@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/organizations/organizationGroupNames.js

@@ -0,0 +1,53 @@
+import { saveOrganizationGroupDisplayNames } from "../../data/persistence/organizations/organizationGroupNamePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { verifyDirectoryGroup, } from "./groupNameUniqueness.js";
+import { loadGroupNameDirectoryAuthority } from "./organizationGroupNamePolicies.js";
+/** Verify names against the signed directory before projecting decrypted labels. */
+export async function hydrateOrganizationGroupNames(input) {
+    const authority = await loadGroupNameDirectoryAuthority(input);
+    if (!authority)
+        throw new Error("Group directory authority is unavailable");
+    const names = [];
+    const unreadableGroupIds = new Set();
+    for (const group of input.directory.groups) {
+        const head = authority.descriptor.groupHeads.find((head) => head.principalId === group.groupId);
+        if (!head || head.stateHash !== group.currentState?.stateHash)
+            throw new Error("Group listing does not match the signed directory");
+        const verified = await verifyDirectoryGroup({
+            ...input,
+            descriptor: authority.descriptor,
+            externalAuthority: authority.externalAuthority,
+        }, head);
+        // An undecryptable name stays blank for its group alone, and is flagged so
+        // the group is never offered for selection by name.
+        if (verified.name === null) {
+            unreadableGroupIds.add(group.groupId);
+        }
+        else {
+            names.push({
+                groupId: group.groupId,
+                name: verified.name,
+                stateHash: head.stateHash,
+            });
+        }
+        await retainVerifiedPrincipalPolicyBundle({
+            ...input,
+            bundle: verified.bundle,
+            policy: verified.policy,
+            updatedAt: new Date().toISOString(),
+        });
+    }
+    if (!input.stillCurrent())
+        throw new Error("Group directory access changed");
+    await saveOrganizationGroupDisplayNames({ ...input, names });
+    const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));
+    return {
+        ...input.directory,
+        groups: input.directory.groups.map((group) => ({
+            ...group,
+            name: byId.get(group.groupId) ?? "",
+            nameUnreadable: unreadableGroupIds.has(group.groupId),
+        })),
+    };
+}
+//# sourceMappingURL=organizationGroupNames.js.map

package/workflows/organizations/organizationGroupNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationGroupNames.js","sourceRoot":"","sources":["organizationGroupNames.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAEL,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAGlF,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAIC;IAED,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC5E,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,EACD,IAAI,CACL,CAAC;QACF,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,mCAAmC,CAAC;YACxC,GAAG,KAAK;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7E,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { saveOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  type DirectoryGroupWalkInput,\n  verifyDirectoryGroup,\n} from \"./groupNameUniqueness\";\nimport { loadGroupNameDirectoryAuthority } from \"./organizationGroupNamePolicies\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\n/** Verify names against the signed directory before projecting decrypted labels. */\nexport async function hydrateOrganizationGroupNames(\n  input: Omit<DirectoryGroupWalkInput, \"descriptor\" | \"externalAuthority\"> & {\n    readonly directory: OrganizationDirectoryAndGroups;\n    readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n    readonly stillCurrent: () => boolean;\n  },\n): Promise<OrganizationDirectoryAndGroups> {\n  const authority = await loadGroupNameDirectoryAuthority(input);\n  if (!authority) throw new Error(\"Group directory authority is unavailable\");\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadableGroupIds = new Set<string>();\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await verifyDirectoryGroup(\n      {\n        ...input,\n        descriptor: authority.descriptor,\n        externalAuthority: authority.externalAuthority,\n      },\n      head,\n    );\n    // An undecryptable name stays blank for its group alone, and is flagged so\n    // the group is never offered for selection by name.\n    if (verified.name === null) {\n      unreadableGroupIds.add(group.groupId);\n    } else {\n      names.push({\n        groupId: group.groupId,\n        name: verified.name,\n        stateHash: head.stateHash,\n      });\n    }\n    await retainVerifiedPrincipalPolicyBundle({\n      ...input,\n      bundle: verified.bundle,\n      policy: verified.policy,\n      updatedAt: new Date().toISOString(),\n    });\n  }\n  if (!input.stillCurrent()) throw new Error(\"Group directory access changed\");\n  await saveOrganizationGroupDisplayNames({ ...input, names });\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadableGroupIds.has(group.groupId),\n    })),\n  };\n}\n"]}

package/workflows/organizations/organizationPolicyHistoryDetails.js

@@ -0,0 +1,88 @@
+import { verifyOrganizationPolicyHistory } from "./organizationPolicyHistoryVerification.js";
+import { buildOrganizationPolicyHistory, diffPrincipalProjectionMembers, } from "./policyHistoryReadModel.js";
+function diffGrants(previous, current) {
+    const before = new Map(previous.map((grant) => [grant.containerId, grant.accessLevel]));
+    const after = new Map(current.map((grant) => [grant.containerId, grant.accessLevel]));
+    return [...new Set([...before.keys(), ...after.keys()])]
+        .sort()
+        .flatMap((containerId) => {
+        const previousAccess = before.get(containerId) ?? null;
+        const nextAccess = after.get(containerId) ?? null;
+        return previousAccess === nextAccess
+            ? []
+            : [{ containerId, previousAccess, nextAccess }];
+    });
+}
+function describeGroupChange(previous, current, groupState) {
+    const head = current ?? previous;
+    if (!head)
+        throw new Error("Group change has no state");
+    const oldEntry = previous ? groupState(previous) : null;
+    const newEntry = current ? groupState(current) : null;
+    return {
+        groupId: head.principalId,
+        changeType: !previous ? "created" : !current ? "deleted" : "updated",
+        previousVersion: previous?.version ?? null,
+        version: head.version,
+        previousKeyEpoch: previous?.keyEpoch ?? null,
+        keyEpoch: head.keyEpoch,
+        changes: newEntry
+            ? diffPrincipalProjectionMembers({
+                previous: oldEntry?.projection ?? [],
+                current: newEntry.projection,
+            })
+            : [],
+        grantChanges: newEntry
+            ? diffGrants(oldEntry?.grants ?? [], newEntry.grants)
+            : [],
+    };
+}
+function diffGroups(previousHeads, heads, groupState) {
+    const before = new Map(previousHeads.map((head) => [head.principalId, head]));
+    const after = new Map(heads.map((head) => [head.principalId, head]));
+    const changes = [];
+    for (const groupId of [
+        ...new Set([...before.keys(), ...after.keys()]),
+    ].sort()) {
+        const previous = before.get(groupId);
+        const current = after.get(groupId);
+        if (previous?.stateHash === current?.stateHash)
+            continue;
+        changes.push(describeGroupChange(previous, current, groupState));
+    }
+    return changes;
+}
+/** Derived in memory; names remain in their existing encrypted sources. */
+export async function buildDetailedOrganizationPolicyHistory(input) {
+    const { descriptors, groups } = await verifyOrganizationPolicyHistory(input);
+    const states = [
+        ...input.bundle.previousStates.map((entry) => entry.state),
+        input.bundle.currentState,
+    ].sort((a, b) => a.version - b.version);
+    const groupState = (head) => {
+        const entry = groups
+            .find((group) => group.principalId === head.principalId)
+            ?.history.find((entry) => entry.state.stateHash === head.stateHash);
+        if (!entry)
+            throw new Error("Verified group history state is missing");
+        return entry;
+    };
+    const byState = new Map();
+    let previousHeads = [];
+    for (const state of states) {
+        const heads = descriptors.get(state.stateHash)?.groupHeads;
+        if (!heads)
+            throw new Error("Verified organization directory is missing");
+        byState.set(state.stateHash, diffGroups(previousHeads, heads, groupState));
+        previousHeads = heads;
+    }
+    const history = buildOrganizationPolicyHistory(input.bundle);
+    return {
+        ...history,
+        entries: history.entries.map((entry) => ({
+            ...entry,
+            groupChanges: byState.get(entry.stateHash) ?? [],
+        })),
+    };
+}
+//# sourceMappingURL=organizationPolicyHistoryDetails.js.map

