress.authorityReference,\n      references,\n    ),\n    completedHead: complete ? input.source.head : null,\n  };\n}\n"]}

package/workflows/principals/publicPrincipalHistoryProgress.js

@@ -167,6 +167,7 @@ export async function publishPublicPrincipalHistoryPrefix(input, progress, histo
             : await rejectedCompletedPrefix(input, progress, history));
     const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();
     await savePrincipalHistoryPrefix({
+        indexRootHash: history.indexRootHash,
         execSql: input.execSql,
         prefix: { ...prefix, progress: sealed.value },
         stillCurrent,

package/workflows/principals/publicPrincipalHistoryProgress.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicPrincipalHistoryProgress.js","sourceRoot":"","sources":["publicPrincipalHistoryProgress.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,qCAAqC,EACrC,4BAA4B,EAE5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAE1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,sCAAsC,EACtC,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAM3C,KAAK,UAAU,mBAAmB,CAChC,KAAoC,EACpC,OAAe,EACf,EAAU,EACV,MAAqC;IAErC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC9C,kBAAkB,KAAK,SAAS;YAChC,kCAAkC,CAAC,UAAU,CAAC;YAC9C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAC3C,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC/C,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EACrC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,MAAM,CAAC,QAAQ,EACf,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBACxE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;oBACrE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;oBAC5D,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,MAAM;oBACpB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,6BAA6B,CAAC;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM;gBACN,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAoC,EACpC,UAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,IAAI,EACJ,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IACE,UAAU;YACV,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC7C,kBAAkB,KAAK,SAAS,EAChC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CACrE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvE,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBAChE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK;oBACL,YAAY,EAAE,IAAI;oBAClB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,OAAO,EACP,EAAE,EACF,MAAM,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CACzD,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,CAAC;QACf,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,uBAAuB,CACpC,KAAoC,EACpC,QAAwC,EACxC,OAAuC;IAEvC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QACvE,OAAO,IAAI,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,EAAE,EACX,SAAS,CACV,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,UAAU,EAAE,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACxE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,uBAAuB;YACxC,KAAK,YAAY,sCAAsC;YAEvD,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAoC,EACpC,QAAwC,EACxC,OAAuC,EACvC,cAA6C;IAE7C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,4BAA4B,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACrE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,QAAQ,GACZ,cAAc;QACd,CAAC,QAAQ,CAAC,YAAY;YACpB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,0BAA0B,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY;QACZ,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK;QAChB,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,KAAK,EACd,YAAY,CACb,CAAC;AACN,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  restorePrincipalPolicyHistoryVerifier,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyHistory,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryPrefix,\n  loadPrincipalHistoryPrefix,\n  type PrincipalHistoryPrefix,\n  savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalHistoryEvidenceScopeId,\n  principalHistoryPrefixProtection,\n} from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport {\n  PublicHistoryAuthorityUnavailableError,\n  parsePublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  validatePublicHistoryAuthority,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nasync function restorePublicPrefix(\n  input: PublicPrincipalHistoryOptions,\n  scopeId: string,\n  id: string,\n  prefix: PrincipalHistoryPrefix | null,\n): Promise<PublicPrincipalHistoryProgress | null> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  if (prefix) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      prefix.currentJson,\n    );\n    let prefixHead: unknown;\n    try {\n      prefixHead = JSON.parse(prefix.headJson);\n    } catch {\n      prefixHead = null;\n    }\n    if (\n      prefix.organizationId === input.organizationId &&\n      authorityReference !