@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/principals/principalRecoveryDirectory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalRecoveryDirectory.js","sourceRoot":"","sources":["principalRecoveryDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAEL,oCAAoC,GACrC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uDAAuD,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAehF,MAAM,OAAO,kCAAmC,SAAQ,KAAK;CAAG;AAEhE,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,qBAAqB,CAAC,KAA+B;IAKlE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG;YAChB,aAAa,EAAE,cAAuB;YACtC,WAAW,EAAE,KAAK,CAAC,cAAc;SAClC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,OAAO,EAAE,CAAC;SACX,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,uBAAuB,CACpE,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAClE,mCAAmC,CACjC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC5D,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,KAAK,CAAC,aAAa,KAAK,cAAc;YACtC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;QACJ,OAAO;YACL,aAAa,EAAE,2BAA2B,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;YACvE,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;YACD,IAAI,EAAE;gBACJ,aAAa,EAAE,cAAc;gBAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA+B,EAC/B,UAA8C,EAC9C,QAAmC;IAEnC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK;QACR,UAAU,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;KACzD,CAAC;IACF,MAAM,EACJ,IAAI,EAAE,YAAY,EAClB,OAAO,EACP,aAAa,GACd,GAAG,QAAQ;QACV,CAAC,CAAC;YACE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK;YAClD,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC;QACH,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,2DAA2D,CAC5D,CAAC;IACJ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QAC1E,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;QACpD,GAAG,MAAM;QACT,aAAa;QACb,YAAY;QACZ,kBAAkB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,oCAAoC,CAC/C,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,OAAO,EAAE,GAAG,SAAS,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { directoryHistoryProtection } from \"../../data/principals/principalHistoryScopeProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { reusePrincipalDiscoveryPage } from \"./principalRecoveryDiscoveryPage\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport type PrincipalRecoveryContext = Omit<\n  RecoverPrincipalPolicyHistoryOptions,\n  | \"expectedHead\"\n  | \"retainedReferences\"\n  | \"historyVerification\"\n  | \"loadExternalAuthority\"\n>;\n\nexport interface RecoveredPolicyDirectory\n  extends RecoveredPrincipalPolicyHistory {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n}\n\nexport class PrincipalRecoveryDirectoryAdvanced extends Error {}\n\nfunction exactHead(state: ReferencedPrincipalHead): ReferencedPrincipalHead {\n  return {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\n/** An unverified discovery read chooses a pin; recovery must authenticate it. */\nasync function discoverDirectoryHead(input: PrincipalRecoveryContext): Promise<{\n  head: ReferencedPrincipalHead;\n  genesis: ReferencedPrincipalHead;\n  historyReader: PrincipalRecoveryContext[\"historyReader\"];\n}> {\n  assertProjectionVerificationCurrent(\n    () => !input.signal?.aborted && input.stillCurrent(),\n  );\n  if (input.offline) {\n    const principal = {\n      principalType: \"organization\" as const,\n      principalId: input.organizationId,\n    };\n    const scopeId = await principalHistoryEvidenceScopeId({\n      organizationId: input.organizationId,\n      head: principal,\n      protection: input.protection,\n    });\n    const prefix = await loadVerifiedPrincipalHistoryPrefix(\n      input,\n      principal,\n      scopeId,\n    );\n    if (!prefix)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory is unavailable offline\",\n      );\n    const history = prefix.verifier.finish(prefix.head);\n    if (!history.ok) throw history.error;\n    const genesis = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId,\n      history: history.value,\n      version: 1,\n    });\n    const selected = await verifyPrincipalPolicyHistoryReferences({\n      history: history.value,\n      references: [genesis],\n    });\n    if (!selected.ok) throw selected.error;\n    return {\n      head: prefix.head,\n      genesis: genesis.reference,\n      historyReader: input.historyReader,\n    };\n  }\n  for await (const result of input.historyReader.getPrincipalPolicyPages(\n    \"organization\",\n    input.organizationId,\n    { signal: input.signal },\n  )) {\n    if (!result.ok) throw new PrincipalPolicyHistoryReadError(result);\n    assertProjectionVerificationCurrent(\n      () => !input.signal?.aborted && input.stillCurrent(),\n    );\n    const state = result.data.currentState;\n    const first = result.data.previousStates[0]?.state ?? state;\n    if (\n      first.version !== 1 ||\n      first.principalType !== \"organization\" ||\n      first.principalId !== input.organizationId\n    )\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Organization directory discovery requires genesis\",\n      );\n    return {\n      historyReader: reusePrincipalDiscoveryPage(input.historyReader, result),\n      genesis: {\n        principalType: first.principalType,\n        principalId: first.principalId,\n        version: first.version,\n        stateHash: first.stateHash,\n        keyEpoch: first.keyEpoch,\n        keyFingerprint: first.keyFingerprint,\n      },\n      head: {\n        principalType: \"organization\",\n        principalId: input.organizationId,\n        version: state.version,\n        stateHash: state.stateHash,\n        keyEpoch: state.keyEpoch,\n        keyFingerprint: state.keyFingerprint,\n      },\n    };\n  }\n  throw new KeyingVerificationError(\n    \"missing_dependency\",\n    \"Organization directory head is unavailable\",\n  );\n}\n\nexport async function recoverPolicyDirectory(\n  input: PrincipalRecoveryContext,\n  references: readonly ReferencedPrincipalHead[],\n  selected?: RecoveredPolicyDirectory,\n): Promise<RecoveredPolicyDirectory> {\n  const scoped = {\n    ...input,\n    protection: directoryHistoryProtection(input.protection),\n  };\n  const {\n    head: expectedHead,\n    genesis,\n    historyReader,\n  } = selected\n    ? {\n        head: exactHead(selected.policy.state),\n        genesis: selected.policy.retainedHistory[0]?.state,\n        historyReader: input.historyReader,\n      }\n    : await discoverDirectoryHead(scoped);\n  if (genesis?.version !== 1)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization directory recovery requires verified genesis\",\n    );\n  if (references.some((reference) => reference.version > expectedHead.version))\n    throw new PrincipalRecoveryDirectoryAdvanced();\n  const recovered = await recoverPrincipalPolicyHistory({\n    ...scoped,\n    historyReader,\n    expectedHead,\n    retainedReferences: references.some((reference) => reference.version === 1)\n      ? references\n      : [exactHead(genesis), ...references],\n  });\n  let descriptor: OrganizationAuthorityDescriptor;\n  try {\n    descriptor = parseOrganizationAuthorityDescriptor(\n      recovered.current.currentPayload.ciphertext,\n    );\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Organization directory payload is invalid\",\n    );\n  }\n  if (descriptor.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Organization directory scope does not match\",\n    );\n  return { ...recovered, descriptor };\n}\n"]}

