@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/registration/provisioningBootstrapBuilders.js

@@ -0,0 +1,275 @@
+import { base64ToBytes } from "../../internal/encoding/index.js";
+import { createInitializedContainerMetadataDocument } from "../../data/containers/containerMetadataDocument.js";
+import { deriveStableDocumentId } from "../../data/documents/shared/stableDocumentId.js";
+import { deriveContainerSystemSlot, } from "../container-contents/systemSlot.js";
+import { buildContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, } from "../containers/child/create.js";
+import { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "../containers/root/create.js";
+import { buildMaterializedDocumentCreatePlan } from "../documents/create.js";
+import { buildInitialDocumentSyncRequest } from "../documents/initialSync.js";
+import { getOrganizationProfileDocumentLocalId } from "../organizations/organizationProfile.js";
+import { deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, } from "../organizations/rosterProfileContainer.js";
+import { buildProvisionedOrganizationProfile, buildProvisionedRosterProfile, } from "./provisionedProfileDocument.js";
+import { verifiedPrincipalPolicyFromInitialGroupRequest } from "./registrationPrincipalPolicyPersistence.js";
+/**
+ * The shared spine of every provisioned system child container: mint the
+ * container and its metadata document under root, project the writer view,
+ * and assemble the create request. Callers differ only in slot derivation,
+ * display metadata, authorizing policies, an optional managed read grant, and
+ * what they attach afterwards (roster/org profile documents).
+ */
+async function buildProvisionedChildContainerCore(input) {
+    const containerId = input.containerId ?? crypto.randomUUID();
+    const { initialUpdate } = await createInitializedContainerMetadataDocument(containerId, {
+        icon: input.icon,
+        name: input.name,
+    });
+    const containerKey = crypto.getRandomValues(new Uint8Array(32));
+    const containerPlan = {
+        containerKey,
+        plan: input.independentMetadataGroups
+            ? (await buildRootContainerCreatePlan({
+                ...input.independentMetadataGroups,
+                author: input.author,
+                containerId,
+                containerKey,
+                metadataDocumentId: containerId,
+                systemSlot: input.systemSlot,
+                recipientEncapsulationPublicKey: base64ToBytes(input.independentMetadataGroups.adminGroup.initialGroupPolicy
+                    .state.encapsulationPublicKey),
+            })).plan
+            : await buildContainerCreatePlan({
+                author: input.author,
+                containerId,
+                containerKey,
+                ...(input.managedPrincipalGrant
+                    ? { managedPrincipalGrant: input.managedPrincipalGrant }
+                    : {}),
+                metadataDocumentId: containerId,
+                systemSlot: input.systemSlot,
+                parentProjection: input.rootContainerProjection,
+                principalPolicies: input.principalPolicies,
+            }),
+    };
+    const containerProjection = input.independentMetadataGroups
+        ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)
+        : childContainerWriterProjectionFromCreatePlan({
+            materializedPlan: containerPlan,
+            parentProjection: input.rootContainerProjection,
+        });
+    const knownContainerKeks = new Map([
+        [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],
+    ]);
+    const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({
+        author: input.author,
+        containerProjection,
+        documentId: containerPlan.plan.metadataDocumentId,
+        knownContainerKeks,
+        targetSecretKey: input.targetSecretKey,
+        trustedLocalProjection: true,
+    });
+    const initialMetadataSync = await buildInitialDocumentSyncRequest({
+        author: input.author,
+        containerProjection,
+        initialUpdate,
+        materializedDocument: containerMetadataDocument,
+    });
+    return {
+        containerId,
+        containerMetadataDocument,
+        containerMetadataInitialUpdate: initialUpdate,
+        containerPlan,
+        containerProjection,
+        containerRequest: {
+            systemSlot: input.systemSlot,
+            container: containerPlan.plan.request,
+            initialMetadataSync,
+            metadataDocument: containerMetadataDocument.plan.request,
+        },
+        knownContainerKeks,
+        systemSlot: input.systemSlot,
+    };
+}
+export async function buildInitialRosterProfileBootstrap(input) {
+    const core = await buildProvisionedChildContainerCore({
+        author: input.author,
+        icon: null,
+        name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,
+        principalPolicies: [
+            await verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),
