@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/registration/registerIdentity.js

@@ -0,0 +1,272 @@
+import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, KeyingVerificationError, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { encodeOrganizationAuthorityDescriptor } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { validateUserIdentityKeys } from "../../data/trustedUserIdentity/index.js";
+import { resolveDocumentCreateAuthor } from "../documents/author.js";
+import { groupPolicyMutationHead } from "../organizations/groupPolicyMutationHead.js";
+import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "../organizations/principalPolicy.js";
+import { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
+import { buildInitialOrganizationMetadataBootstrap, buildInitialRootProvisioning, buildInitialRosterProfileBootstrap, buildInitialSystemContainerBootstrap, } from "./provisioningBootstrapBuilders.js";
+import { createInitialRootMetadataBootstrap } from "./rootMetadataBootstrap.js";
+export { persistOrganizationProvisioningState };
+export async function buildInitialOrganizationPolicyRequest(input) {
+    const organizationKem = generateKemSeedAndKeyPair();
+    const signerUserKeyFingerprint = await toFingerprint(input.signingKeyPair.signingPublicKey);
+    const userEncapsulationKeyFingerprint = await toFingerprint(input.encapsulationPublicKey);
+    const projection = [
+        {
+            userId: input.userId,
+            role: "admin",
+        },
+    ];
+    const payloadCiphertext = encodeOrganizationAuthorityDescriptor({
+        version: 2,
+        organizationId: input.organizationId,
+        adminGroupId: input.adminGroupId,
+        memberGroupId: input.memberGroupId,
+        groupHeads: input.groupHeads.map((head) => {
+            if (head.principalType !== "group") {
+                throw new Error("Organization directory can contain only group heads");
+            }
+            return { ...head, principalType: "group" };
+        }),
+    });
+    const [memberEnvelope] = await wrapDekForRecipients(organizationKem.secretKey, [input.encapsulationPublicKey]);
+    if (!memberEnvelope) {
+        throw new Error("Failed to wrap organization key for registering user");
+    }
+    const memberEnvelopes = [
+        {
+            userId: input.userId,
+            memberKeyFingerprint: userEncapsulationKeyFingerprint,
+            kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),
+            wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),
+        },
+    ];
+    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
+        principalType: "organization",
+        principalId: input.organizationId,
+        version: 1,
+        prevStateHash: null,
+        keyEpoch: 1,
+        encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),
+        keyFingerprint: await toFingerprint(organizationKem.publicKey),
+        members: [{ userId: input.userId }],
+        memberEnvelopes,
+        projection,
+        grants: [],
+        payloadCiphertext,
+        externalAuthority: null,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.userId,
+        signerUserKeyFingerprint,
+    }), input.signingKeyPair.signingPrivateKey);
+    return {
+        state,
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm",
+            ciphertext: payloadCiphertext,
+            ciphertextHash: state.payloadCiphertextHash,
+        },
+        projection,
+        grants: [],
+        memberEnvelopes,
+    };
+}
+async function createOrganizationPrincipalPolicies(input) {
+    const organizationId = crypto.randomUUID();
+    const signingFingerprint = await toFingerprint(input.signingKeyPair.signingPublicKey);
+    const initialAdminGroup = await buildInitialGroupPolicyRequest({
+        creatorEncapsulationKeyPair: input.encapsulationKeyPair,
+        groupId: crypto.randomUUID(),
+        grants: [
+            { containerId: input.rootContainerId, accessLevel: "admin" },
+            {
+                containerId: input.organizationMetadataContainerId,
+                accessLevel: "admin",
+            },
+        ],
+        name: "Admins",
+        builtinRole: "admins",
+        signerUserId: input.userId,
+        signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({
+        creatorEncapsulationKeyPair: input.encapsulationKeyPair,
+        groupId: crypto.randomUUID(),
+        grants: [
+            {
+                containerId: input.organizationMetadataContainerId,
+                accessLevel: "read",
+            },
+        ],
+        signerUserId: input.userId,
+        signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest({
+        adminGroupId: initialAdminGroup.groupId,
+        encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+        groupHeads: await Promise.all([
+            groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),
+            groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),
+        ]),
+        memberGroupId: initialMemberGroup.groupId,
+        organizationId,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    });
+    return {
+        initialAdminGroup,
+        initialMemberGroup,
+        initialOrganizationPolicy,
+        organizationId,
+        signingFingerprint,
+    };
+}
+function requireOrganizationProvisioningAuthor(input) {
+    const author = resolveDocumentCreateAuthor({
+        auth: { organizationId: input.organizationId, userId: input.userId },
