npm - @tearleads/client-sdk - Versions diffs - 0.1.63 → 0.1.65 - Mend

@tearleads/client-sdk 0.1.63 → 0.1.65

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1432) hide show

package/data/persistence/principalHistory/principalHistoryStagePersistence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryStagePersistence.js","sourceRoot":"","sources":["principalHistoryStagePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,yDAAyD,CAAC;AAC9G,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAQlG,MAAM,4BAA4B,GAAG;IACnC,EAAE,EAAE,sBAAsB,CAAC,EAAE;IAC7B,cAAc,EAAE,sBAAsB,CAAC,cAAc;IACrD,WAAW,EAAE,sBAAsB,CAAC,WAAW;IAC/C,YAAY,EAAE,sBAAsB,CAAC,YAAY;IACjD,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;IACzC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;CAC1C,CAAC;AAEF,MAAM,iCAAkC,SAAQ,KAAK;IAC1C,IAAI,GAAG,iCAAiC,CAAC;IAClD;QACE,KAAK,CACH,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,EAAU;IAEV,MAAM,eAAe,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,4BAA4B,CAAC;SACpC,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,2BAA2B;QAC9B,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC5C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,gBAAgB;YACzD,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAChD,MAAM,iCAAiC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChD,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,GAAG,CAAC;aACX,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;aACnE,GAAG,EAAE,CAAC;QACT,MAAM,0BAA0B,CAAC,EAAE,EAAE;YACnC,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,QAAQ,EAAE,QAAQ,CAAC,aAAa;SACjC,CAAC,CAAC;QACH,MAAM,uCAAuC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,wCAAwC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,4BAA4B,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,KAA4B,EAC5B,YAA2B;IAE3B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,2BAA2B;QAC9B,GAAG,mCAAmC;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAChD,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAAE,OAAO;QACjD,MAAM,2BAA2B,CAAC,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EACvC,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CACpD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../../keyingProjectionVerification/types\";\nimport { principalHistoryEvidenceTables } from \"../../sqlite/schema/principalHistoryEvidenceSchema\";\nimport { principalHistoryNodeRetentionTables } from \"../../sqlite/schema/principalHistoryNodeRetentionSchema\";\nimport {\n principalHistoryStages,\n principalHistoryStageTables,\n} from \"../../sqlite/schema/principalHistoryStageSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport {\n type PrincipalHistoryEvidencePage,\n writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\nimport { reclaimIncompletePrincipalHistoryStages } from \"./principalHistoryIncompleteRetention\";\nimport { reclaimPrincipalHistoryNodes } from \"./principalHistoryNodeRetention\";\nimport {\n releasePrincipalHistoryRoot,\n retainPrincipalHistoryRoot,\n} from \"./principalHistoryRootOwnership\";\nimport { reclaimUnpublishedPrincipalHistoryStages } from \"./principalHistoryUnpublishedRetention\";\n\n/** A stage's verification work; its retention hints are written by persistence. */\nexport type PrincipalHistoryStage = Omit<\n typeof principalHistoryStages.$inferSelect,\n \"scopeId\" | \"touchedAt\"\n>;\n\nconst principalHistoryStageColumns = {\n id: principalHistoryStages.id,\n organizationId: principalHistoryStages.organizationId,\n currentJson: principalHistoryStages.currentJson,\n afterVersion: principalHistoryStages.afterVersion,\n complete: principalHistoryStages.complete,\n progress: principalHistoryStages.progress,\n};\n\nclass PrincipalHistoryStageChangedError extends Error {\n readonly code = \"principal_history_stage_changed\";\n constructor() {\n super(\n \"Another operation changed the saved principal history; resume from its current state\",\n );\n this.name = \"PrincipalHistoryStageChangedError\";\n }\n}\n\nexport async function loadPrincipalHistoryStage(\n execSql: ExecSql,\n id: string,\n): Promise<PrincipalHistoryStage | null> {\n await ensureSqlTables(execSql, principalHistoryStageTables);\n const { db } = getClientSQLitePersistenceRuntime(execSql);\n const [row] = await db\n .select(principalHistoryStageColumns)\n .from(principalHistoryStages)\n .where(eq(principalHistoryStages.id, id))\n .limit(1);\n return row ?? null;\n}\n\n/** Publish accepted entries and index nodes atomically with authenticated progress. */\nexport async function savePrincipalHistoryStage(input: {\n readonly execSql: ExecSql;\n readonly stage: PrincipalHistoryStage;\n readonly evidence: PrincipalHistoryEvidencePage;\n readonly previousProgress: string | null;\n readonly stillCurrent: () => boolean;\n}): Promise<void> {\n const evidence = structuredClone(input.evidence);\n const stage = { ...input.stage, scopeId: evidence.scopeId };\n await ensureSqlTables(input.execSql, [\n ...principalHistoryStageTables,\n ...principalHistoryEvidenceTables,\n ]);\n const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n const saved = await runtime.guardedTransaction(\n async (tx) => {\n const [previous] = await tx\n .select({ progress: principalHistoryStages.progress })\n .from(principalHistoryStages)\n .where(eq(principalHistoryStages.id, stage.id))\n .limit(1);\n if ((previous?.progress ?? null) !== input.previousProgress)\n throw new PrincipalHistoryStageChangedError();\n await writePrincipalHistoryEvidencePage(tx, evidence);\n const row = { ...stage, touchedAt: Date.now() };\n await tx\n .insert(principalHistoryStages)\n .values(row)\n .onConflictDoUpdate({ target: principalHistoryStages.id, set: row })\n .run();\n await retainPrincipalHistoryRoot(tx, {\n id: `stage:${stage.id}`,\n scopeId: evidence.scopeId,\n organizationId: stage.organizationId,\n rootHash: evidence.indexRootHash,\n });\n await reclaimIncompletePrincipalHistoryStages(tx, stage);\n await reclaimUnpublishedPrincipalHistoryStages(tx, stage);\n await reclaimPrincipalHistoryNodes(tx, evidence);\n },\n input.stillCurrent,\n { behavior: \"immediate\" },\n );\n assertProjectionVerificationCurrent(() => saved.committed);\n}\n\nexport async function discardPrincipalHistoryStage(\n execSql: ExecSql,\n stage: PrincipalHistoryStage,\n stillCurrent: () => boolean,\n) {\n await ensureSqlTables(execSql, [\n ...principalHistoryStageTables,\n ...principalHistoryNodeRetentionTables,\n ]);\n const runtime = getClientSQLitePersistenceRuntime(execSql);\n const discarded = await runtime.guardedTransaction(\n async (db) => {\n const [current] = await db\n .select({ progress: principalHistoryStages.progress })\n .from(principalHistoryStages)\n .where(eq(principalHistoryStages.id, stage.id))\n .limit(1);\n if (current?.progress !== stage.progress) return;\n await releasePrincipalHistoryRoot(db, `stage:${stage.id}`);\n await db\n .delete(principalHistoryStages)\n .where(\n and(\n eq(principalHistoryStages.id, stage.id),\n eq(principalHistoryStages.progress, stage.progress),\n ),\n )\n .run();\n },\n stillCurrent,\n { behavior: \"immediate\" },\n );\n assertProjectionVerificationCurrent(() => discarded.committed);\n}\n"]}

package/data/persistence/principalHistory/principalHistoryStageRetention.js ADDED Viewed

