@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/principals/historyRecovery/recoverPrincipalPolicyHistory.js

@@ -0,0 +1,295 @@
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { preparePrincipalHistoryEvidencePage } from "../../../data/persistence/principalHistoryEvidencePersistence.js";
+import { discardPrincipalHistoryStage, savePrincipalHistoryStage, } from "../../../data/persistence/principalHistoryStagePersistence.js";
+import { ownPrincipalHistoryProtection } from "../../../data/principals/principalHistoryProtection.js";
+import { principalHistoryStageProtection } from "../../../data/principals/principalHistoryStageProtection.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../policyVerification.js";
+import { validatePrincipalHistoryRecoveryAuthority } from "./principalHistoryRecoveryAuthority.js";
+import { publishReusablePrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
+import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "./principalHistoryRecoveryReferences.js";
+import { restorePrincipalHistoryRecoveryStage, } from "./principalHistoryRecoveryStage.js";
+import { PrincipalHistoryRecoveryRaceError, PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
+import { assertPrincipalHistoryVerificationMode, principalHistoryVerificationContext, } from "./principalHistoryRecoveryVerification.js";
+class PrincipalHistoryPrefixDisconnectedError extends Error {
+    verificationError;
+    constructor(verificationError) {
+        super(verificationError.message);
+        this.verificationError = verificationError;
+        this.name = "PrincipalHistoryPrefixDisconnectedError";
+    }
+}
+/** Stored current artifacts of a completed stage failed their signed-history check. */
+class StoredPrincipalCurrentRejectedError extends Error {
+    verificationError;
+    constructor(verificationError) {
+        super(verificationError.message);
+        this.verificationError = verificationError;
+        this.name = "StoredPrincipalCurrentRejectedError";
+    }
+}
+function currentArtifacts(page) {
+    return {
+        currentState: page.currentState,
+        currentPayload: page.currentPayload,
+        currentProjection: page.currentProjection,
+        currentGrants: page.currentGrants,
+        currentMemberEnvelopes: page.currentMemberEnvelopes,
+    };
+}
+function recoveryIsCurrent(input) {
+    return !input.signal?.aborted && input.stillCurrent();
+}
+function assertCurrent(input) {
+    assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));
+}
+function assertExpectedHead(current, expectedHead) {
+    for (const field of [
+        "principalType",
+        "principalId",
+        "version",
+        "stateHash",
+        "keyEpoch",
+        "keyFingerprint",
+    ]) {
+        if (current.currentState[field] !== expectedHead[field])
+            throw new KeyingVerificationError("object_mismatch", "Principal history page does not match its requested head");
+    }
+}
+async function acceptPage(input, stage, response) {
+    const page = structuredClone(response);
+    assertCurrent(input);
+    assertExpectedHead(page, input.expectedHead);
+    if (stage.complete) {
+        if (page.previousStates.length !== 0 ||
+            page.historyPage.nextAfterVersion !== null)
+            throw new KeyingVerificationError("invalid_shape", "Completed history returned additional entries");
+        stage.current = currentArtifacts(page);
+        return;
+    }
+    const complete = page.historyPage.nextAfterVersion === null;
+    const current = currentArtifacts(page);
+    const entries = [...page.previousStates];
+    if (complete)
+        entries.push({
+            state: current.currentState,
+            projection: current.currentProjection,
+            grants: current.currentGrants,
+        });
+    assertPrincipalHistoryVerificationMode(input, entries);
+    const keys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: { ...current, previousStates: page.previousStates },
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in keys)
+        throw new KeyingVerificationError(keys.error === "not-found" ? "missing_dependency" : "signer_mismatch", "Principal history signer identity could not be authenticated");
+    const externalAuthority = await input.loadExternalAuthority?.(entries.flatMap(({ state }) => state.externalAuthority ? [state.externalAuthority] : []));
+    const appended = await stage.verifier.append({
+        entries,
+        signerPublicKeys: keys.signerPublicKeys,
+        ...(externalAuthority ? { externalAuthority } : {}),
+    });
+    if (!appended.ok) {
+        if (appended.error.code === "stale_predecessor")
+            throw new PrincipalHistoryPrefixDisconnectedError(appended.error);
+        throw appended.error;
+    }
+    const next = {
+        id: stage.id,
+        organizationId: input.organizationId,
+        currentJson: JSON.stringify(current),
+        afterVersion: appended.value.throughVersion - (complete ? 1 : 0),
+        complete,
+    };
+    const protectedProgress = await stage.verifier.exportProgress(await principalHistoryStageProtection(input.protection, input.expectedHead, next));
+    if (!protectedProgress.ok)
+        throw protectedProgress.error;
+    const saved = { ...next, progress: protectedProgress.value };
+    await savePrincipalHistoryStage({
+        execSql: input.execSql,
+        stage: saved,
+        evidence: await preparePrincipalHistoryEvidencePage({
+            indexRootHash: appended.value.indexRootHash,
+            scopeId: stage.scopeId,
+            organizationId: input.organizationId,
+            entries,
+            nodes: appended.value.indexNodes,
+        }),
+        previousProgress: stage.saved?.progress ?? null,
+        stillCurrent: () => recoveryIsCurrent(input),
+    });
+    stage.current = current;
+    stage.saved = saved;
+    stage.complete = complete;
+}
+async function finishRecovery(input, stage, checkpoint, storedCurrent) {
+    if (!stage.current || !stage.complete)
+        throw new KeyingVerificationError("missing_dependency", "Principal history ended before its pinned head");
+    const history = stage.verifier.finish(input.expectedHead);
+    if (!history.ok)
+        throw history.error;
+    const selected = await selectRecoveredPrincipalHistory({
+        options: input,
+        scopeId: stage.scopeId,
+        history: history.value,
+        checkpoint,
+    });
+    const current = await verifyPrincipalPolicyCurrent({
+        current: stage.current,
+        history: selected,
+    });
+    if (!current.ok) {
+        if (storedCurrent)
+            throw new StoredPrincipalCurrentRejectedError(current.error);
+        throw current.error;
+    }
+    verifyPrincipalPolicyCheckpoint({
+        chain: current.value.retainedHistory,
+        currentState: current.value.state,
+        localCheckpoint: checkpoint,
+    });
+    const latest = await loadPrincipalPolicyCheckpoint(input.execSql, input.expectedHead.principalType, input.expectedHead.principalId);
+    if (latest?.version !== checkpoint?.version ||
+        latest?.stateHash !== checkpoint?.stateHash)
+        throw new PrincipalHistoryRecoveryRaceError("Local principal checkpoint changed during history recovery");
+    assertCurrent(input);
+    if (!input.offline)
+        await publishReusablePrincipalHistoryPrefix(input, stage.scopeId, stage.verifier, stage.current);
+    assertCurrent(input);
+    return { current: stage.current, policy: current.value };
+}
+function completedStageMatchesHead(stage, expectedHead) {
+    if (!stage.complete || !stage.current)
+        return false;
+    try {
+        assertExpectedHead(stage.current, expectedHead);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Returns whether the stage's current artifacts came from local storage. A
+ * completed stage already authenticates every signed entry through the exact
+ * pinned head, so an online read of that head could only return the pinned
+ * bytes or refuse. Server-current freshness belongs to the caller's discovery.
