@tearleads/client-sdk 0.1.47 → 0.1.49

package/data/persistence/principalHistoryNodeRetention.js

@@ -1,48 +1,173 @@
-import { and, asc, eq } from "drizzle-orm";
+import { and, asc, eq, inArray } from "drizzle-orm";
 import { principalHistoryNodes } from "../sqlite/principalHistoryEvidenceSchema.js";
 import { principalHistoryNodeReferences } from "../sqlite/principalHistoryNodeRetentionSchema.js";
-import { decrementPrincipalHistoryNodeReference, incrementPrincipalHistoryNodeReference, } from "./principalHistoryRootOwnership.js";
-/** Register edges before inserting their proof node, preserving pre-index evidence. */
-export async function recordPrincipalHistoryNodeEdges(tx, scope, node) {
-    const key = and(eq(principalHistoryNodeReferences.scopeId, scope.scopeId), eq(principalHistoryNodeReferences.hash, node.hash));
-    const [previous] = await tx
-        .select()
-        .from(principalHistoryNodeReferences)
-        .where(key)
-        .limit(1);
-    if (previous?.leftHash === node.leftHash &&
-        previous.rightHash === node.rightHash)
+import { sqliteInsertBatchSize, sqliteRowsPerStatement, } from "../sqlite/sqliteBindBudget.js";
+import { excludedValue } from "../sqlite/sqliteUpsert.js";
+import { decrementPrincipalHistoryNodeReference, } from "./principalHistoryRootOwnership.js";
+const REFERENCE_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalHistoryNodeReferences);
+const NODE_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalHistoryNodes);
+// The scope id binds once per lookup.
+const HASH_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);
+function batches(items, size) {
+    const result = [];
+    for (let index = 0; index < items.length; index += size)
+        result.push(items.slice(index, index + size));
+    return result;
+}
+async function loadNodeReferences(tx, scope, hashes, into) {
+    const missing = [...new Set(hashes)].filter((hash) => !into.has(hash));
+    for (const batch of batches(missing, HASH_LOOKUP_BATCH_SIZE)) {
+        for (const hash of batch)
+            into.set(hash, null);
+        const rows = await tx
+            .select()
+            .from(principalHistoryNodeReferences)
+            .where(and(eq(principalHistoryNodeReferences.scopeId, scope.scopeId), inArray(principalHistoryNodeReferences.hash, batch)));
+        for (const row of rows)
+            into.set(row.hash, row);
+    }
+}
+async function loadStoredNodeHashes(tx, scope, hashes) {
+    const stored = new Set();
+    for (const batch of batches([...new Set(hashes)], HASH_LOOKUP_BATCH_SIZE)) {
+        const rows = await tx
+            .select({ hash: principalHistoryNodes.hash })
+            .from(principalHistoryNodes)
+            .where(and(eq(principalHistoryNodes.scopeId, scope.scopeId), inArray(principalHistoryNodes.hash, batch)));
+        for (const row of rows)
+            stored.add(row.hash);
+    }
+    return stored;
+}
+/**
+ * Replays the per-node edge bookkeeping in memory: increment inserts or adds
+ * one, decrement floors at zero within the scope's organization, and an edge
+ * change keeps the count while marking nodes first stored here as managed.
+ */
+function replayNodeEdges(scope, nodes, loaded, storedNodeHashes) {
+    const references = new Map(loaded);
+    const read = (hash) => {
+        const reference = references.get(hash);
+        if (reference === undefined)
+            throw new Error("Principal history node reference was not loaded");
+        return reference;
+    };
+    const increment = (hash) => {
+        const reference = read(hash);
+        references.set(hash, reference
+            ? { ...reference, referenceCount: reference.referenceCount + 1 }
+            : {
+                ...scope,
+                hash,
+                referenceCount: 1,
+                managed: false,
+                leftHash: null,
+                rightHash: null,
+            });
+    };
+    const decrement = (hash) => {
+        const reference = read(hash);
+        if (reference?.organizationId === scope.organizationId)
+            references.set(hash, {
+                ...reference,
+                referenceCount: Math.max(reference.referenceCount - 1, 0),
+            });
+    };
+    for (const node of nodes) {
+        const previous = read(node.hash);
+        if (previous?.leftHash !== node.leftHash ||
+            previous.rightHash !== node.rightHash) {
+            const managed = previous?.managed || !storedNodeHashes.has(node.hash);
+            increment(node.leftHash);
+            increment(node.rightHash);
+            const current = read(node.hash);
+            references.set(node.hash, {
+                ...(current ?? {
+                    ...scope,
+                    hash: node.hash,
+                    referenceCount: previous?.referenceCount ?? 0,
+                }),
+                leftHash: node.leftHash,
+                rightHash: node.rightHash,
+                managed,
+            });
+            for (const hash of [previous?.leftHash, previous?.rightHash])
+                if (hash)
+                    decrement(hash);
+        }
+        storedNodeHashes.add(node.hash);
+    }
+    return references;
+}
+function isSameNodeReference(left, right) {
+    return (left.organizationId === right.organizationId &&
+        left.referenceCount === right.referenceCount &&
+        left.managed === right.managed &&
+        left.leftHash === right.leftHash &&
+        left.rightHash === right.rightHash);
+}
+/**
+ * Register edges and store proof nodes in the given order, with the same
+ * result as recording each node's edges and then upserting it. Reads the
+ * touched liveness rows once, replays the bookkeeping, and writes the changed
+ * rows and the nodes as multi-row upserts.
+ */
+export async function writePrincipalHistoryNodes(tx, scope, nodes) {
+    if (nodes.length === 0)
         return;
-    const [existing] = await tx
-        .select({ hash: principalHistoryNodes.hash })
-        .from(principalHistoryNodes)
-        .where(and(eq(principalHistoryNodes.scopeId, scope.scopeId), eq(principalHistoryNodes.hash, node.hash)))
-        .limit(1);
-    for (const hash of [node.leftHash, node.rightHash])
-        await incrementPrincipalHistoryNodeReference(tx, scope, hash);
-    await tx
-        .insert(principalHistoryNodeReferences)
-        .values({
-        ...scope,
-        ...node,
-        referenceCount: previous?.referenceCount ?? 0,
-        managed: previous?.managed || !existing,
-    })
-        .onConflictDoUpdate({
-        target: [
-            principalHistoryNodeReferences.scopeId,
-            principalHistoryNodeReferences.hash,
-        ],
-        set: {
+    const loaded = new Map();
+    await loadNodeReferences(tx, scope, nodes.flatMap((node) => [node.hash, node.leftHash, node.rightHash]), loaded);
+    // An edge change releases the stored row's previous children.
