@tearleads/client-sdk 0.1.63 → 0.1.65

package/data/keyingProjectionVerification/resolvedPrincipalPolicy.js

@@ -1,72 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
-import { verifiedPrincipalPolicyMeetsCheckpoint } from "../persistence/principalPolicyCheckpointSelection.js";
-import { observePrincipalPolicy, } from "./checkpointContext.js";
-import { referencedPrincipalPolicyKey, verifiedPrincipalPolicyContainsReference, } from "./principalPolicyCache.js";
-import { observeProjectionLifetime } from "./projectionLifetimes.js";
-import { assertProjectionVerificationCurrent, } from "./types.js";
-// Scoped evidence is always resolved through the warmer: its operation memo is
-// the only reuse of recovered directory and Admins evidence, with one set of
-// validity rules. The caller's policy cache keeps bare verified policies; it
-// never stands in for organization, dependency or lifetime bindings.
-async function meetsCheckpoints(context, result, refreshMissing) {
-    for (const policy of [...result.dependencies, result.policy]) {
-        const checkpoint = await loadPrincipalPolicyCheckpoint(context.execSql, policy.principalType, policy.principalId);
-        if (refreshMissing &&
-            checkpoint &&
-            (policy.version < checkpoint.version ||
-                (policy.version > checkpoint.version &&
-                    !policy.retainedHistory.some((entry) => entry.state.version === checkpoint.version))))
-            return false;
-        if (!verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint))
-            throw new KeyingVerificationError("rollback", "Recovered principal evidence predates the durable checkpoint");
-    }
-    return true;
-}
-async function recoverEvidence(input, resolve) {
-    const read = async (recoveryBatch) => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const recovered = await resolve({
-            recoveryBatch,
-            organizationId: input.organizationId,
-            reference: input.reference,
-            stillCurrent: input.stillCurrent,
-        });
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        assertProjectionVerificationCurrent(recovered.stillCurrent);
-        return recovered;
-    };
-    let result = await read();
-    // A concurrent admission may advance a pin after recovery verified it.
-    // Refresh once outside the operation's directory view; the fresh
-    // recovery and final checkpoint check still reject rollback/equivocation.
-    if (!(await meetsCheckpoints(input.checkpointContext, result, true))) {
-        assertProjectionVerificationCurrent(result.stillCurrent);
-        result = await read({});
-        await meetsCheckpoints(input.checkpointContext, result, false);
-    }
-    return result;
-}
-export async function resolveReferencedPrincipalPolicy(input) {
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    const key = referencedPrincipalPolicyKey(input.reference);
-    const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;
-    if (!resolve)
-        return null;
-    const result = await recoverEvidence(input, resolve);
-    const evidenceCurrent = result.stillCurrent;
-    // The consumer's and every producer's lifetime guard the evidence where it
-    // is used: projection admission rechecks them through the context.
-    const lifetime = () => input.stillCurrent?.() !== false && evidenceCurrent();
-    assertProjectionVerificationCurrent(lifetime);
-    observeProjectionLifetime(input.checkpointContext, lifetime);
-    if (result.organizationId !== input.organizationId)
-        throw new KeyingVerificationError("object_mismatch", "Recovered principal evidence belongs to another organization");
-    if (!verifiedPrincipalPolicyContainsReference(result.policy, input.reference))
-        throw new KeyingVerificationError("object_mismatch", "Recovered principal evidence does not contain the exact citation");
-    for (const policy of [...result.dependencies, result.policy])
-        observePrincipalPolicy(input.checkpointContext, policy, input.organizationId);
-    input.principalPolicyCache.set(key, result.policy);
-    return result.policy;
-}
-//# sourceMappingURL=resolvedPrincipalPolicy.js.map