+        ],
+        rootContainer: input.rootContainer,
+        rootContainerProjection: input.rootContainerProjection,
+        systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({
+            organizationId: input.author.organizationId,
+        }),
+        targetSecretKey: input.targetSecretKey,
+    });
+    const { profile, rosterProfileDocument } = await buildInitialRosterProfile({
+        author: input.author,
+        containerProjection: core.containerProjection,
+        encapsulationPublicKey: input.encapsulationPublicKey,
+        knownContainerKeks: core.knownContainerKeks,
+        rosterProfileNickname: input.rosterProfileNickname,
+        targetSecretKey: input.targetSecretKey,
+    });
+    return {
+        containerId: core.containerId,
+        containerMetadataDocument: core.containerMetadataDocument,
+        containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,
+        containerPlan: core.containerPlan,
+        containerRequest: core.containerRequest,
+        profileDocument: rosterProfileDocument,
+        profileDocumentInitialUpdate: profile.initialUpdate,
+        profileDocumentRequest: profile.request,
+        systemSlot: core.systemSlot,
+    };
+}
+async function buildInitialRosterProfile(input) {
+    const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({
+        author: input.author,
+        containerProjection: input.containerProjection,
+        documentId: await deriveStableDocumentId(getRosterProfileDocumentLocalId({
+            organizationId: input.author.organizationId,
+            userId: input.author.signerUserId,
+        })),
+        knownContainerKeks: input.knownContainerKeks,
+        targetSecretKey: input.targetSecretKey,
+        trustedLocalProjection: true,
+    });
+    const profile = await buildProvisionedRosterProfile({
+        author: input.author,
+        containerProjection: input.containerProjection,
+        encapsulationPublicKey: input.encapsulationPublicKey,
+        materializedDocument: rosterProfileDocument,
+        nickname: input.rosterProfileNickname,
+    });
+    return { profile, rosterProfileDocument };
+}
+export async function buildInitialSystemContainerBootstrap(input) {
+    const core = await buildProvisionedChildContainerCore({
+        author: input.author,
+        icon: input.spec.icon,
+        name: input.spec.name,
+        principalPolicies: [
+            await verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),
+        ],
+        rootContainer: input.rootContainer,
+        rootContainerProjection: input.rootContainerProjection,
+        systemSlot: await deriveContainerSystemSlot({
+            definition: input.spec.slotDefinition,
+            secretKey: input.signingPrivateKey,
+        }),
+        targetSecretKey: input.targetSecretKey,
+    });
+    return {
+        containerId: core.containerId,
+        containerMetadataDocument: core.containerMetadataDocument,
+        containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,
+        containerPlan: core.containerPlan,
+        containerRequest: core.containerRequest,
+        icon: input.spec.icon,
+        name: input.spec.name,
+        systemSlot: core.systemSlot,
+    };
+}
+function stableOrganizationProfileId(organizationId) {
+    return deriveStableDocumentId(getOrganizationProfileDocumentLocalId({ organizationId }));
+}
+async function buildInitialOrganizationProfile(input) {
+    const organizationProfileDocument = await buildMaterializedDocumentCreatePlan({
+        author: input.author,
+        containerProjection: input.containerProjection,
+        documentId: await stableOrganizationProfileId(input.author.organizationId),
+        knownContainerKeks: input.knownContainerKeks,
+        targetSecretKey: input.targetSecretKey,
+        trustedLocalProjection: true,
+    });
+    const profile = await buildProvisionedOrganizationProfile({
+        author: input.author,
+        containerProjection: input.containerProjection,
+        materializedDocument: organizationProfileDocument,
+        name: input.organizationProfileName,
+    });
+    return { organizationProfileDocument, profile };
+}
+/**
+ * Organization labels use an independent system root with Admins/admin and
+ * Members/read grants. Personal root shares and rotations cannot expose or
+ * strand organization metadata; Members changes still rotate its own KEK.
+ */
+export async function buildInitialOrganizationMetadataBootstrap(input) {
+    const core = await buildProvisionedChildContainerCore({
+        author: input.author,
+        containerId: input.containerId,
+        icon: null,
+        independentMetadataGroups: {
+            adminGroup: input.initialAdminGroup,
+            memberGroup: input.initialMemberGroup,
+        },
+        name: ORGANIZATION_METADATA_CONTAINER_NAME,
+        // Both reserved groups receive explicit grants on the independent root.
