@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/persistence/principalPolicy/principalPolicyReferencePersistence.js

@@ -0,0 +1,215 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { isPrincipalPolicyBundleResponse, isReferencedPrincipalStateResponse, } from "../../../internal/validators/response/index.js";
+import { and, eq, inArray } from "drizzle-orm";
+import { principalPolicyBundleContainsReference, principalPolicyBundleStates, } from "../../principals/principalPolicyStates.js";
+import { principalPolicies, principalPolicyBundleHistory, principalPolicyBundleReferences, } from "../../sqlite/schema/index.js";
+import { getClientSQLitePersistenceRuntime } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { assertSameHeadPrincipalPolicyBundle } from "./principalPolicyBundleIntegrity.js";
+import { ensurePrincipalPolicyTables, principalPolicyBundleSelection, } from "./principalPolicyPersistence.js";
+import { applyPrincipalPolicyReferenceCheckpoint } from "./principalPolicyReferenceCheckpoint.js";
+import { storedPrincipalPolicyBundleFromJson } from "./storedPrincipalPolicyBundle.js";
+function assertUnambiguousBundleChain(bundle) {
+    const states = principalPolicyBundleStates(bundle);
+    if (states.length !== bundle.currentState.version) {
+        throw new KeyingVerificationError("missing_dependency", "stored principal policy bundle chain length does not match its head");
+    }
+    const versions = new Map();
+    for (const [index, state] of states.entries()) {
+        if (state.principalType !== bundle.currentState.principalType ||
+            state.principalId !== bundle.currentState.principalId) {
+            throw new KeyingVerificationError("object_mismatch", "stored principal policy bundle chain belongs to another principal");
+        }
+        if (!Number.isInteger(state.version) ||
+            state.version !== index + 1 ||
+            !Number.isSafeInteger(state.keyEpoch) ||
+            state.keyEpoch < 1 ||
+            state.principalId.length === 0 ||
+            state.stateHash.length === 0 ||
+            state.keyFingerprint.length === 0) {
+            throw new KeyingVerificationError("invalid_shape", "stored principal policy bundle chain has an invalid version or epoch");
+        }
+        if (versions.has(state.version)) {
+            const previousHash = versions.get(state.version);
+            throw new KeyingVerificationError(previousHash === state.stateHash ? "duplicate_entry" : "equivocation", "stored principal policy bundle chain repeats a version");
+        }
+        versions.set(state.version, state.stateHash);
+    }
+}
+function parseBoundBundle(row) {
+    let bundle;
+    try {
+        bundle = storedPrincipalPolicyBundleFromJson(row);
+    }
+    catch {
+        throw new KeyingVerificationError("invalid_shape", "stored principal policy bundle contains malformed JSON");
+    }
+    if (!isPrincipalPolicyBundleResponse(bundle)) {
+        throw new KeyingVerificationError("invalid_shape", "stored principal policy bundle is invalid");
+    }
+    if (bundle.currentState.principalType !== row.principalType ||
+        bundle.currentState.principalId !== row.principalId) {
+        throw new KeyingVerificationError("object_mismatch", "stored principal policy bundle row belongs to another principal");
+    }
+    if (bundle.currentState.stateHash !== row.stateHash) {
+        throw new KeyingVerificationError("hash_mismatch", "stored principal policy bundle row has a different head hash");
+    }
+    assertUnambiguousBundleChain(bundle);
+    return bundle;
+}
+function assertIndexedBundle(bundle, indexed, reference) {
+    if (bundle.currentState.stateHash !== indexed.bundleStateHash ||
+        bundle.currentState.version !== indexed.bundleVersion) {
+        throw new KeyingVerificationError("equivocation", "principal policy reference index conflicts with its bundle head");
+    }
+    if (!principalPolicyBundleContainsReference(bundle, reference)) {
+        throw new KeyingVerificationError("hash_mismatch", "indexed principal policy bundle does not contain the exact reference");
+    }
+}
+function addCandidate(candidates, bundle, row) {
+    const existing = candidates.get(bundle.currentState.stateHash);
+    if (existing) {
+        assertSameHeadPrincipalPolicyBundle(existing.row, row);
+        return;
+    }
+    candidates.set(bundle.currentState.stateHash, { bundle, row });
+}
+function assertCurrentDoesNotConflict(bundle, reference) {
+    if (bundle.currentState.version < reference.version) {
+        return;
+    }
+    const stateAtReference = principalPolicyBundleStates(bundle).find((state) => state.version === reference.version);
+    if (!stateAtReference) {
+        throw new KeyingVerificationError("stale_predecessor", "current principal policy chain omits the referenced version");
+    }
+    if (stateAtReference.stateHash !== reference.stateHash) {
+        throw new KeyingVerificationError("equivocation", "current principal policy chain conflicts with the referenced version");
+    }
+    throw new KeyingVerificationError("hash_mismatch", "current principal policy state does not match the exact reference");
+}
+function selectNewestCandidate(candidates) {
+    let selected = null;
+    const stateHashByVersion = new Map();
+    for (const { bundle } of candidates.values()) {
+        const existingHash = stateHashByVersion.get(bundle.currentState.version);
+        if (existingHash !== undefined &&
+            existingHash !== bundle.currentState.stateHash) {
+            throw new KeyingVerificationError("equivocation", "stored principal policy bundles conflict at one version");
+        }
+        stateHashByVersion.set(bundle.currentState.version, bundle.currentState.stateHash);
+        if (!selected ||
+            bundle.currentState.version > selected.currentState.version) {
+            selected = bundle;
+        }
+    }
+    return selected;
+}
+function assertReferenceShape(reference) {
+    if (!isReferencedPrincipalStateResponse(reference)) {
+        throw new KeyingVerificationError("invalid_shape", "principal policy reference is malformed");
+    }
+    if (!Number.isInteger(reference.version) ||
+        reference.version < 1 ||
+        !Number.isSafeInteger(reference.keyEpoch) ||
+        reference.keyEpoch < 1 ||
+        reference.principalId.length === 0 ||
+        reference.stateHash.length === 0 ||
+        reference.keyFingerprint.length === 0) {
+        throw new KeyingVerificationError("invalid_shape", "principal policy reference is malformed");
+    }
+}
+async function loadCurrentRow(execSql, reference) {
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [row] = await db
+        .select(principalPolicyBundleSelection(principalPolicies))
+        .from(principalPolicies)
+        .where(and(eq(principalPolicies.principalType, reference.principalType), eq(principalPolicies.principalId, reference.principalId)))
+        .limit(1);
+    return row;
+}
+async function loadIndexedHeads(execSql, reference) {
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    return db
+        .select({
+        bundleStateHash: principalPolicyBundleReferences.bundleStateHash,
+        bundleVersion: principalPolicyBundleReferences.bundleVersion,
+    })
+        .from(principalPolicyBundleReferences)
+        .where(and(eq(principalPolicyBundleReferences.principalType, reference.principalType), eq(principalPolicyBundleReferences.principalId, reference.principalId), eq(principalPolicyBundleReferences.version, reference.version), eq(principalPolicyBundleReferences.stateHash, reference.stateHash), eq(principalPolicyBundleReferences.keyEpoch, reference.keyEpoch), eq(principalPolicyBundleReferences.keyFingerprint, reference.keyFingerprint)));
+}
+function indexHeadsByHash(heads) {
+    const stateHashByVersion = new Map();
+    for (const head of heads) {
+        if (!Number.isInteger(head.bundleVersion) ||
+            head.bundleVersion < 1 ||
+            head.bundleStateHash.length === 0) {
+            throw new KeyingVerificationError("invalid_shape", "principal policy reference index is malformed");
+        }
+        const indexedHash = stateHashByVersion.get(head.bundleVersion);
+        if (indexedHash !== undefined && indexedHash !== head.bundleStateHash) {
+            throw new KeyingVerificationError("equivocation", "principal policy reference index has conflicting bundle heads at one version");
+        }
+        stateHashByVersion.set(head.bundleVersion, head.bundleStateHash);
+    }
+    return new Map(heads.map((head) => [head.bundleStateHash, head]));
+}
+async function loadRetainedRows(execSql, reference, currentRow, indexedByHash) {
+    const hashes = new Set([reference.stateHash, ...indexedByHash.keys()]);
+    if (currentRow) {
+        hashes.delete(currentRow.stateHash);
+    }
+    if (hashes.size === 0) {
+        return [];
+    }
+    // Remote reset deliberately clears mutable heads while retaining historical
+    // key material, so an index target can outlive its bundle row. Such a target
+    // is only a selection hint; rows that still exist remain authoritative.
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    return db
+        .select(principalPolicyBundleSelection(principalPolicyBundleHistory))
+        .from(principalPolicyBundleHistory)
+        .where(and(eq(principalPolicyBundleHistory.principalType, reference.principalType), eq(principalPolicyBundleHistory.principalId, reference.principalId), inArray(principalPolicyBundleHistory.stateHash, [...hashes])));
+}
+function collectCandidates(currentRow, retainedRows, indexedByHash, reference) {
+    const candidates = new Map();
+    if (currentRow) {
+        const bundle = parseBoundBundle(currentRow);
+        const indexed = indexedByHash.get(currentRow.stateHash);
+        if (indexed) {
+            assertIndexedBundle(bundle, indexed, reference);
+        }
+        if (principalPolicyBundleContainsReference(bundle, reference)) {
+            addCandidate(candidates, bundle, currentRow);
+        }
+        else {
+            assertCurrentDoesNotConflict(bundle, reference);
+        }
+    }
+    for (const row of retainedRows) {
+        const bundle = parseBoundBundle(row);
+        const indexed = indexedByHash.get(row.stateHash);
+        if (indexed) {
+            assertIndexedBundle(bundle, indexed, reference);
+        }
+        else if (!principalPolicyBundleContainsReference(bundle, reference)) {
+            throw new KeyingVerificationError("hash_mismatch", "stored principal policy bundle head does not match the exact reference");
+        }
+        addCandidate(candidates, bundle, row);
+    }
+    return candidates;
+}
+export async function loadPrincipalPolicyBundleForReference(execSql, reference, checkpoint) {
+    assertReferenceShape(reference);
+    await ensurePrincipalPolicyTables(execSql);
+    const [currentRow, indexedHeads] = await Promise.all([
+        loadCurrentRow(execSql, reference),
+        loadIndexedHeads(execSql, reference),
+    ]);
+    const indexedByHash = indexHeadsByHash(indexedHeads);
+    const retainedRows = await loadRetainedRows(execSql, reference, currentRow, indexedByHash);
+    const candidates = collectCandidates(currentRow, retainedRows, indexedByHash, reference);
+    const selected = selectNewestCandidate(candidates);
+    return selected
+        ? applyPrincipalPolicyReferenceCheckpoint(selected, checkpoint)
+        : null;
+}
+//# sourceMappingURL=principalPolicyReferencePersistence.js.map