package/data/keyingProjectionVerification/resolvedPrincipalPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolvedPrincipalPolicy.js","sourceRoot":"","sources":["resolvedPrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,sCAAsC,EAAE,MAAM,mDAAmD,CAAC;AAC3G,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,mCAAmC,GAIpC,MAAM,SAAS,CAAC;AAEjB,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,qEAAqE;AACrE,KAAK,UAAU,gBAAgB,CAC7B,OAAoC,EACpC,MAAuC,EACvC,cAAuB;IAEvB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IACE,cAAc;YACd,UAAU;YACV,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;gBAClC,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;oBAClC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CACtD,CAAC,CAAC;YAEP,OAAO,KAAK,CAAC;QACf,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,KAAK,UAAU,eAAe,CAC5B,KAA4C,EAC5C,OAAyE;IAEzE,MAAM,IAAI,GAAG,KAAK,EAAE,aAAsB,EAAE,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC;YAC9B,aAAa;YACb,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,uEAAuE;IACvE,iEAAiE;IACjE,0EAA0E;IAC1E,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACrE,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,+BAA+B,EAAE,gBAAgB,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC;IAC5C,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,eAAe,EAAE,CAAC;IAC7E,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9C,yBAAyB,CAAC,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,IAAI,CAAC,wCAAwC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1D,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,MAAM,EACN,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../persistence/keyingCheckpointPersistence\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"../persistence/principalPolicyCheckpointSelection\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"./checkpointContext\";\nimport {\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\nimport { observeProjectionLifetime } from \"./projectionLifetimes\";\nimport {\n  assertProjectionVerificationCurrent,\n  type PrincipalPolicyCache,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"./types\";\n\n// Scoped evidence is always resolved through the warmer: its operation memo is\n// the only reuse of recovered directory and Admins evidence, with one set of\n// validity rules. The caller's policy cache keeps bare verified policies; it\n// never stands in for organization, dependency or lifetime bindings.\nasync function meetsCheckpoints(\n  context: ProjectionCheckpointContext,\n  result: ResolvedPrincipalPolicyEvidence,\n  refreshMissing: boolean,\n): Promise<boolean> {\n  for (const policy of [...result.dependencies, result.policy]) {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      context.execSql,\n      policy.principalType,\n      policy.principalId,\n    );\n    if (\n      refreshMissing &&\n      checkpoint &&\n      (policy.version < checkpoint.version ||\n        (policy.version > checkpoint.version &&\n          !policy.retainedHistory.some(\n            (entry) => entry.state.version === checkpoint.version,\n          )))\n    )\n      return false;\n    if (!verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint))\n      throw new KeyingVerificationError(\n        \"rollback\",\n        \"Recovered principal evidence predates the durable checkpoint\",\n      );\n  }\n  return true;\n}\n\ninterface ResolveReferencedPrincipalPolicyInput {\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly reference: ReferencedPrincipalHead;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nasync function recoverEvidence(\n  input: ResolveReferencedPrincipalPolicyInput,\n  resolve: NonNullable<ReferencedPrincipalPolicyWarmer[\"resolveReference\"]>,\n): Promise<ResolvedPrincipalPolicyEvidence> {\n  const read = async (recoveryBatch?: object) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const recovered = await resolve({\n      recoveryBatch,\n      organizationId: input.organizationId,\n      reference: input.reference,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    assertProjectionVerificationCurrent(recovered.stillCurrent);\n    return recovered;\n  };\n  let result = await read();\n  // A concurrent admission may advance a pin after recovery verified it.\n  // Refresh once outside the operation's directory view; the fresh\n  // recovery and final checkpoint check still reject rollback/equivocation.\n  if (!(await meetsCheckpoints(input.checkpointContext, result, true))) {\n    assertProjectionVerificationCurrent(result.stillCurrent);\n    result = await read({});\n    await meetsCheckpoints(input.checkpointContext, result, false);\n  }\n  return result;\n}\n\nexport async function resolveReferencedPrincipalPolicy(\n  input: ResolveReferencedPrincipalPolicyInput,\n): Promise<VerifiedPrincipalPolicyCurrent | null> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const key = referencedPrincipalPolicyKey(input.reference);\n  const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;\n  if (!resolve) return null;\n  const result = await recoverEvidence(input, resolve);\n  const evidenceCurrent = result.stillCurrent;\n  // The consumer's and every producer's lifetime guard the evidence where it\n  // is used: projection admission rechecks them through the context.\n  const lifetime = () => input.stillCurrent?.() !== false && evidenceCurrent();\n  assertProjectionVerificationCurrent(lifetime);\n  observeProjectionLifetime(input.checkpointContext, lifetime);\n  if (result.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence belongs to another organization\",\n    );\n  if (!verifiedPrincipalPolicyContainsReference(result.policy, input.reference))\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence does not contain the exact citation\",\n    );\n  for (const policy of [...result.dependencies, result.policy])\n    observePrincipalPolicy(\n      input.checkpointContext,\n      policy,\n      input.organizationId,\n    );\n  input.principalPolicyCache.set(key, result.policy);\n  return result.policy;\n}\n"]}

package/data/persistence/documentPurgeCheckpointPersistence.d.ts

@@ -1,10 +0,0 @@
-import type { ClientSQLiteTransactionScope } from "../sqlite/sqlitePersistenceRuntime.js";
-import { type ExecSql } from "../sqlite/sqlSchema.js";
-export interface DocumentPurgeCheckpoint {
-    readonly documentId: string;
-    readonly documentManifestHash: string;
-    readonly organizationId: string;
-    readonly purgeEventHash: string;
-}
-export declare function loadDocumentPurgeCheckpoint(execSql: ExecSql, documentId: string): Promise<DocumentPurgeCheckpoint | null>;
-export declare function storeDocumentPurgeCheckpointInTransaction(tx: ClientSQLiteTransactionScope, checkpoint: DocumentPurgeCheckpoint, updatedAt: string): Promise<void>;