+        principalPolicies: await Promise.all([
+            verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),
+            verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),
+        ]),
+        rootContainer: input.rootContainer,
+        rootContainerProjection: input.rootContainerProjection,
+        systemSlot: await deriveOrganizationMetadataContainerSystemSlot({
+            organizationId: input.author.organizationId,
+        }),
+        targetSecretKey: input.targetSecretKey,
+    });
+    const { organizationProfileDocument, profile } = await buildInitialOrganizationProfile({
+        author: input.author,
+        containerProjection: core.containerProjection,
+        knownContainerKeks: core.knownContainerKeks,
+        organizationProfileName: input.organizationProfileName,
+        targetSecretKey: input.targetSecretKey,
+    });
+    return {
+        containerId: core.containerId,
+        containerMetadataDocument: core.containerMetadataDocument,
+        containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,
+        containerPlan: core.containerPlan,
+        containerRequest: core.containerRequest,
+        organizationProfileDocument,
+        organizationProfileDocumentRequest: profile.request,
+        organizationProfileSnapshot: profile.snapshot,
+        systemSlot: core.systemSlot,
+    };
+}
+export async function buildInitialRootProvisioning(input) {
+    const rootContainer = await buildRootContainerCreatePlan({
+        adminGroup: input.adminGroup,
+        author: input.author,
+        containerId: input.rootContainerId,
+        metadataDocumentId: input.bootstrap.metadataDocumentId,
+        recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,
+    });
+    const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(rootContainer.plan);
+    const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({
+        author: input.author,
+        containerProjection: rootContainerProjection,
+        documentId: input.bootstrap.metadataDocumentId,
+        knownContainerKeks: new Map([
+            [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],
+        ]),
+        targetSecretKey: input.targetSecretKey,
+        trustedLocalProjection: true,
+    });
+    return {
+        rootContainer,
+        rootContainerProjection,
+        rootMetadataDocument,
+        rootMetadataDocumentRequest: {
+            ...rootMetadataDocument.plan.request,
+            initialSync: await buildInitialDocumentSyncRequest({
+                author: input.author,
+                containerProjection: rootContainerProjection,
+                initialUpdate: input.bootstrap.initialUpdate,
+                materializedDocument: rootMetadataDocument,
+            }),
+        },
+    };
+}
+//# sourceMappingURL=provisioningBootstrapBuilders.js.map

package/workflows/registration/provisioningBootstrapBuilders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioningBootstrapBuilders.js","sourceRoot":"","sources":["provisioningBootstrapBuilders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,4CAA4C,GAC7C,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAqE1G;;;;;;GAMG;AACH,KAAK,UAAU,kCAAkC,CAAC,KAmBjD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAqC;QACtD,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACnC,CAAC,CAAC,CACE,MAAM,4BAA4B,CAAC;gBACjC,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,+BAA+B,EAAE,aAAa,CAC5C,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,kBAAkB;qBAC1D,KAAK,CAAC,sBAAsB,CAChC;aACF,CAAC,CACH,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,KAAK,CAAC,qBAAqB;oBAC7B,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;KACP,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,yBAAyB;QACzD,CAAC,CAAC,2CAA2C,CAAC,aAAa,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,4CAA4C,CAAC;YAC3C,gBAAgB,EAAE,aAAa;YAC/B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;SAChD,CAAC,CAAC;IACP,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,mCAAmC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,kBAAkB;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,aAAa;QACb,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,8BAA8B,EAAE,aAAa;QAC7C,aAAa;QACb,mBAAmB;QACnB,gBAAgB,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,mBAAmB;YACnB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO;SACzD;QACD,kBAAkB;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,0CAA0C;QAChD,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,kDAAkD,CAAC;YACnE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,qBAAqB;QACtC,4BAA4B,EAAE,OAAO,CAAC,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,OAAO;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAgC;IACvE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,sBAAsB,CACtC,+BAA+B,CAAC;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CACH;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,qBAAqB;QAC3C,QAAQ,EAAE,KAAK,CAAC,qBAAqB;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,yBAAyB,CAAC;