@@ -0,0 +1,45 @@
+import { and, asc, desc, eq, lt } from "drizzle-orm";
+import { principalHistoryStages } from "../../sqlite/schema/principalHistoryStageSchema.js";
+import { archivePrincipalHistoryKeyEnvelopes } from "../principalKeys/principalKeyEnvelopeArchivePersistence.js";
+import { releasePrincipalHistoryRoot } from "./principalHistoryRootOwnership.js";
+/** Each publication reclaims at most this many obsolete completed heads. */
+export const PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT = 16;
+/** Mark a stored stage as just used by a writer for its principal history. */
+export async function touchPrincipalHistoryStage(tx, input) {
+    await tx
+        .update(principalHistoryStages)
+        .set({ scopeId: input.scopeId, touchedAt: Date.now() })
+        .where(eq(principalHistoryStages.id, input.id))
+        .run();
+}
+/** The prefix and its key candidates must be published in this transaction. */
+export async function reclaimCompletedPrincipalHistoryStages(tx, prefix) {
+    const obsolete = await tx
+        .select({
+        stage: {
+            id: principalHistoryStages.id,
+            organizationId: principalHistoryStages.organizationId,
+            currentJson: principalHistoryStages.currentJson,
+            afterVersion: principalHistoryStages.afterVersion,
+        },
+    })
+        .from(principalHistoryStages)
+        .where(and(eq(principalHistoryStages.scopeId, prefix.scopeId), eq(principalHistoryStages.organizationId, prefix.organizationId), eq(principalHistoryStages.complete, true), lt(principalHistoryStages.afterVersion, prefix.version)))
+        .orderBy(desc(principalHistoryStages.afterVersion), desc(principalHistoryStages.touchedAt), asc(principalHistoryStages.id))
+        // Keep the current completed head and its newest completed predecessor.
+        // This also preserves the prefix-only predecessor restored after an ack.
+        .offset(2)
+        .limit(PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT);
+    for (const { stage } of obsolete) {
+        await releasePrincipalHistoryRoot(tx, `stage:${stage.id}`);
+        await archivePrincipalHistoryKeyEnvelopes(tx, {
+            ...stage,
+            version: stage.afterVersion + 1,
+        });
+        await tx
+            .delete(principalHistoryStages)
+            .where(eq(principalHistoryStages.id, stage.id))
+            .run();
+    }
+}
+//# sourceMappingURL=principalHistoryStageRetention.js.map

package/data/persistence/principalHistory/principalHistoryStageRetention.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryStageRetention.js","sourceRoot":"","sources":["principalHistoryStageRetention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAEzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,yDAAyD,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAExD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAgC,EAChC,KAAwD;IAExD,MAAM,EAAE;SACL,MAAM,CAAC,sBAAsB,CAAC;SAC9B,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SACtD,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SAC9C,GAAG,EAAE,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,EAAgC,EAChC,MAIC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,KAAK,EAAE;YACL,EAAE,EAAE,sBAAsB,CAAC,EAAE;YAC7B,cAAc,EAAE,sBAAsB,CAAC,cAAc;YACrD,WAAW,EAAE,sBAAsB,CAAC,WAAW;YAC/C,YAAY,EAAE,sBAAsB,CAAC,YAAY;SAClD;KACF,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAClD,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,EAChE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,EACzC,EAAE,CAAC,sBAAsB,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CACxD,CACF;SACA,OAAO,CACN,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,EACzC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACtC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAC/B;QACD,wEAAwE;QACxE,yEAAyE;SACxE,MAAM,CAAC,CAAC,CAAC;SACT,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChD,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,2BAA2B,CAAC,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,mCAAmC,CAAC,EAAE,EAAE;YAC5C,GAAG,KAAK;YACR,OAAO,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC9C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC","sourcesContent":["import { and, asc, desc, eq, lt } from \"drizzle-orm\";\nimport { principalHistoryStages } from \"../../sqlite/schema/principalHistoryStageSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { archivePrincipalHistoryKeyEnvelopes } from \"../principalKeys/principalKeyEnvelopeArchivePersistence\";\nimport { releasePrincipalHistoryRoot } from \"./principalHistoryRootOwnership\";\n\n/** Each publication reclaims at most this many obsolete completed heads. */\nexport const PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT = 16;\n\n/** Mark a stored stage as just used by a writer for its principal history. */\nexport async function touchPrincipalHistoryStage(\n tx: ClientSQLiteTransactionScope,\n input: { readonly id: string; readonly scopeId: string },\n) {\n await tx\n .update(principalHistoryStages)\n .set({ scopeId: input.scopeId, touchedAt: Date.now() })\n .where(eq(principalHistoryStages.id, input.id))\n .run();\n}\n\n/** The prefix and its key candidates must be published in this transaction. */\nexport async function reclaimCompletedPrincipalHistoryStages(\n tx: ClientSQLiteTransactionScope,\n prefix: {\n readonly scopeId: string;\n readonly organizationId: string;\n readonly version: number;\n },\n) {\n const obsolete = await tx\n .select({\n stage: {\n id: principalHistoryStages.id,\n organizationId: principalHistoryStages.organizationId,\n currentJson: principalHistoryStages.currentJson,\n afterVersion: principalHistoryStages.afterVersion,\n },\n })\n .from(principalHistoryStages)\n .where(\n and(\n eq(principalHistoryStages.scopeId, prefix.scopeId),\n eq(principalHistoryStages.organizationId, prefix.organizationId),\n eq(principalHistoryStages.complete, true),\n lt(principalHistoryStages.afterVersion, prefix.version),\n ),\n )\n .orderBy(\n desc(principalHistoryStages.afterVersion),\n desc(principalHistoryStages.touchedAt),\n asc(principalHistoryStages.id),\n )\n // Keep the current completed head and its newest completed predecessor.\n // This also preserves the prefix-only predecessor restored after an ack.\n .offset(2)\n .limit(PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT);\n for (const { stage } of obsolete) {\n await releasePrincipalHistoryRoot(tx, `stage:${stage.id}`);\n await archivePrincipalHistoryKeyEnvelopes(tx, {\n ...stage,\n version: stage.afterVersion + 1,\n });\n await tx\n .delete(principalHistoryStages)\n .where(eq(principalHistoryStages.id, stage.id))\n .run();\n }\n}\n"]}

package/data/persistence/principalHistory/principalHistoryUnpublishedRetention.js ADDED Viewed

@@ -0,0 +1,64 @@
+import { and, asc, desc, eq, inArray, lt, notInArray } from "drizzle-orm";
+import { principalHistoryPrefixes } from "../../sqlite/schema/principalHistoryEvidenceSchema.js";
+import { principalHistoryStages } from "../../sqlite/schema/principalHistoryStageSchema.js";
+import { archivePrincipalHistoryKeyEnvelopes } from "../principalKeys/principalKeyEnvelopeArchivePersistence.js";
+import { releasePrincipalHistoryRoot } from "./principalHistoryRootOwnership.js";
+import { PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT } from "./principalHistoryStageRetention.js";
+const COMPLETED_STAGE_LIMIT = 8;
+function matchingCompletedStages(current) {
+    return and(eq(principalHistoryStages.scopeId, current.scopeId), eq(principalHistoryStages.organizationId, current.organizationId), eq(principalHistoryStages.complete, true));
+}
+async function protectedPublishedStages(tx, current) {
+    const [prefix] = await tx
+        .select({ version: principalHistoryPrefixes.version })
+        .from(principalHistoryPrefixes)
+        .where(and(eq(principalHistoryPrefixes.scopeId, current.scopeId), eq(principalHistoryPrefixes.organizationId, current.organizationId)))
+        .limit(1);
+    if (!prefix)
+        return [];
+    return tx
+        .select({ id: principalHistoryStages.id })
+        .from(principalHistoryStages)
+        .where(and(matchingCompletedStages(current), lt(principalHistoryStages.afterVersion, prefix.version)))
+        .orderBy(desc(principalHistoryStages.afterVersion), desc(principalHistoryStages.touchedAt), asc(principalHistoryStages.id))
+        .limit(2);
+}
+/** Bound completed attempts even when current-artifact verification never publishes. */
+export async function reclaimUnpublishedPrincipalHistoryStages(tx, current) {
+    if (!current.complete)
+        return;
+    const published = await protectedPublishedStages(tx, current);
+    const protectedIds = [
+        ...new Set([current.id, ...published.map(({ id }) => id)]),
+    ];
+    const obsolete = await tx
+        .select({
+        stage: {
+            id: principalHistoryStages.id,
+            organizationId: principalHistoryStages.organizationId,
+            currentJson: principalHistoryStages.currentJson,
+            afterVersion: principalHistoryStages.afterVersion,
+        },
+    })
+        .from(principalHistoryStages)
+        .where(and(matchingCompletedStages(current), notInArray(principalHistoryStages.id, protectedIds)))
+        // The existing "incomplete" index also covers completed scoped recency.
+        .orderBy(desc(principalHistoryStages.touchedAt), asc(principalHistoryStages.id))
+        .offset(COMPLETED_STAGE_LIMIT - protectedIds.length)
+        .limit(PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT);
+    if (obsolete.length === 0)
+        return;
+    for (const { stage } of obsolete)
+        await archivePrincipalHistoryKeyEnvelopes(tx, {
+            ...stage,
+            version: stage.afterVersion + 1,
+        });
+    const ids = obsolete.map(({ stage }) => stage.id);
+    for (const id of ids)
+        await releasePrincipalHistoryRoot(tx, `stage:${id}`);
+    await tx
+        .delete(principalHistoryStages)
+        .where(inArray(principalHistoryStages.id, ids))
+        .run();
+}
+//# sourceMappingURL=principalHistoryUnpublishedRetention.js.map