+ */
+async function readRecoveryPages(input, stage) {
+    if (input.offline) {
+        if (!stage.complete || !stage.current)
+            throw new KeyingVerificationError("missing_dependency", "Completed principal history is unavailable offline");
+        assertExpectedHead(stage.current, input.expectedHead);
+        return true;
+    }
+    if (completedStageMatchesHead(stage, input.expectedHead))
+        return true;
+    let receivedFinalPage = false;
+    for await (const result of input.historyReader.getPrincipalPolicyPages(input.expectedHead.principalType, input.expectedHead.principalId, {
+        signal: input.signal,
+        stateHash: input.expectedHead.stateHash,
+        ...(stage.saved && stage.current
+            ? {
+                resume: {
+                    current: stage.current,
+                    afterVersion: stage.saved.afterVersion,
+                },
+            }
+            : { afterVersion: stage.initialAfterVersion }),
+    })) {
+        if (!result.ok) {
+            // A rejected transport pin cannot justify skipping history on retry.
+            // Discard only this operation's progress, then let a new call replay it.
+            if (result.kind === "shape" && stage.saved)
+                await discardPrincipalHistoryStage(input.execSql, stage.saved, () => recoveryIsCurrent(input));
+            throw new PrincipalPolicyHistoryReadError(result);
+        }
+        await acceptPage(input, stage, result.data);
+        receivedFinalPage = result.data.historyPage.nextAfterVersion === null;
+    }
+    if (!receivedFinalPage)
+        throw new KeyingVerificationError("missing_dependency", "Principal history transport did not complete");
+    return false;
+}
+async function recover(input, allowEvidenceRebuild = true) {
+    assertCurrent(input);
+    const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, input.expectedHead.principalType, input.expectedHead.principalId);
+    if (checkpoint && input.expectedHead.version < checkpoint.version)
+        throw new KeyingVerificationError(input.offline ? "missing_dependency" : "rollback", "Requested principal history predates the local checkpoint");
+    // Validate the requested pin/selection before creating any disposable caches.
+    createPrincipalPolicyHistoryVerifier({
+        principalType: input.expectedHead.principalType,
+        principalId: input.expectedHead.principalId,
+        localCheckpoint: checkpoint,
+        retainedReferences: input.retainedReferences ?? [],
+    });
+    const historyInput = {
+        principalType: input.expectedHead.principalType,
+        principalId: input.expectedHead.principalId,
+    };
+    const stage = await restorePrincipalHistoryRecoveryStage(input, historyInput, allowEvidenceRebuild);
+    try {
+        if (stage.fromCache)
+            await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);
+        const stored = await readRecoveryPages(input, stage);
+        return await finishRecovery(input, stage, checkpoint, stored && !input.offline);
+    }
+    catch (error) {
+        const lostEvidence = error instanceof PrincipalHistoryEvidenceUnavailableError;
+        // Disposable stored artifacts never refuse an online reader: replay them.
+        const disposable = error instanceof PrincipalHistoryPrefixDisconnectedError ||
+            error instanceof StoredPrincipalCurrentRejectedError;
+        if (!lostEvidence && !disposable)
+            throw error;
+        if (stage.saved)
+            await discardPrincipalHistoryStage(input.execSql, stage.saved, () => recoveryIsCurrent(input));
+        if (!input.offline &&
+            allowEvidenceRebuild &&
+            (lostEvidence || stage.fromCache))
+            return recover(input, false);
+        throw error.verificationError;
+    }
+}
+/**
+ * Recover one exact head with bounded retained history and durable checked progress.
+ * The result is a sparse current-policy capability; this does not advance app checkpoints.
+ * Retain organization version 1 when the result will establish founder binding.
+ */
+export function recoverPrincipalPolicyHistory(options) {
+    return recoverPrincipalPolicyHistoryWithVersions(options, []);
+}
+/** Internal bounded display selection; missing proof rows use the normal single rebuild. */
+export async function recoverPrincipalPolicyHistoryWithVersions(options, retainedVersions) {
+    if (!Array.isArray(retainedVersions) ||
+        retainedVersions.length + (options.retainedReferences?.length ?? 0) >
+            PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||
+        retainedVersions.some((version) => !Number.isSafeInteger(version) ||
+            version < 1 ||
+            version > options.expectedHead.version))
+        throw new KeyingVerificationError("invalid_shape", "Principal display history selection exceeds its bounded range");
+    if (options.offline !== undefined && typeof options.offline !== "boolean")
+        throw new KeyingVerificationError("invalid_shape", "Invalid principal history transport mode");
+    if (!options.organizationId ||
+        (options.expectedHead.principalType === "organization" &&
+            options.expectedHead.principalId !== options.organizationId))
+        throw new KeyingVerificationError("object_mismatch", "Principal history organization scope is invalid");
+    if (options.retainedReferences?.some((reference) => reference.version > options.expectedHead.version))
+        throw new KeyingVerificationError("missing_dependency", "Requested history reference is beyond the recovery head");
+    const input = {
+        ...options,
+        historyVerification: options.historyVerification ?? "standard",
+        expectedHead: structuredClone(options.expectedHead),
+        retainedReferences: structuredClone(options.retainedReferences ?? []),
+        retainedVersions: [...retainedVersions],
+        protection: ownPrincipalHistoryProtection(options.protection),
+    };
+    try {
+        input.protection.context = principalHistoryVerificationContext(input);
+        return await recover(input);
+    }
+    finally {
+        input.protection.localKey.fill(0);
+    }
+}
+//# sourceMappingURL=recoverPrincipalPolicyHistory.js.map