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;YACrC,SAAS,EAAE,KAAK,CAAC,iBAAiB;SACnC,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB;IACzD,OAAO,sBAAsB,CAC3B,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,MAAM,2BAA2B,GAAG,MAAM,mCAAmC,CAC3E;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,2BAA2B,CAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,oBAAoB,EAAE,2BAA2B;QACjD,IAAI,EAAE,KAAK,CAAC,uBAAuB;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI;QACV,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,IAAI,EAAE,oCAAoC;QAC1C,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YACnC,8CAA8C,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,8CAA8C,CAAC,KAAK,CAAC,kBAAkB,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,6CAA6C,CAAC;YAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,GAC5C,MAAM,+BAA+B,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACL,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,2BAA2B;QAC3B,kCAAkC,EAAE,OAAO,CAAC,OAAO;QACnD,2BAA2B,EAAE,OAAO,CAAC,QAAQ;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,eAAe;QAClC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QACtD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,2CAA2C,CACzE,aAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,uBAAuB;QAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,oBAAoB;QACpB,2BAA2B,EAAE;YAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO;YACpC,WAAW,EAAE,MAAM,+BAA+B,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mBAAmB,EAAE,uBAAuB;gBAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC5C,oBAAoB,EAAE,oBAAoB;aAC3C,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { createInitializedContainerMetadataDocument } from \"../../data/containers/containerMetadataDocument\";\nimport { deriveStableDocumentId } from \"../../data/documents/shared/stableDocumentId\";\nimport {\n  type ContainerSystemSlotDefinition,\n  deriveContainerSystemSlot,\n} from \"../container-contents/systemSlot\";\nimport {\n  buildContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n} from \"../containers/child/create\";\nimport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"../containers/root/create\";\nimport type { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { buildMaterializedDocumentCreatePlan } from \"../documents/create\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/initialSync\";\nimport { getOrganizationProfileDocumentLocalId } from \"../organizations/organizationProfile\";\nimport {\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n} from \"../organizations/rosterProfileContainer\";\nimport type {\n  InitialOrganizationMetadataBootstrap,\n  InitialRootContainerCreatePlan,\n  InitialRosterProfileBootstrap,\n  InitialSystemContainerBootstrap,\n  InitialSystemContainerCreatePlan,\n} from \"./organizationProvisioningArtifacts\";\nimport {\n  buildProvisionedOrganizationProfile,\n  buildProvisionedRosterProfile,\n} from \"./provisionedProfileDocument\";\nimport { verifiedPrincipalPolicyFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\ntype InitialRootContainerProjection = ReturnType<\n  typeof rootContainerWriterProjectionFromCreatePlan\n>;\n\n/**\n * An app-owned system container to provision atomically with a new organization\n * (e.g. a trash bin). The client-sdk is agnostic to what these are:\n * the caller (the app, which owns the mini-app slot namespaces) declares each\n * one, and the provisioning path derives its per-user system slot, builds a\n * signed Admins-scoped child of root, and links it into the same transaction as\n * the rest of the organization bootstrap. The behavioral rules that govern a\n * system container are resolved client-side by slot, so provisioning needs only\n * the slot definition, display name, and icon — no rules travel to the server.\n */\nexport interface ProvisionedSystemContainerSpec {\n  readonly slotDefinition: ContainerSystemSlotDefinition;\n  readonly name: string;\n  readonly icon: string | null;\n}\n\ninterface InitialOrganizationMetadataBootstrapInput {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId: string;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  organizationProfileName?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}\n\ninterface InitialRosterProfileInput {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  encapsulationPublicKey: Uint8Array;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  rosterProfileNickname?: string | undefined;\n  targetSecretKey: Uint8Array;\n}\n\ninterface ProvisionedChildContainerCore {\n  containerId: string;\n  containerMetadataDocument: Awaited<\n    ReturnType<typeof buildMaterializedDocumentCreatePlan>\n  >;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  containerRequest: {\n    systemSlot: ContainerSystemSlot;\n    container: InitialSystemContainerCreatePlan[\"plan\"][\"request\"];\n    initialMetadataSync: Awaited<\n      ReturnType<typeof buildInitialDocumentSyncRequest>\n    >;\n    metadataDocument: Awaited<\n      ReturnType<typeof buildMaterializedDocumentCreatePlan>\n    >[\"plan\"][\"request\"];\n  };\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  systemSlot: ContainerSystemSlot;\n}\n\n/**\n * The shared spine of every provisioned system child container: mint the\n * container and its metadata document under root, project the writer view,\n * and assemble the create request. Callers differ only in slot derivation,\n * display metadata, authorizing policies, an optional managed read grant, and\n * what they attach afterwards (roster/org profile documents).