package/workflows/principals/principalRecoveryDiscoveryPage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalRecoveryDiscoveryPage.js","sourceRoot":"","sources":["principalRecoveryDiscoveryPage.ts"],"names":[],"mappings":"AAIA,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CACzC,MAAiC,EACjC,SAAsD;IAEtD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;IACF,OAAO;QACL,KAAK,CAAC,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YACrE,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;gBACjC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,SAAS;gBACpD,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,aAAa;gBACpD,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,WAAW,EAChD,CAAC;gBACD,KAAK,CAAC,CAAC,MAAM,CAAC,uBAAuB,CACnC,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;YAC/C,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO;YAC1B,0EAA0E;YAC1E,+EAA+E;YAC/E,KAAK,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE;gBAChE,GAAG,OAAO;gBACV,YAAY,EAAE,SAAS;gBACvB,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { RequestSuccess } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyPageReader } from \"./principalPolicyHistoryReader\";\n\n/** Reuse the discovery bytes as untrusted input to the ordinary verifier. */\nexport function reusePrincipalDiscoveryPage(\n  reader: PrincipalPolicyPageReader,\n  discovery: RequestSuccess<PrincipalPolicyPageResponse>,\n): PrincipalPolicyPageReader {\n  const first = structuredClone(discovery);\n  const page = first.data;\n  const current = {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n  return {\n    async *getPrincipalPolicyPages(principalType, principalId, options = {}) {\n      if (\n        options.resume !== undefined ||\n        (options.afterVersion ?? 0) !== 0 ||\n        options.stateHash !== current.currentState.stateHash ||\n        principalType !== current.currentState.principalType ||\n        principalId !== current.currentState.principalId\n      ) {\n        yield* reader.getPrincipalPolicyPages(\n          principalType,\n          principalId,\n          options,\n        );\n        return;\n      }\n      yield structuredClone(first);\n      const next = page.historyPage.nextAfterVersion;\n      if (next === null) return;\n      // Resume binds every later page to these exact artifacts, including bytes\n      // outside the signed head. The wrapped reader's cursor/shape checks still run.\n      yield* reader.getPrincipalPolicyPages(principalType, principalId, {\n        ...options,\n        afterVersion: undefined,\n        resume: { current, afterVersion: next },\n      });\n    },\n  };\n}\n"]}

package/workflows/principals/principalRecoveryLocalPreference.js

@@ -1,30 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { PrincipalHistoryRecoveryRaceError } from "./principalHistoryRecoveryTypes.js";
-import { recoverWithPrincipalOutageFallback } from "./principalRecoveryOutage.js";
-/** Reuse exact current artifacts, or a proved historical page within a newer prefix. */
-export async function recoverWithPrincipalLocalPreference(recover, options, preferLocalCurrent, allowHistoricalReference = false) {
-    if (preferLocalCurrent && !options.offline) {
-        try {
-            const local = await recover({
-                ...options,
-                offline: true,
-            });
-            assertProjectionVerificationCurrent(options.stillCurrent);
-            if (allowHistoricalReference ||
-                options.historyPage ||
-                principalHeadMatchesReference(local.policy.state, options.reference))
-                return local;
-        }
-        catch (error) {
-            assertProjectionVerificationCurrent(options.stillCurrent);
-            if (!(error instanceof PrincipalHistoryRecoveryRaceError) &&
-                !(error instanceof KeyingVerificationError &&
-                    error.code === "missing_dependency"))
-                throw error;
-        }
-    }
-    return recoverWithPrincipalOutageFallback(recover, options);
-}
-//# sourceMappingURL=principalRecoveryLocalPreference.js.map

package/workflows/principals/principalRecoveryLocalPreference.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalRecoveryLocalPreference.js","sourceRoot":"","sources":["principalRecoveryLocalPreference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAM/E,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAA2C,EAC3C,OAAmD,EACnD,kBAA2B,EAC3B,wBAAwB,GAAG,KAAK;IAEhC,IAAI,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;gBAC1B,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,IACE,wBAAwB;gBACxB,OAAO,CAAC,WAAW;gBACnB,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC;gBAEpE,OAAO,KAAK,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,IACE,CAAC,CAAC,KAAK,YAAY,iCAAiC,CAAC;gBACrD,CAAC,CACC,KAAK,YAAY,uBAAuB;oBACxC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CACpC;gBAED,MAAM,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { PrincipalHistoryRecoveryRaceError } from \"./principalHistoryRecoveryTypes\";\nimport { recoverWithPrincipalOutageFallback } from \"./principalRecoveryOutage\";\nimport type {\n  RecoverScopedPrincipalPolicyHistoryOptions,\n  ScopedPrincipalPolicyRecoveryBatch,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Reuse exact current artifacts, or a proved historical page within a newer prefix. */\nexport async function recoverWithPrincipalLocalPreference(\n  recover: ScopedPrincipalPolicyRecoveryBatch,\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n  preferLocalCurrent: boolean,\n  allowHistoricalReference = false,\n) {\n  if (preferLocalCurrent && !options.offline) {\n    try {\n      const local = await recover({\n        ...options,\n        offline: true,\n      });\n      assertProjectionVerificationCurrent(options.stillCurrent);\n      if (\n        allowHistoricalReference ||\n        options.historyPage ||\n        principalHeadMatchesReference(local.policy.state, options.reference)\n      )\n        return local;\n    } catch (error) {\n      assertProjectionVerificationCurrent(options.stillCurrent);\n      if (\n        !(error instanceof PrincipalHistoryRecoveryRaceError) &&\n        !(\n          error instanceof KeyingVerificationError &&\n          error.code === \"missing_dependency\"\n        )\n      )\n        throw error;\n    }\n  }\n  return recoverWithPrincipalOutageFallback(recover, options);\n}\n"]}

package/workflows/principals/principalRecoveryMemo.d.ts

@@ -1,21 +0,0 @@
-import { type ReferencedPrincipalHead } from "../../internal/crypto/index.js";
-import type { RecoveredPrincipalPolicyHistory } from "./principalHistoryRecoveryTypes.js";
-import { type PrincipalRecoveryContext, type RecoveredPolicyDirectory } from "./principalRecoveryDirectory.js";
-interface MemoEntry<T> {
-    readonly value: T;
-    /** The producing call's private lease and caller lifetime. */
-    readonly stillCurrent: () => boolean;
-    /** Organization hint epoch observed before the reads that produced value. */
-    readonly epoch: number;
-}
-type Memo<T> = Map<string, Promise<MemoEntry<T>>>;
-export interface PrincipalRecoveryMemo {
-    readonly directories: Memo<RecoveredPolicyDirectory>;
-    readonly admins: Memo<RecoveredPrincipalPolicyHistory>;
-}
-export declare function createPrincipalRecoveryReader(input: PrincipalRecoveryContext, memo?: PrincipalRecoveryMemo): {
-    stillCurrent: () => boolean;
-    directory: (references: readonly ReferencedPrincipalHead[]) => Promise<RecoveredPolicyDirectory>;
-    admins: (expectedHead: ReferencedPrincipalHead, retainedReferences?: readonly ReferencedPrincipalHead[]) => Promise<RecoveredPrincipalPolicyHistory>;
-};
-export {};

