@tearleads/client-sdk 0.1.38 → 0.1.40

package/data/sqlite/schema.d.ts

@@ -2905,6 +2905,114 @@ export declare const clientSQLiteSchema: {
             }, {}, {
                 length: number | undefined;
             }>;
+            memberGroupStateHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "member_group_state_hash";
+                tableName: "organization_read_model_state";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            organizationStateHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_state_hash";
+                tableName: "organization_read_model_state";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            organizationStateVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_state_version";
+                tableName: "organization_read_model_state";
+                dataType: "number";
+                columnType: "SQLiteInteger";
+                data: number;
+                driverParam: number;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            organizationKeyEpoch: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_key_epoch";
+                tableName: "organization_read_model_state";
+                dataType: "number";
+                columnType: "SQLiteInteger";
+                data: number;
+                driverParam: number;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            organizationKeyFingerprint: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_key_fingerprint";
+                tableName: "organization_read_model_state";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
+            organizationMemberCount: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "organization_member_count";
+                tableName: "organization_read_model_state";
+                dataType: "number";
+                columnType: "SQLiteInteger";
+                data: number;
+                driverParam: number;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
                 name: "updated_at";
                 tableName: "organization_read_model_state";
@@ -3463,148 +3571,14 @@ export declare const clientSQLiteSchema: {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            memberCount: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "member_count";
-                tableName: "organization_read_model_groups";
-                dataType: "number";
-                columnType: "SQLiteInteger";
-                data: number;
-                driverParam: number;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-        };
-        dialect: "sqlite";
-    }>;
-    organizationReadModelPolicyHeads: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
-        name: "organization_read_model_policy_heads";
-        schema: undefined;
-        columns: {
-            organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "organization_id";
-                tableName: "organization_read_model_policy_heads";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            principalType: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "principal_type";
-                tableName: "organization_read_model_policy_heads";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            principalId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "principal_id";
-                tableName: "organization_read_model_policy_heads";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            stateHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "state_hash";
-                tableName: "organization_read_model_policy_heads";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            stateVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "state_version";
-                tableName: "organization_read_model_policy_heads";
-                dataType: "number";
-                columnType: "SQLiteInteger";
-                data: number;
-                driverParam: number;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            keyEpoch: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "key_epoch";
-                tableName: "organization_read_model_policy_heads";
-                dataType: "number";
-                columnType: "SQLiteInteger";
-                data: number;
-                driverParam: number;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
             keyFingerprint: import("drizzle-orm/sqlite-core").SQLiteColumn<{
                 name: "key_fingerprint";
-                tableName: "organization_read_model_policy_heads";
+                tableName: "organization_read_model_groups";
                 dataType: "string";
                 columnType: "SQLiteText";
                 data: string;
                 driverParam: string;
-                notNull: true;
+                notNull: false;
                 hasDefault: false;
                 isPrimaryKey: false;
                 isAutoincrement: false;
@@ -3618,12 +3592,12 @@ export declare const clientSQLiteSchema: {
             }>;
             memberCount: import("drizzle-orm/sqlite-core").SQLiteColumn<{
                 name: "member_count";
-                tableName: "organization_read_model_policy_heads";
+                tableName: "organization_read_model_groups";
                 dataType: "number";
                 columnType: "SQLiteInteger";
                 data: number;
                 driverParam: number;
-                notNull: true;
+                notNull: false;
                 hasDefault: false;
                 isPrimaryKey: false;
                 isAutoincrement: false;
@@ -3633,59 +3607,14 @@ export declare const clientSQLiteSchema: {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-        };
-        dialect: "sqlite";
-    }>;
-    organizationReadModelGroupMemberships: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
-        name: "organization_read_model_group_memberships";
-        schema: undefined;
-        columns: {
-            organizationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "organization_id";
-                tableName: "organization_read_model_group_memberships";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            groupId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "group_id";
-                tableName: "organization_read_model_group_memberships";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            stateHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "state_hash";
-                tableName: "organization_read_model_group_memberships";
+            membersStateHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "members_state_hash";
+                tableName: "organization_read_model_groups";
                 dataType: "string";
                 columnType: "SQLiteText";
                 data: string;
                 driverParam: string;
-                notNull: true;
+                notNull: false;
                 hasDefault: false;
                 isPrimaryKey: false;
                 isAutoincrement: false;
@@ -3816,82 +3745,6 @@ export declare const clientSQLiteSchema: {
             }, {}, {
                 length: number | undefined;
             }>;
-            signingKeyFingerprint: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "signing_key_fingerprint";
-                tableName: "organization_read_model_group_members";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            signingPublicKey: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "signing_public_key";
-                tableName: "organization_read_model_group_members";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            encapsulationPublicKey: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "encapsulation_public_key";
-                tableName: "organization_read_model_group_members";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
-            encapsulationKeyFingerprint: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-                name: "encapsulation_key_fingerprint";
-                tableName: "organization_read_model_group_members";
-                dataType: "string";
-                columnType: "SQLiteText";
-                data: string;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {
-                length: number | undefined;
-            }>;
         };
         dialect: "sqlite";
     }>;