+    await loadNodeReferences(tx, scope, nodes.flatMap((node) => {
+        const stored = loaded.get(node.hash);
+        return [stored?.leftHash, stored?.rightHash].filter((hash) => Boolean(hash));
+    }), loaded);
+    const replayed = replayNodeEdges(scope, nodes, loaded, await loadStoredNodeHashes(tx, scope, nodes.map((node) => node.hash)));
+    const changed = [...replayed].flatMap(([hash, reference]) => {
+        const before = loaded.get(hash);
+        return reference && !(before && isSameNodeReference(before, reference))
+            ? [reference]
+            : [];
+    });
+    for (const batch of batches(changed, REFERENCE_WRITE_BATCH_SIZE))
+        await tx
+            .insert(principalHistoryNodeReferences)
+            .values(batch)
+            .onConflictDoUpdate({
+            target: [
+                principalHistoryNodeReferences.scopeId,
+                principalHistoryNodeReferences.hash,
+            ],
+            set: {
+                referenceCount: excludedValue(principalHistoryNodeReferences.referenceCount),
+                managed: excludedValue(principalHistoryNodeReferences.managed),
+                leftHash: excludedValue(principalHistoryNodeReferences.leftHash),
+                rightHash: excludedValue(principalHistoryNodeReferences.rightHash),
+            },
+        })
+            .run();
+    const nodeRows = new Map(nodes.map((node) => [
+        node.hash,
+        {
+            ...scope,
+            hash: node.hash,
             leftHash: node.leftHash,
             rightHash: node.rightHash,
-            managed: previous?.managed || !existing,
         },
-    })
-        .run();
-    for (const hash of [previous?.leftHash, previous?.rightHash])
-        if (hash)
-            await decrementPrincipalHistoryNodeReference(tx, scope, hash);
+    ]));
+    for (const batch of batches([...nodeRows.values()], NODE_WRITE_BATCH_SIZE))
+        await tx
+            .insert(principalHistoryNodes)
+            .values(batch)
+            .onConflictDoUpdate({
+            target: [principalHistoryNodes.scopeId, principalHistoryNodes.hash],
+            set: {
+                organizationId: excludedValue(principalHistoryNodes.organizationId),
+                leftHash: excludedValue(principalHistoryNodes.leftHash),
+                rightHash: excludedValue(principalHistoryNodes.rightHash),
+            },
+        })
+            .run();
 }
 /** A bounded cascade releases only managed proof nodes with no live incoming edge. */
 export async function reclaimPrincipalHistoryNodes(tx, scope) {

package/data/persistence/principalHistoryNodeRetention.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryNodeRetention.js","sourceRoot":"","sources":["principalHistoryNodeRetention.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAE/F,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GAEvC,MAAM,iCAAiC,CAAC;AAEzC,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAAgC,EAChC,KAAgC,EAChC,IAA+B;IAE/B,MAAM,GAAG,GAAG,GAAG,CACb,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACzD,EAAE,CAAC,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,8BAA8B,CAAC;SACpC,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IACE,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ;QACpC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAErC,OAAO;IACT,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC;SAC5C,IAAI,CAAC,qBAAqB,CAAC;SAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAC1C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;QAChD,MAAM,sCAAsC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,EAAE;SACL,MAAM,CAAC,8BAA8B,CAAC;SACtC,MAAM,CAAC;QACN,GAAG,KAAK;QACR,GAAG,IAAI;QACP,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ;KACxC,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,8BAA8B,CAAC,OAAO;YACtC,8BAA8B,CAAC,IAAI;SACpC;QACD,GAAG,EAAE;YACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ;SACxC;KACF,CAAC;SACD,GAAG,EAAE,CAAC;IACT,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC1D,IAAI,IAAI;YAAE,MAAM,sCAAsC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAgC,EAChC,KAAgC;IAEhC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,SAAS,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,8BAA8B,CAAC;aACpC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACzD,EAAE,CACA,8BAA8B,CAAC,cAAc,EAC7C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,EAChD,EAAE,CAAC,8BAA8B,CAAC,cAAc,EAAE,CAAC,CAAC,CACrD,CACF;aACA,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;aACjD,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;QACzB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,EAAE;iBACL,MAAM,CAAC,qBAAqB,CAAC;iBAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EAC9D,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAC1C,CACF;iBACA,GAAG,EAAE,CAAC;YACT,MAAM,EAAE;iBACL,MAAM,CAAC,8BAA8B,CAAC;iBACtC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACzD,EAAE,CAAC,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CACnD,CACF;iBACA,GAAG,EAAE,CAAC;YACT,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;gBAChD,IAAI,IAAI;oBAAE,MAAM,sCAAsC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1E,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import type { PrincipalHistoryIndexNode } from \"@tearleads/crypto\";\nimport { and, asc, eq } from \"drizzle-orm\";\nimport { principalHistoryNodes } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryNodeReferences } from \"../sqlite/principalHistoryNodeRetentionSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport {\n  decrementPrincipalHistoryNodeReference,\n  incrementPrincipalHistoryNodeReference,\n  type PrincipalHistoryNodeScope,\n} from \"./principalHistoryRootOwnership\";\n\n/** Register edges before inserting their proof node, preserving pre-index evidence. */\nexport async function recordPrincipalHistoryNodeEdges(\n  tx: ClientSQLiteTransactionScope,\n  scope: PrincipalHistoryNodeScope,\n  node: PrincipalHistoryIndexNode,\n) {\n  const key = and(\n    eq(principalHistoryNodeReferences.scopeId, scope.scopeId),\n    eq(principalHistoryNodeReferences.hash, node.hash),\n  );\n  const [previous] = await tx\n    .select()\n    .from(principalHistoryNodeReferences)\n    .where(key)\n    .limit(1);\n  if (\n    previous?.leftHash === node.leftHash &&\n    previous.rightHash === node.rightHash\n  )\n    return;\n  const [existing] = await tx\n    .select({ hash: principalHistoryNodes.hash })\n    .from(principalHistoryNodes)\n    .where(\n      and(\n        eq(principalHistoryNodes.scopeId, scope.scopeId),\n        eq(principalHistoryNodes.hash, node.hash),\n      ),\n    )\n    .limit(1);\n  for (const hash of [node.leftHash, node.rightHash])\n    await incrementPrincipalHistoryNodeReference(tx, scope, hash);\n  await tx\n    .insert(principalHistoryNodeReferences)\n    .values({\n      ...scope,\n      ...node,\n      referenceCount: previous?.referenceCount ?? 0,\n      managed: previous?.managed || !existing,\n    })\n    .onConflictDoUpdate({\n      target: [\n        principalHistoryNodeReferences.scopeId,\n        principalHistoryNodeReferences.hash,\n      ],\n      set: {\n        leftHash: node.leftHash,\n        rightHash: node.rightHash,\n        managed: previous?.managed || !existing,\n      },\n    })\n    .run();\n  for (const hash of [previous?.leftHash, previous?.rightHash])\n    if (hash) await decrementPrincipalHistoryNodeReference(tx, scope, hash);\n}\n\n/** A bounded cascade releases only managed proof nodes with no live incoming edge. */\nexport async function reclaimPrincipalHistoryNodes(\n  tx: ClientSQLiteTransactionScope,\n  scope: PrincipalHistoryNodeScope,\n): Promise<number> {\n  let reclaimed = 0;\n  while (reclaimed < 64) {\n    const obsolete = await tx\n      .select()\n      .from(principalHistoryNodeReferences)\n      .where(\n        and(\n          eq(principalHistoryNodeReferences.scopeId, scope.scopeId),\n          eq(\n            principalHistoryNodeReferences.organizationId,\n            scope.organizationId,\n          ),\n          eq(principalHistoryNodeReferences.managed, true),\n          eq(principalHistoryNodeReferences.referenceCount, 0),\n        ),\n      )\n      .orderBy(asc(principalHistoryNodeReferences.hash))\n      .limit(64 - reclaimed);\n    if (obsolete.length === 0) break;\n    for (const node of obsolete) {\n      await tx\n        .delete(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, scope.scopeId),\n            eq(principalHistoryNodes.organizationId, scope.organizationId),\n            eq(principalHistoryNodes.hash, node.hash),\n          ),\n        )\n        .run();\n      await tx\n        .delete(principalHistoryNodeReferences)\n        .where(\n          and(\n            eq(principalHistoryNodeReferences.scopeId, scope.scopeId),\n            eq(principalHistoryNodeReferences.hash, node.hash),\n          ),\n        )\n        .run();\n      for (const hash of [node.leftHash, node.rightHash])\n        if (hash) await decrementPrincipalHistoryNodeReference(tx, scope, hash);\n      reclaimed += 1;\n    }\n  }\n  return reclaimed;\n}\n"]}