package/workflows/organizations/organizationPolicyHistoryDetails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationPolicyHistoryDetails.js","sourceRoot":"","sources":["organizationPolicyHistoryDetails.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC1F,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAE/B,MAAM,0BAA0B,CAAC;AAMlC,SAAS,UAAU,CACjB,QAA4C,EAC5C,OAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAC/D,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACrD,IAAI,EAAE;SACN,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACvB,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAClD,OAAO,cAAc,KAAK,UAAU;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA2C,EAC3C,OAA0C,EAC1C,UAA2E;IAE3E,MAAM,IAAI,GAAG,OAAO,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,WAAW;QACzB,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpE,eAAe,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI;QAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,QAAQ;YACf,CAAC,CAAC,8BAA8B,CAAC;gBAC7B,QAAQ,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;gBACpC,OAAO,EAAE,QAAQ,CAAC,UAAU;aAC7B,CAAC;YACJ,CAAC,CAAC,EAAE;QACN,YAAY,EAAE,QAAQ;YACpB,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC;YACrD,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,aAA+C,EAC/C,KAAuC,EACvC,UAA2E;IAE3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,KAAK,MAAM,OAAO,IAAI;QACpB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;KAChD,CAAC,IAAI,EAAE,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,SAAS,KAAK,OAAO,EAAE,SAAS;YAAE,SAAS;QACzD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA4D;IAE5D,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY;KAC1B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,CACjB,IAA2B,EACK,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM;aACjB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC;YACxD,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,IAAI,aAAa,GAAqC,EAAE,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3E,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,GAAG,KAAK;YACR,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE;SACjD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  PrincipalContainerGrant,\n  PrincipalPolicyStateChainEntry,\n} from \"@tearleads/crypto\";\nimport type { OrganizationGroupHead } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { verifyOrganizationPolicyHistory } from \"./organizationPolicyHistoryVerification\";\nimport {\n  buildOrganizationPolicyHistory,\n  diffPrincipalProjectionMembers,\n  type OrganizationPolicyHistory,\n} from \"./policyHistoryReadModel\";\nimport type {\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n} from \"./policyHistoryTypes\";\n\nfunction diffGrants(\n  previous: readonly PrincipalContainerGrant[],\n  current: readonly PrincipalContainerGrant[],\n): OrganizationPolicyGrantChange[] {\n  const before = new Map(\n    previous.map((grant) => [grant.containerId, grant.accessLevel]),\n  );\n  const after = new Map(\n    current.map((grant) => [grant.containerId, grant.accessLevel]),\n  );\n  return [...new Set([...before.keys(), ...after.keys()])]\n    .sort()\n    .flatMap((containerId) => {\n      const previousAccess = before.get(containerId) ?? null;\n      const nextAccess = after.get(containerId) ?? null;\n      return previousAccess === nextAccess\n        ? []\n        : [{ containerId, previousAccess, nextAccess }];\n    });\n}\n\nfunction describeGroupChange(\n  previous: OrganizationGroupHead | undefined,\n  current: OrganizationGroupHead | undefined,\n  groupState: (head: OrganizationGroupHead) => PrincipalPolicyStateChainEntry,\n): OrganizationPolicyGroupChange {\n  const head = current ?? previous;\n  if (!head) throw new Error(\"Group change has no state\");\n  const oldEntry = previous ? groupState(previous) : null;\n  const newEntry = current ? groupState(current) : null;\n  return {\n    groupId: head.principalId,\n    changeType: !previous ? \"created\" : !current ? \"deleted\" : \"updated\",\n    previousVersion: previous?.version ?? null,\n    version: head.version,\n    previousKeyEpoch: previous?.keyEpoch ?? null,\n    keyEpoch: head.keyEpoch,\n    changes: newEntry\n      ? diffPrincipalProjectionMembers({\n          previous: oldEntry?.projection ?? [],\n          current: newEntry.projection,\n        })\n      : [],\n    grantChanges: newEntry\n      ? diffGrants(oldEntry?.grants ?? [], newEntry.grants)\n      : [],\n  };\n}\n\nfunction diffGroups(\n  previousHeads: readonly OrganizationGroupHead[],\n  heads: readonly OrganizationGroupHead[],\n  groupState: (head: OrganizationGroupHead) => PrincipalPolicyStateChainEntry,\n): OrganizationPolicyGroupChange[] {\n  const before = new Map(previousHeads.map((head) => [head.principalId, head]));\n  const after = new Map(heads.map((head) => [head.principalId, head]));\n  const changes: OrganizationPolicyGroupChange[] = [];\n  for (const groupId of [\n    ...new Set([...before.keys(), ...after.keys()]),\n  ].sort()) {\n    const previous = before.get(groupId);\n    const current = after.get(groupId);\n    if (previous?.stateHash === current?.stateHash) continue;\n    changes.push(describeGroupChange(previous, current, groupState));\n  }\n  return changes;\n}\n\n/** Derived in memory; names remain in their existing encrypted sources. */\nexport async function buildDetailedOrganizationPolicyHistory(\n  input: Parameters<typeof verifyOrganizationPolicyHistory>[0],\n): Promise<OrganizationPolicyHistory> {\n  const { descriptors, groups } = await verifyOrganizationPolicyHistory(input);\n  const states = [\n    ...input.bundle.previousStates.map((entry) => entry.state),\n    input.bundle.currentState,\n  ].sort((a, b) => a.version - b.version);\n  const groupState = (\n    head: OrganizationGroupHead,\n  ): PrincipalPolicyStateChainEntry => {\n    const entry = groups\n      .find((group) => group.principalId === head.principalId)\n      ?.history.find((entry) => entry.state.stateHash === head.stateHash);\n    if (!entry) throw new Error(\"Verified group history state is missing\");\n    return entry;\n  };\n  const byState = new Map<string, OrganizationPolicyGroupChange[]>();\n  let previousHeads: readonly OrganizationGroupHead[] = [];\n  for (const state of states) {\n    const heads = descriptors.get(state.stateHash)?.groupHeads;\n    if (!heads) throw new Error(\"Verified organization directory is missing\");\n    byState.set(state.stateHash, diffGroups(previousHeads, heads, groupState));\n    previousHeads = heads;\n  }\n  const history = buildOrganizationPolicyHistory(input.bundle);\n  return {\n    ...history,\n    entries: history.entries.map((entry) => ({\n      ...entry,\n      groupChanges: byState.get(entry.stateHash) ?? [],\n    })),\n  };\n}\n"]}