package/data/persistence/principalPolicy/principalPolicyReferencePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyReferencePersistence.js","sourceRoot":"","sources":["principalPolicyReferencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,sCAAsC,EACtC,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAE1F,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAOpF,SAAS,4BAA4B,CACnC,MAAqC;IAErC,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IACE,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC,aAAa;YACzD,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW,EACrD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;YAChC,KAAK,CAAC,OAAO,KAAK,KAAK,GAAG,CAAC;YAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;YACrC,KAAK,CAAC,QAAQ,GAAG,CAAC;YAClB,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAC9B,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAC5B,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,uBAAuB,CAC/B,YAAY,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,EACrE,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,GAA+B;IAE/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa;QACvD,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EACnD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAqC,EACrC,OAA0B,EAC1B,SAAkC;IAElC,IACE,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,OAAO,CAAC,eAAe;QACzD,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,OAAO,CAAC,aAAa,EACrD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,UAGC,EACD,MAAqC,EACrC,GAA+B;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,QAAQ,EAAE,CAAC;QACb,mCAAmC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAqC,EACrC,SAAkC;IAElC,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,IAAI,CAC/D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,CAC/C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mEAAmE,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAGC;IAED,IAAI,QAAQ,GAAyC,IAAI,CAAC;IAC1D,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzE,IACE,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,EAC9C,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,GAAG,CACpB,MAAM,CAAC,YAAY,CAAC,OAAO,EAC3B,MAAM,CAAC,YAAY,CAAC,SAAS,CAC9B,CAAC;QACF,IACE,CAAC,QAAQ;YACT,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAC3D,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAkC;IAC9D,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,SAAS,CAAC,OAAO,GAAG,CAAC;QACrB,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;QACzC,SAAS,CAAC,QAAQ,GAAG,CAAC;QACtB,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAClC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAChC,SAAS,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,SAAkC;IAElC,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;SACzD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EAC5D,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CACzD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,SAAkC;IAElC,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,EAAE;SACN,MAAM,CAAC;QACN,eAAe,EAAE,+BAA+B,CAAC,eAAe;QAChE,aAAa,EAAE,+BAA+B,CAAC,aAAa;KAC7D,CAAC;SACD,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,aAAa,EAC7C,SAAS,CAAC,aAAa,CACxB,EACD,EAAE,CAAC,+BAA+B,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACtE,EAAE,CAAC,+BAA+B,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAC9D,EAAE,CAAC,+BAA+B,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAClE,EAAE,CAAC,+BAA+B,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,EAChE,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,SAAS,CAAC,cAAc,CACzB,CACF,CACF,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAmC;IAEnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;YACrC,IAAI,CAAC,aAAa,GAAG,CAAC;YACtB,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,SAAkC,EAClC,UAAkD,EAClD,aAAqD;IAErD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,EAAE;SACN,MAAM,CAAC,8BAA8B,CAAC,4BAA4B,CAAC,CAAC;SACpE,IAAI,CAAC,4BAA4B,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,4BAA4B,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EACvE,EAAE,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACnE,OAAO,CAAC,4BAA4B,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAC7D,CACF,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CACxB,UAAkD,EAClD,YAAmD,EACnD,aAAqD,EACrD,SAAkC;IAElC,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;IACJ,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,sCAAsC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAgB,EAChB,SAAkC,EAClC,UAA4C;IAE5C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;QAClC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC;KACrC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,OAAO,EACP,SAAS,EACT,UAAU,EACV,aAAa,CACd,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAClC,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,QAAQ;QACb,CAAC,CAAC,uCAAuC,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  isPrincipalPolicyBundleResponse,\n  isReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq, inArray } from \"drizzle-orm\";\nimport {\n  principalPolicyBundleContainsReference,\n  principalPolicyBundleStates,\n} from \"../../principals/principalPolicyStates\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyBundleReferences,\n} from \"../../sqlite/schema\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { assertSameHeadPrincipalPolicyBundle } from \"./principalPolicyBundleIntegrity\";\nimport {\n  ensurePrincipalPolicyTables,\n  principalPolicyBundleSelection,\n  type SelectedPrincipalPolicyRow,\n} from \"./principalPolicyPersistence\";\nimport { applyPrincipalPolicyReferenceCheckpoint } from \"./principalPolicyReferenceCheckpoint\";\nimport { storedPrincipalPolicyBundleFromJson } from \"./storedPrincipalPolicyBundle\";\n\ninterface IndexedBundleHead {\n  readonly bundleStateHash: string;\n  readonly bundleVersion: number;\n}\n\nfunction assertUnambiguousBundleChain(\n  bundle: PrincipalPolicyBundleResponse,\n): void {\n  const states = principalPolicyBundleStates(bundle);\n  if (states.length !== bundle.currentState.version) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"stored principal policy bundle chain length does not match its head\",\n    );\n  }\n  const versions = new Map<number, string>();\n  for (const [index, state] of states.entries()) {\n    if (\n      state.principalType !== bundle.currentState.principalType ||\n      state.principalId !== bundle.currentState.principalId\n    ) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"stored principal policy bundle chain belongs to another principal\",\n      );\n    }\n    if (\n      !Number.isInteger(state.version) ||\n      state.version !== index + 1 ||\n      !Number.isSafeInteger(state.keyEpoch) ||\n      state.keyEpoch < 1 ||\n      state.principalId.length === 0 ||\n      state.stateHash.length === 0 ||\n      state.keyFingerprint.length === 0\n    ) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"stored principal policy bundle chain has an invalid version or epoch\",\n      );\n    }\n    if (versions.has(state.version)) {\n      const previousHash = versions.get(state.version);\n      throw new KeyingVerificationError(\n        previousHash === state.stateHash ? \"duplicate_entry\" : \"equivocation\",\n        \"stored principal policy bundle chain repeats a version\",\n      );\n    }\n    versions.set(state.version, state.stateHash);\n  }\n}\n\nfunction parseBoundBundle(\n  row: SelectedPrincipalPolicyRow,\n): PrincipalPolicyBundleResponse {\n  let bundle: unknown;\n  try {\n    bundle = storedPrincipalPolicyBundleFromJson(row);\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"stored principal policy bundle contains malformed JSON\",\n    );\n  }\n  if (!isPrincipalPolicyBundleResponse(bundle)) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"stored principal policy bundle is invalid\",\n    );\n  }\n  if (\n    bundle.currentState.principalType !== row.principalType ||\n    bundle.currentState.principalId !== row.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"stored principal policy bundle row belongs to another principal\",\n    );\n  }\n  if (bundle.currentState.stateHash !== row.stateHash) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"stored principal policy bundle row has a different head hash\",\n    );\n  }\n  assertUnambiguousBundleChain(bundle);\n  return bundle;\n}\n\nfunction assertIndexedBundle(\n  bundle: PrincipalPolicyBundleResponse,\n  indexed: IndexedBundleHead,\n  reference: ReferencedPrincipalHead,\n): void {\n  if (\n    bundle.currentState.stateHash !== indexed.bundleStateHash ||\n    bundle.currentState.version !== indexed.bundleVersion\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"principal policy reference index conflicts with its bundle head\",\n    );\n  }\n  if (!principalPolicyBundleContainsReference(bundle, reference)) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"indexed principal policy bundle does not contain the exact reference\",\n    );\n  }\n}\n\nfunction addCandidate(\n  candidates: Map<\n    string,\n    { bundle: PrincipalPolicyBundleResponse; row: SelectedPrincipalPolicyRow }\n  >,\n  bundle: PrincipalPolicyBundleResponse,\n  row: SelectedPrincipalPolicyRow,\n): void {\n  const existing = candidates.get(bundle.currentState.stateHash);\n  if (existing) {\n    assertSameHeadPrincipalPolicyBundle(existing.row, row);\n    return;\n  }\n  candidates.set(bundle.currentState.stateHash, { bundle, row });\n}\n\nfunction assertCurrentDoesNotConflict(\n  bundle: PrincipalPolicyBundleResponse,\n  reference: ReferencedPrincipalHead,\n): void {\n  if (bundle.currentState.version < reference.version) {\n    return;\n  }\n  const stateAtReference = principalPolicyBundleStates(bundle).find(\n    (state) => state.version === reference.version,\n  );\n  if (!stateAtReference) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"current principal policy chain omits the referenced version\",\n    );\n  }\n  if (stateAtReference.stateHash !== reference.stateHash) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"current principal policy chain conflicts with the referenced version\",\n    );\n  }\n  throw new KeyingVerificationError(\n    \"hash_mismatch\",\n    \"current principal policy state does not match the exact reference\",\n  );\n}\n\nfunction selectNewestCandidate(\n  candidates: ReadonlyMap<\n    string,\n    { readonly bundle: PrincipalPolicyBundleResponse }\n  >,\n): PrincipalPolicyBundleResponse | null {\n  let selected: PrincipalPolicyBundleResponse | null = null;\n  const stateHashByVersion = new Map<number, string>();\n  for (const { bundle } of candidates.values()) {\n    const existingHash = stateHashByVersion.get(bundle.currentState.version);\n    if (\n      existingHash !== undefined &&\n      existingHash !== bundle.currentState.stateHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"stored principal policy bundles conflict at one version\",\n      );\n    }\n    stateHashByVersion.set(\n      bundle.currentState.version,\n      bundle.currentState.stateHash,\n    );\n    if (\n      !selected ||\n      bundle.currentState.version > selected.currentState.version\n    ) {\n      selected = bundle;\n    }\n  }\n  return selected;\n}\n\nfunction assertReferenceShape(reference: ReferencedPrincipalHead): void {\n  if (!isReferencedPrincipalStateResponse(reference)) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy reference is malformed\",\n    );\n  }\n  if (\n    !Number.isInteger(reference.version) ||\n    reference.version < 1 ||\n    !Number.isSafeInteger(reference.keyEpoch) ||\n    reference.keyEpoch < 1 ||\n    reference.principalId.length === 0 ||\n    reference.stateHash.length === 0 ||\n    reference.keyFingerprint.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy reference is malformed\",\n    );\n  }\n}\n\nasync function loadCurrentRow(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n): Promise<SelectedPrincipalPolicyRow | undefined> {\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [row] = await db\n    .select(principalPolicyBundleSelection(principalPolicies))\n    .from(principalPolicies)\n    .where(\n      and(\n        eq(principalPolicies.principalType, reference.principalType),\n        eq(principalPolicies.principalId, reference.principalId),\n      ),\n    )\n    .limit(1);\n  return row;\n}\n\nasync function loadIndexedHeads(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n): Promise<IndexedBundleHead[]> {\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  return db\n    .select({\n      bundleStateHash: principalPolicyBundleReferences.bundleStateHash,\n      bundleVersion: principalPolicyBundleReferences.bundleVersion,\n    })\n    .from(principalPolicyBundleReferences)\n    .where(\n      and(\n        eq(\n          principalPolicyBundleReferences.principalType,\n          reference.principalType,\n        ),\n        eq(principalPolicyBundleReferences.principalId, reference.principalId),\n        eq(principalPolicyBundleReferences.version, reference.version),\n        eq(principalPolicyBundleReferences.stateHash, reference.stateHash),\n        eq(principalPolicyBundleReferences.keyEpoch, reference.keyEpoch),\n        eq(\n          principalPolicyBundleReferences.keyFingerprint,\n          reference.keyFingerprint,\n        ),\n      ),\n    );\n}\n\nfunction indexHeadsByHash(\n  heads: readonly IndexedBundleHead[],\n): Map<string, IndexedBundleHead> {\n  const stateHashByVersion = new Map<number, string>();\n  for (const head of heads) {\n    if (\n      !Number.isInteger(head.bundleVersion) ||\n      head.bundleVersion < 1 ||\n      head.bundleStateHash.length === 0\n    ) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"principal policy reference index is malformed\",\n      );\n    }\n    const indexedHash = stateHashByVersion.get(head.bundleVersion);\n    if (indexedHash !== undefined && indexedHash !== head.bundleStateHash) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"principal policy reference index has conflicting bundle heads at one version\",\n      );\n    }\n    stateHashByVersion.set(head.bundleVersion, head.bundleStateHash);\n  }\n  return new Map(heads.map((head) => [head.bundleStateHash, head]));\n}\n\nasync function loadRetainedRows(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n  currentRow: SelectedPrincipalPolicyRow | undefined,\n  indexedByHash: ReadonlyMap<string, IndexedBundleHead>,\n): Promise<SelectedPrincipalPolicyRow[]> {\n  const hashes = new Set([reference.stateHash, ...indexedByHash.keys()]);\n  if (currentRow) {\n    hashes.delete(currentRow.stateHash);\n  }\n  if (hashes.size === 0) {\n    return [];\n  }\n  // Remote reset deliberately clears mutable heads while retaining historical\n  // key material, so an index target can outlive its bundle row. Such a target\n  // is only a selection hint; rows that still exist remain authoritative.\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  return db\n    .select(principalPolicyBundleSelection(principalPolicyBundleHistory))\n    .from(principalPolicyBundleHistory)\n    .where(\n      and(\n        eq(principalPolicyBundleHistory.principalType, reference.principalType),\n        eq(principalPolicyBundleHistory.principalId, reference.principalId),\n        inArray(principalPolicyBundleHistory.stateHash, [...hashes]),\n      ),\n    );\n}\n\nfunction collectCandidates(\n  currentRow: SelectedPrincipalPolicyRow | undefined,\n  retainedRows: readonly SelectedPrincipalPolicyRow[],\n  indexedByHash: ReadonlyMap<string, IndexedBundleHead>,\n  reference: ReferencedPrincipalHead,\n) {\n  const candidates = new Map<\n    string,\n    { bundle: PrincipalPolicyBundleResponse; row: SelectedPrincipalPolicyRow }\n  >();\n  if (currentRow) {\n    const bundle = parseBoundBundle(currentRow);\n    const indexed = indexedByHash.get(currentRow.stateHash);\n    if (indexed) {\n      assertIndexedBundle(bundle, indexed, reference);\n    }\n    if (principalPolicyBundleContainsReference(bundle, reference)) {\n      addCandidate(candidates, bundle, currentRow);\n    } else {\n      assertCurrentDoesNotConflict(bundle, reference);\n    }\n  }\n  for (const row of retainedRows) {\n    const bundle = parseBoundBundle(row);\n    const indexed = indexedByHash.get(row.stateHash);\n    if (indexed) {\n      assertIndexedBundle(bundle, indexed, reference);\n    } else if (!principalPolicyBundleContainsReference(bundle, reference)) {\n      throw new KeyingVerificationError(\n        \"hash_mismatch\",\n        \"stored principal policy bundle head does not match the exact reference\",\n      );\n    }\n    addCandidate(candidates, bundle, row);\n  }\n  return candidates;\n}\n\nexport async function loadPrincipalPolicyBundleForReference(\n  execSql: ExecSql,\n  reference: ReferencedPrincipalHead,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): Promise<PrincipalPolicyBundleResponse | null> {\n  assertReferenceShape(reference);\n  await ensurePrincipalPolicyTables(execSql);\n  const [currentRow, indexedHeads] = await Promise.all([\n    loadCurrentRow(execSql, reference),\n    loadIndexedHeads(execSql, reference),\n  ]);\n  const indexedByHash = indexHeadsByHash(indexedHeads);\n  const retainedRows = await loadRetainedRows(\n    execSql,\n    reference,\n    currentRow,\n    indexedByHash,\n  );\n  const candidates = collectCandidates(\n    currentRow,\n    retainedRows,\n    indexedByHash,\n    reference,\n  );\n  const selected = selectNewestCandidate(candidates);\n  return selected\n    ? applyPrincipalPolicyReferenceCheckpoint(selected, checkpoint)\n    : null;\n}\n"]}