+{"version":3,"file":"principalHistoryNodeRetention.js","sourceRoot":"","sources":["principalHistoryNodeRetention.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,sCAAsC,GAEvC,MAAM,iCAAiC,CAAC;AAKzC,MAAM,0BAA0B,GAAG,qBAAqB,CACtD,8BAA8B,CAC/B,CAAC;AACF,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;AAC3E,sCAAsC;AACtC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE5D,SAAS,OAAO,CAAI,KAAmB,EAAE,IAAY;IACnD,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI;QACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAgC,EAChC,KAAgC,EAChC,MAAyB,EACzB,IAAuD;IAEvD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,8BAA8B,CAAC;aACpC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACzD,OAAO,CAAC,8BAA8B,CAAC,IAAI,EAAE,KAAK,CAAC,CACpD,CACF,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAgC,EAChC,KAAgC,EAChC,MAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC;aAC5C,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAC3C,CACF,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,KAAgC,EAChC,KAA2C,EAC3C,MAAiE,EACjE,gBAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,UAAU,CAAC,GAAG,CACZ,IAAI,EACJ,SAAS;YACP,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,GAAG,CAAC,EAAE;YAChE,CAAC,CAAC;gBACE,GAAG,KAAK;gBACR,IAAI;gBACJ,cAAc,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;aAChB,CACN,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,SAAS,EAAE,cAAc,KAAK,KAAK,CAAC,cAAc;YACpD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE;gBACnB,GAAG,SAAS;gBACZ,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC,CAAC;aAC1D,CAAC,CAAC;IACP,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IACE,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACpC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EACrC,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;gBACxB,GAAG,CAAC,OAAO,IAAI;oBACb,GAAG,KAAK;oBACR,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,CAAC;iBAC9C,CAAC;gBACF,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO;aACR,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;gBAC1D,IAAI,IAAI;oBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAmC,EACnC,KAAoC;IAEpC,OAAO,CACL,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC5C,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC5C,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAgC,EAChC,KAAgC,EAChC,KAA2C;IAE3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,MAAM,kBAAkB,CACtB,EAAE,EACF,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EACnE,MAAM,CACP,CAAC;IACF,8DAA8D;IAC9D,MAAM,kBAAkB,CACtB,EAAE,EACF,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,CACjD,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,EACF,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,eAAe,CAC9B,KAAK,EACL,KAAK,EACL,MAAM,EACN,MAAM,oBAAoB,CACxB,EAAE,EACF,KAAK,EACL,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC,SAAS,CAAC;YACb,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,0BAA0B,CAAC;QAC9D,MAAM,EAAE;aACL,MAAM,CAAC,8BAA8B,CAAC;aACtC,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,8BAA8B,CAAC,OAAO;gBACtC,8BAA8B,CAAC,IAAI;aACpC;YACD,GAAG,EAAE;gBACH,cAAc,EAAE,aAAa,CAC3B,8BAA8B,CAAC,cAAc,CAC9C;gBACD,OAAO,EAAE,aAAa,CAAC,8BAA8B,CAAC,OAAO,CAAC;gBAC9D,QAAQ,EAAE,aAAa,CAAC,8BAA8B,CAAC,QAAQ,CAAC;gBAChE,SAAS,EAAE,aAAa,CAAC,8BAA8B,CAAC,SAAS,CAAC;aACnE;SACF,CAAC;aACD,GAAG,EAAE,CAAC;IACX,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI;QACT;YACE,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,CAAC,CACH,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,qBAAqB,CAAC;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,qBAAqB,CAAC;aAC7B,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC;YACnE,GAAG,EAAE;gBACH,cAAc,EAAE,aAAa,CAAC,qBAAqB,CAAC,cAAc,CAAC;gBACnE,QAAQ,EAAE,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC;gBACvD,SAAS,EAAE,aAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;aAC1D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAgC,EAChC,KAAgC;IAEhC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,SAAS,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,8BAA8B,CAAC;aACpC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACzD,EAAE,CACA,8BAA8B,CAAC,cAAc,EAC7C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,EAChD,EAAE,CAAC,8BAA8B,CAAC,cAAc,EAAE,CAAC,CAAC,CACrD,CACF;aACA,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;aACjD,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;QACzB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,EAAE;iBACL,MAAM,CAAC,qBAAqB,CAAC;iBAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EAC9D,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAC1C,CACF;iBACA,GAAG,EAAE,CAAC;YACT,MAAM,EAAE;iBACL,MAAM,CAAC,8BAA8B,CAAC;iBACtC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACzD,EAAE,CAAC,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CACnD,CACF;iBACA,GAAG,EAAE,CAAC;YACT,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;gBAChD,IAAI,IAAI;oBAAE,MAAM,sCAAsC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1E,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import type { PrincipalHistoryIndexNode } from \"@tearleads/crypto\";\nimport { and, asc, eq, inArray } from \"drizzle-orm\";\nimport { principalHistoryNodes } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryNodeReferences } from \"../sqlite/principalHistoryNodeRetentionSchema\";\nimport {\n  sqliteInsertBatchSize,\n  sqliteRowsPerStatement,\n} from \"../sqlite/sqliteBindBudget\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../sqlite/sqliteUpsert\";\nimport {\n  decrementPrincipalHistoryNodeReference,\n  type PrincipalHistoryNodeScope,\n} from \"./principalHistoryRootOwnership\";\n\ntype PrincipalHistoryNodeReference =\n  typeof principalHistoryNodeReferences.$inferSelect;\n\nconst REFERENCE_WRITE_BATCH_SIZE = sqliteInsertBatchSize(\n  principalHistoryNodeReferences,\n);\nconst NODE_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalHistoryNodes);\n// The scope id binds once per lookup.\nconst HASH_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);\n\nfunction batches<T>(items: readonly T[], size: number): T[][] {\n  const result: T[][] = [];\n  for (let index = 0; index < items.length; index += size)\n    result.push(items.slice(index, index + size));\n  return result;\n}\n\nasync function loadNodeReferences(\n  tx: ClientSQLiteTransactionScope,\n  scope: PrincipalHistoryNodeScope,\n  hashes: readonly string[],\n  into: Map<string, PrincipalHistoryNodeReference | null>,\n): Promise<void> {\n  const missing = [...new Set(hashes)].filter((hash) => !into.has(hash));\n  for (const batch of batches(missing, HASH_LOOKUP_BATCH_SIZE)) {\n    for (const hash of batch) into.set(hash, null);\n    const rows = await tx\n      .select()\n      .from(principalHistoryNodeReferences)\n      .where(\n        and(\n          eq(principalHistoryNodeReferences.scopeId, scope.scopeId),\n          inArray(principalHistoryNodeReferences.hash, batch),\n        ),\n      );\n    for (const row of rows) into.set(row.hash, row);\n  }\n}\n\nasync function loadStoredNodeHashes(\n  tx: ClientSQLiteTransactionScope,\n  scope: PrincipalHistoryNodeScope,\n  hashes: readonly string[],\n): Promise<Set<string>> {\n  const stored = new Set<string>();\n  for (const batch of batches([...new Set(hashes)], HASH_LOOKUP_BATCH_SIZE)) {\n    const rows = await tx\n      .select({ hash: principalHistoryNodes.hash })\n      .from(principalHistoryNodes)\n      .where(\n        and(\n          eq(principalHistoryNodes.scopeId, scope.scopeId),\n          inArray(principalHistoryNodes.hash, batch),\n        ),\n      );\n    for (const row of rows) stored.add(row.hash);\n  }\n  return stored;\n}\n\n/**\n * Replays the per-node edge bookkeeping in memory: increment inserts or adds\n * one, decrement floors at zero within the scope's organization, and an edge\n * change keeps the count while marking nodes first stored here as managed.