@tearleads/client-sdk 0.1.22 → 0.1.24

package/workflows/organizations/principalOperationReceipt.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalOperationReceipt.js","sourceRoot":"","sources":["principalOperationReceipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAIL,uCAAuC,EACvC,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EACL,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,4BAA4B,CAAC;AAQpC,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,QAAmC,EACnC,QAAmC;IAEnC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,SAAS;YACZ,IAAI,CAAC,uCAAuC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YAC9D,OAAO,sCAAsC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,OAAO,oCAAoC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,MAAM,6BAA6B,CAAC;gBAClC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBACrE,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK;gBACxB,SAAS,EAAE,MAAM,yBAAyB,CACxC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAC1C;aACF,CAAC,CAAC;YACH,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QACJ,KAAK,cAAc;YACjB,IACE,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAC5C,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,QAAQ,CAAC,cAAc;oBACrB,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBAEvD,MAAM;YACR,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;IACN,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport {\n  type CommitOrganizationGroupPolicyResponse,\n  type CreateOrganizationGroupResponse,\n  type DeleteOrganizationGroupResponse,\n  isCommitOrganizationGroupPolicyResponse,\n  isCreateOrganizationGroupResponse,\n  isDeleteOrganizationGroupResponse,\n  isPrincipalPolicyMutationResponse,\n  type PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport { acknowledgeInitialGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  assertAuthoredPrincipalMutationReceipt,\n  assertAuthoredPrincipalPolicyReceipt,\n} from \"./principalMutationReceipt\";\n\nexport type PrincipalMutationResponse =\n  | CommitOrganizationGroupPolicyResponse\n  | CreateOrganizationGroupResponse\n  | DeleteOrganizationGroupResponse\n  | PrincipalPolicyMutationResponse;\n\n/** Match both the operation's route and its exact authored policy artifacts. */\nexport async function assertAuthoredPrincipalOperationReceipt(\n  mutation: AuthoredPrincipalMutation,\n  response: PrincipalMutationResponse,\n): Promise<void> {\n  switch (mutation.kind) {\n    case undefined:\n      if (!isCommitOrganizationGroupPolicyResponse(response)) break;\n      return assertAuthoredPrincipalMutationReceipt(mutation.request, response);\n    case \"organization\":\n      if (!isPrincipalPolicyMutationResponse(response)) break;\n      return assertAuthoredPrincipalPolicyReceipt(mutation.request, response);\n    case \"group-create\":\n      if (!isCreateOrganizationGroupResponse(response)) break;\n      await acknowledgeInitialGroupPolicy({\n        organizationId: mutation.request.organizationPolicy.state.principalId,\n        request: mutation.request,\n        response: response.group,\n        stateHash: await computePrincipalStateHash(\n          mutation.request.initialGroupPolicy.state,\n        ),\n      });\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n    case \"group-delete\":\n      if (\n        !isDeleteOrganizationGroupResponse(response) ||\n        response.groupId !== mutation.groupId ||\n        response.organizationId !==\n          mutation.request.organizationPolicy.state.principalId\n      )\n        break;\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n  }\n  throw new Error(\"Principal mutation receipt operation or target differs\");\n}\n"]}
+{"version":3,"file":"principalOperationReceipt.js","sourceRoot":"","sources":["principalOperationReceipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAIL,uCAAuC,EACvC,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EACL,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,4BAA4B,CAAC;AAQpC,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,QAAmC,EACnC,QAAmC;IAEnC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,UAAU;YACb,IAAI,CAAC,uCAAuC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YAC9D,OAAO,sCAAsC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,OAAO,oCAAoC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,MAAM,6BAA6B,CAAC;gBAClC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBACrE,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK;gBACxB,SAAS,EAAE,MAAM,yBAAyB,CACxC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAC1C;aACF,CAAC,CAAC;YACH,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QACJ,KAAK,cAAc;YACjB,IACE,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAC5C,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,QAAQ,CAAC,cAAc;oBACrB,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBAEvD,MAAM;YACR,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;IACN,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport {\n  type CommitOrganizationGroupPolicyResponse,\n  type CreateOrganizationGroupResponse,\n  type DeleteOrganizationGroupResponse,\n  isCommitOrganizationGroupPolicyResponse,\n  isCreateOrganizationGroupResponse,\n  isDeleteOrganizationGroupResponse,\n  isPrincipalPolicyMutationResponse,\n  type PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport { acknowledgeInitialGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  assertAuthoredPrincipalMutationReceipt,\n  assertAuthoredPrincipalPolicyReceipt,\n} from \"./principalMutationReceipt\";\n\nexport type PrincipalMutationResponse =\n  | CommitOrganizationGroupPolicyResponse\n  | CreateOrganizationGroupResponse\n  | DeleteOrganizationGroupResponse\n  | PrincipalPolicyMutationResponse;\n\n/** Match both the operation's route and its exact authored policy artifacts. */\nexport async function assertAuthoredPrincipalOperationReceipt(\n  mutation: AuthoredPrincipalMutation,\n  response: PrincipalMutationResponse,\n): Promise<void> {\n  switch (mutation.kind) {\n    case \"compound\":\n      if (!isCommitOrganizationGroupPolicyResponse(response)) break;\n      return assertAuthoredPrincipalMutationReceipt(mutation.request, response);\n    case \"organization\":\n      if (!isPrincipalPolicyMutationResponse(response)) break;\n      return assertAuthoredPrincipalPolicyReceipt(mutation.request, response);\n    case \"group-create\":\n      if (!isCreateOrganizationGroupResponse(response)) break;\n      await acknowledgeInitialGroupPolicy({\n        organizationId: mutation.request.organizationPolicy.state.principalId,\n        request: mutation.request,\n        response: response.group,\n        stateHash: await computePrincipalStateHash(\n          mutation.request.initialGroupPolicy.state,\n        ),\n      });\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n    case \"group-delete\":\n      if (\n        !isDeleteOrganizationGroupResponse(response) ||\n        response.groupId !== mutation.groupId ||\n        response.organizationId !==\n          mutation.request.organizationPolicy.state.principalId\n      )\n        break;\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n  }\n  throw new Error(\"Principal mutation receipt operation or target differs\");\n}\n"]}

