@tearleads/client-sdk 0.1.63 → 0.1.64

package/data/keyingProjectionVerification/{documentPurgeProofVerification.d.ts → documentPurge/documentPurgeProofVerification.d.ts}

@@ -1,8 +1,8 @@
-import { type AccessManifestCheckpoint, type PrincipalPolicyAuthorization, type VerifiedContainerAccessManifest } from "../../internal/crypto/index.js";
-import type { DocumentPurgeProofResponse } from "../../internal/validators/response/index.js";
-import type { ExecSql } from "../sqlite/sqlSchema.js";
-import { createProjectionCheckpointContext } from "./checkpointContext.js";
-import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "./types.js";
+import { type AccessManifestCheckpoint, type PrincipalPolicyAuthorization, type VerifiedContainerAccessManifest } from "../../../internal/crypto/index.js";
+import type { DocumentPurgeProofResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../sqlite/sqlSchema.js";
+import { createProjectionCheckpointContext } from "../checkpoints/checkpointContext.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../types.js";
 interface VerifyDocumentPurgeProofInput {
     readonly stillCurrent?: (() => boolean) | undefined;
     readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;

package/data/keyingProjectionVerification/{documentPurgeProofVerification.js → documentPurge/documentPurgeProofVerification.js}

@@ -1,16 +1,16 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { isDocumentPurgeProofResponse } from "../../internal/validators/response/index.js";
-import { addBundleByHash } from "./bundleVerification.js";
-import { createProjectionCheckpointContext, observeAccessManifestCheckpoints, } from "./checkpointContext.js";
-import { verifyContainerManifestPath } from "./containerPathVerification.js";
-import { verifiedContainerManifestsForBundles } from "./containerProjectionVerification.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { isDocumentPurgeProofResponse } from "../../../internal/validators/response/index.js";
+import { addBundleByHash } from "../checkpoints/bundleVerification.js";
+import { createProjectionCheckpointContext, observeAccessManifestCheckpoints, } from "../checkpoints/checkpointContext.js";
+import { verifyContainerManifestPath } from "../container/containerPathVerification.js";
+import { verifiedContainerManifestsForBundles } from "../container/containerProjectionVerification.js";
+import { verifyProjectionPolicyEvidence } from "../principalPolicy/projectionPolicyEvidence.js";
+import { observeProjectionLifetime } from "../projectionLifetimes.js";
+import { readAccessManifest } from "../readers.js";
+import { assertProjectionVerificationCurrent, } from "../types.js";
 import { commitDocumentPurgeCheckpoints, validateDocumentPurgeCheckpoints, } from "./documentPurgeCheckpointCurrency.js";
 import { recoverDocumentPurgePolicyCurrency } from "./documentPurgePolicyCurrency.js";
 import { authenticateDocumentPurgeArtifacts } from "./documentPurgePrincipalEvidence.js";
-import { observeProjectionLifetime } from "./projectionLifetimes.js";
-import { verifyProjectionPolicyEvidence } from "./projectionPolicyEvidence.js";
-import { readAccessManifest } from "./readers.js";
-import { assertProjectionVerificationCurrent, } from "./types.js";
 function collectContainerBundles(proof) {
     const bundlesByHash = new Map();
     for (const [index, bundle] of proof.authorizingContainerPath.entries()) {

package/data/keyingProjectionVerification/documentPurge/documentPurgeProofVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentPurgeProofVerification.js","sourceRoot":"","sources":["documentPurgeProofVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EACL,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8CAA8C,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EACL,mCAAmC,GAIpC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AA2BtF,SAAS,uBAAuB,CAC9B,KAA6B;IAE7B,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC;QACvE,eAAe,CACb,aAAa,EACb,MAAM,EACN,6CAA6C,KAAK,GAAG,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CACT,KAAK,EACL,MAAM,EACP,IAAI,KAAK,CAAC,gCAAgC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,eAAe,CACb,aAAa,EACb,MAAM,EACN,oCAAoC,KAAK,GAAG,CAC7C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CACT,SAAS,EACT,IAAI,EACL,IAAI,KAAK,CAAC,8BAA8B,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,eAAe,CACb,aAAa,EACb,MAAM,EACN,kCAAkC,SAAS,KAAK,WAAW,GAAG,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAQ/C;IACC,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,wBAAwB,GAAG,MAAM,2BAA2B,CAAC;QACjE,eAAe,EAAE,KAAK;QACtB,uBAAuB,EAAE,YAAY;QACrC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,yEAAyE;QACzE,uEAAuE;QACvE,uBAAuB,EAAE,KAAK;QAC9B,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QAC1C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,IAAI;QAClC,cAAc;KACf,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,2BAA2B,GAAG,IAAI,GAAG,EAGxC,CAAC;IACJ,2BAA2B,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE;QAC5D,GAAG,wBAAwB;KAC5B,CAAC,CAAC;IACH,KAAK,MAAM,CACT,KAAK,EACL,IAAI,EACL,IAAI,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;YACrD,eAAe,EAAE,KAAK;YACtB,uBAAuB,EAAE,YAAY;YACrC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,aAAa;YACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,KAAK;YAC9B,KAAK,EAAE,kCAAkC,KAAK,GAAG;YACjD,IAAI;YACJ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,4BAA4B,EAAE,IAAI;YAClC,cAAc;SACf,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxD,aAAa,EAAE,wBAAwB;QACvC,iBAAiB,EAAE,oCAAoC,CACrD,aAAa,EACb,cAAc,CACf;KACF,CAAC,CAAC;IACH,OAAO;QACL,wBAAwB;QACxB,2BAA2B;QAC3B,0BAA0B,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc;IAEd,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc,EAAE,QAAgB;IAChE,IAAI,MAAM,KAAK,QAAQ;QACrB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAAoC;IAEpC,MAAM,UAAU,GAAG,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAC3E,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC;SAC5D,wBAAwB,CAC9B,CAAC;IACF,IACE,CAAC,UAAU,CAAC,MAAM;QAClB,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY;YACtC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM;YACxC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC;QAEzD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mEAAmE,CACpE,CAAC;IACJ,OAAO,8BAA8B,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,sBAAsB;QAC5C,UAAU;QACV,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAiC;IAClE,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,YAAY;QACjC,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM;KAC/B,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,KAAoC,EACpC,uBAAgC;IAEhC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,IACE,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,kBAAkB;QACnD,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,sBAAsB;KAC7C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB,IAAI,IAAI,GAAG,EAAmC,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC1D,yBAAyB,CAAC,iBAAiB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,qBAAqB,GAAG,SAAS,CAAC,QAAQ,CAAC;IACjD,MAAM,EACJ,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,GAC3B,GAAG,MAAM,yBAAyB,CAAC;QAClC,qBAAqB;QACrB,iBAAiB;QACjB,oBAAoB;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAC3D,MAAM,kCAAkC,CAAC;QACvC,qBAAqB;QACrB,wBAAwB;QACxB,iBAAiB;QACjB,2BAA2B;QAC3B,uBAAuB;QACvB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B;KAC3B,CAAC,CAAC;IACL,wBAAwB,CACtB,gBAAgB,CAAC,KAAK,CAAC,cAAc,EACrC,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,uBAAuB;QAC9C,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,iBAAiB;YAC1B,cAAc,EAAE,KAAK,CAAC,sBAAsB;YAC5C,QAAQ,EAAE,iBAAiB;YAC3B,MAAM,EAAE,KAAK,CAAC,+BAA+B;YAC7C,YAAY,EAAE,SAAS,CAAC,YAAY;SACrC,CAAC;QACJ,CAAC,CAAC,iBAAiB,CAAC;IACtB,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,gCAAgC,CAAC;YACrC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB;YACjB,gBAAgB;YAChB,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,uBAAuB,GAAG;QAC9B,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,oBAAoB,EAAE,gBAAgB,CAAC,YAAY;QACnD,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC,cAAc;QACrD,cAAc;KACf,CAAC;IACF,OAAO;QACL,iBAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAC7C,8BAA8B,CAAC;YAC7B,OAAO,EAAE,iBAAiB;YAC1B,uBAAuB;YACvB,OAAO;YACP,iBAAiB;YACjB,gBAAgB;YAChB,sBAAsB;SACvB,CAAC;QACJ,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAoC;IAEpC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAoC;IAEpC,OAAO,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  KeyingVerificationError,\n  type PrincipalPolicyAuthorization,\n  type VerifiedContainerAccessManifest,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  DocumentPurgeProofResponse,\n} from \"@tearleads/validators/response\";\nimport { isDocumentPurgeProofResponse } from \"@tearleads/validators/response\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { addBundleByHash } from \"../checkpoints/bundleVerification\";\nimport {\n  createProjectionCheckpointContext,\n  observeAccessManifestCheckpoints,\n} from \"../checkpoints/checkpointContext\";\nimport { verifyContainerManifestPath } from \"../container/containerPathVerification\";\nimport { verifiedContainerManifestsForBundles } from \"../container/containerProjectionVerification\";\nimport { verifyProjectionPolicyEvidence } from \"../principalPolicy/projectionPolicyEvidence\";\nimport { observeProjectionLifetime } from \"../projectionLifetimes\";\nimport { readAccessManifest } from \"../readers\";\nimport {\n  assertProjectionVerificationCurrent,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  commitDocumentPurgeCheckpoints,\n  validateDocumentPurgeCheckpoints,\n} from \"./documentPurgeCheckpointCurrency\";\nimport { recoverDocumentPurgePolicyCurrency } from \"./documentPurgePolicyCurrency\";\nimport { authenticateDocumentPurgeArtifacts } from \"./documentPurgePrincipalEvidence\";\n\ninterface VerifyDocumentPurgeProofInput {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n  readonly execSql: ExecSql;\n  readonly expectedDocumentId: string;\n  readonly expectedOrganizationId: string;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly proof: DocumentPurgeProofResponse;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}\n\ninterface VerifiedDocumentPurgeProofCommit {\n  readonly commitCheckpoints: (execSql?: ExecSql) => Promise<void>;\n  readonly documentCheckpoint: AccessManifestCheckpoint;\n}\n\ntype PurgeContainerEvidence = Pick<\n  DocumentPurgeProofResponse,\n  | \"authorizingContainerPath\"\n  | \"documentContainerManifestHistory\"\n  | \"documentManifestContainerPaths\"\n>;\n\nfunction collectContainerBundles(\n  proof: PurgeContainerEvidence,\n): Map<string, AccessManifestBundleWireResponse> {\n  const bundlesByHash = new Map<string, AccessManifestBundleWireResponse>();\n  for (const [index, bundle] of proof.authorizingContainerPath.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document purge authorizing container path[${index}]`,\n    );\n  }\n  for (const [\n    index,\n    bundle,\n  ] of proof.documentContainerManifestHistory.entries()) {\n    addBundleByHash(\n      bundlesByHash,\n      bundle,\n      `Document purge container history[${index}]`,\n    );\n  }\n  for (const [\n    pathIndex,\n    path,\n  ] of proof.documentManifestContainerPaths.entries()) {\n    for (const [bundleIndex, bundle] of path.entries()) {\n      addBundleByHash(\n        bundlesByHash,\n        bundle,\n        `Document purge dependency path[${pathIndex}][${bundleIndex}]`,\n      );\n    }\n  }\n  return bundlesByHash;\n}\n\nexport async function verifyPurgeContainerPaths(input: {\n  readonly authorizationEvidence: readonly PrincipalPolicyAuthorization[];\n  readonly checkpointContext: ReturnType<\n    typeof createProjectionCheckpointContext\n  >;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly proof: PurgeContainerEvidence;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n}) {\n  const bundlesByHash = collectContainerBundles(input.proof);\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const authorizingContainerPath = await verifyContainerManifestPath({\n    servedAsCurrent: false,\n    authorizationMembership: \"referenced\",\n    authorizationEvidence: input.authorizationEvidence,\n    bundlesByHash,\n    checkpointContext: input.checkpointContext,\n    // Authenticate the signed path here; the complete purge's local currency\n    // is checked after its event and document evidence have authenticated.\n    enforceLocalCheckpoints: false,\n    label: \"Document purge authorizing container path\",\n    path: input.proof.authorizingContainerPath,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: input.resolveUserKey,\n    requireAuthorizationEvidence: true,\n    verifiedByHash,\n  });\n  const authorizingLeaf = authorizingContainerPath.at(-1);\n  if (!authorizingLeaf) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Document purge authorizing container path is empty\",\n    );\n  }\n  const containerPathByManifestHash = new Map<\n    string,\n    readonly VerifiedContainerAccessManifest[]\n  >();\n  containerPathByManifestHash.set(authorizingLeaf.manifestHash, [\n    ...authorizingContainerPath,\n  ]);\n  for (const [\n    index,\n    path,\n  ] of input.proof.documentManifestContainerPaths.entries()) {\n    const verifiedPath = await verifyContainerManifestPath({\n      servedAsCurrent: false,\n      authorizationMembership: \"referenced\",\n      authorizationEvidence: input.authorizationEvidence,\n      bundlesByHash,\n      checkpointContext: input.checkpointContext,\n      enforceLocalCheckpoints: false,\n      label: `Document purge dependency path[${index}]`,\n      path,\n      principalPolicyCache: input.principalPolicyCache,\n      resolveUserKey: input.resolveUserKey,\n      requireAuthorizationEvidence: true,\n      verifiedByHash,\n    });\n    const leaf = verifiedPath.at(-1);\n    if (leaf && !containerPathByManifestHash.has(leaf.manifestHash)) {\n      containerPathByManifestHash.set(leaf.manifestHash, verifiedPath);\n    }\n  }\n  // Purge verification consumes event citations only, never content-write\n  // headers, so historical evidence needs no pinned target-path grouping.\n  for (const [hash, manifest] of verifiedByHash) {\n    if (!containerPathByManifestHash.has(hash)) {\n      containerPathByManifestHash.set(hash, [manifest]);\n    }\n  }\n  observeAccessManifestCheckpoints(input.checkpointContext, {\n    verifiedHeads: authorizingContainerPath,\n    verifiedManifests: verifiedContainerManifestsForBundles(\n      bundlesByHash,\n      verifiedByHash,\n    ),\n  });\n  return {\n    authorizingContainerPath,\n    containerPathByManifestHash,\n    verifiedContainerManifests: new Map(verifiedByHash),\n  };\n}\n\nfunction requirePurgeProofShape(\n  proof: unknown,\n): asserts proof is DocumentPurgeProofResponse {\n  if (!isDocumentPurgeProofResponse(proof)) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Document purge proof has an invalid shape\",\n    );\n  }\n}\n\nfunction requirePurgeOrganization(actual: string, expected: string): void {\n  if (actual !== expected)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge proof belongs to another organization\",\n    );\n}\n\nasync function recoverPurgePolicyEvidence(\n  input: VerifyDocumentPurgeProofInput,\n) {\n  const references = [...collectContainerBundles(input.proof).values()].flatMap(\n    (bundle) =>\n      readAccessManifest(bundle.manifest, \"Purge container manifest\")\n        .referencedPrincipalHeads,\n  );\n  if (\n    !references.length &&\n    (input.proof.policyEvidence.organization ||\n      input.proof.policyEvidence.groups.length ||\n      input.proof.policyEvidence.organizationPayloads.length)\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Document purge proof includes unrelated principal policy evidence\",\n    );\n  return verifyProjectionPolicyEvidence({\n    evidence: input.proof.policyEvidence,\n    organizationId: input.expectedOrganizationId,\n    references,\n    historicalProof: true,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n\nfunction purgePrincipalSourceHeads(proof: DocumentPurgeProofResponse) {\n  return [\n    proof.policyEvidence.organization,\n    ...proof.policyEvidence.groups,\n  ].flatMap((source) => (source ? [source.head] : []));\n}\n\nasync function verifyDocumentPurgeProofWithMode(\n  input: VerifyDocumentPurgeProofInput,\n  enforceLocalCheckpoints: boolean,\n): Promise<VerifiedDocumentPurgeProofCommit> {\n  requirePurgeProofShape(input.proof);\n  input = { ...input, proof: structuredClone(input.proof) };\n  if (\n    input.proof.documentId !== input.expectedDocumentId ||\n    input.proof.documentManifest.manifestHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Document purge proof targets the wrong document\",\n    );\n  }\n  const checkpointContext = createProjectionCheckpointContext({\n    execSql: input.execSql,\n    organizationId: input.expectedOrganizationId,\n  });\n  const principalPolicyCache =\n    input.principalPolicyCache ?? new Map<string, VerifiedPrincipalPolicy>();\n  const recovered = await recoverPurgePolicyEvidence(input);\n  observeProjectionLifetime(checkpointContext, recovered.stillCurrent);\n  const authorizationEvidence = recovered.policies;\n  const {\n    authorizingContainerPath,\n    containerPathByManifestHash,\n    verifiedContainerManifests,\n  } = await verifyPurgeContainerPaths({\n    authorizationEvidence,\n    checkpointContext,\n    principalPolicyCache,\n    proof: input.proof,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const { documentManifest, principalPolicies, purgeEventHash } =\n    await authenticateDocumentPurgeArtifacts({\n      authorizationEvidence,\n      authorizingContainerPath,\n      checkpointContext,\n      containerPathByManifestHash,\n      enforceLocalCheckpoints,\n      expectedDocumentId: input.expectedDocumentId,\n      principalPolicyCache,\n      proof: input.proof,\n      resolveUserKey: input.resolveUserKey,\n      verifiedContainerManifests,\n    });\n  requirePurgeOrganization(\n    documentManifest.state.organizationId,\n    input.expectedOrganizationId,\n  );\n  const observedPrincipalHeads = purgePrincipalSourceHeads(input.proof);\n  assertProjectionVerificationCurrent(recovered.stillCurrent);\n  const currencyPolicies = enforceLocalCheckpoints\n    ? await recoverDocumentPurgePolicyCurrency({\n        context: checkpointContext,\n        organizationId: input.expectedOrganizationId,\n        policies: principalPolicies,\n        warmer: input.warmReferencedPrincipalPolicies,\n        stillCurrent: recovered.stillCurrent,\n      })\n    : principalPolicies;\n  if (enforceLocalCheckpoints) {\n    await validateDocumentPurgeCheckpoints({\n      context: checkpointContext,\n      execSql: input.execSql,\n      principalPolicies,\n      currencyPolicies,\n      observedPrincipalHeads,\n    });\n  }\n  const documentPurgeCheckpoint = {\n    documentId: input.expectedDocumentId,\n    documentManifestHash: documentManifest.manifestHash,\n    organizationId: documentManifest.state.organizationId,\n    purgeEventHash,\n  };\n  return {\n    commitCheckpoints: (execSql = input.execSql) =>\n      commitDocumentPurgeCheckpoints({\n        context: checkpointContext,\n        documentPurgeCheckpoint,\n        execSql,\n        principalPolicies,\n        currencyPolicies,\n        observedPrincipalHeads,\n      }),\n    documentCheckpoint: documentManifest.checkpoint,\n  };\n}\n\nexport async function verifyDocumentPurgeProofBaseline(\n  input: VerifyDocumentPurgeProofInput,\n): Promise<Pick<VerifiedDocumentPurgeProofCommit, \"documentCheckpoint\">> {\n  requirePurgeProofShape(input.proof);\n  const verified = await verifyDocumentPurgeProofWithMode(input, false);\n  return {\n    documentCheckpoint: verified.documentCheckpoint,\n  };\n}\n\nexport function verifyDocumentPurgeProof(\n  input: VerifyDocumentPurgeProofInput,\n): Promise<VerifiedDocumentPurgeProofCommit> {\n  return verifyDocumentPurgeProofWithMode(input, true);\n}\n"]}