\n */\nasync function buildProvisionedChildContainerCore(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId?: string | undefined;\n  icon: string | null;\n  managedPrincipalGrant?: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"managedPrincipalGrant\"];\n  name: string;\n  principalPolicies: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"principalPolicies\"];\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  systemSlot: ContainerSystemSlot;\n  targetSecretKey: Uint8Array;\n  independentMetadataGroups?: {\n    adminGroup: CreateOrganizationGroupRequest;\n    memberGroup: CreateOrganizationGroupRequest;\n  };\n}): Promise<ProvisionedChildContainerCore> {\n  const containerId = input.containerId ?? crypto.randomUUID();\n  const { initialUpdate } = await createInitializedContainerMetadataDocument(\n    containerId,\n    {\n      icon: input.icon,\n      name: input.name,\n    },\n  );\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerPlan: InitialSystemContainerCreatePlan = {\n    containerKey,\n    plan: input.independentMetadataGroups\n      ? (\n          await buildRootContainerCreatePlan({\n            ...input.independentMetadataGroups,\n            author: input.author,\n            containerId,\n            containerKey,\n            metadataDocumentId: containerId,\n            systemSlot: input.systemSlot,\n            recipientEncapsulationPublicKey: base64ToBytes(\n              input.independentMetadataGroups.adminGroup.initialGroupPolicy\n                .state.encapsulationPublicKey,\n            ),\n          })\n        ).plan\n      : await buildContainerCreatePlan({\n          author: input.author,\n          containerId,\n          containerKey,\n          ...(input.managedPrincipalGrant\n            ? { managedPrincipalGrant: input.managedPrincipalGrant }\n            : {}),\n          metadataDocumentId: containerId,\n          systemSlot: input.systemSlot,\n          parentProjection: input.rootContainerProjection,\n          principalPolicies: input.principalPolicies,\n        }),\n  };\n  const containerProjection = input.independentMetadataGroups\n    ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)\n    : childContainerWriterProjectionFromCreatePlan({\n        materializedPlan: containerPlan,\n        parentProjection: input.rootContainerProjection,\n      });\n  const knownContainerKeks = new Map([\n    [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n  ]);\n  const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection,\n    documentId: containerPlan.plan.metadataDocumentId,\n    knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const initialMetadataSync = await buildInitialDocumentSyncRequest({\n    author: input.author,\n    containerProjection,\n    initialUpdate,\n    materializedDocument: containerMetadataDocument,\n  });\n  return {\n    containerId,\n    containerMetadataDocument,\n    containerMetadataInitialUpdate: initialUpdate,\n    containerPlan,\n    containerProjection,\n    containerRequest: {\n      systemSlot: input.systemSlot,\n      container: containerPlan.plan.request,\n      initialMetadataSync,\n      metadataDocument: containerMetadataDocument.plan.request,\n    },\n    knownContainerKeks,\n    systemSlot: input.systemSlot,\n  };\n}\n\nexport async function buildInitialRosterProfileBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  encapsulationPublicKey: Uint8Array;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rosterProfileNickname?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialRosterProfileBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: null,\n    name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { profile, rosterProfileDocument } = await buildInitialRosterProfile({\n    author: input.author,\n    containerProjection: core.