\n */\nfunction replayNodeEdges(\n  scope: PrincipalHistoryNodeScope,\n  nodes: readonly PrincipalHistoryIndexNode[],\n  loaded: ReadonlyMap<string, PrincipalHistoryNodeReference | null>,\n  storedNodeHashes: Set<string>,\n): Map<string, PrincipalHistoryNodeReference | null> {\n  const references = new Map(loaded);\n  const read = (hash: string) => {\n    const reference = references.get(hash);\n    if (reference === undefined)\n      throw new Error(\"Principal history node reference was not loaded\");\n    return reference;\n  };\n  const increment = (hash: string) => {\n    const reference = read(hash);\n    references.set(\n      hash,\n      reference\n        ? { ...reference, referenceCount: reference.referenceCount + 1 }\n        : {\n            ...scope,\n            hash,\n            referenceCount: 1,\n            managed: false,\n            leftHash: null,\n            rightHash: null,\n          },\n    );\n  };\n  const decrement = (hash: string) => {\n    const reference = read(hash);\n    if (reference?.organizationId === scope.organizationId)\n      references.set(hash, {\n        ...reference,\n        referenceCount: Math.max(reference.referenceCount - 1, 0),\n      });\n  };\n  for (const node of nodes) {\n    const previous = read(node.hash);\n    if (\n      previous?.leftHash !== node.leftHash ||\n      previous.rightHash !== node.rightHash\n    ) {\n      const managed = previous?.managed || !storedNodeHashes.has(node.hash);\n      increment(node.leftHash);\n      increment(node.rightHash);\n      const current = read(node.hash);\n      references.set(node.hash, {\n        ...(current ?? {\n          ...scope,\n          hash: node.hash,\n          referenceCount: previous?.referenceCount ?? 0,\n        }),\n        leftHash: node.leftHash,\n        rightHash: node.rightHash,\n        managed,\n      });\n      for (const hash of [previous?.leftHash, previous?.rightHash])\n        if (hash) decrement(hash);\n    }\n    storedNodeHashes.add(node.hash);\n  }\n  return references;\n}\n\nfunction isSameNodeReference(\n  left: PrincipalHistoryNodeReference,\n  right: PrincipalHistoryNodeReference,\n): boolean {\n  return (\n    left.organizationId === right.organizationId &&\n    left.referenceCount === right.referenceCount &&\n    left.managed === right.managed &&\n    left.leftHash === right.leftHash &&\n    left.rightHash === right.rightHash\n  );\n}\n\n/**\n * Register edges and store proof nodes in the given order, with the same\n * result as recording each node's edges and then upserting it. Reads the\n * touched liveness rows once, replays the bookkeeping, and writes the changed\n * rows and the nodes as multi-row upserts.\n */\nexport async function writePrincipalHistoryNodes(\n  tx: ClientSQLiteTransactionScope,\n  scope: PrincipalHistoryNodeScope,\n  nodes: readonly PrincipalHistoryIndexNode[],\n): Promise<void> {\n  if (nodes.length === 0) return;\n  const loaded = new Map<string, PrincipalHistoryNodeReference | null>();\n  await loadNodeReferences(\n    tx,\n    scope,\n    nodes.flatMap((node) => [node.hash, node.leftHash, node.rightHash]),\n    loaded,\n  );\n  // An edge change releases the stored row's previous children.\n  await loadNodeReferences(\n    tx,\n    scope,\n    nodes.flatMap((node) => {\n      const stored = loaded.get(node.hash);\n      return [stored?.leftHash, stored?.rightHash].filter(\n        (hash): hash is string => Boolean(hash),\n      );\n    }),\n    loaded,\n  );\n  const replayed = replayNodeEdges(\n    scope,\n    nodes,\n    loaded,\n    await loadStoredNodeHashes(\n      tx,\n      scope,\n      nodes.map((node) => node.hash),\n    ),\n  );\n  const changed = [...replayed].flatMap(([hash, reference]) => {\n    const before = loaded.get(hash);\n    return reference && !(before && isSameNodeReference(before, reference))\n      ? [reference]\n      : [];\n  });\n  for (const batch of batches(changed, REFERENCE_WRITE_BATCH_SIZE))\n    await tx\n      .insert(principalHistoryNodeReferences)\n      .values(batch)\n      .onConflictDoUpdate({\n        target: [\n          principalHistoryNodeReferences.scopeId,\n          principalHistoryNodeReferences.hash,\n        ],\n        set: {\n          referenceCount: excludedValue(\n            principalHistoryNodeReferences.referenceCount,\n          ),\n          managed: excludedValue(principalHistoryNodeReferences.managed),\n          leftHash: excludedValue(principalHistoryNodeReferences.leftHash),\n          rightHash: excludedValue(principalHistoryNodeReferences.rightHash),\n        },\n      })\n      .run();\n  const nodeRows = new Map(\n    nodes.map((node) => [\n      node.hash,\n      {\n        ...scope,\n        hash: node.hash,\n        leftHash: node.leftHash,\n        rightHash: node.rightHash,\n      },\n    ]),\n  );\n  for (const batch of batches([...nodeRows.values()], NODE_WRITE_BATCH_SIZE))\n    await tx\n      .insert(principalHistoryNodes)\n      .values(batch)\n      .onConflictDoUpdate({\n        target: [principalHistoryNodes.scopeId, principalHistoryNodes.hash],\n        set: {\n          organizationId: excludedValue(principalHistoryNodes.organizationId),\n          leftHash: excludedValue(principalHistoryNodes.leftHash),\n          rightHash: excludedValue(principalHistoryNodes.rightHash),\n        },\n      })\n      .run();\n}\n\n/** A bounded cascade releases only managed proof nodes with no live incoming edge. */\nexport async function reclaimPrincipalHistoryNodes(\n  tx: ClientSQLiteTransactionScope,\n  scope: PrincipalHistoryNodeScope,\n): Promise<number> {\n  let reclaimed = 0;\n  while (reclaimed < 64) {\n    const obsolete = await tx\n      .select()\n      .from(principalHistoryNodeReferences)\n      .where(\n        and(\n          eq(principalHistoryNodeReferences.scopeId, scope.scopeId),\n          eq(\n            principalHistoryNodeReferences.organizationId,\n            scope.organizationId,\n          ),\n          eq(principalHistoryNodeReferences.managed, true),\n          eq(principalHistoryNodeReferences.referenceCount, 0),\n        ),\n      )\n      .orderBy(asc(principalHistoryNodeReferences.hash))\n      .limit(64 - reclaimed);\n    if (obsolete.length === 0) break;\n    for (const node of obsolete) {\n      await tx\n        .delete(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, scope.scopeId),\n            eq(principalHistoryNodes.organizationId, scope.organizationId),\n            eq(principalHistoryNodes.hash, node.hash),\n          ),\n        )\n        .run();\n      await tx\n        .delete(principalHistoryNodeReferences)\n        .where(\n          and(\n            eq(principalHistoryNodeReferences.scopeId, scope.scopeId),\n            eq(principalHistoryNodeReferences.hash, node.hash),\n          ),\n        )\n        .run();\n      for (const hash of [node.leftHash, node.rightHash])\n        if (hash) await decrementPrincipalHistoryNodeReference(tx, scope, hash);\n      reclaimed += 1;\n    }\n  }\n  return reclaimed;\n}\n"]}

package/data/persistence/principalPolicyReferenceIndexPersistence.js

@@ -1,52 +1,115 @@
 import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray, or } from "drizzle-orm";
 import { principalPolicyBundleStates } from "../principalPolicyStates.js";
 import { principalPolicyBundleReferences } from "../sqlite/schema.js";
-function exactReferenceWhere(row) {
-    return and(eq(principalPolicyBundleReferences.principalType, row.principalType), eq(principalPolicyBundleReferences.principalId, row.principalId), eq(principalPolicyBundleReferences.version, row.version), eq(principalPolicyBundleReferences.stateHash, row.stateHash), eq(principalPolicyBundleReferences.keyEpoch, row.keyEpoch), eq(principalPolicyBundleReferences.keyFingerprint, row.keyFingerprint));
+import { sqliteInsertBatchSize, sqliteRowsPerStatement, } from "../sqlite/sqliteBindBudget.js";
+const REFERENCE_INSERT_BATCH_SIZE = sqliteInsertBatchSize(principalPolicyBundleReferences);
+// Principal type and id plus the bundle version and state hash bind once.