package/workflows/principals/principalRecoveryMemo.js

@@ -1,178 +0,0 @@
-import { KeyingVerificationError, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { recoverPolicyDirectory, } from "./principalRecoveryDirectory.js";
-import { adminsMemoValidity, directoryMemoValidity, } from "./principalRecoveryMemoValidity.js";
-import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
-/** Synchronous: no hint and no lease end since the entry's reads began. */
-function entryLive(entry, validity) {
-    return entry.epoch === validity.epoch() && entry.stillCurrent();
-}
-function evict(memo, key, pending) {
-    if (memo?.get(key) === pending)
-        memo.delete(key);
-}
-/**
- * Return a live entry, evicting one whose producer lease ended, that predates
- * an organization hint, or that a durable pin has moved past. Liveness is
- * checked again after every await, so a hint or lease end during the pin
- * reads also evicts. The caller rechecks synchronously before use. A pin read
- * is a snapshot; a pin that advances later is caught by the checkpoint reload
- * in recovery, the caller's checkpoint refresh, and atomic admission.
- */
-async function reusableEntry(memo, key, validity) {
-    const pending = memo?.get(key);
-    if (!pending)
-        return undefined;
-    const entry = await pending.catch(() => undefined);
-    if (entry &&
-        entryLive(entry, validity) &&
-        (await validity.covers(entry.value)) &&
-        entryLive(entry, validity))
-        return { entry, pending };
-    evict(memo, key, pending);
-    return undefined;
-}
-/**
- * Share authenticated results within one workflow operation. A later caller
- * never receives a result whose producer lease ended, that predates an
- * organization hint, or that a durable pin has moved past; it recovers again.
- * A result derived from a reused source keeps the source's epoch, so a hint
- * that arrives before it is stored still evicts it. Every value is handed out
- * with the consumer's lifetime and its producer's, so a producer that expires
- * after hand-out still invalidates the consumer's use.
- */
-async function memoPrincipalRecovery(memo, key, stillCurrent, validity, sourceEpoch, work) {
-    assertProjectionVerificationCurrent(stillCurrent);
-    const reused = await reusableEntry(memo, key, validity);
-    if (reused) {
-        const { entry } = reused;
-        if (entryLive(entry, validity)) {
-            assertProjectionVerificationCurrent(stillCurrent);
-            return {
-                value: entry.value,
-                stillCurrent: () => stillCurrent() && entry.stillCurrent(),
-            };
-        }
-        evict(memo, key, reused.pending);
-    }
-    // Observed before work starts its reads; a derived result keeps its source's.
-    const epoch = sourceEpoch ?? validity.epoch();
-    const pending = work().then((value) => ({ value, stillCurrent, epoch }));
-    memo?.set(key, pending);
-    const result = await pending.catch((error) => {
-        evict(memo, key, pending);
-        throw error;
-    });
-    // A hint during production leaves this caller's in-flight view, never a
-    // stored one: the stale epoch would evict it anyway.
-    if (result.epoch !== validity.epoch())
-        evict(memo, key, pending);
-    assertProjectionVerificationCurrent(result.stillCurrent);
-    assertProjectionVerificationCurrent(stillCurrent);
-    // stillCurrent already includes the lifetime of a derived value's source.
-    return { value: result.value, stillCurrent };
-}
-function fallsBackOnline(input, error) {
-    return (!input.offline &&
-        error instanceof KeyingVerificationError &&
-        error.code === "missing_dependency");
-}
-async function readMemoizedAdmins(input, memo, scope, expectedHead, retainedReferences) {
-    // Every recovered Current already retains its own exact head.
-    const references = retainedReferences.filter((reference) => !principalHeadMatchesReference(expectedHead, reference));
-    const key = (selected) => serializeKeyingCanonicalJson([
-        ...scope,
-        { ...expectedHead },
-        selected.map((reference) => ({ ...reference })),
-    ]);
-    const validity = adminsMemoValidity(input, expectedHead);
-    const known = (await reusableEntry(memo, key([]), validity))?.entry;
-    const sourceCurrent = known?.stillCurrent ?? (() => true);
-    const current = () => !input.signal?.aborted && input.stillCurrent() && sourceCurrent();
-    return memoPrincipalRecovery(memo, key(references), current, validity, known?.epoch, async () => {
-        const options = {
-            ...input,
-            expectedHead,
-            retainedReferences,
-            historyVerification: "direct-admins",
-            stillCurrent: current,
-        };
-        if (known) {
-            try {
-                // A freshly verified exact head only needs local proofs for additional
-                // citations; their signature and private-root checks still run.
-                return await recoverPrincipalPolicyHistory({
-                    ...options,
-                    offline: true,
-                });
-            }
-            catch (error) {
-                assertProjectionVerificationCurrent(current);
-                if (!fallsBackOnline(input, error))
-                    throw error;
-            }
-        }
-        return recoverPrincipalPolicyHistory(options);
-    });
-}
-async function readMemoizedDirectory(input, memo, key, references) {
-    const validity = directoryMemoValidity(input);
-    const known = references.length > 0
-        ? (await reusableEntry(memo, key([]), validity))?.entry
-        : undefined;
-    const sourceCurrent = known?.stillCurrent ?? (() => true);
-    const current = () => !input.signal?.aborted && input.stillCurrent() && sourceCurrent();
-    return memoPrincipalRecovery(memo, key(references), current, validity, known?.epoch, async () => {
-        if (!known)
-            return recoverPolicyDirectory(input, references);
-        try {
-            // Add authenticated historical citations to this operation's exact
-            // directory view. A newer private prefix must not silently replace it.
-            return await recoverPolicyDirectory({ ...input, offline: true, stillCurrent: current }, references, known.value);
-        }
-        catch (error) {
-            assertProjectionVerificationCurrent(current);
-            if (!fallsBackOnline(input, error))
-                throw error;
-        }
-        return recoverPolicyDirectory({ ...input, stillCurrent: current }, references, known.value);
-    });
-}
-export function createPrincipalRecoveryReader(input, memo) {
-    const scope = [
-        input.organizationId,
-        input.protection.context,
-        input.offline === true,
-    ];
-    const directoryKey = (references) => serializeKeyingCanonicalJson([
-        ...scope,
-        references.map((reference) => ({ ...reference })),
-    ]);
-    // Every lifetime behind a value this reader handed out; its caller must
-    // keep checking them at the point of use.
-    const lifetimes = [];
-    const lease = (leased) => {
-        lifetimes.push(leased.stillCurrent);
-        return leased.value;
-    };
-    return {
-        stillCurrent: () => lifetimes.every((current) => current()),
-        directory: async (references) => {
-            const value = lease(await readMemoizedDirectory(input, memo?.directories, directoryKey, references));
-            // Retaining extra citations does not prevent this authenticated directory
-            // from satisfying a later read with no selected historical references.
-            const unselectedKey = directoryKey([]);
-            const selected = memo?.directories.get(directoryKey(references));
-            if (memo &&
-                selected &&
-                references.length > 0 &&
-                !memo.directories.has(unselectedKey))
-                // The alias keeps the original lease and validity; either ending evicts it.
-                memo.directories.set(unselectedKey, selected);
-            return value;
-        },
-        admins: async (expectedHead, retainedReferences = []) => lease(await readMemoizedAdmins(input, memo?.admins, scope, expectedHead, retainedReferences)),
-    };
-}
-//# sourceMappingURL=principalRecoveryMemo.js.map