== undefined &&\n      isReferencedPrincipalStateResponse(prefixHead) &&\n      prefixHead.principalId === head.principalId &&\n      prefixHead.principalType === head.principalType &&\n      prefixHead.version === prefix.version\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        prefix.progress,\n        await principalHistoryPrefixProtection(input.protection, prefix),\n      );\n      if (restored.ok && restored.value.finish(prefixHead).ok) {\n        await validatePublicHistoryAuthority(input, authorityReference, prefix);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: prefixHead.version >= head.version ? prefixHead : null,\n          afterVersion: Math.min(prefixHead.version, head.version - 1),\n          saved: null,\n          cachedPrefix: prefix,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryPrefix({\n        execSql: input.execSql,\n        prefix,\n        stillCurrent: current,\n      });\n  }\n  return null;\n}\n\nexport async function restorePublicPrincipalHistoryProgress(\n  input: PublicPrincipalHistoryOptions,\n  allowReuse: boolean,\n): Promise<PublicPrincipalHistoryProgress> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    head,\n    input.protection.context,\n  );\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      saved.currentJson,\n    );\n    if (\n      allowReuse &&\n      saved.organizationId === input.organizationId &&\n      authorityReference !== undefined\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(input.protection, head, saved),\n      );\n      if (restored.ok && (!saved.complete || restored.value.finish(head).ok)) {\n        await validatePublicHistoryAuthority(input, authorityReference);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: saved.complete ? head : null,\n          afterVersion: saved.afterVersion,\n          saved,\n          cachedPrefix: null,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryStage(input.execSql, saved, current);\n  }\n  if (allowReuse) {\n    const prefix = await restorePublicPrefix(\n      input,\n      scopeId,\n      id,\n      await loadPrincipalHistoryPrefix(input.execSql, scopeId),\n    );\n    if (prefix) return prefix;\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    completedHead: null,\n    afterVersion: 0,\n    saved: null,\n    cachedPrefix: null,\n    authorityReference: null,\n  };\n}\n\n/** A resumed stage may finish after the reader that rejected the prefix exits. */\nasync function rejectedCompletedPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n): Promise<PrincipalHistoryPrefix | null> {\n  const candidate = await loadPrincipalHistoryPrefix(\n    input.execSql,\n    progress.scopeId,\n  );\n  if (!candidate || candidate.version <= history.currentEntry.state.version)\n    return null;\n  try {\n    const cached = await restorePublicPrefix(\n      input,\n      progress.scopeId,\n      progress.id,\n      candidate,\n    );\n    if (!cached?.completedHead) return null;\n    const finished = cached.verifier.finish(cached.completedHead);\n    if (!finished.ok) throw finished.error;\n    const proof = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId: progress.scopeId,\n      history: finished.value,\n      version: input.source.head.version,\n    });\n    const verified = await verifyPrincipalPolicyHistoryReferences({\n      history: finished.value,\n      references: [proof],\n    });\n    if (!verified.ok) throw verified.error;\n    return principalHeadMatchesReference(proof.entry.state, input.source.head)\n      ? null\n      : candidate;\n  } catch (error) {\n    if (\n      error instanceof KeyingVerificationError ||\n      error instanceof PublicHistoryAuthorityUnavailableError\n    )\n      return candidate;\n    throw error;\n  }\n}\n\nexport async function publishPublicPrincipalHistoryPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n  rejectedPrefix: PrincipalHistoryPrefix | null,\n): Promise<void> {\n  const state = history.currentEntry.state;\n  const head = {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n  const prefix = {\n    scopeId: progress.scopeId,\n    organizationId: input.organizationId,\n    version: head.version,\n    headJson: serializeKeyingCanonicalJson(head),\n    currentJson: publicHistoryAuthorityJson(progress.authorityReference),\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryPrefixProtection(input.protection, prefix),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const rejected =\n    rejectedPrefix ??\n    (progress.cachedPrefix\n      ? null\n      : await rejectedCompletedPrefix(input, progress, history));\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  await savePrincipalHistoryPrefix({\n    execSql: input.execSql,\n    prefix: { ...prefix, progress: sealed.value },\n    stillCurrent,\n    rejectedPrefix: rejected,\n  });\n  if (progress.saved)\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      progress.saved,\n      stillCurrent,\n    );\n}\n"]}