package/workflows/principals/historyRecovery/recoverPrincipalPolicyHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,kCAAkC,EAGlC,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,mCAAmC,EAAE,MAAM,+DAA+D,CAAC;AACpH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0DAA0D,CAAC;AAC3G,OAAO,EAAE,sCAAsC,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,uCAAwC,SAAQ,KAAK;IACpC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAC;IACxD,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,mCAAoC,SAAQ,KAAK;IAChC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C;IAE3C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC,EACnC,YAAkE;IAElE,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,sCAAsC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC5B,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,uCAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;YAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAuC,EACvC,KAAoC,EACpC,UAA4C,EAC5C,aAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,aAAa;YACf,MAAM,IAAI,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,+BAA+B,CAAC;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;QACpC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QACjC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,qCAAqC,CACzC,KAAK,EACL,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAoC,EACpC,YAAkE;IAElE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QACH,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAA2C,EAC3C,KAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;YACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,uBAAuB,CACpE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACjD,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAuC,EACvC,oBAAoB,GAAG,IAAI;IAE3B,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,EACjD,2DAA2D,CAC5D,CAAC;IACJ,8EAA8E;IAC9E,oCAAoC,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CACtD,KAAK,EACL,YAAY,EACZ,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,SAAS;YACjB,MAAM,yCAAyC,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,MAAM,cAAc,CACzB,KAAK,EACL,KAAK,EACL,UAAU,EACV,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAChB,KAAK,YAAY,wCAAwC,CAAC;QAC5D,0EAA0E;QAC1E,MAAM,UAAU,GACd,KAAK,YAAY,uCAAuC;YACxD,KAAK,YAAY,mCAAmC,CAAC;QACvD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC;QAC9C,IAAI,KAAK,CAAC,KAAK;YACb,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;QACJ,IACE,CAAC,KAAK,CAAC,OAAO;YACd,oBAAoB;YACpB,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,CAAC;YAEjC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,iBAAiB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA6C;IAE7C,OAAO,yCAAyC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,OAA6C,EAC7C,gBAAmC;IAEnC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAChC,gBAAgB,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;YACjE,kCAAkC;QACpC,gBAAgB,CAAC,IAAI,CACnB,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAC9B,OAAO,GAAG,CAAC;YACX,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CACzC;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,UAAU;QAC9D,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryInput,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n  discardPrincipalHistoryStage,\n  savePrincipalHistoryStage,\n} from \"../../../data/persistence/principalHistoryStagePersistence\";\nimport { ownPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryProtection\";\nimport { principalHistoryStageProtection } from \"../../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../policyVerification\";\nimport { validatePrincipalHistoryRecoveryAuthority } from \"./principalHistoryRecoveryAuthority\";\nimport { publishReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n  PrincipalHistoryEvidenceUnavailableError,\n  type PrincipalHistorySelectionOptions,\n  selectRecoveredPrincipalHistory,\n} from \"./principalHistoryRecoveryReferences\";\nimport {\n  type PrincipalHistoryRecoveryStage,\n  restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n  assertPrincipalHistoryVerificationMode,\n  principalHistoryVerificationContext,\n} from \"./principalHistoryRecoveryVerification\";\n\nclass PrincipalHistoryPrefixDisconnectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PrincipalHistoryPrefixDisconnectedError\";\n  }\n}\n\n/** Stored current artifacts of a completed stage failed their signed-history check. */\nclass StoredPrincipalCurrentRejectedError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"StoredPrincipalCurrentRejectedError\";\n  }\n}\n\nfunction currentArtifacts(\n  page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n  return {\n    currentState: page.currentState,\n    currentPayload: page.currentPayload,\n    currentProjection: page.currentProjection,\n    currentGrants: page.currentGrants,\n    currentMemberEnvelopes: page.currentMemberEnvelopes,\n  };\n}\n\nfunction recoveryIsCurrent(\n  input: RecoverPrincipalPolicyHistoryOptions,\n): boolean {\n  return !input.signal?.aborted && input.stillCurrent();\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n  assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));\n}\n\nfunction assertExpectedHead(\n  current: PrincipalPolicyPageCurrent,\n  expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): void {\n  for (const field of [\n    \"principalType\",\n    \"principalId\",\n    \"version\",\n    \"stateHash\",\n    \"keyEpoch\",\n    \"keyFingerprint\",\n  ] as const) {\n    if (current.currentState[field] !== expectedHead[field])\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Principal history page does not match its requested head\",\n      );\n  }\n}\n\nasync function acceptPage(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  response: PrincipalPolicyPageResponse,\n): Promise<void> {\n  const page = structuredClone(response);\n  assertCurrent(input);\n  assertExpectedHead(page, input.expectedHead);\n  if (stage.complete) {\n    if (\n      page.previousStates.length !== 0 ||\n      page.historyPage.nextAfterVersion !== null\n    )\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Completed history returned additional entries\",\n      );\n    stage.current = currentArtifacts(page);\n    return;\n  }\n  const complete = page.historyPage.nextAfterVersion === null;\n  const current = currentArtifacts(page);\n  const entries = [...page.previousStates];\n  if (complete)\n    entries.push({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n  assertPrincipalHistoryVerificationMode(input, entries);\n  const keys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: { ...current, previousStates: page.previousStates },\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in keys)\n    throw new KeyingVerificationError(\n      keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n      \"Principal history signer identity could not be authenticated\",\n    );\n  const externalAuthority = await input.loadExternalAuthority?.(\n    entries.flatMap(({ state }) =>\n      state.externalAuthority ? [state.externalAuthority] : [],\n    ),\n  );\n  const appended = await stage.verifier.append({\n    entries,\n    signerPublicKeys: keys.signerPublicKeys,\n    ...