+const REFERENCE_LOOKUP_VERSIONS = sqliteRowsPerStatement(1, 4);
+/** The exact six-field match; the lookup already fixes the principal. */
+function isSameReference(stored, row) {
+    return (stored.version === row.version &&
+        stored.stateHash === row.stateHash &&
+        stored.keyEpoch === row.keyEpoch &&
+        stored.keyFingerprint === row.keyFingerprint);
 }
-async function assertNoIndexedConflict(tx, row) {
-    const conflicts = await tx
-        .select({
-        bundleStateHash: principalPolicyBundleReferences.bundleStateHash,
-    })
-        .from(principalPolicyBundleReferences)
-        .where(and(exactReferenceWhere(row), eq(principalPolicyBundleReferences.bundleVersion, row.bundleVersion)));
-    if (conflicts.some(({ bundleStateHash }) => bundleStateHash !== row.bundleStateHash)) {
-        throw new KeyingVerificationError("equivocation", "principal policy reference has conflicting bundle heads at one version");
+/** The table's primary key within one principal. */
+function referenceKey(row) {
+    return JSON.stringify([
+        row.version,
+        row.stateHash,
+        row.keyEpoch,
+        row.keyFingerprint,
+        row.bundleStateHash,
+    ]);
+}
+/** Rows either equivocation check can match, read before this bundle's writes. */
+async function loadStoredReferences(tx, head, versions) {
+    const stored = [];
+    for (let index = 0; index < versions.length; index += REFERENCE_LOOKUP_VERSIONS) {
+        stored.push(...(await tx
+            .select({
+            version: principalPolicyBundleReferences.version,
+            stateHash: principalPolicyBundleReferences.stateHash,
+            keyEpoch: principalPolicyBundleReferences.keyEpoch,
+            keyFingerprint: principalPolicyBundleReferences.keyFingerprint,
+            bundleVersion: principalPolicyBundleReferences.bundleVersion,
+            bundleStateHash: principalPolicyBundleReferences.bundleStateHash,
+        })
+            .from(principalPolicyBundleReferences)
+            .where(and(eq(principalPolicyBundleReferences.principalType, head.principalType), eq(principalPolicyBundleReferences.principalId, head.principalId), inArray(principalPolicyBundleReferences.version, versions.slice(index, index + REFERENCE_LOOKUP_VERSIONS)), or(eq(principalPolicyBundleReferences.bundleVersion, head.version), eq(principalPolicyBundleReferences.bundleStateHash, head.stateHash))))));
     }
+    return stored;
 }
-export async function indexPrincipalPolicyBundleInTransaction(tx, bundle) {
-    const head = bundle.currentState;
-    for (const state of principalPolicyBundleStates(bundle)) {
-        if (state.principalType !== head.principalType ||
-            state.principalId !== head.principalId) {
-            throw new KeyingVerificationError("object_mismatch", "principal policy bundle reference belongs to another principal");
-        }
-        const row = {
-            principalType: state.principalType,
-            principalId: state.principalId,
-            version: state.version,
-            stateHash: state.stateHash,
-            keyEpoch: state.keyEpoch,
-            keyFingerprint: state.keyFingerprint,
-            bundleVersion: head.version,
-            bundleStateHash: head.stateHash,
-        };
-        await assertNoIndexedConflict(tx, row);
+/**
+ * Rows written earlier in the same bundle all carry its head, so neither
+ * check can match them: each state's outcome depends only on stored rows.
+ */
+function referenceConflict(row, stored) {
+    const sameReference = stored.filter((candidate) => isSameReference(candidate, row));
+    if (sameReference.some((candidate) => candidate.bundleVersion === row.bundleVersion &&
+        candidate.bundleStateHash !== row.bundleStateHash))
+        return new KeyingVerificationError("equivocation", "principal policy reference has conflicting bundle heads at one version");
+    const indexed = sameReference.find((candidate) => candidate.bundleStateHash === row.bundleStateHash);
+    if (indexed && indexed.bundleVersion !== row.bundleVersion)
+        return new KeyingVerificationError("equivocation", "principal policy reference index conflicts with the bundle head");
+    return null;
+}
+async function insertMissingReferences(tx, rows, stored) {
+    const present = new Set(stored.map(referenceKey));
+    const missing = new Map();
+    for (const row of rows) {
+        const key = referenceKey(row);
+        if (!present.has(key) && !missing.has(key))
+            missing.set(key, row);
+    }
+    const values = [...missing.values()];
+    for (let index = 0; index < values.length; index += REFERENCE_INSERT_BATCH_SIZE) {
         await tx
             .insert(principalPolicyBundleReferences)
-            .values(row)
+            .values(values.slice(index, index + REFERENCE_INSERT_BATCH_SIZE))
             .onConflictDoNothing()
             .run();
-        const [stored] = await tx
-            .select({ bundleVersion: principalPolicyBundleReferences.bundleVersion })
-            .from(principalPolicyBundleReferences)
-            .where(and(exactReferenceWhere(row), eq(principalPolicyBundleReferences.bundleStateHash, row.bundleStateHash)))
-            .limit(1);
-        if (stored?.bundleVersion !== row.bundleVersion) {
-            throw new KeyingVerificationError("equivocation", "principal policy reference index conflicts with the bundle head");
+    }
+}
+/**
+ * Index every state of a verified bundle under its head. Fails in state order
+ * with the per-state checks' errors, keeping the states indexed before the
+ * first failure.
+ */
+export async function indexPrincipalPolicyBundleInTransaction(tx, bundle) {
+    const head = bundle.currentState;
+    const states = principalPolicyBundleStates(bundle);
+    const foreignIndex = states.findIndex((state) => state.principalType !== head.principalType ||
+        state.principalId !== head.principalId);
+    const rows = (foreignIndex === -1 ? states : states.slice(0, foreignIndex)).map((state) => ({
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        stateHash: state.stateHash,
+        keyEpoch: state.keyEpoch,
+        keyFingerprint: state.keyFingerprint,
+        bundleVersion: head.version,
+        bundleStateHash: head.stateHash,
+    }));
+    const stored = rows.length === 0
+        ? []
+        : await loadStoredReferences(tx, head, [
+            ...new Set(rows.map((row) => row.version)),
+        ]);
+    let failure = null;
+    let accepted = rows.length;
+    for (const [index, row] of rows.entries()) {
+        failure = referenceConflict(row, stored);
+        if (failure) {
+            accepted = index;
+            break;
         }
     }
+    if (!failure && foreignIndex !== -1)
+        failure = new KeyingVerificationError("object_mismatch", "principal policy bundle reference belongs to another principal");
+    await insertMissingReferences(tx, rows.slice(0, accepted), stored);
+    if (failure)
+        throw failure;
 }
 //# sourceMappingURL=principalPolicyReferenceIndexPersistence.js.map

