@tearleads/client-sdk 0.1.62 → 0.1.64

package/data/keyingProjectionVerification/principalPolicy/mergeProjectionPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeProjectionPolicyEvidence.js","sourceRoot":"","sources":["mergeProjectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAK5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAEjG,SAAS,KAAK,CACZ,QAAiE,EACjE,IAA0C;IAE1C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;QACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;IACJ,IACE,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;QAC3C,CAAC,6BAA6B,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAExD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,QAAqD;IAErD,IAAI,SAAuD,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,SAAS,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC3D,IACE,QAAQ;gBACR,CAAC,CAAC,6BAA6B,CAC7B,QAAQ,CAAC,SAAS,EAClB,OAAO,CAAC,SAAS,CAClB;oBACC,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW;oBAC5D,QAAQ,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,aAAa;oBAChE,QAAQ,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU;oBAC1D,QAAQ,CAAC,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAErE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,oBAAoB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyHistorySourceResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport { principalHeadMatchesReference } from \"../../principals/organizationAuthorityDescriptor\";\n\nfunction newer(\n  previous: PrincipalPolicyHistorySourceResponse | null | undefined,\n  next: PrincipalPolicyHistorySourceResponse,\n): boolean {\n  if (!previous) return true;\n  if (previous.head.principalId !== next.head.principalId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Projection evidence crosses principals\",\n    );\n  if (\n    previous.head.version === next.head.version &&\n    !principalHeadMatchesReference(previous.head, next.head)\n  )\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Projection evidence contains conflicting heads\",\n    );\n  return previous.head.version < next.head.version;\n}\n\n/** Combine proof material when locally composing projections; verification follows. */\nexport function mergeProjectionPolicyEvidence(\n  evidence: readonly ProjectionPolicyEvidenceResponse[],\n): ProjectionPolicyEvidenceResponse {\n  let directory: ProjectionPolicyEvidenceResponse | undefined;\n  const groups = new Map<string, PrincipalPolicyHistorySourceResponse>();\n  const payloads = new Map<\n    string,\n    ProjectionPolicyEvidenceResponse[\"organizationPayloads\"][number]\n  >();\n  for (const proof of evidence) {\n    const organization = proof.organization;\n    if (organization && newer(directory?.organization, organization))\n      directory = proof;\n    for (const payload of proof.organizationPayloads) {\n      const previous = payloads.get(payload.reference.stateHash);\n      if (\n        previous &&\n        (!principalHeadMatchesReference(\n          previous.reference,\n          payload.reference,\n        ) ||\n          previous.payload.principalId !== payload.payload.principalId ||\n          previous.payload.principalType !== payload.payload.principalType ||\n          previous.payload.ciphertext !== payload.payload.ciphertext ||\n          previous.payload.ciphertextHash !== payload.payload.ciphertextHash)\n      )\n        throw new KeyingVerificationError(\n          \"hash_mismatch\",\n          \"Projection evidence contains conflicting directory payloads\",\n        );\n      payloads.set(payload.reference.stateHash, payload);\n    }\n    for (const group of proof.groups) {\n      const prior = groups.get(group.head.principalId);\n      if (newer(prior, group)) groups.set(group.head.principalId, group);\n    }\n  }\n  return {\n    organization: directory?.organization ?? null,\n    organizationPayloads: [...payloads.values()],\n    groups: [...groups.values()],\n  };\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/organizationFounderBinding.js

@@ -0,0 +1,41 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { rememberOrganizationFounder } from "../../persistence/organizationFounderPersistence.js";
+import { verifiedContainerCreateManifest } from "../container/containerCreateManifest.js";
+/**
+ * A directory can cite someone else's public policies. Bind its founder to the
+ * verified personal root's creator before trusting it to authorize a rehome.
+ * Metadata roots can be created by later admins and cannot establish this pin.
+ * This immutable identity anchor survives read-only verification and canceled
+ * views; it neither advances nor replaces a current-policy checkpoint.
+ */
+export async function rememberRootBoundOrganizationFounder(input) {
+    const { root } = input;
+    if (!root || root.state.systemSlot !== null)
+        return;
+    const organization = input.policies?.find((policy) => policy.principalType === "organization" &&
+        policy.principalId === root.state.organizationId);
+    if (!organization)
+        return;
+    const entries = "retainedHistory" in organization
+        ? organization.retainedHistory
+        : organization.history;
+    if (!entries)
+        return;
+    const genesis = entries.find(({ state }) => state.version === 1)?.state;
+    if (!genesis)
+        throw new KeyingVerificationError("missing_dependency", "Organization founder requires verified genesis");
+    const created = verifiedContainerCreateManifest({
+        head: root,
+        label: "Organization founder root",
+        verifiedByHash: input.verifiedByHash,
+    });
+    if (genesis?.signerUserId !== created.event.event.signerUserId ||
+        genesis.signerUserKeyFingerprint !==
+            created.event.event.signerKeyFingerprint)
+        throw new KeyingVerificationError("signer_mismatch", "Organization founder does not match its verified personal root's creator");
+    await rememberOrganizationFounder({
+        execSql: input.execSql,
+        organization,
+    });
+}
+//# sourceMappingURL=organizationFounderBinding.js.map

package/data/keyingProjectionVerification/principalPolicy/organizationFounderBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationFounderBinding.js","sourceRoot":"","sources":["organizationFounderBinding.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CACnD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,OAAO,GACX,iBAAiB,IAAI,YAAY;QAC/B,CAAC,CAAC,YAAY,CAAC,eAAe;QAC9B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;QAC1D,OAAO,CAAC,wBAAwB;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberOrganizationFounder } from \"../../persistence/organizationFounderPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { verifiedContainerCreateManifest } from \"../container/containerCreateManifest\";\n\n/**\n * A directory can cite someone else's public policies. Bind its founder to the\n * verified personal root's creator before trusting it to authorize a rehome.\n * Metadata roots can be created by later admins and cannot establish this pin.\n * This immutable identity anchor survives read-only verification and canceled\n * views; it neither advances nor replaces a current-policy checkpoint.\n */\nexport async function rememberRootBoundOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyAuthorization[] | undefined;\n  readonly root: VerifiedContainerAccessManifest | undefined;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<void> {\n  const { root } = input;\n  if (!root || root.state.systemSlot !== null) return;\n  const organization = input.policies?.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === root.state.organizationId,\n  );\n  if (!organization) return;\n  const entries =\n    \"retainedHistory\" in organization\n      ? organization.retainedHistory\n      : organization.history;\n  if (!entries) return;\n  const genesis = entries.find(({ state }) => state.version === 1)?.state;\n  if (!genesis)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const created = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Organization founder root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  if (\n    genesis?.signerUserId !== created.event.event.signerUserId ||\n    genesis.signerUserKeyFingerprint !==\n      created.event.event.signerKeyFingerprint\n  )\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Organization founder does not match its verified personal root's creator\",\n    );\n  await rememberOrganizationFounder({\n    execSql: input.execSql,\n    organization,\n  });\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js

@@ -0,0 +1,76 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpointPersistence.js";
+import { verifiedPrincipalPolicyMeetsCheckpoint } from "../../persistence/principalPolicyCheckpointSelection.js";
+import { loadPrincipalPolicyBundleForReference } from "../../persistence/principalPolicyReferencePersistence.js";
+import { principalPolicyEvidenceEntries, } from "../../principals/principalPolicyEvidence.js";
+import { principalStateMatchesReference } from "../../principals/principalPolicyStates.js";
+/**
+ * Cache key for a referenced principal policy. The in-memory principal-policy
+ * cache is populated and read from several call sites; they must agree on this
+ * format byte-for-byte or a populated entry looks uncached (extra warm fetches)
+ * — so this is the single source of truth, imported rather than re-declared.