+{"version":3,"file":"publicPrincipalHistoryProgress.js","sourceRoot":"","sources":["publicPrincipalHistoryProgress.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,qCAAqC,EACrC,4BAA4B,EAE5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAE1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,sCAAsC,EACtC,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAM3C,KAAK,UAAU,mBAAmB,CAChC,KAAoC,EACpC,OAAe,EACf,EAAU,EACV,MAAqC;IAErC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC9C,kBAAkB,KAAK,SAAS;YAChC,kCAAkC,CAAC,UAAU,CAAC;YAC9C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAC3C,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC/C,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EACrC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,MAAM,CAAC,QAAQ,EACf,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBACxE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;oBACrE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;oBAC5D,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,MAAM;oBACpB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,6BAA6B,CAAC;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM;gBACN,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAAoC,EACpC,UAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,IAAI,EACJ,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,KAAK,EACL,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IACE,UAAU;YACV,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC7C,kBAAkB,KAAK,SAAS,EAChC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CACrE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvE,MAAM,8BAA8B,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBAChE,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK;oBACL,YAAY,EAAE,IAAI;oBAClB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,OAAO,EACP,EAAE,EACF,MAAM,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CACzD,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,CAAC;QACf,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,uBAAuB,CACpC,KAAoC,EACpC,QAAwC,EACxC,OAAuC;IAEvC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QACvE,OAAO,IAAI,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,EACL,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,EAAE,EACX,SAAS,CACV,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,UAAU,EAAE,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACxE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,uBAAuB;YACxC,KAAK,YAAY,sCAAsC;YAEvD,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAoC,EACpC,QAAwC,EACxC,OAAuC,EACvC,cAA6C;IAE7C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,4BAA4B,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACrE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,gCAAgC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,QAAQ,GACZ,cAAc;QACd,CAAC,QAAQ,CAAC,YAAY;YACpB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,0BAA0B,CAAC;QAC/B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY;QACZ,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK;QAChB,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,KAAK,EACd,YAAY,CACb,CAAC;AACN,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  restorePrincipalPolicyHistoryVerifier,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyHistory,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryPrefix,\n  loadPrincipalHistoryPrefix,\n  type PrincipalHistoryPrefix,\n  savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  loadPrincipalHistoryStage,\n} from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalHistoryEvidenceScopeId,\n  principalHistoryPrefixProtection,\n} from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport {\n  PublicHistoryAuthorityUnavailableError,\n  parsePublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  validatePublicHistoryAuthority,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nasync function restorePublicPrefix(\n  input: PublicPrincipalHistoryOptions,\n  scopeId: string,\n  id: string,\n  prefix: PrincipalHistoryPrefix | null,\n): Promise<PublicPrincipalHistoryProgress | null> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  if (prefix) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      prefix.currentJson,\n    );\n    let prefixHead: unknown;\n    try {\n      prefixHead = JSON.parse(prefix.headJson);\n    } catch {\n      prefixHead = null;\n    }\n    if (\n      prefix.organizationId === input.organizationId &&\n      authorityReference !