package/data/persistence/principalPolicy/verifiedPrincipalPolicyBundle.js

@@ -0,0 +1,33 @@
+import { KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../keying/canonicalJson.js";
+import { assertCurrentMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyCurrent.js";
+export async function assertBundleMatchesVerifiedPolicy(input) {
+    const { bundle, policy } = input;
+    const history = policy.history ?? [];
+    const expectedChain = [
+        ...bundle.previousStates,
+        {
+            state: bundle.currentState,
+            projection: bundle.currentProjection,
+            grants: bundle.currentGrants,
+        },
+    ].map((entry) => ({
+        ...entry,
+        projection: normalizePrincipalProjectionMembers(entry.projection),
+        grants: normalizePrincipalContainerGrants(entry.grants),
+    }));
+    const verifiedHistory = history.map((entry) => ({
+        ...entry,
+        projection: normalizePrincipalProjectionMembers(entry.projection),
+        grants: normalizePrincipalContainerGrants(entry.grants),
+    }));
+    if (canonicalKeyingJsonString(expectedChain, "principal policy bundle history") !==
+        canonicalKeyingJsonString(verifiedHistory, "verified principal policy history")) {
+        throw new KeyingVerificationError("equivocation", "Verified principal policy bundle history mismatch");
+    }
+    await assertCurrentMatchesVerifiedPolicy({
+        current: input.bundle,
+        policy: input.policy,
+    });
+}
+//# sourceMappingURL=verifiedPrincipalPolicyBundle.js.map

package/data/persistence/principalPolicy/verifiedPrincipalPolicyBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyBundle.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,UAAU,EAAE,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,EAAE,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,IACE,yBAAyB,CACvB,aAAa,EACb,iCAAiC,CAClC;QACD,yBAAyB,CACvB,eAAe,EACf,mCAAmC,CACpC,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../keying/canonicalJson\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyCurrent\";\n\nexport async function assertBundleMatchesVerifiedPolicy(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  policy: VerifiedPrincipalPolicy;\n}): Promise<void> {\n  const { bundle, policy } = input;\n  const history = policy.history ?? [];\n  const expectedChain = [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ].map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  const verifiedHistory = history.map((entry) => ({\n    ...entry,\n    projection: normalizePrincipalProjectionMembers(entry.projection),\n    grants: normalizePrincipalContainerGrants(entry.grants),\n  }));\n  if (\n    canonicalKeyingJsonString(\n      expectedChain,\n      \"principal policy bundle history\",\n    ) !==\n    canonicalKeyingJsonString(\n      verifiedHistory,\n      \"verified principal policy history\",\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"equivocation\",\n      \"Verified principal policy bundle history mismatch\",\n    );\n  }\n  await assertCurrentMatchesVerifiedPolicy({\n    current: input.bundle,\n    policy: input.policy,\n  });\n}\n"]}

