@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/principals/recoverPublicPrincipalHistory.js

@@ -1,178 +0,0 @@
-import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, serializeKeyingCanonicalJson, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
-import { isPrincipalPolicySnapshotPageResponse, } from "../../internal/validators/response/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
-import { PrincipalPolicyHistoryReadError } from "./principalHistoryRecoveryTypes.js";
-import { PublicHistoryAuthorityUnavailableError } from "./publicPrincipalHistoryAuthority.js";
-import { appendPublicPrincipalHistoryPage, PublicPrincipalHistoryPrefixDisconnectedError, } from "./publicPrincipalHistoryPage.js";
-import { publishPublicPrincipalHistoryPrefix, restorePublicPrincipalHistoryProgress, } from "./publicPrincipalHistoryProgress.js";
-function assertPage(input, page, after) {
-    if (!isPrincipalPolicySnapshotPageResponse(page) ||
-        !principalHeadMatchesReference(page.currentState, input.source.head) ||
-        page.historyPage.afterVersion !== after)
-        throw new KeyingVerificationError("object_mismatch", "Public history page does not match its requested head and cursor");
-    const through = after + page.previousStates.length;
-    if (page.previousStates.some(({ state }, index) => state.version !== after + index + 1) ||
-        through >= input.source.head.version ||
-        (page.historyPage.nextAfterVersion === null
-            ? through !== input.source.head.version - 1
-            : through <= after || page.historyPage.nextAfterVersion !== through))
-        throw new KeyingVerificationError("invalid_shape", "Public history page has a gap or invalid continuation");
-}
-async function readPublicPages(input, initial) {
-    const current = () => !input.signal?.aborted && input.stillCurrent();
-    let progress = initial;
-    let lastPage;
-    // Completed progress already verified every signed entry through the cited
-    // head; a read pinned to that head could only repeat it or refuse.
-    if (!input.offline && !progress.completedHead) {
-        for await (const result of input.historyReader.getProjectionPolicyHistoryPages(input.source, { afterVersion: progress.afterVersion, signal: input.signal })) {
-            assertProjectionVerificationCurrent(current);
-            if (!result.ok)
-                throw new PrincipalPolicyHistoryReadError(result);
-            const page = result.data;
-            assertPage(input, page, progress.afterVersion);
-            if (progress.completedHead)
-                throw new KeyingVerificationError("invalid_shape", "Completed public history returned additional entries");
-            progress = await appendPublicPrincipalHistoryPage(input, progress, page);
-            lastPage = page;
-        }
-        if (lastPage?.historyPage.nextAfterVersion !== null)
-            throw new KeyingVerificationError("missing_dependency", "Public history transport did not complete");
-    }
-    return { progress, lastPage };
-}
-function finishPublicProgress(progress) {
-    if (!progress.completedHead)
-        throw new KeyingVerificationError("missing_dependency", "Completed public history is unavailable");
-    const finished = progress.verifier.finish(progress.completedHead);
-    if (!finished.ok)
-        throw finished.error;
-    return finished.value;
-}
-async function recoverAttempt(input, allowReuse = true, rejectedPrefix = null) {
-    const current = () => !input.signal?.aborted && input.stillCurrent();
-    assertProjectionVerificationCurrent(current);
-    const mayReplay = allowReuse && !input.offline;
-    const initial = await restorePublicPrincipalHistoryProgress(input, allowReuse);
-    let pages;
-    try {
-        pages = await readPublicPages(input, initial);
-    }
-    catch (error) {
-        if (!(error instanceof PublicPrincipalHistoryPrefixDisconnectedError))
-            throw error;
-        // A signed cached candidate need not belong to this requested chain. Only
-        // reused progress permits one replay; a fresh disconnected chain fails.
-        if (mayReplay && initial.afterVersion > 0)
-            return recover(input, false, initial.cachedPrefix);
-        throw error.verificationError;
-    }
-    const { progress, lastPage } = pages;
-    const history = finishPublicProgress(progress);
-    let proof;
-    try {
-        proof = await loadPrincipalHistoryReference({
-            execSql: input.execSql,
-            scopeId: progress.scopeId,
-            history,
-            version: input.source.head.version,
-        });
-        const selected = await verifyPrincipalPolicyHistoryReferences({
-            history,
-            references: [proof],
-        });
-        if (!selected.ok)
-            throw selected.error;
-    }
-    catch (error) {
-        if (error instanceof KeyingVerificationError && mayReplay)
-            return recover(input, false, initial.cachedPrefix);
-        throw error;
-    }
-    // Public prefixes memoize signatures; they are not admitted trust pins. A
-    // rejected projection may have left a valid but unrelated signed candidate.
-    // Rebuild the requested chain once online; callers still check durable pins
-    // and object authority before accepting it. Never reuse a mismatch offline.
-    if (!principalHeadMatchesReference(proof.entry.state, input.source.head)) {
-        if (mayReplay)
-            return recover(input, false, initial.cachedPrefix);
-        throw new KeyingVerificationError("object_mismatch", "Public history source differs from the verified prefix");
-    }
-    if (lastPage) {
-        const currentProof = {
-            ...proof,
-            entry: {
-                state: lastPage.currentState,
-                projection: lastPage.currentProjection,
-                grants: lastPage.currentGrants,
-            },
-        };
-        const checked = await verifyPrincipalPolicyHistoryReferences({
-            history,
-            references: [currentProof],
-        });
-        if (!checked.ok)
-            throw checked.error;
-    }
-    assertProjectionVerificationCurrent(current);
-    if (!input.offline)
-        await publishPublicPrincipalHistoryPrefix(input, progress, history, rejectedPrefix);
-    assertProjectionVerificationCurrent(current);
-    return { scopeId: progress.scopeId, history };
-}
-async function recover(input, allowReuse = true, rejectedPrefix = null) {
-    try {
-        return await recoverAttempt(input, allowReuse, rejectedPrefix);
-    }
-    catch (error) {
-        if (!(error instanceof PublicHistoryAuthorityUnavailableError))
-            throw error;
-        if (allowReuse && !input.offline)
-            return recoverAttempt(input, false, error.rejectedPrefix);
-        throw error.verificationError;
-    }
-}
-/** Private-key-backed public history recovery; never admits a current policy pin. */
-export async function recoverPublicPrincipalHistory(options) {
-    if (!options.organizationId ||
-        (options.historicalProof !== undefined &&
-            typeof options.historicalProof !== "boolean") ||
-        (options.offline !== undefined && typeof options.offline !== "boolean") ||
-        (options.strictAdmins !== undefined &&
-            typeof options.strictAdmins !== "boolean") ||
-        (options.strictAdmins &&
-            (options.source.head.principalType !== "group" ||
-                options.loadExternalAuthority)))
-        throw new KeyingVerificationError("invalid_shape", "Invalid public history verification scope");
-    if (options.source.head.principalType === "organization" &&
-        options.source.head.principalId !== options.organizationId)
-        throw new KeyingVerificationError("object_mismatch", "Public organization history is outside its scope");
-    // Validate the caller's pinned head before any cache or transport access.