package/data/sqlite/sqliteBindBudget.js

@@ -0,0 +1,30 @@
+import { getTableColumns } from "drizzle-orm";
+/**
+ * SQLite's historical default `SQLITE_MAX_VARIABLE_NUMBER`. Some hosts raise
+ * it, but the SDK runs on several SQLite builds, so every statement it batches
+ * stays within this budget.
+ */
+export const SQLITE_BOUND_VARIABLE_BUDGET = 999;
+/**
+ * Rows (or list entries) one statement may carry when each binds
+ * `variablesPerRow` values on top of `fixedVariables` shared ones.
+ */
+export function sqliteRowsPerStatement(variablesPerRow, fixedVariables = 0) {
+    const rows = Math.floor((SQLITE_BOUND_VARIABLE_BUDGET - fixedVariables) / variablesPerRow);
+    if (!Number.isInteger(variablesPerRow) ||
+        variablesPerRow < 1 ||
+        !Number.isInteger(fixedVariables) ||
+        fixedVariables < 0 ||
+        rows < 1) {
+        throw new Error("SQLite statement cannot fit its bound variables");
+    }
+    return rows;
+}
+/**
+ * Rows per multi-row INSERT into `table`. Every column may bind one value,
+ * including explicit nulls, so the column count is the per-row ceiling.
+ */
+export function sqliteInsertBatchSize(table) {
+    return sqliteRowsPerStatement(Object.keys(getTableColumns(table)).length);
+}
+//# sourceMappingURL=sqliteBindBudget.js.map

package/data/sqlite/sqliteBindBudget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqliteBindBudget.js","sourceRoot":"","sources":["sqliteBindBudget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuB,EACvB,cAAc,GAAG,CAAC;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACrB,CAAC,4BAA4B,GAAG,cAAc,CAAC,GAAG,eAAe,CAClE,CAAC;IACF,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC;QAClC,eAAe,GAAG,CAAC;QACnB,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC;QACjC,cAAc,GAAG,CAAC;QAClB,IAAI,GAAG,CAAC,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,OAAO,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import { getTableColumns } from \"drizzle-orm\";\nimport type { SQLiteTable } from \"drizzle-orm/sqlite-core\";\n\n/**\n * SQLite's historical default `SQLITE_MAX_VARIABLE_NUMBER`. Some hosts raise\n * it, but the SDK runs on several SQLite builds, so every statement it batches\n * stays within this budget.\n */\nexport const SQLITE_BOUND_VARIABLE_BUDGET = 999;\n\n/**\n * Rows (or list entries) one statement may carry when each binds\n * `variablesPerRow` values on top of `fixedVariables` shared ones.\n */\nexport function sqliteRowsPerStatement(\n  variablesPerRow: number,\n  fixedVariables = 0,\n): number {\n  const rows = Math.floor(\n    (SQLITE_BOUND_VARIABLE_BUDGET - fixedVariables) / variablesPerRow,\n  );\n  if (\n    !Number.isInteger(variablesPerRow) ||\n    variablesPerRow < 1 ||\n    !Number.isInteger(fixedVariables) ||\n    fixedVariables < 0 ||\n    rows < 1\n  ) {\n    throw new Error(\"SQLite statement cannot fit its bound variables\");\n  }\n  return rows;\n}\n\n/**\n * Rows per multi-row INSERT into `table`. Every column may bind one value,\n * including explicit nulls, so the column count is the per-row ceiling.\n */\nexport function sqliteInsertBatchSize(table: SQLiteTable): number {\n  return sqliteRowsPerStatement(Object.keys(getTableColumns(table)).length);\n}\n"]}