package/data/persistence/principalHistory/principalHistoryUnpublishedRetention.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalHistoryUnpublishedRetention.js","sourceRoot":"","sources":["principalHistoryUnpublishedRetention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAEzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,yDAAyD,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AAEzF,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAShC,SAAS,uBAAuB,CAAC,OAAwB;IACvD,OAAO,GAAG,CACR,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACnD,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,EACjE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,EAAgC,EAChC,OAAwB;IAExB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;SACrD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,wBAAwB,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CACpE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC;SACzC,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CACJ,GAAG,CACD,uBAAuB,CAAC,OAAO,CAAC,EAChC,EAAE,CAAC,sBAAsB,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CACxD,CACF;SACA,OAAO,CACN,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,EACzC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACtC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAC/B;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,EAAgC,EAChC,OAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO;IAC9B,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,KAAK,EAAE;YACL,EAAE,EAAE,sBAAsB,CAAC,EAAE;YAC7B,cAAc,EAAE,sBAAsB,CAAC,cAAc;YACrD,WAAW,EAAE,sBAAsB,CAAC,WAAW;YAC/C,YAAY,EAAE,sBAAsB,CAAC,YAAY;SAClD;KACF,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CACJ,GAAG,CACD,uBAAuB,CAAC,OAAO,CAAC,EAChC,UAAU,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,CAAC,CACpD,CACF;QACD,wEAAwE;SACvE,OAAO,CACN,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACtC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAC/B;SACA,MAAM,CAAC,qBAAqB,GAAG,YAAY,CAAC,MAAM,CAAC;SACnD,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,QAAQ;QAC9B,MAAM,mCAAmC,CAAC,EAAE,EAAE;YAC5C,GAAG,KAAK;YACR,OAAO,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;SAChC,CAAC,CAAC;IACL,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,MAAM,2BAA2B,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE;SACL,MAAM,CAAC,sBAAsB,CAAC;SAC9B,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;SAC9C,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import { and, asc, desc, eq, inArray, lt, notInArray } from \"drizzle-orm\";\nimport { principalHistoryPrefixes } from \"../../sqlite/schema/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../../sqlite/schema/principalHistoryStageSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { archivePrincipalHistoryKeyEnvelopes } from \"../principalKeys/principalKeyEnvelopeArchivePersistence\";\nimport { releasePrincipalHistoryRoot } from \"./principalHistoryRootOwnership\";\nimport { PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT } from \"./principalHistoryStageRetention\";\n\nconst COMPLETED_STAGE_LIMIT = 8;\n\ninterface CompletedWriter {\n readonly id: string;\n readonly scopeId: string;\n readonly organizationId: string;\n readonly complete: boolean;\n}\n\nfunction matchingCompletedStages(current: CompletedWriter) {\n return and(\n eq(principalHistoryStages.scopeId, current.scopeId),\n eq(principalHistoryStages.organizationId, current.organizationId),\n eq(principalHistoryStages.complete, true),\n );\n}\n\nasync function protectedPublishedStages(\n tx: ClientSQLiteTransactionScope,\n current: CompletedWriter,\n) {\n const [prefix] = await tx\n .select({ version: principalHistoryPrefixes.version })\n .from(principalHistoryPrefixes)\n .where(\n and(\n eq(principalHistoryPrefixes.scopeId, current.scopeId),\n eq(principalHistoryPrefixes.organizationId, current.organizationId),\n ),\n )\n .limit(1);\n if (!prefix) return [];\n return tx\n .select({ id: principalHistoryStages.id })\n .from(principalHistoryStages)\n .where(\n and(\n matchingCompletedStages(current),\n lt(principalHistoryStages.afterVersion, prefix.version),\n ),\n )\n .orderBy(\n desc(principalHistoryStages.afterVersion),\n desc(principalHistoryStages.touchedAt),\n asc(principalHistoryStages.id),\n )\n .limit(2);\n}\n\n/** Bound completed attempts even when current-artifact verification never publishes. */\nexport async function reclaimUnpublishedPrincipalHistoryStages(\n tx: ClientSQLiteTransactionScope,\n current: CompletedWriter,\n) {\n if (!current.complete) return;\n const published = await protectedPublishedStages(tx, current);\n const protectedIds = [\n ...new Set([current.id, ...published.map(({ id }) => id)]),\n ];\n const obsolete = await tx\n .select({\n stage: {\n id: principalHistoryStages.id,\n organizationId: principalHistoryStages.organizationId,\n currentJson: principalHistoryStages.currentJson,\n afterVersion: principalHistoryStages.afterVersion,\n },\n })\n .from(principalHistoryStages)\n .where(\n and(\n matchingCompletedStages(current),\n notInArray(principalHistoryStages.id, protectedIds),\n ),\n )\n // The existing \"incomplete\" index also covers completed scoped recency.\n .orderBy(\n desc(principalHistoryStages.touchedAt),\n asc(principalHistoryStages.id),\n )\n .offset(COMPLETED_STAGE_LIMIT - protectedIds.length)\n .limit(PRINCIPAL_HISTORY_STAGE_RECLAIM_LIMIT);\n if (obsolete.length === 0) return;\n for (const { stage } of obsolete)\n await archivePrincipalHistoryKeyEnvelopes(tx, {\n ...stage,\n version: stage.afterVersion + 1,\n });\n const ids = obsolete.map(({ stage }) => stage.id);\n for (const id of ids) await releasePrincipalHistoryRoot(tx, `stage:${id}`);\n await tx\n .delete(principalHistoryStages)\n .where(inArray(principalHistoryStages.id, ids))\n .run();\n}\n"]}

package/data/persistence/principalKeys/principalGrantRetirementPersistence.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import { type AccessManifestCheckpoint, type VerifiedPrincipalPolicy, type VerifiedPrincipalPolicyCurrent } from "../../../internal/crypto/index.js";
+import type { ClientSQLiteTransactionScope } from "../../sqlite/sqlitePersistenceRuntime.js";
+export interface AcknowledgedPrincipalGrantRetirements {
+    readonly containerIds: readonly string[];
+    readonly organizationId: string;
+    readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;
+}
+export declare function storePrincipalGrantRetirements(tx: ClientSQLiteTransactionScope, retirement: AcknowledgedPrincipalGrantRetirements, policies: readonly (VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent)[], organizationId: string | undefined): Promise<void>;
+export declare function assertContainerNotRetired(tx: ClientSQLiteTransactionScope, checkpoint: AccessManifestCheckpoint): Promise<void>;

package/data/persistence/principalKeys/principalGrantRetirementPersistence.js ADDED Viewed

@@ -0,0 +1,43 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalGrantRetirements } from "../../sqlite/schema/principalGrantRetirementSchema.js";
+export async function storePrincipalGrantRetirements(tx, retirement, policies, organizationId) {
+    if (!policies.some((policy) => policy.principalId === retirement.policy.principalId &&
+        policy.principalType === retirement.policy.principalType &&
+        policy.stateHash === retirement.policy.stateHash)) {
+        throw new KeyingVerificationError("object_mismatch", "Retirement must accompany its acknowledged policy");
+    }
+    const history = "retainedHistory" in retirement.policy
+        ? retirement.policy.retainedHistory
+        : retirement.policy.history;
+    const previous = history?.find((entry) => entry.state.stateHash === retirement.policy.state.prevStateHash);
+    const granted = new Set([...retirement.policy.grants, ...(previous?.grants ?? [])].map((grant) => grant.containerId));
+    if (retirement.organizationId !== organizationId ||
+        retirement.containerIds.some((id) => !granted.has(id))) {
+        throw new KeyingVerificationError("object_mismatch", "Retirement must match the acknowledged organization and signed grants");
+    }
+    for (const containerId of new Set(retirement.containerIds)) {
+        await tx
+            .insert(principalGrantRetirements)
+            .values({
+            organizationId: retirement.organizationId,
+            containerId,
+            principalId: retirement.policy.principalId,
+            policyStateHash: retirement.policy.stateHash,
+        })
+            .onConflictDoNothing()
+            .run();
+    }
+}
+export async function assertContainerNotRetired(tx, checkpoint) {
+    if (checkpoint.objectKind !== "container")
+        return;
+    const [retired] = await tx
+        .select({ containerId: principalGrantRetirements.containerId })
+        .from(principalGrantRetirements)
+        .where(and(eq(principalGrantRetirements.organizationId, checkpoint.organizationId), eq(principalGrantRetirements.containerId, checkpoint.objectId)))
+        .limit(1);
+    if (retired)
+        throw new KeyingVerificationError("equivocation", `Container ${checkpoint.objectId} was retired during principal rotation`);
+}
+//# sourceMappingURL=principalGrantRetirementPersistence.js.map