(externalAuthority ? { externalAuthority } : {}),\n  });\n  if (!appended.ok) {\n    if (appended.error.code === \"stale_predecessor\")\n      throw new PrincipalHistoryPrefixDisconnectedError(appended.error);\n    throw appended.error;\n  }\n  const next = {\n    id: stage.id,\n    organizationId: input.organizationId,\n    currentJson: JSON.stringify(current),\n    afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n    complete,\n  };\n  const protectedProgress = await stage.verifier.exportProgress(\n    await principalHistoryStageProtection(\n      input.protection,\n      input.expectedHead,\n      next,\n    ),\n  );\n  if (!protectedProgress.ok) throw protectedProgress.error;\n  const saved = { ...next, progress: protectedProgress.value };\n  await savePrincipalHistoryStage({\n    execSql: input.execSql,\n    stage: saved,\n    evidence: await preparePrincipalHistoryEvidencePage({\n      indexRootHash: appended.value.indexRootHash,\n      scopeId: stage.scopeId,\n      organizationId: input.organizationId,\n      entries,\n      nodes: appended.value.indexNodes,\n    }),\n    previousProgress: stage.saved?.progress ?? null,\n    stillCurrent: () => recoveryIsCurrent(input),\n  });\n  stage.current = current;\n  stage.saved = saved;\n  stage.complete = complete;\n}\n\nasync function finishRecovery(\n  input: PrincipalHistorySelectionOptions,\n  stage: PrincipalHistoryRecoveryStage,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n  storedCurrent: boolean,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (!stage.current || !stage.complete)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history ended before its pinned head\",\n    );\n  const history = stage.verifier.finish(input.expectedHead);\n  if (!history.ok) throw history.error;\n  const selected = await selectRecoveredPrincipalHistory({\n    options: input,\n    scopeId: stage.scopeId,\n    history: history.value,\n    checkpoint,\n  });\n  const current = await verifyPrincipalPolicyCurrent({\n    current: stage.current,\n    history: selected,\n  });\n  if (!current.ok) {\n    if (storedCurrent)\n      throw new StoredPrincipalCurrentRejectedError(current.error);\n    throw current.error;\n  }\n  verifyPrincipalPolicyCheckpoint({\n    chain: current.value.retainedHistory,\n    currentState: current.value.state,\n    localCheckpoint: checkpoint,\n  });\n  const latest = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (\n    latest?.version !== checkpoint?.version ||\n    latest?.stateHash !== checkpoint?.stateHash\n  )\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Local principal checkpoint changed during history recovery\",\n    );\n  assertCurrent(input);\n  if (!input.offline)\n    await publishReusablePrincipalHistoryPrefix(\n      input,\n      stage.scopeId,\n      stage.verifier,\n      stage.current,\n    );\n  assertCurrent(input);\n  return { current: stage.current, policy: current.value };\n}\n\nfunction completedStageMatchesHead(\n  stage: PrincipalHistoryRecoveryStage,\n  expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): boolean {\n  if (!stage.complete || !stage.current) return false;\n  try {\n    assertExpectedHead(stage.current, expectedHead);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Returns whether the stage's current artifacts came from local storage. A\n * completed stage already authenticates every signed entry through the exact\n * pinned head, so an online read of that head could only return the pinned\n * bytes or refuse. Server-current freshness belongs to the caller's discovery.\n */\nasync function readRecoveryPages(\n  input: RecoverPrincipalPolicyHistoryOptions,\n  stage: PrincipalHistoryRecoveryStage,\n): Promise<boolean> {\n  if (input.offline) {\n    if (!stage.complete || !stage.current)\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Completed principal history is unavailable offline\",\n      );\n    assertExpectedHead(stage.current, input.expectedHead);\n    return true;\n  }\n  if (completedStageMatchesHead(stage, input.expectedHead)) return true;\n  let receivedFinalPage = false;\n  for await (const result of input.historyReader.getPrincipalPolicyPages(\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n    {\n      signal: input.signal,\n      stateHash: input.expectedHead.stateHash,\n      ...(stage.saved && stage.current\n        ? {\n            resume: {\n              current: stage.current,\n              afterVersion: stage.saved.afterVersion,\n            },\n          }\n        : { afterVersion: stage.initialAfterVersion }),\n    },\n  )) {\n    if (!result.ok) {\n      // A rejected transport pin cannot justify skipping history on retry.\n      // Discard only this operation's progress, then let a new call replay it.\n      if (result.kind === \"shape\" && stage.saved)\n        await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n          recoveryIsCurrent(input),\n        );\n      throw new PrincipalPolicyHistoryReadError(result);\n    }\n    await acceptPage(input, stage, result.data);\n    receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n  }\n  if (!receivedFinalPage)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history transport did not complete\",\n    );\n  return false;\n}\n\nasync function recover(\n  input: PrincipalHistorySelectionOptions,\n  allowEvidenceRebuild = true,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  assertCurrent(input);\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.expectedHead.principalType,\n    input.expectedHead.principalId,\n  );\n  if (checkpoint && input.expectedHead.version < checkpoint.version)\n    throw new KeyingVerificationError(\n      input.offline ? \"missing_dependency\" : \"rollback\",\n      \"Requested principal history predates the local checkpoint\",\n    );\n  // Validate the requested pin/selection before creating any disposable caches.\n  createPrincipalPolicyHistoryVerifier({\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n    localCheckpoint: checkpoint,\n    retainedReferences: input.retainedReferences ?? [],\n  });\n  const historyInput: PrincipalPolicyHistoryInput = {\n    principalType: input.expectedHead.principalType,\n    principalId: input.expectedHead.principalId,\n  };\n  const stage = await restorePrincipalHistoryRecoveryStage(\n    input,\n    historyInput,\n    allowEvidenceRebuild,\n  );\n  try {\n    if (stage.fromCache)\n      await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);\n    const stored = await readRecoveryPages(input, stage);\n    return await finishRecovery(\n      input,\n      stage,\n      checkpoint,\n      stored && !input.offline,\n    );\n  } catch (error) {\n    const lostEvidence =\n      error instanceof PrincipalHistoryEvidenceUnavailableError;\n    // Disposable stored artifacts never refuse an online reader: replay them.