package/data/keyingProjectionVerification/index.d.ts

@@ -1,9 +1,9 @@
 import type { ProjectionUserKeyResolver } from "./types.js";
-export { resolveEventContainerPaths } from "./documentDependencyPaths.js";
+export { resolveEventContainerPaths } from "./document/documentDependencyPaths.js";
 export { readAccessEvent, readRecordString, readRequiredRecordValue, } from "./readers.js";
 export type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer, } from "./types.js";
 export { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, } from "./types.js";
 export declare function requireProjectionUserKeyResolver(resolveProjectionUserKey: ProjectionUserKeyResolver | null | undefined, label: string): ProjectionUserKeyResolver;
-export { collectContainerWriterProjectionPrincipalPolicies, verifyContainerWriterProjection, } from "./containerProjectionVerification.js";
-export { type DocumentWriterProjectionAuthorization, verifyDocumentWriterProjection, verifyDocumentWriterProjectionAuthorization, } from "./documentProjectionVerification.js";
-export { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, } from "./documentPurgeProofVerification.js";
+export { collectContainerWriterProjectionPrincipalPolicies, verifyContainerWriterProjection, } from "./container/containerProjectionVerification.js";
+export { type DocumentWriterProjectionAuthorization, verifyDocumentWriterProjection, verifyDocumentWriterProjectionAuthorization, } from "./document/documentProjectionVerification.js";
+export { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, } from "./documentPurge/documentPurgeProofVerification.js";

package/data/keyingProjectionVerification/index.js

@@ -1,5 +1,5 @@
 import { requireTrustedUserIdentityResolver } from "../trustedUserIdentity/requiredResolver.js";
-export { resolveEventContainerPaths } from "./documentDependencyPaths.js";
+export { resolveEventContainerPaths } from "./document/documentDependencyPaths.js";
 export { readAccessEvent, readRecordString, readRequiredRecordValue, } from "./readers.js";
 export { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, } from "./types.js";
 export function requireProjectionUserKeyResolver(resolveProjectionUserKey, label) {
@@ -10,7 +10,7 @@ export function requireProjectionUserKeyResolver(resolveProjectionUserKey, label
     // provides the untrusted-shape and wrong-user guards (with identity caching).
     return requireTrustedUserIdentityResolver(resolveProjectionUserKey);
 }
-export { collectContainerWriterProjectionPrincipalPolicies, verifyContainerWriterProjection, } from "./containerProjectionVerification.js";
-export { verifyDocumentWriterProjection, verifyDocumentWriterProjectionAuthorization, } from "./documentProjectionVerification.js";
-export { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, } from "./documentPurgeProofVerification.js";
+export { collectContainerWriterProjectionPrincipalPolicies, verifyContainerWriterProjection, } from "./container/containerProjectionVerification.js";
+export { verifyDocumentWriterProjection, verifyDocumentWriterProjectionAuthorization, } from "./document/documentProjectionVerification.js";
+export { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, } from "./documentPurge/documentPurgeProofVerification.js";
 //# sourceMappingURL=index.js.map