package/workflows/organizations/runtimeGroupMetadataAuthority.js

@@ -0,0 +1,16 @@
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { createRuntimePrincipalPolicyCurrentResolver, } from "../principals/runtimePolicyRecovery.js";
+import { createCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
+/** Remote metadata destinations require the same private authority as name reads. */
+export async function verifyRuntimeGroupMetadataAuthority(input) {
+    const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(input.runtime);
+    if (!resolveCurrentPolicy)
+        throw new ProjectionDependencyUnavailableError("Group metadata requires private paged recovery");
+    await createCurrentGroupMetadataContainerVerifier({
+        execSql: input.runtime.infra.execSql,
+        organizationId: input.organizationId,
+        resolveCurrentPolicy,
+        stillCurrent: input.stillCurrent,
+    })(input.state, input.organizationReference);
+}
+//# sourceMappingURL=runtimeGroupMetadataAuthority.js.map

package/workflows/organizations/runtimeGroupMetadataAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeGroupMetadataAuthority.js","sourceRoot":"","sources":["runtimeGroupMetadataAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,2CAA2C,GAE5C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAE9F,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,MAAM,oBAAoB,GAAG,2CAA2C,CACtE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,oBAAoB;QACvB,MAAM,IAAI,oCAAoC,CAC5C,gDAAgD,CACjD,CAAC;IACJ,MAAM,2CAA2C,CAAC;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  createRuntimePrincipalPolicyCurrentResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"../principals/runtimePolicyRecovery\";\nimport { createCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\n\n/** Remote metadata destinations require the same private authority as name reads. */\nexport async function verifyRuntimeGroupMetadataAuthority(input: {\n  readonly runtime: PrincipalPolicyRecoveryRuntime;\n  readonly organizationId: string;\n  readonly state: ContainerAccessManifestState;\n  readonly organizationReference?: ReferencedPrincipalHead | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(\n    input.runtime,\n  );\n  if (!resolveCurrentPolicy)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group metadata requires private paged recovery\",\n    );\n  await createCurrentGroupMetadataContainerVerifier({\n    execSql: input.runtime.infra.execSql,\n    organizationId: input.organizationId,\n    resolveCurrentPolicy,\n    stillCurrent: input.stillCurrent,\n  })(input.state, input.organizationReference);\n}\n"]}