package/data/persistence/principalPolicy/verifiedPrincipalPolicyCurrent.js

@@ -0,0 +1,56 @@
+import { computePrincipalMemberEnvelopesRoot, computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, PrincipalMemberEnvelopeValidationError, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../keying/canonicalJson.js";
+function currentMismatch(message) {
+    throw new KeyingVerificationError("equivocation", message);
+}
+async function memberEnvelopesRoot(current) {
+    try {
+        return await computePrincipalMemberEnvelopesRoot(current.currentMemberEnvelopes.envelopes);
+    }
+    catch (error) {
+        if (error instanceof PrincipalMemberEnvelopeValidationError) {
+            throw new KeyingVerificationError("invalid_shape", error.message);
+        }
+        throw error;
+    }
+}
+async function assertCurrentPayloadMatches(input) {
+    const { current, policy } = input;
+    const payloadHash = await computePrincipalStatePayloadCiphertextHash(current.currentPayload.ciphertext);
+    const envelopesRoot = await memberEnvelopesRoot(current);
+    if (current.currentPayload.principalType !== policy.principalType ||
+        current.currentPayload.principalId !== policy.principalId ||
+        current.currentPayload.stateHash !== policy.stateHash ||
+        current.currentPayload.ciphertextHash !== payloadHash ||
+        policy.state.payloadCiphertextHash !== payloadHash ||
+        current.currentMemberEnvelopes.principalType !== policy.principalType ||
+        current.currentMemberEnvelopes.principalId !== policy.principalId ||
+        current.currentMemberEnvelopes.stateHash !== policy.stateHash ||
+        current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||
+        envelopesRoot !== policy.state.memberEnvelopesRoot) {
+        currentMismatch("Verified principal policy current payload mismatch");
+    }
+}
+/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */
+export async function assertCurrentMatchesVerifiedPolicy(input) {
+    const { current, policy } = input;
+    if (current.currentState.principalType !== policy.principalType ||
+        current.currentState.principalId !== policy.principalId ||
+        current.currentState.version !== policy.version ||
+        current.currentState.keyEpoch !== policy.keyEpoch ||
+        current.currentState.stateHash !== policy.stateHash ||
+        policy.checkpoint.version !== policy.version ||
+        policy.checkpoint.stateHash !== policy.stateHash) {
+        currentMismatch("Verified principal policy current head mismatch");
+    }
+    if (canonicalKeyingJsonString(current.currentState, "principal policy current state") !==
+        canonicalKeyingJsonString(policy.state, "verified principal policy state") ||
+        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(current.currentProjection), "principal policy current projection") !==
+            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(policy.projection), "verified principal policy projection") ||
+        canonicalKeyingJsonString(normalizePrincipalContainerGrants(current.currentGrants), "principal policy current grants") !==
+            canonicalKeyingJsonString(normalizePrincipalContainerGrants(policy.grants), "verified principal policy grants")) {
+        currentMismatch("Verified principal policy current content mismatch");
+    }
+    await assertCurrentPayloadMatches(input);
+}
+//# sourceMappingURL=verifiedPrincipalPolicyCurrent.js.map

package/data/persistence/principalPolicy/verifiedPrincipalPolicyCurrent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyCurrent.js","sourceRoot":"","sources":["verifiedPrincipalPolicyCurrent.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,EACnC,sCAAsC,GAGvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAMvE,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAmC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAC9C,OAAO,CAAC,sBAAsB,CAAC,SAAS,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sCAAsC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAG1C;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,0CAA0C,CAClE,OAAO,CAAC,cAAc,CAAC,UAAU,CAClC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzD,IACE,OAAO,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC7D,OAAO,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACzD,OAAO,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACrD,OAAO,CAAC,cAAc,CAAC,cAAc,KAAK,WAAW;QACrD,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,WAAW;QAClD,OAAO,CAAC,sBAAsB,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QACrE,OAAO,CAAC,sBAAsB,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACjE,OAAO,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAC7D,OAAO,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ;QACxD,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAClD,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,IACE,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC3D,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACvD,OAAO,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/C,OAAO,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACjD,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACnD,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5C,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAChD,CAAC;QACD,eAAe,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,yBAAyB,CACvB,OAAO,CAAC,YAAY,EACpB,gCAAgC,CACjC;QACC,yBAAyB,CACvB,MAAM,CAAC,KAAK,EACZ,iCAAiC,CAClC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9D,qCAAqC,CACtC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,MAAM,CAAC,UAAU,CAAC,EACtD,sCAAsC,CACvC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,OAAO,CAAC,aAAa,CAAC,EACxD,iCAAiC,CAClC;YACC,yBAAyB,CACvB,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,kCAAkC,CACnC,EACH,CAAC;QACD,eAAe,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  PrincipalMemberEnvelopeValidationError,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { canonicalKeyingJsonString } from \"../../keying/canonicalJson\";\n\ntype VerifiedCurrentPolicy =\n  | VerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\nfunction currentMismatch(message: string): never {\n  throw new KeyingVerificationError(\"equivocation\", message);\n}\n\nasync function memberEnvelopesRoot(\n  current: PrincipalPolicyPageCurrent,\n): Promise<string> {\n  try {\n    return await computePrincipalMemberEnvelopesRoot(\n      current.currentMemberEnvelopes.envelopes,\n    );\n  } catch (error) {\n    if (error instanceof PrincipalMemberEnvelopeValidationError) {\n      throw new KeyingVerificationError(\"invalid_shape\", error.message);\n    }\n    throw error;\n  }\n}\n\nasync function assertCurrentPayloadMatches(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  const payloadHash = await computePrincipalStatePayloadCiphertextHash(\n    current.currentPayload.ciphertext,\n  );\n  const envelopesRoot = await memberEnvelopesRoot(current);\n  if (\n    current.currentPayload.principalType !== policy.principalType ||\n    current.currentPayload.principalId !== policy.principalId ||\n    current.currentPayload.stateHash !== policy.stateHash ||\n    current.currentPayload.ciphertextHash !== payloadHash ||\n    policy.state.payloadCiphertextHash !== payloadHash ||\n    current.currentMemberEnvelopes.principalType !== policy.principalType ||\n    current.currentMemberEnvelopes.principalId !== policy.principalId ||\n    current.currentMemberEnvelopes.stateHash !== policy.stateHash ||\n    current.currentMemberEnvelopes.epoch !== policy.keyEpoch ||\n    envelopesRoot !== policy.state.memberEnvelopesRoot\n  ) {\n    currentMismatch(\"Verified principal policy current payload mismatch\");\n  }\n}\n\n/** Bind current wire artifacts to already verified policy evidence; never authenticate history. */\nexport async function assertCurrentMatchesVerifiedPolicy(input: {\n  current: PrincipalPolicyPageCurrent;\n  policy: VerifiedCurrentPolicy;\n}): Promise<void> {\n  const { current, policy } = input;\n  if (\n    current.currentState.principalType !== policy.principalType ||\n    current.currentState.principalId !== policy.principalId ||\n    current.currentState.version !== policy.version ||\n    current.currentState.keyEpoch !== policy.keyEpoch ||\n    current.currentState.stateHash !== policy.stateHash ||\n    policy.checkpoint.version !== policy.version ||\n    policy.checkpoint.stateHash !== policy.stateHash\n  ) {\n    currentMismatch(\"Verified principal policy current head mismatch\");\n  }\n  if (\n    canonicalKeyingJsonString(\n      current.currentState,\n      \"principal policy current state\",\n    ) !==\n      canonicalKeyingJsonString(\n        policy.state,\n        \"verified principal policy state\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(current.currentProjection),\n      \"principal policy current projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(policy.projection),\n        \"verified principal policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(current.currentGrants),\n      \"principal policy current grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(policy.grants),\n        \"verified principal policy grants\",\n      )\n  ) {\n    currentMismatch(\"Verified principal policy current content mismatch\");\n  }\n\n  await assertCurrentPayloadMatches(input);\n}\n"]}

package/data/persistence/principalPolicy/verifiedPrincipalPolicyRetentionPersistence.js