+        crypto: {
+            signingFingerprint: input.signingFingerprint,
+            signingKeyPair: input.signingKeyPair,
+        },
+    });
+    if (!author) {
+        throw new Error(`Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`);
+    }
+    return author;
+}
+/** Builds the signed artifacts shared by registration and org creation. */
+export async function buildOrganizationProvisioningArtifacts(input) {
+    const bootstrap = await createInitialRootMetadataBootstrap(input.rootContainerId);
+    const organizationMetadataContainerId = crypto.randomUUID();
+    const { initialAdminGroup, initialMemberGroup, initialOrganizationPolicy, organizationId, signingFingerprint, } = await createOrganizationPrincipalPolicies({
+        encapsulationKeyPair: input.encapsulationKeyPair,
+        organizationMetadataContainerId,
+        rootContainerId: input.rootContainerId,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    });
+    const author = requireOrganizationProvisioningAuthor({
+        organizationId,
+        signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    });
+    const { rootContainer, rootContainerProjection, rootMetadataDocument, rootMetadataDocumentRequest, } = await buildInitialRootProvisioning({
+        adminGroup: initialAdminGroup,
+        author,
+        bootstrap,
+        recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+        rootContainerId: input.rootContainerId,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    });
+    const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({
+        author,
+        encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+        initialAdminGroup,
+        rosterProfileNickname: input.rosterProfileNickname,
+        rootContainer,
+        rootContainerProjection,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    });
+    const organizationMetadataBootstrap = await buildInitialOrganizationMetadataBootstrap({
+        author,
+        containerId: organizationMetadataContainerId,
+        initialAdminGroup,
+        initialMemberGroup,
+        organizationProfileName: input.organizationProfileName,
+        rootContainer,
+        rootContainerProjection,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    });
+    const systemContainerBootstraps = await Promise.all((input.provisionedSystemContainers ?? []).map((spec) => buildInitialSystemContainerBootstrap({
+        author,
+        initialAdminGroup,
+        rootContainer,
+        rootContainerProjection,
+        signingPrivateKey: input.signingKeyPair.signingPrivateKey,
+        spec,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    })));
+    return {
+        replacementAuthorization: null,
+        bootstrap,
+        initialAdminGroup,
+        initialMemberGroup,
+        initialOrganizationPolicy,
+        initialRootContainer: rootContainer.plan.request,
+        organizationId,
+        organizationMetadataBootstrap,
+        rootContainer,
+        rootMetadataDocument,
+        rootMetadataDocumentRequest,
+        rosterProfileBootstrap,
+        systemContainerBootstraps,
+    };
+}
+export async function registerIdentity(input) {
+    input.log?.("Registering identity...");
+    await validateUserIdentityKeys({
+        candidate: {
+            encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+            signingKeyFingerprint: input.signingKeyFingerprint,
+            signingPublicKey: input.signingKeyPair.signingPublicKey,
+        },
+    });
+    const newUserId = crypto.randomUUID();
+    const artifacts = await buildOrganizationProvisioningArtifacts({
+        encapsulationKeyPair: input.encapsulationKeyPair,
+        organizationProfileName: input.organizationProfileName,
+        provisionedSystemContainers: input.provisionedSystemContainers,
+        rootContainerId: input.containerId,
+        rosterProfileNickname: input.rosterProfileNickname,
+        signingKeyPair: input.signingKeyPair,
+        userId: newUserId,
+    });
+    const response = await input.apiClient.registerUser(newUserId, artifacts.organizationId, input.containerId, input.signingKeyPair.signingPublicKey, input.encapsulationKeyPair.publicKey, artifacts.initialAdminGroup, artifacts.initialMemberGroup, artifacts.initialOrganizationPolicy, artifacts.initialRootContainer, artifacts.rootMetadataDocumentRequest, artifacts.rosterProfileBootstrap.containerRequest, artifacts.rosterProfileBootstrap.profileDocumentRequest, artifacts.organizationMetadataBootstrap.containerRequest, artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest, artifacts.systemContainerBootstraps.map((systemContainer) => systemContainer.containerRequest));
+    if (!response) {
+        return null;
+    }
+    if (response.userId !== newUserId) {
+        throw new KeyingVerificationError("object_mismatch", "Registration response user does not match the requested identity");
+    }
+    // Pinned only once the server has confirmed this user, and before anything
+    // is persisted under it. The trust store binds each signing key to one user,
+    // so a pin for an id the server never accepted — a retry after a lost
+    // response, or a restored key that is already registered — would later
+    // refuse the key's real user at login. Like the persistence below, it is a
+    // durable write, so it is skipped once the registering identity has been
+    // replaced: the caller discards this result.