package/workflows/principals/principalRecoveryMemo.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalRecoveryMemo.js","sourceRoot":"","sources":["principalRecoveryMemo.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAEtG,OAAO,EAGL,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAwBhF,2EAA2E;AAC3E,SAAS,SAAS,CAChB,KAAmB,EACnB,QAA0C;IAE1C,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CACZ,IAAyB,EACzB,GAAW,EACX,OAA8B;IAE9B,IAAI,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAyB,EACzB,GAAW,EACX,QAA0C;IAI1C,MAAM,OAAO,GAAG,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnD,IACE,KAAK;QACL,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC1B,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;QAE1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAAyB,EACzB,GAAW,EACX,YAA2B,EAC3B,QAA0C,EAC1C,WAA+B,EAC/B,IAAsB;IAEtB,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,IAAI,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/B,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE;aAC3D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,8EAA8E;IAC9E,MAAM,KAAK,GAAG,WAAW,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACpD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACjE,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,0EAA0E;IAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CACtB,KAA+B,EAC/B,KAAc;IAEd,OAAO,CACL,CAAC,KAAK,CAAC,OAAO;QACd,KAAK,YAAY,uBAAuB;QACxC,KAAK,CAAC,IAAI,KAAK,oBAAoB,CACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAA+B,EAC/B,IAAuD,EACvD,KAAoC,EACpC,YAAqC,EACrC,kBAAsD;IAEtD,8DAA8D;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,6BAA6B,CAAC,YAAY,EAAE,SAAS,CAAC,CACvE,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,QAA4C,EAAE,EAAE,CAC3D,4BAA4B,CAAC;QAC3B,GAAG,KAAK;QACR,EAAE,GAAG,YAAY,EAAE;QACnB,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;KAChD,CAAC,CAAC;IACL,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC;IACpE,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,IAAI,aAAa,EAAE,CAAC;IACpE,OAAO,qBAAqB,CAC1B,IAAI,EACJ,GAAG,CAAC,UAAU,CAAC,EACf,OAAO,EACP,QAAQ,EACR,KAAK,EAAE,KAAK,EACZ,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG;YACd,GAAG,KAAK;YACR,YAAY;YACZ,kBAAkB;YAClB,mBAAmB,EAAE,eAAwB;YAC7C,YAAY,EAAE,OAAO;SACtB,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,uEAAuE;gBACvE,gEAAgE;gBAChE,OAAO,MAAM,6BAA6B,CAAC;oBACzC,GAAG,OAAO;oBACV,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mCAAmC,CAAC,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA+B,EAC/B,IAAgD,EAChD,GAA+D,EAC/D,UAA8C;IAE9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GACT,UAAU,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK;QACvD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,IAAI,aAAa,EAAE,CAAC;IACpE,OAAO,qBAAqB,CAC1B,IAAI,EACJ,GAAG,CAAC,UAAU,CAAC,EACf,OAAO,EACP,QAAQ,EACR,KAAK,EAAE,KAAK,EACZ,KAAK,IAAI,EAAE;QACT,IAAI,CAAC,KAAK;YAAE,OAAO,sBAAsB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,mEAAmE;YACnE,uEAAuE;YACvE,OAAO,MAAM,sBAAsB,CACjC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAClD,UAAU,EACV,KAAK,CAAC,KAAK,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,sBAAsB,CAC3B,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EACnC,UAAU,EACV,KAAK,CAAC,KAAK,CACZ,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAA+B,EAC/B,IAA4B;IAE5B,MAAM,KAAK,GAAG;QACZ,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,UAAU,CAAC,OAAO;QACxB,KAAK,CAAC,OAAO,KAAK,IAAI;KACvB,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,UAA8C,EAAE,EAAE,CACtE,4BAA4B,CAAC;QAC3B,GAAG,KAAK;QACR,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;KAClD,CAAC,CAAC;IACL,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAI,MAAiB,EAAK,EAAE;QACxC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;IACF,OAAO;QACL,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,UAA8C,EAAE,EAAE;YAClE,MAAM,KAAK,GAAG,KAAK,CACjB,MAAM,qBAAqB,CACzB,KAAK,EACL,IAAI,EAAE,WAAW,EACjB,YAAY,EACZ,UAAU,CACX,CACF,CAAC;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;YACjE,IACE,IAAI;gBACJ,QAAQ;gBACR,UAAU,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC;gBAEpC,4EAA4E;gBAC5E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE,KAAK,EACX,YAAqC,EACrC,qBAAyD,EAAE,EAC3D,EAAE,CACF,KAAK,CACH,MAAM,kBAAkB,CACtB,KAAK,EACL,IAAI,EAAE,MAAM,EACZ,KAAK,EACL,YAAY,EACZ,kBAAkB,CACnB,CACF;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { RecoveredPrincipalPolicyHistory } from \"./principalHistoryRecoveryTypes\";\nimport {\n  type PrincipalRecoveryContext,\n  type RecoveredPolicyDirectory,\n  recoverPolicyDirectory,\n} from \"./principalRecoveryDirectory\";\nimport {\n  adminsMemoValidity,\n  directoryMemoValidity,\n  type PrincipalRecoveryMemoValidity,\n} from \"./principalRecoveryMemoValidity\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\ninterface MemoEntry<T> {\n  readonly value: T;\n  /** The producing call's private lease and caller lifetime. */\n  readonly stillCurrent: () => boolean;\n  /** Organization hint epoch observed before the reads that produced value. */\n  readonly epoch: number;\n}\n\ntype Memo<T> = Map<string, Promise<MemoEntry<T>>>;\n\n/** A value handed out with every lifetime it depends on. */\ninterface Leased<T> {\n  readonly value: T;\n  /** The consumer's lifetime and every producer lifetime behind value. */\n  readonly stillCurrent: () => boolean;\n}\n\nexport interface PrincipalRecoveryMemo {\n  readonly directories: Memo<RecoveredPolicyDirectory>;\n  readonly admins: Memo<RecoveredPrincipalPolicyHistory>;\n}\n\n/** Synchronous: no hint and no lease end since the entry's reads began. */\nfunction entryLive<T>(\n  entry: MemoEntry<T>,\n  validity: PrincipalRecoveryMemoValidity<T>,\n): boolean {\n  return entry.epoch === validity.epoch() && entry.stillCurrent();\n}\n\nfunction evict<T>(\n  memo: Memo<T> | undefined,\n  key: string,\n  pending: Promise<MemoEntry<T>>,\n): void {\n  if (memo?.get(key) === pending) memo.delete(key);\n}\n\n/**\n * Return a live entry, evicting one whose producer lease ended, that predates\n * an organization hint, or that a durable pin has moved past. Liveness is\n * checked again after every await, so a hint or lease end during the pin\n * reads also evicts. The caller rechecks synchronously before use. A pin read\n * is a snapshot; a pin that advances later is caught by the checkpoint reload\n * in recovery, the caller's checkpoint refresh, and atomic admission.\n */\nasync function reusableEntry<T>(\n  memo: Memo<T> | undefined,\n  key: string,\n  validity: PrincipalRecoveryMemoValidity<T>,\n): Promise<\n  { entry: MemoEntry<T>; pending: Promise<MemoEntry<T>> } | undefined\n> {\n  const pending = memo?.get(key);\n  if (!pending) return undefined;\n  const entry = await pending.catch(() => undefined);\n  if (\n    entry &&\n    entryLive(entry, validity) &&\n    (await validity.covers(entry.value)) &&\n    entryLive(entry, validity)\n  )\n    return { entry, pending };\n  evict(memo, key, pending);\n  return undefined;\n}\n\n/**\n * Share authenticated results within one workflow operation. A later caller\n * never receives a result whose producer lease ended, that predates an\n * organization hint, or that a durable pin has moved past; it recovers again.\n * A result derived from a reused source keeps the source's epoch, so a hint\n * that arrives before it is stored still evicts it. Every value is handed out\n * with the consumer's lifetime and its producer's, so a producer that expires\n * after hand-out still invalidates the consumer's use.\n */\nasync function memoPrincipalRecovery<T>(\n  memo: Memo<T> | undefined,\n  key: string,\n  stillCurrent: () => boolean,\n  validity: PrincipalRecoveryMemoValidity<T>,\n  sourceEpoch: number | undefined,\n  work: () => Promise<T>,\n): Promise<Leased<T>> {\n  assertProjectionVerificationCurrent(stillCurrent);\n  const reused = await reusableEntry(memo, key, validity);\n  if (reused) {\n    const { entry } = reused;\n    if (entryLive(entry, validity)) {\n      assertProjectionVerificationCurrent(stillCurrent);\n      return {\n        value: entry.value,\n        stillCurrent: () => stillCurrent() && entry.stillCurrent(),\n      };\n    }\n    evict(memo, key, reused.pending);\n  }\n  // Observed before work starts its reads; a derived result keeps its source's.\n  const epoch = sourceEpoch ?? validity.epoch();\n  const pending = work().then((value) => ({ value, stillCurrent, epoch }));\n  memo?.set(key, pending);\n  const result = await pending.catch((error: unknown) => {\n    evict(memo, key, pending);\n    throw error;\n  });\n  // A hint during production leaves this caller's in-flight view, never a\n  // stored one: the stale epoch would evict it anyway.\n  if (result.epoch !== validity.epoch()) evict(memo, key, pending);\n  assertProjectionVerificationCurrent(result.stillCurrent);\n  assertProjectionVerificationCurrent(stillCurrent);\n  // stillCurrent already includes the lifetime of a derived value's source.\n  return { value: result.value, stillCurrent };\n}\n\nfunction fallsBackOnline(\n  input: PrincipalRecoveryContext,\n  error: unknown,\n): boolean {\n  return (\n    !input.offline &&\n    error instanceof KeyingVerificationError &&\n    error.code === \"missing_dependency\"\n  );\n}\n\nasync function readMemoizedAdmins(\n  input: PrincipalRecoveryContext,\n  memo: Memo<RecoveredPrincipalPolicyHistory> | undefined,\n  scope: readonly (string | boolean)[],\n  expectedHead: ReferencedPrincipalHead,\n  retainedReferences: readonly ReferencedPrincipalHead[],\n) {\n  // Every recovered Current already retains its own exact head.\n  const references = retainedReferences.filter(\n    (reference) => !principalHeadMatchesReference(expectedHead, reference),\n  );\n  const key = (selected: readonly ReferencedPrincipalHead[]) =>\n    serializeKeyingCanonicalJson([\n      ...scope,\n      { ...expectedHead },\n      selected.map((reference) => ({ ...reference })),\n    ]);\n  const validity = adminsMemoValidity(input, expectedHead);\n  const known = (await reusableEntry(memo, key([]), validity))?.entry;\n  const sourceCurrent = known?.stillCurrent ?? (() => true);\n  const current = () =>\n    !input.signal?.aborted && input.stillCurrent() && sourceCurrent();\n  return memoPrincipalRecovery(\n    memo,\n    key(references),\n    current,\n    validity,\n    known?.epoch,\n    async () => {\n      const options = {\n        ...input,\n        expectedHead,\n        retainedReferences,\n        historyVerification: \"direct-admins\" as const,\n        stillCurrent: current,\n      };\n      if (known) {\n        try {\n          // A freshly verified exact head only needs local proofs for additional\n          // citations; their signature and private-root checks still run.\n          return await recoverPrincipalPolicyHistory({\n            ...options,\n            offline: true,\n          });\n        } catch (error) {\n          assertProjectionVerificationCurrent(current);\n          if (!fallsBackOnline(input, error)) throw error;\n        }\n      }\n      return recoverPrincipalPolicyHistory(options);\n    },\n  );\n}\n\nasync function readMemoizedDirectory(\n  input: PrincipalRecoveryContext,\n  memo: Memo<RecoveredPolicyDirectory> | undefined,\n  key: (references: readonly ReferencedPrincipalHead[]) => string,\n  references: readonly ReferencedPrincipalHead[],\n) {\n  const validity = directoryMemoValidity(input);\n  const known =\n    references.length > 0\n      ? (await reusableEntry(memo, key([]), validity))?.entry\n      : undefined;\n  const sourceCurrent = known?.stillCurrent ?? (() => true);\n  const current = () =>\n    !input.signal?.aborted && input.stillCurrent() && sourceCurrent();\n  return memoPrincipalRecovery(\n    memo,\n    key(references),\n    current,\n    validity,\n    known?.epoch,\n    async () => {\n      if (!known) return recoverPolicyDirectory(input, references);\n      try {\n        // Add authenticated historical citations to this operation's exact\n        // directory view. A newer private prefix must not silently replace it.\n        return await recoverPolicyDirectory(\n          { ...input, offline: true, stillCurrent: current },\n          references,\n          known.value,\n        );\n      } catch (error) {\n        assertProjectionVerificationCurrent(current);\n        if (!fallsBackOnline(input, error)) throw error;\n      }\n      return recoverPolicyDirectory(\n        { ...input, stillCurrent: current },\n        references,\n        known.value,\n      );\n    },\n  );\n}\n\nexport function createPrincipalRecoveryReader(\n  input: PrincipalRecoveryContext,\n  memo?: PrincipalRecoveryMemo,\n) {\n  const scope = [\n    input.organizationId,\n    input.protection.context,\n    input.offline === true,\n  ];\n  const directoryKey = (references: readonly ReferencedPrincipalHead[]) =>\n    serializeKeyingCanonicalJson([\n      ...scope,\n      references.map((reference) => ({ ...reference })),\n    ]);\n  // Every lifetime behind a value this reader handed out; its caller must\n  // keep checking them at the point of use.\n  const lifetimes: (() => boolean)[] = [];\n  const lease = <T>(leased: Leased<T>): T => {\n    lifetimes.push(leased.stillCurrent);\n    return leased.value;\n  };\n  return {\n    stillCurrent: () => lifetimes.every((current) => current()),\n    directory: async (references: readonly ReferencedPrincipalHead[]) => {\n      const value = lease(\n        await readMemoizedDirectory(\n          input,\n          memo?.directories,\n          directoryKey,\n          references,\n        ),\n      );\n      // Retaining extra citations does not prevent this authenticated directory\n      // from satisfying a later read with no selected historical references.\n      const unselectedKey = directoryKey([]);\n      const selected = memo?.directories.get(directoryKey(references));\n      if (\n        memo &&\n        selected &&\n        references.length > 0 &&\n        !memo.directories.has(unselectedKey)\n      )\n        // The alias keeps the original lease and validity; either ending evicts it.\n        memo.directories.set(unselectedKey, selected);\n      return value;\n    },\n    admins: async (\n      expectedHead: ReferencedPrincipalHead,\n      retainedReferences: readonly ReferencedPrincipalHead[] = [],\n    ) =>\n      lease(\n        await readMemoizedAdmins(\n          input,\n          memo?.admins,\n          scope,\n          expectedHead,\n          retainedReferences,\n        ),\n      ),\n  };\n}\n"]}