package/data/keyingProjectionVerification/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAG7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAOnB,OAAO,EACL,sCAAsC,EACtC,wCAAwC,GACzC,MAAM,SAAS,CAAC;AAEjB,MAAM,UAAU,gCAAgC,CAC9C,wBAAsE,EACtE,KAAa;IAEb,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IACnE,CAAC;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,kCAAkC,CAAC,wBAAwB,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EACL,iDAAiD,EACjD,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,8BAA8B,EAC9B,2CAA2C,GAC5C,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,kCAAkC,CAAC","sourcesContent":["import { requireTrustedUserIdentityResolver } from \"../trustedUserIdentity/requiredResolver\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nexport { resolveEventContainerPaths } from \"./documentDependencyPaths\";\nexport {\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n} from \"./readers\";\n\nexport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nexport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n} from \"./types\";\n\nexport function requireProjectionUserKeyResolver(\n  resolveProjectionUserKey: ProjectionUserKeyResolver | null | undefined,\n  label: string,\n): ProjectionUserKeyResolver {\n  if (!resolveProjectionUserKey) {\n    throw new Error(`${label} requires projection key verification`);\n  }\n\n  // A ProjectionUserKey is a TrustedUserIdentity, so the shared adapter\n  // provides the untrusted-shape and wrong-user guards (with identity caching).\n  return requireTrustedUserIdentityResolver(resolveProjectionUserKey);\n}\n\nexport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  verifyContainerWriterProjection,\n} from \"./containerProjectionVerification\";\nexport {\n  type DocumentWriterProjectionAuthorization,\n  verifyDocumentWriterProjection,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"./documentProjectionVerification\";\nexport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n} from \"./documentPurgeProofVerification\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAG7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAOnB,OAAO,EACL,sCAAsC,EACtC,wCAAwC,GACzC,MAAM,SAAS,CAAC;AAEjB,MAAM,UAAU,gCAAgC,CAC9C,wBAAsE,EACtE,KAAa;IAEb,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IACnE,CAAC;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,kCAAkC,CAAC,wBAAwB,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EACL,iDAAiD,EACjD,+BAA+B,GAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAEL,8BAA8B,EAC9B,2CAA2C,GAC5C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,gDAAgD,CAAC","sourcesContent":["import { requireTrustedUserIdentityResolver } from \"../trustedUserIdentity/requiredResolver\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nexport { resolveEventContainerPaths } from \"./document/documentDependencyPaths\";\nexport {\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n} from \"./readers\";\n\nexport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nexport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n} from \"./types\";\n\nexport function requireProjectionUserKeyResolver(\n  resolveProjectionUserKey: ProjectionUserKeyResolver | null | undefined,\n  label: string,\n): ProjectionUserKeyResolver {\n  if (!resolveProjectionUserKey) {\n    throw new Error(`${label} requires projection key verification`);\n  }\n\n  // A ProjectionUserKey is a TrustedUserIdentity, so the shared adapter\n  // provides the untrusted-shape and wrong-user guards (with identity caching).\n  return requireTrustedUserIdentityResolver(resolveProjectionUserKey);\n}\n\nexport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  verifyContainerWriterProjection,\n} from \"./container/containerProjectionVerification\";\nexport {\n  type DocumentWriterProjectionAuthorization,\n  verifyDocumentWriterProjection,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"./document/documentProjectionVerification\";\nexport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n} from \"./documentPurge/documentPurgeProofVerification\";\n"]}

package/data/keyingProjectionVerification/{mergeProjectionPolicyEvidence.js → principalPolicy/mergeProjectionPolicyEvidence.js}

@@ -1,5 +1,5 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { principalHeadMatchesReference } from "../principals/organizationAuthorityDescriptor.js";
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { principalHeadMatchesReference } from "../../principals/organizationAuthorityDescriptor.js";
 function newer(previous, next) {
     if (!previous)
         return true;

package/data/keyingProjectionVerification/principalPolicy/mergeProjectionPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeProjectionPolicyEvidence.js","sourceRoot":"","sources":["mergeProjectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAK5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAEjG,SAAS,KAAK,CACZ,QAAiE,EACjE,IAA0C;IAE1C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW;QACrD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;IACJ,IACE,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;QAC3C,CAAC,6BAA6B,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAExD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,QAAqD;IAErD,IAAI,SAAuD,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,SAAS,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC3D,IACE,QAAQ;gBACR,CAAC,CAAC,6BAA6B,CAC7B,QAAQ,CAAC,SAAS,EAClB,OAAO,CAAC,SAAS,CAClB;oBACC,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW;oBAC5D,QAAQ,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,aAAa;oBAChE,QAAQ,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU;oBAC1D,QAAQ,CAAC,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAErE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,oBAAoB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyHistorySourceResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport { principalHeadMatchesReference } from \"../../principals/organizationAuthorityDescriptor\";\n\nfunction newer(\n  previous: PrincipalPolicyHistorySourceResponse | null | undefined,\n  next: PrincipalPolicyHistorySourceResponse,\n): boolean {\n  if (!previous) return true;\n  if (previous.head.principalId !== next.head.principalId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Projection evidence crosses principals\",\n    );\n  if (\n    previous.head.version === next.head.version &&\n    !principalHeadMatchesReference(previous.head, next.head)\n  )\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Projection evidence contains conflicting heads\",\n    );\n  return previous.head.version < next.head.version;\n}\n\n/** Combine proof material when locally composing projections; verification follows. */\nexport function mergeProjectionPolicyEvidence(\n  evidence: readonly ProjectionPolicyEvidenceResponse[],\n): ProjectionPolicyEvidenceResponse {\n  let directory: ProjectionPolicyEvidenceResponse | undefined;\n  const groups = new Map<string, PrincipalPolicyHistorySourceResponse>();\n  const payloads = new Map<\n    string,\n    ProjectionPolicyEvidenceResponse[\"organizationPayloads\"][number]\n  >();\n  for (const proof of evidence) {\n    const organization = proof.organization;\n    if (organization && newer(directory?.organization, organization))\n      directory = proof;\n    for (const payload of proof.organizationPayloads) {\n      const previous = payloads.get(payload.reference.stateHash);\n      if (\n        previous &&\n        (!principalHeadMatchesReference(\n          previous.reference,\n          payload.reference,\n        ) ||\n          previous.payload.principalId !== payload.payload.principalId ||\n          previous.payload.principalType !== payload.payload.principalType ||\n          previous.payload.ciphertext !== payload.payload.ciphertext ||\n          previous.payload.ciphertextHash !== payload.payload.ciphertextHash)\n      )\n        throw new KeyingVerificationError(\n          \"hash_mismatch\",\n          \"Projection evidence contains conflicting directory payloads\",\n        );\n      payloads.set(payload.reference.stateHash, payload);\n    }\n    for (const group of proof.groups) {\n      const prior = groups.get(group.head.principalId);\n      if (newer(prior, group)) groups.set(group.head.principalId, group);\n    }\n  }\n  return {\n    organization: directory?.organization ?? null,\n    organizationPayloads: [...payloads.values()],\n    groups: [...groups.values()],\n  };\n}\n"]}

package/data/keyingProjectionVerification/{organizationFounderBinding.js → principalPolicy/organizationFounderBinding.js}

@@ -1,6 +1,6 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { rememberOrganizationFounder } from "../persistence/organizationFounderPersistence.js";
-import { verifiedContainerCreateManifest } from "./containerCreateManifest.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { rememberOrganizationFounder } from "../../persistence/organizationFounderPersistence.js";
+import { verifiedContainerCreateManifest } from "../container/containerCreateManifest.js";
 /**
  * A directory can cite someone else's public policies. Bind its founder to the
  * verified personal root's creator before trusting it to authorize a rehome.

package/data/keyingProjectionVerification/principalPolicy/organizationFounderBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationFounderBinding.js","sourceRoot":"","sources":["organizationFounderBinding.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CACnD,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,OAAO,GACX,iBAAiB,IAAI,YAAY;QAC/B,CAAC,CAAC,YAAY,CAAC,eAAe;QAC9B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;QAC1D,OAAO,CAAC,wBAAwB;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB;QAE1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,MAAM,2BAA2B,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  type VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport { rememberOrganizationFounder } from \"../../persistence/organizationFounderPersistence\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { verifiedContainerCreateManifest } from \"../container/containerCreateManifest\";\n\n/**\n * A directory can cite someone else's public policies. Bind its founder to the\n * verified personal root's creator before trusting it to authorize a rehome.\n * Metadata roots can be created by later admins and cannot establish this pin.\n * This immutable identity anchor survives read-only verification and canceled\n * views; it neither advances nor replaces a current-policy checkpoint.\n */\nexport async function rememberRootBoundOrganizationFounder(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly PrincipalPolicyAuthorization[] | undefined;\n  readonly root: VerifiedContainerAccessManifest | undefined;\n  readonly verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>;\n}): Promise<void> {\n  const { root } = input;\n  if (!root || root.state.systemSlot !== null) return;\n  const organization = input.policies?.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === root.state.organizationId,\n  );\n  if (!organization) return;\n  const entries =\n    \"retainedHistory\" in organization\n      ? organization.retainedHistory\n      : organization.history;\n  if (!entries) return;\n  const genesis = entries.find(({ state }) => state.version === 1)?.state;\n  if (!genesis)\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Organization founder requires verified genesis\",\n    );\n  const created = verifiedContainerCreateManifest({\n    head: root,\n    label: \"Organization founder root\",\n    verifiedByHash: input.verifiedByHash,\n  });\n  if (\n    genesis?.signerUserId !== created.event.event.signerUserId ||\n    genesis.signerUserKeyFingerprint !==\n      created.event.event.signerKeyFingerprint\n  )\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"Organization founder does not match its verified personal root's creator\",\n    );\n  await rememberOrganizationFounder({\n    execSql: input.execSql,\n    organization,\n  });\n}\n"]}

package/data/keyingProjectionVerification/{principalPolicyCache.js → principalPolicy/principalPolicyCache.js}

@@ -1,9 +1,9 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
-import { verifiedPrincipalPolicyMeetsCheckpoint } from "../persistence/principalPolicyCheckpointSelection.js";
-import { loadPrincipalPolicyBundleForReference } from "../persistence/principalPolicyReferencePersistence.js";
-import { principalPolicyEvidenceEntries, } from "../principals/principalPolicyEvidence.js";
-import { principalStateMatchesReference } from "../principals/principalPolicyStates.js";
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpointPersistence.js";
+import { verifiedPrincipalPolicyMeetsCheckpoint } from "../../persistence/principalPolicyCheckpointSelection.js";
+import { loadPrincipalPolicyBundleForReference } from "../../persistence/principalPolicyReferencePersistence.js";
+import { principalPolicyEvidenceEntries, } from "../../principals/principalPolicyEvidence.js";
+import { principalStateMatchesReference } from "../../principals/principalPolicyStates.js";
 /**
  * Cache key for a referenced principal policy. The in-memory principal-policy
  * cache is populated and read from several call sites; they must agree on this