package/data/persistence/documentPurgeCheckpointPersistence.js

@@ -1,43 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { eq } from "drizzle-orm";
-import { documentPurgeCheckpoints, keyingCheckpointTables, } from "../sqlite/schema.js";
-import { getClientSQLitePersistenceRuntime } from "../sqlite/sqlitePersistenceRuntime.js";
-import { ensureSqlTables } from "../sqlite/sqlSchema.js";
-export async function loadDocumentPurgeCheckpoint(execSql, documentId) {
-    await ensureSqlTables(execSql, keyingCheckpointTables);
-    const [row] = await getClientSQLitePersistenceRuntime(execSql)
-        .db.select({
-        documentId: documentPurgeCheckpoints.documentId,
-        documentManifestHash: documentPurgeCheckpoints.documentManifestHash,
-        organizationId: documentPurgeCheckpoints.organizationId,
-        purgeEventHash: documentPurgeCheckpoints.purgeEventHash,
-    })
-        .from(documentPurgeCheckpoints)
-        .where(eq(documentPurgeCheckpoints.documentId, documentId))
-        .limit(1);
-    return row ?? null;
-}
-export async function storeDocumentPurgeCheckpointInTransaction(tx, checkpoint, updatedAt) {
-    const [stored] = await tx
-        .select({
-        documentManifestHash: documentPurgeCheckpoints.documentManifestHash,
-        organizationId: documentPurgeCheckpoints.organizationId,
-        purgeEventHash: documentPurgeCheckpoints.purgeEventHash,
-    })
-        .from(documentPurgeCheckpoints)
-        .where(eq(documentPurgeCheckpoints.documentId, checkpoint.documentId))
-        .limit(1);
-    if (stored) {
-        if (stored.documentManifestHash !== checkpoint.documentManifestHash ||
-            stored.organizationId !== checkpoint.organizationId ||
-            stored.purgeEventHash !== checkpoint.purgeEventHash) {
-            throw new KeyingVerificationError("equivocation", "Document purge checkpoint conflicts with the verified terminal event");
-        }
-        return;
-    }
-    await tx
-        .insert(documentPurgeCheckpoints)
-        .values({ ...checkpoint, updatedAt })
-        .run();
-}
-//# sourceMappingURL=documentPurgeCheckpointPersistence.js.map

package/data/persistence/documentPurgeCheckpointPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentPurgeCheckpointPersistence.js","sourceRoot":"","sources":["documentPurgeCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AASpE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,UAAkB;IAElB,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC;SAC3D,EAAE,CAAC,MAAM,CAAC;QACT,UAAU,EAAE,wBAAwB,CAAC,UAAU;QAC/C,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,UAAmC,EACnC,SAAiB;IAEjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,cAAc,EAAE,wBAAwB,CAAC,cAAc;KACxD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;SACrE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,EAAE,CAAC;QACX,IACE,MAAM,CAAC,oBAAoB,KAAK,UAAU,CAAC,oBAAoB;YAC/D,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACnD,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc,EACnD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;SACpC,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport {\n  documentPurgeCheckpoints,\n  keyingCheckpointTables,\n} from \"../sqlite/schema\";\nimport type { ClientSQLiteTransactionScope } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { getClientSQLitePersistenceRuntime } from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\n\nexport interface DocumentPurgeCheckpoint {\n  readonly documentId: string;\n  readonly documentManifestHash: string;\n  readonly organizationId: string;\n  readonly purgeEventHash: string;\n}\n\nexport async function loadDocumentPurgeCheckpoint(\n  execSql: ExecSql,\n  documentId: string,\n): Promise<DocumentPurgeCheckpoint | null> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n  const [row] = await getClientSQLitePersistenceRuntime(execSql)\n    .db.select({\n      documentId: documentPurgeCheckpoints.documentId,\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, documentId))\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function storeDocumentPurgeCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: DocumentPurgeCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const [stored] = await tx\n    .select({\n      documentManifestHash: documentPurgeCheckpoints.documentManifestHash,\n      organizationId: documentPurgeCheckpoints.organizationId,\n      purgeEventHash: documentPurgeCheckpoints.purgeEventHash,\n    })\n    .from(documentPurgeCheckpoints)\n    .where(eq(documentPurgeCheckpoints.documentId, checkpoint.documentId))\n    .limit(1);\n  if (stored) {\n    if (\n      stored.documentManifestHash !== checkpoint.documentManifestHash ||\n      stored.organizationId !== checkpoint.organizationId ||\n      stored.purgeEventHash !== checkpoint.purgeEventHash\n    ) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        \"Document purge checkpoint conflicts with the verified terminal event\",\n      );\n    }\n    return;\n  }\n  await tx\n    .insert(documentPurgeCheckpoints)\n    .values({ ...checkpoint, updatedAt })\n    .run();\n}\n"]}