package/workflows/organizations/organizationPolicyHistoryVerification.js

@@ -0,0 +1,80 @@
+import { computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { verifyPrincipalPolicySnapshots } from "../../data/keyingProjectionVerification/principalPolicySnapshotVerification.js";
+import { parseOrganizationAuthorityDescriptor, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { verifyOrganizationAdminPolicy } from "../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../principals/policyVerification.js";
+function reject(message, code = "hash_mismatch") {
+    throw new KeyingVerificationError(code, `Organization policy history: ${message}`);
+}
+async function verifyDirectoryPayloads(bundle, evidence, organizationId) {
+    const states = [
+        ...bundle.previousStates.map((entry) => entry.state),
+        bundle.currentState,
+    ];
+    if (evidence.organizationPayloads.length !== states.length)
+        reject("directory history is incomplete", "invalid_shape");
+    const descriptors = new Map();
+    for (const payload of evidence.organizationPayloads) {
+        const state = states.find((candidate) => candidate.stateHash === payload.stateHash);
+        if (!state ||
+            descriptors.has(payload.stateHash) ||
+            payload.principalType !== "organization" ||
+            payload.principalId !== organizationId)
+            reject("directory payload scope is invalid", "object_mismatch");
+        const hash = await computePrincipalStatePayloadCiphertextHash(payload.ciphertext);
+        if (hash !== state.payloadCiphertextHash || hash !== payload.ciphertextHash)
+            reject("directory payload does not match its signed hash");
+        const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);
+        if (descriptor.organizationId !== organizationId)
+            reject("directory belongs to another organization", "object_mismatch");
+        descriptors.set(state.stateHash, descriptor);
+    }
+    return descriptors;
+}
+/** All returned data is authenticated against the already selected organization head. */
+export async function verifyOrganizationPolicyHistory(input) {
+    const { bundle, evidence, organizationId } = input;
+    if (evidence.organizationId !== organizationId ||
+        evidence.stateHash !== bundle.currentState.stateHash)
+        reject("response does not match the requested organization head", "object_mismatch");
+    const keys = await collectPrincipalPolicySignerPublicKeys(input);
+    if ("error" in keys) {
+        if (keys.error === "not-found")
+            throw new ProjectionDependencyUnavailableError("Organization policy history signer identity is unavailable");
+        reject("signer fingerprint does not match", "signer_mismatch");
+    }
+    const verified = await verifyOrganizationAdminPolicy({
+        ...input,
+        signerPublicKeys: keys.signerPublicKeys,
+    });
+    if (!verified.ok)
+        throw verified.error;
+    const descriptors = await verifyDirectoryPayloads(bundle, evidence, organizationId);
+    // These are historical display proofs, authenticated by the selected
+    // organization chain. They never advance a group's current-policy checkpoint.
+    const groups = await verifyPrincipalPolicySnapshots({
+        resolveUserKey: input.resolveTrustedUserIdentity,
+        snapshots: evidence.groups,
+    });
+    const expectedGroups = new Set();
+    for (const descriptor of descriptors.values()) {
+        for (const reference of descriptor.groupHeads) {
+            expectedGroups.add(reference.principalId);
+            const policy = groups.find((group) => group.principalType === "group" &&
+                group.principalId === reference.principalId);
+            if (!policy || !principalPolicyMatchesReference({ policy, reference }))
+                reject("group history does not match the signed directory");
+        }
+    }
+    if (groups.length !== expectedGroups.size)
+        reject("unexpected group history", "invalid_shape");
+    for (const group of groups) {
+        const heads = [...descriptors.values()].flatMap((descriptor) => descriptor.groupHeads.filter((head) => head.principalId === group.principalId));
+        const latest = heads.reduce((left, right) => left.version > right.version ? left : right);
+        if (group.stateHash !== latest.stateHash)
+            reject("group history extends beyond the selected organization head");
+    }
+    return { descriptors, groups };
+}
+//# sourceMappingURL=organizationPolicyHistoryVerification.js.map