-    createPrincipalPolicyHistoryVerifier({
-        principalType: options.source.head.principalType,
-        principalId: options.source.head.principalId,
-        retainedReferences: [options.source.head],
-    });
-    const protection = ownPrincipalHistoryProtection(options.protection);
-    protection.context = serializeKeyingCanonicalJson([
-        "tearleads.sdk.public-principal-history.v2",
-        protection.context,
-        options.strictAdmins === true,
-        options.authorityGroupId ?? null,
-    ]);
-    const input = {
-        ...options,
-        source: structuredClone(options.source),
-        protection,
-    };
-    try {
-        return await recover(input, options.replay !== true);
-    }
-    finally {
-        protection.localKey.fill(0);
-    }
-}
-//# sourceMappingURL=recoverPublicPrincipalHistory.js.map

package/workflows/principals/recoverPublicPrincipalHistory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"recoverPublicPrincipalHistory.js","sourceRoot":"","sources":["recoverPublicPrincipalHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EAEvB,4BAA4B,EAC5B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qCAAqC,GAEtC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAE3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,sCAAsC,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EACL,gCAAgC,EAChC,6CAA6C,GAC9C,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,kCAAkC,CAAC;AAO1C,SAAS,UAAU,CACjB,KAAoC,EACpC,IAAyC,EACzC,KAAa;IAEb,IACE,CAAC,qCAAqC,CAAC,IAAI,CAAC;QAC5C,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,KAAK;QAEvC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACnD,IACE,IAAI,CAAC,cAAc,CAAC,IAAI,CACtB,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,GAAG,KAAK,GAAG,CAAC,CAC1D;QACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;QACpC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YACzC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC;YAC3C,CAAC,CAAC,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,OAAO,CAAC;QAEtE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,uDAAuD,CACxD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAoC,EACpC,OAAuC;IAEvC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,IAAI,QAAyD,CAAC;IAC9D,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,+BAA+B,CAC5E,KAAK,CAAC,MAAM,EACZ,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC9D,EAAE,CAAC;YACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa;gBACxB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sDAAsD,CACvD,CAAC;YACJ,QAAQ,GAAG,MAAM,gCAAgC,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzE,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,QAAQ,EAAE,WAAW,CAAC,gBAAgB,KAAK,IAAI;YACjD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;IACN,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAwC;IACpE,IAAI,CAAC,QAAQ,CAAC,aAAa;QACzB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;IACJ,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAoC,EACpC,UAAU,GAAG,IAAI,EACjB,iBAAgD,IAAI;IAEpD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,qCAAqC,CACzD,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,KAAkD,CAAC;IACvD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,6CAA6C,CAAC;YACnE,MAAM,KAAK,CAAC;QACd,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,SAAS,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC;YACvC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC,iBAAiB,CAAC;IAChC,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAA2C,CAAC;IAChD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,6BAA6B,CAAC;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;YAC5D,OAAO;YACP,UAAU,EAAE,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,IAAI,SAAS;YACvD,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,IAAI,SAAS;YAAE,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG;YACnB,GAAG,KAAK;YACR,KAAK,EAAE;gBACL,KAAK,EAAE,QAAQ,CAAC,YAAY;gBAC5B,UAAU,EAAE,QAAQ,CAAC,iBAAiB;gBACtC,MAAM,EAAE,QAAQ,CAAC,aAAa;aAC/B;SACF,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,OAAO;YACP,UAAU,EAAE,CAAC,YAAY,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACvC,CAAC;IACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,mCAAmC,CACvC,KAAK,EACL,QAAQ,EACR,OAAO,EACP,cAAc,CACf,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAoC,EACpC,UAAU,GAAG,IAAI,EACjB,iBAAgD,IAAI;IAEpD,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sCAAsC,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5E,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO;YAC9B,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC,iBAAiB,CAAC;IAChC,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAsC;IAEtC,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;YACpC,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC;QAC/C,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;QACvE,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YACjC,OAAO,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC;QAC5C,CAAC,OAAO,CAAC,YAAY;YACnB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO;gBAC5C,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAEnC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,cAAc;QACpD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc;QAE1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;IACJ,0EAA0E;IAC1E,oCAAoC,CAAC;QACnC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;QAChD,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW;QAC5C,kBAAkB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrE,UAAU,CAAC,OAAO,GAAG,4BAA4B,CAAC;QAChD,2CAA2C;QAC3C,UAAU,CAAC,OAAO;QAClB,OAAO,CAAC,YAAY,KAAK,IAAI;QAC7B,OAAO,CAAC,gBAAgB,IAAI,IAAI;KACjC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,UAAU;KACX,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  type PrincipalPolicyHistoryReferenceProof,\n  serializeKeyingCanonicalJson,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicySnapshotPageResponse,\n  type PrincipalPolicySnapshotPageResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport type { PrincipalHistoryPrefix } from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport { PrincipalPolicyHistoryReadError } from \"./principalHistoryRecoveryTypes\";\nimport { PublicHistoryAuthorityUnavailableError } from \"./publicPrincipalHistoryAuthority\";\nimport {\n  appendPublicPrincipalHistoryPage,\n  PublicPrincipalHistoryPrefixDisconnectedError,\n} from \"./publicPrincipalHistoryPage\";\nimport {\n  publishPublicPrincipalHistoryPrefix,\n  restorePublicPrincipalHistoryProgress,\n} from \"./publicPrincipalHistoryProgress\";\nimport type {\n  PublicPrincipalHistoryOptions,\n  PublicPrincipalHistoryProgress,\n  RecoveredPublicPrincipalHistory,\n} from \"./publicPrincipalHistoryTypes\";\n\nfunction assertPage(\n  input: PublicPrincipalHistoryOptions,\n  page: PrincipalPolicySnapshotPageResponse,\n  after: number,\n): void {\n  if (\n    !isPrincipalPolicySnapshotPageResponse(page) ||\n    !principalHeadMatchesReference(page.currentState, input.source.head) ||\n    page.historyPage.afterVersion !