package/data/persistence/principalPolicyReferenceIndexPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyReferenceIndexPersistence.js","sourceRoot":"","sources":["principalPolicyReferenceIndexPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAMnE,SAAS,mBAAmB,CAAC,GAAgC;IAC3D,OAAO,GAAG,CACR,EAAE,CAAC,+BAA+B,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,+BAA+B,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,EAChE,EAAE,CAAC,+BAA+B,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EACxD,EAAE,CAAC,+BAA+B,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAC5D,EAAE,CAAC,+BAA+B,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,EAC1D,EAAE,CAAC,+BAA+B,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,EAAgC,EAChC,GAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC;QACN,eAAe,EAAE,+BAA+B,CAAC,eAAe;KACjE,CAAC;SACD,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,mBAAmB,CAAC,GAAG,CAAC,EACxB,EAAE,CAAC,+BAA+B,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CACrE,CACF,CAAC;IACJ,IACE,SAAS,CAAC,IAAI,CACZ,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe,CACjE,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,EAAgC,EAChC,MAAqC;IAErC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IACE,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EACtC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAgC;YACvC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,eAAe,EAAE,IAAI,CAAC,SAAS;SAChC,CAAC;QACF,MAAM,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE;aACL,MAAM,CAAC,+BAA+B,CAAC;aACvC,MAAM,CAAC,GAAG,CAAC;aACX,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,aAAa,EAAE,+BAA+B,CAAC,aAAa,EAAE,CAAC;aACxE,IAAI,CAAC,+BAA+B,CAAC;aACrC,KAAK,CACJ,GAAG,CACD,mBAAmB,CAAC,GAAG,CAAC,EACxB,EAAE,CACA,+BAA+B,CAAC,eAAe,EAC/C,GAAG,CAAC,eAAe,CACpB,CACF,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM,EAAE,aAAa,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalPolicyBundleStates } from \"../principalPolicyStates\";\nimport { principalPolicyBundleReferences } from \"../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\ntype PrincipalPolicyReferenceRow =\n  typeof principalPolicyBundleReferences.$inferInsert;\n\nfunction exactReferenceWhere(row: PrincipalPolicyReferenceRow) {\n  return and(\n    eq(principalPolicyBundleReferences.principalType, row.principalType),\n    eq(principalPolicyBundleReferences.principalId, row.principalId),\n    eq(principalPolicyBundleReferences.version, row.version),\n    eq(principalPolicyBundleReferences.stateHash, row.stateHash),\n    eq(principalPolicyBundleReferences.keyEpoch, row.keyEpoch),\n    eq(principalPolicyBundleReferences.keyFingerprint, row.keyFingerprint),\n  );\n}\n\nasync function assertNoIndexedConflict(\n  tx: ClientSQLiteTransactionScope,\n  row: PrincipalPolicyReferenceRow,\n): Promise<void> {\n  const conflicts = await tx\n    .select({\n      bundleStateHash: principalPolicyBundleReferences.bundleStateHash,\n    })\n    .from(principalPolicyBundleReferences)\n    .where(\n      and(\n        exactReferenceWhere(row),\n        eq(principalPolicyBundleReferences.bundleVersion, row.bundleVersion),\n      ),\n    );\n  if (\n    conflicts.some(\n      ({ bundleStateHash }) => bundleStateHash !== row.bundleStateHash,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy reference has conflicting bundle heads at one version\",\n    );\n  }\n}\n\nexport async function indexPrincipalPolicyBundleInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<void> {\n  const head = bundle.currentState;\n  for (const state of principalPolicyBundleStates(bundle)) {\n    if (\n      state.principalType !== head.principalType ||\n      state.principalId !== head.principalId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"principal policy bundle reference belongs to another principal\",\n      );\n    }\n    const row: PrincipalPolicyReferenceRow = {\n      principalType: state.principalType,\n      principalId: state.principalId,\n      version: state.version,\n      stateHash: state.stateHash,\n      keyEpoch: state.keyEpoch,\n      keyFingerprint: state.keyFingerprint,\n      bundleVersion: head.version,\n      bundleStateHash: head.stateHash,\n    };\n    await assertNoIndexedConflict(tx, row);\n    await tx\n      .insert(principalPolicyBundleReferences)\n      .values(row)\n      .onConflictDoNothing()\n      .run();\n    const [stored] = await tx\n      .select({ bundleVersion: principalPolicyBundleReferences.bundleVersion })\n      .from(principalPolicyBundleReferences)\n      .where(\n        and(\n          exactReferenceWhere(row),\n          eq(\n            principalPolicyBundleReferences.bundleStateHash,\n            row.bundleStateHash,\n          ),\n        ),\n      )\n      .limit(1);\n    if (stored?.bundleVersion !== row.bundleVersion) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"principal policy reference index conflicts with the bundle head\",\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"principalPolicyReferenceIndexPersistence.js","sourceRoot":"","sources":["principalPolicyReferenceIndexPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAgBpC,MAAM,2BAA2B,GAAG,qBAAqB,CACvD,+BAA+B,CAChC,CAAC;AACF,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/D,yEAAyE;AACzE,SAAS,eAAe,CACtB,MAAsC,EACtC,GAAgC;IAEhC,OAAO,CACL,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;QAC9B,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;QAClC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAChC,MAAM,CAAC,cAAc,KAAK,GAAG,CAAC,cAAc,CAC7C,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CACnB,GAGC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,eAAe;KACpB,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,oBAAoB,CACjC,EAAgC,EAChC,IAAmD,EACnD,QAA2B;IAE3B,MAAM,MAAM,GAAqC,EAAE,CAAC;IACpD,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,QAAQ,CAAC,MAAM,EACvB,KAAK,IAAI,yBAAyB,EAClC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,EAAE;aACT,MAAM,CAAC;YACN,OAAO,EAAE,+BAA+B,CAAC,OAAO;YAChD,SAAS,EAAE,+BAA+B,CAAC,SAAS;YACpD,QAAQ,EAAE,+BAA+B,CAAC,QAAQ;YAClD,cAAc,EAAE,+BAA+B,CAAC,cAAc;YAC9D,aAAa,EAAE,+BAA+B,CAAC,aAAa;YAC5D,eAAe,EAAE,+BAA+B,CAAC,eAAe;SACjE,CAAC;aACD,IAAI,CAAC,+BAA+B,CAAC;aACrC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,aAAa,EAC7C,IAAI,CAAC,aAAa,CACnB,EACD,EAAE,CAAC,+BAA+B,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,EACjE,OAAO,CACL,+BAA+B,CAAC,OAAO,EACvC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,yBAAyB,CAAC,CACzD,EACD,EAAE,CACA,EAAE,CAAC,+BAA+B,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/D,EAAE,CACA,+BAA+B,CAAC,eAAe,EAC/C,IAAI,CAAC,SAAS,CACf,CACF,CACF,CACF,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACxB,GAAgC,EAChC,MAAiD;IAEjD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAChD,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CAAC;IACF,IACE,aAAa,CAAC,IAAI,CAChB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa;QAC7C,SAAS,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe,CACpD;QAED,OAAO,IAAI,uBAAuB,CAChC,cAAc,EACd,wEAAwE,CACzE,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe,CACjE,CAAC;IACF,IAAI,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa;QACxD,OAAO,IAAI,uBAAuB,CAChC,cAAc,EACd,iEAAiE,CAClE,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,EAAgC,EAChC,IAA4C,EAC5C,MAAiD;IAEjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,MAAM,CAAC,MAAM,EACrB,KAAK,IAAI,2BAA2B,EACpC,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,+BAA+B,CAAC;aACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,2BAA2B,CAAC,CAAC;aAChE,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,EAAgC,EAChC,MAAqC;IAErC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CACnC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CACzC,CAAC;IACF,MAAM,IAAI,GAAkC,CAC1C,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAC7D,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,IAAI,CAAC,OAAO;QAC3B,eAAe,EAAE,IAAI,CAAC,SAAS;KAChC,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,CAAC;QACf,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE;YACnC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SAC3C,CAAC,CAAC;IACT,IAAI,OAAO,GAAmC,IAAI,CAAC;IACnD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,GAAG,KAAK,CAAC;YACjB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,YAAY,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,IAAI,uBAAuB,CACnC,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;IACJ,MAAM,uBAAuB,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;AAC7B,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { and, eq, inArray, or } from \"drizzle-orm\";\nimport { principalPolicyBundleStates } from \"../principalPolicyStates\";\nimport { principalPolicyBundleReferences } from \"../sqlite/schema\";\nimport {\n  sqliteInsertBatchSize,\n  sqliteRowsPerStatement,\n} from \"../sqlite/sqliteBindBudget\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\n\ntype PrincipalPolicyReferenceRow =\n  typeof principalPolicyBundleReferences.