package/workflows/organizations/organizationPolicyHistoryVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationPolicyHistoryVerification.js","sourceRoot":"","sources":["organizationPolicyHistoryVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,EAE1C,uBAAuB,EAEvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,8BAA8B,EAAE,MAAM,6EAA6E,CAAC;AAC7H,OAAO,EAEL,oCAAoC,GACrC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAElG,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAE1F,SAAS,MAAM,CACb,OAAe,EACf,OAA+B,eAAe;IAE9C,MAAM,IAAI,uBAAuB,CAC/B,IAAI,EACJ,gCAAgC,OAAO,EAAE,CAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,MAAqC,EACrC,QAA2C,EAC3C,cAAsB;IAEtB,MAAM,MAAM,GAAG;QACb,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,MAAM,CAAC,YAAY;KACpB,CAAC;IACF,IAAI,QAAQ,CAAC,oBAAoB,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QACxD,MAAM,CAAC,iCAAiC,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2C,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CACzD,CAAC;QACF,IACE,CAAC,KAAK;YACN,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;YAClC,OAAO,CAAC,aAAa,KAAK,cAAc;YACxC,OAAO,CAAC,WAAW,KAAK,cAAc;YAEtC,MAAM,CAAC,oCAAoC,EAAE,iBAAiB,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,IAAI,KAAK,KAAK,CAAC,qBAAqB,IAAI,IAAI,KAAK,OAAO,CAAC,cAAc;YACzE,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,oCAAoC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,cAAc,KAAK,cAAc;YAC9C,MAAM,CAAC,2CAA2C,EAAE,iBAAiB,CAAC,CAAC;QACzE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IACnD,IACE,QAAQ,CAAC,cAAc,KAAK,cAAc;QAC1C,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS;QAEpD,MAAM,CACJ,yDAAyD,EACzD,iBAAiB,CAClB,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;YAC5B,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;QACJ,MAAM,CAAC,mCAAmC,EAAE,iBAAiB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,GAAG,KAAK;QACR,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAC/C,MAAM,EACN,QAAQ,EACR,cAAc,CACf,CAAC;IACF,qEAAqE;IACrE,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;QAClD,cAAc,EAAE,KAAK,CAAC,0BAA0B;QAChD,SAAS,EAAE,QAAQ,CAAC,MAAM;KAC3B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9C,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,OAAO;gBAC/B,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAC9C,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACpE,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI;QACvC,MAAM,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC7D,UAAU,CAAC,UAAU,CAAC,MAAM,CAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACjD,CACF,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAC5C,CAAC;QACF,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YACtC,MAAM,CAAC,6DAA6D,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import {\n  computePrincipalStatePayloadCiphertextHash,\n  type KeyingVerificationCode,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  principalPolicyMatchesReference,\n} from \"@tearleads/crypto\";\nimport type {\n  OrganizationPolicyHistoryResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { verifyPrincipalPolicySnapshots } from \"../../data/keyingProjectionVerification/principalPolicySnapshotVerification\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { verifyOrganizationAdminPolicy } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\n\nfunction reject(\n  message: string,\n  code: KeyingVerificationCode = \"hash_mismatch\",\n): never {\n  throw new KeyingVerificationError(\n    code,\n    `Organization policy history: ${message}`,\n  );\n}\n\nasync function verifyDirectoryPayloads(\n  bundle: PrincipalPolicyBundleResponse,\n  evidence: OrganizationPolicyHistoryResponse,\n  organizationId: string,\n) {\n  const states = [\n    ...bundle.previousStates.map((entry) => entry.state),\n    bundle.currentState,\n  ];\n  if (evidence.organizationPayloads.length !== states.length)\n    reject(\"directory history is incomplete\", \"invalid_shape\");\n  const descriptors = new Map<string, OrganizationAuthorityDescriptor>();\n  for (const payload of evidence.organizationPayloads) {\n    const state = states.find(\n      (candidate) => candidate.stateHash === payload.stateHash,\n    );\n    if (\n      !state ||\n      descriptors.has(payload.stateHash) ||\n      payload.principalType !== \"organization\" ||\n      payload.principalId !== organizationId\n    )\n      reject(\"directory payload scope is invalid\", \"object_mismatch\");\n    const hash = await computePrincipalStatePayloadCiphertextHash(\n      payload.ciphertext,\n    );\n    if (hash !== state.payloadCiphertextHash || hash !== payload.ciphertextHash)\n      reject(\"directory payload does not match its signed hash\");\n    const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);\n    if (descriptor.organizationId !== organizationId)\n      reject(\"directory belongs to another organization\", \"object_mismatch\");\n    descriptors.set(state.stateHash, descriptor);\n  }\n  return descriptors;\n}\n\n/** All returned data is authenticated against the already selected organization head. */\nexport async function verifyOrganizationPolicyHistory(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  evidence: OrganizationPolicyHistoryResponse;\n  organizationId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}) {\n  const { bundle, evidence, organizationId } = input;\n  if (\n    evidence.organizationId !== organizationId ||\n    evidence.stateHash !== bundle.currentState.stateHash\n  )\n    reject(\n      \"response does not match the requested organization head\",\n      \"object_mismatch\",\n    );\n  const keys = await collectPrincipalPolicySignerPublicKeys(input);\n  if (\"error\" in keys) {\n    if (keys.error === \"not-found\")\n      throw new ProjectionDependencyUnavailableError(\n        \"Organization policy history signer identity is unavailable\",\n      );\n    reject(\"signer fingerprint does not match\", \"signer_mismatch\");\n  }\n  const verified = await verifyOrganizationAdminPolicy({\n    ...input,\n    signerPublicKeys: keys.signerPublicKeys,\n  });\n  if (!verified.ok) throw verified.error;\n  const descriptors = await verifyDirectoryPayloads(\n    bundle,\n    evidence,\n    organizationId,\n  );\n  // These are historical display proofs, authenticated by the selected\n  // organization chain. They never advance a group's current-policy checkpoint.\n  const groups = await verifyPrincipalPolicySnapshots({\n    resolveUserKey: input.resolveTrustedUserIdentity,\n    snapshots: evidence.groups,\n  });\n  const expectedGroups = new Set<string>();\n  for (const descriptor of descriptors.values()) {\n    for (const reference of descriptor.groupHeads) {\n      expectedGroups.add(reference.principalId);\n      const policy = groups.find(\n        (group) =>\n          group.principalType === \"group\" &&\n          group.principalId === reference.principalId,\n      );\n      if (!policy || !principalPolicyMatchesReference({ policy, reference }))\n        reject(\"group history does not match the signed directory\");\n    }\n  }\n  if (groups.length !== expectedGroups.size)\n    reject(\"unexpected group history\", \"invalid_shape\");\n  for (const group of groups) {\n    const heads = [...descriptors.values()].flatMap((descriptor) =>\n      descriptor.groupHeads.filter(\n        (head) => head.principalId === group.principalId,\n      ),\n    );\n    const latest = heads.reduce((left, right) =>\n      left.version > right.version ? left : right,\n    );\n    if (group.stateHash !== latest.stateHash)\n      reject(\"group history extends beyond the selected organization head\");\n  }\n  return { descriptors, groups };\n}\n"]}