== after\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history page does not match its requested head and cursor\",\n    );\n  const through = after + page.previousStates.length;\n  if (\n    page.previousStates.some(\n      ({ state }, index) => state.version !== after + index + 1,\n    ) ||\n    through >= input.source.head.version ||\n    (page.historyPage.nextAfterVersion === null\n      ? through !== input.source.head.version - 1\n      : through <= after || page.historyPage.nextAfterVersion !== through)\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Public history page has a gap or invalid continuation\",\n    );\n}\n\nasync function readPublicPages(\n  input: PublicPrincipalHistoryOptions,\n  initial: PublicPrincipalHistoryProgress,\n) {\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  let progress = initial;\n  let lastPage: PrincipalPolicySnapshotPageResponse | undefined;\n  // Completed progress already verified every signed entry through the cited\n  // head; a read pinned to that head could only repeat it or refuse.\n  if (!input.offline && !progress.completedHead) {\n    for await (const result of input.historyReader.getProjectionPolicyHistoryPages(\n      input.source,\n      { afterVersion: progress.afterVersion, signal: input.signal },\n    )) {\n      assertProjectionVerificationCurrent(current);\n      if (!result.ok) throw new PrincipalPolicyHistoryReadError(result);\n      const page = result.data;\n      assertPage(input, page, progress.afterVersion);\n      if (progress.completedHead)\n        throw new KeyingVerificationError(\n          \"invalid_shape\",\n          \"Completed public history returned additional entries\",\n        );\n      progress = await appendPublicPrincipalHistoryPage(input, progress, page);\n      lastPage = page;\n    }\n    if (lastPage?.historyPage.nextAfterVersion !== null)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Public history transport did not complete\",\n      );\n  }\n  return { progress, lastPage };\n}\n\nfunction finishPublicProgress(progress: PublicPrincipalHistoryProgress) {\n  if (!progress.completedHead)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Completed public history is unavailable\",\n    );\n  const finished = progress.verifier.finish(progress.completedHead);\n  if (!finished.ok) throw finished.error;\n  return finished.value;\n}\n\nasync function recoverAttempt(\n  input: PublicPrincipalHistoryOptions,\n  allowReuse = true,\n  rejectedPrefix: PrincipalHistoryPrefix | null = null,\n): Promise<RecoveredPublicPrincipalHistory> {\n  const current = () => !input.signal?.aborted && input.stillCurrent();\n  assertProjectionVerificationCurrent(current);\n  const mayReplay = allowReuse && !input.offline;\n  const initial = await restorePublicPrincipalHistoryProgress(\n    input,\n    allowReuse,\n  );\n  let pages: Awaited<ReturnType<typeof readPublicPages>>;\n  try {\n    pages = await readPublicPages(input, initial);\n  } catch (error) {\n    if (!(error instanceof PublicPrincipalHistoryPrefixDisconnectedError))\n      throw error;\n    // A signed cached candidate need not belong to this requested chain. Only\n    // reused progress permits one replay; a fresh disconnected chain fails.\n    if (mayReplay && initial.afterVersion > 0)\n      return recover(input, false, initial.cachedPrefix);\n    throw error.verificationError;\n  }\n  const { progress, lastPage } = pages;\n  const history = finishPublicProgress(progress);\n  let proof: PrincipalPolicyHistoryReferenceProof;\n  try {\n    proof = await loadPrincipalHistoryReference({\n      execSql: input.execSql,\n      scopeId: progress.scopeId,\n      history,\n      version: input.source.head.version,\n    });\n    const selected = await verifyPrincipalPolicyHistoryReferences({\n      history,\n      references: [proof],\n    });\n    if (!selected.ok) throw selected.error;\n  } catch (error) {\n    if (error instanceof KeyingVerificationError && mayReplay)\n      return recover(input, false, initial.cachedPrefix);\n    throw error;\n  }\n  // Public prefixes memoize signatures; they are not admitted trust pins. A\n  // rejected projection may have left a valid but unrelated signed candidate.\n  // Rebuild the requested chain once online; callers still check durable pins\n  // and object authority before accepting it. Never reuse a mismatch offline.\n  if (!principalHeadMatchesReference(proof.entry.state, input.source.head)) {\n    if (mayReplay) return recover(input, false, initial.cachedPrefix);\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history source differs from the verified prefix\",\n    );\n  }\n  if (lastPage) {\n    const currentProof = {\n      ...proof,\n      entry: {\n        state: lastPage.currentState,\n        projection: lastPage.currentProjection,\n        grants: lastPage.currentGrants,\n      },\n    };\n    const checked = await verifyPrincipalPolicyHistoryReferences({\n      history,\n      references: [currentProof],\n    });\n    if (!checked.ok) throw checked.error;\n  }\n  assertProjectionVerificationCurrent(current);\n  if (!input.offline)\n    await publishPublicPrincipalHistoryPrefix(\n      input,\n      progress,\n      history,\n      rejectedPrefix,\n    );\n  assertProjectionVerificationCurrent(current);\n  return { scopeId: progress.scopeId, history };\n}\n\nasync function recover(\n  input: PublicPrincipalHistoryOptions,\n  allowReuse = true,\n  rejectedPrefix: PrincipalHistoryPrefix | null = null,\n): Promise<RecoveredPublicPrincipalHistory> {\n  try {\n    return await recoverAttempt(input, allowReuse, rejectedPrefix);\n  } catch (error) {\n    if (!