@@ -0,0 +1,18 @@
+import { getClientSQLitePersistenceRuntime } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { ensurePrincipalPolicyTables, retainPrincipalPolicyBundleInTransaction, } from "./principalPolicyPersistence.js";
+import { assertBundleMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyBundle.js";
+/** Retains a just-verified epoch without promoting it to the mutable head. */
+export async function retainVerifiedPrincipalPolicyBundle(input) {
+    await assertBundleMatchesVerifiedPolicy(input);
+    await ensurePrincipalPolicyTables(input.execSql);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const retain = (tx) => retainPrincipalPolicyBundleInTransaction(tx, input.bundle, input.updatedAt, input.organizationId);
+    if (input.stillCurrent) {
+        await runtime.guardedTransaction(retain, input.stillCurrent, {
+            behavior: "immediate",
+        });
+        return;
+    }
+    await runtime.transaction(retain, { behavior: "immediate" });
+}
+//# sourceMappingURL=verifiedPrincipalPolicyRetentionPersistence.js.map

package/data/persistence/principalPolicy/verifiedPrincipalPolicyRetentionPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyRetentionPersistence.js","sourceRoot":"","sources":["verifiedPrincipalPolicyRetentionPersistence.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAE1F,OAAO,EACL,2BAA2B,EAC3B,wCAAwC,GACzC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEpF,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAOzD;IACC,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,CACb,EAAkE,EAClE,EAAE,CACF,wCAAwC,CACtC,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE;YAC3D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { getClientSQLitePersistenceRuntime } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport {\n  ensurePrincipalPolicyTables,\n  retainPrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\n/** Retains a just-verified epoch without promoting it to the mutable head. */\nexport async function retainVerifiedPrincipalPolicyBundle(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  await assertBundleMatchesVerifiedPolicy(input);\n  await ensurePrincipalPolicyTables(input.execSql);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const retain = (\n    tx: Parameters<typeof retainPrincipalPolicyBundleInTransaction>[0],\n  ) =>\n    retainPrincipalPolicyBundleInTransaction(\n      tx,\n      input.bundle,\n      input.updatedAt,\n      input.organizationId,\n    );\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(retain, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(retain, { behavior: \"immediate\" });\n}\n"]}

package/data/persistence/securityIncidentPersistence.js

@@ -1,6 +1,6 @@
 import { isKeyingVerificationCode, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
 import { desc, eq, inArray, isNull, sql } from "drizzle-orm";
-import { securityIncidents, securityIncidentTable, } from "../sqlite/securityIncidentSchema.js";
+import { securityIncidents, securityIncidentTable, } from "../sqlite/schema/securityIncidentSchema.js";
 import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../sqlite/sqlSchema.js";
 const SECURITY_INCIDENT_RETENTION_LIMIT = 1_000;