package/workflows/principals/runtimePolicyWarmer.js

@@ -1,35 +1,37 @@
-import { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
+import { errorMessage } from "../../data/errorMessage.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { rethrowKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
+import { assertProjectionVerificationCurrent, isProjectionVerificationCancelledError, } from "../../data/keyingProjectionVerification/types.js";
 import { createRuntimePrincipalPolicyResolver, } from "./runtimePolicyRecovery.js";
 import { createRuntimeProjectionPolicyResolver } from "./runtimeProjectionPolicyRecovery.js";
+/** Prefetch is best-effort; exact resolution still rejects unavailable evidence. */
 export function createRuntimePrincipalPolicyWarmer(runtime, options = {}) {
-    const policyInput = ({ organizationId, references, stillCurrent, }) => {
-        const input = {
-            execSql: runtime.infra.execSql,
-            getCurrentPrincipalPolicy: (principalType, principalId) => runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
-            log: runtime.util.log,
-            organizationId,
-            reportSecurityIncident: runtime.util.reportSecurityIncident,
-            references,
-            resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
-            stillCurrent,
-        };
-        return input;
+    const resolve = createRuntimePrincipalPolicyResolver(runtime, options);
+    const resolveReference = async (input) => {
+        if (!resolve)
+            throw new ProjectionDependencyUnavailableError("Principal policies require private paged recovery");
+        return resolve(input);
     };
-    const warmer = async (input) => cacheReferencedPrincipalPolicies(policyInput(input));
-    const cacheBundles = (input) => cachePrincipalPolicyBundles({
-        bundles: input.bundles,
-        execSql: runtime.infra.execSql,
-        getCurrentPrincipalPolicy: (principalType, principalId) => runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
-        log: runtime.util.log,
-        organizationId: input.organizationId,
-        reportSecurityIncident: runtime.util.reportSecurityIncident,
-        resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
-        stillCurrent: input.stillCurrent,
-    });
-    return Object.assign(warmer, {
-        cacheBundles,
-        resolveReference: createRuntimePrincipalPolicyResolver(runtime, options),
+    return Object.assign((input) => prefetchReferences(runtime, resolveReference, input), {
+        resolveReference,
         resolveProjectionHistory: createRuntimeProjectionPolicyResolver(runtime),
     });
 }
+async function prefetchReferences(runtime, resolve, input) {
+    const recoveryBatch = {};
+    for (const reference of input.references) {
+        try {
+            assertProjectionVerificationCurrent(input.stillCurrent);
+            const resolved = await resolve({ ...input, reference, recoveryBatch });
+            assertProjectionVerificationCurrent(resolved.stillCurrent);
+        }
+        catch (error) {
+            if (isProjectionVerificationCancelledError(error))
+                return;
+            // Recovery already reports signature/authority failures. Keep them fatal.
+            rethrowKeyingVerificationError(error);
+            runtime.util.log?.(`Principal policy prefetch: ${reference.principalId}: ${errorMessage(error)}`);
+        }
+    }
+}
 //# sourceMappingURL=runtimePolicyWarmer.js.map

