@tearleads/client-sdk 0.1.80 → 0.1.82

package/client/organizations/organizationReadModels.js

@@ -1,6 +1,6 @@
+import { recoverOrganizationAccess } from "../../workflows/container-contents/recovery/accessRestoration.js";
 import { loadLocalOrganizationContainerGrants, loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupMembers, loadLocalOrganizationUserDetail, reconcileOrganizationDirectoryAndGroups, } from "../../workflows/organizations/index.js";
 import { organizationAccessScopeKey, wasOrganizationPresentationAccessDeniedByServer, } from "../../workflows/organizations/readModel/organizationPresentationAccessState.js";
-import { recoverOrganizationAccess } from "./organizationAccessRestoration.js";
 import { loadBoundedOrganizationGroupHistory } from "./organizationGroupHistory.js";
 import { hydrateOrganizationGroupNamesForRuntime } from "./organizationGroupNameHydration.js";
 import { loadBoundedOrganizationHistory } from "./organizationHistory.js";
@@ -145,9 +145,11 @@ class OrganizationReadModelCoordinatorImpl {
                 directoryAndGroups !== undefined;
             if (accessWasRestored)
                 await recoverOrganizationAccess({
-                    active,
                     domainScope,
+                    execSql: active.runtime.infra.execSql,
+                    organizationId: active.organizationId,
                     stillCurrent,
+                    userId: active.userId,
                 });
             if (!stillCurrent())
                 return null;

package/client/organizations/organizationReadModels.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,6EAA6E,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupMembers,\n  loadLocalOrganizationUserDetail,\n  type OrganizationContainerGrants,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationGroupContainers,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationPolicyHistory,\n  type OrganizationUserDetail,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n  organizationAccessScopeKey,\n  wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/readModel/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null>;\n  loadLocalGroupMembers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupMembers | null>;\n  loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationGroupPolicyHistory | null>;\n  loadOrganizationPolicyHistory(\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationPolicyHistory | null>;\n  loadLocalGrants(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationContainerGrants | null>;\n  loadLocalGroupContainers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupContainers | null>;\n  loadLocalUserDetail(\n    userId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationUserDetail | null>;\n  /**\n   * Resolves `undefined` when the runtime declines without I/O (offline,\n   * database not ready, organization mismatch) or when the feed failed with\n   * no locally retained projection — passes that must not count as caught\n   * up; `null` when the reconcile completed but produced nothing presentable\n   * — including an authoritative denial that purged the projection, which\n   * consumers must repaint.\n   */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n  reconcileAfterMutation(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n  implements OrganizationReadModelCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDirectoryAndGroups | null | undefined>>\n  >();\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationDirectoryAndGroups({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGrants(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationContainerGrants({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupContainers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupMembers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationGroupHistory({\n      active,\n      groupId,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadOrganizationPolicyHistory(\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) return null;\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationHistory({\n      active,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadLocalUserDetail(userId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || userId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationUserDetail({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      userId,\n    });\n  }\n\n  reconcile(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return Promise.resolve(undefined);\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    // Snapshot the server-denied flag before reconciling. A reconcile that\n    // flips it back to readable means org access was just restored (e.g. the\n    // user was re-added to a group), and any write lanes idled by\n    // permission-denied submissions have no self re-arm — regaining access is\n    // their retry signal, mirroring how billing recovery re-requests all\n    // lanes. Only a genuine server denial counts: a local session reset also\n    // marks scopes denied, and re-arming on its first reconcile would race the\n    // startup sync passes (e.g. pending-create adoption between panes).\n    const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n      {\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      },\n      \"readModel\",\n    );\n    const domainScope = active.runtime.state.domainScope;\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(\n        this.runtimeService,\n        active,\n        domainScope,\n      );\n\n    const reconciliation = reconcileOrganizationDirectoryAndGroups({\n      apiClient: active.runtime.apiClient,\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n    })\n      .then(async (directoryAndGroups) => {\n        if (!stillCurrent()) return null;\n        // Feed success restores retry eligibility even if name decryption fails.\n        const accessWasRestored =\n          accessWasDenied &&\n          directoryAndGroups !== null &&\n          directoryAndGroups !== undefined;\n        if (accessWasRestored)\n          await recoverOrganizationAccess({\n            active,\n            domainScope,\n            stillCurrent,\n          });\n        if (!stillCurrent()) return null;\n        return hydrateOrganizationGroupNamesForRuntime(\n          this.runtimeService,\n          active,\n          domainScope,\n          directoryAndGroups,\n        );\n      })\n      .finally(() => {\n        if (byKey.get(key) === reconciliation) {\n          byKey.delete(key);\n        }\n      });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n\n  async reconcileAfterMutation(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return undefined;\n    }\n    const existing = this.reconciliationMap(active).get(\n      organizationAccessScopeKey(active.organizationId, active.userId),\n    );\n    if (existing) {\n      await existing.catch(() => null);\n    }\n    return this.reconcile(active.organizationId);\n  }\n}\n\nexport function createOrganizationReadModelCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}
+{"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC1G,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,6EAA6E,CAAC;AAErF,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,WAAW;oBACX,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,YAAY;oBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { recoverOrganizationAccess } from \"../../workflows/container-contents/recovery/accessRestoration\";\nimport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupMembers,\n  loadLocalOrganizationUserDetail,\n  type OrganizationContainerGrants,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationGroupContainers,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationPolicyHistory,\n  type OrganizationUserDetail,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n  organizationAccessScopeKey,\n  wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/readModel/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null>;\n  loadLocalGroupMembers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupMembers | null>;\n  loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationGroupPolicyHistory | null>;\n  loadOrganizationPolicyHistory(\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationPolicyHistory | null>;\n  loadLocalGrants(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationContainerGrants | null>;\n  loadLocalGroupContainers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupContainers | null>;\n  loadLocalUserDetail(\n    userId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationUserDetail | null>;\n  /**\n   * Resolves `undefined` when the runtime declines without I/O (offline,\n   * database not ready, organization mismatch) or when the feed failed with\n   * no locally retained projection — passes that must not count as caught\n   * up; `null` when the reconcile completed but produced nothing presentable\n   * — including an authoritative denial that purged the projection, which\n   * consumers must repaint.\n   */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n  reconcileAfterMutation(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n  implements OrganizationReadModelCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDirectoryAndGroups | null | undefined>>\n  >();\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationDirectoryAndGroups({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGrants(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationContainerGrants({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupContainers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupMembers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationGroupHistory({\n      active,\n      groupId,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadOrganizationPolicyHistory(\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) return null;\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationHistory({\n      active,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadLocalUserDetail(userId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || userId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationUserDetail({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      userId,\n    });\n  }\n\n  reconcile(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return Promise.resolve(undefined);\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    // Snapshot the server-denied flag before reconciling. A reconcile that\n    // flips it back to readable means org access was just restored (e.g. the\n    // user was re-added to a group), and any write lanes idled by\n    // permission-denied submissions have no self re-arm — regaining access is\n    // their retry signal, mirroring how billing recovery re-requests all\n    // lanes. Only a genuine server denial counts: a local session reset also\n    // marks scopes denied, and re-arming on its first reconcile would race the\n    // startup sync passes (e.g. pending-create adoption between panes).\n    const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n      {\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      },\n      \"readModel\",\n    );\n    const domainScope = active.runtime.state.domainScope;\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(\n        this.runtimeService,\n        active,\n        domainScope,\n      );\n\n    const reconciliation = reconcileOrganizationDirectoryAndGroups({\n      apiClient: active.runtime.apiClient,\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n    })\n      .then(async (directoryAndGroups) => {\n        if (!stillCurrent()) return null;\n        // Feed success restores retry eligibility even if name decryption fails.\n        const accessWasRestored =\n          accessWasDenied &&\n          directoryAndGroups !== null &&\n          directoryAndGroups !== undefined;\n        if (accessWasRestored)\n          await recoverOrganizationAccess({\n            domainScope,\n            execSql: active.runtime.infra.execSql,\n            organizationId: active.organizationId,\n            stillCurrent,\n            userId: active.userId,\n          });\n        if (!stillCurrent()) return null;\n        return hydrateOrganizationGroupNamesForRuntime(\n          this.runtimeService,\n          active,\n          domainScope,\n          directoryAndGroups,\n        );\n      })\n      .finally(() => {\n        if (byKey.get(key) === reconciliation) {\n          byKey.delete(key);\n        }\n      });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n\n  async reconcileAfterMutation(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return undefined;\n    }\n    const existing = this.reconciliationMap(active).get(\n      organizationAccessScopeKey(active.organizationId, active.userId),\n    );\n    if (existing) {\n      await existing.catch(() => null);\n    }\n    return this.reconcile(active.organizationId);\n  }\n}\n\nexport function createOrganizationReadModelCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}

package/data/keyingProjectionVerification/index.d.ts

@@ -10,4 +10,5 @@ export { collectContainerWriterProjectionPrincipalPolicies, verifyContainerWrite
 export { type DocumentWriterProjectionAuthorization, verifyDocumentWriterProjection, verifyDocumentWriterProjectionAuthorization, } from "./document/documentProjectionVerification.js";
 export { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, } from "./documentPurge/documentPurgeProofVerification.js";
 export { mergeProjectionPolicyEvidence } from "./principalPolicy/mergeProjectionPolicyEvidence.js";
+export { principalPolicyHeadMeetsCheckpoint } from "./principalPolicy/principalPolicyCheckpointSelection.js";
 export { isPrincipalPolicyNotCachedError } from "./principalPolicy/principalPolicyVerification.js";