+    if (input.isIdentityCurrent?.() ?? true) {
+        await input.pinLocalUserIdentity(newUserId, {
+            encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+            signingPublicKey: input.signingKeyPair.signingPublicKey,
+        });
+    }
+    input.log?.(`Key registered (${response.userId})`);
+    await persistOrganizationProvisioningState({
+        bootstrap: artifacts.bootstrap,
+        canStartDurableMutation: input.isIdentityCurrent,
+        onPersistQueued: input.onPersistQueued,
+        containerId: input.containerId,
+        dbClient: input.dbClient,
+        documentProjectors: input.documentProjectors,
+        initialAdminGroup: artifacts.initialAdminGroup,
+        initialMemberGroup: artifacts.initialMemberGroup,
+        initialOrganizationPolicy: artifacts.initialOrganizationPolicy,
+        log: input.log,
+        logError: input.logError,
+        organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,
+        response,
+        rootContainer: artifacts.rootContainer,
+        rootMetadataDocument: artifacts.rootMetadataDocument,
+        rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,
+        rosterProfileBootstrap: artifacts.rosterProfileBootstrap,
+        systemContainerBootstraps: artifacts.systemContainerBootstraps,
+    });
+    return response;
+}
+//# sourceMappingURL=registerIdentity.js.map

package/workflows/registration/registerIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerIdentity.js","sourceRoot":"","sources":["registerIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,yBAAyB,EACzB,uBAAuB,EAGvB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAG9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAC7F,OAAO,EACL,yCAAyC,EACzC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAI7E,OAAO,EAAE,oCAAoC,EAAE,CAAC;AA+FhD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,wBAAwB,GAAG,MAAM,aAAa,CAClD,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,aAAa,CACzD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,UAAU,GAAG;QACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,OAAgB;SACvB;KACF,CAAC;IACF,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CACjD,eAAe,CAAC,SAAS,EACzB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAC/B,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG;QACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,+BAA+B;YACrD,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,CAAC;QACX,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,wBAAwB;KACzB,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM,EAAE,EAAE;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;QAC7D,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE;YAC5D;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,OAAO;aACrB;SACF;QACD,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;QACpE,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,MAAM;aACpB;SACF;QACD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,qCAAqC,CAC3E;QACE,YAAY,EAAE,iBAAiB,CAAC,OAAO;QACvC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC7D,uBAAuB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;SAC/D,CAAC;QACF,aAAa,EAAE,kBAAkB,CAAC,OAAO;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACpE,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5D,MAAM,EACJ,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,GACnB,GAAG,MAAM,mCAAmC,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,+BAA+B;QAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC;QACnD,cAAc;QACd,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,MAAM,EACJ,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,GAAG,MAAM,4BAA4B,CAAC;QACrC,UAAU,EAAE,iBAAiB;QAC7B,MAAM;QACN,SAAS;QACT,+BAA+B,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,iBAAiB;QACjB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,6BAA6B,GACjC,MAAM,yCAAyC,CAAC;QAC9C,MAAM;QACN,WAAW,EAAE,+BAA+B;QAC5C,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACL,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,oCAAoC,CAAC;QACnC,MAAM;QACN,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;QACzD,IAAI;QACJ,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,SAAS;QACT,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;QAChD,cAAc;QACd,6BAA6B;QAC7B,aAAa;QACb,oBAAoB;QACpB,2BAA2B;QAC3B,sBAAsB;QACtB,yBAAyB;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE;YACT,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CACjD,SAAS,EACT,SAAS,CAAC,cAAc,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,cAAc,CAAC,gBAAgB,EACrC,KAAK,CAAC,oBAAoB,CAAC,SAAS,EACpC,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,SAAS,CAAC,yBAAyB,EACnC,SAAS,CAAC,oBAAoB,EAC9B,SAAS,CAAC,2BAA2B,EACrC,SAAS,CAAC,sBAAsB,CAAC,gBAAgB,EACjD,SAAS,CAAC,sBAAsB,CAAC,sBAAsB,EACvD,SAAS,CAAC,6BAA6B,CAAC,gBAAgB,EACxD,SAAS,CAAC,6BAA6B,CAAC,kCAAkC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,GAAG,CACrC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE;YAC1C,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { RegistrationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { encodeOrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type { LocalUserIdentityCandidate } from \"../../data/trustedUserIdentity\";\nimport { validateUserIdentityKeys } from \"../../data/trustedUserIdentity\";\nimport { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { groupPolicyMutationHead } from \"../organizations/groupPolicyMutationHead\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"../organizations/principalPolicy\";\nimport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nimport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nimport {\n  buildInitialOrganizationMetadataBootstrap,\n  buildInitialRootProvisioning,\n  buildInitialRosterProfileBootstrap,\n  buildInitialSystemContainerBootstrap,\n  type ProvisionedSystemContainerSpec,\n} from \"./provisioningBootstrapBuilders\";\nimport { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nexport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\nexport { persistOrganizationProvisioningState };\n\nexport interface RegistrationApi {\n  registerUser(\n    userId: string,\n    organizationId: string,\n    rootContainerId: string,\n    signingPublicKey: Uint8Array,\n    encapsulationPublicKey: Uint8Array,\n    initialAdminGroup: RegistrationRequest[\"initialAdminGroup\"],\n    initialMemberGroup: RegistrationRequest[\"initialMemberGroup\"],\n    initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"],\n    initialRootContainer: RegistrationRequest[\"initialRootContainer\"],\n    initialRootMetadataDocument: ProvisionedDocumentRequest,\n    initialRosterProfileContainer: RegistrationRequest[\"initialRosterProfileContainer\"],\n    initialRosterProfileDocument: ProvisionedDocumentRequest | undefined,\n    initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest,\n    initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined,\n    initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined,\n  ): Promise<RegistrationResponse | null>;\n}\n\ninterface OrganizationProvisioningPrincipalPolicies {\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  organizationId: string;\n  signingFingerprint: string;\n}\n\nexport interface RegisterIdentityInput {\n  apiClient: RegistrationApi;\n  containerId: string;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  /**\n   * Reports whether the identity that started this registration is still\n   * current. Forwarded to the bootstrap persist's in-mutex currency check,\n   * so an identity replaced while the persist waits for the mutation queue\n   * cannot write its bootstrap through a client the replacement owns.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /**\n   * Overrides the seeded personal-org profile name; defaults to \"Personal Org\".\n   */\n  organizationProfileName?: string | undefined;\n  pinLocalUserIdentity: (\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ) => Promise<void>;\n  /**\n   * App-owned system containers to provision atomically with the personal\n   * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname; defaults to \"You\". The\n   * demo host passes each pane's peer-labeled self name (\"Peer 1 (You)\").\n   */\n  rosterProfileNickname?: string | undefined;\n  signingKeyFingerprint?: string | null | undefined;\n  signingKeyPair: SigningKeyPair;\n}\n\n/**\n * The freshly built provisioning artifacts, shared by registration and\n * additional-organization creation. `registerIdentity` generates a new\n * `userId`; creating an additional organization reuses the caller's existing\n * one. Everything here is derived purely from the caller's key material, so it\n * is identical for both flows.\n */\nexport interface OrganizationProvisioningArtifactsInput {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the organization\n   * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and\n   * organization-metadata system containers.