package/data/trustedUserIdentity/index.d.ts

@@ -1,6 +1,6 @@
 export { createApiUserIdentitySource } from "./apiAdapter.js";
 export { requireTrustedUserIdentityResolver } from "./requiredResolver.js";
-export { createTrustedUserIdentityService } from "./service.js";
+export { createTrustedUserIdentityService, loadPinnedUserIdentity, } from "./service.js";
 export { resolveIdentityTrustDomain } from "./trustDomain.js";
 export type { LocalUserIdentityCandidate, TrustedUserIdentity, TrustedUserIdentityResolver, } from "./types.js";
 export { validateUserIdentityKeys } from "./validation.js";

package/data/trustedUserIdentity/index.js

@@ -1,6 +1,6 @@
 export { createApiUserIdentitySource } from "./apiAdapter.js";
 export { requireTrustedUserIdentityResolver } from "./requiredResolver.js";
-export { createTrustedUserIdentityService } from "./service.js";
+export { createTrustedUserIdentityService, loadPinnedUserIdentity, } from "./service.js";
 export { resolveIdentityTrustDomain } from "./trustDomain.js";
 export { validateUserIdentityKeys } from "./validation.js";
 //# sourceMappingURL=index.js.map

package/data/trustedUserIdentity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAM3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export { createApiUserIdentitySource } from \"./apiAdapter\";\nexport { requireTrustedUserIdentityResolver } from \"./requiredResolver\";\nexport { createTrustedUserIdentityService } from \"./service\";\nexport { resolveIdentityTrustDomain } from \"./trustDomain\";\nexport type {\n  LocalUserIdentityCandidate,\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"./types\";\nexport { validateUserIdentityKeys } from \"./validation\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAM3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC","sourcesContent":["export { createApiUserIdentitySource } from \"./apiAdapter\";\nexport { requireTrustedUserIdentityResolver } from \"./requiredResolver\";\nexport {\n  createTrustedUserIdentityService,\n  loadPinnedUserIdentity,\n} from \"./service\";\nexport { resolveIdentityTrustDomain } from \"./trustDomain\";\nexport type {\n  LocalUserIdentityCandidate,\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"./types\";\nexport { validateUserIdentityKeys } from \"./validation\";\n"]}

package/data/trustedUserIdentity/service.d.ts

@@ -1,2 +1,13 @@
-import { type TrustedUserIdentityService, type TrustedUserIdentityServiceDependencies } from "./types.js";
+import type { ExecSql } from "../sqlite/sqlSchema.js";
+import { type TrustedUserIdentity, type TrustedUserIdentityService, type TrustedUserIdentityServiceDependencies } from "./types.js";
+/**
+ * Read-only: the identity this trust store already pins for `userId`, or null.
+ * The stored keys must still match their stored fingerprints. Never inserts,
+ * compares against or replaces a pin.
+ */
+export declare function loadPinnedUserIdentity(input: {
+    readonly execSql: ExecSql;
+    readonly identityTrustDomain: string;
+    readonly userId: string;
+}): Promise<TrustedUserIdentity | null>;
 export declare function createTrustedUserIdentityService(dependencies: TrustedUserIdentityServiceDependencies): TrustedUserIdentityService;