package/data/keyingProjectionVerification/index.js

@@ -16,5 +16,6 @@ export { collectContainerWriterProjectionPrincipalPolicies, verifyContainerWrite
 export { verifyDocumentWriterProjection, verifyDocumentWriterProjectionAuthorization, } from "./document/documentProjectionVerification.js";
 export { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, } from "./documentPurge/documentPurgeProofVerification.js";
 export { mergeProjectionPolicyEvidence } from "./principalPolicy/mergeProjectionPolicyEvidence.js";
+export { principalPolicyHeadMeetsCheckpoint } from "./principalPolicy/principalPolicyCheckpointSelection.js";
 export { isPrincipalPolicyNotCachedError } from "./principalPolicy/principalPolicyVerification.js";
 //# sourceMappingURL=index.js.map

package/data/keyingProjectionVerification/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AAG5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAOnB,OAAO,EACL,sCAAsC,EACtC,wCAAwC,GACzC,MAAM,SAAS,CAAC;AAEjB,MAAM,UAAU,gCAAgC,CAC9C,wBAAsE,EACtE,KAAa;IAEb,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IACnE,CAAC;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,kCAAkC,CAAC,wBAAwB,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8CAA8C,CAAC;AACpG,OAAO,EACL,iDAAiD,EACjD,+BAA+B,GAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAEL,8BAA8B,EAC9B,2CAA2C,GAC5C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC","sourcesContent":["import { requireTrustedUserIdentityResolver } from \"../trustedUserIdentity\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nexport { resolveEventContainerPaths } from \"./document/documentDependencyPaths\";\nexport {\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n} from \"./readers\";\n\nexport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nexport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n} from \"./types\";\n\nexport function requireProjectionUserKeyResolver(\n  resolveProjectionUserKey: ProjectionUserKeyResolver | null | undefined,\n  label: string,\n): ProjectionUserKeyResolver {\n  if (!resolveProjectionUserKey) {\n    throw new Error(`${label} requires projection key verification`);\n  }\n\n  // A ProjectionUserKey is a TrustedUserIdentity, so the shared adapter\n  // provides the untrusted-shape and wrong-user guards (with identity caching).\n  return requireTrustedUserIdentityResolver(resolveProjectionUserKey);\n}\n\nexport { verifiedContainerCreateManifest } from \"./container/containerCreateManifest\";\nexport { verifyContainerDestinationProjection } from \"./container/containerDestinationVerification\";\nexport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  verifyContainerWriterProjection,\n} from \"./container/containerProjectionVerification\";\nexport {\n  type DocumentWriterProjectionAuthorization,\n  verifyDocumentWriterProjection,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"./document/documentProjectionVerification\";\nexport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n} from \"./documentPurge/documentPurgeProofVerification\";\nexport { mergeProjectionPolicyEvidence } from \"./principalPolicy/mergeProjectionPolicyEvidence\";\nexport { isPrincipalPolicyNotCachedError } from \"./principalPolicy/principalPolicyVerification\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AAG5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAOnB,OAAO,EACL,sCAAsC,EACtC,wCAAwC,GACzC,MAAM,SAAS,CAAC;AAEjB,MAAM,UAAU,gCAAgC,CAC9C,wBAAsE,EACtE,KAAa;IAEb,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IACnE,CAAC;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,kCAAkC,CAAC,wBAAwB,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8CAA8C,CAAC;AACpG,OAAO,EACL,iDAAiD,EACjD,+BAA+B,GAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAEL,8BAA8B,EAC9B,2CAA2C,GAC5C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC","sourcesContent":["import { requireTrustedUserIdentityResolver } from \"../trustedUserIdentity\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nexport { resolveEventContainerPaths } from \"./document/documentDependencyPaths\";\nexport {\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n} from \"./readers\";\n\nexport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./types\";\nexport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n} from \"./types\";\n\nexport function requireProjectionUserKeyResolver(\n  resolveProjectionUserKey: ProjectionUserKeyResolver | null | undefined,\n  label: string,\n): ProjectionUserKeyResolver {\n  if (!resolveProjectionUserKey) {\n    throw new Error(`${label} requires projection key verification`);\n  }\n\n  // A ProjectionUserKey is a TrustedUserIdentity, so the shared adapter\n  // provides the untrusted-shape and wrong-user guards (with identity caching).\n  return requireTrustedUserIdentityResolver(resolveProjectionUserKey);\n}\n\nexport { verifiedContainerCreateManifest } from \"./container/containerCreateManifest\";\nexport { verifyContainerDestinationProjection } from \"./container/containerDestinationVerification\";\nexport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  verifyContainerWriterProjection,\n} from \"./container/containerProjectionVerification\";\nexport {\n  type DocumentWriterProjectionAuthorization,\n  verifyDocumentWriterProjection,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"./document/documentProjectionVerification\";\nexport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n} from \"./documentPurge/documentPurgeProofVerification\";\nexport { mergeProjectionPolicyEvidence } from \"./principalPolicy/mergeProjectionPolicyEvidence\";\nexport { principalPolicyHeadMeetsCheckpoint } from \"./principalPolicy/principalPolicyCheckpointSelection\";\nexport { isPrincipalPolicyNotCachedError } from \"./principalPolicy/principalPolicyVerification\";\n"]}

package/data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js

@@ -1,9 +1,9 @@
 import { KeyingVerificationError } from "../../../internal/crypto/index.js";
 import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
-import { verifiedPrincipalPolicyMeetsCheckpoint } from "../../persistence/principalPolicy/principalPolicyCheckpointSelection.js";
 import { loadPrincipalPolicyBundleForReference } from "../../persistence/principalPolicy/principalPolicyReferencePersistence.js";
 import { principalPolicyEvidenceEntries, } from "../../principals/principalPolicyEvidence.js";
 import { principalStateMatchesReference } from "../../principals/principalPolicyStates.js";
+import { verifiedPrincipalPolicyMeetsCheckpoint } from "./principalPolicyCheckpointSelection.js";
 /**
  * Cache key for a referenced principal policy. The in-memory principal-policy
  * cache is populated and read from several call sites; they must agree on this

