npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.63 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (653) hide show

package/workflows/principals/{principalAcknowledgementChecks.d.ts → acknowledgements/principalAcknowledgementChecks.d.ts} RENAMED Viewed

@@ -1,6 +1,6 @@
-import type { PrincipalPolicyExternalAuthority, PrincipalPolicySignerPublicKey, ReferencedPrincipalHead, VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
-import type { PutPrincipalPolicyRequest } from "../../internal/validators/request/index.js";
-import type { PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
+import type { PrincipalPolicyExternalAuthority, PrincipalPolicySignerPublicKey, ReferencedPrincipalHead, VerifiedPrincipalPolicyCurrent } from "../../../internal/crypto/index.js";
+import type { PutPrincipalPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { PrincipalPolicyMutationResponse } from "../../../internal/validators/response/index.js";
 /**
  * The checks the code that authored a principal mutation makes on the
  * server's acknowledgement of it. Recovery records an acknowledged current

package/workflows/principals/{principalCurrentPublicationSeal.js → acknowledgements/principalCurrentPublicationSeal.js} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
-import { principalHistoryPrefixProtection } from "../../data/principals/principalHistoryPrefixProtection.js";
-import { principalHistoryStageId, principalHistoryStageProtection, } from "../../data/principals/principalHistoryStageProtection.js";
+import { serializeKeyingCanonicalJson, } from "../../../internal/crypto/index.js";
+import { principalHistoryPrefixProtection } from "../../../data/principals/principalHistoryPrefixProtection.js";
+import { principalHistoryStageId, principalHistoryStageProtection, } from "../../../data/principals/principalHistoryStageProtection.js";
 function exactHead(head) {
     return {
         principalType: head.principalType,

package/workflows/principals/acknowledgements/principalCurrentPublicationSeal.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalCurrentPublicationSeal.js","sourceRoot":"","sources":["principalCurrentPublicationSeal.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,0DAA0D,CAAC;AAGlE,SAAS,SAAS,CAAC,IAA6B;IAC9C,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA6C,EAC7C,YAAqC,EACrC,QAAwC,EACxC,QAAoC;IAEpC,+EAA+E;IAC/E,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;KACxD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,MAAM,uBAAuB,CAC/B,OAAO,CAAC,cAAc,EACtB,YAAY,EACZ,OAAO,CAAC,UAAU,CAAC,OAAO,CAC3B;QACD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC;QACtC,QAAQ,EAAE,IAAI;QACd,WAAW;KACZ,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC5C,MAAM,+BAA+B,CACnC,OAAO,CAAC,UAAU,EAClB,YAAY,EACZ,KAAK,CACN,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAA6C,EAC7C,OAAe,EACf,YAAqC,EACrC,QAAwC,EACxC,QAAoC;IAEpC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAC3C,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;IACF,MAAM,MAAM,GAAG;QACb,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,QAAQ,EAAE,4BAA4B,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC5C,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CACnE,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n type PrincipalPolicyHistoryVerifier,\n type ReferencedPrincipalHead,\n serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { principalHistoryPrefixProtection } from \"../../../data/principals/principalHistoryPrefixProtection\";\nimport {\n principalHistoryStageId,\n principalHistoryStageProtection,\n} from \"../../../data/principals/principalHistoryStageProtection\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"../historyRecovery/principalHistoryRecoveryTypes\";\n\nfunction exactHead(head: ReferencedPrincipalHead): ReferencedPrincipalHead {\n return {\n principalType: head.principalType,\n principalId: head.principalId,\n version: head.version,\n keyEpoch: head.keyEpoch,\n stateHash: head.stateHash,\n keyFingerprint: head.keyFingerprint,\n };\n}\n\nexport async function sealPrincipalCurrentStage(\n options: RecoverPrincipalPolicyHistoryOptions,\n expectedHead: ReferencedPrincipalHead,\n verifier: PrincipalPolicyHistoryVerifier,\n response: PrincipalPolicyPageCurrent,\n) {\n // Authentication uses the reference contract, never extra signed-state fields.\n expectedHead = exactHead(expectedHead);\n const currentJson = JSON.stringify({\n currentState: response.currentState,\n currentProjection: response.currentProjection,\n currentGrants: response.currentGrants,\n currentPayload: response.currentPayload,\n currentMemberEnvelopes: response.currentMemberEnvelopes,\n });\n const stage = {\n id: await principalHistoryStageId(\n options.organizationId,\n expectedHead,\n options.protection.context,\n ),\n organizationId: options.organizationId,\n afterVersion: expectedHead.version - 1,\n complete: true,\n currentJson,\n };\n const progress = await verifier.exportProgress(\n await principalHistoryStageProtection(\n options.protection,\n expectedHead,\n stage,\n ),\n );\n if (!progress.ok) throw progress.error;\n return { ...stage, progress: progress.value };\n}\n\nexport async function sealPrincipalCurrentPublication(\n options: RecoverPrincipalPolicyHistoryOptions,\n scopeId: string,\n expectedHead: ReferencedPrincipalHead,\n verifier: PrincipalPolicyHistoryVerifier,\n response: PrincipalPolicyPageCurrent,\n) {\n expectedHead = exactHead(expectedHead);\n const stage = await sealPrincipalCurrentStage(\n options,\n expectedHead,\n verifier,\n response,\n );\n const prefix = {\n scopeId,\n organizationId: options.organizationId,\n version: expectedHead.version,\n headJson: serializeKeyingCanonicalJson({ ...expectedHead }),\n currentJson: stage.currentJson,\n };\n const progress = await verifier.exportProgress(\n await principalHistoryPrefixProtection(options.protection, prefix),\n );\n if (!progress.ok) throw progress.error;\n return { prefix: { ...prefix, progress: progress.value }, stage };\n}\n"]}

package/workflows/principals/{reconcileAcknowledgedPrincipalCurrent.js → acknowledgements/reconcileAcknowledgedPrincipalCurrent.js} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { KeyingVerificationError, verifyPrincipalPolicyCurrent, } from "../../internal/crypto/index.js";
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { loadPrincipalHistoryPrefix } from "../../data/persistence/principalHistoryPrefixPersistence.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { KeyingVerificationError, verifyPrincipalPolicyCurrent, } from "../../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalHistoryPrefix } from "../../../data/persistence/principalHistoryPrefixPersistence.js";
+import { principalHeadMatchesReference } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "../historyRecovery/principalHistoryRecoveryReferences.js";
+import { principalHistoryVerificationContext } from "../historyRecovery/principalHistoryRecoveryVerification.js";
 import { restoreAcknowledgedPrincipalPrefix } from "./acknowledgedPrincipalPredecessor.js";
-import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "./principalHistoryRecoveryReferences.js";
-import { principalHistoryVerificationContext } from "./principalHistoryRecoveryVerification.js";
 /** Only the receipt is proven; a newer local pin needs scoped history covering it. */
 function reconcileReceiptOnly(publication, observedPrefixProgress, checkpoint) {
     // Other verified evidence, such as a document purge proof, can pin a newer

package/workflows/principals/acknowledgements/reconcileAcknowledgedPrincipalCurrent.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"reconcileAcknowledgedPrincipalCurrent.js","sourceRoot":"","sources":["reconcileAcknowledgedPrincipalCurrent.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAKtG,OAAO,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAE/D,OAAO,EAAE,mCAAmC,EAAE,MAAM,yDAAyD,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AAExF,sFAAsF;AACtF,SAAS,oBAAoB,CAC3B,WAAoD,EACpD,sBAAqC,EACrC,UAA4C;IAE5C,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,IACE,WAAW,CAAC,gBAAgB;QAC5B,UAAU;QACV,UAAU,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO;QAE/C,MAAM,IAAI,wCAAwC,CAChD,IAAI,uBAAuB,CACzB,oBAAoB,EACpB,8DAA8D,CAC/D,CACF,CAAC;IACJ,OAAO;QACL,GAAG,WAAW;QACd,cAAc,EAAE,KAAK;QACrB,sBAAsB;QACtB,kBAAkB,EAAE,UAAU;QAC9B,cAAc,EAAE,WAAW,CAAC,MAAM;QAClC,gBAAgB,EAAE,WAAW,CAAC,MAAM;KACrC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAA2C,EAC3C,WAAoD;IAEpD,MAAM,OAAO,GAAG;QACd,GAAG,KAAK;QACR,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,UAAU;YACnB,OAAO,EAAE,mCAAmC,CAAC,KAAK,CAAC;SACpD;KACF,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,WAAW,CAAC,MAAM,CAAC,aAAa,EAChC,WAAW,CAAC,MAAM,CAAC,WAAW,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAC5C,OAAO,CAAC,OAAO,EACf,WAAW,CAAC,MAAM,CAAC,OAAO,CAC3B,CAAC;IACF,MAAM,sBAAsB,GAAG,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC;IACvD,IAAI,sBAAsB,KAAK,WAAW,CAAC,sBAAsB;QAC/D,OAAO,oBAAoB,CACzB,WAAW,EACX,sBAAsB,EACtB,UAAU,CACX,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3D,IACE,CAAC,6BAA6B,CAC5B,QAAQ,CAAC,QAAQ,CAAC,KAAK,EACvB,OAAO,CAAC,YAAY,CACrB;YAED,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,kEAAkE,CACnE,CAAC;QACJ,OAAO,oBAAoB,CACzB,WAAW,EACX,sBAAsB,EACtB,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;QACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,OAAO,EAAE,QAAQ,CAAC,SAAS;QAC3B,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,OAAO;QACL,GAAG,WAAW;QACd,cAAc,EAAE,IAAI;QACpB,sBAAsB;QACtB,kBAAkB,EAAE,UAAU;QAC9B,cAAc,EAAE,QAAQ,CAAC,KAAK;QAC9B,gBAAgB,EAAE,MAAM,CAAC,KAAK;KAC/B,CAAC;AACJ,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type PrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport type {\n AcknowledgedPrincipalCurrentPublication,\n ReconciledPrincipalCurrentPublication,\n} from \"../../../data/persistence/principalCurrentAcknowledgementPersistence\";\nimport { loadPrincipalHistoryPrefix } from \"../../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n PrincipalHistoryEvidenceUnavailableError,\n selectRecoveredPrincipalHistory,\n} from \"../historyRecovery/principalHistoryRecoveryReferences\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"../historyRecovery/principalHistoryRecoveryTypes\";\nimport { principalHistoryVerificationContext } from \"../historyRecovery/principalHistoryRecoveryVerification\";\nimport { restoreAcknowledgedPrincipalPrefix } from \"./acknowledgedPrincipalPredecessor\";\n\n/** Only the receipt is proven; a newer local pin needs scoped history covering it. */\nfunction reconcileReceiptOnly(\n publication: AcknowledgedPrincipalCurrentPublication,\n observedPrefixProgress: string | null,\n checkpoint: PrincipalPolicyCheckpoint | null,\n): ReconciledPrincipalCurrentPublication {\n // Other verified evidence, such as a document purge proof, can pin a newer\n // head without advancing this scope's prefix. That is honest progress this\n // receipt cannot prove membership in: retry after recovery, not a rollback.\n // A genesis receipt has no predecessor, so any existing pin stays a conflict.\n if (\n publication.predecessorStage &&\n checkpoint &&\n checkpoint.version > publication.policy.version\n )\n throw new PrincipalHistoryEvidenceUnavailableError(\n new KeyingVerificationError(\n \"missing_dependency\",\n \"A newer local principal pin is not covered by scoped history\",\n ),\n );\n return {\n ...publication,\n preservePrefix: false,\n observedPrefixProgress,\n observedCheckpoint: checkpoint,\n retainedPrefix: publication.prefix,\n checkpointPolicy: publication.policy,\n };\n}\n\n/** Prove an already observed successor contains this receipt before preserving it. */\nexport async function reconcileAcknowledgedPrincipalCurrent(\n input: RecoverPrincipalPolicyHistoryOptions,\n publication: AcknowledgedPrincipalCurrentPublication,\n): Promise<ReconciledPrincipalCurrentPublication> {\n const options = {\n ...input,\n protection: {\n ...input.protection,\n context: principalHistoryVerificationContext(input),\n },\n };\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n options.execSql,\n publication.policy.principalType,\n publication.policy.principalId,\n );\n const saved = await loadPrincipalHistoryPrefix(\n options.execSql,\n publication.prefix.scopeId,\n );\n const observedPrefixProgress = saved?.progress ?? null;\n if (observedPrefixProgress === publication.previousPrefixProgress)\n return reconcileReceiptOnly(\n publication,\n observedPrefixProgress,\n checkpoint,\n );\n const restored = await restoreAcknowledgedPrincipalPrefix(options, saved);\n if (restored.previous.version < publication.policy.version) {\n if (\n !principalHeadMatchesReference(\n restored.previous.state,\n options.expectedHead,\n )\n )\n throw new KeyingVerificationError(\n \"stale_predecessor\",\n \"Acknowledgement does not extend the authenticated current prefix\",\n );\n return reconcileReceiptOnly(\n publication,\n observedPrefixProgress,\n checkpoint,\n );\n }\n const history = await selectRecoveredPrincipalHistory({\n options: { ...options, retainedReferences: [publication.policy.state] },\n scopeId: publication.prefix.scopeId,\n history: restored.history,\n checkpoint,\n });\n const policy = await verifyPrincipalPolicyCurrent({\n current: restored.artifacts,\n history,\n });\n if (!policy.ok) throw policy.error;\n return {\n ...publication,\n preservePrefix: true,\n observedPrefixProgress,\n observedCheckpoint: checkpoint,\n retainedPrefix: restored.saved,\n checkpointPolicy: policy.value,\n };\n}\n"]}