package/data/persistence/securityIncidentPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"securityIncidentPersistence.js","sourceRoot":"","sources":["securityIncidentPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAK7D,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAepE,MAAM,iCAAiC,GAAG,KAAK,CAAC;AAEhD;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,cAA4D;IAE5D,OAAO,4BAA4B,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,4EAA4E;IAC5E,oDAAoD;IACpD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC;QACf;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,OAAgB;IACzD,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAQvC;IACC,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC;QACvC,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,cAAc;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAC5C,CAAC;IACF,OAAO,eAAe,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAA0C;IAE1C,OAAO;QACL,GAAG,GAAG;QACN,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC;QACvD,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3C,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,QAA+B;IAE/B,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,cAAc;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc;QACd,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACjD,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,GAAG,QAAQ;YACX,cAAc;YACd,EAAE;YACF,cAAc;YACd,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,iBAAiB,CAAC,EAAE;YAC5B,GAAG,EAAE;gBACH,UAAU,EAAE,GAAG,CAAA,OAAO,iBAAiB,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,GAAG;gBAC7E,cAAc,EAAE,GAAG,CAAA,OAAO,iBAAiB,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,GAAG;gBACzF,eAAe,EAAE,GAAG,CAAA,GAAG,iBAAiB,CAAC,eAAe,MAAM,QAAQ,CAAC,eAAe,EAAE;aACzF;SACF,CAAC;aACD,GAAG,EAAE,CAAC;QACT,MAAM,oBAAoB,GACxB,QAAQ,CAAC,WAAW,KAAK,IAAI;YAC3B,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC;YACvC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;aACpC,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,OAAO,CACN,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EACtC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAC3B;aACA,KAAK,CAAC,CAAC,CAAC;aACR,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC7C,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,iBAAiB,CAAC;iBACzB,KAAK,CACJ,OAAO,CACL,iBAAiB,CAAC,EAAE,EACpB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACzC,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,WAA0B;IAE1B,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CACnD;SACA,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;SAC3E,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import {\n  isKeyingVerificationCode,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { desc, eq, inArray, isNull, sql } from \"drizzle-orm\";\nimport type {\n  SecurityIncident,\n  SecurityIncidentObjectKind,\n} from \"../shared/securityIncidents\";\nimport {\n  securityIncidents,\n  securityIncidentTable,\n} from \"../sqlite/securityIncidentSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\ninterface SecurityIncidentWrite {\n  readonly trustDomain: string | null;\n  readonly code: SecurityIncident[\"code\"];\n  readonly operation: string;\n  readonly objectKind: SecurityIncidentObjectKind;\n  readonly objectId: string | null;\n  readonly organizationId?: string | null | undefined;\n  readonly evidenceHashes?: Readonly<Record<string, string>> | undefined;\n  readonly detectedAt: string;\n  readonly lastDetectedAt: string;\n  readonly occurrenceCount: number;\n}\n\nconst SECURITY_INCIDENT_RETENTION_LIMIT = 1_000;\n\n/**\n * The incident id hashes this text, so it must be identical on every device:\n * code-unit key order, no locale collation, and no `Object` property-order\n * rules (which would float integer-like keys ahead of the sort).\n */\nfunction serializeEvidenceHashes(\n  evidenceHashes: Readonly<Record<string, string>> | undefined,\n): string {\n  return serializeKeyingCanonicalJson(evidenceHashes ?? {});\n}\n\nfunction parseEvidenceHashes(value: string): Readonly<Record<string, string>> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(value);\n  } catch {\n    return {};\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return {};\n  }\n  const entries: Array<[string, string]> = [];\n  for (const [key, item] of Object.entries(parsed)) {\n    if (key.length === 0 || typeof item !== \"string\") {\n      return {};\n    }\n    entries.push([key, item]);\n  }\n  // Object.fromEntries keeps every key, including \"__proto__\", which an index\n  // assignment on a plain object would silently drop.\n  return Object.fromEntries(entries);\n}\n\nfunction parseVerificationCode(value: string): SecurityIncident[\"code\"] {\n  if (isKeyingVerificationCode(value)) return value;\n  return \"unrecognized_verification_code\";\n}\n\nfunction parseObjectKind(value: string): SecurityIncidentObjectKind {\n  switch (value) {\n    case \"blob\":\n    case \"container\":\n    case \"document\":\n    case \"principal\":\n    case \"user\":\n    case \"unknown\":\n      return value;\n    default:\n      return \"unknown\";\n  }\n}\n\nasync function ensureSecurityIncidentTable(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, [securityIncidentTable]);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\n    \"\",\n  );\n}\n\nasync function deriveSecurityIncidentId(input: {\n  readonly code: SecurityIncident[\"code\"];\n  readonly evidenceHashes: string;\n  readonly objectId: string | null;\n  readonly objectKind: SecurityIncidentObjectKind;\n  readonly operation: string;\n  readonly organizationId: string | null;\n  readonly trustDomain: string | null;\n}): Promise<string> {\n  const canonicalIdentity = JSON.stringify([\n    input.trustDomain,\n    input.code,\n    input.operation,\n    input.objectKind,\n    input.objectId,\n    input.organizationId,\n    input.evidenceHashes,\n  ]);\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(canonicalIdentity),\n  );\n  return `incident_v1_${bytesToHex(new Uint8Array(digest))}`;\n}\n\nfunction parseSecurityIncidentRow(\n  row: typeof securityIncidents.$inferSelect,\n): SecurityIncident {\n  return {\n    ...row,\n    code: parseVerificationCode(row.code),\n    evidenceHashes: parseEvidenceHashes(row.evidenceHashes),\n    objectKind: parseObjectKind(row.objectKind),\n    trustDomain: row.trustDomain,\n  };\n}\n\nexport async function appendSecurityIncident(\n  execSql: ExecSql,\n  incident: SecurityIncidentWrite,\n): Promise<SecurityIncident | null> {\n  await ensureSecurityIncidentTable(execSql);\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const evidenceHashes = serializeEvidenceHashes(incident.evidenceHashes);\n  const organizationId = incident.organizationId ?? null;\n  const id = await deriveSecurityIncidentId({\n    code: incident.code,\n    evidenceHashes,\n    objectId: incident.objectId,\n    objectKind: incident.objectKind,\n    operation: incident.operation,\n    organizationId,\n    trustDomain: incident.trustDomain,\n  });\n  const row = await runtime.transaction(async (tx) => {\n    await tx\n      .insert(securityIncidents)\n      .values({\n        ...incident,\n        evidenceHashes,\n        id,\n        organizationId,\n        trustDomain: incident.trustDomain,\n      })\n      .onConflictDoUpdate({\n        target: securityIncidents.id,\n        set: {\n          detectedAt: sql`min(${securityIncidents.detectedAt}, ${incident.detectedAt})`,\n          lastDetectedAt: sql`max(${securityIncidents.lastDetectedAt}, ${incident.lastDetectedAt})`,\n          occurrenceCount: sql`${securityIncidents.occurrenceCount} + ${incident.occurrenceCount}`,\n        },\n      })\n      .run();\n    const trustDomainCondition =\n      incident.trustDomain === null\n        ? isNull(securityIncidents.trustDomain)\n        : eq(securityIncidents.trustDomain, incident.trustDomain);\n    const staleRows = await tx\n      .select({ id: securityIncidents.id })\n      .from(securityIncidents)\n      .where(trustDomainCondition)\n      .orderBy(\n        desc(securityIncidents.lastDetectedAt),\n        desc(securityIncidents.id),\n      )\n      .limit(1)\n      .offset(SECURITY_INCIDENT_RETENTION_LIMIT);\n    // Each call can add at most one distinct row, so deleting the single 1,001st\n    // row restores the cap. A future bulk writer must delete its whole excess.\n    if (staleRows.length > 0) {\n      await tx\n        .delete(securityIncidents)\n        .where(\n          inArray(\n            securityIncidents.id,\n            staleRows.map((staleRow) => staleRow.id),\n          ),\n        )\n        .run();\n    }\n    const [storedRow] = await tx\n      .select()\n      .from(securityIncidents)\n      .where(eq(securityIncidents.id, id))\n      .limit(1);\n    return storedRow;\n  });\n  return row ? parseSecurityIncidentRow(row) : null;\n}\n\nexport async function listSecurityIncidents(\n  execSql: ExecSql,\n  trustDomain: string | null,\n): Promise<SecurityIncident[]> {\n  await ensureSecurityIncidentTable(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select()\n    .from(securityIncidents)\n    .where(\n      trustDomain === null\n        ? isNull(securityIncidents.trustDomain)\n        : eq(securityIncidents.trustDomain, trustDomain),\n    )\n    .orderBy(desc(securityIncidents.lastDetectedAt), desc(securityIncidents.id))\n    .limit(SECURITY_INCIDENT_RETENTION_LIMIT);\n  return rows.map(parseSecurityIncidentRow);\n}\n"]}