package/data/trustedUserIdentity/service.js

@@ -1,10 +1,10 @@
 import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { compareOrInsertTrustedUserIdentityPin, loadTrustedUserIdForSigningKey, TrustedUserIdentityPinCorruptError, TrustedUserIdentityPinMismatchError, } from "../persistence/trustedUserIdentityPinPersistence.js";
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { compareOrInsertTrustedUserIdentityPin, loadTrustedUserIdentityPin, loadTrustedUserIdForSigningKey, TrustedUserIdentityPinCorruptError, TrustedUserIdentityPinMismatchError, } from "../persistence/trustedUserIdentityPinPersistence.js";
 import { TrustedUserIdentityPinContentionError } from "../persistence/trustedUserIdentityPinTransaction.js";
 import { DatabaseUnavailableError } from "../sync/databaseUnavailable.js";
 import { brandTrustedUserIdentity, TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE, TRUSTED_USER_IDENTITY_FORMAT_VERSION, TRUSTED_USER_IDENTITY_SIGNING_SUITE, } from "./types.js";
-import { assertTrustedUserIdentityUserId, validateLocalUserIdentity, validateRemoteUserIdentity, } from "./validation.js";
+import { assertTrustedUserIdentityUserId, validateLocalUserIdentity, validateRemoteUserIdentity, validateUserIdentityKeys, } from "./validation.js";
 function requireTrustStore(dependencies) {
     // A missing trust domain is a static misconfiguration and must stay loud.
     if (!dependencies.identityTrustDomain) {
@@ -85,6 +85,30 @@ async function pinIdentity(input) {
     });
     return brandTrustedUserIdentity(input.identity);
 }
+/**
+ * Read-only: the identity this trust store already pins for `userId`, or null.
+ * The stored keys must still match their stored fingerprints. Never inserts,
+ * compares against or replaces a pin.
+ */
+export async function loadPinnedUserIdentity(input) {
+    assertTrustedUserIdentityUserId(input.userId);
+    const pin = await loadTrustedUserIdentityPin(input);
+    if (!pin)
+        return null;
+    const keys = await validateUserIdentityKeys({
+        candidate: {
+            encapsulationPublicKey: base64ToBytes(pin.encapsulationPublicKey),
+            signingKeyFingerprint: pin.signingKeyFingerprint,
+            signingPublicKey: base64ToBytes(pin.signingPublicKey),
+        },
+        encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,
+    });
+    return brandTrustedUserIdentity({
+        ...keys,
+        identityTrustDomain: input.identityTrustDomain,
+        userId: input.userId,
+    });
+}
 export function createTrustedUserIdentityService(dependencies) {
     return {
         async boundUserId(signingKeyFingerprint) {