package/workflows/principals/{loadRecoveredPrincipalHistoryPage.d.ts → historyRecovery/loadRecoveredPrincipalHistoryPage.d.ts} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { type PrincipalPolicyStateChainEntryResponse } from "../../internal/validators/response/index.js";
+import { type PrincipalPolicyStateChainEntryResponse } from "../../../internal/validators/response/index.js";
 import { type RecoverPrincipalPolicyHistoryOptions } from "./principalHistoryRecoveryTypes.js";
 export interface RecoveredPrincipalHistoryPage {
     /** Ascending entries, with the immediate predecessor kept separately for diffs. */

package/workflows/principals/{loadRecoveredPrincipalHistoryPage.js → historyRecovery/loadRecoveredPrincipalHistoryPage.js} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { KeyingVerificationError, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
-import { isPrincipalPolicyStateChainEntryResponse, PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE, } from "../../internal/validators/response/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
-import { principalHistoryEvidenceScopeId } from "../../data/principals/principalHistoryPrefixProtection.js";
-import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
+import { KeyingVerificationError, verifyPrincipalPolicyHistoryReferences, } from "../../../internal/crypto/index.js";
+import { isPrincipalPolicyStateChainEntryResponse, PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE, } from "../../../internal/validators/response/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalHistoryReference } from "../../../data/persistence/principalHistoryEvidencePersistence.js";
+import { principalHistoryEvidenceScopeId } from "../../../data/principals/principalHistoryPrefixProtection.js";
+import { ownPrincipalHistoryProtection } from "../../../data/principals/principalHistoryProtection.js";
 import { loadVerifiedPrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
 import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
 import { PrincipalHistoryRecoveryRaceError, } from "./principalHistoryRecoveryTypes.js";

package/workflows/principals/historyRecovery/loadRecoveredPrincipalHistoryPage.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"loadRecoveredPrincipalHistoryPage.js","sourceRoot":"","sources":["loadRecoveredPrincipalHistoryPage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,GAEpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,+DAA+D,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,EACL,iCAAiC,GAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mCAAmC,EAAE,MAAM,wCAAwC,CAAC;AAS7F,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA6C,EAC7C,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;IAEhD,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAA6C,EAC7C,aAAqB;IAErB,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,IAAI,CAAC;QAClB,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QAEhD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QACjE,MAAM,IAAI,iCAAiC,CACzC,mEAAmE,CACpE,CAAC;IACJ,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAC/B,iBAAiB,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO;QACP,OAAO;QACP,OAAO;KACR,CAAC,CAAC;IACL,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,aAAa,GAAG,mCAAmC,CACpD,CAAC;IACF,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KACE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,EAC3C,OAAO,GAAG,aAAa,EACvB,OAAO,IAAI,CAAC,EACZ,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IACd,IACE,mBAAmB;QACnB,mBAAmB,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,SAAS;QAEjE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8DAA8D,CAC/D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,8BAA8B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,OAAO,IAAI,YAAY,IAAI,KAAK,CAAC,OAAO,GAAG,aAAa,CACjE;QACD,WAAW,EACT,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,CAAC,CAAC,IAAI,IAAI;QAC1E,iBAAiB,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAA6C,EAC7C,UAAqE;IAErE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CAAC,aAAa,EAClC,OAAO,CAAC,YAAY,CAAC,WAAW,CACjC,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA0D;IAE1D,IAAI,CAAC;QACH,OAAO,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAqC;IAErC,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA6C,EAC7C,OAAsB;IAEtB,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO;QACV,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,UAAU;YACrB,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;SACtD;KACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,UAAU,EAAE,UAAU,CAAC,UAAU;KAClC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,UAAU,EACV;QACE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;QACjD,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;KAC9C,EACD,OAAO,CACR,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type PrincipalPolicyHistoryReferenceProof,\n type PrincipalPolicyStateChainEntry,\n verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport {\n isPrincipalPolicyStateChainEntryResponse,\n PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE,\n type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalHistoryReference } from \"../../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../../data/principals/principalHistoryPrefixProtection\";\nimport { ownPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryProtection\";\nimport { loadVerifiedPrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport {\n PrincipalHistoryRecoveryRaceError,\n type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { principalHistoryVerificationContext } from \"./principalHistoryRecoveryVerification\";\n\nexport interface RecoveredPrincipalHistoryPage {\n /** Ascending entries, with the immediate predecessor kept separately for diffs. */\n readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n readonly predecessor: PrincipalPolicyStateChainEntryResponse | null;\n readonly nextBeforeVersion: number | null;\n}\n\n/** Read a bounded historical window from an already recovered, exact private root. */\nexport async function loadRecoveredPrincipalHistoryPage(\n options: RecoverPrincipalPolicyHistoryOptions,\n beforeVersion = options.expectedHead.version + 1,\n): Promise<RecoveredPrincipalHistoryPage> {\n const owned = {\n ...options,\n expectedHead: structuredClone(options.expectedHead),\n protection: ownPrincipalHistoryProtection(options.protection),\n };\n try {\n return await readPage(owned, beforeVersion);\n } finally {\n owned.protection.localKey.fill(0);\n }\n}\n\nasync function readPage(\n options: RecoverPrincipalPolicyHistoryOptions,\n beforeVersion: number,\n): Promise<RecoveredPrincipalHistoryPage> {\n if (\n !Number.isSafeInteger(beforeVersion) ||\n beforeVersion <= 1 ||\n beforeVersion > options.expectedHead.version + 1\n )\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Principal history page cursor is outside the selected history\",\n );\n const current = () => !options.signal?.aborted && options.stillCurrent();\n assertProjectionVerificationCurrent(current);\n const { scopeId, history } = await restoreReadRoot(options, current);\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n options.execSql,\n options.expectedHead.principalType,\n options.expectedHead.principalId,\n );\n if (checkpoint && checkpoint.version > options.expectedHead.version)\n throw new PrincipalHistoryRecoveryRaceError(\n \"Principal checkpoint advanced beyond the selected display history\",\n );\n const load = (version: number) =>\n loadPageReference({\n execSql: options.execSql,\n scopeId,\n history,\n version,\n });\n const firstVersion = Math.max(\n 1,\n beforeVersion - PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE,\n );\n const references: PrincipalPolicyHistoryReferenceProof[] = [];\n for (\n let version = Math.max(1, firstVersion - 1);\n version < beforeVersion;\n version += 1\n ) {\n assertProjectionVerificationCurrent(current);\n references.push(await load(version));\n }\n const checkpointReference = checkpoint\n ? await load(checkpoint.version)\n : undefined;\n if (\n checkpointReference &&\n checkpointReference.reference.stateHash !== checkpoint?.stateHash\n )\n throw new KeyingVerificationError(\n \"equivocation\",\n \"Principal history page conflicts with its durable checkpoint\",\n );\n const selected = await verifyPrincipalPolicyHistoryReferences({\n history,\n references,\n checkpointReference,\n });\n if (!selected.ok)\n throw new PrincipalHistoryEvidenceUnavailableError(selected.error);\n await assertDisplayCheckpointCurrent(options, checkpoint);\n assertProjectionVerificationCurrent(current);\n // These exact rows passed inclusion and commitment verification above. Keep\n // their display-only server timestamps, which the private current strips.\n const retained = references.map(({ entry }) => responseEntry(entry));\n return {\n entries: retained.filter(\n ({ state }) =>\n state.version >= firstVersion && state.version < beforeVersion,\n ),\n predecessor:\n retained.find(({ state }) => state.version === firstVersion - 1) ?? null,\n nextBeforeVersion: firstVersion > 1 ? firstVersion : null,\n };\n}\n\nasync function assertDisplayCheckpointCurrent(\n options: RecoverPrincipalPolicyHistoryOptions,\n checkpoint: Awaited<ReturnType<typeof loadPrincipalPolicyCheckpoint>>,\n) {\n const latest = await loadPrincipalPolicyCheckpoint(\n options.execSql,\n options.expectedHead.principalType,\n options.expectedHead.principalId,\n );\n if (\n latest?.version !== checkpoint?.version ||\n latest?.stateHash !== checkpoint?.stateHash\n )\n throw new PrincipalHistoryRecoveryRaceError(\n \"Principal checkpoint changed while reading display history\",\n );\n}\n\nasync function loadPageReference(\n input: Parameters<typeof loadPrincipalHistoryReference>[0],\n) {\n try {\n return await loadPrincipalHistoryReference(input);\n } catch (error) {\n if (error instanceof KeyingVerificationError)\n throw new PrincipalHistoryEvidenceUnavailableError(error);\n throw error;\n }\n}\n\nfunction responseEntry(\n entry: PrincipalPolicyStateChainEntry,\n): PrincipalPolicyStateChainEntryResponse {\n if (!isPrincipalPolicyStateChainEntryResponse(entry))\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history display metadata is unavailable\",\n );\n return entry;\n}\n\nasync function restoreReadRoot(\n options: RecoverPrincipalPolicyHistoryOptions,\n current: () => boolean,\n) {\n const normalized = {\n ...options,\n protection: {\n ...options.protection,\n context: principalHistoryVerificationContext(options),\n },\n };\n const scopeId = await principalHistoryEvidenceScopeId({\n organizationId: options.organizationId,\n head: options.expectedHead,\n protection: normalized.protection,\n });\n const prefix = await loadVerifiedPrincipalHistoryPrefix(\n normalized,\n {\n principalType: options.expectedHead.principalType,\n principalId: options.expectedHead.principalId,\n },\n scopeId,\n );\n assertProjectionVerificationCurrent(current);\n if (!prefix)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history page requires a recovered private prefix\",\n );\n const finished = prefix.verifier.finish(options.expectedHead);\n if (!finished.ok) throw finished.error;\n return { scopeId, history: finished.value };\n}\n"]}