package/workflows/principals/principalRecoveryMemoValidity.js

@@ -1,33 +0,0 @@
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { getOrCreatePrincipalPolicyCoordinator } from "../../data/principals/principalPolicyCoordinator.js";
-async function pinCovers(input, head) {
-    const pin = await loadPrincipalPolicyCheckpoint(input.execSql, head.principalType, head.principalId);
-    return (!pin ||
-        pin.version < head.version ||
-        (pin.version === head.version && pin.stateHash === head.stateHash));
-}
-function organizationEpoch(input) {
-    return () => getOrCreatePrincipalPolicyCoordinator(input.execSql).recoveryEpoch(input.organizationId);
-}
-/** A directory names every group head; a newer pin on any of them evicts it. */
-export function directoryMemoValidity(input) {
-    return {
-        epoch: organizationEpoch(input),
-        covers: async (directory) => {
-            for (const head of [
-                directory.policy.state,
-                ...directory.descriptor.groupHeads,
-            ])
-                if (!(await pinCovers(input, head)))
-                    return false;
-            return true;
-        },
-    };
-}
-export function adminsMemoValidity(input, expectedHead) {
-    return {
-        epoch: organizationEpoch(input),
-        covers: () => pinCovers(input, expectedHead),
-    };
-}
-//# sourceMappingURL=principalRecoveryMemoValidity.js.map