package/data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyCache.js","sourceRoot":"","sources":["principalPolicyCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,sCAAsC,EAAE,MAAM,sEAAsE,CAAC;AAC9H,OAAO,EAAE,qCAAqC,EAAE,MAAM,uEAAuE,CAAC;AAC9H,OAAO,EAEL,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAGxF;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAkC;IAElC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,OAAO;QACjB,SAAS,CAAC,SAAS;QACnB,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,cAAc;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAE7C,UAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,iBAAiB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CACvB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CACP,4BAA4B,CAAC;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,EACF,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAAsC,EACtC,SAAkC;IAElC,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CACrB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,8BAA8B,CAAC,KAAK,EAAE,SAAS,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CACjD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,SAAS,CAAC,EAClE,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,SAAS,EAAwC,EAAE,CAAC,SAAS,KAAK,IAAI,CACxE,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"../../persistence/principalPolicy/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicy/principalPolicyReferencePersistence\";\nimport {\n  type PrincipalPolicyCurrentEvidence,\n  principalPolicyEvidenceEntries,\n} from \"../../principals/principalPolicyEvidence\";\nimport { principalStateMatchesReference } from \"../../principals/principalPolicyStates\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\n\n/**\n * Cache key for a referenced principal policy. The in-memory principal-policy\n * cache is populated and read from several call sites; they must agree on this\n * format byte-for-byte or a populated entry looks uncached (extra warm fetches)\n * — so this is the single source of truth, imported rather than re-declared.\n */\nexport function referencedPrincipalPolicyKey(\n  reference: ReferencedPrincipalHead,\n): string {\n  return JSON.stringify([\n    reference.principalType,\n    reference.principalId,\n    reference.version,\n    reference.stateHash,\n    reference.keyEpoch,\n    reference.keyFingerprint,\n  ]);\n}\n\n/**\n * Dedupes references by their exact head identity, keyed with\n * {@link referencedPrincipalPolicyKey} so every consumer agrees on what\n * \"the same reference\" means. Later duplicates win, preserving each\n * caller's original last-wins behavior.\n */\nexport function dedupeReferencedPrincipalStates<\n  TReference extends ReferencedPrincipalHead,\n>(references: ReadonlyArray<TReference>): TReference[] {\n  const referencesByState = new Map<string, TReference>();\n  for (const reference of references) {\n    referencesByState.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n  return Array.from(referencesByState.values());\n}\n\nexport function principalPolicyCacheForVerifiedPolicies(\n  policies: readonly PrincipalPolicyCurrentEvidence[],\n): Map<string, PrincipalPolicyCurrentEvidence> {\n  const cache = new Map<string, PrincipalPolicyCurrentEvidence>();\n  for (const policy of policies) {\n    const states = principalPolicyEvidenceEntries(policy).map(\n      (entry) => entry.state,\n    );\n    for (const state of states) {\n      cache.set(\n        referencedPrincipalPolicyKey({\n          principalType: state.principalType,\n          principalId: state.principalId,\n          version: state.version,\n          keyEpoch: state.keyEpoch,\n          stateHash: state.stateHash,\n          keyFingerprint: state.keyFingerprint,\n        }),\n        policy,\n      );\n    }\n  }\n  return cache;\n}\n\nexport function verifiedPrincipalPolicyContainsReference(\n  policy: PrincipalPolicyCurrentEvidence,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const states = principalPolicyEvidenceEntries(policy).map(\n    ({ state }) => state,\n  );\n  return states.some((state) =>\n    principalStateMatchesReference(state, reference),\n  );\n}\n\n// Identify which referenced policies are absent from both the in-memory cache\n// and local storage, so the warmer fetches only what is genuinely missing.\nexport async function filterUncachedPrincipalPolicyReferences(input: {\n  execSql: ExecSql;\n  principalPolicyCache: ReadonlyMap<string, PrincipalPolicyCurrentEvidence>;\n  references: readonly ReferencedPrincipalHead[];\n}): Promise<ReferencedPrincipalHead[]> {\n  const results = await Promise.all(\n    input.references.map(async (reference) => {\n      const checkpoint = await loadPrincipalPolicyCheckpoint(\n        input.execSql,\n        reference.principalType,\n        reference.principalId,\n      );\n      const cachedPolicy = input.principalPolicyCache.get(\n        referencedPrincipalPolicyKey(reference),\n      );\n      if (cachedPolicy) {\n        if (\n          !verifiedPrincipalPolicyContainsReference(cachedPolicy, reference)\n        ) {\n          throw new KeyingVerificationError(\n            \"hash_mismatch\",\n            \"in-memory principal policy cache does not match its exact reference\",\n          );\n        }\n        if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, checkpoint)) {\n          return null;\n        }\n      }\n      const bundle = await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      );\n      return bundle ? null : reference;\n    }),\n  );\n  return results.filter(\n    (reference): reference is ReferencedPrincipalHead => reference !== null,\n  );\n}\n"]}
+{"version":3,"file":"principalPolicyCache.js","sourceRoot":"","sources":["principalPolicyCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,qCAAqC,EAAE,MAAM,uEAAuE,CAAC;AAC9H,OAAO,EAEL,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAExF,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAkC;IAElC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,OAAO;QACjB,SAAS,CAAC,SAAS;QACnB,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,cAAc;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAE7C,UAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,iBAAiB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CACvB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CACP,4BAA4B,CAAC;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,EACF,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAAsC,EACtC,SAAkC;IAElC,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CACvD,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CACrB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,8BAA8B,CAAC,KAAK,EAAE,SAAS,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CACjD,4BAA4B,CAAC,SAAS,CAAC,CACxC,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,SAAS,CAAC,EAClE,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,SAAS,EAAwC,EAAE,CAAC,SAAS,KAAK,IAAI,CACxE,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicy/principalPolicyReferencePersistence\";\nimport {\n  type PrincipalPolicyCurrentEvidence,\n  principalPolicyEvidenceEntries,\n} from \"../../principals/principalPolicyEvidence\";\nimport { principalStateMatchesReference } from \"../../principals/principalPolicyStates\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"./principalPolicyCheckpointSelection\";\n\n/**\n * Cache key for a referenced principal policy. The in-memory principal-policy\n * cache is populated and read from several call sites; they must agree on this\n * format byte-for-byte or a populated entry looks uncached (extra warm fetches)\n * — so this is the single source of truth, imported rather than re-declared.\n */\nexport function referencedPrincipalPolicyKey(\n  reference: ReferencedPrincipalHead,\n): string {\n  return JSON.stringify([\n    reference.principalType,\n    reference.principalId,\n    reference.version,\n    reference.stateHash,\n    reference.keyEpoch,\n    reference.keyFingerprint,\n  ]);\n}\n\n/**\n * Dedupes references by their exact head identity, keyed with\n * {@link referencedPrincipalPolicyKey} so every consumer agrees on what\n * \"the same reference\" means. Later duplicates win, preserving each\n * caller's original last-wins behavior.\n */\nexport function dedupeReferencedPrincipalStates<\n  TReference extends ReferencedPrincipalHead,\n>(references: ReadonlyArray<TReference>): TReference[] {\n  const referencesByState = new Map<string, TReference>();\n  for (const reference of references) {\n    referencesByState.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n  return Array.from(referencesByState.values());\n}\n\nexport function principalPolicyCacheForVerifiedPolicies(\n  policies: readonly PrincipalPolicyCurrentEvidence[],\n): Map<string, PrincipalPolicyCurrentEvidence> {\n  const cache = new Map<string, PrincipalPolicyCurrentEvidence>();\n  for (const policy of policies) {\n    const states = principalPolicyEvidenceEntries(policy).map(\n      (entry) => entry.state,\n    );\n    for (const state of states) {\n      cache.set(\n        referencedPrincipalPolicyKey({\n          principalType: state.principalType,\n          principalId: state.principalId,\n          version: state.version,\n          keyEpoch: state.keyEpoch,\n          stateHash: state.stateHash,\n          keyFingerprint: state.keyFingerprint,\n        }),\n        policy,\n      );\n    }\n  }\n  return cache;\n}\n\nexport function verifiedPrincipalPolicyContainsReference(\n  policy: PrincipalPolicyCurrentEvidence,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const states = principalPolicyEvidenceEntries(policy).map(\n    ({ state }) => state,\n  );\n  return states.some((state) =>\n    principalStateMatchesReference(state, reference),\n  );\n}\n\n// Identify which referenced policies are absent from both the in-memory cache\n// and local storage, so the warmer fetches only what is genuinely missing.\nexport async function filterUncachedPrincipalPolicyReferences(input: {\n  execSql: ExecSql;\n  principalPolicyCache: ReadonlyMap<string, PrincipalPolicyCurrentEvidence>;\n  references: readonly ReferencedPrincipalHead[];\n}): Promise<ReferencedPrincipalHead[]> {\n  const results = await Promise.all(\n    input.references.map(async (reference) => {\n      const checkpoint = await loadPrincipalPolicyCheckpoint(\n        input.execSql,\n        reference.principalType,\n        reference.principalId,\n      );\n      const cachedPolicy = input.principalPolicyCache.get(\n        referencedPrincipalPolicyKey(reference),\n      );\n      if (cachedPolicy) {\n        if (\n          !verifiedPrincipalPolicyContainsReference(cachedPolicy, reference)\n        ) {\n          throw new KeyingVerificationError(\n            \"hash_mismatch\",\n            \"in-memory principal policy cache does not match its exact reference\",\n          );\n        }\n        if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, checkpoint)) {\n          return null;\n        }\n      }\n      const bundle = await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      );\n      return bundle ? null : reference;\n    }),\n  );\n  return results.filter(\n    (reference): reference is ReferencedPrincipalHead => reference !== null,\n  );\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/principalPolicyCheckpointSelection.d.ts

@@ -0,0 +1,6 @@
+import type { PrincipalPolicyAuthorization, PrincipalPolicyCheckpoint } from "../../../internal/crypto/index.js";
+export declare function principalPolicyHeadMeetsCheckpoint(head: {
+    readonly stateHash: string;
+    readonly version: number;
+}, checkpoint: PrincipalPolicyCheckpoint | null): boolean;
+export declare function verifiedPrincipalPolicyMeetsCheckpoint(policy: PrincipalPolicyAuthorization, checkpoint: PrincipalPolicyCheckpoint | null): boolean;

package/data/{persistence → keyingProjectionVerification}/principalPolicy/principalPolicyCheckpointSelection.js

@@ -1,5 +1,5 @@
 import { verifyPrincipalPolicyCheckpoint } from "../../../internal/crypto/index.js";
-import { assertPrincipalPolicyCheckpointShape } from "../keyingCheckpoints/keyingCheckpointPersistence.js";
+import { assertPrincipalPolicyCheckpointShape } from "../../persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
 export function principalPolicyHeadMeetsCheckpoint(head, checkpoint) {
     return (!checkpoint ||
         head.version > checkpoint.version ||

package/data/keyingProjectionVerification/principalPolicy/principalPolicyCheckpointSelection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCheckpointSelection.js","sourceRoot":"","sources":["principalPolicyCheckpointSelection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,iEAAiE,CAAC;AAEvH,MAAM,UAAU,kCAAkC,CAChD,IAA8D,EAC9D,UAA4C;IAE5C,OAAO,CACL,CAAC,UAAU;QACX,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;QACjC,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;YAClC,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAoC,EACpC,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+BAA+B,CAAC;QAC9B,KAAK,EACH,iBAAiB,IAAI,MAAM;YACzB,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type {\n  PrincipalPolicyAuthorization,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { verifyPrincipalPolicyCheckpoint } from \"@tearleads/crypto\";\nimport { assertPrincipalPolicyCheckpointShape } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\n\nexport function principalPolicyHeadMeetsCheckpoint(\n  head: { readonly stateHash: string; readonly version: number },\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n  return (\n    !checkpoint ||\n    head.version > checkpoint.version ||\n    (head.version === checkpoint.version &&\n      head.stateHash === checkpoint.stateHash)\n  );\n}\n\nexport function verifiedPrincipalPolicyMeetsCheckpoint(\n  policy: PrincipalPolicyAuthorization,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): boolean {\n  if (!checkpoint) {\n    return true;\n  }\n  assertPrincipalPolicyCheckpointShape(checkpoint, policy);\n  if (policy.version < checkpoint.version) {\n    return false;\n  }\n  verifyPrincipalPolicyCheckpoint({\n    chain:\n      \"retainedHistory\" in policy\n        ? policy.retainedHistory\n        : (policy.history ?? []),\n    currentState: policy.state,\n    localCheckpoint: checkpoint,\n  });\n  return true;\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/principalPolicyVerification.js

