@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/organizations/containerGrantRevocation.js

@@ -0,0 +1,37 @@
+import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
+import { revokeRemoteContainer } from "../containers/index.js";
+import { resolveDocumentCreateAuthor } from "../documents/index.js";
+export async function revokeOrganizationContainerGrant(input) {
+    const author = resolveDocumentCreateAuthor({
+        auth: {
+            organizationId: input.organizationId,
+            userId: input.signerUserId,
+        },
+        crypto: {
+            signingFingerprint: input.signingFingerprint,
+            signingKeyPair: input.signingKeyPair,
+        },
+    });
+    if (!author) {
+        throw new Error("Org Manager signing context is unavailable");
+    }
+    const revoked = await revokeRemoteContainer({
+        stillCurrent: input.stillCurrent,
+        reportSecurityIncident: input.reportSecurityIncident,
+        apiClient: input.apiClient,
+        author,
+        containerId: input.containerId,
+        execSql: input.execSql,
+        revokedSubject: input.revokedSubject,
+        resolveProjectionUserKey: createProjectionUserKeyResolver({
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        }),
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (!revoked) {
+        throw new Error("Container grant could not be revoked");
+    }
+    return revoked.response;
+}
+//# sourceMappingURL=containerGrantRevocation.js.map

package/workflows/organizations/containerGrantRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerGrantRevocation.js","sourceRoot":"","sources":["containerGrantRevocation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAI1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAW3D,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAsBtD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE;YACJ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,YAAY;SAC3B;QACD,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,+BAA+B,CAAC;YACxD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC","sourcesContent":["import type { ContainerDirectGrant } from \"@tearleads/crypto\";\nimport type { ContainerMutationResponse } from \"@tearleads/validators/response\";\nimport type { ReferencedPrincipalPolicyWarmer } from \"../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { revokeRemoteContainer } from \"../containers\";\nimport { resolveDocumentCreateAuthor } from \"../documents\";\n\ntype OrganizationContainerGrantSubject = Pick<\n  ContainerDirectGrant,\n  \"subjectId\" | \"subjectType\"\n>;\n\ntype OrganizationContainerGrantRevocationApi = Parameters<\n  typeof revokeRemoteContainer\n>[0][\"apiClient\"];\n\nexport async function revokeOrganizationContainerGrant(input: {\n  readonly stillCurrent: () => boolean;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly apiClient: OrganizationContainerGrantRevocationApi;\n  readonly containerId: string;\n  readonly encapsulationKeyPair: {\n    readonly publicKey: Uint8Array;\n    readonly secretKey: Uint8Array;\n  };\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly revokedSubject: OrganizationContainerGrantSubject;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: {\n    readonly signingPrivateKey: Uint8Array;\n    readonly signingPublicKey: Uint8Array;\n  };\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}): Promise<ContainerMutationResponse> {\n  const author = resolveDocumentCreateAuthor({\n    auth: {\n      organizationId: input.organizationId,\n      userId: input.signerUserId,\n    },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\"Org Manager signing context is unavailable\");\n  }\n\n  const revoked = await revokeRemoteContainer({\n    stillCurrent: input.stillCurrent,\n    reportSecurityIncident: input.reportSecurityIncident,\n    apiClient: input.apiClient,\n    author,\n    containerId: input.containerId,\n    execSql: input.execSql,\n    revokedSubject: input.revokedSubject,\n    resolveProjectionUserKey: createProjectionUserKeyResolver({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!revoked) {\n    throw new Error(\"Container grant could not be revoked\");\n  }\n\n  return revoked.response;\n}\n"]}

package/workflows/organizations/createOrganization.d.ts

@@ -0,0 +1,59 @@
+import { type EncapsulationKeyPair, type SigningKeyPair } from "../../internal/crypto/index.js";
+import type { CreateOrganizationRequest } from "../../internal/validators/request/index.js";
+import type { CreateOrganizationResponse } from "../../internal/validators/response/index.js";
+import type { DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
+import type { ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
+import { type ProvisionedSystemContainerSpec } from "../registration/registerIdentity.js";
+import { removeNativeSubscriptionRestoreProvisioningAttempt } from "./organizationProvisioningAttempt.js";
+export { removeNativeSubscriptionRestoreProvisioningAttempt };
+export interface CreateOrganizationApi {
+    createOrganization(request: CreateOrganizationRequest): Promise<CreateOrganizationResponse | null>;
+}
+export interface CreateOrganizationInput {
+    apiClient: CreateOrganizationApi;
+    dbClient: ExecSqlClientLike;
+    documentProjectors?: DocumentProjectorRegistryInput | undefined;
+    encapsulationKeyPair: EncapsulationKeyPair;
+    /**
+     * Returns false once the identity that supplied the key pairs is no longer
+     * active. Checked before the remote create (so a stale request is never
+     * submitted) and again before local persistence: an identity switch closes
+     * or renews the captured database client, so persisting would write another
+     * identity's bootstrap — or throw — after the org already exists remotely.
+     * The caller discards the result.
+     */
+    isIdentityCurrent?: (() => boolean) | undefined;
+    /** @internal Forwarded to the bootstrap persist; test-only seam. */
+    onPersistQueued?: (() => void) | undefined;
+    log?: ((message: string) => void) | undefined;
+    logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
+    /** Overrides the seeded organization profile name; see registration. */
+    organizationProfileName?: string | undefined;
+    /**
+     * App-owned system containers to provision atomically with the new
+     * organization (e.g. a trash bin). See registration.
+     */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+    /** Purged organization whose personal-org generation this replaces. */
+    replacesOrganizationId?: string | undefined;
+    /** Marks and durably replays a fresh native-subscription restore target. */
+    nativeSubscriptionRestore?: boolean | undefined;
+    /** Overrides the seeded self roster-profile nickname; see registration. */
+    rosterProfileNickname?: string | undefined;
+    signingKeyPair: SigningKeyPair;
+    /**
+     * The already-registered user creating the organization; they become its
+     * founding admin. The server independently requires this to match the
+     * authenticated session.
+     */
+    userId: string;
+}
+/**
+ * Provisions an additional organization for an already-registered user, reusing
+ * the exact artifact-build and local-persistence path as registration
+ * ({@link buildOrganizationProvisioningArtifacts} /
+ * {@link persistOrganizationProvisioningState}). Unlike registration it mints a
+ * fresh root container id, signs with the caller's existing identity, and needs
+ * no auth challenge — the user is already authenticated.
+ */
+export declare function createOrganization(input: CreateOrganizationInput): Promise<CreateOrganizationResponse | null>;