+ */
+export function referencedPrincipalPolicyKey(reference) {
+    return JSON.stringify([
+        reference.principalType,
+        reference.principalId,
+        reference.version,
+        reference.stateHash,
+        reference.keyEpoch,
+        reference.keyFingerprint,
+    ]);
+}
+/**
+ * Dedupes references by their exact head identity, keyed with
+ * {@link referencedPrincipalPolicyKey} so every consumer agrees on what
+ * "the same reference" means. Later duplicates win, preserving each
+ * caller's original last-wins behavior.
+ */
+export function dedupeReferencedPrincipalStates(references) {
+    const referencesByState = new Map();
+    for (const reference of references) {
+        referencesByState.set(referencedPrincipalPolicyKey(reference), reference);
+    }
+    return Array.from(referencesByState.values());
+}
+export function principalPolicyCacheForVerifiedPolicies(policies) {
+    const cache = new Map();
+    for (const policy of policies) {
+        const states = principalPolicyEvidenceEntries(policy).map((entry) => entry.state);
+        for (const state of states) {
+            cache.set(referencedPrincipalPolicyKey({
+                principalType: state.principalType,
+                principalId: state.principalId,
+                version: state.version,
+                keyEpoch: state.keyEpoch,
+                stateHash: state.stateHash,
+                keyFingerprint: state.keyFingerprint,
+            }), policy);
+        }
+    }
+    return cache;
+}
+export function verifiedPrincipalPolicyContainsReference(policy, reference) {
+    const states = principalPolicyEvidenceEntries(policy).map(({ state }) => state);
+    return states.some((state) => principalStateMatchesReference(state, reference));
+}
+// Identify which referenced policies are absent from both the in-memory cache
+// and local storage, so the warmer fetches only what is genuinely missing.
+export async function filterUncachedPrincipalPolicyReferences(input) {
+    const results = await Promise.all(input.references.map(async (reference) => {
+        const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, reference.principalType, reference.principalId);
+        const cachedPolicy = input.principalPolicyCache.get(referencedPrincipalPolicyKey(reference));
+        if (cachedPolicy) {
+            if (!verifiedPrincipalPolicyContainsReference(cachedPolicy, reference)) {
+                throw new KeyingVerificationError("hash_mismatch", "in-memory principal policy cache does not match its exact reference");
+            }
+            if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, checkpoint)) {
+                return null;
+            }
+        }
+        const bundle = await loadPrincipalPolicyBundleForReference(input.execSql, reference, checkpoint);
+        return bundle ? null : reference;
+    }));
+    return results.filter((reference) => reference !== null);
+}
+//# sourceMappingURL=principalPolicyCache.js.map

package/data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCache.js","sourceRoot":"","sources":["principalPolicyCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,sCAAsC,EAAE,MAAM,sDAAsD,CAAC;AAC9G,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EAEL,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAGxF;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAkC;IAElC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,OAAO;QACjB,SAAS,CAAC,SAAS;QACnB,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,cAAc;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAE7C,UAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,iBAAiB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CACvB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CACP,4BAA4B,CAAC;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,EACF,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAAsC,EACtC,SAAkC;IAElC,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CACrB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,8BAA8B,CAAC,KAAK,EAAE,SAAS,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CACjD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,SAAS,CAAC,EAClE,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,SAAS,EAAwC,EAAE,CAAC,SAAS,KAAK,IAAI,CACxE,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpointPersistence\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"../../persistence/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicyReferencePersistence\";\nimport {\n  type PrincipalPolicyCurrentEvidence,\n  principalPolicyEvidenceEntries,\n} from \"../../principals/principalPolicyEvidence\";\nimport { principalStateMatchesReference } from \"../../principals/principalPolicyStates\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/**\n * Cache key for a referenced principal policy. The in-memory principal-policy\n * cache is populated and read from several call sites; they must agree on this\n * format byte-for-byte or a populated entry looks uncached (extra warm fetches)\n * — so this is the single source of truth, imported rather than re-declared.\n */\nexport function referencedPrincipalPolicyKey(\n  reference: ReferencedPrincipalHead,\n): string {\n  return JSON.stringify([\n    reference.principalType,\n    reference.principalId,\n    reference.version,\n    reference.stateHash,\n    reference.keyEpoch,\n    reference.keyFingerprint,\n  ]);\n}\n\n/**\n * Dedupes references by their exact head identity, keyed with\n * {@link referencedPrincipalPolicyKey} so every consumer agrees on what\n * \"the same reference\" means. Later duplicates win, preserving each\n * caller's original last-wins behavior.