@@ -1,6 +1,5 @@
 import { KeyingVerificationError, toFingerprint, verifyPrincipalPolicyBundle, } from "../../../internal/crypto/index.js";
 import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
-import { principalPolicyHeadMeetsCheckpoint, verifiedPrincipalPolicyMeetsCheckpoint, } from "../../persistence/principalPolicy/principalPolicyCheckpointSelection.js";
 import { loadPrincipalPolicyBundle } from "../../persistence/principalPolicy/principalPolicyPersistence.js";
 import { loadPrincipalPolicyBundleForReference } from "../../persistence/principalPolicy/principalPolicyReferencePersistence.js";
 import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../principals/organizationAuthorityDescriptor.js";
@@ -11,6 +10,7 @@ import { ProjectionDependencyUnavailableError } from "../dependencyUnavailable.j
 import { rethrowProjectionVerificationBoundaryError } from "../error.js";
 import { assertProjectionVerificationCurrent, generationGuardedPrincipalPolicyWarmer, } from "../types.js";
 import { filterUncachedPrincipalPolicyReferences, referencedPrincipalPolicyKey, verifiedPrincipalPolicyContainsReference, } from "./principalPolicyCache.js";
+import { principalPolicyHeadMeetsCheckpoint, verifiedPrincipalPolicyMeetsCheckpoint, } from "./principalPolicyCheckpointSelection.js";
 import { resolveReferencedPrincipalPolicy } from "./resolvedPrincipalPolicy.js";
 function principalPolicyReferenceLabel(reference) {
     return `${reference.principalType}:${reference.principalId}@${reference.version}`;