== undefined &&\n      isReferencedPrincipalStateResponse(prefixHead) &&\n      prefixHead.principalId === head.principalId &&\n      prefixHead.principalType === head.principalType &&\n      prefixHead.version === prefix.version\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        prefix.progress,\n        await principalHistoryPrefixProtection(input.protection, prefix),\n      );\n      if (restored.ok && restored.value.finish(prefixHead).ok) {\n        await validatePublicHistoryAuthority(input, authorityReference, prefix);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: prefixHead.version >= head.version ? prefixHead : null,\n          afterVersion: Math.min(prefixHead.version, head.version - 1),\n          saved: null,\n          cachedPrefix: prefix,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryPrefix({\n        execSql: input.execSql,\n        prefix,\n        stillCurrent: current,\n      });\n  }\n  return null;\n}\n\nexport async function restorePublicPrincipalHistoryProgress(\n  input: PublicPrincipalHistoryOptions,\n  allowReuse: boolean,\n): Promise<PublicPrincipalHistoryProgress> {\n  const head = input.source.head;\n  const historyInput = {\n    principalType: head.principalType,\n    principalId: head.principalId,\n  };\n  const scopeId = await principalHistoryEvidenceScopeId({\n    organizationId: input.organizationId,\n    head,\n    protection: input.protection,\n  });\n  const id = await principalHistoryStageId(\n    input.organizationId,\n    head,\n    input.protection.context,\n  );\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  const saved = await loadPrincipalHistoryStage(input.execSql, id);\n  if (saved) {\n    const authorityReference = parsePublicHistoryAuthority(\n      input,\n      saved.currentJson,\n    );\n    if (\n      allowReuse &&\n      saved.organizationId === input.organizationId &&\n      authorityReference !== undefined\n    ) {\n      const restored = await restorePrincipalPolicyHistoryVerifier(\n        historyInput,\n        saved.progress,\n        await principalHistoryStageProtection(input.protection, head, saved),\n      );\n      if (restored.ok && (!saved.complete || restored.value.finish(head).ok)) {\n        await validatePublicHistoryAuthority(input, authorityReference);\n        return {\n          id,\n          scopeId,\n          verifier: restored.value,\n          completedHead: saved.complete ? head : null,\n          afterVersion: saved.afterVersion,\n          saved,\n          cachedPrefix: null,\n          authorityReference,\n        };\n      }\n    }\n    if (!input.offline)\n      await discardPrincipalHistoryStage(input.execSql, saved, current);\n  }\n  if (allowReuse) {\n    const prefix = await restorePublicPrefix(\n      input,\n      scopeId,\n      id,\n      await loadPrincipalHistoryPrefix(input.execSql, scopeId),\n    );\n    if (prefix) return prefix;\n  }\n  return {\n    id,\n    scopeId,\n    verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n    completedHead: null,\n    afterVersion: 0,\n    saved: null,\n    cachedPrefix: null,\n    authorityReference: null,\n  };\n}\n\n/** A resumed stage may finish after the reader that rejected the prefix exits. */\nasync function rejectedCompletedPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n): Promise<PrincipalHistoryPrefix | null> {\n  const candidate = await loadPrincipalHistoryPrefix(\n    input.execSql,\n    progress.scopeId,\n  );\n  if (!candidate || candidate.version <= history.currentEntry.state.version)\n    return null;\n  try {\n    const cached = await restorePublicPrefix(\n      input,\n      progress.scopeId,\n      progress.id,\n      candidate,\n    );\n    if (!cached?.completedHead) return null;\n    const finished = cached.verifier.finish(cached.completedHead);\n    if (!finished.ok) throw finished.error;\n    const proof = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId: progress.scopeId,\n      history: finished.value,\n      version: input.source.head.version,\n    });\n    const verified = await verifyPrincipalPolicyHistoryReferences({\n      history: finished.value,\n      references: [proof],\n    });\n    if (!verified.ok) throw verified.error;\n    return principalHeadMatchesReference(proof.entry.state, input.source.head)\n      ? null\n      : candidate;\n  } catch (error) {\n    if (\n      error instanceof KeyingVerificationError ||\n      error instanceof PublicHistoryAuthorityUnavailableError\n    )\n      return candidate;\n    throw error;\n  }\n}\n\nexport async function publishPublicPrincipalHistoryPrefix(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  history: VerifiedPrincipalPolicyHistory,\n  rejectedPrefix: PrincipalHistoryPrefix | null,\n): Promise<void> {\n  const state = history.currentEntry.state;\n  const head = {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n  const prefix = {\n    scopeId: progress.scopeId,\n    organizationId: input.organizationId,\n    version: head.version,\n    headJson: serializeKeyingCanonicalJson(head),\n    currentJson: publicHistoryAuthorityJson(progress.authorityReference),\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryPrefixProtection(input.protection, prefix),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const rejected =\n    rejectedPrefix ??