\n */\nexport function dedupeReferencedPrincipalStates<\n  TReference extends ReferencedPrincipalHead,\n>(references: ReadonlyArray<TReference>): TReference[] {\n  const referencesByState = new Map<string, TReference>();\n  for (const reference of references) {\n    referencesByState.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n  return Array.from(referencesByState.values());\n}\n\nexport function principalPolicyCacheForVerifiedPolicies(\n  policies: readonly PrincipalPolicyCurrentEvidence[],\n): Map<string, PrincipalPolicyCurrentEvidence> {\n  const cache = new Map<string, PrincipalPolicyCurrentEvidence>();\n  for (const policy of policies) {\n    const states = principalPolicyEvidenceEntries(policy).map(\n      (entry) => entry.state,\n    );\n    for (const state of states) {\n      cache.set(\n        referencedPrincipalPolicyKey({\n          principalType: state.principalType,\n          principalId: state.principalId,\n          version: state.version,\n          keyEpoch: state.keyEpoch,\n          stateHash: state.stateHash,\n          keyFingerprint: state.keyFingerprint,\n        }),\n        policy,\n      );\n    }\n  }\n  return cache;\n}\n\nexport function verifiedPrincipalPolicyContainsReference(\n  policy: PrincipalPolicyCurrentEvidence,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const states = principalPolicyEvidenceEntries(policy).map(\n    ({ state }) => state,\n  );\n  return states.some((state) =>\n    principalStateMatchesReference(state, reference),\n  );\n}\n\n// Identify which referenced policies are absent from both the in-memory cache\n// and local storage, so the warmer fetches only what is genuinely missing.\nexport async function filterUncachedPrincipalPolicyReferences(input: {\n  execSql: ExecSql;\n  principalPolicyCache: ReadonlyMap<string, PrincipalPolicyCurrentEvidence>;\n  references: readonly ReferencedPrincipalHead[];\n}): Promise<ReferencedPrincipalHead[]> {\n  const results = await Promise.all(\n    input.references.map(async (reference) => {\n      const checkpoint = await loadPrincipalPolicyCheckpoint(\n        input.execSql,\n        reference.principalType,\n        reference.principalId,\n      );\n      const cachedPolicy = input.principalPolicyCache.get(\n        referencedPrincipalPolicyKey(reference),\n      );\n      if (cachedPolicy) {\n        if (\n          !verifiedPrincipalPolicyContainsReference(cachedPolicy, reference)\n        ) {\n          throw new KeyingVerificationError(\n            \"hash_mismatch\",\n            \"in-memory principal policy cache does not match its exact reference\",\n          );\n        }\n        if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, checkpoint)) {\n          return null;\n        }\n      }\n      const bundle = await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      );\n      return bundle ? null : reference;\n    }),\n  );\n  return results.filter(\n    (reference): reference is ReferencedPrincipalHead => reference !== null,\n  );\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/principalPolicyVerification.js

@@ -0,0 +1,252 @@
+import { KeyingVerificationError, toFingerprint, verifyPrincipalPolicyBundle, } from "../../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpointPersistence.js";
+import { principalPolicyHeadMeetsCheckpoint, verifiedPrincipalPolicyMeetsCheckpoint, } from "../../persistence/principalPolicyCheckpointSelection.js";
+import { loadPrincipalPolicyBundle } from "../../persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../persistence/principalPolicyReferencePersistence.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../principals/organizationAuthorityDescriptor.js";
+import { organizationAdminExternalAuthority, principalPolicyReferenceFromBundle, verifyOrganizationAdminPolicy, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../principals/principalPolicyAdminSigners.js";
+import { principalPolicyBundleStates } from "../../principals/principalPolicyStates.js";
+import { observePrincipalPolicy, } from "../checkpoints/checkpointContext.js";
+import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
+import { rethrowProjectionVerificationBoundaryError } from "../error.js";
+import { assertProjectionVerificationCurrent, generationGuardedPrincipalPolicyWarmer, } from "../types.js";
+import { filterUncachedPrincipalPolicyReferences, referencedPrincipalPolicyKey, verifiedPrincipalPolicyContainsReference, } from "./principalPolicyCache.js";
+import { resolveReferencedPrincipalPolicy } from "./resolvedPrincipalPolicy.js";
+function principalPolicyReferenceLabel(reference) {
+    return `${reference.principalType}:${reference.principalId}@${reference.version}`;
+}
+/**
+ * A referenced principal policy is not in the local store and warming could
+ * not fetch it this pass — a transient cold-cache condition, typical for a
+ * member whose access arrives via a group policy the device has not hydrated
+ * yet. Sync passes discriminate on this type to defer the affected container
+ * and retry on a later trigger, rather than failing the whole pass.