package/data/persistence/keyingCheckpointAdvancePersistence.js

@@ -1,222 +0,0 @@
-import { KeyingVerificationError, verifyAccessManifestLocalCheckpoint, verifyPrincipalPolicyCheckpoint, } from "../../internal/crypto/index.js";
-import { keyingCheckpointTables, principalPolicyTables, } from "../sqlite/schema.js";
-import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
-import { ensureSqlTables } from "../sqlite/sqlSchema.js";
-import { verifiedManifestBundleTables } from "../sqlite/verifiedManifestBundleSchema.js";
-import { storeDocumentPurgeCheckpointInTransaction, } from "./documentPurgeCheckpointPersistence.js";
-import { validateAccessManifestCheckpointEvidence } from "./keyingCheckpointEvidence.js";
-import { accessManifestObjectKey, loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertAccessManifestCheckpointInTransaction, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
-import { validatePrincipalAuthorizationCheckpoints } from "./principalAuthorizationCheckpoints.js";
-import { assertContainerNotRetired } from "./principalGrantRetirementPersistence.js";
-import { assertPrincipalPolicyBundleStoredInTransaction, writePrincipalPolicyBundleInTransaction, } from "./principalPolicyPersistence.js";
-import { verifiedManifestBundleRows, writeVerifiedManifestBundlesInTransaction, } from "./verifiedManifestBundlePersistence.js";
-import { assertBundleMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyBundle.js";
-function validateAccessAdvance(advance, localCheckpoint) {
-    const current = {
-        ...advance.head.checkpoint,
-        previousManifestHash: advance.head.manifest.previousManifestHash,
-    };
-    const predecessors = [...advance.predecessors].sort((left, right) => left.checkpoint.epoch - right.checkpoint.epoch);
-    if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {
-        verifyAccessManifestLocalCheckpoint({
-            current,
-            localCheckpoint,
-            checkpointPredecessors: undefined,
-        });
-    }
-    validateAccessManifestCheckpointEvidence({
-        head: advance.head,
-        predecessors,
-        localCheckpoint,
-    });
-    verifyAccessManifestLocalCheckpoint({
-        current,
-        localCheckpoint,
-        checkpointPredecessors: predecessors.filter((manifest) => localCheckpoint !== null &&
-            manifest.checkpoint.epoch > localCheckpoint.epoch &&
-            manifest.checkpoint.epoch < current.epoch),
-    });
-    return {
-        checkpoint: advance.head.checkpoint,
-    };
-}
-async function validateAccessAdvances(tx, advances) {
-    const pending = new Map();
-    for (const advance of advances) {
-        await assertContainerNotRetired(tx, advance.head.checkpoint);
-        const key = accessManifestObjectKey(advance.head.checkpoint);
-        if (pending.has(key)) {
-            throw new KeyingVerificationError("equivocation", `projection declares multiple access checkpoint heads for ${key}`);
-        }
-        const localCheckpoint = await loadStoredAccessManifestCheckpoint(tx, advance.head.checkpoint);
-        pending.set(key, validateAccessAdvance(advance, localCheckpoint));
-    }
-    return pending;
-}
-function extendsObservedPolicy(head, candidate) {
-    const history = "retainedHistory" in head ? head.retainedHistory : head.history;
-    return (history?.some(({ state }) => state.principalType === candidate.principalType &&
-        state.principalId === candidate.principalId &&
-        state.version === candidate.version &&
-        state.stateHash === candidate.stateHash) ?? false);
-}
-async function validatePolicyAdvances(tx, policies) {
-    const policiesByPrincipal = new Map();
-    for (const policy of policies) {
-        const key = principalPolicyKey(policy);
-        const candidates = policiesByPrincipal.get(key) ?? [];
-        candidates.push(policy);
-        policiesByPrincipal.set(key, candidates);
-    }
-    const pending = new Map();
-    for (const key of [...policiesByPrincipal.keys()].sort()) {
-        const candidates = policiesByPrincipal.get(key) ?? [];
-        const maxVersion = Math.max(...candidates.map((policy) => policy.version));
-        const heads = candidates.filter((policy) => policy.version === maxVersion);
-        const head = heads[0];
-        if (!head) {
-            continue;
-        }
-        if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {
-            throw new KeyingVerificationError("equivocation", `principal policy declares conflicting heads for ${key}`);
-        }
-        for (const candidate of candidates) {
-            if (candidate.version === head.version) {
-                continue;
-            }
-            if (!extendsObservedPolicy(head, candidate)) {
-                throw new KeyingVerificationError("stale_predecessor", `principal policy head does not extend observed state for ${key}`);
-            }
-        }
-        const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);
-        verifyPrincipalPolicyCheckpoint({
-            chain: "retainedHistory" in head ? head.retainedHistory : (head.history ?? []),
-            currentState: head.state,
-            localCheckpoint,
-        });
-        pending.set(key, head);
-    }
-    return pending;
-}
-async function writeAccessCheckpoints(tx, pending, updatedAt) {
-    for (const { checkpoint } of pending.values()) {
-        await upsertAccessManifestCheckpointInTransaction(tx, checkpoint, updatedAt);
-    }
-}
-async function writePolicyCheckpoints(tx, pending, updatedAt, organizationId) {
-    for (const policy of pending.values()) {
-        await upsertPrincipalPolicyCheckpointInTransaction(tx, policy.checkpoint, updatedAt, organizationId);
-    }
-}
-/**
- * Digests the verified bundles and ensures every table the batch touches,
- * all before its transaction begins.
- */
-async function prepareKeyingCheckpointBatch(input) {
-    const bundleRows = await verifiedManifestBundleRows(input.verifiedBundles ?? []);
-    await ensureSqlTables(input.execSql, [
-        ...(input.policies.length > 0 ||
-            (input.authorizationPolicies?.length ?? 0) > 0
-            ? principalPolicyTables
-            : []),
-        ...keyingCheckpointTables,
-        ...(bundleRows.length > 0 ? verifiedManifestBundleTables : []),
-    ]);
-    return bundleRows;
-}
-/**
- * Re-checks verified candidates against durable pins without advancing them.
- * Only the verified bundles' citation rows are written.
- */
-export async function validateKeyingCheckpointsAtomically(input) {
-    const bundleRows = await prepareKeyingCheckpointBatch(input);
-    const verifiedAt = new Date().toISOString();
-    const validate = async (tx) => {
-        await validateAccessAdvances(tx, input.access);
-        await validatePolicyAdvances(tx, input.policies);
-        await validatePrincipalAuthorizationCheckpoints(tx, input.authorizationPolicies ?? []);
-        await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);
-    };
-    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
-    if (input.stillCurrent) {
-        await runtime.guardedTransaction(validate, input.stillCurrent, {
-            behavior: "immediate",
-        });
-        return;
-    }
-    await runtime.transaction(validate, { behavior: "immediate" });
-}
-/**
- * Re-check every verified projection candidate against the latest durable pins
- * and advance the complete batch atomically. Signature verification and remote
- * fetching happen before this short transaction; only checkpoint comparison
- * and persistence, with the batch's verified bundles, are serialized here.
- */
-export async function advanceKeyingCheckpointsAtomically(input) {
-    const bundleRows = await prepareKeyingCheckpointBatch(input);
-    const updatedAt = new Date().toISOString();
-    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
-    const advance = async (tx) => {
-        const access = await validateAccessAdvances(tx, input.access);
-        const policies = await validatePolicyAdvances(tx, input.policies);
-        await validatePrincipalAuthorizationCheckpoints(tx, input.authorizationPolicies ?? []);
-        await writeAccessCheckpoints(tx, access, updatedAt);
-        await writePolicyCheckpoints(tx, policies, updatedAt, input.organizationId);
-        if (input.documentPurgeCheckpoint) {
-            await storeDocumentPurgeCheckpointInTransaction(tx, input.documentPurgeCheckpoint, updatedAt);
-        }
-        await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, updatedAt);
-    };
-    if (input.stillCurrent) {
-        await runtime.guardedTransaction(advance, input.stillCurrent, {
-            behavior: "immediate",
-        });
-        return;
-    }
-    await runtime.transaction(advance, { behavior: "immediate" });
-}
-/**
- * Persists each verified full policy bundle together with its durable head.
- * This prevents a crash or bundle-write failure from leaving a checkpoint
- * without the exact same-head payload and member-envelope evidence.
- */
-export async function persistVerifiedPrincipalPolicyBundlesAtomically(input) {
-    const seen = new Set();
-    for (const entry of input.entries) {
-        const key = principalPolicyKey(entry.policy);
-        if (seen.has(key)) {
-            throw new KeyingVerificationError("duplicate_entry", `verified policy bundle batch repeats ${key}`);
-        }
-        seen.add(key);
-    }
-    await Promise.all(input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)));
-    await ensureSqlTables(input.execSql, [
-        ...principalPolicyTables,
-        ...keyingCheckpointTables,
-    ]);
-    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
-    const persist = async (tx) => {
-        const policies = await validatePolicyAdvances(tx, input.entries.map((entry) => entry.policy));
-        for (const entry of input.entries) {
-            await writePrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
-            await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);
-        }
-        await writePolicyCheckpoints(tx, policies, input.updatedAt, input.organizationId);
-        for (const policy of policies.values()) {
-            const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);
-            if (!checkpoint ||
-                checkpoint.version !== policy.version ||
-                checkpoint.stateHash !== policy.stateHash) {
-                throw new Error("Verified principal policy checkpoint was not persisted");
-            }
-        }
-    };
-    if (input.stillCurrent) {
-        await runtime.guardedTransaction(persist, input.stillCurrent, {
-            behavior: "immediate",
-        });
-        return;
-    }
-    await runtime.transaction(persist, { behavior: "immediate" });
-}
-//# sourceMappingURL=keyingCheckpointAdvancePersistence.js.map

package/data/persistence/keyingCheckpointAdvancePersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAKvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EACL,8CAA8C,EAC9C,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,0BAA0B,EAC1B,yCAAyC,GAC1C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAmCpF,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,kCAAkC,CAC9D,EAAE,EACF,OAAO,CAAC,IAAI,CAAC,UAAU,CACxB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,cAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,KAAK,CAAC,eAAe,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,sBAAsB;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QACF,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QAEF,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAMrE;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,8CAA8C,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,sBAAsB,CAC1B,EAAE,EACF,QAAQ,EACR,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IACE,CAAC,UAAU;gBACX,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBACrC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { verifiedManifestBundleTables } from \"../sqlite/verifiedManifestBundleSchema\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { validatePrincipalAuthorizationCheckpoints } from \"./principalAuthorizationCheckpoints\";\nimport { assertContainerNotRetired } from \"./principalGrantRetirementPersistence\";\nimport {\n  assertPrincipalPolicyBundleStoredInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport {\n  type VerifiedManifestBundle,\n  type VerifiedManifestBundleRow,\n  verifiedManifestBundleRows,\n  writeVerifiedManifestBundlesInTransaction,\n} from \"./verifiedManifestBundlePersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /**\n   * Bundles this projection verified. They are stored for later citation in\n   * the same transaction, so they commit only with the batch they verified.\n   */\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n}\n\ninterface VerifiedPrincipalPolicyBundleEntry {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n\n  for (const advance of advances) {\n    await assertContainerNotRetired(tx, advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const localCheckpoint = await loadStoredAccessManifestCheckpoint(\n      tx,\n      advance.head.checkpoint,\n    );\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\nasync function validatePolicyAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const { checkpoint } of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\nasync function writePolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  for (const policy of pending.values()) {\n    await upsertPrincipalPolicyCheckpointInTransaction(\n      tx,\n      policy.checkpoint,\n      updatedAt,\n      organizationId,\n    );\n  }\n}\n\n/**\n * Digests the verified bundles and ensures every table the batch touches,\n * all before its transaction begins.\n */\nasync function prepareKeyingCheckpointBatch(\n  input: KeyingCheckpointValidationInput,\n): Promise<VerifiedManifestBundleRow[]> {\n  const bundleRows = await verifiedManifestBundleRows(\n    input.verifiedBundles ?? [],\n  );\n  await ensureSqlTables(input.execSql, [\n    ...(input.policies.length > 0 ||\n    (input.authorizationPolicies?.length ?? 0) > 0\n      ? principalPolicyTables\n      : []),\n    ...keyingCheckpointTables,\n    ...(bundleRows.length > 0 ? verifiedManifestBundleTables : []),\n  ]);\n  return bundleRows;\n}\n\n/**\n * Re-checks verified candidates against durable pins without advancing them.\n * Only the verified bundles' citation rows are written.\n */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const verifiedAt = new Date().toISOString();\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePolicyAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence, with the batch's verified bundles, are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput & {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly organizationId?: string | undefined;\n  },\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePolicyAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePolicyCheckpoints(tx, policies, updatedAt, input.organizationId);\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, updatedAt);\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n\n/**\n * Persists each verified full policy bundle together with its durable head.\n * This prevents a crash or bundle-write failure from leaving a checkpoint\n * without the exact same-head payload and member-envelope evidence.\n */\nexport async function persistVerifiedPrincipalPolicyBundlesAtomically(input: {\n  readonly entries: readonly VerifiedPrincipalPolicyBundleEntry[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  const seen = new Set<string>();\n  for (const entry of input.entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `verified policy bundle batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const persist = async (tx: ClientSQLiteTransactionScope) => {\n    const policies = await validatePolicyAdvances(\n      tx,\n      input.entries.map((entry) => entry.policy),\n    );\n    for (const entry of input.entries) {\n      await writePrincipalPolicyBundleInTransaction(\n        tx,\n        entry.bundle,\n        input.updatedAt,\n        input.organizationId,\n      );\n      await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);\n    }\n    await writePolicyCheckpoints(\n      tx,\n      policies,\n      input.updatedAt,\n      input.organizationId,\n    );\n    for (const policy of policies.values()) {\n      const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n      if (\n        !checkpoint ||\n        checkpoint.version !== policy.version ||\n        checkpoint.stateHash !== policy.stateHash\n      ) {\n        throw new Error(\n          \"Verified principal policy checkpoint was not persisted\",\n        );\n      }\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(persist, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(persist, { behavior: \"immediate\" });\n}\n"]}