$inferInsert;\n\ntype StoredPrincipalPolicyReference = Pick<\n  typeof principalPolicyBundleReferences.$inferSelect,\n  | \"version\"\n  | \"stateHash\"\n  | \"keyEpoch\"\n  | \"keyFingerprint\"\n  | \"bundleVersion\"\n  | \"bundleStateHash\"\n>;\n\nconst REFERENCE_INSERT_BATCH_SIZE = sqliteInsertBatchSize(\n  principalPolicyBundleReferences,\n);\n// Principal type and id plus the bundle version and state hash bind once.\nconst REFERENCE_LOOKUP_VERSIONS = sqliteRowsPerStatement(1, 4);\n\n/** The exact six-field match; the lookup already fixes the principal. */\nfunction isSameReference(\n  stored: StoredPrincipalPolicyReference,\n  row: PrincipalPolicyReferenceRow,\n): boolean {\n  return (\n    stored.version === row.version &&\n    stored.stateHash === row.stateHash &&\n    stored.keyEpoch === row.keyEpoch &&\n    stored.keyFingerprint === row.keyFingerprint\n  );\n}\n\n/** The table's primary key within one principal. */\nfunction referenceKey(\n  row: Pick<\n    StoredPrincipalPolicyReference,\n    \"version\" | \"stateHash\" | \"keyEpoch\" | \"keyFingerprint\" | \"bundleStateHash\"\n  >,\n): string {\n  return JSON.stringify([\n    row.version,\n    row.stateHash,\n    row.keyEpoch,\n    row.keyFingerprint,\n    row.bundleStateHash,\n  ]);\n}\n\n/** Rows either equivocation check can match, read before this bundle's writes. */\nasync function loadStoredReferences(\n  tx: ClientSQLiteTransactionScope,\n  head: PrincipalPolicyBundleResponse[\"currentState\"],\n  versions: readonly number[],\n): Promise<StoredPrincipalPolicyReference[]> {\n  const stored: StoredPrincipalPolicyReference[] = [];\n  for (\n    let index = 0;\n    index < versions.length;\n    index += REFERENCE_LOOKUP_VERSIONS\n  ) {\n    stored.push(\n      ...(await tx\n        .select({\n          version: principalPolicyBundleReferences.version,\n          stateHash: principalPolicyBundleReferences.stateHash,\n          keyEpoch: principalPolicyBundleReferences.keyEpoch,\n          keyFingerprint: principalPolicyBundleReferences.keyFingerprint,\n          bundleVersion: principalPolicyBundleReferences.bundleVersion,\n          bundleStateHash: principalPolicyBundleReferences.bundleStateHash,\n        })\n        .from(principalPolicyBundleReferences)\n        .where(\n          and(\n            eq(\n              principalPolicyBundleReferences.principalType,\n              head.principalType,\n            ),\n            eq(principalPolicyBundleReferences.principalId, head.principalId),\n            inArray(\n              principalPolicyBundleReferences.version,\n              versions.slice(index, index + REFERENCE_LOOKUP_VERSIONS),\n            ),\n            or(\n              eq(principalPolicyBundleReferences.bundleVersion, head.version),\n              eq(\n                principalPolicyBundleReferences.bundleStateHash,\n                head.stateHash,\n              ),\n            ),\n          ),\n        )),\n    );\n  }\n  return stored;\n}\n\n/**\n * Rows written earlier in the same bundle all carry its head, so neither\n * check can match them: each state's outcome depends only on stored rows.\n */\nfunction referenceConflict(\n  row: PrincipalPolicyReferenceRow,\n  stored: readonly StoredPrincipalPolicyReference[],\n): KeyingVerificationError | null {\n  const sameReference = stored.filter((candidate) =>\n    isSameReference(candidate, row),\n  );\n  if (\n    sameReference.some(\n      (candidate) =>\n        candidate.bundleVersion === row.bundleVersion &&\n        candidate.bundleStateHash !== row.bundleStateHash,\n    )\n  )\n    return new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy reference has conflicting bundle heads at one version\",\n    );\n  const indexed = sameReference.find(\n    (candidate) => candidate.bundleStateHash === row.bundleStateHash,\n  );\n  if (indexed && indexed.bundleVersion !== row.bundleVersion)\n    return new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy reference index conflicts with the bundle head\",\n    );\n  return null;\n}\n\nasync function insertMissingReferences(\n  tx: ClientSQLiteTransactionScope,\n  rows: readonly PrincipalPolicyReferenceRow[],\n  stored: readonly StoredPrincipalPolicyReference[],\n): Promise<void> {\n  const present = new Set(stored.map(referenceKey));\n  const missing = new Map<string, PrincipalPolicyReferenceRow>();\n  for (const row of rows) {\n    const key = referenceKey(row);\n    if (!present.has(key) && !missing.has(key)) missing.set(key, row);\n  }\n  const values = [...missing.values()];\n  for (\n    let index = 0;\n    index < values.length;\n    index += REFERENCE_INSERT_BATCH_SIZE\n  ) {\n    await tx\n      .insert(principalPolicyBundleReferences)\n      .values(values.slice(index, index + REFERENCE_INSERT_BATCH_SIZE))\n      .onConflictDoNothing()\n      .run();\n  }\n}\n\n/**\n * Index every state of a verified bundle under its head. Fails in state order\n * with the per-state checks' errors, keeping the states indexed before the\n * first failure.\n */\nexport async function indexPrincipalPolicyBundleInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<void> {\n  const head = bundle.currentState;\n  const states = principalPolicyBundleStates(bundle);\n  const foreignIndex = states.findIndex(\n    (state) =>\n      state.principalType !== head.principalType ||\n      state.principalId !== head.principalId,\n  );\n  const rows: PrincipalPolicyReferenceRow[] = (\n    foreignIndex === -1 ? states : states.slice(0, foreignIndex)\n  ).map((state) => ({\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n    bundleVersion: head.version,\n    bundleStateHash: head.stateHash,\n  }));\n  const stored =\n    rows.length === 0\n      ? []\n      : await loadStoredReferences(tx, head, [\n          ...new Set(rows.map((row) => row.version)),\n        ]);\n  let failure: KeyingVerificationError | null = null;\n  let accepted = rows.length;\n  for (const [index, row] of rows.entries()) {\n    failure = referenceConflict(row, stored);\n    if (failure) {\n      accepted = index;\n      break;\n    }\n  }\n  if (!failure && foreignIndex !== -1)\n    failure = new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy bundle reference belongs to another principal\",\n    );\n  await insertMissingReferences(tx, rows.slice(0, accepted), stored);\n  if (failure) throw failure;\n}\n"]}

package/data/principals/principalMutationJournalShape.js

@@ -33,6 +33,12 @@ export function readPrincipalMutation(value, scope) {
         throw new Error("Principal mutation journal operation is unsupported");
     const request = CommitOrganizationGroupPolicyRequestSchema.parse(body);
     assertStateScope(request.groupPolicy.state, "group", groupId, scope);
+    if (request.memberPolicy) {
+        // The server binds this signed group ID to the organization's Members group.