package/data/trustedUserIdentity/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AACzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,oCAAoC,EACpC,mCAAmC,GAKpC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AAEtB,SAAS,iBAAiB,CACxB,YAAoD;IAOpD,0EAA0E;IAC1E,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAChC,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,YAAY,CAAC,mBAAmB,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAMpC;IACC,IAAI,CAAC;QACH,MAAM,qCAAqC,CAAC;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE;gBACH,2BAA2B,EAAE,KAAK,CAAC,QAAQ,CAAC,2BAA2B;gBACvE,sBAAsB,EAAE,aAAa,CACnC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CACtC;gBACD,kBAAkB,EAAE,yCAAyC;gBAC7D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,oCAAoC;gBACnD,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;gBACvD,qBAAqB,EAAE,KAAK,CAAC,QAAQ,CAAC,qBAAqB;gBAC3D,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAChE,YAAY,EAAE,mCAAmC;gBACjD,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mCAAmC,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM;gBAC9C,CAAC,CAAC,mBAAmB,KAAK,CAAC,QAAQ,CAAC,MAAM,wBAAwB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;gBACzF,CAAC,CAAC,qCAAqC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4CAA4C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,qCAAqC,EAAE,CAAC;YAC3D,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,IAAI,wBAAwB,CAChC,+CAA+C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,YAAoD,EACpD,MAAc,EACd,mBAA2B;IAE3B,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,aAAa;YACxB,mBAAmB;YACnB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,cAAc;QACnB,CAAC,CAAC,0BAA0B,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,mBAAmB;YACnB,eAAe,EAAE,MAAM;SACxB,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAM1B;IACC,MAAM,qBAAqB,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACrE,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,YAAoD;IAEpD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACrC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,OAAO,8BAA8B,CAAC;gBACpC,OAAO;gBACP,mBAAmB;gBACnB,qBAAqB;aACtB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS;YAC9B,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;gBAC/C,SAAS;gBACT,mBAAmB;gBACnB,MAAM;aACP,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,YAAY,EACZ,MAAM,EACN,mBAAmB,CACpB,CAAC;gBACF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,MAAM,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  compareOrInsertTrustedUserIdentityPin,\n  loadTrustedUserIdForSigningKey,\n  TrustedUserIdentityPinCorruptError,\n  TrustedUserIdentityPinMismatchError,\n} from \"../persistence/trustedUserIdentityPinPersistence\";\nimport { TrustedUserIdentityPinContentionError } from \"../persistence/trustedUserIdentityPinTransaction\";\nimport { DatabaseUnavailableError } from \"../sync/databaseUnavailable\";\nimport {\n  brandTrustedUserIdentity,\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n  type TrustedUserIdentity,\n  type TrustedUserIdentityService,\n  type TrustedUserIdentityServiceDependencies,\n  type ValidatedUserIdentityCandidate,\n} from \"./types\";\nimport {\n  assertTrustedUserIdentityUserId,\n  validateLocalUserIdentity,\n  validateRemoteUserIdentity,\n} from \"./validation\";\n\nfunction requireTrustStore(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): {\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly identityTrustDomain: string;\n} {\n  // A missing trust domain is a static misconfiguration and must stay loud.\n  if (!dependencies.identityTrustDomain) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Trusted user identity resolution requires a stable API trust domain\",\n    );\n  }\n  // An absent trust store is not: getExecSql() returns null exactly while the\n  // database is not ready, which happens routinely when the runtime is swapped\n  // under in-flight sync work. Callers that tolerate a vanishing database\n  // discriminate on the error type, so this must not share the code above.\n  const execSql = dependencies.getExecSql();\n  if (!execSql) {\n    throw new DatabaseUnavailableError(\n      \"Trusted user identity resolution requires a ready SQLite trust store\",\n    );\n  }\n  return { execSql, identityTrustDomain: dependencies.identityTrustDomain };\n}\n\nasync function compareWithDurablePin(input: {\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly firstSeenAt: string;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<void> {\n  try {\n    await compareOrInsertTrustedUserIdentityPin({\n      execSql: input.execSql,\n      pin: {\n        encapsulationKeyFingerprint: input.identity.encapsulationKeyFingerprint,\n        encapsulationPublicKey: bytesToBase64(\n          input.identity.encapsulationPublicKey,\n        ),\n        encapsulationSuite: TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n        firstSeenAt: input.firstSeenAt,\n        formatVersion: TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n        identityTrustDomain: input.identity.identityTrustDomain,\n        signingKeyFingerprint: input.identity.signingKeyFingerprint,\n        signingPublicKey: bytesToBase64(input.identity.signingPublicKey),\n        signingSuite: TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n        userId: input.identity.userId,\n      },\n    });\n  } catch (error) {\n    if (error instanceof TrustedUserIdentityPinMismatchError) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        error.existing.userId !== error.candidate.userId\n          ? `Signing key for ${input.identity.userId} is already bound to ${error.existing.userId}`\n          : `Trusted user identity changed for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinCorruptError) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        `Trusted user identity pin is corrupt for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinContentionError) {\n      // Lock contention says nothing about the identity; the caller retries\n      // once the trust store is free, so this must not be recordable evidence.