(error instanceof PublicHistoryAuthorityUnavailableError)) throw error;\n    if (allowReuse && !input.offline)\n      return recoverAttempt(input, false, error.rejectedPrefix);\n    throw error.verificationError;\n  }\n}\n\n/** Private-key-backed public history recovery; never admits a current policy pin. */\nexport async function recoverPublicPrincipalHistory(\n  options: PublicPrincipalHistoryOptions,\n): Promise<RecoveredPublicPrincipalHistory> {\n  if (\n    !options.organizationId ||\n    (options.historicalProof !== undefined &&\n      typeof options.historicalProof !== \"boolean\") ||\n    (options.offline !== undefined && typeof options.offline !== \"boolean\") ||\n    (options.strictAdmins !== undefined &&\n      typeof options.strictAdmins !== \"boolean\") ||\n    (options.strictAdmins &&\n      (options.source.head.principalType !== \"group\" ||\n        options.loadExternalAuthority))\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid public history verification scope\",\n    );\n  if (\n    options.source.head.principalType === \"organization\" &&\n    options.source.head.principalId !== options.organizationId\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public organization history is outside its scope\",\n    );\n  // Validate the caller's pinned head before any cache or transport access.\n  createPrincipalPolicyHistoryVerifier({\n    principalType: options.source.head.principalType,\n    principalId: options.source.head.principalId,\n    retainedReferences: [options.source.head],\n  });\n  const protection = ownPrincipalHistoryProtection(options.protection);\n  protection.context = serializeKeyingCanonicalJson([\n    \"tearleads.sdk.public-principal-history.v2\",\n    protection.context,\n    options.strictAdmins === true,\n    options.authorityGroupId ?? null,\n  ]);\n  const input = {\n    ...options,\n    source: structuredClone(options.source),\n    protection,\n  };\n  try {\n    return await recover(input, options.replay !== true);\n  } finally {\n    protection.localKey.fill(0);\n  }\n}\n"]}

package/workflows/principals/recoverScopedPrincipalPolicyHistory.d.ts

@@ -1,27 +0,0 @@
-import { type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
-import type { RecoveredPrincipalHistoryPage } from "./loadRecoveredPrincipalHistoryPage.js";
-import { type RecoveredPrincipalPolicyHistory } from "./principalHistoryRecoveryTypes.js";
-import { type PrincipalRecoveryContext } from "./principalRecoveryDirectory.js";
-import { type PrincipalRecoveryMemo } from "./principalRecoveryMemo.js";
-export interface RecoverScopedPrincipalPolicyHistoryOptions extends PrincipalRecoveryContext {
-    readonly reference: ReferencedPrincipalHead;
-    /** Optional bounded display history ending before this exclusive version. */
-    readonly historyPage?: {
-        readonly beforeVersion?: number;
-    } | undefined;
-}
-export interface RecoveredScopedPrincipalPolicyHistory extends RecoveredPrincipalPolicyHistory {
-    /** Submit these with policy when atomically admitting its organization scope. */
-    readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];
-    readonly historyPage?: RecoveredPrincipalHistoryPage | undefined;
-}
-/** Internal result: valid only while every evidence producer behind it is. */
-export interface ScopedPrincipalPolicyRecovery extends RecoveredScopedPrincipalPolicyHistory {
-    readonly stillCurrent: () => boolean;
-}
-export type ScopedPrincipalPolicyRecoveryBatch = (options: RecoverScopedPrincipalPolicyHistoryOptions) => Promise<ScopedPrincipalPolicyRecovery>;
-export declare function recoverScopedPrincipalPolicyHistory(options: RecoverScopedPrincipalPolicyHistoryOptions): Promise<RecoveredScopedPrincipalPolicyHistory>;
-/** Internal unbatched recovery that keeps its result's lifetime. */
-export declare const recoverLeasedScopedPrincipalPolicyHistory: ScopedPrincipalPolicyRecoveryBatch;
-/** Internal runtime batch: shared results never outlive its operation or caller. */
-export declare function createScopedPrincipalPolicyHistoryBatch(memo?: PrincipalRecoveryMemo): ScopedPrincipalPolicyRecoveryBatch;

package/workflows/principals/recoverScopedPrincipalPolicyHistory.js

@@ -1,163 +0,0 @@
-import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
-import { directoryHistoryProtection, scopedGroupHistoryProtection, } from "../../data/principals/principalHistoryScopeProtection.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
-import { PrincipalHistoryRecoveryRaceError, } from "./principalHistoryRecoveryTypes.js";
-import { PrincipalRecoveryDirectoryAdvanced, } from "./principalRecoveryDirectory.js";
-import { createPrincipalRecoveryReader, } from "./principalRecoveryMemo.js";
-import { recoverPrincipalHistoryPage } from "./recoverPrincipalHistoryPage.js";
-import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
-function groupHead(directory, principalId) {
-    const head = directory.descriptor.groupHeads.find((entry) => entry.principalId === principalId);
-    if (!head)
-        throw new KeyingVerificationError("missing_dependency", "Group is absent from the signed organization directory");
-    return head;
-}
-function authorityHead(state) {
-    return {
-        principalType: "group",
-        principalId: state.principalId,
-        version: state.version,
-        stateHash: state.stateHash,
-        keyEpoch: state.keyEpoch,
-        keyFingerprint: state.keyFingerprint,
-    };
-}
-async function recoverScopedPolicy(input, memo) {
-    if (input.reference.principalType === "organization" &&
-        input.reference.principalId !== input.organizationId)
-        throw new KeyingVerificationError("object_mismatch", "Requested organization policy is outside its scope");
-    const read = createPrincipalRecoveryReader(input, memo);
-    // Reused or derived evidence keeps its producers' lifetimes to its use.