package/data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCache.js","sourceRoot":"","sources":["principalPolicyCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,sCAAsC,EAAE,MAAM,sDAAsD,CAAC;AAC9G,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EAEL,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAGxF;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAkC;IAElC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,OAAO;QACjB,SAAS,CAAC,SAAS;QACnB,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,cAAc;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAE7C,UAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,iBAAiB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CACvB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CACP,4BAA4B,CAAC;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,EACF,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAAsC,EACtC,SAAkC;IAElC,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CACrB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,8BAA8B,CAAC,KAAK,EAAE,SAAS,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CACjD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,SAAS,CAAC,EAClE,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,SAAS,EAAwC,EAAE,CAAC,SAAS,KAAK,IAAI,CACxE,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpointPersistence\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"../../persistence/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicyReferencePersistence\";\nimport {\n  type PrincipalPolicyCurrentEvidence,\n  principalPolicyEvidenceEntries,\n} from \"../../principals/principalPolicyEvidence\";\nimport { principalStateMatchesReference } from \"../../principals/principalPolicyStates\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/**\n * Cache key for a referenced principal policy. The in-memory principal-policy\n * cache is populated and read from several call sites; they must agree on this\n * format byte-for-byte or a populated entry looks uncached (extra warm fetches)\n * — so this is the single source of truth, imported rather than re-declared.\n */\nexport function referencedPrincipalPolicyKey(\n  reference: ReferencedPrincipalHead,\n): string {\n  return JSON.stringify([\n    reference.principalType,\n    reference.principalId,\n    reference.version,\n    reference.stateHash,\n    reference.keyEpoch,\n    reference.keyFingerprint,\n  ]);\n}\n\n/**\n * Dedupes references by their exact head identity, keyed with\n * {@link referencedPrincipalPolicyKey} so every consumer agrees on what\n * \"the same reference\" means. Later duplicates win, preserving each\n * caller's original last-wins behavior.\n */\nexport function dedupeReferencedPrincipalStates<\n  TReference extends ReferencedPrincipalHead,\n>(references: ReadonlyArray<TReference>): TReference[] {\n  const referencesByState = new Map<string, TReference>();\n  for (const reference of references) {\n    referencesByState.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n  return Array.from(referencesByState.values());\n}\n\nexport function principalPolicyCacheForVerifiedPolicies(\n  policies: readonly PrincipalPolicyCurrentEvidence[],\n): Map<string, PrincipalPolicyCurrentEvidence> {\n  const cache = new Map<string, PrincipalPolicyCurrentEvidence>();\n  for (const policy of policies) {\n    const states = principalPolicyEvidenceEntries(policy).map(\n      (entry) => entry.state,\n    );\n    for (const state of states) {\n      cache.set(\n        referencedPrincipalPolicyKey({\n          principalType: state.principalType,\n          principalId: state.principalId,\n          version: state.version,\n          keyEpoch: state.keyEpoch,\n          stateHash: state.stateHash,\n          keyFingerprint: state.keyFingerprint,\n        }),\n        policy,\n      );\n    }\n  }\n  return cache;\n}\n\nexport function verifiedPrincipalPolicyContainsReference(\n  policy: PrincipalPolicyCurrentEvidence,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const states = principalPolicyEvidenceEntries(policy).map(\n    ({ state }) => state,\n  );\n  return states.some((state) =>\n    principalStateMatchesReference(state, reference),\n  );\n}\n\n// Identify which referenced policies are absent from both the in-memory cache\n// and local storage, so the warmer fetches only what is genuinely missing.\nexport async function filterUncachedPrincipalPolicyReferences(input: {\n  execSql: ExecSql;\n  principalPolicyCache: ReadonlyMap<string, PrincipalPolicyCurrentEvidence>;\n  references: readonly ReferencedPrincipalHead[];\n}): Promise<ReferencedPrincipalHead[]> {\n  const results = await Promise.all(\n    input.references.map(async (reference) => {\n      const checkpoint = await loadPrincipalPolicyCheckpoint(\n        input.execSql,\n        reference.principalType,\n        reference.principalId,\n      );\n      const cachedPolicy = input.principalPolicyCache.get(\n        referencedPrincipalPolicyKey(reference),\n      );\n      if (cachedPolicy) {\n        if (\n          !verifiedPrincipalPolicyContainsReference(cachedPolicy, reference)\n        ) {\n          throw new KeyingVerificationError(\n            \"hash_mismatch\",\n            \"in-memory principal policy cache does not match its exact reference\",\n          );\n        }\n        if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, checkpoint)) {\n          return null;\n        }\n      }\n      const bundle = await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      );\n      return bundle ? null : reference;\n    }),\n  );\n  return results.filter(\n    (reference): reference is ReferencedPrincipalHead => reference !== null,\n  );\n}\n"]}

package/data/keyingProjectionVerification/{principalPolicyVerification.js → principalPolicy/principalPolicyVerification.js}

@@ -1,17 +1,17 @@
-import { KeyingVerificationError, toFingerprint, verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
-import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
-import { principalPolicyHeadMeetsCheckpoint, verifiedPrincipalPolicyMeetsCheckpoint, } from "../persistence/principalPolicyCheckpointSelection.js";
-import { loadPrincipalPolicyBundle } from "../persistence/principalPolicyPersistence.js";
-import { loadPrincipalPolicyBundleForReference } from "../persistence/principalPolicyReferencePersistence.js";
-import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../principals/organizationAuthorityDescriptor.js";
-import { organizationAdminExternalAuthority, principalPolicyReferenceFromBundle, verifyOrganizationAdminPolicy, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../principals/principalPolicyAdminSigners.js";
-import { principalPolicyBundleStates } from "../principals/principalPolicyStates.js";
-import { observePrincipalPolicy, } from "./checkpointContext.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { rethrowProjectionVerificationBoundaryError } from "./error.js";
+import { KeyingVerificationError, toFingerprint, verifyPrincipalPolicyBundle, } from "../../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpointPersistence.js";
+import { principalPolicyHeadMeetsCheckpoint, verifiedPrincipalPolicyMeetsCheckpoint, } from "../../persistence/principalPolicyCheckpointSelection.js";
+import { loadPrincipalPolicyBundle } from "../../persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../persistence/principalPolicyReferencePersistence.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../principals/organizationAuthorityDescriptor.js";
+import { organizationAdminExternalAuthority, principalPolicyReferenceFromBundle, verifyOrganizationAdminPolicy, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../principals/principalPolicyAdminSigners.js";
+import { principalPolicyBundleStates } from "../../principals/principalPolicyStates.js";
+import { observePrincipalPolicy, } from "../checkpoints/checkpointContext.js";
+import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
+import { rethrowProjectionVerificationBoundaryError } from "../error.js";
+import { assertProjectionVerificationCurrent, generationGuardedPrincipalPolicyWarmer, } from "../types.js";
 import { filterUncachedPrincipalPolicyReferences, referencedPrincipalPolicyKey, verifiedPrincipalPolicyContainsReference, } from "./principalPolicyCache.js";
 import { resolveReferencedPrincipalPolicy } from "./resolvedPrincipalPolicy.js";
-import { assertProjectionVerificationCurrent, generationGuardedPrincipalPolicyWarmer, } from "./types.js";
 function principalPolicyReferenceLabel(reference) {
     return `${reference.principalType}:${reference.principalId}@${reference.version}`;
 }