package/data/persistence/keyingCheckpointEvidence.js

@@ -1,32 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { accessManifestObjectKey } from "./keyingCheckpointPersistence.js";
-/** Structural consistency applies even when local currency prevents acceptance. */
-export function validateAccessManifestCheckpointEvidence(input) {
-    const current = input.head.checkpoint;
-    const { predecessors, localCheckpoint } = input;
-    const hashByEpoch = new Map();
-    for (const predecessor of predecessors) {
-        if (accessManifestObjectKey(predecessor.checkpoint) !==
-            accessManifestObjectKey(current)) {
-            throw new KeyingVerificationError("object_mismatch", "access manifest checkpoint evidence belongs to another object");
-        }
-        const previousHash = hashByEpoch.get(predecessor.checkpoint.epoch);
-        if (previousHash && previousHash !== predecessor.manifestHash) {
-            throw new KeyingVerificationError("equivocation", `access manifest checkpoint evidence conflicts at epoch ${predecessor.checkpoint.epoch}`);
-        }
-        hashByEpoch.set(predecessor.checkpoint.epoch, predecessor.manifestHash);
-        if (predecessor.checkpoint.epoch === current.epoch &&
-            predecessor.manifestHash !== current.manifestHash) {
-            throw new KeyingVerificationError("equivocation", "access manifest checkpoint evidence conflicts with the declared head");
-        }
-        if (localCheckpoint &&
-            predecessor.checkpoint.epoch === localCheckpoint.epoch &&
-            predecessor.manifestHash !== localCheckpoint.manifestHash) {
-            throw new KeyingVerificationError("equivocation", "access manifest checkpoint evidence conflicts with the local checkpoint");
-        }
-        if (predecessor.checkpoint.epoch > current.epoch) {
-            throw new KeyingVerificationError("stale_predecessor", "access manifest checkpoint evidence is newer than the declared head");
-        }
-    }
-}
-//# sourceMappingURL=keyingCheckpointEvidence.js.map