package/data/keyingProjectionVerification/principalPolicy/principalPolicyVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyVerification.js","sourceRoot":"","sources":["principalPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,aAAa,EAEb,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EACL,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AACzG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uEAAuE,CAAC;AAC9H,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,6BAA6B,EAC7B,yDAAyD,GAC1D,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,UAAU,CAAC;AAMtE,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,uCAAuC,EACvC,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE7E,SAAS,6BAA6B,CACpC,SAAkC;IAElC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,cAAsB;QAChC,KAAK,CAAC,oBAAoB,cAAc,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,CACL,KAAK,YAAY,6BAA6B;QAC9C,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAIrD;IACC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC3E,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,oCAAoC,CAC5C,GAAG,KAAK,CAAC,KAAK,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,aAAa,CAC/C,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,IAAI,qBAAqB,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,kCAAkC,CACjD,CAAC;QACJ,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,qBAAqB;YACrB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,KAAmC;IAUnC,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,IAAI,MAAM,GAAG,MAAM,yBAAyB,CAC1C,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,GAAG,MAAM,6BAA6B,CACvD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IACE,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;QACzE,KAAK,CAAC,+BAA+B,EACrC,CAAC;QACD,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,yBAAyB,CACtC,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,eAAe,GAAG,MAAM,6BAA6B,CACnD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,+BAA+B,CACtC,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,WAAW,CAAC,EAC/C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,iBAAiB,KAAK,CAAC,YAAY,EAAE;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,WAAW;QACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe,EAAE,eAAe;QAChC,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,+BAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAmC;IAEnC,MAAM,kBAAkB,GAAG,MAAM,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;YACpE,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,KAAK,EAAE,uBAAuB,KAAK,CAAC,cAAc,EAAE;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,eAAe,EAAE,kBAAkB,CAAC,eAAe;YACnD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,MAAM,UAAU,GAAG,oCAAoC,CACrD,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CACpD,CAAC;QACF,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC;YAC1D,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;YACD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,kCAAkC,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0CAA0C,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,OAAO,EACP,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,KAAK,CAAC,SAAS,CAAC,WAAW,CAC5B,CAAC;IACF,IAAI,YAAY,IAAI,CAAC,CAAC,iBAAiB,IAAI,YAAY,CAAC,EAAE,CAAC;QACzD,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1E,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,YAAY,EACZ,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,MAAM,GAAG,MAAM,qCAAqC,CACtD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC;QACrD,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,qCAAqC,CAClD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,KAAK,EAAE,oBAAoB,cAAc,EAAE;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,qBAAqB,EAAE,GAAG,EAAE,CAC1B,iCAAiC,CAAC;YAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;SACxC,CAAC;QACJ,eAAe;QACf,gBAAgB;KACjB,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,2EAA2E;IAC3E,yEAAyE;IACzE,0CAA0C;IAC1C,IACE,+BAA+B;QAC/B,CAAC,+BAA+B,CAAC,gBAAgB,EACjD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAAC;YAC7D,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,+BAA+B,CAAC;gBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,+BAA+B,CAAC;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS;QACT,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B;KAChC,CAAC,CACH,CACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  toFingerprint,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport {\n  principalPolicyHeadMeetsCheckpoint,\n  verifiedPrincipalPolicyMeetsCheckpoint,\n} from \"../../persistence/principalPolicy/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundle } from \"../../persistence/principalPolicy/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicy/principalPolicyReferencePersistence\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../principals/principalPolicyEvidence\";\nimport { principalPolicyBundleStates } from \"../../principals/principalPolicyStates\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { rethrowProjectionVerificationBoundaryError } from \"../error\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  filterUncachedPrincipalPolicyReferences,\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\nimport { resolveReferencedPrincipalPolicy } from \"./resolvedPrincipalPolicy\";\n\nfunction principalPolicyReferenceLabel(\n  reference: ReferencedPrincipalHead,\n): string {\n  return `${reference.principalType}:${reference.principalId}@${reference.version}`;\n}\n\n/**\n * A referenced principal policy is not in the local store and warming could\n * not fetch it this pass — a transient cold-cache condition, typical for a\n * member whose access arrives via a group policy the device has not hydrated\n * yet. Sync passes discriminate on this type to defer the affected container\n * and retry on a later trigger, rather than failing the whole pass.\n */\nexport class PrincipalPolicyNotCachedError extends Error {\n  constructor(referenceLabel: string) {\n    super(`Principal policy ${referenceLabel} is not cached`);\n    this.name = \"PrincipalPolicyNotCachedError\";\n  }\n}\n\nexport function isPrincipalPolicyNotCachedError(error: unknown): boolean {\n  return (\n    error instanceof PrincipalPolicyNotCachedError ||\n    (error instanceof Error && error.name === \"PrincipalPolicyNotCachedError\")\n  );\n}\n\nasync function collectPrincipalPolicySignerPublicKeys(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  label: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyBundleStates(input.bundle)) {\n    const cacheKey = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const signerKey = await input.resolveUserKey(state.signerUserId);\n    if (!signerKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `${input.label} signer key could not be resolved for ${state.signerUserId}`,\n      );\n    }\n\n    const signingKeyFingerprint = await toFingerprint(\n      signerKey.signingPublicKey,\n    );\n    if (signingKeyFingerprint !== state.signerUserKeyFingerprint) {\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        `${input.label} signer key fingerprint mismatch`,\n      );\n    }\n\n    signerPublicKeysByKey.set(cacheKey, {\n      userId: state.signerUserId,\n      signingKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    });\n  }\n\n  return [...signerPublicKeysByKey.values()];\n}\n\ntype OrganizationAdminPolicyInput = {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n};\n\nasync function loadOrganizationPolicyForVerification(\n  input: OrganizationAdminPolicyInput,\n): Promise<\n  | {\n      bundle: PrincipalPolicyBundleResponse;\n      localCheckpoint: Awaited<\n        ReturnType<typeof loadPrincipalPolicyCheckpoint>\n      >;\n    }\n  | undefined\n> {\n  const execSql = input.checkpointContext.execSql;\n  let bundle = await loadPrincipalPolicyBundle(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (!bundle) {\n    return undefined;\n  }\n  let localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (\n    !principalPolicyHeadMeetsCheckpoint(bundle.currentState, localCheckpoint) &&\n    input.warmReferencedPrincipalPolicies\n  ) {\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [principalPolicyReferenceFromBundle(bundle)],\n    });\n    bundle = await loadPrincipalPolicyBundle(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    localCheckpoint = await loadPrincipalPolicyCheckpoint(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) {\n      return undefined;\n    }\n  }\n\n  return { bundle, localCheckpoint };\n}\n\nfunction assertReservedAdminsPolicyShape(\n  policy: VerifiedPrincipalPolicy,\n): void {\n  const history = policy.history ?? [{ projection: policy.projection }];\n  if (\n    history.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\nasync function verifyOrganizationAdminsPolicy(input: {\n  adminGroupId: string;\n  execSql: ProjectionCheckpointContext[\"execSql\"];\n  expectedHead: ReferencedPrincipalHead;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<VerifiedPrincipalPolicy | undefined> {\n  const adminBundle = await loadPrincipalPolicyBundle(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!adminBundle) {\n    return undefined;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(adminBundle),\n      input.expectedHead,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Admins policy does not match the signed organization directory\",\n    );\n  }\n  const adminCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: adminBundle,\n    label: `Admins policy ${input.adminGroupId}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: adminBundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint: adminCheckpoint,\n    signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  assertReservedAdminsPolicyShape(verified.value);\n  return verified.value;\n}\n\nasync function loadOrganizationExternalAuthority(\n  input: OrganizationAdminPolicyInput,\n): Promise<ReturnType<typeof organizationAdminExternalAuthority> | null> {\n  const organizationPolicy = await loadOrganizationPolicyForVerification(input);\n  if (!organizationPolicy) {\n    return null;\n  }\n\n  try {\n    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n      bundle: organizationPolicy.bundle,\n      label: `Organization policy ${input.organizationId}`,\n      resolveUserKey: input.resolveUserKey,\n    });\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle: organizationPolicy.bundle,\n      localCheckpoint: organizationPolicy.localCheckpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys,\n    });\n    if (!verified.ok) {\n      throw verified.error;\n    }\n    const descriptor = parseOrganizationAuthorityDescriptor(\n      organizationPolicy.bundle.currentPayload.ciphertext,\n    );\n    if (descriptor.organizationId !== input.organizationId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization authority descriptor scope does not match\",\n      );\n    }\n    const verifiedAdmins = await verifyOrganizationAdminsPolicy({\n      adminGroupId: descriptor.adminGroupId,\n      execSql: input.checkpointContext.execSql,\n      expectedHead: requireOrganizationGroupHead(\n        descriptor,\n        descriptor.adminGroupId,\n      ),\n      resolveUserKey: input.resolveUserKey,\n    });\n    if (!verifiedAdmins) {\n      return null;\n    }\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verified.value,\n      input.organizationId,\n    );\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verifiedAdmins,\n      input.organizationId,\n    );\n    return organizationAdminExternalAuthority(verifiedAdmins);\n  } catch (error) {\n    rethrowProjectionVerificationBoundaryError(error);\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n\nasync function verifyReferencedPrincipalPolicy(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  reference: ReferencedPrincipalHead;\n  stillCurrent?: (() => boolean) | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n  // Scoped recovery carries organization, dependency and lifetime bindings.\n  // A bare policy cache entry cannot replace those bindings.\n  const recovered = await resolveReferencedPrincipalPolicy(input);\n  if (recovered) return recovered;\n  const cacheKey = referencedPrincipalPolicyKey(input.reference);\n  const cachedPolicy = input.principalPolicyCache.get(cacheKey);\n  const execSql = input.checkpointContext.execSql;\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    input.reference.principalType,\n    input.reference.principalId,\n  );\n  if (cachedPolicy && !(\"retainedHistory\" in cachedPolicy)) {\n    if (\n      !verifiedPrincipalPolicyContainsReference(cachedPolicy, input.reference)\n    ) {\n      throw new KeyingVerificationError(\n        \"hash_mismatch\",\n        \"in-memory principal policy cache does not match its exact reference\",\n      );\n    }\n    if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, localCheckpoint)) {\n      observePrincipalPolicy(\n        input.checkpointContext,\n        cachedPolicy,\n        input.organizationId,\n      );\n      return cachedPolicy;\n    }\n  }\n\n  const referenceLabel = principalPolicyReferenceLabel(input.reference);\n  let bundle = await loadPrincipalPolicyBundleForReference(\n    execSql,\n    input.reference,\n    localCheckpoint,\n  );\n  if (!bundle && input.warmReferencedPrincipalPolicies) {\n    // The reference is not cached locally — the common case for a member who\n    // gained access via another org's group grant and never hydrated that\n    // group's policy. Fetch+verify+persist it, then re-read from the cache.\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [input.reference],\n    });\n    bundle = await loadPrincipalPolicyBundleForReference(\n      execSql,\n      input.reference,\n      localCheckpoint,\n    );\n  }\n  if (!bundle) {\n    throw new PrincipalPolicyNotCachedError(referenceLabel);\n  }\n\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    label: `Principal policy ${referenceLabel}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: input.reference,\n      loadExternalAuthority: () =>\n        loadOrganizationExternalAuthority({\n          checkpointContext: input.checkpointContext,\n          organizationId: input.organizationId,\n          resolveUserKey: input.resolveUserKey,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n        }),\n      localCheckpoint,\n      signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n\n  observePrincipalPolicy(\n    input.checkpointContext,\n    verified.value,\n    input.organizationId,\n  );\n  input.principalPolicyCache.set(cacheKey, verified.value);\n  return verified.value;\n}\n\nexport async function collectReferencedPrincipalPolicies(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  references: readonly ReferencedPrincipalHead[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const warmReferencedPrincipalPolicies =\n    generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    );\n  const uniqueReferences = new Map<string, ReferencedPrincipalHead>();\n  for (const reference of input.references) {\n    uniqueReferences.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n\n  const references = [...uniqueReferences.values()];\n  // Warm every missing reference in one batched fetch before verifying, so a\n  // path that references several uncached policies makes a single round of\n  // requests rather than one per reference.\n  if (\n    warmReferencedPrincipalPolicies &&\n    !warmReferencedPrincipalPolicies.resolveReference\n  ) {\n    const uncached = await filterUncachedPrincipalPolicyReferences({\n      execSql: input.checkpointContext.execSql,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n    });\n    if (uncached.length > 0) {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      await warmReferencedPrincipalPolicies({\n        organizationId: input.organizationId,\n        references: uncached,\n      });\n      assertProjectionVerificationCurrent(input.stillCurrent);\n    }\n  }\n\n  // The warmer's operation shares one recovery view across its collections.\n  return Promise.all(\n    references.map((reference) =>\n      verifyReferencedPrincipalPolicy({\n        checkpointContext: input.checkpointContext,\n        organizationId: input.organizationId,\n        principalPolicyCache: input.principalPolicyCache,\n        reference,\n        stillCurrent: input.stillCurrent,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      }),\n    ),\n  );\n}\n"]}