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  rootContainerId: string;\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}\n\nexport async function buildInitialOrganizationPolicyRequest(input: {\n  adminGroupId: string;\n  groupHeads: readonly ReferencedPrincipalHead[];\n  encapsulationPublicKey: Uint8Array;\n  memberGroupId: string;\n  organizationId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<RegistrationRequest[\"initialOrganizationPolicy\"]> {\n  const organizationKem = generateKemSeedAndKeyPair();\n  const signerUserKeyFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const userEncapsulationKeyFingerprint = await toFingerprint(\n    input.encapsulationPublicKey,\n  );\n  const projection = [\n    {\n      userId: input.userId,\n      role: \"admin\" as const,\n    },\n  ];\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    version: 2,\n    organizationId: input.organizationId,\n    adminGroupId: input.adminGroupId,\n    memberGroupId: input.memberGroupId,\n    groupHeads: input.groupHeads.map((head) => {\n      if (head.principalType !== \"group\") {\n        throw new Error(\"Organization directory can contain only group heads\");\n      }\n      return { ...head, principalType: \"group\" };\n    }),\n  });\n  const [memberEnvelope] = await wrapDekForRecipients(\n    organizationKem.secretKey,\n    [input.encapsulationPublicKey],\n  );\n\n  if (!memberEnvelope) {\n    throw new Error(\"Failed to wrap organization key for registering user\");\n  }\n  const memberEnvelopes = [\n    {\n      userId: input.userId,\n      memberKeyFingerprint: userEncapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),\n    },\n  ];\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.organizationId,\n      version: 1,\n      prevStateHash: null,\n      keyEpoch: 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: [{ userId: input.userId }],\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.userId,\n      signerUserKeyFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants: [],\n    memberEnvelopes,\n  };\n}\n\nasync function createOrganizationPrincipalPolicies(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationMetadataContainerId: string;\n  rootContainerId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<OrganizationProvisioningPrincipalPolicies> {\n  const organizationId = crypto.randomUUID();\n  const signingFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const initialAdminGroup = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      { containerId: input.rootContainerId, accessLevel: \"admin\" },\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"admin\",\n      },\n    ],\n    name: \"Admins\",\n    builtinRole: \"admins\",\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"read\",\n      },\n    ],\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest(\n    {\n      adminGroupId: initialAdminGroup.groupId,\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      groupHeads: await Promise.all([\n        groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),\n        groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),\n      ]),\n      memberGroupId: initialMemberGroup.groupId,\n      organizationId,\n      signingKeyPair: input.signingKeyPair,\n      userId: input.userId,\n    },\n  );\n\n  return {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  };\n}\n\nfunction requireOrganizationProvisioningAuthor(input: {\n  readonly organizationId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}) {\n  const author = resolveDocumentCreateAuthor({\n    auth: { organizationId: input.organizationId, userId: input.userId },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\n      `Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`,\n    );\n  }\n  return author;\n}\n\n/** Builds the signed artifacts shared by registration and org creation. */\nexport async function buildOrganizationProvisioningArtifacts(\n  input: OrganizationProvisioningArtifactsInput,\n): Promise<OrganizationProvisioningArtifacts> {\n  const bootstrap = await createInitialRootMetadataBootstrap(\n    input.rootContainerId,\n  );\n  const organizationMetadataContainerId = crypto.randomUUID();\n  const {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  } = await createOrganizationPrincipalPolicies({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationMetadataContainerId,\n    rootContainerId: input.rootContainerId,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n  const author = requireOrganizationProvisioningAuthor({\n    organizationId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n\n  const {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n  } = await buildInitialRootProvisioning({\n    adminGroup: initialAdminGroup,\n    author,\n    bootstrap,\n    recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    rootContainerId: input.rootContainerId,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({\n    author,\n    encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    initialAdminGroup,\n    rosterProfileNickname: input.rosterProfileNickname,\n    rootContainer,\n    rootContainerProjection,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const organizationMetadataBootstrap =\n    await buildInitialOrganizationMetadataBootstrap({\n      author,\n      containerId: organizationMetadataContainerId,\n      initialAdminGroup,\n      initialMemberGroup,\n      organizationProfileName: input.organizationProfileName,\n      rootContainer,\n      rootContainerProjection,\n      targetSecretKey: input.encapsulationKeyPair.secretKey,\n    });\n  const systemContainerBootstraps = await Promise.all(\n    (input.provisionedSystemContainers ?? []).map((spec) =>\n      buildInitialSystemContainerBootstrap({\n        author,\n        initialAdminGroup,\n        rootContainer,\n        rootContainerProjection,\n        signingPrivateKey: input.signingKeyPair.signingPrivateKey,\n        spec,\n        targetSecretKey: input.encapsulationKeyPair.secretKey,\n      }),\n    ),\n  );\n\n  return {\n    replacementAuthorization: null,\n    bootstrap,\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    initialRootContainer: rootContainer.plan.request,\n    organizationId,\n    organizationMetadataBootstrap,\n    rootContainer,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n    rosterProfileBootstrap,\n    systemContainerBootstraps,\n  };\n}\n\nexport async function registerIdentity(\n  input: RegisterIdentityInput,\n): Promise<RegistrationResponse | null> {\n  input.log?.(\"Registering identity...\");\n  await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingKeyFingerprint: input.signingKeyFingerprint,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    },\n  });\n\n  const newUserId = crypto.randomUUID();\n  const artifacts = await buildOrganizationProvisioningArtifacts({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId: input.containerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: newUserId,\n  });\n\n  const response = await input.apiClient.registerUser(\n    newUserId,\n    artifacts.organizationId,\n    input.containerId,\n    input.signingKeyPair.signingPublicKey,\n    input.encapsulationKeyPair.publicKey,\n    artifacts.initialAdminGroup,\n    artifacts.initialMemberGroup,\n    artifacts.initialOrganizationPolicy,\n    artifacts.initialRootContainer,\n    artifacts.rootMetadataDocumentRequest,\n    artifacts.rosterProfileBootstrap.containerRequest,\n    artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    artifacts.organizationMetadataBootstrap.containerRequest,\n    artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest,\n    artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n  );\n  if (!response) {\n    return null;\n  }\n  if (response.userId !== newUserId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Registration response user does not match the requested identity\",\n    );\n  }\n  // Pinned only once the server has confirmed this user, and before anything\n  // is persisted under it. The trust store binds each signing key to one user,\n  // so a pin for an id the server never accepted — a retry after a lost\n  // response, or a restored key that is already registered — would later\n  // refuse the key's real user at login. Like the persistence below, it is a\n  // durable write, so it is skipped once the registering identity has been\n  // replaced: the caller discards this result.\n  if (input.isIdentityCurrent?.() ?? true) {\n    await input.pinLocalUserIdentity(newUserId, {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  }\n\n  input.log?.(`Key registered (${response.userId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: input.containerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}

package/workflows/registration/registrationBootstrapPendingUpdates.js

@@ -0,0 +1,16 @@
+import { createPendingUpdateFields } from "../../data/documents/documentSync.js";
+import { sqlContainerContentsPersistence } from "../../data/persistence/container-contents/containerContentsPersistence.js";
+export async function enqueueInitialContainerMetadataUpdate(execSql, containerId, initialUpdate, initialUpdateCommitted) {