+ */
+export class PrincipalPolicyNotCachedError extends Error {
+    constructor(referenceLabel) {
+        super(`Principal policy ${referenceLabel} is not cached`);
+        this.name = "PrincipalPolicyNotCachedError";
+    }
+}
+export function isPrincipalPolicyNotCachedError(error) {
+    return (error instanceof PrincipalPolicyNotCachedError ||
+        (error instanceof Error && error.name === "PrincipalPolicyNotCachedError"));
+}
+async function collectPrincipalPolicySignerPublicKeys(input) {
+    const signerPublicKeysByKey = new Map();
+    for (const state of principalPolicyBundleStates(input.bundle)) {
+        const cacheKey = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;
+        if (signerPublicKeysByKey.has(cacheKey)) {
+            continue;
+        }
+        const signerKey = await input.resolveUserKey(state.signerUserId);
+        if (!signerKey) {
+            throw new ProjectionDependencyUnavailableError(`${input.label} signer key could not be resolved for ${state.signerUserId}`);
+        }
+        const signingKeyFingerprint = await toFingerprint(signerKey.signingPublicKey);
+        if (signingKeyFingerprint !== state.signerUserKeyFingerprint) {
+            throw new KeyingVerificationError("signer_mismatch", `${input.label} signer key fingerprint mismatch`);
+        }
+        signerPublicKeysByKey.set(cacheKey, {
+            userId: state.signerUserId,
+            signingKeyFingerprint,
+            signingPublicKey: signerKey.signingPublicKey,
+        });
+    }
+    return [...signerPublicKeysByKey.values()];
+}
+async function loadOrganizationPolicyForVerification(input) {
+    const execSql = input.checkpointContext.execSql;
+    let bundle = await loadPrincipalPolicyBundle(execSql, "organization", input.organizationId);
+    if (!bundle) {
+        return undefined;
+    }
+    let localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, "organization", input.organizationId);
+    if (!principalPolicyHeadMeetsCheckpoint(bundle.currentState, localCheckpoint) &&
+        input.warmReferencedPrincipalPolicies) {
+        await input.warmReferencedPrincipalPolicies({
+            organizationId: input.organizationId,
+            references: [principalPolicyReferenceFromBundle(bundle)],
+        });
+        bundle = await loadPrincipalPolicyBundle(execSql, "organization", input.organizationId);
+        localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, "organization", input.organizationId);
+        if (!bundle) {
+            return undefined;
+        }
+    }
+    return { bundle, localCheckpoint };
+}
+function assertReservedAdminsPolicyShape(policy) {
+    const history = policy.history ?? [{ projection: policy.projection }];
+    if (history.some((entry) => entry.projection.length === 0 ||
+        entry.projection.some((member) => member.role !== "admin"))) {
+        throw new KeyingVerificationError("invalid_shape", "reserved Admins policy must contain only direct admin users");
+    }
+}
+async function verifyOrganizationAdminsPolicy(input) {
+    const adminBundle = await loadPrincipalPolicyBundle(input.execSql, "group", input.adminGroupId);
+    if (!adminBundle) {
+        return undefined;
+    }
+    if (!principalHeadMatchesReference(principalPolicyReferenceFromBundle(adminBundle), input.expectedHead)) {
+        throw new KeyingVerificationError("hash_mismatch", "Admins policy does not match the signed organization directory");
+    }
+    const adminCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", input.adminGroupId);
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: adminBundle,
+        label: `Admins policy ${input.adminGroupId}`,
+        resolveUserKey: input.resolveUserKey,
+    });
+    const verified = await verifyPrincipalPolicyBundle({
+        bundle: adminBundle,
+        expectedReference: input.expectedHead,
+        localCheckpoint: adminCheckpoint,
+        signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    assertReservedAdminsPolicyShape(verified.value);
+    return verified.value;
+}
+async function loadOrganizationExternalAuthority(input) {
+    const organizationPolicy = await loadOrganizationPolicyForVerification(input);
+    if (!organizationPolicy) {
+        return null;
+    }
+    try {
+        const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+            bundle: organizationPolicy.bundle,
+            label: `Organization policy ${input.organizationId}`,
+            resolveUserKey: input.resolveUserKey,
+        });
+        const verified = await verifyOrganizationAdminPolicy({
+            bundle: organizationPolicy.bundle,
+            localCheckpoint: organizationPolicy.localCheckpoint,
+            organizationId: input.organizationId,
+            signerPublicKeys,
+        });
+        if (!verified.ok) {
+            throw verified.error;
+        }
+        const descriptor = parseOrganizationAuthorityDescriptor(organizationPolicy.bundle.currentPayload.ciphertext);
+        if (descriptor.organizationId !== input.organizationId) {
+            throw new KeyingVerificationError("object_mismatch", "organization authority descriptor scope does not match");
+        }
+        const verifiedAdmins = await verifyOrganizationAdminsPolicy({
+            adminGroupId: descriptor.adminGroupId,
+            execSql: input.checkpointContext.execSql,
+            expectedHead: requireOrganizationGroupHead(descriptor, descriptor.adminGroupId),
+            resolveUserKey: input.resolveUserKey,
+        });
+        if (!verifiedAdmins) {
+            return null;
+        }
+        observePrincipalPolicy(input.checkpointContext, verified.value, input.organizationId);
+        observePrincipalPolicy(input.checkpointContext, verifiedAdmins, input.organizationId);
+        return organizationAdminExternalAuthority(verifiedAdmins);
+    }
+    catch (error) {
+        rethrowProjectionVerificationBoundaryError(error);
+        if (error instanceof KeyingVerificationError) {
+            throw error;
+        }
+        return null;
+    }
+}
+async function verifyReferencedPrincipalPolicy(input) {
+    // Scoped recovery carries organization, dependency and lifetime bindings.
+    // A bare policy cache entry cannot replace those bindings.
+    const recovered = await resolveReferencedPrincipalPolicy(input);
+    if (recovered)
+        return recovered;
+    const cacheKey = referencedPrincipalPolicyKey(input.reference);
+    const cachedPolicy = input.principalPolicyCache.get(cacheKey);
+    const execSql = input.checkpointContext.execSql;
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, input.reference.principalType, input.reference.principalId);
+    if (cachedPolicy && !("retainedHistory" in cachedPolicy)) {
+        if (!verifiedPrincipalPolicyContainsReference(cachedPolicy, input.reference)) {
+            throw new KeyingVerificationError("hash_mismatch", "in-memory principal policy cache does not match its exact reference");
+        }
+        if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, localCheckpoint)) {
+            observePrincipalPolicy(input.checkpointContext, cachedPolicy, input.organizationId);
+            return cachedPolicy;
+        }
+    }
+    const referenceLabel = principalPolicyReferenceLabel(input.reference);
+    let bundle = await loadPrincipalPolicyBundleForReference(execSql, input.reference, localCheckpoint);
+    if (!bundle && input.warmReferencedPrincipalPolicies) {
+        // The reference is not cached locally — the common case for a member who
+        // gained access via another org's group grant and never hydrated that
+        // group's policy. Fetch+verify+persist it, then re-read from the cache.