-    const stillCurrent = () => !input.signal?.aborted && input.stillCurrent() && read.stillCurrent();
-    const directory = await read.directory(input.reference.principalType === "organization" ? [input.reference] : []);
-    if (input.reference.principalType === "organization")
-        return {
-            current: directory.current,
-            policy: directory.policy,
-            dependencies: [],
-            stillCurrent,
-            ...(await selectDisplayHistory(input, {
-                ...input,
-                expectedHead: principalPolicyReferenceFromBundle(directory.current),
-                protection: directoryHistoryProtection(input.protection),
-            })),
-        };
-    const expectedHead = groupHead(directory, input.reference.principalId);
-    if (input.reference.version > expectedHead.version)
-        throw new PrincipalRecoveryDirectoryAdvanced();
-    const adminHead = groupHead(directory, directory.descriptor.adminGroupId);
-    const isAdmins = expectedHead.principalId === adminHead.principalId;
-    let admins = null;
-    if (!isAdmins) {
-        admins = (await read.admins(adminHead)).policy;
-    }
-    const loadExternalAuthority = async (citations) => {
-        const references = new Map();
-        for (const citation of citations) {
-            if (citation.principalId !== adminHead.principalId)
-                throw new KeyingVerificationError("object_mismatch", "Group cites another organization's Admins authority");
-            if (citation.version > adminHead.version)
-                throw new PrincipalRecoveryDirectoryAdvanced();
-            references.set(`${citation.version}:${citation.stateHash}`, citation);
-        }
-        if (!references.size)
-            return undefined;
-        const recovered = await read.admins(adminHead, [...references.values()]);
-        return {
-            currentHead: adminHead,
-            states: recovered.policy.retainedHistory.map(({ state, projection }) => ({
-                head: authorityHead(state),
-                projection,
-            })),
-        };
-    };
-    const recoveryOptions = {
-        ...input,
-        expectedHead,
-        retainedReferences: [input.reference],
-        historyVerification: isAdmins ? "direct-admins" : "standard",
-        ...(isAdmins
-            ? {}
-            : {
-                protection: scopedGroupHistoryProtection(input.protection, input.organizationId, adminHead.principalId),
-            }),
-        ...(isAdmins ? {} : { loadExternalAuthority }),
-    };
-    const recovered = isAdmins
-        ? await read.admins(expectedHead, [input.reference])
-        : await recoverPrincipalPolicyHistory(recoveryOptions);
-    return {
-        ...recovered,
-        dependencies: admins ? [directory.policy, admins] : [directory.policy],
-        stillCurrent,
-        ...(await selectDisplayHistory(input, recoveryOptions)),
-    };
-}
-/** Recover signed directory and strict Admins dependencies without full histories. */
-async function recoverScopedPrincipalPolicyHistoryInBatch(options, memo) {
-    if (options.offline !== undefined && typeof options.offline !== "boolean")
-        throw new KeyingVerificationError("invalid_shape", "Invalid principal history transport mode");
-    if (!options.organizationId)
-        throw new KeyingVerificationError("object_mismatch", "Principal recovery requires an organization scope");
-    const input = {
-        historyReader: options.historyReader,
-        execSql: options.execSql,
-        organizationId: options.organizationId,
-        offline: options.offline,
-        resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,
-        signal: options.signal,
-        stillCurrent: options.stillCurrent,
-        reference: structuredClone(options.reference),
-        historyPage: options.historyPage ? { ...options.historyPage } : undefined,
-        protection: ownPrincipalHistoryProtection(options.protection),
-    };
-    try {
-        // Reject malformed exact citations before any discovery or disposable writes.
-        createPrincipalPolicyHistoryVerifier({
-            principalId: input.reference.principalId,
-            principalType: input.reference.principalType,
-            retainedReferences: [input.reference],
-        });
-        for (let attempt = 0; attempt < 2; attempt += 1) {
-            try {
-                const recovered = await recoverScopedPolicy(input, memo);
-                assertProjectionVerificationCurrent(recovered.stillCurrent);
-                return recovered;
-            }
-            catch (error) {
-                if (!(error instanceof PrincipalRecoveryDirectoryAdvanced))
-                    throw error;
-                memo?.directories.clear();
-                memo?.admins.clear();
-                if (input.offline)
-                    throw new KeyingVerificationError("missing_dependency", "Requested principal evidence is newer than the offline directory");
-            }
-        }
-        throw new PrincipalHistoryRecoveryRaceError("Organization directory remains behind the requested policy evidence");
-    }
-    finally {
-        input.protection.localKey.fill(0);
-    }
-}
-export function recoverScopedPrincipalPolicyHistory(options) {
-    return recoverScopedPrincipalPolicyHistoryInBatch(options);
-}
-/** Internal unbatched recovery that keeps its result's lifetime. */
-export const recoverLeasedScopedPrincipalPolicyHistory = (options) => recoverScopedPrincipalPolicyHistoryInBatch(options);
-async function selectDisplayHistory(input, options) {
-    if (!input.historyPage)
-        return {};
-    return {
-        historyPage: await recoverPrincipalHistoryPage(options, input.historyPage.beforeVersion ?? input.reference.version + 1),
-    };
-}
-/** Internal runtime batch: shared results never outlive its operation or caller. */
-export function createScopedPrincipalPolicyHistoryBatch(memo = {
-    directories: new Map(),
-    admins: new Map(),
-}) {
-    return (options) => recoverScopedPrincipalPolicyHistoryInBatch(options, memo);
-}
-//# sourceMappingURL=recoverScopedPrincipalPolicyHistory.js.map

package/workflows/principals/recoverScopedPrincipalPolicyHistory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"recoverScopedPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverScopedPrincipalPolicyHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAEvG,OAAO,EACL,iCAAiC,GAGlC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,kCAAkC,GAEnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,6BAA6B,GAE9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AA0BhF,SAAS,SAAS,CAAC,SAAmC,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAC7C,CAAC;IACF,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO;QACL,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAiD,EACjD,IAA4B;IAE5B,IACE,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAChD,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;QAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,oDAAoD,CACrD,CAAC;IACJ,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxD,wEAAwE;IACxE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAClD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,YAAY,EAAE,EAAE;YAChB,YAAY;YACZ,GAAG,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE;gBACpC,GAAG,KAAK;gBACR,YAAY,EAAE,kCAAkC,CAAC,SAAS,CAAC,OAAO,CAAC;gBACnE,UAAU,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;aACzD,CAAC,CAAC;SACJ,CAAC;IACJ,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO;QAChD,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAAC;IACpE,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,CAAC;IACD,MAAM,qBAAqB,GAAG,KAAK,EACjC,SAA6C,EACU,EAAE;QACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;gBAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;YACJ,IAAI,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO;gBACtC,MAAM,IAAI,kCAAkC,EAAE,CAAC;YACjD,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO;YACL,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC1B,UAAU;aACX,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,eAAe,GAAyC;QAC5D,GAAG,KAAK;QACR,YAAY;QACZ,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACrC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU;QAC5D,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,UAAU,EAAE,4BAA4B,CACtC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,SAAS,CAAC,WAAW,CACtB;aACF,CAAC;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;KAC/C,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC,CAAC,MAAM,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACzD,OAAO;QACL,GAAG,SAAS;QACZ,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QACtE,YAAY;QACZ,GAAG,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,0CAA0C,CACvD,OAAmD,EACnD,IAA4B;IAE5B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,cAAc;QACzB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,8EAA8E;QAC9E,oCAAoC,CAAC;YACnC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YACxC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;YAC5C,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SACtC,CAAC,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzD,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC5D,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kCAAkC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,KAAK,CAAC,OAAO;oBACf,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,kEAAkE,CACnE,CAAC;YACN,CAAC;QACH,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAAmD;IAEnD,OAAO,0CAA0C,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,yCAAyC,GACpD,CAAC,OAAO,EAAE,EAAE,CAAC,0CAA0C,CAAC,OAAO,CAAC,CAAC;AAEnE,KAAK,UAAU,oBAAoB,CACjC,KAAiD,EACjD,OAA6C;IAE7C,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO;QACL,WAAW,EAAE,MAAM,2BAA2B,CAC5C,OAAO,EACP,KAAK,CAAC,WAAW,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAC/D;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uCAAuC,CACrD,OAA8B;IAC5B,WAAW,EAAE,IAAI,GAAG,EAAE;IACtB,MAAM,EAAE,IAAI,GAAG,EAAE;CAClB;IAED,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,0CAA0C,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { ownPrincipalHistoryProtection } from \"../../data/principals/principalHistoryProtection\";\nimport {\n  directoryHistoryProtection,\n  scopedGroupHistoryProtection,\n} from \"../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { RecoveredPrincipalHistoryPage } from \"./loadRecoveredPrincipalHistoryPage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n  type PrincipalRecoveryContext,\n  PrincipalRecoveryDirectoryAdvanced,\n  type RecoveredPolicyDirectory,\n} from \"./principalRecoveryDirectory\";\nimport {\n  createPrincipalRecoveryReader,\n  type PrincipalRecoveryMemo,\n} from \"./principalRecoveryMemo\";\nimport { recoverPrincipalHistoryPage } from \"./recoverPrincipalHistoryPage\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport interface RecoverScopedPrincipalPolicyHistoryOptions\n  extends PrincipalRecoveryContext {\n  readonly reference: ReferencedPrincipalHead;\n  /** Optional bounded display history ending before this exclusive version. */\n  readonly historyPage?: { readonly beforeVersion?: number } | undefined;\n}\n\nexport interface RecoveredScopedPrincipalPolicyHistory\n  extends RecoveredPrincipalPolicyHistory {\n  /** Submit these with policy when atomically admitting its organization scope. */\n  readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n  readonly historyPage?: RecoveredPrincipalHistoryPage | undefined;\n}\n\n/** Internal result: valid only while every evidence producer behind it is. */\nexport interface ScopedPrincipalPolicyRecovery\n  extends RecoveredScopedPrincipalPolicyHistory {\n  readonly stillCurrent: () => boolean;\n}\n\nexport type ScopedPrincipalPolicyRecoveryBatch = (\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n) => Promise<ScopedPrincipalPolicyRecovery>;\n\nfunction groupHead(directory: RecoveredPolicyDirectory, principalId: string) {\n  const head = directory.descriptor.groupHeads.find(\n    (entry) => entry.principalId === principalId,\n  );\n  if (!head)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Group is absent from the signed organization directory\",\n    );\n  return head;\n}\n\nfunction authorityHead(state: ReferencedPrincipalHead) {\n  return {\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nasync function recoverScopedPolicy(\n  input: RecoverScopedPrincipalPolicyHistoryOptions,\n  memo?: PrincipalRecoveryMemo,\n): Promise<ScopedPrincipalPolicyRecovery> {\n  if (\n    input.reference.principalType === \"organization\" &&\n    input.reference.principalId !== input.organizationId\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Requested organization policy is outside its scope\",\n    );\n  const read = createPrincipalRecoveryReader(input, memo);\n  // Reused or derived evidence keeps its producers' lifetimes to its use.\n  const stillCurrent = () =>\n    !input.signal?.aborted && input.stillCurrent() && read.stillCurrent();\n  const directory = await read.directory(\n    input.reference.principalType === \"organization\" ? [input.reference] : [],\n  );\n  if (input.reference.principalType === \"organization\")\n    return {\n      current: directory.current,\n      policy: directory.policy,\n      dependencies: [],\n      stillCurrent,\n      ...(await selectDisplayHistory(input, {\n        ...input,\n        expectedHead: principalPolicyReferenceFromBundle(directory.current),\n        protection: directoryHistoryProtection(input.protection),\n      })),\n    };\n  const expectedHead = groupHead(directory, input.reference.principalId);\n  if (input.reference.version > expectedHead.version)\n    throw new PrincipalRecoveryDirectoryAdvanced();\n  const adminHead = groupHead(directory, directory.descriptor.adminGroupId);\n  const isAdmins = expectedHead.principalId === adminHead.principalId;\n  let admins: VerifiedPrincipalPolicyCurrent | null = null;\n  if (!isAdmins) {\n    admins = (await read.admins(adminHead)).policy;\n  }\n  const loadExternalAuthority = async (\n    citations: readonly ReferencedPrincipalHead[],\n  ): Promise<PrincipalPolicyExternalAuthority | undefined> => {\n    const references = new Map<string, ReferencedPrincipalHead>();\n    for (const citation of citations) {\n      if (citation.principalId !== adminHead.principalId)\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Group cites another organization's Admins authority\",\n        );\n      if (citation.version > adminHead.version)\n        throw new PrincipalRecoveryDirectoryAdvanced();\n      references.set(`${citation.version}:${citation.stateHash}`, citation);\n    }\n    if (!references.size) return undefined;\n    const recovered = await read.admins(adminHead, [...references.values()]);\n    return {\n      currentHead: adminHead,\n      states: recovered.policy.retainedHistory.map(({ state, projection }) => ({\n        head: authorityHead(state),\n        projection,\n      })),\n    };\n  };\n  const recoveryOptions: RecoverPrincipalPolicyHistoryOptions = {\n    ...input,\n    expectedHead,\n    retainedReferences: [input.reference],\n    historyVerification: isAdmins ? \"direct-admins\" : \"standard\",\n    ...(isAdmins\n      ? {}\n      : {\n          protection: scopedGroupHistoryProtection(\n            input.protection,\n            input.organizationId,\n            adminHead.principalId,\n          ),\n        }),\n    ...(isAdmins ? {} : { loadExternalAuthority }),\n  };\n  const recovered = isAdmins\n    ? await read.admins(expectedHead, [input.reference])\n    : await recoverPrincipalPolicyHistory(recoveryOptions);\n  return {\n    ...recovered,\n    dependencies: admins ? [directory.policy, admins] : [directory.policy],\n    stillCurrent,\n    ...