package/workflows/principals/{principalHistoryRecoveryAuthority.js → historyRecovery/principalHistoryRecoveryAuthority.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { principalHeadMatchesReference } from "../../../data/principals/organizationAuthorityDescriptor.js";
 import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
 /** Reusable signatures remain conditional on their authenticated authority lineage. */
 export async function validatePrincipalHistoryRecoveryAuthority(input, verifier) {

package/workflows/principals/historyRecovery/principalHistoryRecoveryAuthority.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryRecoveryAuthority.js","sourceRoot":"","sources":["principalHistoryRecoveryAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAGhG,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAA2C,EAC3C,QAAwC;IAExC,MAAM,SAAS,GAAG,QAAQ,CAAC,6BAA6B,EAAE,CAAC;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,IACE,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/C;YAED,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,CAC7D,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type PrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { PrincipalHistoryEvidenceUnavailableError } from \"./principalHistoryRecoveryReferences\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\n/** Reusable signatures remain conditional on their authenticated authority lineage. */\nexport async function validatePrincipalHistoryRecoveryAuthority(\n input: RecoverPrincipalPolicyHistoryOptions,\n verifier: PrincipalPolicyHistoryVerifier,\n): Promise<void> {\n const reference = verifier.getExternalAuthorityReference();\n if (!reference) return;\n try {\n const authority = await input.loadExternalAuthority?.([reference]);\n if (\n !authority?.states.some(({ head }) =>\n principalHeadMatchesReference(head, reference),\n )\n )\n throw new KeyingVerificationError(\n \"stale_predecessor\",\n \"Cached principal history has a different authority lineage\",\n );\n } catch (error) {\n if (error instanceof KeyingVerificationError)\n throw new PrincipalHistoryEvidenceUnavailableError(error);\n throw error;\n }\n}\n"]}

package/workflows/principals/{principalHistoryRecoveryPrefix.js → historyRecovery/principalHistoryRecoveryPrefix.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { restorePrincipalPolicyHistoryVerifier, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
-import { isReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
-import { discardPrincipalHistoryPrefix, loadPrincipalHistoryPrefix, savePrincipalHistoryPrefix, } from "../../data/persistence/principalHistoryPrefixPersistence.js";
-import { principalHistoryPrefixProtection } from "../../data/principals/principalHistoryPrefixProtection.js";
-import { parsePrincipalHistoryStageCurrent } from "../../data/principals/principalHistoryStageProtection.js";
+import { restorePrincipalPolicyHistoryVerifier, serializeKeyingCanonicalJson, } from "../../../internal/crypto/index.js";
+import { isReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
+import { discardPrincipalHistoryPrefix, loadPrincipalHistoryPrefix, savePrincipalHistoryPrefix, } from "../../../data/persistence/principalHistoryPrefixPersistence.js";
+import { principalHistoryPrefixProtection } from "../../../data/principals/principalHistoryPrefixProtection.js";
+import { parsePrincipalHistoryStageCurrent } from "../../../data/principals/principalHistoryStageProtection.js";
 export async function loadVerifiedPrincipalHistoryPrefix(options, historyInput, scopeId) {
     const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);
     if (!saved)

package/workflows/principals/historyRecovery/principalHistoryRecoveryPrefix.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryRecoveryPrefix.js","sourceRoot":"","sources":["principalHistoryRecoveryPrefix.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,iCAAiC,EAAE,MAAM,0DAA0D,CAAC;AAG7G,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAmE,EACnE,YAAyC,EACzC,OAAe;IAMf,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC/C,kCAAkC,CAAC,IAAI,CAAC;QACxC,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QACjD,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC7C,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAC9B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,MAAM,OAAO,GAAG,iCAAiC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO;YAC1D,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,YAAyC,EACzC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,OAAO,EACP,YAAY,EACZ,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAC/D,OAAO,IAAI,CAAC;IACd,IACE,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAClD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE;QAE/C,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACrD,yEAAyE;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,OAAe,EACf,QAAwC,EACxC,OAAmC;IAEnC,MAAM,MAAM,GAAG;QACb,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,OAAO;QACrC,QAAQ,EAAE,4BAA4B,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CACnE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,0BAA0B,CAAC;QAC/B,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n type PrincipalPolicyHistoryInput,\n type PrincipalPolicyHistoryVerifier,\n type ReferencedPrincipalHead,\n restorePrincipalPolicyHistoryVerifier,\n serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport {\n discardPrincipalHistoryPrefix,\n loadPrincipalHistoryPrefix,\n savePrincipalHistoryPrefix,\n} from \"../../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHistoryPrefixProtection } from \"../../../data/principals/principalHistoryPrefixProtection\";\nimport { parsePrincipalHistoryStageCurrent } from \"../../../data/principals/principalHistoryStageProtection\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport async function loadVerifiedPrincipalHistoryPrefix(\n options: Omit<RecoverPrincipalPolicyHistoryOptions, \"expectedHead\">,\n historyInput: PrincipalPolicyHistoryInput,\n scopeId: string,\n): Promise<{\n verifier: PrincipalPolicyHistoryVerifier;\n head: ReferencedPrincipalHead;\n current: PrincipalPolicyPageCurrent;\n} | null> {\n const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);\n if (!saved) return null;\n let head: unknown;\n try {\n head = JSON.parse(saved.headJson);\n } catch {\n head = null;\n }\n if (\n saved.organizationId === options.organizationId &&\n isReferencedPrincipalStateResponse(head) &&\n head.principalType === historyInput.principalType &&\n head.principalId === historyInput.principalId &&\n head.version === saved.version\n ) {\n const restored = await restorePrincipalPolicyHistoryVerifier(\n historyInput,\n saved.progress,\n await principalHistoryPrefixProtection(options.protection, saved),\n );\n const current = parsePrincipalHistoryStageCurrent({\n currentJson: saved.currentJson,\n afterVersion: saved.version - 1,\n });\n if (restored.ok && restored.value.finish(head).ok && current)\n return { verifier: restored.value, head, current };\n }\n await discardPrincipalHistoryPrefix({\n execSql: options.execSql,\n prefix: saved,\n stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n });\n return null;\n}\n\nexport async function restoreReusablePrincipalHistoryPrefix(\n options: RecoverPrincipalPolicyHistoryOptions,\n historyInput: PrincipalPolicyHistoryInput,\n scopeId: string,\n) {\n const prefix = await loadVerifiedPrincipalHistoryPrefix(\n options,\n historyInput,\n scopeId,\n );\n if (!prefix || prefix.head.version > options.expectedHead.version)\n return null;\n if (\n prefix.head.version < options.expectedHead.version ||\n prefix.verifier.finish(options.expectedHead).ok\n )\n return { ...prefix, version: prefix.head.version };\n // An incompatible target cannot erase an independently valid local hint.\n return null;\n}\n\n/** The verifier must use stable empty selection/checkpoint inputs. */\nexport async function publishReusablePrincipalHistoryPrefix(\n options: RecoverPrincipalPolicyHistoryOptions,\n scopeId: string,\n verifier: PrincipalPolicyHistoryVerifier,\n current: PrincipalPolicyPageCurrent,\n): Promise<void> {\n const prefix = {\n scopeId,\n organizationId: options.organizationId,\n version: options.expectedHead.version,\n headJson: serializeKeyingCanonicalJson({ ...options.expectedHead }),\n currentJson: JSON.stringify(current),\n };\n const sealed = await verifier.exportProgress(\n await principalHistoryPrefixProtection(options.protection, prefix),\n );\n if (!sealed.ok) throw sealed.error;\n const history = verifier.finish(options.expectedHead);\n if (!history.ok) throw history.error;\n await savePrincipalHistoryPrefix({\n indexRootHash: history.value.indexRootHash,\n execSql: options.execSql,\n prefix: { ...prefix, progress: sealed.value },\n stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n });\n}\n"]}

package/workflows/principals/{principalHistoryRecoveryReferences.js → historyRecovery/principalHistoryRecoveryReferences.js} RENAMED Viewed

@@ -1,7 +1,7 @@
-import { KeyingVerificationError, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { KeyingVerificationError, verifyPrincipalPolicyHistoryReferences, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalHistoryReference } from "../../../data/persistence/principalHistoryEvidencePersistence.js";
+import { principalHeadMatchesReference } from "../../../data/principals/organizationAuthorityDescriptor.js";
 export class PrincipalHistoryEvidenceUnavailableError extends Error {
     verificationError;
     constructor(verificationError) {