+        await input.warmReferencedPrincipalPolicies({
+            organizationId: input.organizationId,
+            references: [input.reference],
+        });
+        bundle = await loadPrincipalPolicyBundleForReference(execSql, input.reference, localCheckpoint);
+    }
+    if (!bundle) {
+        throw new PrincipalPolicyNotCachedError(referenceLabel);
+    }
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        label: `Principal policy ${referenceLabel}`,
+        resolveUserKey: input.resolveUserKey,
+    });
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: input.reference,
+        loadExternalAuthority: () => loadOrganizationExternalAuthority({
+            checkpointContext: input.checkpointContext,
+            organizationId: input.organizationId,
+            resolveUserKey: input.resolveUserKey,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        }),
+        localCheckpoint,
+        signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throw verified.error;
+    }
+    observePrincipalPolicy(input.checkpointContext, verified.value, input.organizationId);
+    input.principalPolicyCache.set(cacheKey, verified.value);
+    return verified.value;
+}
+export async function collectReferencedPrincipalPolicies(input) {
+    const warmReferencedPrincipalPolicies = generationGuardedPrincipalPolicyWarmer(input.warmReferencedPrincipalPolicies, input.stillCurrent);
+    const uniqueReferences = new Map();
+    for (const reference of input.references) {
+        uniqueReferences.set(referencedPrincipalPolicyKey(reference), reference);
+    }
+    const references = [...uniqueReferences.values()];
+    // Warm every missing reference in one batched fetch before verifying, so a
+    // path that references several uncached policies makes a single round of
+    // requests rather than one per reference.
+    if (warmReferencedPrincipalPolicies &&
+        !warmReferencedPrincipalPolicies.resolveReference) {
+        const uncached = await filterUncachedPrincipalPolicyReferences({
+            execSql: input.checkpointContext.execSql,
+            principalPolicyCache: input.principalPolicyCache,
+            references,
+        });
+        if (uncached.length > 0) {
+            assertProjectionVerificationCurrent(input.stillCurrent);
+            await warmReferencedPrincipalPolicies({
+                organizationId: input.organizationId,
+                references: uncached,
+            });
+            assertProjectionVerificationCurrent(input.stillCurrent);
+        }
+    }
+    // The warmer's operation shares one recovery view across its collections.
+    return Promise.all(references.map((reference) => verifyReferencedPrincipalPolicy({
+        checkpointContext: input.checkpointContext,
+        organizationId: input.organizationId,
+        principalPolicyCache: input.principalPolicyCache,
+        reference,
+        stillCurrent: input.stillCurrent,
+        resolveUserKey: input.resolveUserKey,
+        warmReferencedPrincipalPolicies,
+    })));
+}
+//# sourceMappingURL=principalPolicyVerification.js.map

package/data/keyingProjectionVerification/principalPolicy/principalPolicyVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyVerification.js","sourceRoot":"","sources":["principalPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,aAAa,EAEb,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EACL,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,6BAA6B,EAC7B,yDAAyD,GAC1D,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,UAAU,CAAC;AAMtE,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,uCAAuC,EACvC,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE7E,SAAS,6BAA6B,CACpC,SAAkC;IAElC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,cAAsB;QAChC,KAAK,CAAC,oBAAoB,cAAc,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,CACL,KAAK,YAAY,6BAA6B;QAC9C,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAIrD;IACC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC3E,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,oCAAoC,CAC5C,GAAG,KAAK,CAAC,KAAK,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,aAAa,CAC/C,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,IAAI,qBAAqB,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,kCAAkC,CACjD,CAAC;QACJ,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,qBAAqB;YACrB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,KAAmC;IAUnC,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,IAAI,MAAM,GAAG,MAAM,yBAAyB,CAC1C,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,GAAG,MAAM,6BAA6B,CACvD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IACE,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;QACzE,KAAK,CAAC,+BAA+B,EACrC,CAAC;QACD,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,yBAAyB,CACtC,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,eAAe,GAAG,MAAM,6BAA6B,CACnD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,+BAA+B,CACtC,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,WAAW,CAAC,EAC/C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,iBAAiB,KAAK,CAAC,YAAY,EAAE;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,WAAW;QACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe,EAAE,eAAe;QAChC,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,+BAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAmC;IAEnC,MAAM,kBAAkB,GAAG,MAAM,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;YACpE,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,KAAK,EAAE,uBAAuB,KAAK,CAAC,cAAc,EAAE;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,eAAe,EAAE,kBAAkB,CAAC,eAAe;YACnD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,MAAM,UAAU,GAAG,oCAAoC,CACrD,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CACpD,CAAC;QACF,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC;YAC1D,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;YACD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,kCAAkC,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0CAA0C,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,OAAO,EACP,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,KAAK,CAAC,SAAS,CAAC,WAAW,CAC5B,CAAC;IACF,IAAI,YAAY,IAAI,CAAC,CAAC,iBAAiB,IAAI,YAAY,CAAC,EAAE,CAAC;QACzD,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1E,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,YAAY,EACZ,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,MAAM,GAAG,MAAM,qCAAqC,CACtD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC;QACrD,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,qCAAqC,CAClD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,KAAK,EAAE,oBAAoB,cAAc,EAAE;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,qBAAqB,EAAE,GAAG,EAAE,CAC1B,iCAAiC,CAAC;YAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;SACxC,CAAC;QACJ,eAAe;QACf,gBAAgB;KACjB,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,2EAA2E;IAC3E,yEAAyE;IACzE,0CAA0C;IAC1C,IACE,+BAA+B;QAC/B,CAAC,+BAA+B,CAAC,gBAAgB,EACjD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAAC;YAC7D,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,+BAA+B,CAAC;gBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,+BAA+B,CAAC;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS;QACT,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B;KAChC,CAAC,CACH,CACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  