package/workflows/organizations/organizationPresentationAccessState.js

@@ -0,0 +1,173 @@
+import { hasOrganizationPresentationDenial } from "../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
+const accessByExecutor = new WeakMap();
+export function organizationAccessScopeKey(organizationId, requesterUserId) {
+    return JSON.stringify([organizationId, requesterUserId]);
+}
+function accessExecutorState(execSql) {
+    let state = accessByExecutor.get(execSql);
+    if (!state) {
+        state = {
+            generationByOrganization: new Map(),
+            resetDepthByOrganization: new Map(),
+            scopes: new Map(),
+        };
+        accessByExecutor.set(execSql, state);
+    }
+    return state;
+}
+function newProjectionState(denied) {
+    return { denied, deniedByServer: false, generation: 0 };
+}
+function organizationResetDepth(executor, organizationId) {
+    return executor.resetDepthByOrganization.get(organizationId) ?? 0;
+}
+function organizationGeneration(executor, organizationId) {
+    return executor.generationByOrganization.get(organizationId) ?? 0;
+}
+function accessScopeState(executor, organizationId, requesterUserId) {
+    const key = organizationAccessScopeKey(organizationId, requesterUserId);
+    let scope = executor.scopes.get(key);
+    if (!scope) {
+        const denied = organizationResetDepth(executor, organizationId) > 0;
+        scope = {
+            organizationId,
+            readModel: newProjectionState(denied),
+            usage: newProjectionState(denied),
+        };
+        executor.scopes.set(key, scope);
+    }
+    return scope;
+}
+function projectionState(scope, projection) {
+    return scope[projection];
+}
+export function captureOrganizationPresentationAccessAttempt(input, projection) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), projection);
+    return {
+        executorGeneration: organizationGeneration(executor, input.organizationId),
+        projection,
+        projectionGeneration: state.generation,
+        startedDenied: state.denied,
+        startedDuringReset: organizationResetDepth(executor, input.organizationId) > 0,
+    };
+}
+export function isOrganizationPresentationAccessAttemptCurrent(input, attempt) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), attempt.projection);
+    return (!attempt.startedDuringReset &&
+        organizationResetDepth(executor, input.organizationId) === 0 &&
+        organizationGeneration(executor, input.organizationId) ===
+            attempt.executorGeneration &&
+        state.generation === attempt.projectionGeneration);
+}
+export function isOrganizationPresentationAccessReadable(input, projection) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), projection);
+    return (organizationResetDepth(executor, input.organizationId) === 0 &&
+        !state.denied);
+}
+export function denyOrganizationPresentationAccess(input, projections) {
+    const executor = accessExecutorState(input.execSql);
+    const scope = accessScopeState(executor, input.organizationId, input.requesterUserId);
+    for (const projection of new Set(projections)) {
+        const state = projectionState(scope, projection);
+        state.denied = true;
+        state.deniedByServer = true;
+        state.generation += 1;
+    }
+}
+/**
+ * Whether the scope's projection is currently denied because the server
+ * refused it (as opposed to a local session reset). The flip back to readable
+ * after this returns true is the "org access was just restored" edge.
+ */
+export function wasOrganizationPresentationAccessDeniedByServer(input, projection) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), projection);
+    return state.denied && state.deniedByServer;
+}
+export function restoreOrganizationPresentationAccess(input, attempt) {
+    if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {
+        return false;
+    }
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), attempt.projection);
+    state.denied = false;
+    state.deniedByServer = false;
+    return true;
+}
+export async function runOrganizationPresentationRead(input, projection, operation) {
+    const attempt = captureOrganizationPresentationAccessAttempt(input, projection);
+    if (!isOrganizationPresentationAccessReadable(input, projection)) {
+        return null;
+    }
+    // In-memory denial dies with the process. The durable marker keeps a
+    // revoked projection unreadable when its purge failed and the app
+    // restarted; a successful reconcile clears it.
+    if (await hasOrganizationPresentationDenial(input, projection)) {
+        return null;
+    }
+    const value = await operation();
+    return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&
+        isOrganizationPresentationAccessReadable(input, projection)
+        ? value
+        : null;
+}
+function beginOrganizationPresentationAccessReset(execSql, organizationId) {
+    const executor = accessExecutorState(execSql);
+    executor.generationByOrganization.set(organizationId, organizationGeneration(executor, organizationId) + 1);
+    executor.resetDepthByOrganization.set(organizationId, organizationResetDepth(executor, organizationId) + 1);
+    for (const scope of executor.scopes.values()) {
+        if (scope.organizationId !== organizationId)
+            continue;
+        // A reset denies presentation locally but is not a server denial: the next
+        // session re-derives server state, and startup sync already re-drives the
+        // lanes, so the lost-access memory must not survive into it.
+        scope.readModel.denied = true;
+        scope.readModel.deniedByServer = false;
+        scope.usage.denied = true;
+        scope.usage.deniedByServer = false;
+    }
+}
+function finishOrganizationPresentationAccessReset(execSql, organizationId) {
+    const executor = accessExecutorState(execSql);
+    const nextDepth = Math.max(0, organizationResetDepth(executor, organizationId) - 1);
+    if (nextDepth === 0) {
+        executor.resetDepthByOrganization.delete(organizationId);
+    }
+    else {
+        executor.resetDepthByOrganization.set(organizationId, nextDepth);
+    }
+}
+export async function runOrganizationPresentationMutation(execSql, operation) {
+    const executor = accessExecutorState(execSql);
+    const previous = executor.mutationQueue ?? Promise.resolve();
+    let releaseCurrent = () => { };
+    const current = new Promise((resolve) => {
+        releaseCurrent = resolve;
+    });
+    const waitForPrevious = previous.catch(() => undefined);
+    const queuedCurrent = waitForPrevious.then(() => current);
+    executor.mutationQueue = queuedCurrent;
+    await waitForPrevious;
+    try {
+        return await operation();
+    }
+    finally {
+        releaseCurrent();
+        if (executor.mutationQueue === queuedCurrent) {
+            executor.mutationQueue = undefined;
+        }
+    }
+}
+export async function runOrganizationPresentationReset(execSql, organizationId, operation) {
+    beginOrganizationPresentationAccessReset(execSql, organizationId);
+    try {
+        return await runOrganizationPresentationMutation(execSql, operation);
+    }
+    finally {
+        finishOrganizationPresentationAccessReset(execSql, organizationId);
+    }
+}
+//# sourceMappingURL=organizationPresentationAccessState.js.map