package/workflows/principals/historyRecovery/principalHistoryRecoveryReferences.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryRecoveryReferences.js","sourceRoot":"","sources":["principalHistoryRecoveryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAIvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,+DAA+D,CAAC;AAC9G,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AASzG,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IAC5C;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAAC,KAK/B;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACzD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CACb,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CACzE,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QACpC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,MAAM,6BAA6B,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,KAAK,CAAC,UAAU;QAC1C,CAAC,CAAC,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;SAClC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA6C;IAE7C,IAAI,QAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,gFAAgF;IAChF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAC/D,IACE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD;YAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyHistoryReferenceProof,\n type VerifiedPrincipalPolicyHistory,\n verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport interface PrincipalHistorySelectionOptions\n extends RecoverPrincipalPolicyHistoryOptions {\n /** Internal page selection by version; every selected row still needs a private-root proof. */\n readonly retainedVersions?: readonly number[] | undefined;\n}\n\nexport class PrincipalHistoryEvidenceUnavailableError extends Error {\n constructor(readonly verificationError: KeyingVerificationError) {\n super(verificationError.message);\n this.name = \"PrincipalHistoryEvidenceUnavailableError\";\n }\n}\n\nasync function selectReferences(input: {\n readonly options: PrincipalHistorySelectionOptions;\n readonly scopeId: string;\n readonly history: VerifiedPrincipalPolicyHistory;\n readonly checkpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<VerifiedPrincipalPolicyHistory> {\n const { options, scopeId, history } = input;\n const current = () => !options.signal?.aborted && options.stillCurrent();\n const base = { execSql: options.execSql, scopeId, history };\n const references: PrincipalPolicyHistoryReferenceProof[] = [];\n for (const reference of options.retainedReferences ?? []) {\n assertProjectionVerificationCurrent(current);\n references.push(\n await loadPrincipalHistoryReference({\n ...base,\n version: reference.version,\n }),\n );\n }\n const versions = new Set(\n (options.retainedReferences ?? []).map((reference) => reference.version),\n );\n for (const version of options.retainedVersions ?? []) {\n if (versions.has(version)) continue;\n versions.add(version);\n assertProjectionVerificationCurrent(current);\n references.push(await loadPrincipalHistoryReference({ ...base, version }));\n }\n assertProjectionVerificationCurrent(current);\n const checkpointReference = input.checkpoint\n ? await loadPrincipalHistoryReference({\n ...base,\n version: input.checkpoint.version,\n })\n : undefined;\n const selected = await verifyPrincipalPolicyHistoryReferences({\n history,\n references,\n checkpointReference,\n });\n if (!selected.ok) throw selected.error;\n assertProjectionVerificationCurrent(current);\n return selected.value;\n}\n\nexport async function selectRecoveredPrincipalHistory(\n input: Parameters<typeof selectReferences>[0],\n): Promise<VerifiedPrincipalPolicyHistory> {\n let selected: VerifiedPrincipalPolicyHistory;\n try {\n selected = await selectReferences(input);\n } catch (error) {\n if (error instanceof KeyingVerificationError)\n throw new PrincipalHistoryEvidenceUnavailableError(error);\n throw error;\n }\n // First authenticate the stored entry against the private root. Only then\n // compare the caller's citation, so a bad request is not treated as cache loss.\n for (const reference of input.options.retainedReferences ?? []) {\n if (\n !selected.retainedEntries.some(({ state }) =>\n principalHeadMatchesReference(state, reference),\n )\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Requested citation does not match the verified principal history\",\n );\n }\n return selected;\n}\n"]}

package/workflows/principals/{principalHistoryRecoveryStage.js → historyRecovery/principalHistoryRecoveryStage.js} RENAMED Viewed

@@ -1,7 +1,7 @@
-import { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "../../internal/crypto/index.js";
-import { discardPrincipalHistoryStage, loadPrincipalHistoryStage, } from "../../data/persistence/principalHistoryStagePersistence.js";
-import { principalHistoryEvidenceScopeId } from "../../data/principals/principalHistoryPrefixProtection.js";
-import { parsePrincipalHistoryStageCurrent, principalHistoryStageId, principalHistoryStageProtection, } from "../../data/principals/principalHistoryStageProtection.js";
+import { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "../../../internal/crypto/index.js";
+import { discardPrincipalHistoryStage, loadPrincipalHistoryStage, } from "../../../data/persistence/principalHistoryStagePersistence.js";
+import { principalHistoryEvidenceScopeId } from "../../../data/principals/principalHistoryPrefixProtection.js";
+import { parsePrincipalHistoryStageCurrent, principalHistoryStageId, principalHistoryStageProtection, } from "../../../data/principals/principalHistoryStageProtection.js";
 import { restoreReusablePrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
 export async function restorePrincipalHistoryRecoveryStage(input, historyInput, useReusablePrefix = true) {
     const scopeId = await principalHistoryEvidenceScopeId({

package/workflows/principals/historyRecovery/principalHistoryRecoveryStage.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryRecoveryStage.js","sourceRoot":"","sources":["principalHistoryRecoveryStage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EAGpC,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AAczF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA2C,EAC3C,YAAyC,EACzC,iBAAiB,GAAG,IAAI;IAExB,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CACtC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CAAC,OAAO,CACzB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,KAAK,CACN,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE;gBACb,OAAO;oBACL,EAAE;oBACF,OAAO;oBACP,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,mBAAmB,EAAE,KAAK,CAAC,YAAY;oBACvC,SAAS,EAAE,IAAI;iBAChB,CAAC;QACN,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,KAAK,EACL,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB;QAC9B,CAAC,CAAC,MAAM,qCAAqC,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;QAC/D,OAAO;YACL,EAAE;YACF,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzC,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,mBAAmB,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO;QACP,QAAQ,EAAE,oCAAoC,CAAC,YAAY,CAAC;QAC5D,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;QACf,mBAAmB,EAAE,CAAC;QACtB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n createPrincipalPolicyHistoryVerifier,\n type PrincipalPolicyHistoryInput,\n type PrincipalPolicyHistoryVerifier,\n restorePrincipalPolicyHistoryVerifier,\n} from \"@tearleads/crypto\";\nimport {\n discardPrincipalHistoryStage,\n loadPrincipalHistoryStage,\n type PrincipalHistoryStage,\n} from \"../../../data/persistence/principalHistoryStagePersistence\";\nimport { principalHistoryEvidenceScopeId } from \"../../../data/principals/principalHistoryPrefixProtection\";\nimport {\n parsePrincipalHistoryStageCurrent,\n principalHistoryStageId,\n principalHistoryStageProtection,\n} from \"../../../data/principals/principalHistoryStageProtection\";\nimport { restoreReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport interface PrincipalHistoryRecoveryStage {\n readonly id: string;\n readonly scopeId: string;\n readonly verifier: PrincipalPolicyHistoryVerifier;\n readonly initialAfterVersion: number;\n readonly fromCache: boolean;\n complete: boolean;\n current: PrincipalPolicyPageCurrent | null;\n saved: PrincipalHistoryStage | null;\n}\n\nexport async function restorePrincipalHistoryRecoveryStage(\n input: RecoverPrincipalPolicyHistoryOptions,\n historyInput: PrincipalPolicyHistoryInput,\n useReusablePrefix = true,\n): Promise<PrincipalHistoryRecoveryStage> {\n const scopeId = await principalHistoryEvidenceScopeId({\n organizationId: input.organizationId,\n head: input.expectedHead,\n protection: input.protection,\n });\n const id = await principalHistoryStageId(\n input.organizationId,\n input.expectedHead,\n input.protection.context,\n );\n const saved = await loadPrincipalHistoryStage(input.execSql, id);\n if (saved) {\n const current = parsePrincipalHistoryStageCurrent(saved);\n if (current && saved.organizationId === input.organizationId) {\n const restored = await restorePrincipalPolicyHistoryVerifier(\n historyInput,\n saved.progress,\n await principalHistoryStageProtection(\n input.protection,\n input.expectedHead,\n saved,\n ),\n );\n if (restored.ok)\n return {\n id,\n scopeId,\n verifier: restored.value,\n current,\n saved,\n complete: saved.complete,\n initialAfterVersion: saved.afterVersion,\n fromCache: true,\n };\n }\n // Saved bytes are a disposable hint. Only a locally authenticated restore\n // can skip signed history; missing keys or changed inputs replay genesis.\n await discardPrincipalHistoryStage(\n input.execSql,\n saved,\n () => !input.signal?.aborted && input.stillCurrent(),\n );\n }\n const prefix = useReusablePrefix\n ? await restoreReusablePrincipalHistoryPrefix(input, historyInput, scopeId)\n : null;\n if (prefix) {\n const complete = prefix.version === input.expectedHead.version;\n return {\n id,\n scopeId,\n verifier: prefix.verifier,\n current: complete ? prefix.current : null,\n saved: null,\n complete,\n initialAfterVersion: prefix.version - (complete ? 1 : 0),\n fromCache: true,\n };\n }\n return {\n id,\n scopeId,\n verifier: createPrincipalPolicyHistoryVerifier(historyInput),\n current: null,\n saved: null,\n complete: false,\n initialAfterVersion: 0,\n fromCache: false,\n };\n}\n"]}

package/workflows/principals/{principalHistoryRecoveryTypes.d.ts → historyRecovery/principalHistoryRecoveryTypes.d.ts} RENAMED Viewed

@@ -1,8 +1,8 @@
-import type { PrincipalPolicyPageCurrent, RequestFailure } from "../../internal/api-client/index.js";
-import { KeyingVerificationError, type PrincipalPolicyExternalAuthority, type PrincipalPolicyHistoryProgressOptions, type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
-import type { PrincipalPolicyPageReader } from "./principalPolicyHistoryReader.js";
+import type { PrincipalPolicyPageCurrent, RequestFailure } from "../../../internal/api-client/index.js";
+import { KeyingVerificationError, type PrincipalPolicyExternalAuthority, type PrincipalPolicyHistoryProgressOptions, type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../../internal/crypto/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { PrincipalPolicyPageReader } from "../principalPolicyHistoryReader.js";
 /** A locally observed race, distinct from a rejected signed predecessor. */
 export declare class PrincipalHistoryRecoveryRaceError extends KeyingVerificationError {
     constructor(message: string);

package/workflows/principals/{principalHistoryRecoveryTypes.js → historyRecovery/principalHistoryRecoveryTypes.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
 /** A locally observed race, distinct from a rejected signed predecessor. */
 export class PrincipalHistoryRecoveryRaceError extends KeyingVerificationError {
     constructor(message) {

package/workflows/principals/historyRecovery/principalHistoryRecoveryTypes.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryRecoveryTypes.js","sourceRoot":"","sources":["principalHistoryRecoveryTypes.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,uBAAuB,GAKxB,MAAM,mBAAmB,CAAC;AAK3B,4EAA4E;AAC5E,MAAM,OAAO,iCAAkC,SAAQ,uBAAuB;IAC5E,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AA8BD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAArB,YAAqB,OAAuB;QAC1C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QADJ,YAAO,GAAP,OAAO,CAAgB;QAE1C,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF","sourcesContent":["import type {\n PrincipalPolicyPageCurrent,\n RequestFailure,\n} from \"@tearleads/api-client\";\nimport {\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n type PrincipalPolicyHistoryProgressOptions,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { PrincipalPolicyPageReader } from \"../principalPolicyHistoryReader\";\n\n/** A locally observed race, distinct from a rejected signed predecessor. */\nexport class PrincipalHistoryRecoveryRaceError extends KeyingVerificationError {\n constructor(message: string) {\n super(\"stale_predecessor\", message);\n }\n}\n\nexport interface RecoverPrincipalPolicyHistoryOptions {\n readonly historyReader: PrincipalPolicyPageReader;\n readonly execSql: ExecSql;\n readonly organizationId: string;\n readonly expectedHead: ReferencedPrincipalHead;\n /** Only use locally authenticated completed evidence; never perform HTTP. */\n readonly offline?: boolean | undefined;\n /** Device-controlled key and stable identity/trust-policy context, never supplied by the API. */\n readonly protection: PrincipalPolicyHistoryProgressOptions;\n readonly retainedReferences?: readonly ReferencedPrincipalHead[] | undefined;\n /** Strict Admins mode checks every historical projection in a separate cache scope. */\n readonly historyVerification?: \"standard\" | \"direct-admins\" | undefined;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n /** Authenticate these exact authority references, including cached-prefix citations. */\n readonly loadExternalAuthority?:\n | ((\n references: readonly ReferencedPrincipalHead[],\n ) => Promise<PrincipalPolicyExternalAuthority | undefined>)\n | undefined;\n readonly stillCurrent: () => boolean;\n readonly signal?: AbortSignal | undefined;\n}\n\nexport interface RecoveredPrincipalPolicyHistory {\n readonly current: PrincipalPolicyPageCurrent;\n readonly policy: VerifiedPrincipalPolicyCurrent;\n}\n\nexport class PrincipalPolicyHistoryReadError extends Error {\n constructor(readonly failure: RequestFailure) {\n super(failure.message);\n this.name = \"PrincipalPolicyHistoryReadError\";\n }\n}\n"]}

package/workflows/principals/{principalHistoryRecoveryVerification.js → historyRecovery/principalHistoryRecoveryVerification.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { KeyingVerificationError, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, serializeKeyingCanonicalJson, } from "../../../internal/crypto/index.js";
 export function principalHistoryVerificationContext(input) {
     const mode = input.historyVerification ?? "standard";
     if (mode !== "standard" && mode !== "direct-admins")

package/workflows/principals/{recoverCurrentOrganizationPolicy.js → historyRecovery/recoverCurrentOrganizationPolicy.js} RENAMED Viewed