\n    (progress.cachedPrefix\n      ? null\n      : await rejectedCompletedPrefix(input, progress, history));\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  await savePrincipalHistoryPrefix({\n    indexRootHash: history.indexRootHash,\n    execSql: input.execSql,\n    prefix: { ...prefix, progress: sealed.value },\n    stillCurrent,\n    rejectedPrefix: rejected,\n  });\n  if (progress.saved)\n    await discardPrincipalHistoryStage(\n      input.execSql,\n      progress.saved,\n      stillCurrent,\n    );\n}\n"]}

package/workflows/principals/publicPrincipalHistoryTypes.d.ts

@@ -7,6 +7,8 @@ import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
 export interface PublicPrincipalHistoryOptions {
     readonly apiClient: Pick<ApiClient, "getProjectionPolicyHistoryPages">;
+    /** Terminal proof verification defers durable currency until all artifacts authenticate. */
+    readonly historicalProof?: boolean | undefined;
     readonly source: PrincipalPolicyHistorySourceResponse;
     readonly organizationId: string;
     readonly execSql: ExecSql;

package/workflows/principals/publicPrincipalHistoryTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicPrincipalHistoryTypes.js","sourceRoot":"","sources":["publicPrincipalHistoryTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyHistorySourceResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\nexport interface PublicPrincipalHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getProjectionPolicyHistoryPages\">;\n  readonly source: PrincipalPolicyHistorySourceResponse;\n  readonly organizationId: string;\n  readonly execSql: ExecSql;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n  readonly offline?: boolean | undefined;\n  /** Retry disposable evidence loss once from signatures, without reusing hints. */\n  readonly replay?: boolean | undefined;\n  readonly strictAdmins?: boolean | undefined;\n  /** Already verified organization binding; included in the protected cache scope. */\n  readonly authorityGroupId?: string | undefined;\n  readonly loadExternalAuthority?:\n    | ((\n        references: readonly ReferencedPrincipalHead[],\n        cachedPrefix?: boolean,\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n}\n\nexport interface PublicPrincipalHistoryProgress {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly completedHead: ReferencedPrincipalHead | null;\n  readonly afterVersion: number;\n  readonly saved: PrincipalHistoryStage | null;\n  readonly cachedPrefix: PrincipalHistoryPrefix | null;\n  readonly authorityReference: ReferencedPrincipalHead | null;\n}\n\n/** Public authorization only; caller must check directory binding and local pins. */\nexport interface RecoveredPublicPrincipalHistory {\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}\n"]}
+{"version":3,"file":"publicPrincipalHistoryTypes.js","sourceRoot":"","sources":["publicPrincipalHistoryTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyHistorySourceResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\n\nexport interface PublicPrincipalHistoryOptions {\n  readonly apiClient: Pick<ApiClient, \"getProjectionPolicyHistoryPages\">;\n  /** Terminal proof verification defers durable currency until all artifacts authenticate. */\n  readonly historicalProof?: boolean | undefined;\n  readonly source: PrincipalPolicyHistorySourceResponse;\n  readonly organizationId: string;\n  readonly execSql: ExecSql;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent: () => boolean;\n  readonly signal?: AbortSignal | undefined;\n  readonly offline?: boolean | undefined;\n  /** Retry disposable evidence loss once from signatures, without reusing hints. */\n  readonly replay?: boolean | undefined;\n  readonly strictAdmins?: boolean | undefined;\n  /** Already verified organization binding; included in the protected cache scope. */\n  readonly authorityGroupId?: string | undefined;\n  readonly loadExternalAuthority?:\n    | ((\n        references: readonly ReferencedPrincipalHead[],\n        cachedPrefix?: boolean,\n      ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n    | undefined;\n}\n\nexport interface PublicPrincipalHistoryProgress {\n  readonly id: string;\n  readonly scopeId: string;\n  readonly verifier: PrincipalPolicyHistoryVerifier;\n  readonly completedHead: ReferencedPrincipalHead | null;\n  readonly afterVersion: number;\n  readonly saved: PrincipalHistoryStage | null;\n  readonly cachedPrefix: PrincipalHistoryPrefix | null;\n  readonly authorityReference: ReferencedPrincipalHead | null;\n}\n\n/** Public authorization only; caller must check directory binding and local pins. */\nexport interface RecoveredPublicPrincipalHistory {\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}\n"]}