package/data/keyingProjectionVerification/principalPolicy/principalPolicyVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyVerification.js","sourceRoot":"","sources":["principalPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,aAAa,EAEb,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EACL,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,6BAA6B,EAC7B,yDAAyD,GAC1D,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,UAAU,CAAC;AAMtE,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,uCAAuC,EACvC,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE7E,SAAS,6BAA6B,CACpC,SAAkC;IAElC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,cAAsB;QAChC,KAAK,CAAC,oBAAoB,cAAc,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,CACL,KAAK,YAAY,6BAA6B;QAC9C,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAIrD;IACC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC3E,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,oCAAoC,CAC5C,GAAG,KAAK,CAAC,KAAK,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,aAAa,CAC/C,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,IAAI,qBAAqB,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,kCAAkC,CACjD,CAAC;QACJ,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,qBAAqB;YACrB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,KAAmC;IAUnC,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,IAAI,MAAM,GAAG,MAAM,yBAAyB,CAC1C,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,GAAG,MAAM,6BAA6B,CACvD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IACE,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;QACzE,KAAK,CAAC,+BAA+B,EACrC,CAAC;QACD,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,yBAAyB,CACtC,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,eAAe,GAAG,MAAM,6BAA6B,CACnD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,+BAA+B,CACtC,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,WAAW,CAAC,EAC/C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,iBAAiB,KAAK,CAAC,YAAY,EAAE;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,WAAW;QACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe,EAAE,eAAe;QAChC,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,+BAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAmC;IAEnC,MAAM,kBAAkB,GAAG,MAAM,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;YACpE,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,KAAK,EAAE,uBAAuB,KAAK,CAAC,cAAc,EAAE;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,eAAe,EAAE,kBAAkB,CAAC,eAAe;YACnD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,MAAM,UAAU,GAAG,oCAAoC,CACrD,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CACpD,CAAC;QACF,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC;YAC1D,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;YACD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,kCAAkC,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0CAA0C,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,OAAO,EACP,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,KAAK,CAAC,SAAS,CAAC,WAAW,CAC5B,CAAC;IACF,IAAI,YAAY,IAAI,CAAC,CAAC,iBAAiB,IAAI,YAAY,CAAC,EAAE,CAAC;QACzD,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1E,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,YAAY,EACZ,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,MAAM,GAAG,MAAM,qCAAqC,CACtD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC;QACrD,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,qCAAqC,CAClD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,KAAK,EAAE,oBAAoB,cAAc,EAAE;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,qBAAqB,EAAE,GAAG,EAAE,CAC1B,iCAAiC,CAAC;YAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;SACxC,CAAC;QACJ,eAAe;QACf,gBAAgB;KACjB,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,2EAA2E;IAC3E,yEAAyE;IACzE,0CAA0C;IAC1C,IACE,+BAA+B;QAC/B,CAAC,+BAA+B,CAAC,gBAAgB,EACjD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAAC;YAC7D,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,+BAA+B,CAAC;gBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,+BAA+B,CAAC;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS;QACT,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B;KAChC,CAAC,CACH,CACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  toFingerprint,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpointPersistence\";\nimport {\n  principalPolicyHeadMeetsCheckpoint,\n  verifiedPrincipalPolicyMeetsCheckpoint,\n} from \"../../persistence/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundle } from \"../../persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicyReferencePersistence\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../principals/principalPolicyEvidence\";\nimport { principalPolicyBundleStates } from \"../../principals/principalPolicyStates\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { rethrowProjectionVerificationBoundaryError } from \"../error\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  filterUncachedPrincipalPolicyReferences,\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\nimport { resolveReferencedPrincipalPolicy } from \"./resolvedPrincipalPolicy\";\n\nfunction principalPolicyReferenceLabel(\n  reference: ReferencedPrincipalHead,\n): string {\n  return `${reference.principalType}:${reference.principalId}@${reference.version}`;\n}\n\n/**\n * A referenced principal policy is not in the local store and warming could\n * not fetch it this pass — a transient cold-cache condition, typical for a\n * member whose access arrives via a group policy the device has not hydrated\n * yet. Sync passes discriminate on this type to defer the affected container\n * and retry on a later trigger, rather than failing the whole pass.\n */\nexport class PrincipalPolicyNotCachedError extends Error {\n  constructor(referenceLabel: string) {\n    super(`Principal policy ${referenceLabel} is not cached`);\n    this.name = \"PrincipalPolicyNotCachedError\";\n  }\n}\n\nexport function isPrincipalPolicyNotCachedError(error: unknown): boolean {\n  return (\n    error instanceof PrincipalPolicyNotCachedError ||\n    (error instanceof Error && error.name === \"PrincipalPolicyNotCachedError\")\n  );\n}\n\nasync function collectPrincipalPolicySignerPublicKeys(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  label: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyBundleStates(input.bundle)) {\n    const cacheKey = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const signerKey = await input.resolveUserKey(state.signerUserId);\n    if (!signerKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `${input.label} signer key could not be resolved for ${state.signerUserId}`,\n      );\n    }\n\n    const signingKeyFingerprint = await toFingerprint(\n      signerKey.signingPublicKey,\n    );\n    if (signingKeyFingerprint !== state.signerUserKeyFingerprint) {\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        `${input.label} signer key fingerprint mismatch`,\n      );\n    }\n\n    signerPublicKeysByKey.set(cacheKey, {\n      userId: state.signerUserId,\n      signingKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    });\n  }\n\n  return [...signerPublicKeysByKey.values()];\n}\n\ntype OrganizationAdminPolicyInput = {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n};\n\nasync function loadOrganizationPolicyForVerification(\n  input: OrganizationAdminPolicyInput,\n): Promise<\n  | {\n      bundle: PrincipalPolicyBundleResponse;\n      localCheckpoint: Awaited<\n        ReturnType<typeof loadPrincipalPolicyCheckpoint>\n      >;\n    }\n  | undefined\n> {\n  const execSql = input.checkpointContext.execSql;\n  let bundle = await loadPrincipalPolicyBundle(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (!bundle) {\n    return undefined;\n  }\n  let localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (\n    !principalPolicyHeadMeetsCheckpoint(bundle.currentState, localCheckpoint) &&\n    input.warmReferencedPrincipalPolicies\n  ) {\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [principalPolicyReferenceFromBundle(bundle)],\n    });\n    bundle = await loadPrincipalPolicyBundle(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    localCheckpoint = await loadPrincipalPolicyCheckpoint(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) {\n      return undefined;\n    }\n  }\n\n  return { bundle, localCheckpoint };\n}\n\nfunction assertReservedAdminsPolicyShape(\n  policy: VerifiedPrincipalPolicy,\n): void {\n  const history = policy.history ?? [{ projection: policy.projection }];\n  if (\n    history.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\nasync function verifyOrganizationAdminsPolicy(input: {\n  adminGroupId: string;\n  execSql: ProjectionCheckpointContext[\"execSql\"];\n  expectedHead: ReferencedPrincipalHead;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<VerifiedPrincipalPolicy | undefined> {\n  const adminBundle = await loadPrincipalPolicyBundle(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!adminBundle) {\n    return undefined;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(adminBundle),\n      input.expectedHead,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Admins policy does not match the signed organization directory\",\n    );\n  }\n  const adminCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: adminBundle,\n    label: `Admins policy ${input.adminGroupId}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: adminBundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint: adminCheckpoint,\n    signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  assertReservedAdminsPolicyShape(verified.value);\n  return verified.value;\n}\n\nasync function loadOrganizationExternalAuthority(\n  input: OrganizationAdminPolicyInput,\n): Promise<ReturnType<typeof organizationAdminExternalAuthority> | null> {\n  const organizationPolicy = await loadOrganizationPolicyForVerification(input);\n  if (!organizationPolicy) {\n    return null;\n  }\n\n  try {\n    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n      bundle: organizationPolicy.bundle,\n      label: `Organization policy ${input.organizationId}`,\n      resolveUserKey: input.resolveUserKey,\n    });\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle: organizationPolicy.bundle,\n      localCheckpoint: organizationPolicy.localCheckpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys,\n    });\n    if (!verified.ok) {\n      throw verified.error;\n    }\n    const descriptor = parseOrganizationAuthorityDescriptor(\n      organizationPolicy.bundle.currentPayload.ciphertext,\n    );\n    if (descriptor.organizationId !== input.organizationId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization authority descriptor scope does not match\",\n      );\n    }\n    const verifiedAdmins = await verifyOrganizationAdminsPolicy({\n      adminGroupId: descriptor.adminGroupId,\n      execSql: input.checkpointContext.execSql,\n      expectedHead: requireOrganizationGroupHead(\n        descriptor,\n        descriptor.adminGroupId,\n      ),\n      resolveUserKey: input.resolveUserKey,\n    });\n    if (!verifiedAdmins) {\n      return null;\n    }\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verified.value,\n      input.organizationId,\n    );\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verifiedAdmins,\n      input.organizationId,\n    );\n    return organizationAdminExternalAuthority(verifiedAdmins);\n  } catch (error) {\n    rethrowProjectionVerificationBoundaryError(error);\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n\nasync function verifyReferencedPrincipalPolicy(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  reference: ReferencedPrincipalHead;\n  stillCurrent?: (() => boolean) | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n  // Scoped recovery carries organization, dependency and lifetime bindings.\n  // A bare policy cache entry cannot replace those bindings.\n  const recovered = await resolveReferencedPrincipalPolicy(input);\n  if (recovered) return recovered;\n  const cacheKey = referencedPrincipalPolicyKey(input.reference);\n  const cachedPolicy = input.principalPolicyCache.get(cacheKey);\n  const execSql = input.checkpointContext.execSql;\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    input.reference.principalType,\n    input.reference.principalId,\n  );\n  if (cachedPolicy && !(\"retainedHistory\" in cachedPolicy)) {\n    if (\n      !verifiedPrincipalPolicyContainsReference(cachedPolicy, input.reference)\n    ) {\n      throw new KeyingVerificationError(\n        \"hash_mismatch\",\n        \"in-memory principal policy cache does not match its exact reference\",\n      );\n    }\n    if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, localCheckpoint)) {\n      observePrincipalPolicy(\n        input.checkpointContext,\n        cachedPolicy,\n        input.organizationId,\n      );\n      return cachedPolicy;\n    }\n  }\n\n  const referenceLabel = principalPolicyReferenceLabel(input.reference);\n  let bundle = await loadPrincipalPolicyBundleForReference(\n    execSql,\n    input.reference,\n    localCheckpoint,\n  );\n  if (!bundle && input.warmReferencedPrincipalPolicies) {\n    // The reference is not cached locally — the common case for a member who\n    // gained access via another org's group grant and never hydrated that\n    // group's policy. Fetch+verify+persist it, then re-read from the cache.\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [input.reference],\n    });\n    bundle = await loadPrincipalPolicyBundleForReference(\n      execSql,\n      input.reference,\n      localCheckpoint,\n    );\n  }\n  if (!bundle) {\n    throw new PrincipalPolicyNotCachedError(referenceLabel);\n  }\n\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    label: `Principal policy ${referenceLabel}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: input.reference,\n      loadExternalAuthority: () =>\n        loadOrganizationExternalAuthority({\n          checkpointContext: input.checkpointContext,\n          organizationId: input.organizationId,\n          resolveUserKey: input.resolveUserKey,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n        }),\n      localCheckpoint,\n      signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n\n  observePrincipalPolicy(\n    input.checkpointContext,\n    verified.value,\n    input.organizationId,\n  );\n  input.principalPolicyCache.set(cacheKey, verified.value);\n  return verified.value;\n}\n\nexport async function collectReferencedPrincipalPolicies(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  references: readonly ReferencedPrincipalHead[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const warmReferencedPrincipalPolicies =\n    generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    );\n  const uniqueReferences = new Map<string, ReferencedPrincipalHead>();\n  for (const reference of input.references) {\n    uniqueReferences.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n\n  const references = [...uniqueReferences.values()];\n  // Warm every missing reference in one batched fetch before verifying, so a\n  // path that references several uncached policies makes a single round of\n  // requests rather than one per reference.\n  if (\n    warmReferencedPrincipalPolicies &&\n    !warmReferencedPrincipalPolicies.resolveReference\n  ) {\n    const uncached = await filterUncachedPrincipalPolicyReferences({\n      execSql: input.checkpointContext.execSql,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n    });\n    if (uncached.length > 0) {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      await warmReferencedPrincipalPolicies({\n        organizationId: input.organizationId,\n        references: uncached,\n      });\n      assertProjectionVerificationCurrent(input.stillCurrent);\n    }\n  }\n\n  // The warmer's operation shares one recovery view across its collections.\n  return Promise.all(\n    references.map((reference) =>\n      verifyReferencedPrincipalPolicy({\n        checkpointContext: input.checkpointContext,\n        organizationId: input.organizationId,\n        principalPolicyCache: input.principalPolicyCache,\n        reference,\n        stillCurrent: input.stillCurrent,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      }),\n    ),\n  );\n}\n"]}

package/data/keyingProjectionVerification/{projectionAuthorizationEvidence.js → principalPolicy/projectionAuthorizationEvidence.js}

@@ -1,8 +1,8 @@
-import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
+import { KeyingVerificationError, principalPolicyMatchesReference, } from "../../../internal/crypto/index.js";
+import { observeProjectionLifetime } from "../projectionLifetimes.js";
+import { readAccessManifest } from "../readers.js";
 import { collectReferencedPrincipalPolicies } from "./principalPolicyVerification.js";
-import { observeProjectionLifetime } from "./projectionLifetimes.js";
 import { verifyProjectionPolicyEvidence } from "./projectionPolicyEvidence.js";
-import { readAccessManifest } from "./readers.js";
 /** Locally planned successors may cite an already verified, uncommitted policy. */
 async function resolveProjectionAuthorizationEvidence(input) {
     const references = input.bundles

package/data/keyingProjectionVerification/principalPolicy/projectionAuthorizationEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionAuthorizationEvidence.js","sourceRoot":"","sources":["projectionAuthorizationEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMhD,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAE5E,mFAAmF;AACnF,KAAK,UAAU,sCAAsC,CAAC,KAWrD;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9B,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ,CAAC;IACJ,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD,CACJ;QAED,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,GAAG,CAAC,MAAM,kCAAkC,CAAC;YAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAGiE;IAEjE,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,cAAc,CAAC,YAAY;QACjC,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM;KAC/B,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO;SAC7B,OAAO,CACN,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACvD,wBAAwB,CAC9B;SACA,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACpB,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM;YACN,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YACrD,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YACjD,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAC3C;YAED,OAAO,IAAI,CAAC;QACd,iFAAiF;QACjF,IACE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACvD;YAED,OAAO,KAAK,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;QACrD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,cAAc,CAAC,YAAY;QACnC,yBAAyB,CAAC,KAAK,CAAC,iBAAiB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7E,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1E,OAAO,sCAAsC,CAAC;QAC5C,GAAG,KAAK;QACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyAuthorization } from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWireResponse,\n  ProjectionPolicyEvidenceResponse,\n} from \"@tearleads/validators/response\";\nimport type { ProjectionCheckpointContext } from \"../checkpoints/checkpointContext\";\nimport { observeProjectionLifetime } from \"../projectionLifetimes\";\nimport { readAccessManifest } from \"../readers\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport { collectReferencedPrincipalPolicies } from \"./principalPolicyVerification\";\nimport { verifyProjectionPolicyEvidence } from \"./projectionPolicyEvidence\";\n\n/** Locally planned successors may cite an already verified, uncommitted policy. */\nasync function resolveProjectionAuthorizationEvidence(input: {\n  readonly bundles: readonly AccessManifestBundleWireResponse[];\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly evidence: readonly PrincipalPolicyAuthorization[];\n  readonly organizationId: string;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<PrincipalPolicyAuthorization[]> {\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter(\n      (reference) =>\n        !input.evidence.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    );\n  const known = [...input.principalPolicyCache.values()];\n  if (\n    references.some(\n      (reference) =>\n        !known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        ),\n    )\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Projection omits required principal policy evidence\",\n    );\n  return [\n    ...input.evidence,\n    ...(await collectReferencedPrincipalPolicies({\n      checkpointContext: input.checkpointContext,\n      organizationId: input.organizationId,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    })),\n  ];\n}\n\nexport async function verifyProjectionAuthorizationEvidence(\n  input: Omit<\n    Parameters<typeof resolveProjectionAuthorizationEvidence>[0],\n    \"evidence\"\n  > & { readonly policyEvidence: ProjectionPolicyEvidenceResponse },\n) {\n  const sources = [\n    input.policyEvidence.organization,\n    ...input.policyEvidence.groups,\n  ];\n  const known = [...input.principalPolicyCache.values()];\n  const references = input.bundles\n    .flatMap(\n      (bundle) =>\n        readAccessManifest(bundle.manifest, \"Projection manifest\")\n          .referencedPrincipalHeads,\n    )\n    .filter((reference) => {\n      if (\n        sources.some(\n          (source) =>\n            source &&\n            source.head.principalType === reference.principalType &&\n            source.head.principalId === reference.principalId &&\n            source.head.version >= reference.version,\n        )\n      )\n        return true;\n      // Locally planned successors are verified below through the current-policy path.\n      if (\n        known.some((policy) =>\n          principalPolicyMatchesReference({ policy, reference }),\n        )\n      )\n        return false;\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Projection omits required principal policy evidence\",\n      );\n    });\n  const recovered = await verifyProjectionPolicyEvidence({\n    evidence: input.policyEvidence,\n    organizationId: input.organizationId,\n    references,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (input.policyEvidence.organization)\n    observeProjectionLifetime(input.checkpointContext, recovered.stillCurrent);\n  input.checkpointContext.authorizationPolicies.push(...recovered.policies);\n  return resolveProjectionAuthorizationEvidence({\n    ...input,\n    evidence: recovered.policies,\n  });\n}\n"]}

package/data/keyingProjectionVerification/{projectionPolicyEvidence.js → principalPolicy/projectionPolicyEvidence.js}