(await selectDisplayHistory(input, recoveryOptions)),\n  };\n}\n\n/** Recover signed directory and strict Admins dependencies without full histories. */\nasync function recoverScopedPrincipalPolicyHistoryInBatch(\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n  memo?: PrincipalRecoveryMemo,\n): Promise<ScopedPrincipalPolicyRecovery> {\n  if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid principal history transport mode\",\n    );\n  if (!options.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal recovery requires an organization scope\",\n    );\n  const input = {\n    historyReader: options.historyReader,\n    execSql: options.execSql,\n    organizationId: options.organizationId,\n    offline: options.offline,\n    resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,\n    signal: options.signal,\n    stillCurrent: options.stillCurrent,\n    reference: structuredClone(options.reference),\n    historyPage: options.historyPage ? { ...options.historyPage } : undefined,\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    // Reject malformed exact citations before any discovery or disposable writes.\n    createPrincipalPolicyHistoryVerifier({\n      principalId: input.reference.principalId,\n      principalType: input.reference.principalType,\n      retainedReferences: [input.reference],\n    });\n    for (let attempt = 0; attempt < 2; attempt += 1) {\n      try {\n        const recovered = await recoverScopedPolicy(input, memo);\n        assertProjectionVerificationCurrent(recovered.stillCurrent);\n        return recovered;\n      } catch (error) {\n        if (!(error instanceof PrincipalRecoveryDirectoryAdvanced)) throw error;\n        memo?.directories.clear();\n        memo?.admins.clear();\n        if (input.offline)\n          throw new KeyingVerificationError(\n            \"missing_dependency\",\n            \"Requested principal evidence is newer than the offline directory\",\n          );\n      }\n    }\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Organization directory remains behind the requested policy evidence\",\n    );\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n\nexport function recoverScopedPrincipalPolicyHistory(\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n): Promise<RecoveredScopedPrincipalPolicyHistory> {\n  return recoverScopedPrincipalPolicyHistoryInBatch(options);\n}\n\n/** Internal unbatched recovery that keeps its result's lifetime. */\nexport const recoverLeasedScopedPrincipalPolicyHistory: ScopedPrincipalPolicyRecoveryBatch =\n  (options) => recoverScopedPrincipalPolicyHistoryInBatch(options);\n\nasync function selectDisplayHistory(\n  input: RecoverScopedPrincipalPolicyHistoryOptions,\n  options: RecoverPrincipalPolicyHistoryOptions,\n) {\n  if (!input.historyPage) return {};\n  return {\n    historyPage: await recoverPrincipalHistoryPage(\n      options,\n      input.historyPage.beforeVersion ?? input.reference.version + 1,\n    ),\n  };\n}\n\n/** Internal runtime batch: shared results never outlive its operation or caller. */\nexport function createScopedPrincipalPolicyHistoryBatch(\n  memo: PrincipalRecoveryMemo = {\n    directories: new Map(),\n    admins: new Map(),\n  },\n): ScopedPrincipalPolicyRecoveryBatch {\n  return (options) => recoverScopedPrincipalPolicyHistoryInBatch(options, memo);\n}\n"]}

package/workflows/principals/selectPublicPrincipalHistory.js

@@ -1,96 +0,0 @@
-import { KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, selectPrincipalPolicyAuthorization, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
-async function selectBatch(input, versions, checkpointReference) {
-    const proofs = [];
-    for (const version of versions) {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        proofs.push(await loadPrincipalHistoryReference({
-            execSql: input.execSql,
-            ...input.recovered,
-            version,
-        }));
-    }
-    const selected = await verifyPrincipalPolicyHistoryReferences({
-        history: input.recovered.history,
-        references: proofs,
-        checkpointReference,
-    });
-    if (!selected.ok)
-        throw selected.error;
-    return selected.value;
-}
-async function loadCheckpointProof(input, checkpoint) {
-    let checkpointReference;
-    try {
-        if (checkpoint)
-            checkpointReference = await loadPrincipalHistoryReference({
-                execSql: input.execSql,
-                ...input.recovered,
-                version: checkpoint.version,
-            });
-    }
-    catch (error) {
-        if (error instanceof KeyingVerificationError)
-            throw new PrincipalHistoryEvidenceUnavailableError(error);
-        throw error;
-    }
-    return checkpointReference;
-}
-function checkSelectedReferences(input, references, batch, selected, checkpoint) {
-    // Authenticate the disposable proof before comparing caller citations or pins.
-    for (const reference of references.filter(({ version }) => batch.includes(version)))
-        if (!selected.retainedEntries.some(({ state }) => principalHeadMatchesReference(state, reference)))
-            throw new KeyingVerificationError("object_mismatch", "Public history citation differs from its verified entry");
-    if (!input.deferCheckpointCheck)
-        verifyPrincipalPolicyCheckpoint({
-            chain: selected.retainedEntries.map((entry) => ({
-                ...entry,
-                projection: [...entry.projection],
-                grants: [...entry.grants],
-            })),
-            currentState: selected.currentEntry.state,
-            localCheckpoint: checkpoint,
-        });
-}
-/** Select bounded proof batches without admitting or advancing durable pins. */
-export async function selectPublicPrincipalHistory(input) {
-    const references = structuredClone(input.references);
-    const checkpoint = input.checkpoint && { ...input.checkpoint };
-    const head = input.recovered.history.currentEntry.state;
-    if (!input.deferCheckpointCheck &&
-        checkpoint &&
-        checkpoint.version > head.version)
-        throw new KeyingVerificationError("missing_dependency", "Public history cannot connect to the newer durable checkpoint");
-    if (references.some((reference) => reference.principalType !== head.principalType ||
-        reference.principalId !== head.principalId ||
-        reference.version > head.version))
-        throw new KeyingVerificationError("object_mismatch", "Public history reference is outside the verified prefix");
-    const versions = [
-        ...new Set([
-            ...(input.includeGenesis ? [1] : []),
-            ...references.map(({ version }) => version),
-            head.version,
-        ]),
-    ];
-    const policies = [];
-    const checkpointReference = await loadCheckpointProof(input, checkpoint && checkpoint.version <= head.version ? checkpoint : null);
-    for (let offset = 0; offset < versions.length; offset += PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT) {
-        const batch = versions.slice(offset, offset + PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT);
-        const selected = await selectBatch(input, batch, checkpointReference).catch((error) => {
-            if (error instanceof KeyingVerificationError)
-                throw new PrincipalHistoryEvidenceUnavailableError(error);
-            throw error;
-        });
-        checkSelectedReferences(input, references, batch, selected, checkpoint);
-        const policy = await selectPrincipalPolicyAuthorization(selected);
-        if (!policy.ok)
-            throw policy.error;
-        policies.push(policy.value);
-    }
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    return policies;
-}