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    knownContainerKeks: core.knownContainerKeks,\n    rosterProfileNickname: input.rosterProfileNickname,\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    profileDocument: rosterProfileDocument,\n    profileDocumentInitialUpdate: profile.initialUpdate,\n    profileDocumentRequest: profile.request,\n    systemSlot: core.systemSlot,\n  };\n}\n\nasync function buildInitialRosterProfile(input: InitialRosterProfileInput) {\n  const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    documentId: await deriveStableDocumentId(\n      getRosterProfileDocumentLocalId({\n        organizationId: input.author.organizationId,\n        userId: input.author.signerUserId,\n      }),\n    ),\n    knownContainerKeks: input.knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const profile = await buildProvisionedRosterProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    materializedDocument: rosterProfileDocument,\n    nickname: input.rosterProfileNickname,\n  });\n  return { profile, rosterProfileDocument };\n}\n\nexport async function buildInitialSystemContainerBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  signingPrivateKey: Uint8Array;\n  spec: ProvisionedSystemContainerSpec;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialSystemContainerBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveContainerSystemSlot({\n      definition: input.spec.slotDefinition,\n      secretKey: input.signingPrivateKey,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    systemSlot: core.systemSlot,\n  };\n}\n\nfunction stableOrganizationProfileId(organizationId: string): Promise<string> {\n  return deriveStableDocumentId(\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n}\n\nasync function buildInitialOrganizationProfile(input: {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  organizationProfileName?: string | undefined;\n  targetSecretKey: Uint8Array;\n}) {\n  const organizationProfileDocument = await buildMaterializedDocumentCreatePlan(\n    {\n      author: input.author,\n      containerProjection: input.containerProjection,\n      documentId: await stableOrganizationProfileId(\n        input.author.organizationId,\n      ),\n      knownContainerKeks: input.knownContainerKeks,\n      targetSecretKey: input.targetSecretKey,\n      trustedLocalProjection: true,\n    },\n  );\n  const profile = await buildProvisionedOrganizationProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    materializedDocument: organizationProfileDocument,\n    name: input.organizationProfileName,\n  });\n  return { organizationProfileDocument, profile };\n}\n\n/**\n * Organization labels use an independent system root with Admins/admin and\n * Members/read grants. Personal root shares and rotations cannot expose or\n * strand organization metadata; Members changes still rotate its own KEK.\n */\nexport async function buildInitialOrganizationMetadataBootstrap(\n  input: InitialOrganizationMetadataBootstrapInput,\n): Promise<InitialOrganizationMetadataBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    containerId: input.containerId,\n    icon: null,\n    independentMetadataGroups: {\n      adminGroup: input.initialAdminGroup,\n      memberGroup: input.initialMemberGroup,\n    },\n    name: ORGANIZATION_METADATA_CONTAINER_NAME,\n    // Both reserved groups receive explicit grants on the independent root.\n    principalPolicies: await Promise.all([\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),\n    ]),\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationMetadataContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { organizationProfileDocument, profile } =\n    await buildInitialOrganizationProfile({\n      author: input.author,\n      containerProjection: core.containerProjection,\n      knownContainerKeks: core.knownContainerKeks,\n      organizationProfileName: input.organizationProfileName,\n      targetSecretKey: input.targetSecretKey,\n    });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    organizationProfileDocument,\n    organizationProfileDocumentRequest: profile.request,\n    organizationProfileSnapshot: profile.snapshot,\n    systemSlot: core.systemSlot,\n  };\n}\n\nexport async function buildInitialRootProvisioning(input: {\n  adminGroup: CreateOrganizationGroupRequest;\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n  recipientEncapsulationPublicKey: Uint8Array;\n  rootContainerId: string;\n  targetSecretKey: Uint8Array;\n}) {\n  const rootContainer = await buildRootContainerCreatePlan({\n    adminGroup: input.adminGroup,\n    author: input.author,\n    containerId: input.rootContainerId,\n    metadataDocumentId: input.bootstrap.metadataDocumentId,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n  });\n  const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(\n    rootContainer.plan,\n  );\n  const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: rootContainerProjection,\n    documentId: input.bootstrap.metadataDocumentId,\n    knownContainerKeks: new Map([\n      [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],\n    ]),\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  return {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest: {\n      ...rootMetadataDocument.plan.request,\n      initialSync: await buildInitialDocumentSyncRequest({\n        author: input.author,\n        containerProjection: rootContainerProjection,\n        initialUpdate: input.bootstrap.initialUpdate,\n        materializedDocument: rootMetadataDocument,\n      }),\n    },\n  };\n}\n"]}

package/workflows/registration/registerIdentity.d.ts

@@ -0,0 +1,83 @@
+import { type EncapsulationKeyPair, type ReferencedPrincipalHead, type SigningKeyPair } from "../../internal/crypto/index.js";