package/workflows/organizations/createOrganization.js

@@ -0,0 +1,127 @@
+import { signOrganizationReplacementAuthorization, } from "../../internal/crypto/index.js";
+import { createExecSql } from "../../data/sqlite/sqlSchema.js";
+import { buildOrganizationProvisioningArtifacts, persistOrganizationProvisioningState, } from "../registration/registerIdentity.js";
+import { makeOrganizationProvisioningAttemptDurable, removeNativeSubscriptionRestoreProvisioningAttempt, } from "./organizationProvisioningAttempt.js";
+import { pinOrganizationReplacementResponse } from "./organizationReplacementVerification.js";
+export { removeNativeSubscriptionRestoreProvisioningAttempt };
+function isAdoptedReplacementResponse(input) {
+    if (input.response.organizationId === input.request.organizationId &&
+        input.response.rootContainerId === input.request.rootContainerId) {
+        return false;
+    }
+    if (!input.creation.replacesOrganizationId ||
+        input.response.userId !== input.creation.userId) {
+        throw new Error("Organization provisioning returned an unexpected organization");
+    }
+    input.creation.log?.(`Organization replacement adopted (${input.response.organizationId})`);
+    return true;
+}
+async function buildOrganizationCandidate(input, rootContainerId) {
+    const artifactsInput = {
+        encapsulationKeyPair: input.encapsulationKeyPair,
+        organizationProfileName: input.organizationProfileName,
+        provisionedSystemContainers: input.provisionedSystemContainers,
+        rootContainerId,
+        rosterProfileNickname: input.rosterProfileNickname,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    };
+    const artifacts = await buildOrganizationProvisioningArtifacts(artifactsInput);
+    if (input.replacesOrganizationId) {
+        artifacts.replacementAuthorization =
+            await signOrganizationReplacementAuthorization({
+                ...artifacts,
+                replacesOrganizationId: input.replacesOrganizationId,
+                rootContainerId,
+                userId: input.userId,
+            }, input.signingKeyPair);
+    }
+    if (input.replacesOrganizationId &&
+        input.isIdentityCurrent &&
+        !input.isIdentityCurrent()) {
+        input.log?.("Organization creation aborted: identity changed while building artifacts");
+        return null;
+    }
+    return artifacts;
+}
+/**
+ * Provisions an additional organization for an already-registered user, reusing
+ * the exact artifact-build and local-persistence path as registration
+ * ({@link buildOrganizationProvisioningArtifacts} /
+ * {@link persistOrganizationProvisioningState}). Unlike registration it mints a
+ * fresh root container id, signs with the caller's existing identity, and needs
+ * no auth challenge — the user is already authenticated.
+ */
+export async function createOrganization(input) {
+    input.log?.("Creating organization...");
+    const rootContainerId = crypto.randomUUID();
+    const candidateArtifacts = await buildOrganizationCandidate(input, rootContainerId);
+    if (!candidateArtifacts)
+        return null;
+    const durableAttempt = await makeOrganizationProvisioningAttemptDurable({
+        artifacts: candidateArtifacts,
+        canStartDurableMutation: input.isIdentityCurrent,
+        dbClient: input.dbClient,
+        nativeSubscriptionRestore: input.nativeSubscriptionRestore,
+        replacesOrganizationId: input.replacesOrganizationId,
+        rootContainerId,
+        userId: input.userId,
+    });
+    if (!durableAttempt) {
+        input.log?.("Organization creation aborted: identity changed before saving artifacts");
+        return null;
+    }
+    const { artifacts, request, rootContainerId: durableRootContainerId, } = durableAttempt;
+    if (input.isIdentityCurrent && !input.isIdentityCurrent()) {
+        input.log?.("Organization creation aborted: identity changed before provisioning");
+        return null;
+    }
+    const response = await input.apiClient.createOrganization(request);
+    if (!response) {
+        return null;
+    }
+    if (input.isIdentityCurrent && !input.isIdentityCurrent()) {
+        input.log?.("Organization creation discarded: identity changed while provisioning");
+        return null;
+    }
+    if (input.replacesOrganizationId &&
+        !(await pinOrganizationReplacementResponse({
+            replacesOrganizationId: input.replacesOrganizationId,
+            response,
+            signingPublicKey: input.signingKeyPair.signingPublicKey,
+            userId: input.userId,
+            execSql: createExecSql(input.dbClient),
+            stillCurrent: input.isIdentityCurrent,
+        })))
+        return null;
+    if (isAdoptedReplacementResponse({ creation: input, request, response })) {
+        // Another device authorized this winning genesis with the same identity.
+        // Its encrypted bootstrap will hydrate normally; persisting
+        // this device's losing candidate would instead create an unrelated local
+        // root. The session reset rebinds retained local data to the winning ids.
+        return response;
+    }
+    input.log?.(`Organization created (${response.organizationId})`);
+    await persistOrganizationProvisioningState({
+        bootstrap: artifacts.bootstrap,
+        canStartDurableMutation: input.isIdentityCurrent,
+        onPersistQueued: input.onPersistQueued,
+        containerId: durableRootContainerId,
+        dbClient: input.dbClient,
+        documentProjectors: input.documentProjectors,
+        initialAdminGroup: artifacts.initialAdminGroup,
+        initialMemberGroup: artifacts.initialMemberGroup,
+        initialOrganizationPolicy: artifacts.initialOrganizationPolicy,
+        log: input.log,
+        logError: input.logError,
+        organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,
+        response,
+        rootContainer: artifacts.rootContainer,
+        rootMetadataDocument: artifacts.rootMetadataDocument,
+        rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,
+        rosterProfileBootstrap: artifacts.rosterProfileBootstrap,
+        systemContainerBootstraps: artifacts.systemContainerBootstraps,
+    });
+    return response;
+}
+//# sourceMappingURL=createOrganization.js.map