package/workflows/principals/publicProjectionPrincipal.js

@@ -16,6 +16,7 @@ export async function selectPublicProjectionPrincipal(principal, references = pr
             recovered: principal.recovered,
             references: [options.source.head, ...references],
             checkpoint,
+            deferCheckpointCheck: options.historicalProof,
             includeGenesis: options.source.head.principalType === "organization",
             stillCurrent: current,
         });

package/workflows/principals/publicProjectionPrincipal.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicProjectionPrincipal.js","sourceRoot":"","sources":["publicProjectionPrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAKhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAS9E,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAoC,EACpC,aAAiD,SAAS,CAAC,UAAU;IAErE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAChC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC;YAChD,UAAU;YACV,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc;YACpE,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAwC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC,iBAAiB,CAAC;QACzE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,SAAS,GAAG,MAAM,6BAA6B,CAAC;YACxD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,+BAA+B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAsC,EACtC,UAA8C;IAE9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;QACxD,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACrE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC;QACvD,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8BAA8B,OAAO,EAAE,CACxC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  RecoveredPublicPrincipalHistory,\n} from \"./publicPrincipalHistoryTypes\";\nimport { recoverPublicPrincipalHistory } from \"./recoverPublicPrincipalHistory\";\nimport { selectPublicPrincipalHistory } from \"./selectPublicPrincipalHistory\";\n\nexport interface PublicProjectionPrincipal {\n  readonly options: PublicPrincipalHistoryOptions;\n  readonly references: readonly ReferencedPrincipalHead[];\n  recovered: RecoveredPublicPrincipalHistory;\n  replayed: boolean;\n}\n\n/** The source head and every citation remain bound independently of a newer prefix. */\nexport async function selectPublicProjectionPrincipal(\n  principal: PublicProjectionPrincipal,\n  references: readonly ReferencedPrincipalHead[] = principal.references,\n) {\n  const { options } = principal;\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.source.head.principalType,\n    options.source.head.principalId,\n  );\n  try {\n    return await selectPublicPrincipalHistory({\n      execSql: options.execSql,\n      recovered: principal.recovered,\n      references: [options.source.head, ...references],\n      checkpoint,\n      includeGenesis: options.source.head.principalType === \"organization\",\n      stillCurrent: current,\n    });\n  } catch (error) {\n    if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))\n      throw error;\n    if (options.offline || principal.replayed) throw error.verificationError;\n    principal.replayed = true;\n    principal.recovered = await recoverPublicPrincipalHistory({\n      ...options,\n      replay: true,\n    });\n    return selectPublicProjectionPrincipal(principal, references);\n  }\n}\n\nexport async function recoverPublicProjectionPrincipal(\n  options: PublicPrincipalHistoryOptions,\n  references: readonly ReferencedPrincipalHead[],\n): Promise<PublicProjectionPrincipal> {\n  const selected = references.filter(\n    (head) =>\n      head.principalType === options.source.head.principalType &&\n      head.principalId === options.source.head.principalId,\n  );\n  if (selected.some((head) => head.version > options.source.head.version))\n    rejectPublicProjection(\"citation exceeds its supplied source head\");\n  const principal = {\n    options,\n    references: structuredClone(selected),\n    recovered: await recoverPublicPrincipalHistory(options),\n    replayed: false,\n  };\n  await selectPublicProjectionPrincipal(principal);\n  return principal;\n}\n\nexport function rejectPublicProjection(message: string): never {\n  throw new KeyingVerificationError(\n    \"object_mismatch\",\n    `Public projection history: ${message}`,\n  );\n}\n"]}