-//# sourceMappingURL=selectPublicPrincipalHistory.js.map

package/workflows/principals/selectPublicPrincipalHistory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"selectPublicPrincipalHistory.js","sourceRoot":"","sources":["selectPublicPrincipalHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAIlC,kCAAkC,EAElC,+BAA+B,EAC/B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAEtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAahG,KAAK,UAAU,WAAW,CACxB,KAAkC,EAClC,QAA2B,EAC3B,mBAAqE;IAErE,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,MAAM,6BAA6B,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,KAAK,CAAC,SAAS;YAClB,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;QAChC,UAAU,EAAE,MAAM;QAClB,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkC,EAClC,UAA4C;IAE5C,IAAI,mBAAqE,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,UAAU;YACZ,mBAAmB,GAAG,MAAM,6BAA6B,CAAC;gBACxD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,KAAK,CAAC,SAAS;gBAClB,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAkC,EAClC,UAA8C,EAC9C,KAAwB,EACxB,QAAiD,EACjD,UAA4C;IAE5C,+EAA+E;IAC/E,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CACxB;QACC,IACE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD;YAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACN,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAC7B,+BAA+B,CAAC;YAC9B,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC9C,GAAG,KAAK;gBACR,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;gBACjC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;aAC1B,CAAC,CAAC;YACH,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;YACzC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;AACP,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAkC;IAElC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;IACxD,IACE,CAAC,KAAK,CAAC,oBAAoB;QAC3B,UAAU;QACV,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;QAEjC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;IACJ,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC9C,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAC1C,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CACnC;QAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC;YAC3C,IAAI,CAAC,OAAO;SACb,CAAC;KACH,CAAC;IACF,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,mBAAmB,GAAG,MAAM,mBAAmB,CACnD,KAAK,EACL,UAAU,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CACrE,CAAC;IACF,KACE,IAAI,MAAM,GAAG,CAAC,EACd,MAAM,GAAG,QAAQ,CAAC,MAAM,EACxB,MAAM,IAAI,kCAAkC,EAC5C,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAC1B,MAAM,EACN,MAAM,GAAG,kCAAkC,CAC5C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC,KAAK,CACzE,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,KAAK,YAAY,uBAAuB;gBAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC,CACF,CAAC;QACF,uBAAuB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryReferenceProof,\n  type ReferencedPrincipalHead,\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoveredPublicPrincipalHistory } from \"./publicPrincipalHistoryTypes\";\n\ninterface PublicHistorySelectionInput {\n  readonly execSql: ExecSql;\n  readonly recovered: RecoveredPublicPrincipalHistory;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly checkpoint: PrincipalPolicyCheckpoint | null;\n  readonly deferCheckpointCheck?: boolean | undefined;\n  readonly includeGenesis?: boolean;\n  readonly stillCurrent: () => boolean;\n}\n\nasync function selectBatch(\n  input: PublicHistorySelectionInput,\n  versions: readonly number[],\n  checkpointReference: PrincipalPolicyHistoryReferenceProof | undefined,\n) {\n  const proofs: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (const version of versions) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    proofs.push(\n      await loadPrincipalHistoryReference({\n        execSql: input.execSql,\n        ...input.recovered,\n        version,\n      }),\n    );\n  }\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history: input.recovered.history,\n    references: proofs,\n    checkpointReference,\n  });\n  if (!selected.ok) throw selected.error;\n  return selected.value;\n}\n\nasync function loadCheckpointProof(\n  input: PublicHistorySelectionInput,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<PrincipalPolicyHistoryReferenceProof | undefined> {\n  let checkpointReference: PrincipalPolicyHistoryReferenceProof | undefined;\n  try {\n    if (checkpoint)\n      checkpointReference = await loadPrincipalHistoryReference({\n        execSql: input.execSql,\n        ...input.recovered,\n        version: checkpoint.version,\n      });\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n  return checkpointReference;\n}\n\nfunction checkSelectedReferences(\n  input: PublicHistorySelectionInput,\n  references: readonly ReferencedPrincipalHead[],\n  batch: readonly number[],\n  selected: Awaited<ReturnType<typeof selectBatch>>,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n) {\n  // Authenticate the disposable proof before comparing caller citations or pins.\n  for (const reference of references.filter(({ version }) =>\n    batch.includes(version),\n  ))\n    if (\n      !selected.retainedEntries.some(({ state }) =>\n        principalHeadMatchesReference(state, reference),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Public history citation differs from its verified entry\",\n      );\n  if (!input.deferCheckpointCheck)\n    verifyPrincipalPolicyCheckpoint({\n      chain: selected.retainedEntries.map((entry) => ({\n        ...entry,\n        projection: [...entry.projection],\n        grants: [...entry.grants],\n      })),\n      currentState: selected.currentEntry.state,\n      localCheckpoint: checkpoint,\n    });\n}\n\n/** Select bounded proof batches without admitting or advancing durable pins. */\nexport async function selectPublicPrincipalHistory(\n  input: PublicHistorySelectionInput,\n): Promise<VerifiedPrincipalPolicySelection[]> {\n  const references = structuredClone(input.references);\n  const checkpoint = input.checkpoint && { ...input.checkpoint };\n  const head = input.recovered.history.currentEntry.state;\n  if (\n    !input.deferCheckpointCheck &&\n    checkpoint &&\n    checkpoint.version > head.version\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Public history cannot connect to the newer durable checkpoint\",\n    );\n  if (\n    references.some(\n      (reference) =>\n        reference.principalType !== head.principalType ||\n        reference.principalId !== head.principalId ||\n        reference.version > head.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Public history reference is outside the verified prefix\",\n    );\n  const versions = [\n    ...new Set([\n      ...(input.includeGenesis ? [1] : []),\n      ...references.map(({ version }) => version),\n      head.version,\n    ]),\n  ];\n  const policies: VerifiedPrincipalPolicySelection[] = [];\n  const checkpointReference = await loadCheckpointProof(\n    input,\n    checkpoint && checkpoint.version <= head.version ? checkpoint : null,\n  );\n  for (\n    let offset = 0;\n    offset < versions.length;\n    offset += PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  ) {\n    const batch = versions.slice(\n      offset,\n      offset + PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n    );\n    const selected = await selectBatch(input, batch, checkpointReference).catch(\n      (error: unknown) => {\n        if (error instanceof KeyingVerificationError)\n          throw new PrincipalHistoryEvidenceUnavailableError(error);\n        throw error;\n      },\n    );\n    checkSelectedReferences(input, references, batch, selected, checkpoint);\n    const policy = await selectPrincipalPolicyAuthorization(selected);\n    if (!policy.ok) throw policy.error;\n    policies.push(policy.value);\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return policies;\n}\n"]}