@@ -1,6 +1,6 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { assertProjectionVerificationCurrent, } from "./types.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent, } from "../types.js";
 /** Recover public authorization without admitting historical heads as current policy. */
 export async function verifyProjectionPolicyEvidence(input) {
     const stillCurrent = () => input.stillCurrent?.() !== false;

package/data/keyingProjectionVerification/principalPolicy/projectionPolicyEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionPolicyEvidence.js","sourceRoot":"","sources":["projectionPolicyEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EACL,mCAAmC,GAGpC,MAAM,UAAU,CAAC;AAElB,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;IAC5D,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,IACE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;YAC5B,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM;YAC1C,KAAK,CAAC,UAAU,CAAC,MAAM;YAEvB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;QACJ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GACX,KAAK,CAAC,+BAA+B,EAAE,wBAAwB,CAAC;IAClE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACzD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ProjectionPolicyEvidenceResponse } from \"@tearleads/validators/response\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport {\n  assertProjectionVerificationCurrent,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedProjectionPolicyHistory,\n} from \"../types\";\n\n/** Recover public authorization without admitting historical heads as current policy. */\nexport async function verifyProjectionPolicyEvidence(input: {\n  readonly historicalProof?: boolean | undefined;\n  readonly evidence: ProjectionPolicyEvidenceResponse;\n  readonly organizationId: string;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<ResolvedProjectionPolicyHistory> {\n  const stillCurrent = () => input.stillCurrent?.() !== false;\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!input.evidence.organization) {\n    if (\n      input.evidence.groups.length ||\n      input.evidence.organizationPayloads.length ||\n      input.references.length\n    )\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Projection omits required organization history\",\n      );\n    return { policies: [], stillCurrent };\n  }\n  const resolve =\n    input.warmReferencedPrincipalPolicies?.resolveProjectionHistory;\n  if (!resolve)\n    throw new ProjectionDependencyUnavailableError(\n      \"Private projection history recovery is unavailable\",\n    );\n  const result = await resolve({ ...input, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  assertProjectionVerificationCurrent(result.stillCurrent);\n  return result;\n}\n"]}

package/data/keyingProjectionVerification/{resolvedPrincipalPolicy.js → principalPolicy/resolvedPrincipalPolicy.js}

@@ -1,10 +1,10 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
-import { verifiedPrincipalPolicyMeetsCheckpoint } from "../persistence/principalPolicyCheckpointSelection.js";
-import { observePrincipalPolicy, } from "./checkpointContext.js";
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpointPersistence.js";
+import { verifiedPrincipalPolicyMeetsCheckpoint } from "../../persistence/principalPolicyCheckpointSelection.js";
+import { observePrincipalPolicy, } from "../checkpoints/checkpointContext.js";
+import { observeProjectionLifetime } from "../projectionLifetimes.js";
+import { assertProjectionVerificationCurrent, } from "../types.js";
 import { referencedPrincipalPolicyKey, verifiedPrincipalPolicyContainsReference, } from "./principalPolicyCache.js";
-import { observeProjectionLifetime } from "./projectionLifetimes.js";
-import { assertProjectionVerificationCurrent, } from "./types.js";
 // Scoped evidence is always resolved through the warmer: its operation memo is
 // the only reuse of recovered directory and Admins evidence, with one set of
 // validity rules. The caller's policy cache keeps bare verified policies; it

package/data/keyingProjectionVerification/principalPolicy/resolvedPrincipalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvedPrincipalPolicy.js","sourceRoot":"","sources":["resolvedPrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,sCAAsC,EAAE,MAAM,sDAAsD,CAAC;AAC9G,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,mCAAmC,GAIpC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,qEAAqE;AACrE,KAAK,UAAU,gBAAgB,CAC7B,OAAoC,EACpC,MAAuC,EACvC,cAAuB;IAEvB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IACE,cAAc;YACd,UAAU;YACV,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;gBAClC,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;oBAClC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CACtD,CAAC,CAAC;YAEP,OAAO,KAAK,CAAC;QACf,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,KAAK,UAAU,eAAe,CAC5B,KAA4C,EAC5C,OAAyE;IAEzE,MAAM,IAAI,GAAG,KAAK,EAAE,aAAsB,EAAE,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC;YAC9B,aAAa;YACb,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,uEAAuE;IACvE,iEAAiE;IACjE,0EAA0E;IAC1E,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACrE,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,+BAA+B,EAAE,gBAAgB,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC;IAC5C,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,eAAe,EAAE,CAAC;IAC7E,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9C,yBAAyB,CAAC,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,IAAI,CAAC,wCAAwC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1D,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,MAAM,EACN,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpointPersistence\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"../../persistence/principalPolicyCheckpointSelection\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { observeProjectionLifetime } from \"../projectionLifetimes\";\nimport {\n  assertProjectionVerificationCurrent,\n  type PrincipalPolicyCache,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"../types\";\nimport {\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\n\n// Scoped evidence is always resolved through the warmer: its operation memo is\n// the only reuse of recovered directory and Admins evidence, with one set of\n// validity rules. The caller's policy cache keeps bare verified policies; it\n// never stands in for organization, dependency or lifetime bindings.\nasync function meetsCheckpoints(\n  context: ProjectionCheckpointContext,\n  result: ResolvedPrincipalPolicyEvidence,\n  refreshMissing: boolean,\n): Promise<boolean> {\n  for (const policy of [...result.dependencies, result.policy]) {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      context.execSql,\n      policy.principalType,\n      policy.principalId,\n    );\n    if (\n      refreshMissing &&\n      checkpoint &&\n      (policy.version < checkpoint.version ||\n        (policy.version > checkpoint.version &&\n          !policy.retainedHistory.some(\n            (entry) => entry.state.version === checkpoint.version,\n          )))\n    )\n      return false;\n    if (!verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint))\n      throw new KeyingVerificationError(\n        \"rollback\",\n        \"Recovered principal evidence predates the durable checkpoint\",\n      );\n  }\n  return true;\n}\n\ninterface ResolveReferencedPrincipalPolicyInput {\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly reference: ReferencedPrincipalHead;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nasync function recoverEvidence(\n  input: ResolveReferencedPrincipalPolicyInput,\n  resolve: NonNullable<ReferencedPrincipalPolicyWarmer[\"resolveReference\"]>,\n): Promise<ResolvedPrincipalPolicyEvidence> {\n  const read = async (recoveryBatch?: object) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const recovered = await resolve({\n      recoveryBatch,\n      organizationId: input.organizationId,\n      reference: input.reference,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    assertProjectionVerificationCurrent(recovered.stillCurrent);\n    return recovered;\n  };\n  let result = await read();\n  // A concurrent admission may advance a pin after recovery verified it.\n  // Refresh once outside the operation's directory view; the fresh\n  // recovery and final checkpoint check still reject rollback/equivocation.\n  if (!(await meetsCheckpoints(input.checkpointContext, result, true))) {\n    assertProjectionVerificationCurrent(result.stillCurrent);\n    result = await read({});\n    await meetsCheckpoints(input.checkpointContext, result, false);\n  }\n  return result;\n}\n\nexport async function resolveReferencedPrincipalPolicy(\n  input: ResolveReferencedPrincipalPolicyInput,\n): Promise<VerifiedPrincipalPolicyCurrent | null> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const key = referencedPrincipalPolicyKey(input.reference);\n  const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;\n  if (!resolve) return null;\n  const result = await recoverEvidence(input, resolve);\n  const evidenceCurrent = result.stillCurrent;\n  // The consumer's and every producer's lifetime guard the evidence where it\n  // is used: projection admission rechecks them through the context.\n  const lifetime = () => input.stillCurrent?.() !== false && evidenceCurrent();\n  assertProjectionVerificationCurrent(lifetime);\n  observeProjectionLifetime(input.checkpointContext, lifetime);\n  if (result.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence belongs to another organization\",\n    );\n  if (!verifiedPrincipalPolicyContainsReference(result.policy, input.reference))\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence does not contain the exact citation\",\n    );\n  for (const policy of [...result.dependencies, result.policy])\n    observePrincipalPolicy(\n      input.checkpointContext,\n      policy,\n      input.organizationId,\n    );\n  input.principalPolicyCache.set(key, result.policy);\n  return result.policy;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/stores/container-contents/accessRestorationSweep.js

@@ -1,5 +1,5 @@
+import { refreshAllRemoteHydration, } from "./hydration/remoteHydrationRefresh.js";
 import { getContainerContentsStoreLogLabel } from "./logLabel.js";
-import { refreshAllRemoteHydration, } from "./remoteHydrationRefresh.js";
 function createRestorationSweepSession(state, isCurrent) {
     return {
         isCurrent,