package/workflows/principals/principalRecoveryMemoValidity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalRecoveryMemoValidity.js","sourceRoot":"","sources":["principalRecoveryMemoValidity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAoBzG,KAAK,UAAU,SAAS,CACtB,KAA+B,EAC/B,IAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAC7C,KAAK,CAAC,OAAO,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,WAAW,CACjB,CAAC;IACF,OAAO,CACL,CAAC,GAAG;QACJ,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;QAC1B,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA+B;IACxD,OAAO,GAAG,EAAE,CACV,qCAAqC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,CAChE,KAAK,CAAC,cAAc,CACrB,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,KAA+B;IAE/B,OAAO;QACL,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC;QAC/B,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC1B,KAAK,MAAM,IAAI,IAAI;gBACjB,SAAS,CAAC,MAAM,CAAC,KAAK;gBACtB,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU;aACnC;gBACC,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA+B,EAC/B,YAAwB;IAExB,OAAO;QACL,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC;QAC/B,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;KAC7C,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../data/principals/principalPolicyCoordinator\";\nimport type { RecoveredPrincipalPolicyHistory } from \"./principalHistoryRecoveryTypes\";\nimport type {\n  PrincipalRecoveryContext,\n  RecoveredPolicyDirectory,\n} from \"./principalRecoveryDirectory\";\n\n/** What keeps a memo entry valid beyond its producer's lease. */\nexport interface PrincipalRecoveryMemoValidity<T> {\n  /** Organization hint epoch; production records it before its reads. */\n  readonly epoch: () => number;\n  /** No durable pin has moved past or forked from a memoized head. */\n  readonly covers: (value: T) => Promise<boolean>;\n}\n\ntype PinnedHead = Pick<\n  ReferencedPrincipalHead,\n  \"principalType\" | \"principalId\" | \"version\" | \"stateHash\"\n>;\n\nasync function pinCovers(\n  input: PrincipalRecoveryContext,\n  head: PinnedHead,\n): Promise<boolean> {\n  const pin = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    head.principalType,\n    head.principalId,\n  );\n  return (\n    !pin ||\n    pin.version < head.version ||\n    (pin.version === head.version && pin.stateHash === head.stateHash)\n  );\n}\n\nfunction organizationEpoch(input: PrincipalRecoveryContext) {\n  return () =>\n    getOrCreatePrincipalPolicyCoordinator(input.execSql).recoveryEpoch(\n      input.organizationId,\n    );\n}\n\n/** A directory names every group head; a newer pin on any of them evicts it. */\nexport function directoryMemoValidity(\n  input: PrincipalRecoveryContext,\n): PrincipalRecoveryMemoValidity<RecoveredPolicyDirectory> {\n  return {\n    epoch: organizationEpoch(input),\n    covers: async (directory) => {\n      for (const head of [\n        directory.policy.state,\n        ...directory.descriptor.groupHeads,\n      ])\n        if (!(await pinCovers(input, head))) return false;\n      return true;\n    },\n  };\n}\n\nexport function adminsMemoValidity(\n  input: PrincipalRecoveryContext,\n  expectedHead: PinnedHead,\n): PrincipalRecoveryMemoValidity<RecoveredPrincipalPolicyHistory> {\n  return {\n    epoch: organizationEpoch(input),\n    covers: () => pinCovers(input, expectedHead),\n  };\n}\n"]}

package/workflows/principals/principalRecoveryOutage.js

@@ -1,40 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { PrincipalPolicyHistoryReadError } from "./principalHistoryRecoveryTypes.js";
-import { recoverLeasedScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
-/** Refusals and invalid evidence must never silently select a cached policy. */
-export function isPrincipalRecoveryOutage(error) {
-    if (!(error instanceof PrincipalPolicyHistoryReadError))
-        return false;
-    const { failure } = error;
-    return (failure.kind === "network" ||
-        (failure.kind === "http" &&
-            failure.status !== null &&
-            failure.status >= 500) ||
-        (failure.kind === "cancelled" &&
-            failure.code === "principal_history_request_timed_out"));
-}
-export async function recoverWithPrincipalOutageFallback(recover, options) {
-    try {
-        return await recover(options);
-    }
-    catch (error) {
-        assertProjectionVerificationCurrent(options.stillCurrent);
-        if (options.offline || !isPrincipalRecoveryOutage(error))
-            throw error;
-        try {
-            return await recoverLeasedScopedPrincipalPolicyHistory({
-                ...options,
-                offline: true,
-            });
-        }
-        catch (localError) {
-            if (localError instanceof KeyingVerificationError &&
-                localError.code === "missing_dependency")
-                throw new ProjectionDependencyUnavailableError(localError.message);
-            throw localError;
-        }
-    }
-}
-//# sourceMappingURL=principalRecoveryOutage.js.map

package/workflows/principals/principalRecoveryOutage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalRecoveryOutage.js","sourceRoot":"","sources":["principalRecoveryOutage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAEL,yCAAyC,GAE1C,MAAM,uCAAuC,CAAC;AAE/C,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,CAAC,KAAK,YAAY,+BAA+B,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;YACtB,OAAO,CAAC,MAAM,KAAK,IAAI;YACvB,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACxB,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;YAC3B,OAAO,CAAC,IAAI,KAAK,qCAAqC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAA2C,EAC3C,OAAmD;IAEnD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,yCAAyC,CAAC;gBACrD,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IACE,UAAU,YAAY,uBAAuB;gBAC7C,UAAU,CAAC,IAAI,KAAK,oBAAoB;gBAExC,MAAM,IAAI,oCAAoC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { PrincipalPolicyHistoryReadError } from \"./principalHistoryRecoveryTypes\";\nimport {\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverLeasedScopedPrincipalPolicyHistory,\n  type ScopedPrincipalPolicyRecoveryBatch,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n\n/** Refusals and invalid evidence must never silently select a cached policy. */\nexport function isPrincipalRecoveryOutage(error: unknown): boolean {\n  if (!(error instanceof PrincipalPolicyHistoryReadError)) return false;\n  const { failure } = error;\n  return (\n    failure.kind === \"network\" ||\n    (failure.kind === \"http\" &&\n      failure.status !== null &&\n      failure.status >= 500) ||\n    (failure.kind === \"cancelled\" &&\n      failure.code === \"principal_history_request_timed_out\")\n  );\n}\n\nexport async function recoverWithPrincipalOutageFallback(\n  recover: ScopedPrincipalPolicyRecoveryBatch,\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n) {\n  try {\n    return await recover(options);\n  } catch (error) {\n    assertProjectionVerificationCurrent(options.stillCurrent);\n    if (options.offline || !isPrincipalRecoveryOutage(error)) throw error;\n    try {\n      return await recoverLeasedScopedPrincipalPolicyHistory({\n        ...options,\n        offline: true,\n      });\n    } catch (localError) {\n      if (\n        localError instanceof KeyingVerificationError &&\n        localError.code === \"missing_dependency\"\n      )\n        throw new ProjectionDependencyUnavailableError(localError.message);\n      throw localError;\n    }\n  }\n}\n"]}