package/workflows/organizations/createOrganization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOrganization.js","sourceRoot":"","sources":["createOrganization.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,sCAAsC,EAItC,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0CAA0C,EAC1C,kDAAkD,GACnD,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,uCAAuC,CAAC;AAE3F,OAAO,EAAE,kDAAkD,EAAE,CAAC;AAkD9D,SAAS,4BAA4B,CAAC,KAIrC;IACC,IACE,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QAC9D,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO,CAAC,eAAe,EAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QACtC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAClB,qCAAqC,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,CACtE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA8B,EAC9B,eAAuB;IAEvB,MAAM,cAAc,GAA2C;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe;QACf,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,SAAS,GACb,MAAM,sCAAsC,CAAC,cAAc,CAAC,CAAC;IAE/D,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,wBAAwB;YAChC,MAAM,wCAAwC,CAC5C;gBACE,GAAG,SAAS;gBACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,eAAe;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,EACD,KAAK,CAAC,cAAc,CACrB,CAAC;IACN,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAC1B,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CACT,0EAA0E,CAC3E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,KAAK,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,CAAC;IAExC,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAG,MAAM,0BAA0B,CACzD,KAAK,EACL,eAAe,CAChB,CAAC;IAEF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,SAAS,EAAE,kBAAkB;QAC7B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,KAAK,CAAC,GAAG,EAAE,CACT,yEAAyE,CAC1E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EACJ,SAAS,EACT,OAAO,EACP,eAAe,EAAE,sBAAsB,GACxC,GAAG,cAAc,CAAC;IAEnB,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,qEAAqE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,sEAAsE,CACvE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,QAAQ;YACR,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtC,YAAY,EAAE,KAAK,CAAC,iBAAiB;SACtC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IAEd,IAAI,4BAA4B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;IACjE,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,sBAAsB;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  type EncapsulationKeyPair,\n  type SigningKeyPair,\n  signOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport type { CreateOrganizationRequest } from \"@tearleads/validators/request\";\nimport type { CreateOrganizationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport { createExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  buildOrganizationProvisioningArtifacts,\n  type OrganizationProvisioningArtifacts,\n  type OrganizationProvisioningArtifactsInput,\n  type ProvisionedSystemContainerSpec,\n  persistOrganizationProvisioningState,\n} from \"../registration/registerIdentity\";\nimport {\n  makeOrganizationProvisioningAttemptDurable,\n  removeNativeSubscriptionRestoreProvisioningAttempt,\n} from \"./organizationProvisioningAttempt\";\nimport { pinOrganizationReplacementResponse } from \"./organizationReplacementVerification\";\n\nexport { removeNativeSubscriptionRestoreProvisioningAttempt };\n\nexport interface CreateOrganizationApi {\n  createOrganization(\n    request: CreateOrganizationRequest,\n  ): Promise<CreateOrganizationResponse | null>;\n}\n\nexport interface CreateOrganizationInput {\n  apiClient: CreateOrganizationApi;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  /**\n   * Returns false once the identity that supplied the key pairs is no longer\n   * active. Checked before the remote create (so a stale request is never\n   * submitted) and again before local persistence: an identity switch closes\n   * or renews the captured database client, so persisting would write another\n   * identity's bootstrap — or throw — after the org already exists remotely.\n   * The caller discards the result.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /** Overrides the seeded organization profile name; see registration. */\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the new\n   * organization (e.g. a trash bin). See registration.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /** Purged organization whose personal-org generation this replaces. */\n  replacesOrganizationId?: string | undefined;\n  /** Marks and durably replays a fresh native-subscription restore target. */\n  nativeSubscriptionRestore?: boolean | undefined;\n  /** Overrides the seeded self roster-profile nickname; see registration. */\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  /**\n   * The already-registered user creating the organization; they become its\n   * founding admin. The server independently requires this to match the\n   * authenticated session.\n   */\n  userId: string;\n}\n\nfunction isAdoptedReplacementResponse(input: {\n  creation: CreateOrganizationInput;\n  request: CreateOrganizationRequest;\n  response: CreateOrganizationResponse;\n}): boolean {\n  if (\n    input.response.organizationId === input.request.organizationId &&\n    input.response.rootContainerId === input.request.rootContainerId\n  ) {\n    return false;\n  }\n  if (\n    !input.creation.replacesOrganizationId ||\n    input.response.userId !== input.creation.userId\n  ) {\n    throw new Error(\n      \"Organization provisioning returned an unexpected organization\",\n    );\n  }\n  input.creation.log?.(\n    `Organization replacement adopted (${input.response.organizationId})`,\n  );\n  return true;\n}\n\nasync function buildOrganizationCandidate(\n  input: CreateOrganizationInput,\n  rootContainerId: string,\n): Promise<OrganizationProvisioningArtifacts | null> {\n  const artifactsInput: OrganizationProvisioningArtifactsInput = {\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  };\n  const artifacts: OrganizationProvisioningArtifacts =\n    await buildOrganizationProvisioningArtifacts(artifactsInput);\n\n  if (input.replacesOrganizationId) {\n    artifacts.replacementAuthorization =\n      await signOrganizationReplacementAuthorization(\n        {\n          ...artifacts,\n          replacesOrganizationId: input.replacesOrganizationId,\n          rootContainerId,\n          userId: input.userId,\n        },\n        input.signingKeyPair,\n      );\n  }\n\n  if (\n    input.replacesOrganizationId &&\n    input.isIdentityCurrent &&\n    !input.isIdentityCurrent()\n  ) {\n    input.log?.(\n      \"Organization creation aborted: identity changed while building artifacts\",\n    );\n    return null;\n  }\n\n  return artifacts;\n}\n\n/**\n * Provisions an additional organization for an already-registered user, reusing\n * the exact artifact-build and local-persistence path as registration\n * ({@link buildOrganizationProvisioningArtifacts} /\n * {@link persistOrganizationProvisioningState}). Unlike registration it mints a\n * fresh root container id, signs with the caller's existing identity, and needs\n * no auth challenge — the user is already authenticated.\n */\nexport async function createOrganization(\n  input: CreateOrganizationInput,\n): Promise<CreateOrganizationResponse | null> {\n  input.log?.(\"Creating organization...\");\n\n  const rootContainerId = crypto.randomUUID();\n  const candidateArtifacts = await buildOrganizationCandidate(\n    input,\n    rootContainerId,\n  );\n\n  if (!candidateArtifacts) return null;\n\n  const durableAttempt = await makeOrganizationProvisioningAttemptDurable({\n    artifacts: candidateArtifacts,\n    canStartDurableMutation: input.isIdentityCurrent,\n    dbClient: input.dbClient,\n    nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n    replacesOrganizationId: input.replacesOrganizationId,\n    rootContainerId,\n    userId: input.userId,\n  });\n  if (!durableAttempt) {\n    input.log?.(\n      \"Organization creation aborted: identity changed before saving artifacts\",\n    );\n    return null;\n  }\n  const {\n    artifacts,\n    request,\n    rootContainerId: durableRootContainerId,\n  } = durableAttempt;\n\n  if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n    input.log?.(\n      \"Organization creation aborted: identity changed before provisioning\",\n    );\n    return null;\n  }\n\n  const response = await input.apiClient.createOrganization(request);\n  if (!response) {\n    return null;\n  }\n\n  if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n    input.log?.(\n      \"Organization creation discarded: identity changed while provisioning\",\n    );\n    return null;\n  }\n\n  if (\n    input.replacesOrganizationId &&\n    !(await pinOrganizationReplacementResponse({\n      replacesOrganizationId: input.replacesOrganizationId,\n      response,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n      userId: input.userId,\n      execSql: createExecSql(input.dbClient),\n      stillCurrent: input.isIdentityCurrent,\n    }))\n  )\n    return null;\n\n  if (isAdoptedReplacementResponse({ creation: input, request, response })) {\n    // Another device authorized this winning genesis with the same identity.\n    // Its encrypted bootstrap will hydrate normally; persisting\n    // this device's losing candidate would instead create an unrelated local\n    // root. The session reset rebinds retained local data to the winning ids.\n    return response;\n  }\n\n  input.log?.(`Organization created (${response.organizationId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: durableRootContainerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}