toFingerprint,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpointPersistence\";\nimport {\n  principalPolicyHeadMeetsCheckpoint,\n  verifiedPrincipalPolicyMeetsCheckpoint,\n} from \"../../persistence/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundle } from \"../../persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicyReferencePersistence\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../principals/principalPolicyEvidence\";\nimport { principalPolicyBundleStates } from \"../../principals/principalPolicyStates\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { rethrowProjectionVerificationBoundaryError } from \"../error\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  filterUncachedPrincipalPolicyReferences,\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\nimport { resolveReferencedPrincipalPolicy } from \"./resolvedPrincipalPolicy\";\n\nfunction principalPolicyReferenceLabel(\n  reference: ReferencedPrincipalHead,\n): string {\n  return `${reference.principalType}:${reference.principalId}@${reference.version}`;\n}\n\n/**\n * A referenced principal policy is not in the local store and warming could\n * not fetch it this pass — a transient cold-cache condition, typical for a\n * member whose access arrives via a group policy the device has not hydrated\n * yet. Sync passes discriminate on this type to defer the affected container\n * and retry on a later trigger, rather than failing the whole pass.\n */\nexport class PrincipalPolicyNotCachedError extends Error {\n  constructor(referenceLabel: string) {\n    super(`Principal policy ${referenceLabel} is not cached`);\n    this.name = \"PrincipalPolicyNotCachedError\";\n  }\n}\n\nexport function isPrincipalPolicyNotCachedError(error: unknown): boolean {\n  return (\n    error instanceof PrincipalPolicyNotCachedError ||\n    (error instanceof Error && error.name === \"PrincipalPolicyNotCachedError\")\n  );\n}\n\nasync function collectPrincipalPolicySignerPublicKeys(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  label: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyBundleStates(input.bundle)) {\n    const cacheKey = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const signerKey = await input.resolveUserKey(state.signerUserId);\n    if (!signerKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `${input.label} signer key could not be resolved for ${state.signerUserId}`,\n      );\n    }\n\n    const signingKeyFingerprint = await toFingerprint(\n      signerKey.signingPublicKey,\n    );\n    if (signingKeyFingerprint !== state.signerUserKeyFingerprint) {\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        `${input.label} signer key fingerprint mismatch`,\n      );\n    }\n\n    signerPublicKeysByKey.set(cacheKey, {\n      userId: state.signerUserId,\n      signingKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    });\n  }\n\n  return [...signerPublicKeysByKey.values()];\n}\n\ntype OrganizationAdminPolicyInput = {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n};\n\nasync function loadOrganizationPolicyForVerification(\n  input: OrganizationAdminPolicyInput,\n): Promise<\n  | {\n      bundle: PrincipalPolicyBundleResponse;\n      localCheckpoint: Awaited<\n        ReturnType<typeof loadPrincipalPolicyCheckpoint>\n      >;\n    }\n  | undefined\n> {\n  const execSql = input.checkpointContext.execSql;\n  let bundle = await loadPrincipalPolicyBundle(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (!bundle) {\n    return undefined;\n  }\n  let localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (\n    !principalPolicyHeadMeetsCheckpoint(bundle.currentState, localCheckpoint) &&\n    input.warmReferencedPrincipalPolicies\n  ) {\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [principalPolicyReferenceFromBundle(bundle)],\n    });\n    bundle = await loadPrincipalPolicyBundle(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    localCheckpoint = await loadPrincipalPolicyCheckpoint(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) {\n      return undefined;\n    }\n  }\n\n  return { bundle, localCheckpoint };\n}\n\nfunction assertReservedAdminsPolicyShape(\n  policy: VerifiedPrincipalPolicy,\n): void {\n  const history = policy.history ?? [{ projection: policy.projection }];\n  if (\n    history.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\nasync function verifyOrganizationAdminsPolicy(input: {\n  adminGroupId: string;\n  execSql: ProjectionCheckpointContext[\"execSql\"];\n  expectedHead: ReferencedPrincipalHead;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<VerifiedPrincipalPolicy | undefined> {\n  const adminBundle = await loadPrincipalPolicyBundle(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!adminBundle) {\n    return undefined;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(adminBundle),\n      input.expectedHead,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Admins policy does not match the signed organization directory\",\n    );\n  }\n  const adminCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: adminBundle,\n    label: `Admins policy ${input.adminGroupId}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: adminBundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint: adminCheckpoint,\n    signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  assertReservedAdminsPolicyShape(verified.value);\n  return verified.value;\n}\n\nasync function loadOrganizationExternalAuthority(\n  input: OrganizationAdminPolicyInput,\n): Promise<ReturnType<typeof organizationAdminExternalAuthority> | null> {\n  const organizationPolicy = await loadOrganizationPolicyForVerification(input);\n  if (!organizationPolicy) {\n    return null;\n  }\n\n  try {\n    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n      bundle: organizationPolicy.bundle,\n      label: `Organization policy ${input.organizationId}`,\n      resolveUserKey: input.resolveUserKey,\n    });\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle: organizationPolicy.bundle,\n      localCheckpoint: organizationPolicy.localCheckpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys,\n    });\n    if (!verified.ok) {\n      throw verified.error;\n    }\n    const descriptor = parseOrganizationAuthorityDescriptor(\n      organizationPolicy.bundle.currentPayload.ciphertext,\n    );\n    if (descriptor.organizationId !== input.organizationId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization authority descriptor scope does not match\",\n      );\n    }\n    const verifiedAdmins = await verifyOrganizationAdminsPolicy({\n      adminGroupId: descriptor.adminGroupId,\n      execSql: input.checkpointContext.execSql,\n      expectedHead: requireOrganizationGroupHead(\n        descriptor,\n        descriptor.adminGroupId,\n      ),\n      resolveUserKey: input.resolveUserKey,\n    });\n    if (!verifiedAdmins) {\n      return null;\n    }\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verified.value,\n      input.organizationId,\n    );\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verifiedAdmins,\n      input.organizationId,\n    );\n    return organizationAdminExternalAuthority(verifiedAdmins);\n  } catch (error) {\n    rethrowProjectionVerificationBoundaryError(error);\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n\nasync function verifyReferencedPrincipalPolicy(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  reference: ReferencedPrincipalHead;\n  stillCurrent?: (() => boolean) | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n  // Scoped recovery carries organization, dependency and lifetime bindings.