@@ -1,7 +1,7 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
-import { createPrincipalRecoveryReader, } from "./principalRecoveryMemo.js";
-import { isPrincipalRecoveryOutage } from "./principalRecoveryOutage.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { ownPrincipalHistoryProtection } from "../../../data/principals/principalHistoryProtection.js";
+import { createPrincipalRecoveryReader, } from "../recoveryOperation/principalRecoveryMemo.js";
+import { isPrincipalRecoveryOutage } from "../recoveryOperation/principalRecoveryOutage.js";
 /** Discover and verify current directory artifacts, including protected offline recovery. */
 export async function recoverCurrentOrganizationPolicy(options, memo) {
     const input = {

package/workflows/principals/historyRecovery/recoverCurrentOrganizationPolicy.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"recoverCurrentOrganizationPolicy.js","sourceRoot":"","sources":["recoverCurrentOrganizationPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAKpG,OAAO,EACL,6BAA6B,GAE9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AAEzF,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAiC,EACjC,IAA4B;IAE5B,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,IAAI,SAAmC,CAAC;QACxC,IAAI,MAAM,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,GAAG,6BAA6B,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1E,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,wEAAwE;QACxE,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACzE,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,YAAY,EAAE,EAAE;YAChB,YAAY;SACb,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { ownPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryProtection\";\nimport type {\n PrincipalRecoveryContext,\n RecoveredPolicyDirectory,\n} from \"../recoveryOperation/principalRecoveryDirectory\";\nimport {\n createPrincipalRecoveryReader,\n type PrincipalRecoveryMemo,\n} from \"../recoveryOperation/principalRecoveryMemo\";\nimport { isPrincipalRecoveryOutage } from \"../recoveryOperation/principalRecoveryOutage\";\n\n/** Discover and verify current directory artifacts, including protected offline recovery. */\nexport async function recoverCurrentOrganizationPolicy(\n options: PrincipalRecoveryContext,\n memo?: PrincipalRecoveryMemo,\n) {\n const input = {\n ...options,\n protection: ownPrincipalHistoryProtection(options.protection),\n };\n try {\n let directory: RecoveredPolicyDirectory;\n let reader = createPrincipalRecoveryReader(input, memo);\n try {\n directory = await reader.directory([]);\n } catch (error) {\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (input.offline || !isPrincipalRecoveryOutage(error)) throw error;\n reader = createPrincipalRecoveryReader({ ...input, offline: true }, memo);\n directory = await reader.directory([]);\n }\n // A reused directory keeps its producer's lifetime to the point of use.\n const stillCurrent = () => input.stillCurrent() && reader.stillCurrent();\n assertProjectionVerificationCurrent(stillCurrent);\n return {\n current: directory.current,\n policy: directory.policy,\n dependencies: [],\n stillCurrent,\n };\n } finally {\n input.protection.localKey.fill(0);\n }\n}\n"]}

package/workflows/principals/{recoverPrincipalHistoryPage.js → historyRecovery/recoverPrincipalHistoryPage.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE } from "../../internal/validators/response/index.js";
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { PRINCIPAL_DISPLAY_HISTORY_PAGE_SIZE } from "../../../internal/validators/response/index.js";
 import { loadRecoveredPrincipalHistoryPage } from "./loadRecoveredPrincipalHistoryPage.js";
 import { PrincipalHistoryEvidenceUnavailableError } from "./principalHistoryRecoveryReferences.js";
 import { recoverPrincipalPolicyHistoryWithVersions } from "./recoverPrincipalPolicyHistory.js";

package/workflows/principals/{recoverPrincipalPolicyHistory.js → historyRecovery/recoverPrincipalPolicyHistory.js} RENAMED Viewed

@@ -1,11 +1,11 @@
-import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { preparePrincipalHistoryEvidencePage } from "../../data/persistence/principalHistoryEvidencePersistence.js";
-import { discardPrincipalHistoryStage, savePrincipalHistoryStage, } from "../../data/persistence/principalHistoryStagePersistence.js";
-import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
-import { principalHistoryStageProtection } from "../../data/principals/principalHistoryStageProtection.js";
-import { collectPrincipalPolicySignerPublicKeys } from "./policyVerification.js";
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { preparePrincipalHistoryEvidencePage } from "../../../data/persistence/principalHistoryEvidencePersistence.js";
+import { discardPrincipalHistoryStage, savePrincipalHistoryStage, } from "../../../data/persistence/principalHistoryStagePersistence.js";
+import { ownPrincipalHistoryProtection } from "../../../data/principals/principalHistoryProtection.js";
+import { principalHistoryStageProtection } from "../../../data/principals/principalHistoryStageProtection.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../policyVerification.js";
 import { validatePrincipalHistoryRecoveryAuthority } from "./principalHistoryRecoveryAuthority.js";
 import { publishReusablePrincipalHistoryPrefix } from "./principalHistoryRecoveryPrefix.js";
 import { PrincipalHistoryEvidenceUnavailableError, selectRecoveredPrincipalHistory, } from "./principalHistoryRecoveryReferences.js";