\n      throw new DatabaseUnavailableError(\n        `Trusted user identity pin store is busy for ${input.identity.userId}`,\n      );\n    }\n    throw error;\n  }\n}\n\nasync function resolveCandidate(\n  dependencies: TrustedUserIdentityServiceDependencies,\n  userId: string,\n  identityTrustDomain: string,\n): Promise<ValidatedUserIdentityCandidate | null> {\n  const localUserId = dependencies.getLocalUserId();\n  if (userId === localUserId) {\n    const localIdentity = dependencies.getLocalIdentity(userId);\n    if (!localIdentity) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Authoritative local identity keys are unavailable\",\n      );\n    }\n    return validateLocalUserIdentity({\n      candidate: localIdentity,\n      identityTrustDomain,\n      userId,\n    });\n  }\n\n  const remoteIdentity = await dependencies.remoteSource.load(userId);\n  return remoteIdentity\n    ? validateRemoteUserIdentity({\n        candidate: remoteIdentity,\n        identityTrustDomain,\n        requestedUserId: userId,\n      })\n    : null;\n}\n\nasync function pinIdentity(input: {\n  readonly dependencies: TrustedUserIdentityServiceDependencies;\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<TrustedUserIdentity> {\n  await compareWithDurablePin({\n    execSql: input.execSql,\n    firstSeenAt: (input.dependencies.now?.() ?? new Date()).toISOString(),\n    identity: input.identity,\n  });\n  return brandTrustedUserIdentity(input.identity);\n}\n\nexport function createTrustedUserIdentityService(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): TrustedUserIdentityService {\n  return {\n    async boundUserId(signingKeyFingerprint) {\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      return loadTrustedUserIdForSigningKey({\n        execSql,\n        identityTrustDomain,\n        signingKeyFingerprint,\n      });\n    },\n    async pinLocal(userId, candidate) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      const identity = await validateLocalUserIdentity({\n        candidate,\n        identityTrustDomain,\n        userId,\n      });\n      return pinIdentity({ dependencies, execSql, identity });\n    },\n    async resolve(userId) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      try {\n        const identity = await resolveCandidate(\n          dependencies,\n          userId,\n          identityTrustDomain,\n        );\n        if (!identity) {\n          return null;\n        }\n        return await pinIdentity({ dependencies, execSql, identity });\n      } catch (error) {\n        dependencies.remoteSource.invalidate(userId);\n        throw error;\n      }\n    },\n  };\n}\n"]}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAEzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,oCAAoC,EACpC,mCAAmC,GAKpC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAEtB,SAAS,iBAAiB,CACxB,YAAoD;IAOpD,0EAA0E;IAC1E,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAChC,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,YAAY,CAAC,mBAAmB,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAMpC;IACC,IAAI,CAAC;QACH,MAAM,qCAAqC,CAAC;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE;gBACH,2BAA2B,EAAE,KAAK,CAAC,QAAQ,CAAC,2BAA2B;gBACvE,sBAAsB,EAAE,aAAa,CACnC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CACtC;gBACD,kBAAkB,EAAE,yCAAyC;gBAC7D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,oCAAoC;gBACnD,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;gBACvD,qBAAqB,EAAE,KAAK,CAAC,QAAQ,CAAC,qBAAqB;gBAC3D,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAChE,YAAY,EAAE,mCAAmC;gBACjD,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mCAAmC,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM;gBAC9C,CAAC,CAAC,mBAAmB,KAAK,CAAC,QAAQ,CAAC,MAAM,wBAAwB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;gBACzF,CAAC,CAAC,qCAAqC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4CAA4C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,qCAAqC,EAAE,CAAC;YAC3D,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,IAAI,wBAAwB,CAChC,+CAA+C,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,YAAoD,EACpD,MAAc,EACd,mBAA2B;IAE3B,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,aAAa;YACxB,mBAAmB;YACnB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,cAAc;QACnB,CAAC,CAAC,0BAA0B,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,mBAAmB;YACnB,eAAe,EAAE,MAAM;SACxB,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAM1B;IACC,MAAM,qBAAqB,CAAC;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACrE,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAI5C;IACC,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,SAAS,EAAE;YACT,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACjE,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,gBAAgB,EAAE,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACtD;QACD,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;KAC7D,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,GAAG,IAAI;QACP,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,YAAoD;IAEpD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACrC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,OAAO,8BAA8B,CAAC;gBACpC,OAAO;gBACP,mBAAmB;gBACnB,qBAAqB;aACtB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS;YAC9B,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;gBAC/C,SAAS;gBACT,mBAAmB;gBACnB,MAAM;aACP,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,YAAY,EACZ,MAAM,EACN,mBAAmB,CACpB,CAAC;gBACF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,MAAM,WAAW,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  compareOrInsertTrustedUserIdentityPin,\n  loadTrustedUserIdentityPin,\n  loadTrustedUserIdForSigningKey,\n  TrustedUserIdentityPinCorruptError,\n  TrustedUserIdentityPinMismatchError,\n} from \"../persistence/trustedUserIdentityPinPersistence\";\nimport { TrustedUserIdentityPinContentionError } from \"../persistence/trustedUserIdentityPinTransaction\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { DatabaseUnavailableError } from \"../sync/databaseUnavailable\";\nimport {\n  brandTrustedUserIdentity,\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n  type TrustedUserIdentity,\n  type TrustedUserIdentityService,\n  type TrustedUserIdentityServiceDependencies,\n  type ValidatedUserIdentityCandidate,\n} from \"./types\";\nimport {\n  assertTrustedUserIdentityUserId,\n  validateLocalUserIdentity,\n  validateRemoteUserIdentity,\n  validateUserIdentityKeys,\n} from \"./validation\";\n\nfunction requireTrustStore(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): {\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly identityTrustDomain: string;\n} {\n  // A missing trust domain is a static misconfiguration and must stay loud.