package/workflows/organizations/organizationPresentationAccessState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationPresentationAccessState.js","sourceRoot":"","sources":["organizationPresentationAccessState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,gFAAgF,CAAC;AA4CnI,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAgC,CAAC;AAErE,MAAM,UAAU,0BAA0B,CACxC,cAAsB,EACtB,eAAuB;IAEvB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG;YACN,wBAAwB,EAAE,IAAI,GAAG,EAAE;YACnC,wBAAwB,EAAE,IAAI,GAAG,EAAE;YACnC,MAAM,EAAE,IAAI,GAAG,EAAE;SAClB,CAAC;QACF,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IACzC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,cAAsB;IAEtB,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,cAAsB;IAEtB,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA6B,EAC7B,cAAsB,EACtB,eAAuB;IAEvB,MAAM,GAAG,GAAG,0BAA0B,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,GAAG;YACN,cAAc;YACd,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrC,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC;SAClC,CAAC;QACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,KAAuB,EACvB,UAA8C;IAE9C,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,KAA0C,EAC1C,UAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,UAAU,CACX,CAAC;IACF,OAAO;QACL,kBAAkB,EAAE,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC;QAC1E,UAAU;QACV,oBAAoB,EAAE,KAAK,CAAC,UAAU;QACtC,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,kBAAkB,EAChB,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,KAA0C,EAC1C,OAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,OAAO,CACL,CAAC,OAAO,CAAC,kBAAkB;QAC3B,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;QAC5D,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC;YACpD,OAAO,CAAC,kBAAkB;QAC5B,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,KAA0C,EAC1C,UAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,UAAU,CACX,CAAC;IACF,OAAO,CACL,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;QAC5D,CAAC,KAAK,CAAC,MAAM,CACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAA0C,EAC1C,WAA0D;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,gBAAgB,CAC5B,QAAQ,EACR,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC5B,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+CAA+C,CAC7D,KAA0C,EAC1C,UAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,UAAU,CACX,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,KAA0C,EAC1C,OAA8C;IAE9C,IAAI,CAAC,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA0C,EAC1C,UAA8C,EAC9C,SAA2B;IAE3B,MAAM,OAAO,GAAG,4CAA4C,CAC1D,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,CAAC,wCAAwC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,qEAAqE;IACrE,kEAAkE;IAClE,+CAA+C;IAC/C,IAAI,MAAM,iCAAiC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC;QACnE,wCAAwC,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,wCAAwC,CAC/C,OAAgB,EAChB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CACnC,cAAc,EACd,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CACrD,CAAC;IACF,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CACnC,cAAc,EACd,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CACrD,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc;YAAE,SAAS;QACtD,2EAA2E;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC9B,KAAK,CAAC,SAAS,CAAC,cAAc,GAAG,KAAK,CAAC;QACvC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1B,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAChD,OAAgB,EAChB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CACrD,CAAC;IACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAAgB,EAChB,SAA2B;IAE3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7D,IAAI,cAAc,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1D,QAAQ,CAAC,aAAa,GAAG,aAAa,CAAC;IACvC,MAAM,eAAe,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YAC7C,QAAQ,CAAC,aAAa,GAAG,SAAS,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,cAAsB,EACtB,SAA2B;IAE3B,wCAAwC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,yCAAyC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACrE,CAAC;AACH,CAAC","sourcesContent":["import { hasOrganizationPresentationDenial } from \"../../data/persistence/organizations/organizationPresentationDenialPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport type OrganizationPresentationProjection = \"readModel\" | \"usage\";\n\nexport interface OrganizationPresentationAccessInput {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly requesterUserId: string;\n}\n\ninterface ProjectionAccessState {\n  denied: boolean;\n  /**\n   * True only when the server itself denied the projection (a 403/404 read).\n   * A session reset also flips `denied`, but that is a local lifecycle event —\n   * consumers reacting specifically to lost-then-regained org access (e.g.\n   * re-arming write lanes) must not treat a routine reset as a denial.\n   */\n  deniedByServer: boolean;\n  generation: number;\n}\n\ninterface AccessScopeState {\n  readonly organizationId: string;\n  readonly readModel: ProjectionAccessState;\n  readonly usage: ProjectionAccessState;\n}\n\ninterface AccessExecutorState {\n  readonly generationByOrganization: Map<string, number>;\n  mutationQueue?: Promise<void> | undefined;\n  readonly resetDepthByOrganization: Map<string, number>;\n  readonly scopes: Map<string, AccessScopeState>;\n}\n\nexport interface OrganizationPresentationAccessAttempt {\n  readonly executorGeneration: number;\n  readonly projection: OrganizationPresentationProjection;\n  readonly projectionGeneration: number;\n  readonly startedDenied: boolean;\n  readonly startedDuringReset: boolean;\n}\n\nconst accessByExecutor = new WeakMap<ExecSql, AccessExecutorState>();\n\nexport function organizationAccessScopeKey(\n  organizationId: string,\n  requesterUserId: string,\n): string {\n  return JSON.stringify([organizationId, requesterUserId]);\n}\n\nfunction accessExecutorState(execSql: ExecSql): AccessExecutorState {\n  let state = accessByExecutor.get(execSql);\n  if (!state) {\n    state = {\n      generationByOrganization: new Map(),\n      resetDepthByOrganization: new Map(),\n      scopes: new Map(),\n    };\n    accessByExecutor.set(execSql, state);\n  }\n  return state;\n}\n\nfunction newProjectionState(denied: boolean): ProjectionAccessState {\n  return { denied, deniedByServer: false, generation: 0 };\n}\n\nfunction organizationResetDepth(\n  executor: AccessExecutorState,\n  organizationId: string,\n): number {\n  return executor.resetDepthByOrganization.get(organizationId) ?? 0;\n}\n\nfunction organizationGeneration(\n  executor: AccessExecutorState,\n  organizationId: string,\n): number {\n  return executor.generationByOrganization.get(organizationId) ?? 0;\n}\n\nfunction accessScopeState(\n  executor: AccessExecutorState,\n  organizationId: string,\n  requesterUserId: string,\n): AccessScopeState {\n  const key = organizationAccessScopeKey(organizationId, requesterUserId);\n  let scope = executor.scopes.get(key);\n  if (!scope) {\n    const denied = organizationResetDepth(executor, organizationId) > 0;\n    scope = {\n      organizationId,\n      readModel: newProjectionState(denied),\n      usage: newProjectionState(denied),\n    };\n    executor.scopes.set(key, scope);\n  }\n  return scope;\n}\n\nfunction projectionState(\n  scope: AccessScopeState,\n  projection: OrganizationPresentationProjection,\n): ProjectionAccessState {\n  return scope[projection];\n}\n\nexport function captureOrganizationPresentationAccessAttempt(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n): OrganizationPresentationAccessAttempt {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    projection,\n  );\n  return {\n    executorGeneration: organizationGeneration(executor, input.organizationId),\n    projection,\n    projectionGeneration: state.generation,\n    startedDenied: state.denied,\n    startedDuringReset:\n      organizationResetDepth(executor, input.organizationId) > 0,\n  };\n}\n\nexport function isOrganizationPresentationAccessAttemptCurrent(\n  input: OrganizationPresentationAccessInput,\n  attempt: OrganizationPresentationAccessAttempt,\n): boolean {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    attempt.projection,\n  );\n  return (\n    !attempt.startedDuringReset &&\n    organizationResetDepth(executor, input.organizationId) === 0 &&\n    organizationGeneration(executor, input.organizationId) ===\n      attempt.executorGeneration &&\n    state.generation === attempt.projectionGeneration\n  );\n}\n\nexport function isOrganizationPresentationAccessReadable(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n): boolean {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    projection,\n  );\n  return (\n    organizationResetDepth(executor, input.organizationId) === 0 &&\n    !state.denied\n  );\n}\n\nexport function denyOrganizationPresentationAccess(\n  input: OrganizationPresentationAccessInput,\n  projections: readonly OrganizationPresentationProjection[],\n): void {\n  const executor = accessExecutorState(input.execSql);\n  const scope = accessScopeState(\n    executor,\n    input.organizationId,\n    input.requesterUserId,\n  );\n  for (const projection of new Set(projections)) {\n    const state = projectionState(scope, projection);\n    state.denied = true;\n    state.deniedByServer = true;\n    state.generation += 1;\n  }\n}\n\n/**\n * Whether the scope's projection is currently denied because the server\n * refused it (as opposed to a local session reset). The flip back to readable\n * after this returns true is the \"org access was just restored\" edge.\n */\nexport function wasOrganizationPresentationAccessDeniedByServer(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n): boolean {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    projection,\n  );\n  return state.denied && state.deniedByServer;\n}\n\nexport function restoreOrganizationPresentationAccess(\n  input: OrganizationPresentationAccessInput,\n  attempt: OrganizationPresentationAccessAttempt,\n): boolean {\n  if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {\n    return false;\n  }\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    attempt.projection,\n  );\n  state.denied = false;\n  state.deniedByServer = false;\n  return true;\n}\n\nexport async function runOrganizationPresentationRead<T>(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n  operation: () => Promise<T>,\n): Promise<T | null> {\n  const attempt = captureOrganizationPresentationAccessAttempt(\n    input,\n    projection,\n  );\n  if (!isOrganizationPresentationAccessReadable(input, projection)) {\n    return null;\n  }\n  // In-memory denial dies with the process. The durable marker keeps a\n  // revoked projection unreadable when its purge failed and the app\n  // restarted; a successful reconcile clears it.\n  if (await hasOrganizationPresentationDenial(input, projection)) {\n    return null;\n  }\n  const value = await operation();\n  return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&\n    isOrganizationPresentationAccessReadable(input, projection)\n    ? value\n    : null;\n}\n\nfunction beginOrganizationPresentationAccessReset(\n  execSql: ExecSql,\n  organizationId: string,\n): void {\n  const executor = accessExecutorState(execSql);\n  executor.generationByOrganization.set(\n    organizationId,\n    organizationGeneration(executor, organizationId) + 1,\n  );\n  executor.resetDepthByOrganization.set(\n    organizationId,\n    organizationResetDepth(executor, organizationId) + 1,\n  );\n  for (const scope of executor.scopes.values()) {\n    if (scope.organizationId !== organizationId) continue;\n    // A reset denies presentation locally but is not a server denial: the next\n    // session re-derives server state, and startup sync already re-drives the\n    // lanes, so the lost-access memory must not survive into it.\n    scope.readModel.denied = true;\n    scope.readModel.deniedByServer = false;\n    scope.usage.denied = true;\n    scope.usage.deniedByServer = false;\n  }\n}\n\nfunction finishOrganizationPresentationAccessReset(\n  execSql: ExecSql,\n  organizationId: string,\n): void {\n  const executor = accessExecutorState(execSql);\n  const nextDepth = Math.max(\n    0,\n    organizationResetDepth(executor, organizationId) - 1,\n  );\n  if (nextDepth === 0) {\n    executor.resetDepthByOrganization.delete(organizationId);\n  } else {\n    executor.resetDepthByOrganization.set(organizationId, nextDepth);\n  }\n}\n\nexport async function runOrganizationPresentationMutation<T>(\n  execSql: ExecSql,\n  operation: () => Promise<T>,\n): Promise<T> {\n  const executor = accessExecutorState(execSql);\n  const previous = executor.mutationQueue ?? Promise.resolve();\n  let releaseCurrent = () => {};\n  const current = new Promise<void>((resolve) => {\n    releaseCurrent = resolve;\n  });\n  const waitForPrevious = previous.catch(() => undefined);\n  const queuedCurrent = waitForPrevious.then(() => current);\n  executor.mutationQueue = queuedCurrent;\n  await waitForPrevious;\n\n  try {\n    return await operation();\n  } finally {\n    releaseCurrent();\n    if (executor.mutationQueue === queuedCurrent) {\n      executor.mutationQueue = undefined;\n    }\n  }\n}\n\nexport async function runOrganizationPresentationReset<T>(\n  execSql: ExecSql,\n  organizationId: string,\n  operation: () => Promise<T>,\n): Promise<T> {\n  beginOrganizationPresentationAccessReset(execSql, organizationId);\n  try {\n    return await runOrganizationPresentationMutation(execSql, operation);\n  } finally {\n    finishOrganizationPresentationAccessReset(execSql, organizationId);\n  }\n}\n"]}