package/data/persistence/principalKeys/principalGrantRetirementPersistence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalGrantRetirementPersistence.js","sourceRoot":"","sources":["principalGrantRetirementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAS/F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAgC,EAChC,UAAiD,EACjD,QAGG,EACH,cAAkC;IAElC,IACE,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW;QACpD,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;QACxD,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CACnD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,iBAAiB,IAAI,UAAU,CAAC,MAAM;QACpC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CACF,CAAC;IACF,IACE,UAAU,CAAC,cAAc,KAAK,cAAc;QAC5C,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC;YACN,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW;YAC1C,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;SAC7C,CAAC;aACD,mBAAmB,EAAE;aACrB,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAgC,EAChC,UAAoC;IAEpC,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,EAAE,CAAC;SAC9D,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EACvE,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC/D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO;QACT,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,aAAa,UAAU,CAAC,QAAQ,wCAAwC,CACzE,CAAC;AACN,CAAC","sourcesContent":["import {\n type AccessManifestCheckpoint,\n KeyingVerificationError,\n type VerifiedPrincipalPolicy,\n type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalGrantRetirements } from \"../../sqlite/schema/principalGrantRetirementSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\n\nexport interface AcknowledgedPrincipalGrantRetirements {\n readonly containerIds: readonly string[];\n readonly organizationId: string;\n readonly policy: VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent;\n}\n\nexport async function storePrincipalGrantRetirements(\n tx: ClientSQLiteTransactionScope,\n retirement: AcknowledgedPrincipalGrantRetirements,\n policies: readonly (\n | VerifiedPrincipalPolicy\n | VerifiedPrincipalPolicyCurrent\n )[],\n organizationId: string | undefined,\n): Promise<void> {\n if (\n !policies.some(\n (policy) =>\n policy.principalId === retirement.policy.principalId &&\n policy.principalType === retirement.policy.principalType &&\n policy.stateHash === retirement.policy.stateHash,\n )\n ) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Retirement must accompany its acknowledged policy\",\n );\n }\n const history =\n \"retainedHistory\" in retirement.policy\n ? retirement.policy.retainedHistory\n : retirement.policy.history;\n const previous = history?.find(\n (entry) => entry.state.stateHash === retirement.policy.state.prevStateHash,\n );\n const granted = new Set(\n [...retirement.policy.grants, ...(previous?.grants ?? [])].map(\n (grant) => grant.containerId,\n ),\n );\n if (\n retirement.organizationId !== organizationId ||\n retirement.containerIds.some((id) => !granted.has(id))\n ) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Retirement must match the acknowledged organization and signed grants\",\n );\n }\n for (const containerId of new Set(retirement.containerIds)) {\n await tx\n .insert(principalGrantRetirements)\n .values({\n organizationId: retirement.organizationId,\n containerId,\n principalId: retirement.policy.principalId,\n policyStateHash: retirement.policy.stateHash,\n })\n .onConflictDoNothing()\n .run();\n }\n}\n\nexport async function assertContainerNotRetired(\n tx: ClientSQLiteTransactionScope,\n checkpoint: AccessManifestCheckpoint,\n): Promise<void> {\n if (checkpoint.objectKind !== \"container\") return;\n const [retired] = await tx\n .select({ containerId: principalGrantRetirements.containerId })\n .from(principalGrantRetirements)\n .where(\n and(\n eq(principalGrantRetirements.organizationId, checkpoint.organizationId),\n eq(principalGrantRetirements.containerId, checkpoint.objectId),\n ),\n )\n .limit(1);\n if (retired)\n throw new KeyingVerificationError(\n \"equivocation\",\n `Container ${checkpoint.objectId} was retired during principal rotation`,\n );\n}\n"]}

package/data/persistence/principalKeys/principalKeyEnvelopeArchivePersistence.js ADDED Viewed

@@ -0,0 +1,63 @@
+import { computePrincipalMemberEnvelopesRoot } from "../../../internal/crypto/index.js";
+import { isPrincipalPolicyPageResponse } from "../../../internal/validators/response/index.js";
+import { lte } from "drizzle-orm";
+import { principalKeyEnvelopeArchive } from "../../sqlite/schema/principalHistoryRetentionSchema.js";
+/**
+ * Preserve untrusted encrypted candidates, never history or authorization.
+ * The caller replaces progress in this same transaction. Public-history hints
+ * carry no private artifacts and deliberately contribute no candidates.
+ */
+export async function archivePrincipalHistoryKeyEnvelopes(tx, input) {
+    let current;
+    try {
+        current = JSON.parse(input.currentJson);
+    }
+    catch {
+        return;
+    }
+    if (!current || typeof current !== "object" || Array.isArray(current))
+        return;
+    const page = {
+        ...current,
+        previousStates: [],
+        historyPage: { afterVersion: input.version - 1, nextAfterVersion: null },
+    };
+    if (!isPrincipalPolicyPageResponse(page) ||
+        page.currentState.version !== input.version ||
+        page.currentState.stateHash !== page.currentMemberEnvelopes.stateHash ||
+        page.currentState.principalId !== page.currentMemberEnvelopes.principalId ||
+        page.currentState.principalType !==
+            page.currentMemberEnvelopes.principalType ||
+        page.currentState.keyEpoch !== page.currentMemberEnvelopes.epoch)
+        return;
+    try {
+        if ((await computePrincipalMemberEnvelopesRoot(page.currentMemberEnvelopes.envelopes)) !== page.currentState.memberEnvelopesRoot)
+            return;
+    }
+    catch {
+        return;
+    }
+    const row = {
+        organizationId: input.organizationId,
+        principalId: page.currentState.principalId,
+        principalType: page.currentState.principalType,
+        keyFingerprint: page.currentState.keyFingerprint,
+        version: input.version,
+        envelopesJson: JSON.stringify(page.currentMemberEnvelopes),
+    };
+    await tx
+        .insert(principalKeyEnvelopeArchive)
+        .values(row)
+        .onConflictDoUpdate({
+        target: [
+            principalKeyEnvelopeArchive.organizationId,
+            principalKeyEnvelopeArchive.principalType,
+            principalKeyEnvelopeArchive.principalId,
+            principalKeyEnvelopeArchive.keyFingerprint,
+        ],
+        set: row,
+        setWhere: lte(principalKeyEnvelopeArchive.version, row.version),
+    })
+        .run();
+}
+//# sourceMappingURL=principalKeyEnvelopeArchivePersistence.js.map