\n  // A bare policy cache entry cannot replace those bindings.\n  const recovered = await resolveReferencedPrincipalPolicy(input);\n  if (recovered) return recovered;\n  const cacheKey = referencedPrincipalPolicyKey(input.reference);\n  const cachedPolicy = input.principalPolicyCache.get(cacheKey);\n  const execSql = input.checkpointContext.execSql;\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    input.reference.principalType,\n    input.reference.principalId,\n  );\n  if (cachedPolicy && !(\"retainedHistory\" in cachedPolicy)) {\n    if (\n      !verifiedPrincipalPolicyContainsReference(cachedPolicy, input.reference)\n    ) {\n      throw new KeyingVerificationError(\n        \"hash_mismatch\",\n        \"in-memory principal policy cache does not match its exact reference\",\n      );\n    }\n    if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, localCheckpoint)) {\n      observePrincipalPolicy(\n        input.checkpointContext,\n        cachedPolicy,\n        input.organizationId,\n      );\n      return cachedPolicy;\n    }\n  }\n\n  const referenceLabel = principalPolicyReferenceLabel(input.reference);\n  let bundle = await loadPrincipalPolicyBundleForReference(\n    execSql,\n    input.reference,\n    localCheckpoint,\n  );\n  if (!bundle && input.warmReferencedPrincipalPolicies) {\n    // The reference is not cached locally — the common case for a member who\n    // gained access via another org's group grant and never hydrated that\n    // group's policy. Fetch+verify+persist it, then re-read from the cache.\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [input.reference],\n    });\n    bundle = await loadPrincipalPolicyBundleForReference(\n      execSql,\n      input.reference,\n      localCheckpoint,\n    );\n  }\n  if (!bundle) {\n    throw new PrincipalPolicyNotCachedError(referenceLabel);\n  }\n\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    label: `Principal policy ${referenceLabel}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: input.reference,\n      loadExternalAuthority: () =>\n        loadOrganizationExternalAuthority({\n          checkpointContext: input.checkpointContext,\n          organizationId: input.organizationId,\n          resolveUserKey: input.resolveUserKey,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n        }),\n      localCheckpoint,\n      signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n\n  observePrincipalPolicy(\n    input.checkpointContext,\n    verified.value,\n    input.organizationId,\n  );\n  input.principalPolicyCache.set(cacheKey, verified.value);\n  return verified.value;\n}\n\nexport async function collectReferencedPrincipalPolicies(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  references: readonly ReferencedPrincipalHead[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const warmReferencedPrincipalPolicies =\n    generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    );\n  const uniqueReferences = new Map<string, ReferencedPrincipalHead>();\n  for (const reference of input.references) {\n    uniqueReferences.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n\n  const references = [...uniqueReferences.values()];\n  // Warm every missing reference in one batched fetch before verifying, so a\n  // path that references several uncached policies makes a single round of\n  // requests rather than one per reference.\n  if (\n    warmReferencedPrincipalPolicies &&\n    !warmReferencedPrincipalPolicies.resolveReference\n  ) {\n    const uncached = await filterUncachedPrincipalPolicyReferences({\n      execSql: input.checkpointContext.execSql,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n    });\n    if (uncached.length > 0) {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      await warmReferencedPrincipalPolicies({\n        organizationId: input.organizationId,\n        references: uncached,\n      });\n      assertProjectionVerificationCurrent(input.stillCurrent);\n    }\n  }\n\n  // The warmer's operation shares one recovery view across its collections.\n  return Promise.all(\n    references.map((reference) =>\n      verifyReferencedPrincipalPolicy({\n        checkpointContext: input.checkpointContext,\n        organizationId: input.organizationId,\n        principalPolicyCache: input.principalPolicyCache,\n        reference,\n        stillCurrent: input.stillCurrent,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      }),\n    ),\n  );\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/projectionAuthorizationEvidence.js

@@ -0,0 +1,63 @@
+import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../../internal/crypto/index.js";
+import { observeProjectionLifetime } from "../projectionLifetimes.js";
+import { readAccessManifest } from "../readers.js";
+import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
+import { verifyProjectionPolicyEvidence } from "./projectionPolicyEvidence.js";
+/** Locally planned successors may cite an already verified, uncommitted policy. */
+async function resolveProjectionAuthorizationEvidence(input) {
+    const references = input.bundles
+        .flatMap((bundle) => readAccessManifest(bundle.manifest, "Projection manifest")
+        .referencedPrincipalHeads)
+        .filter((reference) => !input.evidence.some((policy) => principalPolicyMatchesReference({ policy, reference })));
+    const known = [...input.principalPolicyCache.values()];
+    if (references.some((reference) => !known.some((policy) => principalPolicyMatchesReference({ policy, reference }))))
+        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
+    return [
+        ...input.evidence,
+        ...(await collectReferencedPrincipalPolicies({
+            checkpointContext: input.checkpointContext,
+            organizationId: input.organizationId,
+            principalPolicyCache: input.principalPolicyCache,
+            references,
+            resolveUserKey: input.resolveUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        })),
+    ];
+}
+export async function verifyProjectionAuthorizationEvidence(input) {
+    const sources = [
+        input.policyEvidence.organization,
+        ...input.policyEvidence.groups,
+    ];
+    const known = [...input.principalPolicyCache.values()];
+    const references = input.bundles
+        .flatMap((bundle) => readAccessManifest(bundle.manifest, "Projection manifest")
+        .referencedPrincipalHeads)
+        .filter((reference) => {
+        if (sources.some((source) => source &&
+            source.head.principalType === reference.principalType &&
+            source.head.principalId === reference.principalId &&
+            source.head.version >= reference.version))
+            return true;
+        // Locally planned successors are verified below through the current-policy path.