+{"version":3,"file":"publicProjectionPrincipal.js","sourceRoot":"","sources":["publicProjectionPrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAKhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAS9E,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAoC,EACpC,aAAiD,SAAS,CAAC,UAAU;IAErE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAChC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC;YAChD,UAAU;YACV,oBAAoB,EAAE,OAAO,CAAC,eAAe;YAC7C,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc;YACpE,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAwC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC,iBAAiB,CAAC;QACzE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,SAAS,GAAG,MAAM,6BAA6B,CAAC;YACxD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,+BAA+B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAsC,EACtC,UAA8C;IAE9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;QACxD,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACrE,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC;QACvD,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8BAA8B,OAAO,EAAE,CACxC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  RecoveredPublicPrincipalHistory,\n} from \"./publicPrincipalHistoryTypes\";\nimport { recoverPublicPrincipalHistory } from \"./recoverPublicPrincipalHistory\";\nimport { selectPublicPrincipalHistory } from \"./selectPublicPrincipalHistory\";\n\nexport interface PublicProjectionPrincipal {\n  readonly options: PublicPrincipalHistoryOptions;\n  readonly references: readonly ReferencedPrincipalHead[];\n  recovered: RecoveredPublicPrincipalHistory;\n  replayed: boolean;\n}\n\n/** The source head and every citation remain bound independently of a newer prefix. */\nexport async function selectPublicProjectionPrincipal(\n  principal: PublicProjectionPrincipal,\n  references: readonly ReferencedPrincipalHead[] = principal.references,\n) {\n  const { options } = principal;\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    options.execSql,\n    options.source.head.principalType,\n    options.source.head.principalId,\n  );\n  try {\n    return await selectPublicPrincipalHistory({\n      execSql: options.execSql,\n      recovered: principal.recovered,\n      references: [options.source.head, ...references],\n      checkpoint,\n      deferCheckpointCheck: options.historicalProof,\n      includeGenesis: options.source.head.principalType === \"organization\",\n      stillCurrent: current,\n    });\n  } catch (error) {\n    if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))\n      throw error;\n    if (options.offline || principal.replayed) throw error.verificationError;\n    principal.replayed = true;\n    principal.recovered = await recoverPublicPrincipalHistory({\n      ...options,\n      replay: true,\n    });\n    return selectPublicProjectionPrincipal(principal, references);\n  }\n}\n\nexport async function recoverPublicProjectionPrincipal(\n  options: PublicPrincipalHistoryOptions,\n  references: readonly ReferencedPrincipalHead[],\n): Promise<PublicProjectionPrincipal> {\n  const selected = references.filter(\n    (head) =>\n      head.principalType === options.source.head.principalType &&\n      head.principalId === options.source.head.principalId,\n  );\n  if (selected.some((head) => head.version > options.source.head.version))\n    rejectPublicProjection(\"citation exceeds its supplied source head\");\n  const principal = {\n    options,\n    references: structuredClone(selected),\n    recovered: await recoverPublicPrincipalHistory(options),\n    replayed: false,\n  };\n  await selectPublicProjectionPrincipal(principal);\n  return principal;\n}\n\nexport function rejectPublicProjection(message: string): never {\n  throw new KeyingVerificationError(\n    \"object_mismatch\",\n    `Public projection history: ${message}`,\n  );\n}\n"]}

package/workflows/principals/recoverPrincipalHistoryPage.js

@@ -1,5 +1,6 @@
 import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { loadRecoveredPrincipalHistoryPage, PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE, } from "./loadRecoveredPrincipalHistoryPage.js";
+import { PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE } from "../../internal/validators/response/index.js";
+import { loadRecoveredPrincipalHistoryPage } from "./loadRecoveredPrincipalHistoryPage.js";
 import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
 import { recoverPrincipalPolicyHistoryWithVersions } from "./recoverPrincipalPolicyHistory.js";
 /** Disposable page proof loss may replay signed pages once online, preserving durable pins. */