+{"version":3,"file":"securityIncidentPersistence.js","sourceRoot":"","sources":["securityIncidentPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAK7D,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAepE,MAAM,iCAAiC,GAAG,KAAK,CAAC;AAEhD;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,cAA4D;IAE5D,OAAO,4BAA4B,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,4EAA4E;IAC5E,oDAAoD;IACpD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC;QACf;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,OAAgB;IACzD,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAQvC;IACC,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC;QACvC,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,cAAc;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAC5C,CAAC;IACF,OAAO,eAAe,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAA0C;IAE1C,OAAO;QACL,GAAG,GAAG;QACN,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC;QACvD,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3C,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,QAA+B;IAE/B,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,cAAc;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc;QACd,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACjD,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,GAAG,QAAQ;YACX,cAAc;YACd,EAAE;YACF,cAAc;YACd,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,iBAAiB,CAAC,EAAE;YAC5B,GAAG,EAAE;gBACH,UAAU,EAAE,GAAG,CAAA,OAAO,iBAAiB,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,GAAG;gBAC7E,cAAc,EAAE,GAAG,CAAA,OAAO,iBAAiB,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,GAAG;gBACzF,eAAe,EAAE,GAAG,CAAA,GAAG,iBAAiB,CAAC,eAAe,MAAM,QAAQ,CAAC,eAAe,EAAE;aACzF;SACF,CAAC;aACD,GAAG,EAAE,CAAC;QACT,MAAM,oBAAoB,GACxB,QAAQ,CAAC,WAAW,KAAK,IAAI;YAC3B,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC;YACvC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;aACpC,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,OAAO,CACN,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EACtC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAC3B;aACA,KAAK,CAAC,CAAC,CAAC;aACR,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC7C,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,iBAAiB,CAAC;iBACzB,KAAK,CACJ,OAAO,CACL,iBAAiB,CAAC,EAAE,EACpB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACzC,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,WAA0B;IAE1B,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CACJ,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CACnD;SACA,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;SAC3E,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import {\n  isKeyingVerificationCode,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { desc, eq, inArray, isNull, sql } from \"drizzle-orm\";\nimport type {\n  SecurityIncident,\n  SecurityIncidentObjectKind,\n} from \"../shared/securityIncidents\";\nimport {\n  securityIncidents,\n  securityIncidentTable,\n} from \"../sqlite/schema/securityIncidentSchema\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\ninterface SecurityIncidentWrite {\n  readonly trustDomain: string | null;\n  readonly code: SecurityIncident[\"code\"];\n  readonly operation: string;\n  readonly objectKind: SecurityIncidentObjectKind;\n  readonly objectId: string | null;\n  readonly organizationId?: string | null | undefined;\n  readonly evidenceHashes?: Readonly<Record<string, string>> | undefined;\n  readonly detectedAt: string;\n  readonly lastDetectedAt: string;\n  readonly occurrenceCount: number;\n}\n\nconst SECURITY_INCIDENT_RETENTION_LIMIT = 1_000;\n\n/**\n * The incident id hashes this text, so it must be identical on every device:\n * code-unit key order, no locale collation, and no `Object` property-order\n * rules (which would float integer-like keys ahead of the sort).\n */\nfunction serializeEvidenceHashes(\n  evidenceHashes: Readonly<Record<string, string>> | undefined,\n): string {\n  return serializeKeyingCanonicalJson(evidenceHashes ?? {});\n}\n\nfunction parseEvidenceHashes(value: string): Readonly<Record<string, string>> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(value);\n  } catch {\n    return {};\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return {};\n  }\n  const entries: Array<[string, string]> = [];\n  for (const [key, item] of Object.entries(parsed)) {\n    if (key.length === 0 || typeof item !== \"string\") {\n      return {};\n    }\n    entries.push([key, item]);\n  }\n  // Object.fromEntries keeps every key, including \"__proto__\", which an index\n  // assignment on a plain object would silently drop.\n  return Object.fromEntries(entries);\n}\n\nfunction parseVerificationCode(value: string): SecurityIncident[\"code\"] {\n  if (isKeyingVerificationCode(value)) return value;\n  return \"unrecognized_verification_code\";\n}\n\nfunction parseObjectKind(value: string): SecurityIncidentObjectKind {\n  switch (value) {\n    case \"blob\":\n    case \"container\":\n    case \"document\":\n    case \"principal\":\n    case \"user\":\n    case \"unknown\":\n      return value;\n    default:\n      return \"unknown\";\n  }\n}\n\nasync function ensureSecurityIncidentTable(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, [securityIncidentTable]);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\n    \"\",\n  );\n}\n\nasync function deriveSecurityIncidentId(input: {\n  readonly code: SecurityIncident[\"code\"];\n  readonly evidenceHashes: string;\n  readonly objectId: string | null;\n  readonly objectKind: SecurityIncidentObjectKind;\n  readonly operation: string;\n  readonly organizationId: string | null;\n  readonly trustDomain: string | null;\n}): Promise<string> {\n  const canonicalIdentity = JSON.stringify([\n    input.trustDomain,\n    input.code,\n    input.operation,\n    input.objectKind,\n    input.objectId,\n    input.organizationId,\n    input.evidenceHashes,\n  ]);\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(canonicalIdentity),\n  );\n  return `incident_v1_${bytesToHex(new Uint8Array(digest))}`;\n}\n\nfunction parseSecurityIncidentRow(\n  row: typeof securityIncidents.$inferSelect,\n): SecurityIncident {\n  return {\n    ...row,\n    code: parseVerificationCode(row.code),\n    evidenceHashes: parseEvidenceHashes(row.evidenceHashes),\n    objectKind: parseObjectKind(row.objectKind),\n    trustDomain: row.trustDomain,\n  };\n}\n\nexport async function appendSecurityIncident(\n  execSql: ExecSql,\n  incident: SecurityIncidentWrite,\n): Promise<SecurityIncident | null> {\n  await ensureSecurityIncidentTable(execSql);\n  const runtime = getClientSQLitePersistenceRuntime(execSql);\n  const evidenceHashes = serializeEvidenceHashes(incident.evidenceHashes);\n  const organizationId = incident.organizationId ?? null;\n  const id = await deriveSecurityIncidentId({\n    code: incident.code,\n    evidenceHashes,\n    objectId: incident.objectId,\n    objectKind: incident.objectKind,\n    operation: incident.operation,\n    organizationId,\n    trustDomain: incident.trustDomain,\n  });\n  const row = await runtime.transaction(async (tx) => {\n    await tx\n      .insert(securityIncidents)\n      .values({\n        ...incident,\n        evidenceHashes,\n        id,\n        organizationId,\n        trustDomain: incident.trustDomain,\n      })\n      .onConflictDoUpdate({\n        target: securityIncidents.id,\n        set: {\n          detectedAt: sql`min(${securityIncidents.detectedAt}, ${incident.detectedAt})`,\n          lastDetectedAt: sql`max(${securityIncidents.lastDetectedAt}, ${incident.lastDetectedAt})`,\n          occurrenceCount: sql`${securityIncidents.occurrenceCount} + ${incident.occurrenceCount}`,\n        },\n      })\n      .run();\n    const trustDomainCondition =\n      incident.trustDomain === null\n        ? isNull(securityIncidents.trustDomain)\n        : eq(securityIncidents.trustDomain, incident.trustDomain);\n    const staleRows = await tx\n      .select({ id: securityIncidents.id })\n      .from(securityIncidents)\n      .where(trustDomainCondition)\n      .orderBy(\n        desc(securityIncidents.lastDetectedAt),\n        desc(securityIncidents.id),\n      )\n      .limit(1)\n      .offset(SECURITY_INCIDENT_RETENTION_LIMIT);\n    // Each call can add at most one distinct row, so deleting the single 1,001st\n    // row restores the cap. A future bulk writer must delete its whole excess.\n    if (staleRows.length > 0) {\n      await tx\n        .delete(securityIncidents)\n        .where(\n          inArray(\n            securityIncidents.id,\n            staleRows.map((staleRow) => staleRow.id),\n          ),\n        )\n        .run();\n    }\n    const [storedRow] = await tx\n      .select()\n      .from(securityIncidents)\n      .where(eq(securityIncidents.id, id))\n      .limit(1);\n    return storedRow;\n  });\n  return row ? parseSecurityIncidentRow(row) : null;\n}\n\nexport async function listSecurityIncidents(\n  execSql: ExecSql,\n  trustDomain: string | null,\n): Promise<SecurityIncident[]> {\n  await ensureSecurityIncidentTable(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select()\n    .from(securityIncidents)\n    .where(\n      trustDomain === null\n        ? isNull(securityIncidents.trustDomain)\n        : eq(securityIncidents.trustDomain, trustDomain),\n    )\n    .orderBy(desc(securityIncidents.lastDetectedAt), desc(securityIncidents.id))\n    .limit(SECURITY_INCIDENT_RETENTION_LIMIT);\n  return rows.map(parseSecurityIncidentRow);\n}\n"]}