package/workflows/organizations/organizationPresentationFailures.js

@@ -0,0 +1,7 @@
+import { ORGANIZATION_PRESENTATION_ERROR_CODES } from "../../internal/validators/response/index.js";
+export function isOrganizationPresentationAccessDeniedFailure(failure) {
+    return (failure.kind === "http" &&
+        (failure.status === 403 || failure.status === 404) &&
+        failure.code === ORGANIZATION_PRESENTATION_ERROR_CODES.accessDenied);
+}
+//# sourceMappingURL=organizationPresentationFailures.js.map

package/workflows/organizations/organizationPresentationFailures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationPresentationFailures.js","sourceRoot":"","sources":["organizationPresentationFailures.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AAEvF,MAAM,UAAU,6CAA6C,CAC3D,OAAuB;IAEvB,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,MAAM;QACvB,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;QAClD,OAAO,CAAC,IAAI,KAAK,qCAAqC,CAAC,YAAY,CACpE,CAAC;AACJ,CAAC","sourcesContent":["import type { RequestFailure } from \"@tearleads/api-client\";\nimport { ORGANIZATION_PRESENTATION_ERROR_CODES } from \"@tearleads/validators/response\";\n\nexport function isOrganizationPresentationAccessDeniedFailure(\n  failure: RequestFailure,\n): boolean {\n  return (\n    failure.kind === \"http\" &&\n    (failure.status === 403 || failure.status === 404) &&\n    failure.code === ORGANIZATION_PRESENTATION_ERROR_CODES.accessDenied\n  );\n}\n"]}

package/workflows/organizations/organizationProfile.d.ts

@@ -0,0 +1,16 @@
+import { ORGANIZATION_PROFILE_DOCUMENT_KIND } from "../../data/documents/documentConstants.js";
+export { ORGANIZATION_PROFILE_DOCUMENT_KIND };
+export declare const DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME = "Personal Org";
+export declare function getOrganizationProfileDocumentLocalId(input: {
+    readonly organizationId: string;
+}): string;
+export declare function buildOrganizationProfileDocumentPatch(input: {
+    readonly name: string;
+}): Record<string, string | undefined>;
+export declare function createInitializedOrganizationProfileDocument(input: {
+    readonly name: string;
+}): Promise<{
+    readonly initialUpdate: Uint8Array;
+    readonly snapshot: string;
+}>;
+export declare function readOrganizationProfileName(structuredFields: Readonly<Record<string, unknown>> | null | undefined): string | null;