package/workflows/organizations/dataUsageReadModel.d.ts

@@ -0,0 +1,19 @@
+import type { RequestResult, RequestResultOptions } from "../../internal/api-client/index.js";
+import type { OrganizationDataUsageResponse } from "../../internal/validators/response/index.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+export type OrganizationDataUsage = OrganizationDataUsageResponse;
+interface OrganizationDataUsageApi {
+    getOrganizationDataUsageResult(organizationId: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationDataUsageResponse>>;
+}
+interface OrganizationDataUsageProjectionInput {
+    readonly execSql: ExecSql;
+    readonly organizationId: string;
+    readonly requesterUserId: string;
+}
+export interface ReconcileOrganizationDataUsageInput extends OrganizationDataUsageProjectionInput {
+    readonly apiClient: OrganizationDataUsageApi;
+    readonly logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
+}
+export declare function loadLocalOrganizationDataUsage(input: OrganizationDataUsageProjectionInput): Promise<OrganizationDataUsage | null>;
+export declare function reconcileOrganizationDataUsage(input: ReconcileOrganizationDataUsageInput): Promise<OrganizationDataUsage | null>;
+export {};

package/workflows/organizations/dataUsageReadModel.js

@@ -0,0 +1,64 @@
+import { loadOrganizationDataUsageProjection, purgeOrganizationDataUsageProjection, saveOrganizationDataUsageProjection, } from "../../data/persistence/organizations/organizationDataUsagePersistence.js";
+import { recordOrganizationPresentationDenials } from "../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
+import { captureOrganizationPresentationAccessAttempt, denyOrganizationPresentationAccess, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, restoreOrganizationPresentationAccess, runOrganizationPresentationMutation, runOrganizationPresentationRead, } from "./organizationPresentationAccessState.js";
+import { isOrganizationPresentationAccessDeniedFailure } from "./organizationPresentationFailures.js";
+export async function loadLocalOrganizationDataUsage(input) {
+    return runOrganizationPresentationRead(input, "usage", () => loadOrganizationDataUsageProjection(input.execSql, input.organizationId, input.requesterUserId));
+}
+function retainedIfUsageReadable(input, attempt, value) {
+    return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&
+        isOrganizationPresentationAccessReadable(input, "usage")
+        ? value
+        : null;
+}
+export async function reconcileOrganizationDataUsage(input) {
+    const attempt = captureOrganizationPresentationAccessAttempt(input, "usage");
+    const local = await loadLocalOrganizationDataUsage(input);
+    const result = await input.apiClient.getOrganizationDataUsageResult(input.organizationId, { reportErrors: false });
+    if (!result.ok) {
+        if (isOrganizationPresentationAccessDeniedFailure(result)) {
+            denyOrganizationPresentationAccess(input, ["usage"]);
+            // Durable marker first: a failed purge plus a restart must not serve
+            // the revoked usage projection.
+            try {
+                await runOrganizationPresentationMutation(input.execSql, () => recordOrganizationPresentationDenials(input, ["usage"]));
+            }
+            catch (error) {
+                input.logError?.("Failed to record denied organization data usage", error);
+            }
+            try {
+                await runOrganizationPresentationMutation(input.execSql, () => purgeOrganizationDataUsageProjection(input.execSql, input.organizationId, input.requesterUserId));
+            }
+            catch (error) {
+                input.logError?.("Failed to purge denied organization data usage", error);
+            }
+            return null;
+        }
+        result.report();
+        return retainedIfUsageReadable(input, attempt, local);
+    }
+    if (result.data.organizationId !== input.organizationId) {
+        input.logError?.(`Organization data-usage response scope does not match ${input.organizationId}`);
+        return retainedIfUsageReadable(input, attempt, local);
+    }
+    return runOrganizationPresentationMutation(input.execSql, async () => {
+        if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {
+            return null;
+        }
+        try {
+            await saveOrganizationDataUsageProjection({
+                execSql: input.execSql,
+                requesterUserId: input.requesterUserId,
+                response: result.data,
+            });
+        }
+        catch (error) {
+            input.logError?.("Failed to persist organization data usage", error);
+            return retainedIfUsageReadable(input, attempt, local);
+        }
+        return restoreOrganizationPresentationAccess(input, attempt)
+            ? result.data
+            : null;
+    });
+}
+//# sourceMappingURL=dataUsageReadModel.js.map