package/data/persistence/principalKeys/principalKeyEnvelopeArchivePersistence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalKeyEnvelopeArchivePersistence.js","sourceRoot":"","sources":["principalKeyEnvelopeArchivePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AAGlG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,EAAgC,EAChC,KAIC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO;IAC9E,MAAM,IAAI,GAAG;QACX,GAAG,OAAO;QACV,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE;KACzE,CAAC;IACF,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC3C,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,IAAI,CAAC,sBAAsB,CAAC,SAAS;QACrE,IAAI,CAAC,YAAY,CAAC,WAAW,KAAK,IAAI,CAAC,sBAAsB,CAAC,WAAW;QACzE,IAAI,CAAC,YAAY,CAAC,aAAa;YAC7B,IAAI,CAAC,sBAAsB,CAAC,aAAa;QAC3C,IAAI,CAAC,YAAY,CAAC,QAAQ,KAAK,IAAI,CAAC,sBAAsB,CAAC,KAAK;QAEhE,OAAO;IACT,IAAI,CAAC;QACH,IACE,CAAC,MAAM,mCAAmC,CACxC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CACtC,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,mBAAmB;YAE5C,OAAO;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW;QAC1C,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,aAAa;QAC9C,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC;KAC3D,CAAC;IACF,MAAM,EAAE;SACL,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,2BAA2B,CAAC,cAAc;YAC1C,2BAA2B,CAAC,aAAa;YACzC,2BAA2B,CAAC,WAAW;YACvC,2BAA2B,CAAC,cAAc;SAC3C;QACD,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,GAAG,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;KAChE,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import { computePrincipalMemberEnvelopesRoot } from \"@tearleads/crypto\";\nimport { isPrincipalPolicyPageResponse } from \"@tearleads/validators/response\";\nimport { lte } from \"drizzle-orm\";\nimport { principalKeyEnvelopeArchive } from \"../../sqlite/schema/principalHistoryRetentionSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\n\n/**\n * Preserve untrusted encrypted candidates, never history or authorization.\n * The caller replaces progress in this same transaction. Public-history hints\n * carry no private artifacts and deliberately contribute no candidates.\n */\nexport async function archivePrincipalHistoryKeyEnvelopes(\n tx: ClientSQLiteTransactionScope,\n input: {\n readonly organizationId: string;\n readonly currentJson: string;\n readonly version: number;\n },\n) {\n let current: unknown;\n try {\n current = JSON.parse(input.currentJson);\n } catch {\n return;\n }\n if (!current || typeof current !== \"object\" || Array.isArray(current)) return;\n const page = {\n ...current,\n previousStates: [],\n historyPage: { afterVersion: input.version - 1, nextAfterVersion: null },\n };\n if (\n !isPrincipalPolicyPageResponse(page) ||\n page.currentState.version !== input.version ||\n page.currentState.stateHash !== page.currentMemberEnvelopes.stateHash ||\n page.currentState.principalId !== page.currentMemberEnvelopes.principalId ||\n page.currentState.principalType !==\n page.currentMemberEnvelopes.principalType ||\n page.currentState.keyEpoch !== page.currentMemberEnvelopes.epoch\n )\n return;\n try {\n if (\n (await computePrincipalMemberEnvelopesRoot(\n page.currentMemberEnvelopes.envelopes,\n )) !== page.currentState.memberEnvelopesRoot\n )\n return;\n } catch {\n return;\n }\n const row = {\n organizationId: input.organizationId,\n principalId: page.currentState.principalId,\n principalType: page.currentState.principalType,\n keyFingerprint: page.currentState.keyFingerprint,\n version: input.version,\n envelopesJson: JSON.stringify(page.currentMemberEnvelopes),\n };\n await tx\n .insert(principalKeyEnvelopeArchive)\n .values(row)\n .onConflictDoUpdate({\n target: [\n principalKeyEnvelopeArchive.organizationId,\n principalKeyEnvelopeArchive.principalType,\n principalKeyEnvelopeArchive.principalId,\n principalKeyEnvelopeArchive.keyFingerprint,\n ],\n set: row,\n setWhere: lte(principalKeyEnvelopeArchive.version, row.version),\n })\n .run();\n}\n"]}

package/data/persistence/principalKeys/principalKeyEnvelopeCandidates.js ADDED Viewed

@@ -0,0 +1,87 @@
+import { isCurrentPrincipalMemberEnvelopesResponse, } from "../../../internal/validators/response/index.js";
+import { and, desc, eq, sql } from "drizzle-orm";
+import { principalCurrentFingerprintJson, principalStateFingerprintJson, } from "../../sqlite/principalKeyFingerprintJson.js";
+import { principalPolicyTables } from "../../sqlite/schema/index.js";
+import { principalHistoryEvidenceTables, principalHistoryPrefixes, } from "../../sqlite/schema/principalHistoryEvidenceSchema.js";
+import { principalKeyEnvelopeArchive } from "../../sqlite/schema/principalHistoryRetentionSchema.js";
+import { principalHistoryStages } from "../../sqlite/schema/principalHistoryStageSchema.js";
+import { principalPolicies, principalPolicyBundleHistory, } from "../../sqlite/schema/principalPolicySchema.js";
+import { getClientSQLitePersistenceRuntime } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
+/**
+ * Untrusted encrypted key candidates, never authorization evidence. The actual
+ * private key must open the requested recipient wrap; the projection verifier
+ * separately checks the signed KEK material identity and all policy authority.
+ * Read only envelopes for the requested fingerprints, never signed histories.
+ */
+export async function loadPrincipalKeyEnvelopeCandidates(execSql, fingerprints) {
+    await ensureSqlTables(execSql, [
+        ...principalPolicyTables,
+        ...principalHistoryEvidenceTables,
+    ]);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const candidates = [];
+    for (const fingerprint of new Set(fingerprints)) {
+        const encoded = [];
+        const [archived] = await db
+            .select({ envelopes: principalKeyEnvelopeArchive.envelopesJson })
+            .from(principalKeyEnvelopeArchive)
+            .where(eq(principalKeyEnvelopeArchive.keyFingerprint, fingerprint))
+            .orderBy(desc(principalKeyEnvelopeArchive.version))
+            .limit(1);
+        if (archived)
+            encoded.push(archived.envelopes);
+        for (const table of [principalPolicies, principalPolicyBundleHistory]) {
+            const [row] = await db
+                .select({ envelopes: table.currentMemberEnvelopesJson })
+                .from(table)
+                .where(eq(principalStateFingerprintJson(table.currentStateJson), fingerprint))
+                .orderBy(desc(table.updatedAt))
+                .limit(1);
+            if (row)
+                encoded.push(row.envelopes);
+        }
+        const [prefix] = await db
+            .select({
+            envelopes: sql `json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,
+        })
+            .from(principalHistoryPrefixes)
+            .where(eq(principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson), fingerprint))
+            .orderBy(desc(principalHistoryPrefixes.version))
+            .limit(1);
+        if (prefix)
+            encoded.push(prefix.envelopes);
+        const [stage] = await db
+            .select({
+            envelopes: sql `json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,
+        })
+            .from(principalHistoryStages)
+            .where(and(eq(principalCurrentFingerprintJson(principalHistoryStages.currentJson), fingerprint), eq(principalHistoryStages.complete, true)))
+            .orderBy(desc(principalHistoryStages.afterVersion))
+            .limit(1);
+        if (stage)
+            encoded.push(stage.envelopes);
+        for (const json of new Set(encoded)) {
+            let envelopes;
+            try {
+                envelopes = JSON.parse(json);
+            }
+            catch {
+                continue;
+            }
+            if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes))
+                continue;
+            candidates.push({
+                currentState: {
+                    principalType: envelopes.principalType,
+                    principalId: envelopes.principalId,
+                    stateHash: envelopes.stateHash,
+                    keyFingerprint: fingerprint,
+                },
+                currentMemberEnvelopes: envelopes,
+            });
+        }
+    }
+    return candidates;
+}
+//# sourceMappingURL=principalKeyEnvelopeCandidates.js.map