package/workflows/principals/publicPrincipalHistoryAuthority.js

@@ -1,60 +0,0 @@
-import { KeyingVerificationError, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
-import { isReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
-/** The greatest cited Admins head commits to the lineage of every earlier citation. */
-export function publicHistoryAuthorityReference(previous, references) {
-    return references.reduce((head, reference) => !head || reference.version > head.version ? reference : head, previous);
-}
-export function publicHistoryAuthorityJson(reference) {
-    return serializeKeyingCanonicalJson(reference ? { ...reference } : null);
-}
-export function parsePublicHistoryAuthority(input, json) {
-    try {
-        const value = JSON.parse(json);
-        if (value === null)
-            return null;
-        if (isReferencedPrincipalStateResponse(value) &&
-            value.principalType === "group" &&
-            value.principalId === input.authorityGroupId)
-            return value;
-    }
-    catch {
-        /* Invalid disposable metadata cannot restore verified progress. */
-    }
-    return undefined;
-}
-export async function loadPublicHistoryAuthority(input, references, cachedPrefix = false) {
-    if (!references.length)
-        return undefined;
-    const authority = await input.loadExternalAuthority?.(references, cachedPrefix);
-    if (authority &&
-        (authority.currentHead.principalId !== input.authorityGroupId ||
-            authority.states.some(({ head }) => head.principalId !== input.authorityGroupId)))
-        throw new KeyingVerificationError("object_mismatch", "Authority callback differs from the directory binding");
-    if (references.some((reference) => !authority?.states.some(({ head }) => principalHeadMatchesReference(head, reference))))
-        throw new KeyingVerificationError("stale_predecessor", "Public history authority differs from its verified Admins lineage");
-    return authority;
-}
-export async function validatePublicHistoryAuthority(input, reference, rejectedPrefix = null) {
-    try {
-        if (reference)
-            await loadPublicHistoryAuthority(input, [reference], true);
-    }
-    catch (error) {
-        if (error instanceof KeyingVerificationError)
-            throw new PublicHistoryAuthorityUnavailableError(error, rejectedPrefix);
-        throw error;
-    }
-}
-/** Only cache restoration can request a replay after an authority mismatch. */
-export class PublicHistoryAuthorityUnavailableError extends Error {
-    verificationError;
-    rejectedPrefix;
-    constructor(verificationError, rejectedPrefix) {
-        super(verificationError.message);
-        this.verificationError = verificationError;
-        this.rejectedPrefix = rejectedPrefix;
-        this.name = "PublicHistoryAuthorityUnavailableError";
-    }
-}
-//# sourceMappingURL=publicPrincipalHistoryAuthority.js.map

package/workflows/principals/publicPrincipalHistoryAuthority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"publicPrincipalHistoryAuthority.js","sourceRoot":"","sources":["publicPrincipalHistoryAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AAEpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAGtG,uFAAuF;AACvF,MAAM,UAAU,+BAA+B,CAC7C,QAAwC,EACxC,UAA8C;IAE9C,OAAO,UAAU,CAAC,MAAM,CACtB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAClB,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAC9D,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,SAAyC;IAEzC,OAAO,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAoC,EACpC,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IACE,kCAAkC,CAAC,KAAK,CAAC;YACzC,KAAK,CAAC,aAAa,KAAK,OAAO;YAC/B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB;YAE5C,OAAO,KAAK,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAoC,EACpC,UAA8C,EAC9C,YAAY,GAAG,KAAK;IAEpB,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CACnD,UAAU,EACV,YAAY,CACb,CAAC;IACF,IACE,SAAS;QACT,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB;YAC3D,SAAS,CAAC,MAAM,CAAC,IAAI,CACnB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CAC1D,CAAC;QAEJ,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/C,CACJ;QAED,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;IACJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAoC,EACpC,SAAyC,EACzC,iBAAgD,IAAI;IAEpD,IAAI,CAAC;QACH,IAAI,SAAS;YAAE,MAAM,0BAA0B,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,sCAAsC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,OAAO,sCAAuC,SAAQ,KAAK;IAEpD;IACA;IAFX,YACW,iBAA0C,EAC1C,cAA6C;QAEtD,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAHxB,sBAAiB,GAAjB,iBAAiB,CAAyB;QAC1C,mBAAc,GAAd,cAAc,CAA+B;QAGtD,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAC;IACvD,CAAC;CACF","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { PublicPrincipalHistoryOptions } from \"./publicPrincipalHistoryTypes\";\n\n/** The greatest cited Admins head commits to the lineage of every earlier citation. */\nexport function publicHistoryAuthorityReference(\n  previous: ReferencedPrincipalHead | null,\n  references: readonly ReferencedPrincipalHead[],\n) {\n  return references.reduce<ReferencedPrincipalHead | null>(\n    (head, reference) =>\n      !head || reference.version > head.version ? reference : head,\n    previous,\n  );\n}\n\nexport function publicHistoryAuthorityJson(\n  reference: ReferencedPrincipalHead | null,\n) {\n  return serializeKeyingCanonicalJson(reference ? { ...reference } : null);\n}\n\nexport function parsePublicHistoryAuthority(\n  input: PublicPrincipalHistoryOptions,\n  json: string,\n): ReferencedPrincipalHead | null | undefined {\n  try {\n    const value: unknown = JSON.parse(json);\n    if (value === null) return null;\n    if (\n      isReferencedPrincipalStateResponse(value) &&\n      value.principalType === \"group\" &&\n      value.principalId === input.authorityGroupId\n    )\n      return value;\n  } catch {\n    /* Invalid disposable metadata cannot restore verified progress. */\n  }\n  return undefined;\n}\n\nexport async function loadPublicHistoryAuthority(\n  input: PublicPrincipalHistoryOptions,\n  references: readonly ReferencedPrincipalHead[],\n  cachedPrefix = false,\n) {\n  if (!references.length) return undefined;\n  const authority = await input.loadExternalAuthority?.(\n    references,\n    cachedPrefix,\n  );\n  if (\n    authority &&\n    (authority.currentHead.principalId !== input.authorityGroupId ||\n      authority.states.some(\n        ({ head }) => head.principalId !== input.authorityGroupId,\n      ))\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Authority callback differs from the directory binding\",\n    );\n  if (\n    references.some(\n      (reference) =>\n        !authority?.states.some(({ head }) =>\n          principalHeadMatchesReference(head, reference),\n        ),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Public history authority differs from its verified Admins lineage\",\n    );\n  return authority;\n}\n\nexport async function validatePublicHistoryAuthority(\n  input: PublicPrincipalHistoryOptions,\n  reference: ReferencedPrincipalHead | null,\n  rejectedPrefix: PrincipalHistoryPrefix | null = null,\n): Promise<void> {\n  try {\n    if (reference) await loadPublicHistoryAuthority(input, [reference], true);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PublicHistoryAuthorityUnavailableError(error, rejectedPrefix);\n    throw error;\n  }\n}\n\n/** Only cache restoration can request a replay after an authority mismatch. */\nexport class PublicHistoryAuthorityUnavailableError extends Error {\n  constructor(\n    readonly verificationError: KeyingVerificationError,\n    readonly rejectedPrefix: PrincipalHistoryPrefix | null,\n  ) {\n    super(verificationError.message);\n    this.name = \"PublicHistoryAuthorityUnavailableError\";\n  }\n}\n"]}