+{"version":3,"file":"principalPolicyVerification.js","sourceRoot":"","sources":["principalPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,aAAa,EAEb,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AACzG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uEAAuE,CAAC;AAC9H,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,6BAA6B,EAC7B,yDAAyD,GAC1D,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,UAAU,CAAC;AAMtE,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,uCAAuC,EACvC,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE7E,SAAS,6BAA6B,CACpC,SAAkC;IAElC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,cAAsB;QAChC,KAAK,CAAC,oBAAoB,cAAc,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,CACL,KAAK,YAAY,6BAA6B;QAC9C,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,KAIrD;IACC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC3E,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,oCAAoC,CAC5C,GAAG,KAAK,CAAC,KAAK,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,aAAa,CAC/C,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,IAAI,qBAAqB,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,CAAC,KAAK,kCAAkC,CACjD,CAAC;QACJ,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,qBAAqB;YACrB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,KAAmC;IAUnC,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,IAAI,MAAM,GAAG,MAAM,yBAAyB,CAC1C,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,GAAG,MAAM,6BAA6B,CACvD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IACE,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;QACzE,KAAK,CAAC,+BAA+B,EACrC,CAAC;QACD,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,yBAAyB,CACtC,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,eAAe,GAAG,MAAM,6BAA6B,CACnD,OAAO,EACP,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,+BAA+B,CACtC,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,IACE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,WAAW,CAAC,EAC/C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,iBAAiB,KAAK,CAAC,YAAY,EAAE;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,WAAW;QACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe,EAAE,eAAe;QAChC,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,+BAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAmC;IAEnC,MAAM,kBAAkB,GAAG,MAAM,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;YACpE,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,KAAK,EAAE,uBAAuB,KAAK,CAAC,cAAc,EAAE;YACpD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,eAAe,EAAE,kBAAkB,CAAC,eAAe;YACnD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,MAAM,UAAU,GAAG,oCAAoC,CACrD,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CACpD,CAAC;QACF,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC;YAC1D,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;YACD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,kCAAkC,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0CAA0C,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,OAAO,EACP,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,KAAK,CAAC,SAAS,CAAC,WAAW,CAC5B,CAAC;IACF,IAAI,YAAY,IAAI,CAAC,CAAC,iBAAiB,IAAI,YAAY,CAAC,EAAE,CAAC;QACzD,IACE,CAAC,wCAAwC,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,sCAAsC,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1E,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,YAAY,EACZ,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,MAAM,GAAG,MAAM,qCAAqC,CACtD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC;QACrD,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,CAAC,+BAA+B,CAAC;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,qCAAqC,CAClD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,KAAK,EAAE,oBAAoB,cAAc,EAAE;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,qBAAqB,EAAE,GAAG,EAAE,CAC1B,iCAAiC,CAAC;YAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;SACxC,CAAC;QACJ,eAAe;QACf,gBAAgB;KACjB,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CAAC,KAAK,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,+BAA+B,GACnC,sCAAsC,CACpC,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,2EAA2E;IAC3E,yEAAyE;IACzE,0CAA0C;IAC1C,IACE,+BAA+B;QAC/B,CAAC,+BAA+B,CAAC,gBAAgB,EACjD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAAC;YAC7D,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;YACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,+BAA+B,CAAC;gBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;YACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,+BAA+B,CAAC;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS;QACT,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B;KAChC,CAAC,CACH,CACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  toFingerprint,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../persistence/principalPolicy/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../persistence/principalPolicy/principalPolicyReferencePersistence\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../principals/principalPolicyEvidence\";\nimport { principalPolicyBundleStates } from \"../../principals/principalPolicyStates\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { ProjectionDependencyUnavailableError } from \"../dependencyUnavailable\";\nimport { rethrowProjectionVerificationBoundaryError } from \"../error\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  assertProjectionVerificationCurrent,\n  generationGuardedPrincipalPolicyWarmer,\n} from \"../types\";\nimport {\n  filterUncachedPrincipalPolicyReferences,\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\nimport {\n  principalPolicyHeadMeetsCheckpoint,\n  verifiedPrincipalPolicyMeetsCheckpoint,\n} from \"./principalPolicyCheckpointSelection\";\nimport { resolveReferencedPrincipalPolicy } from \"./resolvedPrincipalPolicy\";\n\nfunction principalPolicyReferenceLabel(\n  reference: ReferencedPrincipalHead,\n): string {\n  return `${reference.principalType}:${reference.principalId}@${reference.version}`;\n}\n\n/**\n * A referenced principal policy is not in the local store and warming could\n * not fetch it this pass — a transient cold-cache condition, typical for a\n * member whose access arrives via a group policy the device has not hydrated\n * yet. Sync passes discriminate on this type to defer the affected container\n * and retry on a later trigger, rather than failing the whole pass.\n */\nexport class PrincipalPolicyNotCachedError extends Error {\n  constructor(referenceLabel: string) {\n    super(`Principal policy ${referenceLabel} is not cached`);\n    this.name = \"PrincipalPolicyNotCachedError\";\n  }\n}\n\nexport function isPrincipalPolicyNotCachedError(error: unknown): boolean {\n  return (\n    error instanceof PrincipalPolicyNotCachedError ||\n    (error instanceof Error && error.name === \"PrincipalPolicyNotCachedError\")\n  );\n}\n\nasync function collectPrincipalPolicySignerPublicKeys(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  label: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeysByKey = new Map<\n    string,\n    PrincipalPolicySignerPublicKey\n  >();\n\n  for (const state of principalPolicyBundleStates(input.bundle)) {\n    const cacheKey = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;\n    if (signerPublicKeysByKey.has(cacheKey)) {\n      continue;\n    }\n\n    const signerKey = await input.resolveUserKey(state.signerUserId);\n    if (!signerKey) {\n      throw new ProjectionDependencyUnavailableError(\n        `${input.label} signer key could not be resolved for ${state.signerUserId}`,\n      );\n    }\n\n    const signingKeyFingerprint = await toFingerprint(\n      signerKey.signingPublicKey,\n    );\n    if (signingKeyFingerprint !== state.signerUserKeyFingerprint) {\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        `${input.label} signer key fingerprint mismatch`,\n      );\n    }\n\n    signerPublicKeysByKey.set(cacheKey, {\n      userId: state.signerUserId,\n      signingKeyFingerprint,\n      signingPublicKey: signerKey.signingPublicKey,\n    });\n  }\n\n  return [...signerPublicKeysByKey.values()];\n}\n\ntype OrganizationAdminPolicyInput = {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n};\n\nasync function loadOrganizationPolicyForVerification(\n  input: OrganizationAdminPolicyInput,\n): Promise<\n  | {\n      bundle: PrincipalPolicyBundleResponse;\n      localCheckpoint: Awaited<\n        ReturnType<typeof loadPrincipalPolicyCheckpoint>\n      >;\n    }\n  | undefined\n> {\n  const execSql = input.checkpointContext.execSql;\n  let bundle = await loadPrincipalPolicyBundle(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (!bundle) {\n    return undefined;\n  }\n  let localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (\n    !principalPolicyHeadMeetsCheckpoint(bundle.currentState, localCheckpoint) &&\n    input.warmReferencedPrincipalPolicies\n  ) {\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [principalPolicyReferenceFromBundle(bundle)],\n    });\n    bundle = await loadPrincipalPolicyBundle(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    localCheckpoint = await loadPrincipalPolicyCheckpoint(\n      execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) {\n      return undefined;\n    }\n  }\n\n  return { bundle, localCheckpoint };\n}\n\nfunction assertReservedAdminsPolicyShape(\n  policy: VerifiedPrincipalPolicy,\n): void {\n  const history = policy.history ?? [{ projection: policy.projection }];\n  if (\n    history.some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\nasync function verifyOrganizationAdminsPolicy(input: {\n  adminGroupId: string;\n  execSql: ProjectionCheckpointContext[\"execSql\"];\n  expectedHead: ReferencedPrincipalHead;\n  resolveUserKey: ProjectionUserKeyResolver;\n}): Promise<VerifiedPrincipalPolicy | undefined> {\n  const adminBundle = await loadPrincipalPolicyBundle(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!adminBundle) {\n    return undefined;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(adminBundle),\n      input.expectedHead,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"Admins policy does not match the signed organization directory\",\n    );\n  }\n  const adminCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: adminBundle,\n    label: `Admins policy ${input.adminGroupId}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: adminBundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint: adminCheckpoint,\n    signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  assertReservedAdminsPolicyShape(verified.value);\n  return verified.value;\n}\n\nasync function loadOrganizationExternalAuthority(\n  input: OrganizationAdminPolicyInput,\n): Promise<ReturnType<typeof organizationAdminExternalAuthority> | null> {\n  const organizationPolicy = await loadOrganizationPolicyForVerification(input);\n  if (!organizationPolicy) {\n    return null;\n  }\n\n  try {\n    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n      bundle: organizationPolicy.bundle,\n      label: `Organization policy ${input.organizationId}`,\n      resolveUserKey: input.resolveUserKey,\n    });\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle: organizationPolicy.bundle,\n      localCheckpoint: organizationPolicy.localCheckpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys,\n    });\n    if (!verified.ok) {\n      throw verified.error;\n    }\n    const descriptor = parseOrganizationAuthorityDescriptor(\n      organizationPolicy.bundle.currentPayload.ciphertext,\n    );\n    if (descriptor.organizationId !== input.organizationId) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization authority descriptor scope does not match\",\n      );\n    }\n    const verifiedAdmins = await verifyOrganizationAdminsPolicy({\n      adminGroupId: descriptor.adminGroupId,\n      execSql: input.checkpointContext.execSql,\n      expectedHead: requireOrganizationGroupHead(\n        descriptor,\n        descriptor.adminGroupId,\n      ),\n      resolveUserKey: input.resolveUserKey,\n    });\n    if (!verifiedAdmins) {\n      return null;\n    }\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verified.value,\n      input.organizationId,\n    );\n    observePrincipalPolicy(\n      input.checkpointContext,\n      verifiedAdmins,\n      input.organizationId,\n    );\n    return organizationAdminExternalAuthority(verifiedAdmins);\n  } catch (error) {\n    rethrowProjectionVerificationBoundaryError(error);\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n\nasync function verifyReferencedPrincipalPolicy(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  reference: ReferencedPrincipalHead;\n  stillCurrent?: (() => boolean) | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n  // Scoped recovery carries organization, dependency and lifetime bindings.\n  // A bare policy cache entry cannot replace those bindings.\n  const recovered = await resolveReferencedPrincipalPolicy(input);\n  if (recovered) return recovered;\n  const cacheKey = referencedPrincipalPolicyKey(input.reference);\n  const cachedPolicy = input.principalPolicyCache.get(cacheKey);\n  const execSql = input.checkpointContext.execSql;\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    input.reference.principalType,\n    input.reference.principalId,\n  );\n  if (cachedPolicy && !(\"retainedHistory\" in cachedPolicy)) {\n    if (\n      !verifiedPrincipalPolicyContainsReference(cachedPolicy, input.reference)\n    ) {\n      throw new KeyingVerificationError(\n        \"hash_mismatch\",\n        \"in-memory principal policy cache does not match its exact reference\",\n      );\n    }\n    if (verifiedPrincipalPolicyMeetsCheckpoint(cachedPolicy, localCheckpoint)) {\n      observePrincipalPolicy(\n        input.checkpointContext,\n        cachedPolicy,\n        input.organizationId,\n      );\n      return cachedPolicy;\n    }\n  }\n\n  const referenceLabel = principalPolicyReferenceLabel(input.reference);\n  let bundle = await loadPrincipalPolicyBundleForReference(\n    execSql,\n    input.reference,\n    localCheckpoint,\n  );\n  if (!bundle && input.warmReferencedPrincipalPolicies) {\n    // The reference is not cached locally — the common case for a member who\n    // gained access via another org's group grant and never hydrated that\n    // group's policy. Fetch+verify+persist it, then re-read from the cache.\n    await input.warmReferencedPrincipalPolicies({\n      organizationId: input.organizationId,\n      references: [input.reference],\n    });\n    bundle = await loadPrincipalPolicyBundleForReference(\n      execSql,\n      input.reference,\n      localCheckpoint,\n    );\n  }\n  if (!bundle) {\n    throw new PrincipalPolicyNotCachedError(referenceLabel);\n  }\n\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    label: `Principal policy ${referenceLabel}`,\n    resolveUserKey: input.resolveUserKey,\n  });\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: input.reference,\n      loadExternalAuthority: () =>\n        loadOrganizationExternalAuthority({\n          checkpointContext: input.checkpointContext,\n          organizationId: input.organizationId,\n          resolveUserKey: input.resolveUserKey,\n          warmReferencedPrincipalPolicies:\n            input.warmReferencedPrincipalPolicies,\n        }),\n      localCheckpoint,\n      signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n\n  observePrincipalPolicy(\n    input.checkpointContext,\n    verified.value,\n    input.organizationId,\n  );\n  input.principalPolicyCache.set(cacheKey, verified.value);\n  return verified.value;\n}\n\nexport async function collectReferencedPrincipalPolicies(input: {\n  checkpointContext: ProjectionCheckpointContext;\n  organizationId: string;\n  principalPolicyCache: PrincipalPolicyCache;\n  references: readonly ReferencedPrincipalHead[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const warmReferencedPrincipalPolicies =\n    generationGuardedPrincipalPolicyWarmer(\n      input.warmReferencedPrincipalPolicies,\n      input.stillCurrent,\n    );\n  const uniqueReferences = new Map<string, ReferencedPrincipalHead>();\n  for (const reference of input.references) {\n    uniqueReferences.set(referencedPrincipalPolicyKey(reference), reference);\n  }\n\n  const references = [...uniqueReferences.values()];\n  // Warm every missing reference in one batched fetch before verifying, so a\n  // path that references several uncached policies makes a single round of\n  // requests rather than one per reference.\n  if (\n    warmReferencedPrincipalPolicies &&\n    !warmReferencedPrincipalPolicies.resolveReference\n  ) {\n    const uncached = await filterUncachedPrincipalPolicyReferences({\n      execSql: input.checkpointContext.execSql,\n      principalPolicyCache: input.principalPolicyCache,\n      references,\n    });\n    if (uncached.length > 0) {\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      await warmReferencedPrincipalPolicies({\n        organizationId: input.organizationId,\n        references: uncached,\n      });\n      assertProjectionVerificationCurrent(input.stillCurrent);\n    }\n  }\n\n  // The warmer's operation shares one recovery view across its collections.\n  return Promise.all(\n    references.map((reference) =>\n      verifyReferencedPrincipalPolicy({\n        checkpointContext: input.checkpointContext,\n        organizationId: input.organizationId,\n        principalPolicyCache: input.principalPolicyCache,\n        reference,\n        stillCurrent: input.stillCurrent,\n        resolveUserKey: input.resolveUserKey,\n        warmReferencedPrincipalPolicies,\n      }),\n    ),\n  );\n}\n"]}