\n    const disposable =\n      error instanceof PrincipalHistoryPrefixDisconnectedError ||\n      error instanceof StoredPrincipalCurrentRejectedError;\n    if (!lostEvidence && !disposable) throw error;\n    if (stage.saved)\n      await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n        recoveryIsCurrent(input),\n      );\n    if (\n      !input.offline &&\n      allowEvidenceRebuild &&\n      (lostEvidence || stage.fromCache)\n    )\n      return recover(input, false);\n    throw error.verificationError;\n  }\n}\n\n/**\n * Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n * Retain organization version 1 when the result will establish founder binding.\n */\nexport function recoverPrincipalPolicyHistory(\n  options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n  return recoverPrincipalPolicyHistoryWithVersions(options, []);\n}\n\n/** Internal bounded display selection; missing proof rows use the normal single rebuild. */\nexport async function recoverPrincipalPolicyHistoryWithVersions(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  retainedVersions: readonly number[],\n): Promise<RecoveredPrincipalPolicyHistory> {\n  if (\n    !Array.isArray(retainedVersions) ||\n    retainedVersions.length + (options.retainedReferences?.length ?? 0) >\n      PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n    retainedVersions.some(\n      (version) =>\n        !Number.isSafeInteger(version) ||\n        version < 1 ||\n        version > options.expectedHead.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal display history selection exceeds its bounded range\",\n    );\n  if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid principal history transport mode\",\n    );\n  if (\n    !options.organizationId ||\n    (options.expectedHead.principalType === \"organization\" &&\n      options.expectedHead.principalId !== options.organizationId)\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal history organization scope is invalid\",\n    );\n  if (\n    options.retainedReferences?.some(\n      (reference) => reference.version > options.expectedHead.version,\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Requested history reference is beyond the recovery head\",\n    );\n  const input = {\n    ...options,\n    historyVerification: options.historyVerification ?? \"standard\",\n    expectedHead: structuredClone(options.expectedHead),\n    retainedReferences: structuredClone(options.retainedReferences ?? []),\n    retainedVersions: [...retainedVersions],\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    input.protection.context = principalHistoryVerificationContext(input);\n    return await recover(input);\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n"]}

package/workflows/principals/historyRecovery/recoverScopedPrincipalPolicyHistory.d.ts

@@ -0,0 +1,27 @@
+import { type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../../internal/crypto/index.js";
+import { type PrincipalRecoveryContext } from "../recoveryOperation/principalRecoveryDirectory.js";
+import { type PrincipalRecoveryMemo } from "../recoveryOperation/principalRecoveryMemo.js";
+import type { RecoveredPrincipalHistoryPage } from "./loadRecoveredPrincipalHistoryPage.js";
+import { type RecoveredPrincipalPolicyHistory } from "./principalHistoryRecoveryTypes.js";
+export interface RecoverScopedPrincipalPolicyHistoryOptions extends PrincipalRecoveryContext {
+    readonly reference: ReferencedPrincipalHead;
+    /** Optional bounded display history ending before this exclusive version. */
+    readonly historyPage?: {
+        readonly beforeVersion?: number;
+    } | undefined;
+}
+export interface RecoveredScopedPrincipalPolicyHistory extends RecoveredPrincipalPolicyHistory {
+    /** Submit these with policy when atomically admitting its organization scope. */
+    readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];
+    readonly historyPage?: RecoveredPrincipalHistoryPage | undefined;
+}
+/** Internal result: valid only while every evidence producer behind it is. */
+export interface ScopedPrincipalPolicyRecovery extends RecoveredScopedPrincipalPolicyHistory {
+    readonly stillCurrent: () => boolean;
+}
+export type ScopedPrincipalPolicyRecoveryBatch = (options: RecoverScopedPrincipalPolicyHistoryOptions) => Promise<ScopedPrincipalPolicyRecovery>;
+export declare function recoverScopedPrincipalPolicyHistory(options: RecoverScopedPrincipalPolicyHistoryOptions): Promise<RecoveredScopedPrincipalPolicyHistory>;
+/** Internal unbatched recovery that keeps its result's lifetime. */
+export declare const recoverLeasedScopedPrincipalPolicyHistory: ScopedPrincipalPolicyRecoveryBatch;
+/** Internal runtime batch: shared results never outlive its operation or caller. */
+export declare function createScopedPrincipalPolicyHistoryBatch(memo?: PrincipalRecoveryMemo): ScopedPrincipalPolicyRecoveryBatch;

package/workflows/principals/historyRecovery/recoverScopedPrincipalPolicyHistory.js

@@ -0,0 +1,163 @@
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { ownPrincipalHistoryProtection } from "../../../data/principals/principalHistoryProtection.js";
+import { directoryHistoryProtection, scopedGroupHistoryProtection, } from "../../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { PrincipalRecoveryDirectoryAdvanced, } from "../recoveryOperation/principalRecoveryDirectory.js";
+import { createPrincipalRecoveryReader, } from "../recoveryOperation/principalRecoveryMemo.js";
+import { PrincipalHistoryRecoveryRaceError, } from "./principalHistoryRecoveryTypes.js";
+import { recoverPrincipalHistoryPage } from "./recoverPrincipalHistoryPage.js";
+import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+function groupHead(directory, principalId) {
+    const head = directory.descriptor.groupHeads.find((entry) => entry.principalId === principalId);
+    if (!head)
+        throw new KeyingVerificationError("missing_dependency", "Group is absent from the signed organization directory");
+    return head;
+}
+function authorityHead(state) {
+    return {
+        principalType: "group",
+        principalId: state.principalId,
+        version: state.version,
+        stateHash: state.stateHash,
+        keyEpoch: state.keyEpoch,
+        keyFingerprint: state.keyFingerprint,
+    };
+}
+async function recoverScopedPolicy(input, memo) {
+    if (input.reference.principalType === "organization" &&
+        input.reference.principalId !== input.organizationId)
+        throw new KeyingVerificationError("object_mismatch", "Requested organization policy is outside its scope");
+    const read = createPrincipalRecoveryReader(input, memo);
+    // Reused or derived evidence keeps its producers' lifetimes to its use.