package/data/persistence/principalKeys/principalKeyEnvelopeCandidates.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalKeyEnvelopeCandidates.js","sourceRoot":"","sources":["principalKeyEnvelopeCandidates.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yCAAyC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAYvE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAgB,EAChB,YAA+B;IAE/B,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,qBAAqB;QACxB,GAAG,8BAA8B;KAClC,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,SAAS,EAAE,2BAA2B,CAAC,aAAa,EAAE,CAAC;aAChE,IAAI,CAAC,2BAA2B,CAAC;aACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;aAClE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;aAClD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,0BAA0B,EAAE,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACJ,EAAE,CACA,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACrD,WAAW,CACZ,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,wBAAwB,CAAC,WAAW,+BAA+B;SAC1G,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,+BAA+B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EACrE,WAAW,CACZ,CACF;aACA,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACN,SAAS,EAAE,GAAG,CAAQ,gBAAgB,sBAAsB,CAAC,WAAW,+BAA+B;SACxG,CAAC;aACD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,sBAAsB,CAAC,WAAW,CAAC,EACnE,WAAW,CACZ,EACD,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC1C,CACF;aACA,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;aAClD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,yCAAyC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,cAAc,EAAE,WAAW;iBAC5B;gBACD,sBAAsB,EAAE,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n type CurrentPrincipalMemberEnvelopesResponse,\n isCurrentPrincipalMemberEnvelopesResponse,\n} from \"@tearleads/validators/response\";\nimport { and, desc, eq, sql } from \"drizzle-orm\";\nimport {\n principalCurrentFingerprintJson,\n principalStateFingerprintJson,\n} from \"../../sqlite/principalKeyFingerprintJson\";\nimport { principalPolicyTables } from \"../../sqlite/schema\";\nimport {\n principalHistoryEvidenceTables,\n principalHistoryPrefixes,\n} from \"../../sqlite/schema/principalHistoryEvidenceSchema\";\nimport { principalKeyEnvelopeArchive } from \"../../sqlite/schema/principalHistoryRetentionSchema\";\nimport { principalHistoryStages } from \"../../sqlite/schema/principalHistoryStageSchema\";\nimport {\n principalPolicies,\n principalPolicyBundleHistory,\n} from \"../../sqlite/schema/principalPolicySchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\n\nexport interface PrincipalKeyEnvelopeCandidate {\n readonly currentState: {\n readonly principalType: \"group\" | \"organization\";\n readonly principalId: string;\n readonly stateHash: string;\n readonly keyFingerprint: string;\n };\n readonly currentMemberEnvelopes: CurrentPrincipalMemberEnvelopesResponse;\n}\n\n/**\n * Untrusted encrypted key candidates, never authorization evidence. The actual\n * private key must open the requested recipient wrap; the projection verifier\n * separately checks the signed KEK material identity and all policy authority.\n * Read only envelopes for the requested fingerprints, never signed histories.\n */\nexport async function loadPrincipalKeyEnvelopeCandidates(\n execSql: ExecSql,\n fingerprints: readonly string[],\n): Promise<PrincipalKeyEnvelopeCandidate[]> {\n await ensureSqlTables(execSql, [\n ...principalPolicyTables,\n ...principalHistoryEvidenceTables,\n ]);\n const { db } = getClientSQLitePersistenceRuntime(execSql);\n const candidates: PrincipalKeyEnvelopeCandidate[] = [];\n for (const fingerprint of new Set(fingerprints)) {\n const encoded: string[] = [];\n const [archived] = await db\n .select({ envelopes: principalKeyEnvelopeArchive.envelopesJson })\n .from(principalKeyEnvelopeArchive)\n .where(eq(principalKeyEnvelopeArchive.keyFingerprint, fingerprint))\n .orderBy(desc(principalKeyEnvelopeArchive.version))\n .limit(1);\n if (archived) encoded.push(archived.envelopes);\n for (const table of [principalPolicies, principalPolicyBundleHistory]) {\n const [row] = await db\n .select({ envelopes: table.currentMemberEnvelopesJson })\n .from(table)\n .where(\n eq(\n principalStateFingerprintJson(table.currentStateJson),\n fingerprint,\n ),\n )\n .orderBy(desc(table.updatedAt))\n .limit(1);\n if (row) encoded.push(row.envelopes);\n }\n const [prefix] = await db\n .select({\n envelopes: sql<string>`json_extract(${principalHistoryPrefixes.currentJson}, '$.currentMemberEnvelopes')`,\n })\n .from(principalHistoryPrefixes)\n .where(\n eq(\n principalCurrentFingerprintJson(principalHistoryPrefixes.currentJson),\n fingerprint,\n ),\n )\n .orderBy(desc(principalHistoryPrefixes.version))\n .limit(1);\n if (prefix) encoded.push(prefix.envelopes);\n const [stage] = await db\n .select({\n envelopes: sql<string>`json_extract(${principalHistoryStages.currentJson}, '$.currentMemberEnvelopes')`,\n })\n .from(principalHistoryStages)\n .where(\n and(\n eq(\n principalCurrentFingerprintJson(principalHistoryStages.currentJson),\n fingerprint,\n ),\n eq(principalHistoryStages.complete, true),\n ),\n )\n .orderBy(desc(principalHistoryStages.afterVersion))\n .limit(1);\n if (stage) encoded.push(stage.envelopes);\n for (const json of new Set(encoded)) {\n let envelopes: unknown;\n try {\n envelopes = JSON.parse(json);\n } catch {\n continue;\n }\n if (!isCurrentPrincipalMemberEnvelopesResponse(envelopes)) continue;\n candidates.push({\n currentState: {\n principalType: envelopes.principalType,\n principalId: envelopes.principalId,\n stateHash: envelopes.stateHash,\n keyFingerprint: fingerprint,\n },\n currentMemberEnvelopes: envelopes,\n });\n }\n }\n return candidates;\n}\n"]}

package/data/persistence/principalMutationJournalPersistence.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { principalMutationJournal } from "../sqlite/principalMutationJournalSchema.js";
+import { principalMutationJournal } from "../sqlite/schema/principalMutationJournalSchema.js";
 import { type ExecSql } from "../sqlite/sqlSchema.js";
 export type PrincipalMutationJournalRow = typeof principalMutationJournal.$inferSelect;
 export declare class PendingPrincipalMutationError extends Error {

package/data/persistence/principalMutationJournalPersistence.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { and, eq } from "drizzle-orm";
 import { assertProjectionVerificationCurrent } from "../keyingProjectionVerification/types.js";
-import { principalMutationJournal, principalMutationJournalTables, } from "../sqlite/principalMutationJournalSchema.js";
+import { principalMutationJournal, principalMutationJournalTables, } from "../sqlite/schema/principalMutationJournalSchema.js";
 import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../sqlite/sqlSchema.js";
 export class PendingPrincipalMutationError extends Error {

package/data/persistence/principalMutationJournalPersistence.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutationJournalPersistence.js","sourceRoot":"","sources":["principalMutationJournalPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,~~0CAA0C~~,CAAC;~~AAClD~~,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CACH,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;aACrD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,wBAAwB,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,EAC/D,EAAE,CACA,wBAAwB,CAAC,iBAAiB,EAC1C,GAAG,CAAC,iBAAiB,CACtB,EACD,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CACtD,CACF;aACA,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;AAChC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n principalMutationJournal,\n principalMutationJournalTables,\n} from \"../sqlite/principalMutationJournalSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalMutationJournalRow =\n typeof principalMutationJournal.$inferSelect;\n\nexport class PendingPrincipalMutationError extends Error {\n constructor() {\n super(\n \"Resolve the pending principal mutation or explicitly abandon its retry before submitting another\",\n );\n this.name = \"PendingPrincipalMutationError\";\n }\n}\n\nexport async function loadPrincipalMutationJournal(\n execSql: ExecSql,\n scopeId: string,\n): Promise<PrincipalMutationJournalRow \| null> {\n await ensureSqlTables(execSql, principalMutationJournalTables);\n const { db } = getClientSQLitePersistenceRuntime(execSql);\n const [row] = await db\n .select()\n .from(principalMutationJournal)\n .where(eq(principalMutationJournal.scopeId, scopeId))\n .limit(1);\n return row ?? null;\n}\n\n/** Claim the organization lane before dispatch; never overwrite unresolved work. /\nexport async function claimPrincipalMutationJournal(input: {\n readonly execSql: ExecSql;\n readonly row: PrincipalMutationJournalRow;\n readonly stillCurrent: () => boolean;\n}): Promise<void> {\n const row = { ...input.row };\n await ensureSqlTables(input.execSql, principalMutationJournalTables);\n const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n const result = await runtime.guardedTransaction(\n async (tx) => {\n const [existing] = await tx\n .select({ scopeId: principalMutationJournal.scopeId })\n .from(principalMutationJournal)\n .where(eq(principalMutationJournal.scopeId, row.scopeId))\n .limit(1);\n if (existing) throw new PendingPrincipalMutationError();\n await tx.insert(principalMutationJournal).values(row).run();\n },\n input.stillCurrent,\n { behavior: \"immediate\" },\n );\n assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/* A late acknowledgement cannot retire another operation's journal entry. */\nexport async function clearPrincipalMutationJournal(input: {\n readonly execSql: ExecSql;\n readonly row: PrincipalMutationJournalRow;\n readonly stillCurrent: () => boolean;\n}): Promise<boolean> {\n const row = { ...input.row };\n const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n const result = await runtime.guardedTransaction(\n async (tx) => {\n const deleted = await tx\n .delete(principalMutationJournal)\n .where(\n and(\n eq(principalMutationJournal.scopeId, row.scopeId),\n eq(principalMutationJournal.organizationId, row.organizationId),\n eq(\n principalMutationJournal.serializedRequest,\n row.serializedRequest,\n ),\n eq(principalMutationJournal.signature, row.signature),\n ),\n )\n .returning({ scopeId: principalMutationJournal.scopeId });\n return deleted.length > 0;\n },\n input.stillCurrent,\n { behavior: \"immediate\" },\n );\n assertProjectionVerificationCurrent(() => result.committed);\n return result.result === true;\n}\n"]}
1	+ {"version":3,"file":"principalMutationJournalPersistence.js","sourceRoot":"","sources":["principalMutationJournalPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKpE,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CACH,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,OAAe;IAEf,MAAM,eAAe,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;aACrD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,wBAAwB,CAAC;aAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,wBAAwB,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,EAC/D,EAAE,CACA,wBAAwB,CAAC,iBAAiB,EAC1C,GAAG,CAAC,iBAAiB,CACtB,EACD,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CACtD,CACF;aACA,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC,EACD,KAAK,CAAC,YAAY,EAClB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;AAChC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport {\n principalMutationJournal,\n principalMutationJournalTables,\n} from \"../sqlite/schema/principalMutationJournalSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport type PrincipalMutationJournalRow =\n typeof principalMutationJournal.$inferSelect;\n\nexport class PendingPrincipalMutationError extends Error {\n constructor() {\n super(\n \"Resolve the pending principal mutation or explicitly abandon its retry before submitting another\",\n );\n this.name = \"PendingPrincipalMutationError\";\n }\n}\n\nexport async function loadPrincipalMutationJournal(\n execSql: ExecSql,\n scopeId: string,\n): Promise<PrincipalMutationJournalRow \| null> {\n await ensureSqlTables(execSql, principalMutationJournalTables);\n const { db } = getClientSQLitePersistenceRuntime(execSql);\n const [row] = await db\n .select()\n .from(principalMutationJournal)\n .where(eq(principalMutationJournal.scopeId, scopeId))\n .limit(1);\n return row ?? null;\n}\n\n/** Claim the organization lane before dispatch; never overwrite unresolved work. /\nexport async function claimPrincipalMutationJournal(input: {\n readonly execSql: ExecSql;\n readonly row: PrincipalMutationJournalRow;\n readonly stillCurrent: () => boolean;\n}): Promise<void> {\n const row = { ...input.row };\n await ensureSqlTables(input.execSql, principalMutationJournalTables);\n const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n const result = await runtime.guardedTransaction(\n async (tx) => {\n const [existing] = await tx\n .select({ scopeId: principalMutationJournal.scopeId })\n .from(principalMutationJournal)\n .where(eq(principalMutationJournal.scopeId, row.scopeId))\n .limit(1);\n if (existing) throw new PendingPrincipalMutationError();\n await tx.insert(principalMutationJournal).values(row).run();\n },\n input.stillCurrent,\n { behavior: \"immediate\" },\n );\n assertProjectionVerificationCurrent(() => result.committed);\n}\n\n/* A late acknowledgement cannot retire another operation's journal entry. */\nexport async function clearPrincipalMutationJournal(input: {\n readonly execSql: ExecSql;\n readonly row: PrincipalMutationJournalRow;\n readonly stillCurrent: () => boolean;\n}): Promise<boolean> {\n const row = { ...input.row };\n const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n const result = await runtime.guardedTransaction(\n async (tx) => {\n const deleted = await tx\n .delete(principalMutationJournal)\n .where(\n and(\n eq(principalMutationJournal.scopeId, row.scopeId),\n eq(principalMutationJournal.organizationId, row.organizationId),\n eq(\n principalMutationJournal.serializedRequest,\n row.serializedRequest,\n ),\n eq(principalMutationJournal.signature, row.signature),\n ),\n )\n .returning({ scopeId: principalMutationJournal.scopeId });\n return deleted.length > 0;\n },\n input.stillCurrent,\n { behavior: \"immediate\" },\n );\n assertProjectionVerificationCurrent(() => result.committed);\n return result.result === true;\n}\n"]}