package/workflows/principals/historyRecovery/recoverPrincipalPolicyHistory.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"recoverPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverPrincipalPolicyHistory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,kCAAkC,EAGlC,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,mCAAmC,EAAE,MAAM,+DAA+D,CAAC;AACpH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0DAA0D,CAAC;AAC3G,OAAO,EAAE,sCAAsC,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,uCAAwC,SAAQ,KAAK;IACpC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAC;IACxD,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,mCAAoC,SAAQ,KAAK;IAChC;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,IAAiC;IAEjC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C;IAE3C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,mCAAmC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC,EACnC,YAAkE;IAElE,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,gBAAgB;KACR,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA2C,EAC3C,KAAoC,EACpC,QAAqC;IAErC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IACE,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YAE1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;IACL,sCAAsC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EACrE,8DAA8D,CAC/D,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC5B,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,OAAO;QACP,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAC7C,MAAM,IAAI,uCAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,QAAQ;KACT,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC3D,MAAM,+BAA+B,CACnC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CACL,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC7D,MAAM,yBAAyB,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;YAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAuC,EACvC,KAAoC,EACpC,UAA4C,EAC5C,aAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,aAAa;YACf,MAAM,IAAI,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,+BAA+B,CAAC;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;QACpC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QACjC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IACE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO;QACvC,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,SAAS;QAE3C,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO;QAChB,MAAM,qCAAqC,CACzC,KAAK,EACL,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAoC,EACpC,YAAkE;IAElE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QACH,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAA2C,EAC3C,KAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;YACnC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,uBAAuB,CACpE,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;iBACvC;aACF;YACH,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACjD,CACF,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;gBACxC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;YACJ,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAuC,EACvC,oBAAoB,GAAG,IAAI;IAE3B,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CAAC,aAAa,EAChC,KAAK,CAAC,YAAY,CAAC,WAAW,CAC/B,CAAC;IACF,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,EACjD,2DAA2D,CAC5D,CAAC;IACJ,8EAA8E;IAC9E,oCAAoC,CAAC;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;QAC3C,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,YAAY,GAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;QAC/C,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oCAAoC,CACtD,KAAK,EACL,YAAY,EACZ,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,SAAS;YACjB,MAAM,yCAAyC,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,MAAM,cAAc,CACzB,KAAK,EACL,KAAK,EACL,UAAU,EACV,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAChB,KAAK,YAAY,wCAAwC,CAAC;QAC5D,0EAA0E;QAC1E,MAAM,UAAU,GACd,KAAK,YAAY,uCAAuC;YACxD,KAAK,YAAY,mCAAmC,CAAC;QACvD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC;QAC9C,IAAI,KAAK,CAAC,KAAK;YACb,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC,CACzB,CAAC;QACJ,IACE,CAAC,KAAK,CAAC,OAAO;YACd,oBAAoB;YACpB,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,CAAC;YAEjC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,iBAAiB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA6C;IAE7C,OAAO,yCAAyC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,OAA6C,EAC7C,gBAAmC;IAEnC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAChC,gBAAgB,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;YACjE,kCAAkC;QACpC,gBAAgB,CAAC,IAAI,CACnB,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAC9B,OAAO,GAAG,CAAC;YACX,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CACzC;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;YACpD,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC;QAE9D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,IACE,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAChE;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,UAAU;QAC9D,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC;QACnD,kBAAkB,EAAE,eAAe,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACrE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n createPrincipalPolicyHistoryVerifier,\n KeyingVerificationError,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyHistoryInput,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../../data/persistence/principalHistoryEvidencePersistence\";\nimport {\n discardPrincipalHistoryStage,\n savePrincipalHistoryStage,\n} from \"../../../data/persistence/principalHistoryStagePersistence\";\nimport { ownPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryProtection\";\nimport { principalHistoryStageProtection } from \"../../../data/principals/principalHistoryStageProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../policyVerification\";\nimport { validatePrincipalHistoryRecoveryAuthority } from \"./principalHistoryRecoveryAuthority\";\nimport { publishReusablePrincipalHistoryPrefix } from \"./principalHistoryRecoveryPrefix\";\nimport {\n PrincipalHistoryEvidenceUnavailableError,\n type PrincipalHistorySelectionOptions,\n selectRecoveredPrincipalHistory,\n} from \"./principalHistoryRecoveryReferences\";\nimport {\n type PrincipalHistoryRecoveryStage,\n restorePrincipalHistoryRecoveryStage,\n} from \"./principalHistoryRecoveryStage\";\nimport {\n PrincipalHistoryRecoveryRaceError,\n PrincipalPolicyHistoryReadError,\n type RecoveredPrincipalPolicyHistory,\n type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport {\n assertPrincipalHistoryVerificationMode,\n principalHistoryVerificationContext,\n} from \"./principalHistoryRecoveryVerification\";\n\nclass PrincipalHistoryPrefixDisconnectedError extends Error {\n constructor(readonly verificationError: KeyingVerificationError) {\n super(verificationError.message);\n this.name = \"PrincipalHistoryPrefixDisconnectedError\";\n }\n}\n\n/** Stored current artifacts of a completed stage failed their signed-history check. */\nclass StoredPrincipalCurrentRejectedError extends Error {\n constructor(readonly verificationError: KeyingVerificationError) {\n super(verificationError.message);\n this.name = \"StoredPrincipalCurrentRejectedError\";\n }\n}\n\nfunction currentArtifacts(\n page: PrincipalPolicyPageResponse,\n): PrincipalPolicyPageCurrent {\n return {\n currentState: page.currentState,\n currentPayload: page.currentPayload,\n currentProjection: page.currentProjection,\n currentGrants: page.currentGrants,\n currentMemberEnvelopes: page.currentMemberEnvelopes,\n };\n}\n\nfunction recoveryIsCurrent(\n input: RecoverPrincipalPolicyHistoryOptions,\n): boolean {\n return !input.signal?.aborted && input.stillCurrent();\n}\n\nfunction assertCurrent(input: RecoverPrincipalPolicyHistoryOptions): void {\n assertProjectionVerificationCurrent(() => recoveryIsCurrent(input));\n}\n\nfunction assertExpectedHead(\n current: PrincipalPolicyPageCurrent,\n expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): void {\n for (const field of [\n \"principalType\",\n \"principalId\",\n \"version\",\n \"stateHash\",\n \"keyEpoch\",\n \"keyFingerprint\",\n ] as const) {\n if (current.currentState[field] !== expectedHead[field])\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Principal history page does not match its requested head\",\n );\n }\n}\n\nasync function acceptPage(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n response: PrincipalPolicyPageResponse,\n): Promise<void> {\n const page = structuredClone(response);\n assertCurrent(input);\n assertExpectedHead(page, input.expectedHead);\n if (stage.complete) {\n if (\n page.previousStates.length !== 0 ||\n page.historyPage.nextAfterVersion !== null\n )\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Completed history returned additional entries\",\n );\n stage.current = currentArtifacts(page);\n return;\n }\n const complete = page.historyPage.nextAfterVersion === null;\n const current = currentArtifacts(page);\n const entries = [...page.previousStates];\n if (complete)\n entries.push({\n state: current.currentState,\n projection: current.currentProjection,\n grants: current.currentGrants,\n });\n assertPrincipalHistoryVerificationMode(input, entries);\n const keys = await collectPrincipalPolicySignerPublicKeys({\n bundle: { ...current, previousStates: page.previousStates },\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (\"error\" in keys)\n throw new KeyingVerificationError(\n keys.error === \"not-found\" ? \"missing_dependency\" : \"signer_mismatch\",\n \"Principal history signer identity could not be authenticated\",\n );\n const externalAuthority = await input.loadExternalAuthority?.(\n entries.flatMap(({ state }) =>\n state.externalAuthority ? [state.externalAuthority] : [],\n ),\n );\n const appended = await stage.verifier.append({\n entries,\n signerPublicKeys: keys.signerPublicKeys,\n ...(externalAuthority ? { externalAuthority } : {}),\n });\n if (!appended.ok) {\n if (appended.error.code === \"stale_predecessor\")\n throw new PrincipalHistoryPrefixDisconnectedError(appended.error);\n throw appended.error;\n }\n const next = {\n id: stage.id,\n organizationId: input.organizationId,\n currentJson: JSON.stringify(current),\n afterVersion: appended.value.throughVersion - (complete ? 1 : 0),\n complete,\n };\n const protectedProgress = await stage.verifier.exportProgress(\n await principalHistoryStageProtection(\n input.protection,\n input.expectedHead,\n next,\n ),\n );\n if (!protectedProgress.ok) throw protectedProgress.error;\n const saved = { ...next, progress: protectedProgress.value };\n await savePrincipalHistoryStage({\n execSql: input.execSql,\n stage: saved,\n evidence: await preparePrincipalHistoryEvidencePage({\n indexRootHash: appended.value.indexRootHash,\n scopeId: stage.scopeId,\n organizationId: input.organizationId,\n entries,\n nodes: appended.value.indexNodes,\n }),\n previousProgress: stage.saved?.progress ?? null,\n stillCurrent: () => recoveryIsCurrent(input),\n });\n stage.current = current;\n stage.saved = saved;\n stage.complete = complete;\n}\n\nasync function finishRecovery(\n input: PrincipalHistorySelectionOptions,\n stage: PrincipalHistoryRecoveryStage,\n checkpoint: PrincipalPolicyCheckpoint | null,\n storedCurrent: boolean,\n): Promise<RecoveredPrincipalPolicyHistory> {\n if (!stage.current || !stage.complete)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history ended before its pinned head\",\n );\n const history = stage.verifier.finish(input.expectedHead);\n if (!history.ok) throw history.error;\n const selected = await selectRecoveredPrincipalHistory({\n options: input,\n scopeId: stage.scopeId,\n history: history.value,\n checkpoint,\n });\n const current = await verifyPrincipalPolicyCurrent({\n current: stage.current,\n history: selected,\n });\n if (!current.ok) {\n if (storedCurrent)\n throw new StoredPrincipalCurrentRejectedError(current.error);\n throw current.error;\n }\n verifyPrincipalPolicyCheckpoint({\n chain: current.value.retainedHistory,\n currentState: current.value.state,\n localCheckpoint: checkpoint,\n });\n const latest = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n );\n if (\n latest?.version !== checkpoint?.version ||\n latest?.stateHash !== checkpoint?.stateHash\n )\n throw new PrincipalHistoryRecoveryRaceError(\n \"Local principal checkpoint changed during history recovery\",\n );\n assertCurrent(input);\n if (!input.offline)\n await publishReusablePrincipalHistoryPrefix(\n input,\n stage.scopeId,\n stage.verifier,\n stage.current,\n );\n assertCurrent(input);\n return { current: stage.current, policy: current.value };\n}\n\nfunction completedStageMatchesHead(\n stage: PrincipalHistoryRecoveryStage,\n expectedHead: RecoverPrincipalPolicyHistoryOptions[\"expectedHead\"],\n): boolean {\n if (!stage.complete || !stage.current) return false;\n try {\n assertExpectedHead(stage.current, expectedHead);\n return true;\n } catch {\n return false;\n }\n}\n\n/**\n * Returns whether the stage's current artifacts came from local storage. A\n * completed stage already authenticates every signed entry through the exact\n * pinned head, so an online read of that head could only return the pinned\n * bytes or refuse. Server-current freshness belongs to the caller's discovery.\n */\nasync function readRecoveryPages(\n input: RecoverPrincipalPolicyHistoryOptions,\n stage: PrincipalHistoryRecoveryStage,\n): Promise<boolean> {\n if (input.offline) {\n if (!stage.complete || !stage.current)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Completed principal history is unavailable offline\",\n );\n assertExpectedHead(stage.current, input.expectedHead);\n return true;\n }\n if (completedStageMatchesHead(stage, input.expectedHead)) return true;\n let receivedFinalPage = false;\n for await (const result of input.historyReader.getPrincipalPolicyPages(\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n {\n signal: input.signal,\n stateHash: input.expectedHead.stateHash,\n ...(stage.saved && stage.current\n ? {\n resume: {\n current: stage.current,\n afterVersion: stage.saved.afterVersion,\n },\n }\n : { afterVersion: stage.initialAfterVersion }),\n },\n )) {\n if (!result.ok) {\n // A rejected transport pin cannot justify skipping history on retry.\n // Discard only this operation's progress, then let a new call replay it.\n if (result.kind === \"shape\" && stage.saved)\n await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n recoveryIsCurrent(input),\n );\n throw new PrincipalPolicyHistoryReadError(result);\n }\n await acceptPage(input, stage, result.data);\n receivedFinalPage = result.data.historyPage.nextAfterVersion === null;\n }\n if (!receivedFinalPage)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Principal history transport did not complete\",\n );\n return false;\n}\n\nasync function recover(\n input: PrincipalHistorySelectionOptions,\n allowEvidenceRebuild = true,\n): Promise<RecoveredPrincipalPolicyHistory> {\n assertCurrent(input);\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n input.expectedHead.principalType,\n input.expectedHead.principalId,\n );\n if (checkpoint && input.expectedHead.version < checkpoint.version)\n throw new KeyingVerificationError(\n input.offline ? \"missing_dependency\" : \"rollback\",\n \"Requested principal history predates the local checkpoint\",\n );\n // Validate the requested pin/selection before creating any disposable caches.\n createPrincipalPolicyHistoryVerifier({\n principalType: input.expectedHead.principalType,\n principalId: input.expectedHead.principalId,\n localCheckpoint: checkpoint,\n retainedReferences: input.retainedReferences ?? [],\n });\n const historyInput: PrincipalPolicyHistoryInput = {\n principalType: input.expectedHead.principalType,\n principalId: input.expectedHead.principalId,\n };\n const stage = await restorePrincipalHistoryRecoveryStage(\n input,\n historyInput,\n allowEvidenceRebuild,\n );\n try {\n if (stage.fromCache)\n await validatePrincipalHistoryRecoveryAuthority(input, stage.verifier);\n const stored = await readRecoveryPages(input, stage);\n return await finishRecovery(\n input,\n stage,\n checkpoint,\n stored && !input.offline,\n );\n } catch (error) {\n const lostEvidence =\n error instanceof PrincipalHistoryEvidenceUnavailableError;\n // Disposable stored artifacts never refuse an online reader: replay them.\n const disposable =\n error instanceof PrincipalHistoryPrefixDisconnectedError ||\n error instanceof StoredPrincipalCurrentRejectedError;\n if (!lostEvidence && !disposable) throw error;\n if (stage.saved)\n await discardPrincipalHistoryStage(input.execSql, stage.saved, () =>\n recoveryIsCurrent(input),\n );\n if (\n !input.offline &&\n allowEvidenceRebuild &&\n (lostEvidence || stage.fromCache)\n )\n return recover(input, false);\n throw error.verificationError;\n }\n}\n\n/**\n * Recover one exact head with bounded retained history and durable checked progress.\n * The result is a sparse current-policy capability; this does not advance app checkpoints.\n * Retain organization version 1 when the result will establish founder binding.\n */\nexport function recoverPrincipalPolicyHistory(\n options: RecoverPrincipalPolicyHistoryOptions,\n): Promise<RecoveredPrincipalPolicyHistory> {\n return recoverPrincipalPolicyHistoryWithVersions(options, []);\n}\n\n/** Internal bounded display selection; missing proof rows use the normal single rebuild. */\nexport async function recoverPrincipalPolicyHistoryWithVersions(\n options: RecoverPrincipalPolicyHistoryOptions,\n retainedVersions: readonly number[],\n): Promise<RecoveredPrincipalPolicyHistory> {\n if (\n !Array.isArray(retainedVersions) ||\n retainedVersions.length + (options.retainedReferences?.length ?? 0) >\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n retainedVersions.some(\n (version) =>\n !Number.isSafeInteger(version) ||\n version < 1 ||\n version > options.expectedHead.version,\n )\n )\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Principal display history selection exceeds its bounded range\",\n );\n if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Invalid principal history transport mode\",\n );\n if (\n !options.organizationId ||\n (options.expectedHead.principalType === \"organization\" &&\n options.expectedHead.principalId !== options.organizationId)\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Principal history organization scope is invalid\",\n );\n if (\n options.retainedReferences?.some(\n (reference) => reference.version > options.expectedHead.version,\n )\n )\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Requested history reference is beyond the recovery head\",\n );\n const input = {\n ...options,\n historyVerification: options.historyVerification ?? \"standard\",\n expectedHead: structuredClone(options.expectedHead),\n retainedReferences: structuredClone(options.retainedReferences ?? []),\n retainedVersions: [...retainedVersions],\n protection: ownPrincipalHistoryProtection(options.protection),\n };\n try {\n input.protection.context = principalHistoryVerificationContext(input);\n return await recover(input);\n } finally {\n input.protection.localKey.fill(0);\n }\n}\n"]}