+    const stillCurrent = () => !input.signal?.aborted && input.stillCurrent() && read.stillCurrent();
+    const directory = await read.directory(input.reference.principalType === "organization" ? [input.reference] : []);
+    if (input.reference.principalType === "organization")
+        return {
+            current: directory.current,
+            policy: directory.policy,
+            dependencies: [],
+            stillCurrent,
+            ...(await selectDisplayHistory(input, {
+                ...input,
+                expectedHead: principalPolicyReferenceFromBundle(directory.current),
+                protection: directoryHistoryProtection(input.protection),
+            })),
+        };
+    const expectedHead = groupHead(directory, input.reference.principalId);
+    if (input.reference.version > expectedHead.version)
+        throw new PrincipalRecoveryDirectoryAdvanced();
+    const adminHead = groupHead(directory, directory.descriptor.adminGroupId);
+    const isAdmins = expectedHead.principalId === adminHead.principalId;
+    let admins = null;
+    if (!isAdmins) {
+        admins = (await read.admins(adminHead)).policy;
+    }
+    const loadExternalAuthority = async (citations) => {
+        const references = new Map();
+        for (const citation of citations) {
+            if (citation.principalId !== adminHead.principalId)
+                throw new KeyingVerificationError("object_mismatch", "Group cites another organization's Admins authority");
+            if (citation.version > adminHead.version)
+                throw new PrincipalRecoveryDirectoryAdvanced();
+            references.set(`${citation.version}:${citation.stateHash}`, citation);
+        }
+        if (!references.size)
+            return undefined;
+        const recovered = await read.admins(adminHead, [...references.values()]);
+        return {
+            currentHead: adminHead,
+            states: recovered.policy.retainedHistory.map(({ state, projection }) => ({
+                head: authorityHead(state),
+                projection,
+            })),
+        };
+    };
+    const recoveryOptions = {
+        ...input,
+        expectedHead,
+        retainedReferences: [input.reference],
+        historyVerification: isAdmins ? "direct-admins" : "standard",
+        ...(isAdmins
+            ? {}
+            : {
+                protection: scopedGroupHistoryProtection(input.protection, input.organizationId, adminHead.principalId),
+            }),
+        ...(isAdmins ? {} : { loadExternalAuthority }),
+    };
+    const recovered = isAdmins
+        ? await read.admins(expectedHead, [input.reference])
+        : await recoverPrincipalPolicyHistory(recoveryOptions);
+    return {
+        ...recovered,
+        dependencies: admins ? [directory.policy, admins] : [directory.policy],
+        stillCurrent,
+        ...(await selectDisplayHistory(input, recoveryOptions)),
+    };
+}
+/** Recover signed directory and strict Admins dependencies without full histories. */
+async function recoverScopedPrincipalPolicyHistoryInBatch(options, memo) {
+    if (options.offline !== undefined && typeof options.offline !== "boolean")
+        throw new KeyingVerificationError("invalid_shape", "Invalid principal history transport mode");
+    if (!options.organizationId)
+        throw new KeyingVerificationError("object_mismatch", "Principal recovery requires an organization scope");
+    const input = {
+        historyReader: options.historyReader,
+        execSql: options.execSql,
+        organizationId: options.organizationId,
+        offline: options.offline,
+        resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,
+        signal: options.signal,
+        stillCurrent: options.stillCurrent,
+        reference: structuredClone(options.reference),
+        historyPage: options.historyPage ? { ...options.historyPage } : undefined,
+        protection: ownPrincipalHistoryProtection(options.protection),
+    };
+    try {
+        // Reject malformed exact citations before any discovery or disposable writes.
+        createPrincipalPolicyHistoryVerifier({
+            principalId: input.reference.principalId,
+            principalType: input.reference.principalType,
+            retainedReferences: [input.reference],
+        });
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                const recovered = await recoverScopedPolicy(input, memo);
+                assertProjectionVerificationCurrent(recovered.stillCurrent);
+                return recovered;
+            }
+            catch (error) {
+                if (!(error instanceof PrincipalRecoveryDirectoryAdvanced))
+                    throw error;
+                memo?.directories.clear();
+                memo?.admins.clear();
+                if (input.offline)
+                    throw new KeyingVerificationError("missing_dependency", "Requested principal evidence is newer than the offline directory");
+            }
+        }
+        throw new PrincipalHistoryRecoveryRaceError("Organization directory remains behind the requested policy evidence");
+    }
+    finally {
+        input.protection.localKey.fill(0);
+    }
+}
+export function recoverScopedPrincipalPolicyHistory(options) {
+    return recoverScopedPrincipalPolicyHistoryInBatch(options);
+}
+/** Internal unbatched recovery that keeps its result's lifetime. */
+export const recoverLeasedScopedPrincipalPolicyHistory = (options) => recoverScopedPrincipalPolicyHistoryInBatch(options);
+async function selectDisplayHistory(input, options) {
+    if (!input.historyPage)
+        return {};
+    return {
+        historyPage: await recoverPrincipalHistoryPage(options, input.historyPage.beforeVersion ?? input.reference.version + 1),
+    };
+}
+/** Internal runtime batch: shared results never outlive its operation or caller. */
+export function createScopedPrincipalPolicyHistoryBatch(memo = {
+    directories: new Map(),
+    admins: new Map(),
+}) {
+    return (options) => recoverScopedPrincipalPolicyHistoryInBatch(options, memo);
+}
+//# sourceMappingURL=recoverScopedPrincipalPolicyHistory.js.map

package/workflows/principals/historyRecovery/recoverScopedPrincipalPolicyHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoverScopedPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverScopedPrincipalPolicyHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAEL,kCAAkC,GAEnC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,6BAA6B,GAE9B,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,iCAAiC,GAGlC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AA0BhF,SAAS,SAAS,CAAC,SAAmC,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAC7C,CAAC;IACF,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO;QACL,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAiD,EACjD,IAA4B;IAE5B,IACE,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAChD,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;QAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,oDAAoD,CACrD,CAAC;IACJ,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxD,wEAAwE;IACxE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAClD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,YAAY,EAAE,EAAE;YAChB,YAAY;YACZ,GAAG,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE;gBACpC,GAAG,KAAK;gBACR,YAAY,EAAE,kCAAkC,CAAC,SAAS,CAAC,OAAO,CAAC;gBACnE,UAAU,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;aACzD,CAAC,CAAC;SACJ,CAAC;IACJ,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO;QAChD,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAAC;IACpE,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,CAAC;IACD,MAAM,qBAAqB,GAAG,KAAK,EACjC,SAA6C,EACU,EAAE;QACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;gBAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;YACJ,IAAI,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO;gBACtC,MAAM,IAAI,kCAAkC,EAAE,CAAC;YACjD,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO;YACL,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC1B,UAAU;aACX,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,eAAe,GAAyC;QAC5D,GAAG,KAAK;QACR,YAAY;QACZ,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACrC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU;QAC5D,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,UAAU,EAAE,4BAA4B,CACtC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,SAAS,CAAC,WAAW,CACtB;aACF,CAAC;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;KAC/C,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC,CAAC,MAAM,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACzD,OAAO;QACL,GAAG,SAAS;QACZ,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QACtE,YAAY;QACZ,GAAG,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,0CAA0C,CACvD,OAAmD,EACnD,IAA4B;IAE5B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,cAAc;QACzB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,8EAA8E;QAC9E,oCAAoC,CAAC;YACnC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YACxC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;YAC5C,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SACtC,CAAC,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzD,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC5D,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kCAAkC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,KAAK,CAAC,OAAO;oBACf,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,kEAAkE,CACnE,CAAC;YACN,CAAC;QACH,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAAmD;IAEnD,OAAO,0CAA0C,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,yCAAyC,GACpD,CAAC,OAAO,EAAE,EAAE,CAAC,0CAA0C,CAAC,OAAO,CAAC,CAAC;AAEnE,KAAK,UAAU,oBAAoB,CACjC,KAAiD,EACjD,OAA6C;IAE7C,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO;QACL,WAAW,EAAE,MAAM,2BAA2B,CAC5C,OAAO,EACP,KAAK,CAAC,WAAW,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAC/D;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uCAAuC,CACrD,OAA8B;IAC5B,WAAW,EAAE,IAAI,GAAG,EAAE;IACtB,MAAM,EAAE,IAAI,GAAG,EAAE;CAClB;IAED,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,0CAA0C,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import {\n  createPrincipalPolicyHistoryVerifier,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { ownPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryProtection\";\nimport {\n  directoryHistoryProtection,\n  scopedGroupHistoryProtection,\n} from \"../../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport {\n  type PrincipalRecoveryContext,\n  PrincipalRecoveryDirectoryAdvanced,\n  type RecoveredPolicyDirectory,\n} from \"../recoveryOperation/principalRecoveryDirectory\";\nimport {\n  createPrincipalRecoveryReader,\n  type PrincipalRecoveryMemo,\n} from \"../recoveryOperation/principalRecoveryMemo\";\nimport type { RecoveredPrincipalHistoryPage } from \"./loadRecoveredPrincipalHistoryPage\";\nimport {\n  PrincipalHistoryRecoveryRaceError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { recoverPrincipalHistoryPage } from \"./recoverPrincipalHistoryPage\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport interface RecoverScopedPrincipalPolicyHistoryOptions\n  extends PrincipalRecoveryContext {\n  readonly reference: ReferencedPrincipalHead;\n  /** Optional bounded display history ending before this exclusive version. */\n  readonly historyPage?: { readonly beforeVersion?: number } | undefined;\n}\n\nexport interface RecoveredScopedPrincipalPolicyHistory\n  extends RecoveredPrincipalPolicyHistory {\n  /** Submit these with policy when atomically admitting its organization scope. */\n  readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n  readonly historyPage?: RecoveredPrincipalHistoryPage | undefined;\n}\n\n/** Internal result: valid only while every evidence producer behind it is. */\nexport interface ScopedPrincipalPolicyRecovery\n  extends RecoveredScopedPrincipalPolicyHistory {\n  readonly stillCurrent: () => boolean;\n}\n\nexport type ScopedPrincipalPolicyRecoveryBatch = (\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n) => Promise<ScopedPrincipalPolicyRecovery>;\n\nfunction groupHead(directory: RecoveredPolicyDirectory, principalId: string) {\n  const head = directory.descriptor.groupHeads.find(\n    (entry) => entry.principalId === principalId,\n  );\n  if (!head)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Group is absent from the signed organization directory\",\n    );\n  return head;\n}\n\nfunction authorityHead(state: ReferencedPrincipalHead) {\n  return {\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    stateHash: state.stateHash,\n    keyEpoch: state.keyEpoch,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nasync function recoverScopedPolicy(\n  input: RecoverScopedPrincipalPolicyHistoryOptions,\n  memo?: PrincipalRecoveryMemo,\n): Promise<ScopedPrincipalPolicyRecovery> {\n  if (\n    input.reference.principalType === \"organization\" &&\n    input.reference.principalId !== input.organizationId\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Requested organization policy is outside its scope\",\n    );\n  const read = createPrincipalRecoveryReader(input, memo);\n  // Reused or derived evidence keeps its producers' lifetimes to its use.\n  const stillCurrent = () =>\n    !input.signal?.aborted && input.stillCurrent() && read.stillCurrent();\n  const directory = await read.directory(\n    input.reference.principalType === \"organization\" ? [input.reference] : [],\n  );\n  if (input.reference.principalType === \"organization\")\n    return {\n      current: directory.current,\n      policy: directory.policy,\n      dependencies: [],\n      stillCurrent,\n      ...(await selectDisplayHistory(input, {\n        ...input,\n        expectedHead: principalPolicyReferenceFromBundle(directory.current),\n        protection: directoryHistoryProtection(input.protection),\n      })),\n    };\n  const expectedHead = groupHead(directory, input.reference.principalId);\n  if (input.reference.version > expectedHead.version)\n    throw new PrincipalRecoveryDirectoryAdvanced();\n  const adminHead = groupHead(directory, directory.descriptor.adminGroupId);\n  const isAdmins = expectedHead.principalId === adminHead.principalId;\n  let admins: VerifiedPrincipalPolicyCurrent | null = null;\n  if (!isAdmins) {\n    admins = (await read.admins(adminHead)).policy;\n  }\n  const loadExternalAuthority = async (\n    citations: readonly ReferencedPrincipalHead[],\n  ): Promise<PrincipalPolicyExternalAuthority | undefined> => {\n    const references = new Map<string, ReferencedPrincipalHead>();\n    for (const citation of citations) {\n      if (citation.principalId !== adminHead.principalId)\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Group cites another organization's Admins authority\",\n        );\n      if (citation.version > adminHead.version)\n        throw new PrincipalRecoveryDirectoryAdvanced();\n      references.set(`${citation.version}:${citation.stateHash}`, citation);\n    }\n    if (!references.size) return undefined;\n    const recovered = await read.admins(adminHead, [...references.values()]);\n    return {\n      currentHead: adminHead,\n      states: recovered.policy.retainedHistory.map(({ state, projection }) => ({\n        head: authorityHead(state),\n        projection,\n      })),\n    };\n  };\n  const recoveryOptions: RecoverPrincipalPolicyHistoryOptions = {\n    ...input,\n    expectedHead,\n    retainedReferences: [input.reference],\n    historyVerification: isAdmins ? \"direct-admins\" : \"standard\",\n    ...(isAdmins\n      ? {}\n      : {\n          protection: scopedGroupHistoryProtection(\n            input.protection,\n            input.organizationId,\n            adminHead.principalId,\n          ),\n        }),\n    ...(isAdmins ? {} : { loadExternalAuthority }),\n  };\n  const recovered = isAdmins\n    ? await read.admins(expectedHead, [input.reference])\n    : await recoverPrincipalPolicyHistory(recoveryOptions);\n  return {\n    ...recovered,\n    dependencies: admins ? [directory.policy, admins] : [directory.policy],\n    stillCurrent,\n    ...