package/data/persistence/trustedUserIdentityPinPersistence.js

@@ -1,5 +1,5 @@
 import { and, eq } from "drizzle-orm";
-import { trustedUserIdentityPins, trustedUserIdentityPinTables, } from "../sqlite/schema.js";
+import { trustedUserIdentityPins, trustedUserIdentityPinTables, } from "../sqlite/schema/index.js";
 import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../sqlite/sqlSchema.js";
 import { TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE, TRUSTED_USER_IDENTITY_FORMAT_VERSION, TRUSTED_USER_IDENTITY_SIGNING_SUITE, } from "../trustedUserIdentity/types.js";

package/data/persistence/verifiedManifestBundlePersistence.d.ts

@@ -1,8 +1,8 @@
 import type { VerifiedManifestCitations, WriterProjectionTarget } from "../../internal/api-client/index.js";
 import { type AccessManifestBundleWireResponse } from "../../internal/validators/response/index.js";
+import { verifiedAccessManifestBundles as bundles } from "../sqlite/schema/verifiedManifestBundleSchema.js";
 import { type ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
 import { type ExecSql } from "../sqlite/sqlSchema.js";
-import { verifiedAccessManifestBundles as bundles } from "../sqlite/verifiedManifestBundleSchema.js";
 /**
  * Bounds local bytes (a bundle is ~10–20 KB). Evicting the least recently
  * verified rows only makes a later read carry those bundles again.

package/data/persistence/verifiedManifestBundlePersistence.js

@@ -2,12 +2,12 @@ import { toFingerprint } from "../../internal/crypto/index.js";
 import { isAccessManifestBundleWireResponse, } from "../../internal/validators/response/index.js";
 import { KNOWN_MANIFEST_HINT_LIMIT, MAX_CONTAINER_PATH_LENGTH, } from "../../internal/validators/util/index.js";
 import { and, asc, desc, eq, inArray, sql } from "drizzle-orm";
-import { containers } from "../sqlite/containerSchema.js";
-import { documentDiscoveryHeads, pendingDocumentDiscoveries, } from "../sqlite/documentDiscoveryEvidenceSchema.js";
-import { containerTables, documentContainerProjection, documentContainerProjectionTables, } from "../sqlite/schema.js";
+import { containerTables, documentContainerProjection, documentContainerProjectionTables, } from "../sqlite/schema/index.js";
+import { containers } from "../sqlite/schema/containerSchema.js";
+import { documentDiscoveryHeads, pendingDocumentDiscoveries, } from "../sqlite/schema/documentDiscoveryEvidenceSchema.js";
+import { verifiedAccessManifestBundles as bundles, verifiedManifestBundleTables, } from "../sqlite/schema/verifiedManifestBundleSchema.js";
 import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../sqlite/sqlSchema.js";
-import { verifiedAccessManifestBundles as bundles, verifiedManifestBundleTables, } from "../sqlite/verifiedManifestBundleSchema.js";
 /**
  * Bounds local bytes (a bundle is ~10–20 KB). Evicting the least recently
  * verified rows only makes a later read carry those bundles again.