package/workflows/organizations/dataUsageReadModel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataUsageReadModel.js","sourceRoot":"","sources":["dataUsageReadModel.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gFAAgF,CAAC;AAEvI,OAAO,EACL,4CAA4C,EAC5C,kCAAkC,EAClC,8CAA8C,EAC9C,wCAAwC,EAExC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,6CAA6C,EAAE,MAAM,oCAAoC,CAAC;AAyBnG,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA2C;IAE3C,OAAO,+BAA+B,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAC1D,mCAAmC,CACjC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA2C,EAC3C,OAA8C,EAC9C,KAAQ;IAER,OAAO,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC;QACnE,wCAAwC,CAAC,KAAK,EAAE,OAAO,CAAC;QACxD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA0C;IAE1C,MAAM,OAAO,GAAG,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,8BAA8B,CACjE,KAAK,CAAC,cAAc,EACpB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,6CAA6C,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,kCAAkC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,qEAAqE;YACrE,gCAAgC;YAChC,IAAI,CAAC;gBACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,qCAAqC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,QAAQ,EAAE,CACd,iDAAiD,EACjD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,oCAAoC,CAClC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,QAAQ,EAAE,CACd,gDAAgD,EAChD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACxD,KAAK,CAAC,QAAQ,EAAE,CACd,yDAAyD,KAAK,CAAC,cAAc,EAAE,CAChF,CAAC;QACF,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACnE,IAAI,CAAC,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,mCAAmC,CAAC;gBACxC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,QAAQ,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,QAAQ,EAAE,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,qCAAqC,CAAC,KAAK,EAAE,OAAO,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  RequestResult,\n  RequestResultOptions,\n} from \"@tearleads/api-client\";\nimport type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n  loadOrganizationDataUsageProjection,\n  purgeOrganizationDataUsageProjection,\n  saveOrganizationDataUsageProjection,\n} from \"../../data/persistence/organizations/organizationDataUsagePersistence\";\nimport { recordOrganizationPresentationDenials } from \"../../data/persistence/organizations/organizationPresentationDenialPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  captureOrganizationPresentationAccessAttempt,\n  denyOrganizationPresentationAccess,\n  isOrganizationPresentationAccessAttemptCurrent,\n  isOrganizationPresentationAccessReadable,\n  type OrganizationPresentationAccessAttempt,\n  restoreOrganizationPresentationAccess,\n  runOrganizationPresentationMutation,\n  runOrganizationPresentationRead,\n} from \"./organizationPresentationAccessState\";\nimport { isOrganizationPresentationAccessDeniedFailure } from \"./organizationPresentationFailures\";\n\nexport type OrganizationDataUsage = OrganizationDataUsageResponse;\n\ninterface OrganizationDataUsageApi {\n  getOrganizationDataUsageResult(\n    organizationId: string,\n    options?: RequestResultOptions,\n  ): Promise<RequestResult<OrganizationDataUsageResponse>>;\n}\n\ninterface OrganizationDataUsageProjectionInput {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly requesterUserId: string;\n}\n\nexport interface ReconcileOrganizationDataUsageInput\n  extends OrganizationDataUsageProjectionInput {\n  readonly apiClient: OrganizationDataUsageApi;\n  readonly logError?:\n    | ((message: string | Error, cause?: unknown) => void)\n    | undefined;\n}\n\nexport async function loadLocalOrganizationDataUsage(\n  input: OrganizationDataUsageProjectionInput,\n): Promise<OrganizationDataUsage | null> {\n  return runOrganizationPresentationRead(input, \"usage\", () =>\n    loadOrganizationDataUsageProjection(\n      input.execSql,\n      input.organizationId,\n      input.requesterUserId,\n    ),\n  );\n}\n\nfunction retainedIfUsageReadable<T>(\n  input: OrganizationDataUsageProjectionInput,\n  attempt: OrganizationPresentationAccessAttempt,\n  value: T,\n): T | null {\n  return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&\n    isOrganizationPresentationAccessReadable(input, \"usage\")\n    ? value\n    : null;\n}\n\nexport async function reconcileOrganizationDataUsage(\n  input: ReconcileOrganizationDataUsageInput,\n): Promise<OrganizationDataUsage | null> {\n  const attempt = captureOrganizationPresentationAccessAttempt(input, \"usage\");\n  const local = await loadLocalOrganizationDataUsage(input);\n  const result = await input.apiClient.getOrganizationDataUsageResult(\n    input.organizationId,\n    { reportErrors: false },\n  );\n  if (!result.ok) {\n    if (isOrganizationPresentationAccessDeniedFailure(result)) {\n      denyOrganizationPresentationAccess(input, [\"usage\"]);\n      // Durable marker first: a failed purge plus a restart must not serve\n      // the revoked usage projection.