(await selectDisplayHistory(input, recoveryOptions)),\n  };\n}\n\n/** Recover signed directory and strict Admins dependencies without full histories. */\nasync function recoverScopedPrincipalPolicyHistoryInBatch(\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n  memo?: PrincipalRecoveryMemo,\n): Promise<ScopedPrincipalPolicyRecovery> {\n  if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Invalid principal history transport mode\",\n    );\n  if (!options.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Principal recovery requires an organization scope\",\n    );\n  const input = {\n    historyReader: options.historyReader,\n    execSql: options.execSql,\n    organizationId: options.organizationId,\n    offline: options.offline,\n    resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,\n    signal: options.signal,\n    stillCurrent: options.stillCurrent,\n    reference: structuredClone(options.reference),\n    historyPage: options.historyPage ? { ...options.historyPage } : undefined,\n    protection: ownPrincipalHistoryProtection(options.protection),\n  };\n  try {\n    // Reject malformed exact citations before any discovery or disposable writes.\n    createPrincipalPolicyHistoryVerifier({\n      principalId: input.reference.principalId,\n      principalType: input.reference.principalType,\n      retainedReferences: [input.reference],\n    });\n    for (let attempt = 0; attempt < 2; attempt += 1) {\n      try {\n        const recovered = await recoverScopedPolicy(input, memo);\n        assertProjectionVerificationCurrent(recovered.stillCurrent);\n        return recovered;\n      } catch (error) {\n        if (!(error instanceof PrincipalRecoveryDirectoryAdvanced)) throw error;\n        memo?.directories.clear();\n        memo?.admins.clear();\n        if (input.offline)\n          throw new KeyingVerificationError(\n            \"missing_dependency\",\n            \"Requested principal evidence is newer than the offline directory\",\n          );\n      }\n    }\n    throw new PrincipalHistoryRecoveryRaceError(\n      \"Organization directory remains behind the requested policy evidence\",\n    );\n  } finally {\n    input.protection.localKey.fill(0);\n  }\n}\n\nexport function recoverScopedPrincipalPolicyHistory(\n  options: RecoverScopedPrincipalPolicyHistoryOptions,\n): Promise<RecoveredScopedPrincipalPolicyHistory> {\n  return recoverScopedPrincipalPolicyHistoryInBatch(options);\n}\n\n/** Internal unbatched recovery that keeps its result's lifetime. */\nexport const recoverLeasedScopedPrincipalPolicyHistory: ScopedPrincipalPolicyRecoveryBatch =\n  (options) => recoverScopedPrincipalPolicyHistoryInBatch(options);\n\nasync function selectDisplayHistory(\n  input: RecoverScopedPrincipalPolicyHistoryOptions,\n  options: RecoverPrincipalPolicyHistoryOptions,\n) {\n  if (!input.historyPage) return {};\n  return {\n    historyPage: await recoverPrincipalHistoryPage(\n      options,\n      input.historyPage.beforeVersion ?? input.reference.version + 1,\n    ),\n  };\n}\n\n/** Internal runtime batch: shared results never outlive its operation or caller. */\nexport function createScopedPrincipalPolicyHistoryBatch(\n  memo: PrincipalRecoveryMemo = {\n    directories: new Map(),\n    admins: new Map(),\n  },\n): ScopedPrincipalPolicyRecoveryBatch {\n  return (options) => recoverScopedPrincipalPolicyHistoryInBatch(options, memo);\n}\n"]}

package/workflows/principals/index.d.ts

@@ -1,7 +1,7 @@
 export type { PrincipalHistoryProtectionLease } from "../../data/principals/principalHistoryProtection.js";
-export { type AcknowledgedPrincipalPredecessor, captureAcknowledgedPrincipalPredecessor, } from "./acknowledgedPrincipalPredecessor.js";
-export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
-export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./principalHistoryRecoveryTypes.js";
-export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
-export { type ProjectionPolicyHistoryRecoveryOptions, recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
-export { type RecoveredScopedPrincipalPolicyHistory, type RecoverScopedPrincipalPolicyHistoryOptions, recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
+export { type AcknowledgedPrincipalPredecessor, captureAcknowledgedPrincipalPredecessor, } from "./acknowledgements/acknowledgedPrincipalPredecessor.js";
+export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./historyRecovery/principalHistoryRecoveryTypes.js";
+export { recoverPrincipalPolicyHistory } from "./historyRecovery/recoverPrincipalPolicyHistory.js";
+export { type RecoveredScopedPrincipalPolicyHistory, type RecoverScopedPrincipalPolicyHistoryOptions, recoverScopedPrincipalPolicyHistory, } from "./historyRecovery/recoverScopedPrincipalPolicyHistory.js";
+export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache/index.js";
+export { type ProjectionPolicyHistoryRecoveryOptions, recoverProjectionPolicyHistory, } from "./publicHistory/recoverProjectionPolicyHistory.js";

package/workflows/principals/index.js

@@ -1,7 +1,7 @@
-export { captureAcknowledgedPrincipalPredecessor, } from "./acknowledgedPrincipalPredecessor.js";
-export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
-export { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
-export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
-export { recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
-export { recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
+export { captureAcknowledgedPrincipalPredecessor, } from "./acknowledgements/acknowledgedPrincipalPredecessor.js";
+export { PrincipalPolicyHistoryReadError, } from "./historyRecovery/principalHistoryRecoveryTypes.js";
+export { recoverPrincipalPolicyHistory } from "./historyRecovery/recoverPrincipalPolicyHistory.js";
+export { recoverScopedPrincipalPolicyHistory, } from "./historyRecovery/recoverScopedPrincipalPolicyHistory.js";
+export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache/index.js";
+export { recoverProjectionPolicyHistory, } from "./publicHistory/recoverProjectionPolicyHistory.js";
 //# sourceMappingURL=index.js.map

package/workflows/principals/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,uCAAuC,GACxC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC","sourcesContent":["export type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nexport {\n  type AcknowledgedPrincipalPredecessor,\n  captureAcknowledgedPrincipalPredecessor,\n} from \"./acknowledgedPrincipalPredecessor\";\nexport {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\nexport {\n  type ProjectionPolicyHistoryRecoveryOptions,\n  recoverProjectionPolicyHistory,\n} from \"./recoverProjectionPolicyHistory\";\nexport {\n  type RecoveredScopedPrincipalPolicyHistory,\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,uCAAuC,GACxC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,+BAA+B,GAGhC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,EAGL,mCAAmC,GACpC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC","sourcesContent":["export type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nexport {\n  type AcknowledgedPrincipalPredecessor,\n  captureAcknowledgedPrincipalPredecessor,\n} from \"./acknowledgements/acknowledgedPrincipalPredecessor\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./historyRecovery/principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./historyRecovery/recoverPrincipalPolicyHistory\";\nexport {\n  type RecoveredScopedPrincipalPolicyHistory,\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./historyRecovery/recoverScopedPrincipalPolicyHistory\";\nexport {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  type ProjectionPolicyHistoryRecoveryOptions,\n  recoverProjectionPolicyHistory,\n} from \"./publicHistory/recoverProjectionPolicyHistory\";\n"]}