package/stores/container-contents/accessRestorationSweep.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessRestorationSweep.js","sourceRoot":"","sources":["accessRestorationSweep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAEL,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAgBlC,SAAS,6BAA6B,CACpC,KAAsC,EACtC,SAAwB;IAExB,OAAO;QACL,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,KAAsC;IAEtC,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtD,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,CAAC;IACxD,OAAO,GAAG,EAAE,CACV,KAAK,CAAC,mBAAmB,KAAK,mBAAmB;QACjD,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,CAAC;AACxD,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvC,SAAS,iBAAiB,CAAC,KAA2B,EAAE,GAAW;IACjE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,mBAAmB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,EAC9D,kBAAkB,CACnB,CAAC;IACF,OAAO,eAAe,GAAG,UAAU,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAAC,KAA2B;IAC3D,OAAO,GAAG,KAAK,CAAC,eAAe,SAAS,KAAK,CAAC,cAAc,SAAS,KAAK,CAAC,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,yBAAyB,CACtC,OAAgC,EAChC,MAAuC;IAEvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;YAAE,OAAO;QACjC,0EAA0E;QAC1E,sFAAsF;QACtF,MAAM,OAAO,CAAC,WAAW,CAAC,mCAAmC,CAC3D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,KAAK,EACL,OAAO,CAAC,SAAS,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,OAAgC,EAChC,MAAuC,EACvC,mBAAqD;IAErD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,mBAAmB,EAAE,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9D,sEAAsE;YACtE,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;YAC9C,MAAM,OAAO,CAAC,WAAW,CAAC,mCAAmC,CAC3D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,KAAK,EACL,OAAO,CAAC,SAAS,CAClB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACtB,GAAG,iCAAiC,CAAC,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAC1H,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gCAAgC,CACzE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,KAAK,EACL,WAAW,EACX,OAAO,CAAC,SAAS,CAClB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,KAAK;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;gBACpC,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,OAAgC,EAChC,mBAAqD;IAErD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACpD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,aAAa,GACjB,MAAM,OAAO,CAAC,WAAW,CAAC,gCAAgC,CACxD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,eAAe,CAChB,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,yBAAyB,CAAC,OAAO,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,kCAAkC,CACzC,KAAsC,EACtC,kBAA2C,EAC3C,iBAAkD;IAElD,MAAM,OAAO,GAAG,6BAA6B,CAC3C,KAAK,EACL,4BAA4B,CAAC,KAAK,CAAC,CACpC,CAAC;IACF,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,WAAW,GACf,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YAC7B,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,MAAM,mBAAmB,GAAG,WAAW;YACrC,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,EACP,mBAAmB,CACpB,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC;QACjE,iCAAiC,EAAE,GAAG,EAAE,CACtC,kCAAkC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QAC5D,gBAAgB;QAChB,sBAAsB,EAAE,IAAI;QAC5B,0BAA0B,EAAE,KAAK;QACjC,6BAA6B,EAAE,KAAK;QACpC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAG9C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,OAAO,KAAK,EAAE,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,EAAE,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,iCAAiC,CAAC,KAAK,CAAC,iCAAiC,CAAC;YAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { getContainerContentsStoreLogLabel } from \"./logLabel\";\nimport {\n  type RemoteHydrationRequester,\n  refreshAllRemoteHydration,\n} from \"./remoteHydrationRefresh\";\nimport type { ContainerContentsStoreSyncState } from \"./syncAgentTypes\";\n\ntype DormantMetadataSweep = Awaited<\n  ReturnType<\n    ContainerContentsStoreSyncState[\"persistence\"][\"listDormantMetadataSweepRequests\"]\n  >\n>[number];\n\ninterface RestorationSweepSession {\n  isCurrent: () => boolean;\n  persistence: ContainerContentsStoreSyncState[\"persistence\"];\n  runtime: ContainerContentsStoreSyncState[\"runtime\"];\n  state: ContainerContentsStoreSyncState;\n}\n\nfunction createRestorationSweepSession(\n  state: ContainerContentsStoreSyncState,\n  isCurrent: () => boolean,\n): RestorationSweepSession {\n  return {\n    isCurrent,\n    persistence: state.persistence,\n    runtime: state.runtime,\n    state,\n  };\n}\n\nfunction captureRestorationGeneration(\n  state: ContainerContentsStoreSyncState,\n): () => boolean {\n  const lifecycleGeneration = state.lifecycleGeneration;\n  const structuralGeneration = state.structuralGeneration;\n  return () =>\n    state.lifecycleGeneration === lifecycleGeneration &&\n    state.structuralGeneration === structuralGeneration;\n}\n\nconst SWEEP_ATTEMPT_LIMIT = 5;\nconst SWEEP_RETRY_BASE_MS = 60_000;\nconst SWEEP_RETRY_MAX_MS = 15 * 60_000;\n\nfunction isSweepAttemptDue(sweep: DormantMetadataSweep, now: number): boolean {\n  if (!sweep.lastAttemptedAt) {\n    return true;\n  }\n  const lastAttemptedAt = Date.parse(sweep.lastAttemptedAt);\n  if (!Number.isFinite(lastAttemptedAt)) {\n    return true;\n  }\n  const retryDelay = Math.min(\n    SWEEP_RETRY_BASE_MS * 2 ** Math.max(0, sweep.attemptCount - 1),\n    SWEEP_RETRY_MAX_MS,\n  );\n  return lastAttemptedAt + retryDelay <= now;\n}\n\nfunction restorationSweepIdentity(sweep: DormantMetadataSweep): string {\n  return `${sweep.requesterUserId}\\u0000${sweep.organizationId}\\u0000${sweep.generation}`;\n}\n\n/** A completed crawl can restore verified objects; absence never authorizes data loss. */\nasync function completeRestorationSweeps(\n  session: RestorationSweepSession,\n  sweeps: readonly DormantMetadataSweep[],\n): Promise<void> {\n  for (const sweep of sweeps) {\n    if (!session.isCurrent()) return;\n    // An unsigned 404 cannot prove that encrypted local edits are disposable.\n    // Leave unavailable metadata dormant until verified rediscovery or explicit deletion.\n    await session.persistence.completeDormantMetadataSweepRequest(\n      session.runtime.infra.execSql,\n      sweep,\n      session.isCurrent,\n    );\n  }\n}\n\nasync function claimDueRestorationSweeps(\n  session: RestorationSweepSession,\n  sweeps: readonly DormantMetadataSweep[],\n  forcedRetrySweepIds?: ReadonlySet<string> | undefined,\n): Promise<DormantMetadataSweep[]> {\n  const now = Date.now();\n  const attemptedAt = new Date(now).toISOString();\n  const claimed: DormantMetadataSweep[] = [];\n  for (const sweep of sweeps) {\n    if (!session.isCurrent()) {\n      return claimed;\n    }\n    if (forcedRetrySweepIds?.has(restorationSweepIdentity(sweep))) {\n      // The interrupted generation already claimed and durably counted this\n      // attempt. Resume that exact attempt after reset instead of consuming a\n      // new one or retiring it at the limit before its completion ran.\n      claimed.push(sweep);\n      continue;\n    }\n    if (sweep.attemptCount >= SWEEP_ATTEMPT_LIMIT) {\n      await session.persistence.completeDormantMetadataSweepRequest(\n        session.runtime.infra.execSql,\n        sweep,\n        session.isCurrent,\n      );\n      if (!session.isCurrent()) {\n        return claimed;\n      }\n      session.runtime.util.log(\n        `${getContainerContentsStoreLogLabel(session.state)}: retired exhausted dormant metadata sweep; metadata remains dormant`,\n      );\n      continue;\n    }\n    if (!isSweepAttemptDue(sweep, now)) {\n      continue;\n    }\n    const didClaim = await session.persistence.claimDormantMetadataSweepAttempt(\n      session.runtime.infra.execSql,\n      sweep,\n      attemptedAt,\n      session.isCurrent,\n    );\n    if (!session.isCurrent()) {\n      return claimed;\n    }\n    if (didClaim) {\n      claimed.push({\n        ...sweep,\n        attemptCount: sweep.attemptCount + 1,\n        lastAttemptedAt: attemptedAt,\n      });\n    }\n  }\n  return claimed;\n}\n\nasync function loadAndClaimRestorationSweeps(\n  session: RestorationSweepSession,\n  forcedRetrySweepIds?: ReadonlySet<string> | undefined,\n): Promise<DormantMetadataSweep[]> {\n  const requesterUserId = session.runtime.auth.userId;\n  if (!requesterUserId) {\n    return [];\n  }\n  const pendingSweeps =\n    await session.persistence.listDormantMetadataSweepRequests(\n      session.runtime.infra.execSql,\n      requesterUserId,\n    );\n  if (!session.isCurrent()) {\n    return [];\n  }\n  return claimDueRestorationSweeps(session, pendingSweeps, forcedRetrySweepIds);\n}\n\nfunction recreateRestorationSweepCompletion(\n  state: ContainerContentsStoreSyncState,\n  interruptedSession: RestorationSweepSession,\n  interruptedSweeps: readonly DormantMetadataSweep[],\n): () => Promise<void> {\n  const session = createRestorationSweepSession(\n    state,\n    captureRestorationGeneration(state),\n  );\n  return async () => {\n    const sameStorage =\n      session.runtime.infra.execSql ===\n      interruptedSession.runtime.infra.execSql;\n    const forcedRetrySweepIds = sameStorage\n      ? new Set(interruptedSweeps.map(restorationSweepIdentity))\n      : undefined;\n    const sweeps = await loadAndClaimRestorationSweeps(\n      session,\n      forcedRetrySweepIds,\n    );\n    if (session.isCurrent() && sweeps.length > 0) {\n      await completeRestorationSweeps(session, sweeps);\n    }\n  };\n}\n\nasync function reconcileRestoredAccess(input: {\n  isCurrent: () => boolean;\n  requestHydration: RemoteHydrationRequester;\n  state: ContainerContentsStoreSyncState;\n}): Promise<void> {\n  const { requestHydration, state } = input;\n  const session = createRestorationSweepSession(state, input.isCurrent);\n  const sweeps = await loadAndClaimRestorationSweeps(session);\n  if (!session.isCurrent() || sweeps.length === 0) {\n    return;\n  }\n\n  await refreshAllRemoteHydration({\n    onFullyHydrated: () => completeRestorationSweeps(session, sweeps),\n    recreateOnFullyHydratedAfterReset: () =>\n      recreateRestorationSweepCompletion(state, session, sweeps),\n    requestHydration,\n    resetAllLaneWatermarks: true,\n    scheduleSyncAfterHydration: false,\n    scheduleSyncOnHydrationChange: false,\n    state,\n  });\n}\n\nexport function createRestoredAccessReconciler(input: {\n  requestHydration: RemoteHydrationRequester;\n  state: ContainerContentsStoreSyncState;\n}): (isCurrent?: () => boolean) => Promise<void> {\n  const { state } = input;\n  return async (isCurrent = captureRestorationGeneration(state)) => {\n    try {\n      await reconcileRestoredAccess({ ...input, isCurrent });\n    } catch (error) {\n      if (!isCurrent()) {\n        return;\n      }\n      const message = `${getContainerContentsStoreLogLabel(state)}: dormant metadata sweep failed`;\n      if (state.runtime.util.logError) {\n        state.runtime.util.logError(message, error);\n      } else {\n        state.runtime.util.log(message);\n      }\n    }\n  };\n}\n"]}
+{"version":3,"file":"accessRestorationSweep.js","sourceRoot":"","sources":["accessRestorationSweep.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAgB/D,SAAS,6BAA6B,CACpC,KAAsC,EACtC,SAAwB;IAExB,OAAO;QACL,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,KAAsC;IAEtC,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtD,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,CAAC;IACxD,OAAO,GAAG,EAAE,CACV,KAAK,CAAC,mBAAmB,KAAK,mBAAmB;QACjD,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,CAAC;AACxD,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvC,SAAS,iBAAiB,CAAC,KAA2B,EAAE,GAAW;IACjE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,mBAAmB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,EAC9D,kBAAkB,CACnB,CAAC;IACF,OAAO,eAAe,GAAG,UAAU,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAAC,KAA2B;IAC3D,OAAO,GAAG,KAAK,CAAC,eAAe,SAAS,KAAK,CAAC,cAAc,SAAS,KAAK,CAAC,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,yBAAyB,CACtC,OAAgC,EAChC,MAAuC;IAEvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;YAAE,OAAO;QACjC,0EAA0E;QAC1E,sFAAsF;QACtF,MAAM,OAAO,CAAC,WAAW,CAAC,mCAAmC,CAC3D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,KAAK,EACL,OAAO,CAAC,SAAS,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,OAAgC,EAChC,MAAuC,EACvC,mBAAqD;IAErD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,mBAAmB,EAAE,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9D,sEAAsE;YACtE,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;YAC9C,MAAM,OAAO,CAAC,WAAW,CAAC,mCAAmC,CAC3D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,KAAK,EACL,OAAO,CAAC,SAAS,CAClB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACtB,GAAG,iCAAiC,CAAC,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAC1H,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gCAAgC,CACzE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,KAAK,EACL,WAAW,EACX,OAAO,CAAC,SAAS,CAClB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,KAAK;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;gBACpC,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,OAAgC,EAChC,mBAAqD;IAErD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACpD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,aAAa,GACjB,MAAM,OAAO,CAAC,WAAW,CAAC,gCAAgC,CACxD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC7B,eAAe,CAChB,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,yBAAyB,CAAC,OAAO,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,kCAAkC,CACzC,KAAsC,EACtC,kBAA2C,EAC3C,iBAAkD;IAElD,MAAM,OAAO,GAAG,6BAA6B,CAC3C,KAAK,EACL,4BAA4B,CAAC,KAAK,CAAC,CACpC,CAAC;IACF,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,WAAW,GACf,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YAC7B,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,MAAM,mBAAmB,GAAG,WAAW;YACrC,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,EACP,mBAAmB,CACpB,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC;QACjE,iCAAiC,EAAE,GAAG,EAAE,CACtC,kCAAkC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QAC5D,gBAAgB;QAChB,sBAAsB,EAAE,IAAI;QAC5B,0BAA0B,EAAE,KAAK;QACjC,6BAA6B,EAAE,KAAK;QACpC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAG9C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,OAAO,KAAK,EAAE,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,EAAE,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,iCAAiC,CAAC,KAAK,CAAC,iCAAiC,CAAC;YAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type RemoteHydrationRequester,\n  refreshAllRemoteHydration,\n} from \"./hydration/remoteHydrationRefresh\";\nimport { getContainerContentsStoreLogLabel } from \"./logLabel\";\nimport type { ContainerContentsStoreSyncState } from \"./syncAgent/syncAgentTypes\";\n\ntype DormantMetadataSweep = Awaited<\n  ReturnType<\n    ContainerContentsStoreSyncState[\"persistence\"][\"listDormantMetadataSweepRequests\"]\n  >\n>[number];\n\ninterface RestorationSweepSession {\n  isCurrent: () => boolean;\n  persistence: ContainerContentsStoreSyncState[\"persistence\"];\n  runtime: ContainerContentsStoreSyncState[\"runtime\"];\n  state: ContainerContentsStoreSyncState;\n}\n\nfunction createRestorationSweepSession(\n  state: ContainerContentsStoreSyncState,\n  isCurrent: () => boolean,\n): RestorationSweepSession {\n  return {\n    isCurrent,\n    persistence: state.persistence,\n    runtime: state.runtime,\n    state,\n  };\n}\n\nfunction captureRestorationGeneration(\n  state: ContainerContentsStoreSyncState,\n): () => boolean {\n  const lifecycleGeneration = state.lifecycleGeneration;\n  const structuralGeneration = state.structuralGeneration;\n  return () =>\n    state.lifecycleGeneration === lifecycleGeneration &&\n    state.structuralGeneration === structuralGeneration;\n}\n\nconst SWEEP_ATTEMPT_LIMIT = 5;\nconst SWEEP_RETRY_BASE_MS = 60_000;\nconst SWEEP_RETRY_MAX_MS = 15 * 60_000;\n\nfunction isSweepAttemptDue(sweep: DormantMetadataSweep, now: number): boolean {\n  if (!sweep.lastAttemptedAt) {\n    return true;\n  }\n  const lastAttemptedAt = Date.parse(sweep.lastAttemptedAt);\n  if (!Number.isFinite(lastAttemptedAt)) {\n    return true;\n  }\n  const retryDelay = Math.min(\n    SWEEP_RETRY_BASE_MS * 2 ** Math.max(0, sweep.attemptCount - 1),\n    SWEEP_RETRY_MAX_MS,\n  );\n  return lastAttemptedAt + retryDelay <= now;\n}\n\nfunction restorationSweepIdentity(sweep: DormantMetadataSweep): string {\n  return `${sweep.requesterUserId}\\u0000${sweep.organizationId}\\u0000${sweep.generation}`;\n}\n\n/** A completed crawl can restore verified objects; absence never authorizes data loss. */\nasync function completeRestorationSweeps(\n  session: RestorationSweepSession,\n  sweeps: readonly DormantMetadataSweep[],\n): Promise<void> {\n  for (const sweep of sweeps) {\n    if (!session.isCurrent()) return;\n    // An unsigned 404 cannot prove that encrypted local edits are disposable.\n    // Leave unavailable metadata dormant until verified rediscovery or explicit deletion.\n    await session.persistence.completeDormantMetadataSweepRequest(\n      session.runtime.infra.execSql,\n      sweep,\n      session.isCurrent,\n    );\n  }\n}\n\nasync function claimDueRestorationSweeps(\n  session: RestorationSweepSession,\n  sweeps: readonly DormantMetadataSweep[],\n  forcedRetrySweepIds?: ReadonlySet<string> | undefined,\n): Promise<DormantMetadataSweep[]> {\n  const now = Date.now();\n  const attemptedAt = new Date(now).toISOString();\n  const claimed: DormantMetadataSweep[] = [];\n  for (const sweep of sweeps) {\n    if (!session.isCurrent()) {\n      return claimed;\n    }\n    if (forcedRetrySweepIds?.has(restorationSweepIdentity(sweep))) {\n      // The interrupted generation already claimed and durably counted this\n      // attempt. Resume that exact attempt after reset instead of consuming a\n      // new one or retiring it at the limit before its completion ran.\n      claimed.push(sweep);\n      continue;\n    }\n    if (sweep.attemptCount >= SWEEP_ATTEMPT_LIMIT) {\n      await session.persistence.completeDormantMetadataSweepRequest(\n        session.runtime.infra.execSql,\n        sweep,\n        session.isCurrent,\n      );\n      if (!session.isCurrent()) {\n        return claimed;\n      }\n      session.runtime.util.log(\n        `${getContainerContentsStoreLogLabel(session.state)}: retired exhausted dormant metadata sweep; metadata remains dormant`,\n      );\n      continue;\n    }\n    if (!isSweepAttemptDue(sweep, now)) {\n      continue;\n    }\n    const didClaim = await session.persistence.claimDormantMetadataSweepAttempt(\n      session.runtime.infra.execSql,\n      sweep,\n      attemptedAt,\n      session.isCurrent,\n    );\n    if (!session.isCurrent()) {\n      return claimed;\n    }\n    if (didClaim) {\n      claimed.push({\n        ...sweep,\n        attemptCount: sweep.attemptCount + 1,\n        lastAttemptedAt: attemptedAt,\n      });\n    }\n  }\n  return claimed;\n}\n\nasync function loadAndClaimRestorationSweeps(\n  session: RestorationSweepSession,\n  forcedRetrySweepIds?: ReadonlySet<string> | undefined,\n): Promise<DormantMetadataSweep[]> {\n  const requesterUserId = session.runtime.auth.userId;\n  if (!requesterUserId) {\n    return [];\n  }\n  const pendingSweeps =\n    await session.persistence.listDormantMetadataSweepRequests(\n      session.runtime.infra.execSql,\n      requesterUserId,\n    );\n  if (!session.isCurrent()) {\n    return [];\n  }\n  return claimDueRestorationSweeps(session, pendingSweeps, forcedRetrySweepIds);\n}\n\nfunction recreateRestorationSweepCompletion(\n  state: ContainerContentsStoreSyncState,\n  interruptedSession: RestorationSweepSession,\n  interruptedSweeps: readonly DormantMetadataSweep[],\n): () => Promise<void> {\n  const session = createRestorationSweepSession(\n    state,\n    captureRestorationGeneration(state),\n  );\n  return async () => {\n    const sameStorage =\n      session.runtime.infra.execSql ===\n      interruptedSession.runtime.infra.execSql;\n    const forcedRetrySweepIds = sameStorage\n      ? new Set(interruptedSweeps.map(restorationSweepIdentity))\n      : undefined;\n    const sweeps = await loadAndClaimRestorationSweeps(\n      session,\n      forcedRetrySweepIds,\n    );\n    if (session.isCurrent() && sweeps.length > 0) {\n      await completeRestorationSweeps(session, sweeps);\n    }\n  };\n}\n\nasync function reconcileRestoredAccess(input: {\n  isCurrent: () => boolean;\n  requestHydration: RemoteHydrationRequester;\n  state: ContainerContentsStoreSyncState;\n}): Promise<void> {\n  const { requestHydration, state } = input;\n  const session = createRestorationSweepSession(state, input.isCurrent);\n  const sweeps = await loadAndClaimRestorationSweeps(session);\n  if (!session.isCurrent() || sweeps.length === 0) {\n    return;\n  }\n\n  await refreshAllRemoteHydration({\n    onFullyHydrated: () => completeRestorationSweeps(session, sweeps),\n    recreateOnFullyHydratedAfterReset: () =>\n      recreateRestorationSweepCompletion(state, session, sweeps),\n    requestHydration,\n    resetAllLaneWatermarks: true,\n    scheduleSyncAfterHydration: false,\n    scheduleSyncOnHydrationChange: false,\n    state,\n  });\n}\n\nexport function createRestoredAccessReconciler(input: {\n  requestHydration: RemoteHydrationRequester;\n  state: ContainerContentsStoreSyncState;\n}): (isCurrent?: () => boolean) => Promise<void> {\n  const { state } = input;\n  return async (isCurrent = captureRestorationGeneration(state)) => {\n    try {\n      await reconcileRestoredAccess({ ...input, isCurrent });\n    } catch (error) {\n      if (!isCurrent()) {\n        return;\n      }\n      const message = `${getContainerContentsStoreLogLabel(state)}: dormant metadata sweep failed`;\n      if (state.runtime.util.logError) {\n        state.runtime.util.logError(message, error);\n      } else {\n        state.runtime.util.log(message);\n      }\n    }\n  };\n}\n"]}