\n      try {\n        await runOrganizationPresentationMutation(input.execSql, () =>\n          recordOrganizationPresentationDenials(input, [\"usage\"]),\n        );\n      } catch (error) {\n        input.logError?.(\n          \"Failed to record denied organization data usage\",\n          error,\n        );\n      }\n      try {\n        await runOrganizationPresentationMutation(input.execSql, () =>\n          purgeOrganizationDataUsageProjection(\n            input.execSql,\n            input.organizationId,\n            input.requesterUserId,\n          ),\n        );\n      } catch (error) {\n        input.logError?.(\n          \"Failed to purge denied organization data usage\",\n          error,\n        );\n      }\n      return null;\n    }\n\n    result.report();\n    return retainedIfUsageReadable(input, attempt, local);\n  }\n\n  if (result.data.organizationId !== input.organizationId) {\n    input.logError?.(\n      `Organization data-usage response scope does not match ${input.organizationId}`,\n    );\n    return retainedIfUsageReadable(input, attempt, local);\n  }\n\n  return runOrganizationPresentationMutation(input.execSql, async () => {\n    if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {\n      return null;\n    }\n    try {\n      await saveOrganizationDataUsageProjection({\n        execSql: input.execSql,\n        requesterUserId: input.requesterUserId,\n        response: result.data,\n      });\n    } catch (error) {\n      input.logError?.(\"Failed to persist organization data usage\", error);\n      return retainedIfUsageReadable(input, attempt, local);\n    }\n    return restoreOrganizationPresentationAccess(input, attempt)\n      ? result.data\n      : null;\n  });\n}\n"]}

package/workflows/organizations/deleteOrganizationGroup.d.ts

@@ -0,0 +1,18 @@
+import type { SigningKeyPair } from "../../internal/crypto/index.js";
+import type { DeleteOrganizationGroupRequest } from "../../internal/validators/request/index.js";
+import type { DeleteOrganizationGroupResponse } from "../../internal/validators/response/index.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
+import type { PrincipalPolicyReadApi } from "./groupPolicyMutationContext.js";
+export declare function deleteOrganizationGroup(input: {
+    readonly apiClient: PrincipalPolicyReadApi & {
+        deleteOrganizationGroup: (organizationId: string, groupId: string, request: DeleteOrganizationGroupRequest) => Promise<DeleteOrganizationGroupResponse | null>;
+    };
+    readonly execSql: ExecSql;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<DeleteOrganizationGroupResponse>;

package/workflows/organizations/deleteOrganizationGroup.js

@@ -0,0 +1,64 @@
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
+import { acknowledgeGroupPolicyState, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, removeOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+export async function deleteOrganizationGroup(input) {
+    const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        execSql: input.execSql,
+        getCurrentPrincipalPolicy: (principalType, principalId) => input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const adminProjection = externalAdminPolicy.adminBundle.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(adminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection,
+        adminUsers,
+        currentPolicy: externalAdminPolicy.bundle,
+        descriptor: externalAdminPolicy.descriptor,
+        groupHeads: removeOrganizationGroupHead({
+            descriptor: externalAdminPolicy.descriptor,
+            groupId: input.groupId,
+        }),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const stored = await input.apiClient.deleteOrganizationGroup(input.organizationId, input.groupId, { organizationPolicy: organizationRequest });
+    if (!stored) {
+        throw new Error("Group could not be deleted");
+    }
+    if (stored.organizationId !== input.organizationId ||
+        stored.groupId !== input.groupId) {
+        throw new Error("Group deletion response target mismatch");
+    }
+    const organizationHead = await groupPolicyMutationHead(organizationRequest);
+    const organizationPolicy = await acknowledgeGroupPolicyState({
+        currentPolicy: externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy.currentState,
+    });
+    const organizationBundle = buildAcknowledgedGroupPolicyBundle({
+        currentPolicy: externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy,
+    });
+    await persistLocallyAcknowledgedPrincipalPolicyBundles({
+        entries: [{ bundle: organizationBundle, policy: organizationPolicy }],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        updatedAt: new Date().toISOString(),
+    });
+    return stored;
+}
+//# sourceMappingURL=deleteOrganizationGroup.js.map