package/data/keyingProjectionVerification/principalPolicy/resolvedPrincipalPolicy.js

@@ -1,10 +1,10 @@
 import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
 import { loadPrincipalPolicyCheckpoint } from "../../persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
-import { verifiedPrincipalPolicyMeetsCheckpoint } from "../../persistence/principalPolicy/principalPolicyCheckpointSelection.js";
 import { observePrincipalPolicy, } from "../checkpoints/checkpointContext.js";
 import { observeProjectionLifetime } from "../projectionLifetimes.js";
 import { assertProjectionVerificationCurrent, } from "../types.js";
 import { referencedPrincipalPolicyKey, verifiedPrincipalPolicyContainsReference, } from "./principalPolicyCache.js";
+import { verifiedPrincipalPolicyMeetsCheckpoint } from "./principalPolicyCheckpointSelection.js";
 // Scoped evidence is always resolved through the warmer: its operation memo is
 // the only reuse of recovered directory and Admins evidence, with one set of
 // validity rules. The caller's policy cache keeps bare verified policies; it

package/data/keyingProjectionVerification/principalPolicy/resolvedPrincipalPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvedPrincipalPolicy.js","sourceRoot":"","sources":["resolvedPrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,sCAAsC,EAAE,MAAM,sEAAsE,CAAC;AAC9H,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,mCAAmC,GAIpC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,qEAAqE;AACrE,KAAK,UAAU,gBAAgB,CAC7B,OAAoC,EACpC,MAAuC,EACvC,cAAuB;IAEvB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IACE,cAAc;YACd,UAAU;YACV,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;gBAClC,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;oBAClC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CACtD,CAAC,CAAC;YAEP,OAAO,KAAK,CAAC;QACf,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,KAAK,UAAU,eAAe,CAC5B,KAA4C,EAC5C,OAAyE;IAEzE,MAAM,IAAI,GAAG,KAAK,EAAE,aAAsB,EAAE,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC;YAC9B,aAAa;YACb,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,uEAAuE;IACvE,iEAAiE;IACjE,0EAA0E;IAC1E,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACrE,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,+BAA+B,EAAE,gBAAgB,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC;IAC5C,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,eAAe,EAAE,CAAC;IAC7E,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9C,yBAAyB,CAAC,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,IAAI,CAAC,wCAAwC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1D,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,MAAM,EACN,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"../../persistence/principalPolicy/principalPolicyCheckpointSelection\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { observeProjectionLifetime } from \"../projectionLifetimes\";\nimport {\n  assertProjectionVerificationCurrent,\n  type PrincipalPolicyCache,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"../types\";\nimport {\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\n\n// Scoped evidence is always resolved through the warmer: its operation memo is\n// the only reuse of recovered directory and Admins evidence, with one set of\n// validity rules. The caller's policy cache keeps bare verified policies; it\n// never stands in for organization, dependency or lifetime bindings.\nasync function meetsCheckpoints(\n  context: ProjectionCheckpointContext,\n  result: ResolvedPrincipalPolicyEvidence,\n  refreshMissing: boolean,\n): Promise<boolean> {\n  for (const policy of [...result.dependencies, result.policy]) {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      context.execSql,\n      policy.principalType,\n      policy.principalId,\n    );\n    if (\n      refreshMissing &&\n      checkpoint &&\n      (policy.version < checkpoint.version ||\n        (policy.version > checkpoint.version &&\n          !policy.retainedHistory.some(\n            (entry) => entry.state.version === checkpoint.version,\n          )))\n    )\n      return false;\n    if (!verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint))\n      throw new KeyingVerificationError(\n        \"rollback\",\n        \"Recovered principal evidence predates the durable checkpoint\",\n      );\n  }\n  return true;\n}\n\ninterface ResolveReferencedPrincipalPolicyInput {\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly reference: ReferencedPrincipalHead;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nasync function recoverEvidence(\n  input: ResolveReferencedPrincipalPolicyInput,\n  resolve: NonNullable<ReferencedPrincipalPolicyWarmer[\"resolveReference\"]>,\n): Promise<ResolvedPrincipalPolicyEvidence> {\n  const read = async (recoveryBatch?: object) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const recovered = await resolve({\n      recoveryBatch,\n      organizationId: input.organizationId,\n      reference: input.reference,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    assertProjectionVerificationCurrent(recovered.stillCurrent);\n    return recovered;\n  };\n  let result = await read();\n  // A concurrent admission may advance a pin after recovery verified it.\n  // Refresh once outside the operation's directory view; the fresh\n  // recovery and final checkpoint check still reject rollback/equivocation.\n  if (!(await meetsCheckpoints(input.checkpointContext, result, true))) {\n    assertProjectionVerificationCurrent(result.stillCurrent);\n    result = await read({});\n    await meetsCheckpoints(input.checkpointContext, result, false);\n  }\n  return result;\n}\n\nexport async function resolveReferencedPrincipalPolicy(\n  input: ResolveReferencedPrincipalPolicyInput,\n): Promise<VerifiedPrincipalPolicyCurrent | null> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const key = referencedPrincipalPolicyKey(input.reference);\n  const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;\n  if (!resolve) return null;\n  const result = await recoverEvidence(input, resolve);\n  const evidenceCurrent = result.stillCurrent;\n  // The consumer's and every producer's lifetime guard the evidence where it\n  // is used: projection admission rechecks them through the context.\n  const lifetime = () => input.stillCurrent?.() !== false && evidenceCurrent();\n  assertProjectionVerificationCurrent(lifetime);\n  observeProjectionLifetime(input.checkpointContext, lifetime);\n  if (result.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence belongs to another organization\",\n    );\n  if (!verifiedPrincipalPolicyContainsReference(result.policy, input.reference))\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence does not contain the exact citation\",\n    );\n  for (const policy of [...result.dependencies, result.policy])\n    observePrincipalPolicy(\n      input.checkpointContext,\n      policy,\n      input.organizationId,\n    );\n  input.principalPolicyCache.set(key, result.policy);\n  return result.policy;\n}\n"]}
+{"version":3,"file":"resolvedPrincipalPolicy.js","sourceRoot":"","sources":["resolvedPrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,mCAAmC,GAIpC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,4BAA4B,EAC5B,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,qEAAqE;AACrE,KAAK,UAAU,gBAAgB,CAC7B,OAAoC,EACpC,MAAuC,EACvC,cAAuB;IAEvB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IACE,cAAc;YACd,UAAU;YACV,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;gBAClC,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO;oBAClC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CACtD,CAAC,CAAC;YAEP,OAAO,KAAK,CAAC;QACf,IAAI,CAAC,sCAAsC,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,KAAK,UAAU,eAAe,CAC5B,KAA4C,EAC5C,OAAyE;IAEzE,MAAM,IAAI,GAAG,KAAK,EAAE,aAAsB,EAAE,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC;YAC9B,aAAa;YACb,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,uEAAuE;IACvE,iEAAiE;IACjE,0EAA0E;IAC1E,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACrE,mCAAmC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,+BAA+B,EAAE,gBAAgB,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC;IAC5C,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,IAAI,eAAe,EAAE,CAAC;IAC7E,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9C,yBAAyB,CAAC,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAChD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;IACJ,IAAI,CAAC,wCAAwC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1D,sBAAsB,CACpB,KAAK,CAAC,iBAAiB,EACvB,MAAM,EACN,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport {\n  observePrincipalPolicy,\n  type ProjectionCheckpointContext,\n} from \"../checkpoints/checkpointContext\";\nimport { observeProjectionLifetime } from \"../projectionLifetimes\";\nimport {\n  assertProjectionVerificationCurrent,\n  type PrincipalPolicyCache,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"../types\";\nimport {\n  referencedPrincipalPolicyKey,\n  verifiedPrincipalPolicyContainsReference,\n} from \"./principalPolicyCache\";\nimport { verifiedPrincipalPolicyMeetsCheckpoint } from \"./principalPolicyCheckpointSelection\";\n\n// Scoped evidence is always resolved through the warmer: its operation memo is\n// the only reuse of recovered directory and Admins evidence, with one set of\n// validity rules. The caller's policy cache keeps bare verified policies; it\n// never stands in for organization, dependency or lifetime bindings.\nasync function meetsCheckpoints(\n  context: ProjectionCheckpointContext,\n  result: ResolvedPrincipalPolicyEvidence,\n  refreshMissing: boolean,\n): Promise<boolean> {\n  for (const policy of [...result.dependencies, result.policy]) {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      context.execSql,\n      policy.principalType,\n      policy.principalId,\n    );\n    if (\n      refreshMissing &&\n      checkpoint &&\n      (policy.version < checkpoint.version ||\n        (policy.version > checkpoint.version &&\n          !policy.retainedHistory.some(\n            (entry) => entry.state.version === checkpoint.version,\n          )))\n    )\n      return false;\n    if (!verifiedPrincipalPolicyMeetsCheckpoint(policy, checkpoint))\n      throw new KeyingVerificationError(\n        \"rollback\",\n        \"Recovered principal evidence predates the durable checkpoint\",\n      );\n  }\n  return true;\n}\n\ninterface ResolveReferencedPrincipalPolicyInput {\n  readonly checkpointContext: ProjectionCheckpointContext;\n  readonly organizationId: string;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly reference: ReferencedPrincipalHead;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\nasync function recoverEvidence(\n  input: ResolveReferencedPrincipalPolicyInput,\n  resolve: NonNullable<ReferencedPrincipalPolicyWarmer[\"resolveReference\"]>,\n): Promise<ResolvedPrincipalPolicyEvidence> {\n  const read = async (recoveryBatch?: object) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const recovered = await resolve({\n      recoveryBatch,\n      organizationId: input.organizationId,\n      reference: input.reference,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    assertProjectionVerificationCurrent(recovered.stillCurrent);\n    return recovered;\n  };\n  let result = await read();\n  // A concurrent admission may advance a pin after recovery verified it.\n  // Refresh once outside the operation's directory view; the fresh\n  // recovery and final checkpoint check still reject rollback/equivocation.\n  if (!(await meetsCheckpoints(input.checkpointContext, result, true))) {\n    assertProjectionVerificationCurrent(result.stillCurrent);\n    result = await read({});\n    await meetsCheckpoints(input.checkpointContext, result, false);\n  }\n  return result;\n}\n\nexport async function resolveReferencedPrincipalPolicy(\n  input: ResolveReferencedPrincipalPolicyInput,\n): Promise<VerifiedPrincipalPolicyCurrent | null> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const key = referencedPrincipalPolicyKey(input.reference);\n  const resolve = input.warmReferencedPrincipalPolicies?.resolveReference;\n  if (!resolve) return null;\n  const result = await recoverEvidence(input, resolve);\n  const evidenceCurrent = result.stillCurrent;\n  // The consumer's and every producer's lifetime guard the evidence where it\n  // is used: projection admission rechecks them through the context.\n  const lifetime = () => input.stillCurrent?.() !== false && evidenceCurrent();\n  assertProjectionVerificationCurrent(lifetime);\n  observeProjectionLifetime(input.checkpointContext, lifetime);\n  if (result.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence belongs to another organization\",\n    );\n  if (!verifiedPrincipalPolicyContainsReference(result.policy, input.reference))\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Recovered principal evidence does not contain the exact citation\",\n    );\n  for (const policy of [...result.dependencies, result.policy])\n    observePrincipalPolicy(\n      input.checkpointContext,\n      policy,\n      input.organizationId,\n    );\n  input.principalPolicyCache.set(key, result.policy);\n  return result.policy;\n}\n"]}