+        assertStateScope(request.memberPolicy.state, "group", request.memberPolicy.state.principalId, scope);
+        if (request.memberPolicy.state.principalId === groupId)
+            throw new Error("Principal mutation journal Members target is duplicated");
+    }
     assertStateScope(request.organizationPolicy.state, "organization", scope.organizationId, scope);
     return { kind, groupId, request };
 }

package/data/principals/principalMutationJournalShape.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutationJournalShape.js","sourceRoot":"","sources":["principalMutationJournalShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,EAE1C,8CAA8C,EAE9C,oCAAoC,EAEpC,wCAAwC,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA8B5D,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAkB;IAElB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,IAAI;YAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,gBAAgB,CACd,OAAO,CAAC,KAAK,EACb,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,8CAA8C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAkD,EAClD,aAAuC,EACvC,WAAmB,EACnB,KAAkB;IAElB,IACE,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;QACnC,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,kBAAkB;QAE3D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["import {\n  type CommitOrganizationGroupPolicyRequest,\n  CommitOrganizationGroupPolicyRequestSchema,\n  type CreateOrganizationGroupWithPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequestSchema,\n  type DeleteOrganizationGroupRequest,\n  DeleteOrganizationGroupRequestSchema,\n  type OrganizationPrincipalPolicyRequest,\n  OrganizationPrincipalPolicyRequestSchema,\n} from \"@tearleads/validators/request\";\nimport { isUuidV4String } from \"@tearleads/validators/util\";\n\nexport type AuthoredPrincipalMutation =\n  | {\n      readonly kind: \"compound\";\n      readonly groupId: string;\n      readonly request: CommitOrganizationGroupPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-create\";\n      readonly groupId: string;\n      readonly request: CreateOrganizationGroupWithPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-delete\";\n      readonly groupId: string;\n      readonly request: DeleteOrganizationGroupRequest;\n    }\n  | {\n      readonly kind: \"organization\";\n      readonly groupId: null;\n      readonly request: OrganizationPrincipalPolicyRequest;\n    };\n\ninterface SignerScope {\n  readonly organizationId: string;\n  readonly userId: string;\n  readonly signingFingerprint: string;\n}\n\n/** Validate authored inputs; opening an existing row authenticates it first. */\nexport function readPrincipalMutation(\n  value: unknown,\n  scope: SignerScope,\n): AuthoredPrincipalMutation {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Principal mutation journal payload is invalid\");\n  const groupId: unknown = Reflect.get(value, \"groupId\");\n  const kind: unknown = Reflect.get(value, \"kind\");\n  const body: unknown = Reflect.get(value, \"request\");\n  if (kind === \"organization\") {\n    if (groupId !== null)\n      throw new Error(\"Organization journal target differs\");\n    const request = OrganizationPrincipalPolicyRequestSchema.parse(body);\n    assertStateScope(\n      request.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (typeof groupId !== \"string\" || !isUuidV4String(groupId))\n    throw new Error(\"Principal mutation journal group target is invalid\");\n  if (kind === \"group-create\") {\n    const request = CreateOrganizationGroupWithPolicyRequestSchema.parse(body);\n    if (request.groupId !== groupId)\n      throw new Error(\"Group creation journal target differs\");\n    assertStateScope(request.initialGroupPolicy.state, \"group\", groupId, scope);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind === \"group-delete\") {\n    const request = DeleteOrganizationGroupRequestSchema.parse(body);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind !== \"compound\")\n    throw new Error(\"Principal mutation journal operation is unsupported\");\n  const request = CommitOrganizationGroupPolicyRequestSchema.parse(body);\n  assertStateScope(request.groupPolicy.state, \"group\", groupId, scope);\n  assertStateScope(\n    request.organizationPolicy.state,\n    \"organization\",\n    scope.organizationId,\n    scope,\n  );\n  return { kind, groupId, request };\n}\n\nfunction assertStateScope(\n  state: OrganizationPrincipalPolicyRequest[\"state\"],\n  principalType: \"organization\" | \"group\",\n  principalId: string,\n  scope: SignerScope,\n) {\n  if (\n    state.principalType !== principalType ||\n    state.principalId !== principalId ||\n    state.signerUserId !== scope.userId ||\n    state.signerUserKeyFingerprint !== scope.signingFingerprint\n  )\n    throw new Error(\"Principal mutation journal target or signer differs\");\n}\n"]}
+{"version":3,"file":"principalMutationJournalShape.js","sourceRoot":"","sources":["principalMutationJournalShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,EAE1C,8CAA8C,EAE9C,oCAAoC,EAEpC,wCAAwC,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA8B5D,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAkB;IAElB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,IAAI;YAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,gBAAgB,CACd,OAAO,CAAC,KAAK,EACb,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,8CAA8C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,6EAA6E;QAC7E,gBAAgB,CACd,OAAO,CAAC,YAAY,CAAC,KAAK,EAC1B,OAAO,EACP,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EACtC,KAAK,CACN,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;YACpD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;IACN,CAAC;IACD,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAkD,EAClD,aAAuC,EACvC,WAAmB,EACnB,KAAkB;IAElB,IACE,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;QACnC,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,kBAAkB;QAE3D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["import {\n  type CommitOrganizationGroupPolicyRequest,\n  CommitOrganizationGroupPolicyRequestSchema,\n  type CreateOrganizationGroupWithPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequestSchema,\n  type DeleteOrganizationGroupRequest,\n  DeleteOrganizationGroupRequestSchema,\n  type OrganizationPrincipalPolicyRequest,\n  OrganizationPrincipalPolicyRequestSchema,\n} from \"@tearleads/validators/request\";\nimport { isUuidV4String } from \"@tearleads/validators/util\";\n\nexport type AuthoredPrincipalMutation =\n  | {\n      readonly kind: \"compound\";\n      readonly groupId: string;\n      readonly request: CommitOrganizationGroupPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-create\";\n      readonly groupId: string;\n      readonly request: CreateOrganizationGroupWithPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-delete\";\n      readonly groupId: string;\n      readonly request: DeleteOrganizationGroupRequest;\n    }\n  | {\n      readonly kind: \"organization\";\n      readonly groupId: null;\n      readonly request: OrganizationPrincipalPolicyRequest;\n    };\n\ninterface SignerScope {\n  readonly organizationId: string;\n  readonly userId: string;\n  readonly signingFingerprint: string;\n}\n\n/** Validate authored inputs; opening an existing row authenticates it first. */\nexport function readPrincipalMutation(\n  value: unknown,\n  scope: SignerScope,\n): AuthoredPrincipalMutation {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Principal mutation journal payload is invalid\");\n  const groupId: unknown = Reflect.get(value, \"groupId\");\n  const kind: unknown = Reflect.get(value, \"kind\");\n  const body: unknown = Reflect.get(value, \"request\");\n  if (kind === \"organization\") {\n    if (groupId !== null)\n      throw new Error(\"Organization journal target differs\");\n    const request = OrganizationPrincipalPolicyRequestSchema.parse(body);\n    assertStateScope(\n      request.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (typeof groupId !== \"string\" || !isUuidV4String(groupId))\n    throw new Error(\"Principal mutation journal group target is invalid\");\n  if (kind === \"group-create\") {\n    const request = CreateOrganizationGroupWithPolicyRequestSchema.parse(body);\n    if (request.groupId !== groupId)\n      throw new Error(\"Group creation journal target differs\");\n    assertStateScope(request.initialGroupPolicy.state, \"group\", groupId, scope);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind === \"group-delete\") {\n    const request = DeleteOrganizationGroupRequestSchema.parse(body);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind !== \"compound\")\n    throw new Error(\"Principal mutation journal operation is unsupported\");\n  const request = CommitOrganizationGroupPolicyRequestSchema.parse(body);\n  assertStateScope(request.groupPolicy.state, \"group\", groupId, scope);\n  if (request.memberPolicy) {\n    // The server binds this signed group ID to the organization's Members group.\n    assertStateScope(\n      request.memberPolicy.state,\n      \"group\",\n      request.memberPolicy.state.principalId,\n      scope,\n    );\n    if (request.memberPolicy.state.principalId === groupId)\n      throw new Error(\n        \"Principal mutation journal Members target is duplicated\",\n      );\n  }\n  assertStateScope(\n    request.organizationPolicy.state,\n    \"organization\",\n    scope.organizationId,\n    scope,\n  );\n  return { kind, groupId, request };\n}\n\nfunction assertStateScope(\n  state: OrganizationPrincipalPolicyRequest[\"state\"],\n  principalType: \"organization\" | \"group\",\n  principalId: string,\n  scope: SignerScope,\n) {\n  if (\n    state.principalType !== principalType ||\n    state.principalId !== principalId ||\n    state.signerUserId !== scope.userId ||\n    state.signerUserKeyFingerprint !== scope.signingFingerprint\n  )\n    throw new Error(\"Principal mutation journal target or signer differs\");\n}\n"]}

package/data/sqlite/sqliteUpsert.js

@@ -0,0 +1,9 @@
+import { sql } from "drizzle-orm";
+/**
+ * The value a multi-row upsert proposed for `column`. A `set` clause needs it
+ * to apply each conflicting row's own value rather than one shared value.
+ */
+export function excludedValue(column) {
+    return sql `excluded.${sql.identifier(column.name)}`;
+}
+//# sourceMappingURL=sqliteUpsert.js.map

package/data/sqlite/sqliteUpsert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqliteUpsert.js","sourceRoot":"","sources":["sqliteUpsert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AAG5C;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAoB;IAChD,OAAO,GAAG,CAAA,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACtD,CAAC","sourcesContent":["import { type SQL, sql } from \"drizzle-orm\";\nimport type { SQLiteColumn } from \"drizzle-orm/sqlite-core\";\n\n/**\n * The value a multi-row upsert proposed for `column`. A `set` clause needs it\n * to apply each conflicting row's own value rather than one shared value.\n */\nexport function excludedValue(column: SQLiteColumn): SQL {\n  return sql`excluded.${sql.identifier(column.name)}`;\n}\n"]}