package/data/persistence/principalPolicy/principalPolicyBundleIntegrity.js ADDED Viewed

@@ -0,0 +1,49 @@
+import { compareCanonicalStrings, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../../internal/crypto/index.js";
+import { isPrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
+import { canonicalKeyingJsonString } from "../../keying/canonicalJson.js";
+import { storedPrincipalPolicyBundleFromJson, } from "./storedPrincipalPolicyBundle.js";
+function parseBundle(row) {
+    const bundle = storedPrincipalPolicyBundleFromJson(row);
+    if (!isPrincipalPolicyBundleResponse(bundle)) {
+        throw new Error("Stored principal policy bundle is invalid");
+    }
+    return bundle;
+}
+function canonical(value) {
+    return canonicalKeyingJsonString(value, "principal policy bundle security content");
+}
+function withoutCreatedAt(value) {
+    const { createdAt: _createdAt, ...content } = value;
+    return content;
+}
+function securityContent(bundle) {
+    return {
+        currentMemberEnvelopes: {
+            ...bundle.currentMemberEnvelopes,
+            envelopes: [...bundle.currentMemberEnvelopes.envelopes].sort((a, b) => compareCanonicalStrings(canonical(a), canonical(b))),
+        },
+        currentPayload: withoutCreatedAt(bundle.currentPayload),
+        currentProjection: normalizePrincipalProjectionMembers(bundle.currentProjection),
+        currentGrants: normalizePrincipalContainerGrants(bundle.currentGrants),
+        currentState: withoutCreatedAt(bundle.currentState),
+        previousStates: bundle.previousStates.map((entry) => ({
+            projection: normalizePrincipalProjectionMembers(entry.projection),
+            grants: normalizePrincipalContainerGrants(entry.grants),
+            state: withoutCreatedAt(entry.state),
+        })),
+    };
+}
+export function assertSameHeadPrincipalPolicyBundle(stored, incoming) {
+    try {
+        if (canonical(securityContent(parseBundle(stored))) ===
+            canonical(securityContent(parseBundle(incoming)))) {
+            return;
+        }
+    }
+    catch {
+        // Invalid same-head cache content is also an integrity conflict: replacing
+        // it would erase the only durable evidence that the head was inconsistent.
+    }
+    throw new KeyingVerificationError("equivocation", "principal policy bundle content conflicts with the cached bundle at the same head");
+}
+//# sourceMappingURL=principalPolicyBundleIntegrity.js.map

package/data/persistence/principalPolicy/principalPolicyBundleIntegrity.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyBundleIntegrity.js","sourceRoot":"","sources":["principalPolicyBundleIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAEL,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AAEvC,SAAS,WAAW,CAClB,GAAoC;IAEpC,MAAM,MAAM,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,yBAAyB,CAC9B,KAAK,EACL,0CAA0C,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAQ;IAER,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAqC;IAC5D,OAAO;QACL,sBAAsB,EAAE;YACtB,GAAG,MAAM,CAAC,sBAAsB;YAChC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACpE,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CACpD;SACF;QACD,cAAc,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QACvD,iBAAiB,EAAE,mCAAmC,CACpD,MAAM,CAAC,iBAAiB,CACzB;QACD,aAAa,EAAE,iCAAiC,CAAC,MAAM,CAAC,aAAa,CAAC;QACtE,YAAY,EAAE,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;YACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;YACvD,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;SACrC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAuC,EACvC,QAAyC;IAEzC,IAAI,CAAC;QACH,IACE,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EACjD,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,2EAA2E;IAC7E,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mFAAmF,CACpF,CAAC;AACJ,CAAC","sourcesContent":["import {\n compareCanonicalStrings,\n KeyingVerificationError,\n normalizePrincipalContainerGrants,\n normalizePrincipalProjectionMembers,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { isPrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../keying/canonicalJson\";\nimport {\n type StoredPrincipalPolicyBundleJson,\n storedPrincipalPolicyBundleFromJson,\n} from \"./storedPrincipalPolicyBundle\";\n\nfunction parseBundle(\n row: StoredPrincipalPolicyBundleJson,\n): PrincipalPolicyBundleResponse {\n const bundle = storedPrincipalPolicyBundleFromJson(row);\n if (!isPrincipalPolicyBundleResponse(bundle)) {\n throw new Error(\"Stored principal policy bundle is invalid\");\n }\n return bundle;\n}\n\nfunction canonical(value: unknown): string {\n return canonicalKeyingJsonString(\n value,\n \"principal policy bundle security content\",\n );\n}\n\nfunction withoutCreatedAt<T extends { readonly createdAt: string }>(\n value: T,\n): Omit<T, \"createdAt\"> {\n const { createdAt: _createdAt, ...content } = value;\n return content;\n}\n\nfunction securityContent(bundle: PrincipalPolicyBundleResponse) {\n return {\n currentMemberEnvelopes: {\n ...bundle.currentMemberEnvelopes,\n envelopes: [...bundle.currentMemberEnvelopes.envelopes].sort((a, b) =>\n compareCanonicalStrings(canonical(a), canonical(b)),\n ),\n },\n currentPayload: withoutCreatedAt(bundle.currentPayload),\n currentProjection: normalizePrincipalProjectionMembers(\n bundle.currentProjection,\n ),\n currentGrants: normalizePrincipalContainerGrants(bundle.currentGrants),\n currentState: withoutCreatedAt(bundle.currentState),\n previousStates: bundle.previousStates.map((entry) => ({\n projection: normalizePrincipalProjectionMembers(entry.projection),\n grants: normalizePrincipalContainerGrants(entry.grants),\n state: withoutCreatedAt(entry.state),\n })),\n };\n}\n\nexport function assertSameHeadPrincipalPolicyBundle(\n stored: StoredPrincipalPolicyBundleJson,\n incoming: StoredPrincipalPolicyBundleJson,\n): void {\n try {\n if (\n canonical(securityContent(parseBundle(stored))) ===\n canonical(securityContent(parseBundle(incoming)))\n ) {\n return;\n }\n } catch {\n // Invalid same-head cache content is also an integrity conflict: replacing\n // it would erase the only durable evidence that the head was inconsistent.\n }\n throw new KeyingVerificationError(\n \"equivocation\",\n \"principal policy bundle content conflicts with the cached bundle at the same head\",\n );\n}\n"]}

package/data/persistence/principalPolicy/principalPolicyCheckpointSelection.js ADDED Viewed