+import type { ProvisionedDocumentRequest, ProvisionedSystemContainerRequest, RegistrationRequest } from "../../internal/validators/request/index.js";
+import type { RegistrationResponse } from "../../internal/validators/response/index.js";
+import type { DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
+import type { ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
+import type { LocalUserIdentityCandidate } from "../../data/trustedUserIdentity/index.js";
+import type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
+import { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
+import { type ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
+export type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
+export type { ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
+export { persistOrganizationProvisioningState };
+export interface RegistrationApi {
+    registerUser(userId: string, organizationId: string, rootContainerId: string, signingPublicKey: Uint8Array, encapsulationPublicKey: Uint8Array, initialAdminGroup: RegistrationRequest["initialAdminGroup"], initialMemberGroup: RegistrationRequest["initialMemberGroup"], initialOrganizationPolicy: RegistrationRequest["initialOrganizationPolicy"], initialRootContainer: RegistrationRequest["initialRootContainer"], initialRootMetadataDocument: ProvisionedDocumentRequest, initialRosterProfileContainer: RegistrationRequest["initialRosterProfileContainer"], initialRosterProfileDocument: ProvisionedDocumentRequest | undefined, initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest, initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined, initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined): Promise<RegistrationResponse | null>;
+}
+export interface RegisterIdentityInput {
+    apiClient: RegistrationApi;
+    containerId: string;
+    dbClient: ExecSqlClientLike;
+    documentProjectors?: DocumentProjectorRegistryInput | undefined;
+    /**
+     * Reports whether the identity that started this registration is still
+     * current. Forwarded to the bootstrap persist's in-mutex currency check,
+     * so an identity replaced while the persist waits for the mutation queue
+     * cannot write its bootstrap through a client the replacement owns.
+     */
+    isIdentityCurrent?: (() => boolean) | undefined;
+    /** @internal Forwarded to the bootstrap persist; test-only seam. */
+    onPersistQueued?: (() => void) | undefined;
+    encapsulationKeyPair: EncapsulationKeyPair;
+    log?: ((message: string) => void) | undefined;
+    logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
+    /**
+     * Overrides the seeded personal-org profile name; defaults to "Personal Org".
+     */
+    organizationProfileName?: string | undefined;
+    pinLocalUserIdentity: (userId: string, candidate: LocalUserIdentityCandidate) => Promise<void>;
+    /**
+     * App-owned system containers to provision atomically with the personal
+     * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.
+     */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+    /**
+     * Overrides the seeded self roster-profile nickname; defaults to "You". The
+     * demo host passes each pane's peer-labeled self name ("Peer 1 (You)").
+     */
+    rosterProfileNickname?: string | undefined;
+    signingKeyFingerprint?: string | null | undefined;
+    signingKeyPair: SigningKeyPair;
+}
+/**
+ * The freshly built provisioning artifacts, shared by registration and
+ * additional-organization creation. `registerIdentity` generates a new
+ * `userId`; creating an additional organization reuses the caller's existing
+ * one. Everything here is derived purely from the caller's key material, so it
+ * is identical for both flows.
+ */
+export interface OrganizationProvisioningArtifactsInput {
+    encapsulationKeyPair: EncapsulationKeyPair;
+    organizationProfileName?: string | undefined;
+    /**
+     * App-owned system containers to provision atomically with the organization
+     * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and
+     * organization-metadata system containers.
+     */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+    rootContainerId: string;
+    rosterProfileNickname?: string | undefined;
+    signingKeyPair: SigningKeyPair;
+    userId: string;
+}
+export declare function buildInitialOrganizationPolicyRequest(input: {
+    adminGroupId: string;
+    groupHeads: readonly ReferencedPrincipalHead[];
+    encapsulationPublicKey: Uint8Array;
+    memberGroupId: string;
+    organizationId: string;
+    signingKeyPair: SigningKeyPair;
+    userId: string;
+}): Promise<RegistrationRequest["initialOrganizationPolicy"]>;
+/** Builds the signed artifacts shared by registration and org creation. */
+export declare function buildOrganizationProvisioningArtifacts(input: OrganizationProvisioningArtifactsInput): Promise<OrganizationProvisioningArtifacts>;
+export declare function registerIdentity(input: RegisterIdentityInput): Promise<RegistrationResponse | null>;