package/data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js

@@ -4,8 +4,6 @@ import { verifiedManifestBundleTables } from "../../sqlite/schema/verifiedManife
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
 import { assertContainerNotRetired } from "../principalKeys/principalGrantRetirementPersistence.js";
-import { assertPrincipalPolicyBundleStoredInTransaction, writePrincipalPolicyBundleInTransaction, } from "../principalPolicy/principalPolicyPersistence.js";
-import { assertBundleMatchesVerifiedPolicy } from "../principalPolicy/verifiedPrincipalPolicyBundle.js";
 import { verifiedManifestBundleRows, writeVerifiedManifestBundlesInTransaction, } from "../verifiedManifestBundlePersistence.js";
 import { storeDocumentPurgeCheckpointInTransaction, } from "./documentPurgeCheckpointPersistence.js";
 import { validateAccessManifestCheckpointEvidence } from "./keyingCheckpointEvidence.js";
@@ -60,7 +58,12 @@ function extendsObservedPolicy(head, candidate) {
         state.version === candidate.version &&
         state.stateHash === candidate.stateHash) ?? false);
 }
-async function validatePolicyAdvances(tx, policies) {
+/**
+ * Checks, inside the caller's transaction, that each principal's newest policy
+ * extends every other candidate and its durable checkpoint. Returns the heads
+ * to pin, keyed by principal.
+ */
+export async function validatePrincipalPolicyCheckpointAdvances(tx, policies) {
     const policiesByPrincipal = new Map();
     for (const policy of policies) {
         const key = principalPolicyKey(policy);
@@ -103,7 +106,8 @@ async function writeAccessCheckpoints(tx, pending, updatedAt) {
         await upsertAccessManifestCheckpointInTransaction(tx, checkpoint, updatedAt);
     }
 }
-async function writePolicyCheckpoints(tx, pending, updatedAt, organizationId) {
+/** Pins the heads `validatePrincipalPolicyCheckpointAdvances` returned. */
+export async function writePrincipalPolicyCheckpoints(tx, pending, updatedAt, organizationId) {
     for (const policy of pending.values()) {
         await upsertPrincipalPolicyCheckpointInTransaction(tx, policy.checkpoint, updatedAt, organizationId);
     }
@@ -133,7 +137,7 @@ export async function validateKeyingCheckpointsAtomically(input) {
     const verifiedAt = new Date().toISOString();
     const validate = async (tx) => {
         await validateAccessAdvances(tx, input.access);
-        await validatePolicyAdvances(tx, input.policies);
+        await validatePrincipalPolicyCheckpointAdvances(tx, input.policies);
         await validatePrincipalAuthorizationCheckpoints(tx, input.authorizationPolicies ?? []);
         await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);
     };
@@ -158,10 +162,10 @@ export async function advanceKeyingCheckpointsAtomically(input) {
     const runtime = getClientSQLitePersistenceRuntime(input.execSql);
     const advance = async (tx) => {
         const access = await validateAccessAdvances(tx, input.access);
-        const policies = await validatePolicyAdvances(tx, input.policies);
+        const policies = await validatePrincipalPolicyCheckpointAdvances(tx, input.policies);
         await validatePrincipalAuthorizationCheckpoints(tx, input.authorizationPolicies ?? []);
         await writeAccessCheckpoints(tx, access, updatedAt);
-        await writePolicyCheckpoints(tx, policies, updatedAt, input.organizationId);
+        await writePrincipalPolicyCheckpoints(tx, policies, updatedAt, input.organizationId);
         if (input.documentPurgeCheckpoint) {
             await storeDocumentPurgeCheckpointInTransaction(tx, input.documentPurgeCheckpoint, updatedAt);
         }
@@ -175,48 +179,4 @@ export async function advanceKeyingCheckpointsAtomically(input) {
     }
     await runtime.transaction(advance, { behavior: "immediate" });
 }
-/**
- * Persists each verified full policy bundle together with its durable head.
- * This prevents a crash or bundle-write failure from leaving a checkpoint
- * without the exact same-head payload and member-envelope evidence.
- */
-export async function persistVerifiedPrincipalPolicyBundlesAtomically(input) {
-    const seen = new Set();
-    for (const entry of input.entries) {
-        const key = principalPolicyKey(entry.policy);
-        if (seen.has(key)) {
-            throw new KeyingVerificationError("duplicate_entry", `verified policy bundle batch repeats ${key}`);
-        }
-        seen.add(key);
-    }
-    await Promise.all(input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)));
-    await ensureSqlTables(input.execSql, [
-        ...principalPolicyTables,
-        ...keyingCheckpointTables,
-    ]);
-    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
-    const persist = async (tx) => {
-        const policies = await validatePolicyAdvances(tx, input.entries.map((entry) => entry.policy));
-        for (const entry of input.entries) {
-            await writePrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
-            await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);
-        }
-        await writePolicyCheckpoints(tx, policies, input.updatedAt, input.organizationId);
-        for (const policy of policies.values()) {
-            const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);
-            if (!checkpoint ||
-                checkpoint.version !== policy.version ||
-                checkpoint.stateHash !== policy.stateHash) {
-                throw new Error("Verified principal policy checkpoint was not persisted");
-            }
-        }
-    };
-    if (input.stillCurrent) {
-        await runtime.guardedTransaction(persist, input.stillCurrent, {
-            behavior: "immediate",
-        });
-        return;
-    }
-    await runtime.transaction(persist, { behavior: "immediate" });
-}
 //# sourceMappingURL=keyingCheckpointAdvancePersistence.js.map