package/data/persistence/keyingCheckpointPersistence.js

@@ -1,133 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { and, eq } from "drizzle-orm";
-import { accessManifestCheckpoints, keyingCheckpointTables, principalPolicyCheckpoints, } from "../sqlite/schema.js";
-import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceRuntime.js";
-import { ensureSqlTables } from "../sqlite/sqlSchema.js";
-import { recordPrincipalPolicyOrganizationInTransaction } from "./principalPolicyOrganizationPersistence.js";
-/** One key format per checkpoint identity, shared by every batch validator. */
-export function accessManifestObjectKey(identity) {
-    return JSON.stringify([
-        identity.objectKind,
-        identity.organizationId,
-        identity.objectId,
-    ]);
-}
-export function principalPolicyKey(identity) {
-    return JSON.stringify([identity.principalType, identity.principalId]);
-}
-async function loadAccessManifestCheckpointRow(handle, identity) {
-    const rows = await handle
-        .select({
-        epoch: accessManifestCheckpoints.epoch,
-        manifestHash: accessManifestCheckpoints.manifestHash,
-    })
-        .from(accessManifestCheckpoints)
-        .where(and(eq(accessManifestCheckpoints.objectKind, identity.objectKind), eq(accessManifestCheckpoints.organizationId, identity.organizationId), eq(accessManifestCheckpoints.objectId, identity.objectId)))
-        .limit(1);
-    return rows[0] ?? null;
-}
-async function loadPrincipalPolicyCheckpointRow(handle, identity) {
-    const rows = await handle
-        .select({
-        version: principalPolicyCheckpoints.version,
-        stateHash: principalPolicyCheckpoints.stateHash,
-    })
-        .from(principalPolicyCheckpoints)
-        .where(and(eq(principalPolicyCheckpoints.principalType, identity.principalType), eq(principalPolicyCheckpoints.principalId, identity.principalId)))
-        .limit(1);
-    return rows[0] ?? null;
-}
-/**
- * A loaded checkpoint row merged back with the identity it was looked up by —
- * the full checkpoint shape every comparison consumes.
- */
-export async function loadStoredAccessManifestCheckpoint(handle, checkpoint) {
-    const row = await loadAccessManifestCheckpointRow(handle, checkpoint);
-    return row ? { ...checkpoint, ...row } : null;
-}
-export async function loadStoredPrincipalPolicyCheckpoint(handle, identity) {
-    const row = await loadPrincipalPolicyCheckpointRow(handle, identity);
-    return row
-        ? {
-            principalType: identity.principalType,
-            principalId: identity.principalId,
-            ...row,
-        }
-        : null;
-}
-export async function upsertAccessManifestCheckpointInTransaction(tx, checkpoint, updatedAt) {
-    const row = { ...checkpoint, updatedAt };
-    await tx
-        .insert(accessManifestCheckpoints)
-        .values(row)
-        .onConflictDoUpdate({
-        target: [
-            accessManifestCheckpoints.objectKind,
-            accessManifestCheckpoints.organizationId,
-            accessManifestCheckpoints.objectId,
-        ],
-        set: row,
-    })
-        .run();
-}
-export async function upsertPrincipalPolicyCheckpointInTransaction(tx, checkpoint, updatedAt, organizationId) {
-    await recordPrincipalPolicyOrganizationInTransaction(tx, {
-        organizationId,
-        principalId: checkpoint.principalId,
-        principalType: checkpoint.principalType,
-    });
-    const row = { ...checkpoint, updatedAt };
-    await tx
-        .insert(principalPolicyCheckpoints)
-        .values(row)
-        .onConflictDoUpdate({
-        target: [
-            principalPolicyCheckpoints.principalType,
-            principalPolicyCheckpoints.principalId,
-        ],
-        set: row,
-    })
-        .run();
-}
-// Lazily create the checkpoint tables on first access. Every load/save below
-// calls this, so the tables exist on demand; it is intentionally module-private
-// (no caller outside this file needs it, and exporting it tripped knip).
-async function ensureKeyingCheckpointTables(execSql) {
-    await ensureSqlTables(execSql, keyingCheckpointTables);
-}
-export async function loadAccessManifestCheckpoint(execSql, objectKind, organizationId, objectId) {
-    await ensureKeyingCheckpointTables(execSql);
-    const { db } = getClientSQLitePersistenceRuntime(execSql);
-    const row = await loadAccessManifestCheckpointRow(db, {
-        objectKind,
-        organizationId,
-        objectId,
-    });
-    return row ? { objectKind, objectId, organizationId, ...row } : null;
-}
-export async function loadPrincipalPolicyCheckpoint(execSql, principalType, principalId) {
-    await ensureKeyingCheckpointTables(execSql);
-    const { db } = getClientSQLitePersistenceRuntime(execSql);
-    const row = await loadPrincipalPolicyCheckpointRow(db, {
-        principalType,
-        principalId,
-    });
-    return row ? { principalType, principalId, ...row } : null;
-}
-/**
- * The shared shape/ownership guard every checkpoint comparison runs before
- * trusting a durable pin: the pin must belong to the compared principal and
- * carry a well-formed version and hash.
- */
-export function assertPrincipalPolicyCheckpointShape(checkpoint, head) {
-    if (checkpoint.principalType !== head.principalType ||
-        checkpoint.principalId !== head.principalId) {
-        throw new KeyingVerificationError("object_mismatch", "principal policy checkpoint belongs to another principal");
-    }
-    if (!Number.isInteger(checkpoint.version) ||
-        checkpoint.version < 1 ||
-        checkpoint.stateHash.length === 0) {
-        throw new KeyingVerificationError("invalid_shape", "principal policy checkpoint is malformed");
-    }
-}
-//# sourceMappingURL=keyingCheckpointPersistence.js.map