package/workflows/organizations/organizationProfile.js

@@ -0,0 +1,36 @@
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { createDocument, exportAllUpdates } from "../../internal/loro/index.js";
+import { getScopedPeerSeed } from "../../data/crdtPeerSeed.js";
+import { ORGANIZATION_PROFILE_DOCUMENT_KIND } from "../../data/documents/documentConstants.js";
+import { initializeStoredDocumentKind, writeStoredDocumentFields, } from "../../data/documents/documentKinds.js";
+import { DOCUMENTS_APP_KIND } from "../../data/persistence/documents/documentsPersistence.js";
+export { ORGANIZATION_PROFILE_DOCUMENT_KIND };
+export const DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME = "Personal Org";
+export function getOrganizationProfileDocumentLocalId(input) {
+    return `org-profile:${input.organizationId}`;
+}
+export function buildOrganizationProfileDocumentPatch(input) {
+    return {
+        name: input.name.trim(),
+    };
+}
+export async function createInitializedOrganizationProfileDocument(input) {
+    const doc = await createDocument(await getScopedPeerSeed(DOCUMENTS_APP_KIND));
+    initializeStoredDocumentKind(doc, ORGANIZATION_PROFILE_DOCUMENT_KIND);
+    writeStoredDocumentFields(doc, ORGANIZATION_PROFILE_DOCUMENT_KIND, buildOrganizationProfileDocumentPatch({ name: input.name }));
+    const initialUpdate = exportAllUpdates(doc);
+    return {
+        initialUpdate,
+        snapshot: bytesToBase64(initialUpdate),
+    };
+}
+export function readOrganizationProfileName(structuredFields) {
+    if (!structuredFields) {
+        return null;
+    }
+    const value = Reflect.get(structuredFields, "name");
+    return typeof value === "string" && value.trim().length > 0
+        ? value.trim()
+        : null;
+}
+//# sourceMappingURL=organizationProfile.js.map

package/workflows/organizations/organizationProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationProfile.js","sourceRoot":"","sources":["organizationProfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAC5F,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,EAAE,kCAAkC,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,0CAA0C,GAAG,cAAc,CAAC;AAEzE,MAAM,UAAU,qCAAqC,CAAC,KAErD;IACC,OAAO,eAAe,KAAK,CAAC,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,KAErD;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KAElE;IAIC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC9E,4BAA4B,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACtE,yBAAyB,CACvB,GAAG,EACH,kCAAkC,EAClC,qCAAqC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAC5D,CAAC;IAEF,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE5C,OAAO;QACL,aAAa;QACb,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,gBAAsE;IAEtE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAEpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport { createDocument, exportAllUpdates } from \"@tearleads/loro\";\nimport { getScopedPeerSeed } from \"../../data/crdtPeerSeed\";\nimport { ORGANIZATION_PROFILE_DOCUMENT_KIND } from \"../../data/documents/documentConstants\";\nimport {\n  initializeStoredDocumentKind,\n  writeStoredDocumentFields,\n} from \"../../data/documents/documentKinds\";\nimport { DOCUMENTS_APP_KIND } from \"../../data/persistence/documents/documentsPersistence\";\n\nexport { ORGANIZATION_PROFILE_DOCUMENT_KIND };\nexport const DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME = \"Personal Org\";\n\nexport function getOrganizationProfileDocumentLocalId(input: {\n  readonly organizationId: string;\n}): string {\n  return `org-profile:${input.organizationId}`;\n}\n\nexport function buildOrganizationProfileDocumentPatch(input: {\n  readonly name: string;\n}): Record<string, string | undefined> {\n  return {\n    name: input.name.trim(),\n  };\n}\n\nexport async function createInitializedOrganizationProfileDocument(input: {\n  readonly name: string;\n}): Promise<{\n  readonly initialUpdate: Uint8Array;\n  readonly snapshot: string;\n}> {\n  const doc = await createDocument(await getScopedPeerSeed(DOCUMENTS_APP_KIND));\n  initializeStoredDocumentKind(doc, ORGANIZATION_PROFILE_DOCUMENT_KIND);\n  writeStoredDocumentFields(\n    doc,\n    ORGANIZATION_PROFILE_DOCUMENT_KIND,\n    buildOrganizationProfileDocumentPatch({ name: input.name }),\n  );\n\n  const initialUpdate = exportAllUpdates(doc);\n\n  return {\n    initialUpdate,\n    snapshot: bytesToBase64(initialUpdate),\n  };\n}\n\nexport function readOrganizationProfileName(\n  structuredFields: Readonly<Record<string, unknown>> | null | undefined,\n): string | null {\n  if (!structuredFields) {\n    return null;\n  }\n\n  const value = Reflect.get(structuredFields, \"name\");\n\n  return typeof value === \"string\" && value.trim().length > 0\n    ? value.trim()\n    : null;\n}\n"]}

package/workflows/organizations/organizationProvisioningAttempt.d.ts

@@ -0,0 +1,36 @@
+import { type CreateOrganizationRequest } from "../../internal/validators/request/index.js";
+import type { ExecSql, ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
+import type { OrganizationProvisioningArtifacts } from "../registration/registerIdentity.js";
+interface DurableOrganizationProvisioningAttempt {
+    readonly artifacts: OrganizationProvisioningArtifacts;
+    readonly request: CreateOrganizationRequest;
+    readonly rootContainerId: string;
+}
+export declare function loadOrganizationReplacementFinalizationRequest(input: {
+    execSql: ExecSql;
+    replacedOrganizationId: string;
+    userId: string;
+}): Promise<CreateOrganizationRequest>;
+export declare function makeOrganizationProvisioningAttemptDurable(input: {
+    artifacts: OrganizationProvisioningArtifacts;
+    canStartDurableMutation?: (() => boolean) | undefined;
+    dbClient: ExecSqlClientLike;
+    nativeSubscriptionRestore?: boolean | undefined;
+    replacesOrganizationId?: string | undefined;
+    rootContainerId: string;
+    userId: string;
+}): Promise<DurableOrganizationProvisioningAttempt | null>;
+export declare function removeNativeSubscriptionRestoreProvisioningAttempt(input: {
+    canCommit?: (() => boolean) | undefined;
+    dbClient: ExecSqlClientLike;
+    organizationId: string;
+    userId: string;
+}): Promise<boolean>;
+export declare function removeOrganizationProvisioningAttempt(input: {
+    canCommit?: (() => boolean) | undefined;
+    execSql: ExecSql;
+    organizationId?: string | undefined;
+    replacedOrganizationId: string;
+    userId: string;
+}): Promise<boolean>;
+export {};