@@ -0,0 +1,26 @@
+import { verifyPrincipalPolicyCheckpoint } from "../../../internal/crypto/index.js";
+import { assertPrincipalPolicyCheckpointShape } from "../keyingCheckpoints/keyingCheckpointPersistence.js";
+export function principalPolicyHeadMeetsCheckpoint(head, checkpoint) {
+    return (!checkpoint ||
+        head.version > checkpoint.version ||
+        (head.version === checkpoint.version &&
+            head.stateHash === checkpoint.stateHash));
+}
+export function verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint) {
+    if (!checkpoint) {
+        return true;
+    }
+    assertPrincipalPolicyCheckpointShape(checkpoint, policy);
+    if (policy.version < checkpoint.version) {
+        return false;
+    }
+    verifyPrincipalPolicyCheckpoint({
+        chain: "retainedHistory" in policy
+            ? policy.retainedHistory
+            : (policy.history ?? []),
+        currentState: policy.state,
+        localCheckpoint: checkpoint,
+    });
+    return true;
+}
+//# sourceMappingURL=principalPolicyCheckpointSelection.js.map

package/data/persistence/principalPolicy/principalPolicyCheckpointSelection.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyCheckpointSelection.js","sourceRoot":"","sources":["principalPolicyCheckpointSelection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,kDAAkD,CAAC;AAExG,MAAM,UAAU,kCAAkC,CAChD,IAA8D,EAC9D,UAA4C;IAE5C,OAAO,CACL,CAAC,UAAU;QACX,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QACjC,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;YAClC,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+BAA+B,CAAC;QAC9B,KAAK,EACH,iBAAiB,IAAI,MAAM;YACzB,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type {\n PrincipalPolicyAuthorization,\n PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { verifyPrincipalPolicyCheckpoint } from \"@tearleads/crypto\";\nimport { assertPrincipalPolicyCheckpointShape } from \"../keyingCheckpoints/keyingCheckpointPersistence\";\n\nexport function principalPolicyHeadMeetsCheckpoint(\n head: { readonly stateHash: string; readonly version: number },\n checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n return (\n !checkpoint ||\n head.version > checkpoint.version ||\n (head.version === checkpoint.version &&\n head.stateHash === checkpoint.stateHash)\n );\n}\n\nexport function verifiedPrincipalPolicyMeetsCheckpoint(\n policy: PrincipalPolicyAuthorization,\n checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n if (!checkpoint) {\n return true;\n }\n assertPrincipalPolicyCheckpointShape(checkpoint, policy);\n if (policy.version < checkpoint.version) {\n return false;\n }\n verifyPrincipalPolicyCheckpoint({\n chain:\n \"retainedHistory\" in policy\n ? policy.retainedHistory\n : (policy.history ?? []),\n currentState: policy.state,\n localCheckpoint: checkpoint,\n });\n return true;\n}\n"]}

package/data/persistence/principalPolicy/principalPolicyOrganizationPersistence.js ADDED Viewed

@@ -0,0 +1,42 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { and, eq } from "drizzle-orm";
+import { principalPolicyOrganizations } from "../../sqlite/schema/index.js";
+function resolveOrganizationId(input) {
+    if (input.principalType === "organization") {
+        if (input.organizationId !== undefined &&
+            input.organizationId !== input.principalId) {
+            throw new KeyingVerificationError("object_mismatch", "organization policy cache ownership targets another organization");
+        }
+        return input.principalId;
+    }
+    if (!input.organizationId) {
+        throw new Error("Group policy cache writes require an organization ID");
+    }
+    return input.organizationId;
+}
+/** Pins cache ownership in the same transaction as the cached policy state. */
+export async function recordPrincipalPolicyOrganizationInTransaction(tx, input) {
+    const organizationId = resolveOrganizationId(input);
+    const wherePrincipal = and(eq(principalPolicyOrganizations.principalType, input.principalType), eq(principalPolicyOrganizations.principalId, input.principalId));
+    const [stored] = await tx
+        .select({ organizationId: principalPolicyOrganizations.organizationId })
+        .from(principalPolicyOrganizations)
+        .where(wherePrincipal)
+        .limit(1);
+    if (stored && stored.organizationId !== organizationId) {
+        throw new KeyingVerificationError("object_mismatch", "principal policy cache is already owned by another organization");
+    }
+    await tx
+        .insert(principalPolicyOrganizations)
+        .values({ ...input, organizationId })
+        .onConflictDoNothing()
+        .run();
+}
+export function recordPrincipalPolicyBundleOrganizationInTransaction(tx, bundle, organizationId) {
+    return recordPrincipalPolicyOrganizationInTransaction(tx, {
+        organizationId,
+        principalId: bundle.currentState.principalId,
+        principalType: bundle.currentState.principalType,
+    });
+}
+//# sourceMappingURL=principalPolicyOrganizationPersistence.js.map

package/data/persistence/principalPolicy/principalPolicyOrganizationPersistence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyOrganizationPersistence.js","sourceRoot":"","sources":["principalPolicyOrganizationPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AASnE,SAAS,qBAAqB,CAC5B,KAAuC;IAEvC,IAAI,KAAK,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;QAC3C,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,cAAc,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,EAAgC,EAChC,KAAuC;IAEvC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,GAAG,CACxB,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EACnE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAChE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,CAAC;SACvE,IAAI,CAAC,4BAA4B,CAAC;SAClC,KAAK,CAAC,cAAc,CAAC;SACrB,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,4BAA4B,CAAC;SACpC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC;SACpC,mBAAmB,EAAE;SACrB,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,oDAAoD,CAClE,EAAgC,EAChC,MAAyD,EACzD,cAAmC;IAEnC,OAAO,8CAA8C,CAAC,EAAE,EAAE;QACxD,cAAc;QACd,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport { principalPolicyOrganizations } from \"../../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\n\ninterface PrincipalPolicyOrganizationInput {\n readonly organizationId?: string | undefined;\n readonly principalId: string;\n readonly principalType: PrincipalStateResponse[\"principalType\"];\n}\n\nfunction resolveOrganizationId(\n input: PrincipalPolicyOrganizationInput,\n): string {\n if (input.principalType === \"organization\") {\n if (\n input.organizationId !== undefined &&\n input.organizationId !== input.principalId\n ) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"organization policy cache ownership targets another organization\",\n );\n }\n return input.principalId;\n }\n if (!input.organizationId) {\n throw new Error(\"Group policy cache writes require an organization ID\");\n }\n return input.organizationId;\n}\n\n/** Pins cache ownership in the same transaction as the cached policy state. */\nexport async function recordPrincipalPolicyOrganizationInTransaction(\n tx: ClientSQLiteTransactionScope,\n input: PrincipalPolicyOrganizationInput,\n): Promise<void> {\n const organizationId = resolveOrganizationId(input);\n const wherePrincipal = and(\n eq(principalPolicyOrganizations.principalType, input.principalType),\n eq(principalPolicyOrganizations.principalId, input.principalId),\n );\n const [stored] = await tx\n .select({ organizationId: principalPolicyOrganizations.organizationId })\n .from(principalPolicyOrganizations)\n .where(wherePrincipal)\n .limit(1);\n if (stored && stored.organizationId !== organizationId) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"principal policy cache is already owned by another organization\",\n );\n }\n await tx\n .insert(principalPolicyOrganizations)\n .values({ ...input, organizationId })\n .onConflictDoNothing()\n .run();\n}\n\nexport function recordPrincipalPolicyBundleOrganizationInTransaction(\n tx: ClientSQLiteTransactionScope,\n bundle: { readonly currentState: PrincipalStateResponse },\n organizationId?: string | undefined,\n): Promise<void> {\n return recordPrincipalPolicyOrganizationInTransaction(tx, {\n organizationId,\n principalId: bundle.currentState.principalId,\n principalType: bundle.currentState.principalType,\n });\n}\n"]}