\n  if (!dependencies.identityTrustDomain) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Trusted user identity resolution requires a stable API trust domain\",\n    );\n  }\n  // An absent trust store is not: getExecSql() returns null exactly while the\n  // database is not ready, which happens routinely when the runtime is swapped\n  // under in-flight sync work. Callers that tolerate a vanishing database\n  // discriminate on the error type, so this must not share the code above.\n  const execSql = dependencies.getExecSql();\n  if (!execSql) {\n    throw new DatabaseUnavailableError(\n      \"Trusted user identity resolution requires a ready SQLite trust store\",\n    );\n  }\n  return { execSql, identityTrustDomain: dependencies.identityTrustDomain };\n}\n\nasync function compareWithDurablePin(input: {\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly firstSeenAt: string;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<void> {\n  try {\n    await compareOrInsertTrustedUserIdentityPin({\n      execSql: input.execSql,\n      pin: {\n        encapsulationKeyFingerprint: input.identity.encapsulationKeyFingerprint,\n        encapsulationPublicKey: bytesToBase64(\n          input.identity.encapsulationPublicKey,\n        ),\n        encapsulationSuite: TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n        firstSeenAt: input.firstSeenAt,\n        formatVersion: TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n        identityTrustDomain: input.identity.identityTrustDomain,\n        signingKeyFingerprint: input.identity.signingKeyFingerprint,\n        signingPublicKey: bytesToBase64(input.identity.signingPublicKey),\n        signingSuite: TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n        userId: input.identity.userId,\n      },\n    });\n  } catch (error) {\n    if (error instanceof TrustedUserIdentityPinMismatchError) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        error.existing.userId !== error.candidate.userId\n          ? `Signing key for ${input.identity.userId} is already bound to ${error.existing.userId}`\n          : `Trusted user identity changed for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinCorruptError) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        `Trusted user identity pin is corrupt for ${input.identity.userId}`,\n      );\n    }\n    if (error instanceof TrustedUserIdentityPinContentionError) {\n      // Lock contention says nothing about the identity; the caller retries\n      // once the trust store is free, so this must not be recordable evidence.\n      throw new DatabaseUnavailableError(\n        `Trusted user identity pin store is busy for ${input.identity.userId}`,\n      );\n    }\n    throw error;\n  }\n}\n\nasync function resolveCandidate(\n  dependencies: TrustedUserIdentityServiceDependencies,\n  userId: string,\n  identityTrustDomain: string,\n): Promise<ValidatedUserIdentityCandidate | null> {\n  const localUserId = dependencies.getLocalUserId();\n  if (userId === localUserId) {\n    const localIdentity = dependencies.getLocalIdentity(userId);\n    if (!localIdentity) {\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Authoritative local identity keys are unavailable\",\n      );\n    }\n    return validateLocalUserIdentity({\n      candidate: localIdentity,\n      identityTrustDomain,\n      userId,\n    });\n  }\n\n  const remoteIdentity = await dependencies.remoteSource.load(userId);\n  return remoteIdentity\n    ? validateRemoteUserIdentity({\n        candidate: remoteIdentity,\n        identityTrustDomain,\n        requestedUserId: userId,\n      })\n    : null;\n}\n\nasync function pinIdentity(input: {\n  readonly dependencies: TrustedUserIdentityServiceDependencies;\n  readonly execSql: NonNullable<\n    ReturnType<TrustedUserIdentityServiceDependencies[\"getExecSql\"]>\n  >;\n  readonly identity: ValidatedUserIdentityCandidate;\n}): Promise<TrustedUserIdentity> {\n  await compareWithDurablePin({\n    execSql: input.execSql,\n    firstSeenAt: (input.dependencies.now?.() ?? new Date()).toISOString(),\n    identity: input.identity,\n  });\n  return brandTrustedUserIdentity(input.identity);\n}\n\n/**\n * Read-only: the identity this trust store already pins for `userId`, or null.\n * The stored keys must still match their stored fingerprints. Never inserts,\n * compares against or replaces a pin.\n */\nexport async function loadPinnedUserIdentity(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}): Promise<TrustedUserIdentity | null> {\n  assertTrustedUserIdentityUserId(input.userId);\n  const pin = await loadTrustedUserIdentityPin(input);\n  if (!pin) return null;\n  const keys = await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: base64ToBytes(pin.encapsulationPublicKey),\n      signingKeyFingerprint: pin.signingKeyFingerprint,\n      signingPublicKey: base64ToBytes(pin.signingPublicKey),\n    },\n    encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,\n  });\n  return brandTrustedUserIdentity({\n    ...keys,\n    identityTrustDomain: input.identityTrustDomain,\n    userId: input.userId,\n  });\n}\n\nexport function createTrustedUserIdentityService(\n  dependencies: TrustedUserIdentityServiceDependencies,\n): TrustedUserIdentityService {\n  return {\n    async boundUserId(signingKeyFingerprint) {\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      return loadTrustedUserIdForSigningKey({\n        execSql,\n        identityTrustDomain,\n        signingKeyFingerprint,\n      });\n    },\n    async pinLocal(userId, candidate) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      const identity = await validateLocalUserIdentity({\n        candidate,\n        identityTrustDomain,\n        userId,\n      });\n      return pinIdentity({ dependencies, execSql, identity });\n    },\n    async resolve(userId) {\n      assertTrustedUserIdentityUserId(userId);\n      const { execSql, identityTrustDomain } = requireTrustStore(dependencies);\n      try {\n        const identity = await resolveCandidate(\n          dependencies,\n          userId,\n          identityTrustDomain,\n        );\n        if (!identity) {\n          return null;\n        }\n        return await pinIdentity({ dependencies, execSql, identity });\n      } catch (error) {\n        dependencies.remoteSource.invalidate(userId);\n        throw error;\n      }\n    },\n  };\n}\n"]}