package/workflows/organizations/deleteOrganizationGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteOrganizationGroup.js","sourceRoot":"","sources":["deleteOrganizationGroup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gDAAgD,EAAE,MAAM,iEAAiE,CAAC;AAGnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAe7C;IACC,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,UAAU,EAAE,mBAAmB,CAAC,UAAU;QAC1C,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,mBAAmB,CAAC,UAAU;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC5C,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { DeleteOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport type { DeleteOrganizationGroupResponse } from \"@tearleads/validators/response\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport {\n  acknowledgeGroupPolicyState,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { PrincipalPolicyReadApi } from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\nexport async function deleteOrganizationGroup(input: {\n  readonly apiClient: PrincipalPolicyReadApi & {\n    deleteOrganizationGroup: (\n      organizationId: string,\n      groupId: string,\n      request: DeleteOrganizationGroupRequest,\n    ) => Promise<DeleteOrganizationGroupResponse | null>;\n  };\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<DeleteOrganizationGroupResponse> {\n  const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    execSql: input.execSql,\n    getCurrentPrincipalPolicy: (principalType, principalId) =>\n      input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const adminProjection = externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: externalAdminPolicy.bundle,\n      descriptor: externalAdminPolicy.descriptor,\n      groupHeads: removeOrganizationGroupHead({\n        descriptor: externalAdminPolicy.descriptor,\n        groupId: input.groupId,\n      }),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  const stored = await input.apiClient.deleteOrganizationGroup(\n    input.organizationId,\n    input.groupId,\n    { organizationPolicy: organizationRequest },\n  );\n  if (!stored) {\n    throw new Error(\"Group could not be deleted\");\n  }\n  if (\n    stored.organizationId !== input.organizationId ||\n    stored.groupId !== input.groupId\n  ) {\n    throw new Error(\"Group deletion response target mismatch\");\n  }\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [{ bundle: organizationBundle, policy: organizationPolicy }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n  });\n  return stored;\n}\n"]}

package/workflows/organizations/groupCreation.d.ts

@@ -0,0 +1,20 @@
+import type { EncapsulationKeyPair, SigningKeyPair } from "../../internal/crypto/index.js";
+import type { SecurityIncidentReporter } from "../../data/securityIncidents.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
+import type { createGroupMetadataAccess } from "./groupMetadataAccess.js";
+import { type OrganizationPrincipalPolicyApi } from "./groupPolicyMutationContext.js";
+import type { OrganizationGroupSummary } from "./readModel.js";
+export declare function createOrganizationGroup(input: {
+    readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;
+    readonly apiClient: OrganizationPrincipalPolicyApi;
+    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
+    readonly execSql: ExecSql;
+    readonly name: string;
+    readonly organizationId: string;
+    readonly reportSecurityIncident: SecurityIncidentReporter;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<OrganizationGroupSummary>;

package/workflows/organizations/groupCreation.js

@@ -0,0 +1,59 @@
+import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
+import { cacheGroupPolicy, } from "./groupPolicyMutationContext.js";
+import { commitCreatedGroupToDirectory } from "./organizationGroupDirectory.js";
+import { buildInitialGroupPolicyRequest } from "./principalPolicyRequest.js";
+export async function createOrganizationGroup(input) {
+    const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        execSql: input.execSql,
+        getCurrentPrincipalPolicy: (principalType, principalId) => input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if (!externalAdminPolicy) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    if (!externalAdminPolicy.signerUserIds.includes(input.signerUserId)) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const request = await buildInitialGroupPolicyRequest({
+        creatorEncapsulationKeyPair: input.creatorEncapsulationKeyPair,
+        externalAuthority: externalAdminPolicy.externalAuthority.currentHead,
+        groupId: crypto.randomUUID(),
+        includeSignerAsAdmin: false,
+        name: input.name,
+        metadataKey: await input.metadataAccess.loadEncryptionKey(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const { group, head: expectedHead } = await commitCreatedGroupToDirectory({
+        ...input,
+        externalAdminPolicy,
+        readEncryptedName: input.metadataAccess.readName,
+        request,
+    });
+    await cacheGroupPolicy({
+        acknowledgedMemberEnvelopes: {
+            envelopes: request.initialGroupPolicy.memberEnvelopes,
+            epoch: request.initialGroupPolicy.state.keyEpoch,
+            principalId: request.groupId,
+            principalType: "group",
+            stateHash: expectedHead.stateHash,
+        },
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        expectedCurrentHead: expectedHead,
+        externalAuthority: externalAdminPolicy.externalAuthority,
+        groupId: group.groupId,
+        localPolicyCheckpoint: {
+            principalId: request.groupId,
+            principalType: "group",
+            stateHash: expectedHead.stateHash,
+            version: expectedHead.version,
+        },
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    return { ...group, name: input.name.trim(), nameUnreadable: false };
+}
+//# sourceMappingURL=groupCreation.js.map