package/workflows/principals/runtimePolicyWarmer.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oCAAoC,GAErC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAiB1F,MAAM,UAAU,kCAAkC,CAChD,OAAmC,EACnC,UAAqD,EAAE;IAEvD,MAAM,WAAW,GAAG,CAAC,EACnB,cAAc,EACd,UAAU,EACV,YAAY,GACmC,EAAE,EAAE;QACnD,MAAM,KAAK,GAA2D;YACpE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;YACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;YACrB,cAAc;YACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAC3D,UAAU;YACV,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,YAAY;SACb,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAClB,KAAqD,EACrD,EAAE,CAAC,gCAAgC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,KAAwC,EAAE,EAAE,CAChE,2BAA2B,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACzE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;QACrB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,YAAY;QACZ,gBAAgB,EAAE,oCAAoC,CAAC,OAAO,EAAE,OAAO,CAAC;QACxE,wBAAwB,EAAE,qCAAqC,CAAC,OAAO,CAAC;KACzE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type {\n  PrincipalPolicyBundleCacheRequest,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nimport {\n  createRuntimePrincipalPolicyResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"./runtimePolicyRecovery\";\nimport { createRuntimeProjectionPolicyResolver } from \"./runtimeProjectionPolicyRecovery\";\n\ninterface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] & {\n    getCurrentPrincipalPolicy(\n      principalType: \"group\" | \"organization\",\n      principalId: string,\n    ): Promise<PrincipalPolicyBundleResponse | null>;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n  options: { readonly preferLocalCurrent?: boolean } = {},\n): ReferencedPrincipalPolicyWarmer {\n  const policyInput = ({\n    organizationId,\n    references,\n    stillCurrent,\n  }: Parameters<ReferencedPrincipalPolicyWarmer>[0]) => {\n    const input: Parameters<typeof cacheReferencedPrincipalPolicies>[0] = {\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      references,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent,\n    };\n    return input;\n  };\n  const warmer = async (\n    input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n  ) => cacheReferencedPrincipalPolicies(policyInput(input));\n  const cacheBundles = (input: PrincipalPolicyBundleCacheRequest) =>\n    cachePrincipalPolicyBundles({\n      bundles: input.bundles,\n      execSql: runtime.infra.execSql,\n      getCurrentPrincipalPolicy: (principalType, principalId) =>\n        runtime.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n      log: runtime.util.log,\n      organizationId: input.organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent: input.stillCurrent,\n    });\n  return Object.assign(warmer, {\n    cacheBundles,\n    resolveReference: createRuntimePrincipalPolicyResolver(runtime, options),\n    resolveProjectionHistory: createRuntimeProjectionPolicyResolver(runtime),\n  });\n}\n"]}
+{"version":3,"file":"runtimePolicyWarmer.js","sourceRoot":"","sources":["runtimePolicyWarmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oCAAoC,GAErC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAW1F,oFAAoF;AACpF,MAAM,UAAU,kCAAkC,CAChD,OAAmC,EACnC,UAAqD,EAAE;IAEvD,MAAM,OAAO,GAAG,oCAAoC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAmB,KAAK,EAAE,KAAK,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,oCAAoC,CAC5C,mDAAmD,CACpD,CAAC;QACJ,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAqD,EAAE,EAAE,CACxD,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,EACtD;QACE,gBAAgB;QAChB,wBAAwB,EAAE,qCAAqC,CAAC,OAAO,CAAC;KACzE,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAmC,EACnC,OAAuB,EACvB,KAAqD;IAErD,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;YACvE,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1D,0EAA0E;YAC1E,8BAA8B,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAChB,8BAA8B,SAAS,CAAC,WAAW,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { errorMessage } from \"../../data/errorMessage\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { rethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  assertProjectionVerificationCurrent,\n  isProjectionVerificationCancelledError,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification/types\";\nimport {\n  createRuntimePrincipalPolicyResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"./runtimePolicyRecovery\";\nimport { createRuntimeProjectionPolicyResolver } from \"./runtimeProjectionPolicyRecovery\";\n\ntype PolicyResolver = NonNullable<\n  ReferencedPrincipalPolicyWarmer[\"resolveReference\"]\n>;\ninterface PrincipalPolicyWarmRuntime extends PrincipalPolicyRecoveryRuntime {\n  readonly util: PrincipalPolicyRecoveryRuntime[\"util\"] & {\n    readonly log?: ((message: string) => void) | undefined;\n  };\n}\n\n/** Prefetch is best-effort; exact resolution still rejects unavailable evidence. */\nexport function createRuntimePrincipalPolicyWarmer(\n  runtime: PrincipalPolicyWarmRuntime,\n  options: { readonly preferLocalCurrent?: boolean } = {},\n): ReferencedPrincipalPolicyWarmer {\n  const resolve = createRuntimePrincipalPolicyResolver(runtime, options);\n  const resolveReference: PolicyResolver = async (input) => {\n    if (!resolve)\n      throw new ProjectionDependencyUnavailableError(\n        \"Principal policies require private paged recovery\",\n      );\n    return resolve(input);\n  };\n  return Object.assign(\n    (input: Parameters<ReferencedPrincipalPolicyWarmer>[0]) =>\n      prefetchReferences(runtime, resolveReference, input),\n    {\n      resolveReference,\n      resolveProjectionHistory: createRuntimeProjectionPolicyResolver(runtime),\n    },\n  );\n}\n\nasync function prefetchReferences(\n  runtime: PrincipalPolicyWarmRuntime,\n  resolve: PolicyResolver,\n  input: Parameters<ReferencedPrincipalPolicyWarmer>[0],\n): Promise<void> {\n  const recoveryBatch = {};\n  for (const reference of input.references) {\n    try {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      const resolved = await resolve({ ...input, reference, recoveryBatch });\n      assertProjectionVerificationCurrent(resolved.stillCurrent);\n    } catch (error) {\n      if (isProjectionVerificationCancelledError(error)) return;\n      // Recovery already reports signature/authority failures. Keep them fatal.\n      rethrowKeyingVerificationError(error);\n      runtime.util.log?.(\n        `Principal policy prefetch: ${reference.principalId}: ${errorMessage(error)}`,\n      );\n    }\n  }\n}\n"]}