package/workflows/principals/publicPrincipalHistoryPage.js

@@ -1,88 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { preparePrincipalHistoryEvidencePage } from "../../data/persistence/principalHistoryEvidencePersistence.js";
-import { savePrincipalHistoryStage } from "../../data/persistence/principalHistoryStagePersistence.js";
-import { principalHistoryStageProtection } from "../../data/principals/principalHistoryStageProtection.js";
-import { collectPrincipalPolicySignerPublicKeys } from "./policyVerification.js";
-import { loadPublicHistoryAuthority, publicHistoryAuthorityJson, publicHistoryAuthorityReference, } from "./publicPrincipalHistoryAuthority.js";
-export class PublicPrincipalHistoryPrefixDisconnectedError extends Error {
-    verificationError;
-    constructor(verificationError) {
-        super(verificationError.message);
-        this.verificationError = verificationError;
-        this.name = "PublicPrincipalHistoryPrefixDisconnectedError";
-    }
-}
-function assertPublicAuthorityScope(input, entries) {
-    if (input.strictAdmins &&
-        entries.some((entry) => entry.projection.length === 0 ||
-            entry.projection.some((member) => member.role !== "admin")))
-        throw new KeyingVerificationError("invalid_shape", "Public Admins history must contain only direct admin users");
-    if (entries.some(({ state }) => state.externalAuthority &&
-        state.externalAuthority.principalId !== input.authorityGroupId))
-        throw new KeyingVerificationError("object_mismatch", "Public history cites an authority outside its directory binding");
-}
-export async function appendPublicPrincipalHistoryPage(input, progress, page) {
-    const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();
-    const complete = page.historyPage.nextAfterVersion === null;
-    const entries = [...page.previousStates];
-    if (complete)
-        entries.push({
-            state: page.currentState,
-            projection: page.currentProjection,
-            grants: page.currentGrants,
-        });
-    assertPublicAuthorityScope(input, entries);
-    const keys = await collectPrincipalPolicySignerPublicKeys({
-        bundle: page,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-    if ("error" in keys)
-        throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Public history signer identity is unavailable or mismatched");
-    const references = entries.flatMap(({ state }) => state.externalAuthority ? [state.externalAuthority] : []);
-    const externalAuthority = await loadPublicHistoryAuthority(input, references);
-    assertProjectionVerificationCurrent(stillCurrent);
-    const appended = await progress.verifier.append({
-        entries,
-        signerPublicKeys: keys.signerPublicKeys,
-        ...(externalAuthority ? { externalAuthority } : {}),
-    });
-    if (!appended.ok) {
-        if (appended.error.code === "stale_predecessor")
-            throw new PublicPrincipalHistoryPrefixDisconnectedError(appended.error);
-        throw appended.error;
-    }
-    const row = {
-        id: progress.id,
-        organizationId: input.organizationId,
-        currentJson: publicHistoryAuthorityJson(publicHistoryAuthorityReference(progress.authorityReference, references)),
-        afterVersion: appended.value.throughVersion - (complete ? 1 : 0),
-        complete,
-    };
-    const sealed = await progress.verifier.exportProgress(await principalHistoryStageProtection(input.protection, input.source.head, row));
-    if (!sealed.ok)
-        throw sealed.error;
-    const saved = { ...row, progress: sealed.value };
-    await savePrincipalHistoryStage({
-        execSql: input.execSql,
-        stage: saved,
-        evidence: await preparePrincipalHistoryEvidencePage({
-            indexRootHash: appended.value.indexRootHash,
-            scopeId: progress.scopeId,
-            organizationId: input.organizationId,
-            entries,
-            nodes: appended.value.indexNodes,
-        }),
-        previousProgress: progress.saved?.progress ?? null,
-        stillCurrent,
-    });
-    assertProjectionVerificationCurrent(stillCurrent);
-    return {
-        ...progress,
-        afterVersion: row.afterVersion,
-        saved,
-        authorityReference: publicHistoryAuthorityReference(progress.authorityReference, references),
-        completedHead: complete ? input.source.head : null,
-    };
-}
-//# sourceMappingURL=publicPrincipalHistoryPage.js.map

package/workflows/principals/publicPrincipalHistoryPage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"publicPrincipalHistoryPage.js","sourceRoot":"","sources":["publicPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAM3C,MAAM,OAAO,6CAA8C,SAAQ,KAAK;IACjD;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,+CAA+C,CAAC;IAC9D,CAAC;CACF;AAED,SAAS,0BAA0B,CACjC,KAAoC,EACpC,OAAkD;IAElD,IACE,KAAK,CAAC,YAAY;QAClB,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,4DAA4D,CAC7D,CAAC;IACJ,IACE,OAAO,CAAC,IAAI,CACV,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,gBAAgB,CACjE;QAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAoC,EACpC,QAAwC,EACxC,IAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAClC,MAAM,EAAE,IAAI,CAAC,aAAa;SAC3B,CAAC,CAAC;IACL,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,IAAI;QACZ,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,6DAA6D,CAC9D,CAAC;IACJ,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/C,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,6CAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,0BAA0B,CACrC,+BAA+B,CAAC,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC,CACzE;QACD,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACnD,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,GAAG,CACJ,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjD,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAClD,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK;QACL,kBAAkB,EAAE,+BAA+B,CACjD,QAAQ,CAAC,kBAAkB,EAC3B,UAAU,CACX;QACD,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;KACnD,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyStateChainEntry,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicySnapshotPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { savePrincipalHistoryStage } from \"../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryStageProtection } from \"../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"./policyVerification\";\nimport {\n  loadPublicHistoryAuthority,\n  publicHistoryAuthorityJson,\n  publicHistoryAuthorityReference,\n} from \"./publicPrincipalHistoryAuthority\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryTypes\";\n\nexport class PublicPrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PublicPrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\nfunction assertPublicAuthorityScope(\n  input: PublicPrincipalHistoryOptions,\n  entries: readonly PrincipalPolicyStateChainEntry[],\n): void {\n  if (\n    input.strictAdmins &&\n    entries.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Public Admins history must contain only direct admin users\",\n    );\n  if (\n    entries.some(\n      ({ state }) =>\n        state.externalAuthority &&\n        state.externalAuthority.principalId !== input.authorityGroupId,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history cites an authority outside its directory binding\",\n    );\n}\n\nexport async function appendPublicPrincipalHistoryPage(\n  input: PublicPrincipalHistoryOptions,\n  progress: PublicPrincipalHistoryProgress,\n  page: PrincipalPolicySnapshotPageResponse,\n): Promise<PublicPrincipalHistoryProgress> {\n  const stillCurrent = () => !input.signal?.aborted && input.stillCurrent();\n  const complete = page.historyPage.nextAfterVersion === null;\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: page.currentState,\n      projection: page.currentProjection,\n      grants: page.currentGrants,\n    });\n  assertPublicAuthorityScope(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: page,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Public history signer identity is unavailable or mismatched\",\n    );\n  const references = entries.flatMap(({ state }) =>\n    state.externalAuthority ? [state.externalAuthority] : [],\n  );\n  const externalAuthority = await loadPublicHistoryAuthority(input, references);\n  assertProjectionVerificationCurrent(stillCurrent);\n  const appended = await progress.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PublicPrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const row = {\n    id: progress.id,\n    organizationId: input.organizationId,\n    currentJson: publicHistoryAuthorityJson(\n      publicHistoryAuthorityReference(progress.authorityReference, references),\n    ),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const sealed = await progress.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.source.head,\n      row,\n    ),\n  );\n  if (!sealed.ok) throw sealed.error;\n  const saved = { ...row, progress: sealed.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      indexRootHash: appended.value.indexRootHash,\n      scopeId: progress.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: progress.saved?.progress ?? null,\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return {\n    ...progress,\n    afterVersion: row.afterVersion,\n    saved,\n    authorityReference: publicHistoryAuthorityReference(\n      progress.authorityReference,\n      references,\n    ),\n    completedHead: complete ? input.source.head : null,\n  };\n}\n"]}