+        if (known.some((policy) => principalPolicyMatchesReference({ policy, reference })))
+            return false;
+        throw new KeyingVerificationError("missing_dependency", "Projection omits required principal policy evidence");
+    });
+    const recovered = await verifyProjectionPolicyEvidence({
+        evidence: input.policyEvidence,
+        organizationId: input.organizationId,
+        references,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (input.policyEvidence.organization)
+        observeProjectionLifetime(input.checkpointContext, recovered.stillCurrent);
+    input.checkpointContext.authorizationPolicies.push(...recovered.policies);
+    return resolveProjectionAuthorizationEvidence({
+        ...input,
+        evidence: recovered.policies,
+    });
+}
+//# sourceMappingURL=projectionAuthorizationEvidence.js.map

package/data/keyingProjectionVerification/principalPolicy/projectionAuthorizationEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionAuthorizationEvidence.js","sourceRoot":"","sources":["projectionAuthorizationEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMhD,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAE5E,mFAAmF;AACnF,KAAK,UAAU,sCAAsC,CAAC,KAWrD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAGiE;IAEjE,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,cAAc,CAAC,YAAY;QACjC,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM;KAC/B,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACpB,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM;YACN,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YACrD,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YACjD,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAC3C;YAED,OAAO,IAAI,CAAC;QACd,iFAAiF;QACjF,IACE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD;YAED,OAAO,KAAK,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;QACrD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,cAAc,CAAC,YAAY;QACnC,yBAAyB,CAAC,KAAK,CAAC,iBAAiB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7E,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1E,OAAO,sCAAsC,CAAC;QAC5C,GAAG,KAAK;QACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { ProjectionCheckpointContext } from \"../checkpoints/checkpointContext\";\nimport { observeProjectionLifetime } from \"../projectionLifetimes\";\nimport { readAccessManifest } from \"../readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { verifyProjectionPolicyEvidence } from \"./projectionPolicyEvidence\";\n\n/** Locally planned successors may cite an already verified, uncommitted policy. */\nasync function resolveProjectionAuthorizationEvidence(input: {\n  readonly bundles: readonly AccessManifestBundleWireResponse[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly evidence: readonly PrincipalPolicyAuthorization[];\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<PrincipalPolicyAuthorization[]> {\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter(\n      (reference) =>\n        !input.evidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  const known = [...input.principalPolicyCache.values()];\n  if (\n    references.some(\n      (reference) =>\n        !known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  return [\n    ...input.evidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport async function verifyProjectionAuthorizationEvidence(\n  input: Omit<\n    Parameters<typeof resolveProjectionAuthorizationEvidence>[0],\n    \"evidence\"\n  > & { readonly policyEvidence: ProjectionPolicyEvidenceResponse },\n) {\n  const sources = [\n    input.policyEvidence.organization,\n    ...input.policyEvidence.groups,\n  ];\n  const known = [...input.principalPolicyCache.values()];\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter((reference) => {\n      if (\n        sources.some(\n          (source) =>\n            source &&\n            source.head.principalType === reference.principalType &&\n            source.head.principalId === reference.principalId &&\n            source.head.version >= reference.version,\n        )\n      )\n        return true;\n      // Locally planned successors are verified below through the current-policy path.\n      if (\n        known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        )\n      )\n        return false;\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Projection omits required principal policy evidence\",\n      );\n    });\n  const recovered = await verifyProjectionPolicyEvidence({\n    evidence: input.policyEvidence,\n    organizationId: input.organizationId,\n    references,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (input.policyEvidence.organization)\n    observeProjectionLifetime(input.checkpointContext, recovered.stillCurrent);\n  input.checkpointContext.authorizationPolicies.push(...recovered.policies);\n  return resolveProjectionAuthorizationEvidence({\n    ...input,\n    evidence: recovered.policies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/projectionPolicyEvidence.js

@@ -0,0 +1,23 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent, } from "../types.js";
+/** Recover public authorization without admitting historical heads as current policy. */
+export async function verifyProjectionPolicyEvidence(input) {
+    const stillCurrent = () => input.stillCurrent?.() !== false;
+    assertProjectionVerificationCurrent(stillCurrent);
+    if (!input.evidence.organization) {
+        if (input.evidence.groups.length ||
+            input.evidence.organizationPayloads.length ||
+            input.references.length)
+            throw new KeyingVerificationError("missing_dependency", "Projection omits required organization history");
+        return { policies: [], stillCurrent };
+    }
+    const resolve = input.warmReferencedPrincipalPolicies?.resolveProjectionHistory;
+    if (!resolve)
+        throw new ProjectionDependencyUnavailableError("Private projection history recovery is unavailable");
+    const result = await resolve({ ...input, stillCurrent });
+    assertProjectionVerificationCurrent(stillCurrent);
+    assertProjectionVerificationCurrent(result.stillCurrent);
+    return result;
+}
+//# sourceMappingURL=projectionPolicyEvidence.js.map

package/data/keyingProjectionVerification/principalPolicy/projectionPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionPolicyEvidence.js","sourceRoot":"","sources":["projectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EACL,mCAAmC,GAGpC,MAAM,UAAU,CAAC;AAElB,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;IAC5D,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,IACE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;YAC5B,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM;YAC1C,KAAK,CAAC,UAAU,CAAC,MAAM;YAEvB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;QACJ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GACX,KAAK,CAAC,+BAA+B,EAAE,wBAAwB,CAAC;IAClE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACzD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport {\n  assertProjectionVerificationCurrent,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedProjectionPolicyHistory,\n} from \"../types\";\n\n/** Recover public authorization without admitting historical heads as current policy. */\nexport async function verifyProjectionPolicyEvidence(input: {\n  readonly historicalProof?: boolean | undefined;\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly organizationId: string;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<ResolvedProjectionPolicyHistory> {\n  const stillCurrent = () => input.stillCurrent?.() !== false;\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!input.evidence.organization) {\n    if (\n      input.evidence.groups.length ||\n      input.evidence.organizationPayloads.length ||\n      input.references.length\n    )\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Projection omits required organization history\",\n      );\n    return { policies: [], stillCurrent };\n  }\n  const resolve =\n    input.warmReferencedPrincipalPolicies?.resolveProjectionHistory;\n  if (!resolve)\n    throw new ProjectionDependencyUnavailableError(\n      \"Private projection history recovery is unavailable\",\n    );\n  const result = await resolve({ ...input, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  assertProjectionVerificationCurrent(result.stillCurrent);\n  return result;\n}\n"]}