package/workflows/organizations/groupCreation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupCreation.js","sourceRoot":"","sources":["groupCreation.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAExF,OAAO,EACL,gBAAgB,GAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAY7C;IACC,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,WAAW;QACpE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;QAC3D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACxE,GAAG,KAAK;QACR,mBAAmB;QACnB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ;QAChD,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,eAAe;YACrD,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ;YAChD,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport type { createGroupMetadataAccess } from \"./groupMetadataAccess\";\nimport {\n  cacheGroupPolicy,\n  type OrganizationPrincipalPolicyApi,\n} from \"./groupPolicyMutationContext\";\nimport { commitCreatedGroupToDirectory } from \"./organizationGroupDirectory\";\nimport { buildInitialGroupPolicyRequest } from \"./principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"./readModel\";\n\nexport async function createOrganizationGroup(input: {\n  readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n  readonly apiClient: OrganizationPrincipalPolicyApi;\n  readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n  readonly execSql: ExecSql;\n  readonly name: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<OrganizationGroupSummary> {\n  const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    execSql: input.execSql,\n    getCurrentPrincipalPolicy: (principalType, principalId) =>\n      input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!externalAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  if (!externalAdminPolicy.signerUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const request = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.creatorEncapsulationKeyPair,\n    externalAuthority: externalAdminPolicy.externalAuthority.currentHead,\n    groupId: crypto.randomUUID(),\n    includeSignerAsAdmin: false,\n    name: input.name,\n    metadataKey: await input.metadataAccess.loadEncryptionKey(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const { group, head: expectedHead } = await commitCreatedGroupToDirectory({\n    ...input,\n    externalAdminPolicy,\n    readEncryptedName: input.metadataAccess.readName,\n    request,\n  });\n\n  await cacheGroupPolicy({\n    acknowledgedMemberEnvelopes: {\n      envelopes: request.initialGroupPolicy.memberEnvelopes,\n      epoch: request.initialGroupPolicy.state.keyEpoch,\n      principalId: request.groupId,\n      principalType: \"group\",\n      stateHash: expectedHead.stateHash,\n    },\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedCurrentHead: expectedHead,\n    externalAuthority: externalAdminPolicy.externalAuthority,\n    groupId: group.groupId,\n    localPolicyCheckpoint: {\n      principalId: request.groupId,\n      principalType: \"group\",\n      stateHash: expectedHead.stateHash,\n      version: expectedHead.version,\n    },\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  return { ...group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}

package/workflows/organizations/groupMembershipName.d.ts

@@ -0,0 +1,8 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import { type GroupPolicyNameReader } from "./principalPolicyRequest.js";
+export declare class GroupMembershipNameMismatchError extends KeyingVerificationError {
+    constructor(reason: "forbidden_characters" | "name_mismatch");
+}
+/** Check the selected label only after verifying the signed policy bundle. */
+export declare function assertGroupMembershipName(verifiedBundle: PrincipalPolicyBundleResponse, expectedGroupName: string, readEncryptedName?: GroupPolicyNameReader): Promise<void>;

package/workflows/organizations/groupMembershipName.js

@@ -0,0 +1,18 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { groupPolicyNameMismatch, } from "./principalPolicyRequest.js";
+export class GroupMembershipNameMismatchError extends KeyingVerificationError {
+    constructor(reason) {
+        super("object_mismatch", reason === "forbidden_characters"
+            ? "Group membership name contains forbidden control or format characters"
+            : "Group membership name does not match the signed group policy");
+        this.name = "GroupMembershipNameMismatchError";
+    }
+}
+/** Check the selected label only after verifying the signed policy bundle. */
+export async function assertGroupMembershipName(verifiedBundle, expectedGroupName, readEncryptedName) {
+    const mismatch = await groupPolicyNameMismatch(verifiedBundle, expectedGroupName, readEncryptedName);
+    if (mismatch) {
+        throw new GroupMembershipNameMismatchError(mismatch);
+    }
+}
+//# sourceMappingURL=groupMembershipName.js.map

package/workflows/organizations/groupMembershipName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMembershipName.js","sourceRoot":"","sources":["groupMembershipName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAEL,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,OAAO,gCAAiC,SAAQ,uBAAuB;IAC3E,YAAY,MAAgD;QAC1D,KAAK,CACH,iBAAiB,EACjB,MAAM,KAAK,sBAAsB;YAC/B,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,8DAA8D,CACnE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAA6C,EAC7C,iBAAyB,EACzB,iBAAyC;IAEzC,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,cAAc,EACd,iBAAiB,EACjB,iBAAiB,CAClB,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"./principalPolicyRequest\";\n\nexport class GroupMembershipNameMismatchError extends KeyingVerificationError {\n  constructor(reason: \"forbidden_characters\" | \"name_mismatch\") {\n    super(\n      \"object_mismatch\",\n      reason === \"forbidden_characters\"\n        ? \"Group membership name contains forbidden control or format characters\"\n        : \"Group membership name does not match the signed group policy\",\n    );\n    this.name = \"GroupMembershipNameMismatchError\";\n  }\n}\n\n/** Check the selected label only after verifying the signed policy bundle. */\nexport async function assertGroupMembershipName(\n  verifiedBundle: PrincipalPolicyBundleResponse,\n  expectedGroupName: string,\n  readEncryptedName?: GroupPolicyNameReader,\n): Promise<void> {\n  const mismatch = await groupPolicyNameMismatch(\n    verifiedBundle,\n    expectedGroupName,\n    readEncryptedName,\n  );\n  if (mismatch) {\n    throw new GroupMembershipNameMismatchError(mismatch);\n  }\n}\n"]}