package/data/persistence/keyingCheckpointPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyingCheckpointPersistence.js","sourceRoot":"","sources":["keyingCheckpointPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAc1G,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,QAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAwB,EACxB,QAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,KAAK,EAAE,yBAAyB,CAAC,KAAK;QACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;KACrD,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC7D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAwB,EACxB,QAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,0BAA0B,CAAC,OAAO;QAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACjE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwB,EACxB,UAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,QAA2C;IAE3C,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,GAAG;QACR,CAAC,CAAC;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,GAAG;SACP;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,EAAgC,EAChC,UAAoC,EACpC,SAAiB;IAEjB,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,yBAAyB,CAAC,UAAU;YACpC,yBAAyB,CAAC,cAAc;YACxC,yBAAyB,CAAC,QAAQ;SACnC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,UAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,0BAA0B,CAAC,aAAa;YACxC,0BAA0B,CAAC,WAAW;SACvC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,KAAK,UAAU,4BAA4B,CAAC,OAAgB;IAC1D,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,UAA4B,EAC5B,cAAsB,EACtB,QAAgB;IAEhB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE;QACpD,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,aAAmC,EACnC,WAAmB;IAEnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE;QACrD,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAAqC,EACrC,IAAuC;IAEvC,IACE,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC/C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  AccessManifestCheckpoint,\n  AccessObjectKind,\n  ManagedPrincipalKind,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  accessManifestCheckpoints,\n  keyingCheckpointTables,\n  principalPolicyCheckpoints,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport { recordPrincipalPolicyOrganizationInTransaction } from \"./principalPolicyOrganizationPersistence\";\n\ntype CheckpointHandle = ClientSQLiteDatabase | ClientSQLiteTransactionScope;\n\ntype AccessManifestCheckpointIdentity = Pick<\n  AccessManifestCheckpoint,\n  \"objectKind\" | \"organizationId\" | \"objectId\"\n>;\n\ntype PrincipalPolicyCheckpointIdentity = Pick<\n  PrincipalPolicyCheckpoint,\n  \"principalType\" | \"principalId\"\n>;\n\n/** One key format per checkpoint identity, shared by every batch validator. */\nexport function accessManifestObjectKey(\n  identity: AccessManifestCheckpointIdentity,\n): string {\n  return JSON.stringify([\n    identity.objectKind,\n    identity.organizationId,\n    identity.objectId,\n  ]);\n}\n\nexport function principalPolicyKey(\n  identity: PrincipalPolicyCheckpointIdentity,\n): string {\n  return JSON.stringify([identity.principalType, identity.principalId]);\n}\n\nasync function loadAccessManifestCheckpointRow(\n  handle: CheckpointHandle,\n  identity: AccessManifestCheckpointIdentity,\n): Promise<Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\"> | null> {\n  const rows = await handle\n    .select({\n      epoch: accessManifestCheckpoints.epoch,\n      manifestHash: accessManifestCheckpoints.manifestHash,\n    })\n    .from(accessManifestCheckpoints)\n    .where(\n      and(\n        eq(accessManifestCheckpoints.objectKind, identity.objectKind),\n        eq(accessManifestCheckpoints.organizationId, identity.organizationId),\n        eq(accessManifestCheckpoints.objectId, identity.objectId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\nasync function loadPrincipalPolicyCheckpointRow(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<Pick<PrincipalPolicyCheckpoint, \"version\" | \"stateHash\"> | null> {\n  const rows = await handle\n    .select({\n      version: principalPolicyCheckpoints.version,\n      stateHash: principalPolicyCheckpoints.stateHash,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, identity.principalType),\n        eq(principalPolicyCheckpoints.principalId, identity.principalId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\n/**\n * A loaded checkpoint row merged back with the identity it was looked up by —\n * the full checkpoint shape every comparison consumes.\n */\nexport async function loadStoredAccessManifestCheckpoint(\n  handle: CheckpointHandle,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<AccessManifestCheckpoint | null> {\n  const row = await loadAccessManifestCheckpointRow(handle, checkpoint);\n  return row ? { ...checkpoint, ...row } : null;\n}\n\nexport async function loadStoredPrincipalPolicyCheckpoint(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  const row = await loadPrincipalPolicyCheckpointRow(handle, identity);\n  return row\n    ? {\n        principalType: identity.principalType,\n        principalId: identity.principalId,\n        ...row,\n      }\n    : null;\n}\n\nexport async function upsertAccessManifestCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(accessManifestCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        accessManifestCheckpoints.objectKind,\n        accessManifestCheckpoints.organizationId,\n        accessManifestCheckpoints.objectId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\nexport async function upsertPrincipalPolicyCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: PrincipalPolicyCheckpoint,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: checkpoint.principalId,\n    principalType: checkpoint.principalType,\n  });\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(principalPolicyCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        principalPolicyCheckpoints.principalType,\n        principalPolicyCheckpoints.principalId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\n// Lazily create the checkpoint tables on first access. Every load/save below\n// calls this, so the tables exist on demand; it is intentionally module-private\n// (no caller outside this file needs it, and exporting it tripped knip).\nasync function ensureKeyingCheckpointTables(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n}\n\nexport async function loadAccessManifestCheckpoint(\n  execSql: ExecSql,\n  objectKind: AccessObjectKind,\n  organizationId: string,\n  objectId: string,\n): Promise<AccessManifestCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadAccessManifestCheckpointRow(db, {\n    objectKind,\n    organizationId,\n    objectId,\n  });\n\n  return row ? { objectKind, objectId, organizationId, ...row } : null;\n}\n\nexport async function loadPrincipalPolicyCheckpoint(\n  execSql: ExecSql,\n  principalType: ManagedPrincipalKind,\n  principalId: string,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadPrincipalPolicyCheckpointRow(db, {\n    principalType,\n    principalId,\n  });\n\n  return row ? { principalType, principalId, ...row } : null;\n}\n/**\n * The shared shape/ownership guard every checkpoint comparison runs before\n * trusting a durable pin: the pin must belong to the compared principal and\n * carry a well-formed version and hash.\n */\nexport function assertPrincipalPolicyCheckpointShape(\n  checkpoint: PrincipalPolicyCheckpoint,\n  head: PrincipalPolicyCheckpointIdentity,\n): void {\n  if (\n    checkpoint.principalType !== head.principalType ||\n    checkpoint.principalId !== head.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy checkpoint belongs to another principal\",\n    );\n  }\n  if (\n    !Number.isInteger(checkpoint.version) ||\n    checkpoint.version < 1 ||\n    checkpoint.stateHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy checkpoint is malformed\",\n    );\n  }\n}\n"]}