package/workflows/principals/{recoverScopedPrincipalPolicyHistory.d.ts → historyRecovery/recoverScopedPrincipalPolicyHistory.d.ts} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
+import { type ReferencedPrincipalHead, type VerifiedPrincipalPolicyCurrent } from "../../../internal/crypto/index.js";
+import { type PrincipalRecoveryContext } from "../recoveryOperation/principalRecoveryDirectory.js";
+import { type PrincipalRecoveryMemo } from "../recoveryOperation/principalRecoveryMemo.js";
 import type { RecoveredPrincipalHistoryPage } from "./loadRecoveredPrincipalHistoryPage.js";
 import { type RecoveredPrincipalPolicyHistory } from "./principalHistoryRecoveryTypes.js";
-import { type PrincipalRecoveryContext } from "./principalRecoveryDirectory.js";
-import { type PrincipalRecoveryMemo } from "./principalRecoveryMemo.js";
 export interface RecoverScopedPrincipalPolicyHistoryOptions extends PrincipalRecoveryContext {
     readonly reference: ReferencedPrincipalHead;
     /** Optional bounded display history ending before this exclusive version. */

package/workflows/principals/{recoverScopedPrincipalPolicyHistory.js → historyRecovery/recoverScopedPrincipalPolicyHistory.js} RENAMED Viewed

@@ -1,11 +1,11 @@
-import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { ownPrincipalHistoryProtection } from "../../data/principals/principalHistoryProtection.js";
-import { directoryHistoryProtection, scopedGroupHistoryProtection, } from "../../data/principals/principalHistoryScopeProtection.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { ownPrincipalHistoryProtection } from "../../../data/principals/principalHistoryProtection.js";
+import { directoryHistoryProtection, scopedGroupHistoryProtection, } from "../../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { PrincipalRecoveryDirectoryAdvanced, } from "../recoveryOperation/principalRecoveryDirectory.js";
+import { createPrincipalRecoveryReader, } from "../recoveryOperation/principalRecoveryMemo.js";
 import { PrincipalHistoryRecoveryRaceError, } from "./principalHistoryRecoveryTypes.js";
-import { PrincipalRecoveryDirectoryAdvanced, } from "./principalRecoveryDirectory.js";
-import { createPrincipalRecoveryReader, } from "./principalRecoveryMemo.js";
 import { recoverPrincipalHistoryPage } from "./recoverPrincipalHistoryPage.js";
 import { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
 function groupHead(directory, principalId) {

package/workflows/principals/historyRecovery/recoverScopedPrincipalPolicyHistory.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"recoverScopedPrincipalPolicyHistory.js","sourceRoot":"","sources":["recoverScopedPrincipalPolicyHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAEL,kCAAkC,GAEnC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,6BAA6B,GAE9B,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,iCAAiC,GAGlC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AA0BhF,SAAS,SAAS,CAAC,SAAmC,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAC7C,CAAC;IACF,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO;QACL,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAiD,EACjD,IAA4B;IAE5B,IACE,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAChD,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;QAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,oDAAoD,CACrD,CAAC;IACJ,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxD,wEAAwE;IACxE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,cAAc;QAClD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,YAAY,EAAE,EAAE;YAChB,YAAY;YACZ,GAAG,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE;gBACpC,GAAG,KAAK;gBACR,YAAY,EAAE,kCAAkC,CAAC,SAAS,CAAC,OAAO,CAAC;gBACnE,UAAU,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC;aACzD,CAAC,CAAC;SACJ,CAAC;IACJ,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO;QAChD,MAAM,IAAI,kCAAkC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAAC;IACpE,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,CAAC;IACD,MAAM,qBAAqB,GAAG,KAAK,EACjC,SAA6C,EACU,EAAE;QACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;gBAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;YACJ,IAAI,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO;gBACtC,MAAM,IAAI,kCAAkC,EAAE,CAAC;YACjD,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO;YACL,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC1B,UAAU;aACX,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,eAAe,GAAyC;QAC5D,GAAG,KAAK;QACR,YAAY;QACZ,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACrC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU;QAC5D,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,UAAU,EAAE,4BAA4B,CACtC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,SAAS,CAAC,WAAW,CACtB;aACF,CAAC;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;KAC/C,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC,CAAC,MAAM,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACzD,OAAO;QACL,GAAG,SAAS;QACZ,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QACtE,YAAY;QACZ,GAAG,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,0CAA0C,CACvD,OAAmD,EACnD,IAA4B;IAE5B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;QACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,cAAc;QACzB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC;QACH,8EAA8E;QAC9E,oCAAoC,CAAC;YACnC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YACxC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;YAC5C,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SACtC,CAAC,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzD,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC5D,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kCAAkC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,KAAK,CAAC,OAAO;oBACf,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,kEAAkE,CACnE,CAAC;YACN,CAAC;QACH,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAAmD;IAEnD,OAAO,0CAA0C,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,yCAAyC,GACpD,CAAC,OAAO,EAAE,EAAE,CAAC,0CAA0C,CAAC,OAAO,CAAC,CAAC;AAEnE,KAAK,UAAU,oBAAoB,CACjC,KAAiD,EACjD,OAA6C;IAE7C,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO;QACL,WAAW,EAAE,MAAM,2BAA2B,CAC5C,OAAO,EACP,KAAK,CAAC,WAAW,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAC/D;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uCAAuC,CACrD,OAA8B;IAC5B,WAAW,EAAE,IAAI,GAAG,EAAE;IACtB,MAAM,EAAE,IAAI,GAAG,EAAE;CAClB;IAED,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,0CAA0C,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import {\n createPrincipalPolicyHistoryVerifier,\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { ownPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryProtection\";\nimport {\n directoryHistoryProtection,\n scopedGroupHistoryProtection,\n} from \"../../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport {\n type PrincipalRecoveryContext,\n PrincipalRecoveryDirectoryAdvanced,\n type RecoveredPolicyDirectory,\n} from \"../recoveryOperation/principalRecoveryDirectory\";\nimport {\n createPrincipalRecoveryReader,\n type PrincipalRecoveryMemo,\n} from \"../recoveryOperation/principalRecoveryMemo\";\nimport type { RecoveredPrincipalHistoryPage } from \"./loadRecoveredPrincipalHistoryPage\";\nimport {\n PrincipalHistoryRecoveryRaceError,\n type RecoveredPrincipalPolicyHistory,\n type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nimport { recoverPrincipalHistoryPage } from \"./recoverPrincipalHistoryPage\";\nimport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n\nexport interface RecoverScopedPrincipalPolicyHistoryOptions\n extends PrincipalRecoveryContext {\n readonly reference: ReferencedPrincipalHead;\n /** Optional bounded display history ending before this exclusive version. */\n readonly historyPage?: { readonly beforeVersion?: number } | undefined;\n}\n\nexport interface RecoveredScopedPrincipalPolicyHistory\n extends RecoveredPrincipalPolicyHistory {\n /** Submit these with policy when atomically admitting its organization scope. */\n readonly dependencies: readonly VerifiedPrincipalPolicyCurrent[];\n readonly historyPage?: RecoveredPrincipalHistoryPage | undefined;\n}\n\n/** Internal result: valid only while every evidence producer behind it is. */\nexport interface ScopedPrincipalPolicyRecovery\n extends RecoveredScopedPrincipalPolicyHistory {\n readonly stillCurrent: () => boolean;\n}\n\nexport type ScopedPrincipalPolicyRecoveryBatch = (\n options: RecoverScopedPrincipalPolicyHistoryOptions,\n) => Promise<ScopedPrincipalPolicyRecovery>;\n\nfunction groupHead(directory: RecoveredPolicyDirectory, principalId: string) {\n const head = directory.descriptor.groupHeads.find(\n (entry) => entry.principalId === principalId,\n );\n if (!head)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Group is absent from the signed organization directory\",\n );\n return head;\n}\n\nfunction authorityHead(state: ReferencedPrincipalHead) {\n return {\n principalType: \"group\" as const,\n principalId: state.principalId,\n version: state.version,\n stateHash: state.stateHash,\n keyEpoch: state.keyEpoch,\n keyFingerprint: state.keyFingerprint,\n };\n}\n\nasync function recoverScopedPolicy(\n input: RecoverScopedPrincipalPolicyHistoryOptions,\n memo?: PrincipalRecoveryMemo,\n): Promise<ScopedPrincipalPolicyRecovery> {\n if (\n input.reference.principalType === \"organization\" &&\n input.reference.principalId !== input.organizationId\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Requested organization policy is outside its scope\",\n );\n const read = createPrincipalRecoveryReader(input, memo);\n // Reused or derived evidence keeps its producers' lifetimes to its use.\n const stillCurrent = () =>\n !input.signal?.aborted && input.stillCurrent() && read.stillCurrent();\n const directory = await read.directory(\n input.reference.principalType === \"organization\" ? [input.reference] : [],\n );\n if (input.reference.principalType === \"organization\")\n return {\n current: directory.current,\n policy: directory.policy,\n dependencies: [],\n stillCurrent,\n ...(await selectDisplayHistory(input, {\n ...input,\n expectedHead: principalPolicyReferenceFromBundle(directory.current),\n protection: directoryHistoryProtection(input.protection),\n })),\n };\n const expectedHead = groupHead(directory, input.reference.principalId);\n if (input.reference.version > expectedHead.version)\n throw new PrincipalRecoveryDirectoryAdvanced();\n const adminHead = groupHead(directory, directory.descriptor.adminGroupId);\n const isAdmins = expectedHead.principalId === adminHead.principalId;\n let admins: VerifiedPrincipalPolicyCurrent | null = null;\n if (!isAdmins) {\n admins = (await read.admins(adminHead)).policy;\n }\n const loadExternalAuthority = async (\n citations: readonly ReferencedPrincipalHead[],\n ): Promise<PrincipalPolicyExternalAuthority | undefined> => {\n const references = new Map<string, ReferencedPrincipalHead>();\n for (const citation of citations) {\n if (citation.principalId !== adminHead.principalId)\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Group cites another organization's Admins authority\",\n );\n if (citation.version > adminHead.version)\n throw new PrincipalRecoveryDirectoryAdvanced();\n references.set(`${citation.version}:${citation.stateHash}`, citation);\n }\n if (!references.size) return undefined;\n const recovered = await read.admins(adminHead, [...references.values()]);\n return {\n currentHead: adminHead,\n states: recovered.policy.retainedHistory.map(({ state, projection }) => ({\n head: authorityHead(state),\n projection,\n })),\n };\n };\n const recoveryOptions: RecoverPrincipalPolicyHistoryOptions = {\n ...input,\n expectedHead,\n retainedReferences: [input.reference],\n historyVerification: isAdmins ? \"direct-admins\" : \"standard\",\n ...(isAdmins\n ? {}\n : {\n protection: scopedGroupHistoryProtection(\n input.protection,\n input.organizationId,\n adminHead.principalId,\n ),\n }),\n ...(isAdmins ? {} : { loadExternalAuthority }),\n };\n const recovered = isAdmins\n ? await read.admins(expectedHead, [input.reference])\n : await recoverPrincipalPolicyHistory(recoveryOptions);\n return {\n ...recovered,\n dependencies: admins ? [directory.policy, admins] : [directory.policy],\n stillCurrent,\n ...(await selectDisplayHistory(input, recoveryOptions)),\n };\n}\n\n/** Recover signed directory and strict Admins dependencies without full histories. */\nasync function recoverScopedPrincipalPolicyHistoryInBatch(\n options: RecoverScopedPrincipalPolicyHistoryOptions,\n memo?: PrincipalRecoveryMemo,\n): Promise<ScopedPrincipalPolicyRecovery> {\n if (options.offline !== undefined && typeof options.offline !== \"boolean\")\n throw new KeyingVerificationError(\n \"invalid_shape\",\n \"Invalid principal history transport mode\",\n );\n if (!options.organizationId)\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Principal recovery requires an organization scope\",\n );\n const input = {\n historyReader: options.historyReader,\n execSql: options.execSql,\n organizationId: options.organizationId,\n offline: options.offline,\n resolveTrustedUserIdentity: options.resolveTrustedUserIdentity,\n signal: options.signal,\n stillCurrent: options.stillCurrent,\n reference: structuredClone(options.reference),\n historyPage: options.historyPage ? { ...options.historyPage } : undefined,\n protection: ownPrincipalHistoryProtection(options.protection),\n };\n try {\n // Reject malformed exact citations before any discovery or disposable writes.\n createPrincipalPolicyHistoryVerifier({\n principalId: input.reference.principalId,\n principalType: input.reference.principalType,\n retainedReferences: [input.reference],\n });\n for (let attempt = 0; attempt < 2; attempt += 1) {\n try {\n const recovered = await recoverScopedPolicy(input, memo);\n assertProjectionVerificationCurrent(recovered.stillCurrent);\n return recovered;\n } catch (error) {\n if (!(error instanceof PrincipalRecoveryDirectoryAdvanced)) throw error;\n memo?.directories.clear();\n memo?.admins.clear();\n if (input.offline)\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Requested principal evidence is newer than the offline directory\",\n );\n }\n }\n throw new PrincipalHistoryRecoveryRaceError(\n \"Organization directory remains behind the requested policy evidence\",\n );\n } finally {\n input.protection.localKey.fill(0);\n }\n}\n\nexport function recoverScopedPrincipalPolicyHistory(\n options: RecoverScopedPrincipalPolicyHistoryOptions,\n): Promise<RecoveredScopedPrincipalPolicyHistory> {\n return recoverScopedPrincipalPolicyHistoryInBatch(options);\n}\n\n/** Internal unbatched recovery that keeps its result's lifetime. */\nexport const recoverLeasedScopedPrincipalPolicyHistory: ScopedPrincipalPolicyRecoveryBatch =\n (options) => recoverScopedPrincipalPolicyHistoryInBatch(options);\n\nasync function selectDisplayHistory(\n input: RecoverScopedPrincipalPolicyHistoryOptions,\n options: RecoverPrincipalPolicyHistoryOptions,\n) {\n if (!input.historyPage) return {};\n return {\n historyPage: await recoverPrincipalHistoryPage(\n options,\n input.historyPage.beforeVersion ?? input.reference.version + 1,\n ),\n };\n}\n\n/** Internal runtime batch: shared results never outlive its operation or caller. */\nexport function createScopedPrincipalPolicyHistoryBatch(\n memo: PrincipalRecoveryMemo = {\n directories: new Map(),\n admins: new Map(),\n },\n): ScopedPrincipalPolicyRecoveryBatch {\n return (options) => recoverScopedPrincipalPolicyHistoryInBatch(options, memo);\n}\n"]}