package/internal/validators/operation/organizations.d.ts

@@ -7922,22 +7922,14 @@ export declare const getOrganizationReadModelOperation: Omit<{
                     groups: z.ZodCustom<{
                         groupId: string;
                         members: {
-                            encapsulationKeyFingerprint: string | null;
-                            encapsulationPublicKey: string | null;
                             role: "member" | "admin";
-                            signingKeyFingerprint: string | null;
-                            signingPublicKey: string | null;
                             userId: string;
                         }[];
                         stateHash: string;
                     }[], {
                         groupId: string;
                         members: {
-                            encapsulationKeyFingerprint: string | null;
-                            encapsulationPublicKey: string | null;
                             role: "member" | "admin";
-                            signingKeyFingerprint: string | null;
-                            signingPublicKey: string | null;
                             userId: string;
                         }[];
                         stateHash: string;
@@ -8071,22 +8063,14 @@ export declare const getOrganizationReadModelOperation: Omit<{
                     groups: z.ZodCustom<{
                         groupId: string;
                         members: {
-                            encapsulationKeyFingerprint: string | null;
-                            encapsulationPublicKey: string | null;
                             role: "member" | "admin";
-                            signingKeyFingerprint: string | null;
-                            signingPublicKey: string | null;
                             userId: string;
                         }[];
                         stateHash: string;
                     }[], {
                         groupId: string;
                         members: {
-                            encapsulationKeyFingerprint: string | null;
-                            encapsulationPublicKey: string | null;
                             role: "member" | "admin";
-                            signingKeyFingerprint: string | null;
-                            signingPublicKey: string | null;
                             userId: string;
                         }[];
                         stateHash: string;