package/stores/container-contents/containerContentsStore.d.ts

@@ -1,6 +1,6 @@
 import type { DomainScope } from "../../data/shared/domainScope.js";
 import { type ContainerContentsPersistence } from "../../workflows/container-contents/containerPersistence.js";
-import { type ContainerContentsStoreRuntime, createContainerContentsStoreSyncAgent } from "./syncAgent.js";
+import { type ContainerContentsStoreRuntime, createContainerContentsStoreSyncAgent } from "./syncAgent/index.js";
 import type { ContainerContentsStore, ContainerContentsStoreOptions, ContainerContentsStoreState } from "./types.js";
 type ContainerWriteMethods = Pick<ContainerContentsStore, "createChild" | "deleteContainer" | "emptyTrash" | "ensureSystemContainer" | "moveContainer" | "prepareGroupRewrap" | "purgeContainer" | "renameContainer" | "setContainerIcon" | "shareWithGroup" | "shareWithUser">;
 export declare function createContainerWriteMethods(state: ContainerContentsStoreState, syncAgent: ReturnType<typeof createContainerContentsStoreSyncAgent>): ContainerWriteMethods;

package/stores/container-contents/containerContentsStore.js

@@ -1,18 +1,18 @@
 import { getCachedContainerWriterProjection } from "../../workflows/container-contents/container-state/projectionCache.js";
 import { defaultContainerContentsPersistence, } from "../../workflows/container-contents/containerPersistence.js";
-import { persistContainerState } from "./containerStatePersistence.js";
-import { emptyTrash } from "./emptyTrashOperation.js";
-import { prepareContainerGroupRewrap, verifyContainerGroupRewrapCurrent, } from "./groupRewrapOperation.js";
-import { createChildContainer, deleteContainer, ensureSystemContainer, moveContainer, renameContainer, } from "./operations.js";
-import { purgeContainer } from "./purgeContainerOperation.js";
-import { invalidateRemoteContainerWrites } from "./remoteWriteGuards.js";
-import { chainRemoteContainerTask } from "./remoteWriteQueue.js";
-import { setContainerIcon } from "./setContainerIconOperation.js";
-import { shareContainerWithGroup, shareContainerWithUser, } from "./shareOperations.js";
+import { persistContainerState } from "./containerState/containerStatePersistence.js";
+import { createChildContainer, deleteContainer, ensureSystemContainer, moveContainer, renameContainer, } from "./operations/index.js";
+import { emptyTrash } from "./operations/emptyTrashOperation.js";
+import { prepareContainerGroupRewrap, verifyContainerGroupRewrapCurrent, } from "./operations/groupRewrapOperation.js";
+import { purgeContainer } from "./operations/purgeContainerOperation.js";
+import { setContainerIcon } from "./operations/setContainerIconOperation.js";
+import { shareContainerWithGroup, shareContainerWithUser, } from "./operations/shareOperations.js";
+import { invalidateRemoteContainerWrites } from "./remoteWrites/remoteWriteGuards.js";
+import { chainRemoteContainerTask } from "./remoteWrites/remoteWriteQueue.js";
+import { captureContainerWriteGeneration } from "./remoteWrites/writeGeneration.js";
 import { createContainerContentsStoreState, subscribeToContainerContentsStore, updateContainerContentsSnapshot, updateContainerContentsStorePersistence, updateContainerContentsStoreRuntime, } from "./state.js";
-import { createContainerContentsStoreSyncAgent, } from "./syncAgent.js";
-import { findRootContainerState } from "./systemContainerLookup.js";
-import { captureContainerWriteGeneration } from "./writeGeneration.js";
+import { createContainerContentsStoreSyncAgent, } from "./syncAgent/index.js";
+import { findRootContainerState } from "./systemContainers/systemContainerLookup.js";
 const containerContentsStoresByScope = new WeakMap();
 function applyContainerContentsStoreOptions(state, syncAgent, options) {
     if ("logLabel" in options) {