package/workflows/principals/recoverPrincipalHistoryPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoverPrincipalHistoryPage.js","sourceRoot":"","sources":["recoverPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAEhG,OAAO,EAAE,yCAAyC,EAAE,MAAM,iCAAiC,CAAC;AAE5F,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6C,EAC7C,aAAqB;IAErB,IAAI,CAAC;QACH,OAAO,MAAM,iCAAiC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAwC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,OAAO,CAAC,OAAO;YACjB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACN,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,aAAa,GAAG,mCAAmC,GAAG,CAAC,CACxD,CAAC;IACF,MAAM,yCAAyC,CAC7C,OAAO,EACP,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,CAC3E,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,iCAAiC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,YAAY,wCAAwC;YAC7D,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport {\n  loadRecoveredPrincipalHistoryPage,\n  PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE,\n} from \"./loadRecoveredPrincipalHistoryPage\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\nimport { recoverPrincipalPolicyHistoryWithVersions } from \"./recoverPrincipalPolicyHistory\";\n\n/** Disposable page proof loss may replay signed pages once online, preserving durable pins. */\nexport async function recoverPrincipalHistoryPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion: number,\n) {\n  try {\n    return await loadRecoveredPrincipalHistoryPage(options, beforeVersion);\n  } catch (error) {\n    if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))\n      throw error;\n    // A local-first display read must distinguish disposable proof damage\n    // from a durable fork or an invalid caller citation, which are not wrapped.\n    // Preserve that distinction so the online caller can replay signed pages.\n    if (options.offline)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Principal history display proof is unavailable\",\n      );\n  }\n  const first = Math.max(\n    1,\n    beforeVersion - PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE - 1,\n  );\n  await recoverPrincipalPolicyHistoryWithVersions(\n    options,\n    Array.from({ length: beforeVersion - first }, (_, index) => first + index),\n  );\n  try {\n    return await loadRecoveredPrincipalHistoryPage(options, beforeVersion);\n  } catch (error) {\n    throw error instanceof PrincipalHistoryEvidenceUnavailableError\n      ? error.verificationError\n      : error;\n  }\n}\n"]}
+{"version":3,"file":"recoverPrincipalHistoryPage.js","sourceRoot":"","sources":["recoverPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAEhG,OAAO,EAAE,yCAAyC,EAAE,MAAM,iCAAiC,CAAC;AAE5F,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6C,EAC7C,aAAqB;IAErB,IAAI,CAAC;QACH,OAAO,MAAM,iCAAiC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAwC,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,OAAO,CAAC,OAAO;YACjB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACN,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,aAAa,GAAG,mCAAmC,GAAG,CAAC,CACxD,CAAC;IACF,MAAM,yCAAyC,CAC7C,OAAO,EACP,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,CAC3E,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,iCAAiC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,YAAY,wCAAwC;YAC7D,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE } from \"@tearleads/validators/response\";\nimport { loadRecoveredPrincipalHistoryPage } from \"./loadRecoveredPrincipalHistoryPage\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\nimport { recoverPrincipalPolicyHistoryWithVersions } from \"./recoverPrincipalPolicyHistory\";\n\n/** Disposable page proof loss may replay signed pages once online, preserving durable pins. */\nexport async function recoverPrincipalHistoryPage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  beforeVersion: number,\n) {\n  try {\n    return await loadRecoveredPrincipalHistoryPage(options, beforeVersion);\n  } catch (error) {\n    if (!(error instanceof PrincipalHistoryEvidenceUnavailableError))\n      throw error;\n    // A local-first display read must distinguish disposable proof damage\n    // from a durable fork or an invalid caller citation, which are not wrapped.\n    // Preserve that distinction so the online caller can replay signed pages.\n    if (options.offline)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Principal history display proof is unavailable\",\n      );\n  }\n  const first = Math.max(\n    1,\n    beforeVersion - PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE - 1,\n  );\n  await recoverPrincipalPolicyHistoryWithVersions(\n    options,\n    Array.from({ length: beforeVersion - first }, (_, index) => first + index),\n  );\n  try {\n    return await loadRecoveredPrincipalHistoryPage(options, beforeVersion);\n  } catch (error) {\n    throw error instanceof PrincipalHistoryEvidenceUnavailableError\n      ? error.verificationError\n      : error;\n  }\n}\n"]}

package/workflows/principals/recoverPrincipalPolicyHistory.js

@@ -101,6 +101,7 @@ async function acceptPage(input, stage, response) {
         execSql: input.execSql,
         stage: saved,
         evidence: await preparePrincipalHistoryEvidencePage({
+            indexRootHash: appended.value.indexRootHash,
             scopeId: stage.scopeId,
             organizationId: input.organizationId,
             entries,