package/workflows/principals/index.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 export type { PrincipalHistoryProtectionLease } from "../../data/principals/principalHistoryProtection.js";
-export { type AcknowledgedPrincipalPredecessor, captureAcknowledgedPrincipalPredecessor, } from "./acknowledgedPrincipalPredecessor.js";
-export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
-export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./principalHistoryRecoveryTypes.js";
-export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
-export { type ProjectionPolicyHistoryRecoveryOptions, recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
-export { type RecoveredScopedPrincipalPolicyHistory, type RecoverScopedPrincipalPolicyHistoryOptions, recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
+export { type AcknowledgedPrincipalPredecessor, captureAcknowledgedPrincipalPredecessor, } from "./acknowledgements/acknowledgedPrincipalPredecessor.js";
+export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./historyRecovery/principalHistoryRecoveryTypes.js";
+export { recoverPrincipalPolicyHistory } from "./historyRecovery/recoverPrincipalPolicyHistory.js";
+export { type RecoveredScopedPrincipalPolicyHistory, type RecoverScopedPrincipalPolicyHistoryOptions, recoverScopedPrincipalPolicyHistory, } from "./historyRecovery/recoverScopedPrincipalPolicyHistory.js";
+export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache/index.js";
+export { type ProjectionPolicyHistoryRecoveryOptions, recoverProjectionPolicyHistory, } from "./publicHistory/recoverProjectionPolicyHistory.js";

package/workflows/principals/index.js CHANGED Viewed

@@ -1,7 +1,7 @@
-export { captureAcknowledgedPrincipalPredecessor, } from "./acknowledgedPrincipalPredecessor.js";
-export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
-export { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
-export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
-export { recoverProjectionPolicyHistory, } from "./recoverProjectionPolicyHistory.js";
-export { recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
+export { captureAcknowledgedPrincipalPredecessor, } from "./acknowledgements/acknowledgedPrincipalPredecessor.js";
+export { PrincipalPolicyHistoryReadError, } from "./historyRecovery/principalHistoryRecoveryTypes.js";
+export { recoverPrincipalPolicyHistory } from "./historyRecovery/recoverPrincipalPolicyHistory.js";
+export { recoverScopedPrincipalPolicyHistory, } from "./historyRecovery/recoverScopedPrincipalPolicyHistory.js";
+export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache/index.js";
+export { recoverProjectionPolicyHistory, } from "./publicHistory/recoverProjectionPolicyHistory.js";
 //# sourceMappingURL=index.js.map

package/workflows/principals/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,uCAAuC,GACxC,MAAM,~~oCAAoC~~,CAAC;~~AAC5C~~,OAAO,~~EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,~~EACL,+BAA+B,GAGhC,MAAM,~~iCAAiC~~,CAAC;~~AACzC~~,OAAO,EAAE,6BAA6B,EAAE,MAAM,~~iCAAiC~~,CAAC;~~AAChF~~,OAAO,~~EAEL~~,~~8BAA8B~~,~~GAC/B~~,MAAM,~~kCAAkC~~,CAAC;~~AAC1C~~,OAAO,EAGL,~~mCAAmC~~,~~GACpC~~,MAAM,~~uCAAuC~~,CAAC","sourcesContent":["export type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nexport {\n type AcknowledgedPrincipalPredecessor,\n captureAcknowledgedPrincipalPredecessor,\n} from \"./acknowledgedPrincipalPredecessor\";\nexport {\n ~~type CachePrincipalPolicyBundlesOptions~~,\n type ~~CacheReferencedPrincipalPoliciesOptions~~,\n ~~cachePrincipalPolicyBundles~~,\n ~~cacheReferencedPrincipalPolicies,\n~~} from \"./~~policyCache~~\";\nexport {~~\n PrincipalPolicyHistoryReadError,\n type~~ ~~RecoveredPrincipalPolicyHistory,\n type~~ ~~RecoverPrincipalPolicyHistoryOptions,\n~~} from \"./~~principalHistoryRecoveryTypes~~\";\nexport { ~~recoverPrincipalPolicyHistory~~ } from \"./~~recoverPrincipalPolicyHistory~~\";\nexport {\n type ~~ProjectionPolicyHistoryRecoveryOptions~~,\n ~~recoverProjectionPolicyHistory~~,\n} from \"./~~recoverProjectionPolicyHistory~~\";\nexport {\n type ~~RecoveredScopedPrincipalPolicyHistory~~,\n ~~type RecoverScopedPrincipalPolicyHistoryOptions~~,\n ~~recoverScopedPrincipalPolicyHistory,\n~~} from \"./~~recoverScopedPrincipalPolicyHistory~~\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,uCAAuC,GACxC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,+BAA+B,GAGhC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,EAGL,mCAAmC,GACpC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC","sourcesContent":["export type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nexport {\n type AcknowledgedPrincipalPredecessor,\n captureAcknowledgedPrincipalPredecessor,\n} from \"./acknowledgements/acknowledgedPrincipalPredecessor\";\nexport {\n PrincipalPolicyHistoryReadError,\n type RecoveredPrincipalPolicyHistory,\n type RecoverPrincipalPolicyHistoryOptions,\n} from \"./historyRecovery/principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./historyRecovery/recoverPrincipalPolicyHistory\";\nexport {\n type RecoveredScopedPrincipalPolicyHistory,\n type RecoverScopedPrincipalPolicyHistoryOptions,\n recoverScopedPrincipalPolicyHistory,\n} from \"./historyRecovery/recoverScopedPrincipalPolicyHistory\";\nexport {\n type CachePrincipalPolicyBundlesOptions,\n type CacheReferencedPrincipalPoliciesOptions,\n cachePrincipalPolicyBundles,\n cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n type ProjectionPolicyHistoryRecoveryOptions,\n recoverProjectionPolicyHistory,\n} from \"./publicHistory/recoverProjectionPolicyHistory\";\n"]}

package/workflows/principals/{policyCache.d.ts → policyCache/index.d.ts} RENAMED Viewed

@@ -1,8 +1,8 @@
-import type { PrincipalPolicyBundleResponse, ReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
-import type { SecurityIncidentReporter } from "../../data/shared/securityIncidents.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
-import type { CurrentPrincipalPolicyReader } from "./currentPrincipalPolicyReader.js";
+import type { PrincipalPolicyBundleResponse, ReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { CurrentPrincipalPolicyReader } from "../currentPrincipalPolicyReader.js";
 export interface CacheReferencedPrincipalPoliciesOptions {
     currentPolicyReader: CurrentPrincipalPolicyReader;
     execSql: ExecSql;