+    if (initialUpdateCommitted === true) {
+        return;
+    }
+    const initialMetadataUpdate = createPendingUpdateFields(initialUpdate);
+    if (!initialMetadataUpdate) {
+        return;
+    }
+    await sqlContainerContentsPersistence.enqueuePendingUpdate(execSql, {
+        containerId,
+        ...initialMetadataUpdate,
+    });
+}
+//# sourceMappingURL=registrationBootstrapPendingUpdates.js.map

package/workflows/registration/registrationBootstrapPendingUpdates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registrationBootstrapPendingUpdates.js","sourceRoot":"","sources":["registrationBootstrapPendingUpdates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wEAAwE,CAAC;AAGzH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAgB,EAChB,WAAmB,EACnB,aAAyB,EACzB,sBAA2C;IAE3C,IAAI,sBAAsB,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,MAAM,+BAA+B,CAAC,oBAAoB,CAAC,OAAO,EAAE;QAClE,WAAW;QACX,GAAG,qBAAqB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createPendingUpdateFields } from \"../../data/documents/documentSync\";\nimport { sqlContainerContentsPersistence } from \"../../data/persistence/container-contents/containerContentsPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport async function enqueueInitialContainerMetadataUpdate(\n  execSql: ExecSql,\n  containerId: string,\n  initialUpdate: Uint8Array,\n  initialUpdateCommitted: boolean | undefined,\n): Promise<void> {\n  if (initialUpdateCommitted === true) {\n    return;\n  }\n  const initialMetadataUpdate = createPendingUpdateFields(initialUpdate);\n  if (!initialMetadataUpdate) {\n    return;\n  }\n  await sqlContainerContentsPersistence.enqueuePendingUpdate(execSql, {\n    containerId,\n    ...initialMetadataUpdate,\n  });\n}\n"]}

package/workflows/registration/registrationPrincipalPolicyPersistence.d.ts

@@ -0,0 +1,13 @@
+import { type VerifiedPrincipalPolicy } from "../../internal/crypto/index.js";
+import type { CreateOrganizationGroupRequest, RegistrationRequest } from "../../internal/validators/request/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+export declare function principalPolicyBundleFromInitialGroupRequest(input: CreateOrganizationGroupRequest): Promise<PrincipalPolicyBundleResponse>;
+export declare function principalPolicyBundleFromInitialOrganizationRequest(input: RegistrationRequest["initialOrganizationPolicy"]): Promise<PrincipalPolicyBundleResponse>;
+export declare function verifiedPrincipalPolicyFromInitialGroupRequest(input: CreateOrganizationGroupRequest): Promise<VerifiedPrincipalPolicy>;
+export declare function persistRegistrationPrincipalPolicies(input: {
+    readonly adminGroup: PrincipalPolicyBundleResponse;
+    readonly execSql: ExecSql;
+    readonly memberGroup: PrincipalPolicyBundleResponse;
+    readonly organization: PrincipalPolicyBundleResponse;
+}): Promise<void>;

package/workflows/registration/registrationPrincipalPolicyPersistence.js

@@ -0,0 +1,74 @@
+import { computePrincipalStateHash, makeVerifiedPrincipalPolicy, } from "../../internal/crypto/index.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+async function principalPolicyBundleFromInitialRequest(principalType, principalId, policy) {
+    const createdAt = new Date().toISOString();
+    const stateHash = await computePrincipalStateHash(policy.state);
+    return {
+        currentState: { ...policy.state, stateHash, createdAt },
+        currentPayload: {
+            principalType,
+            principalId,
+            stateHash,
+            ...policy.encryptedPayload,
+            createdAt,
+        },
+        currentGrants: policy.grants,
+        currentProjection: policy.projection,
+        currentMemberEnvelopes: {
+            principalType,
+            principalId,
+            stateHash,
+            epoch: policy.state.keyEpoch,
+            envelopes: policy.memberEnvelopes,
+        },
+        previousStates: [],
+    };
+}
+export async function principalPolicyBundleFromInitialGroupRequest(input) {
+    return principalPolicyBundleFromInitialRequest("group", input.groupId, input.initialGroupPolicy);
+}
+export async function principalPolicyBundleFromInitialOrganizationRequest(input) {
+    return principalPolicyBundleFromInitialRequest("organization", input.state.principalId, input);
+}
+export async function verifiedPrincipalPolicyFromInitialGroupRequest(input) {
+    const bundle = await principalPolicyBundleFromInitialGroupRequest(input);
+    return verifiedPrincipalPolicyFromBundle(bundle);
+}
+function verifiedPrincipalPolicyFromBundle(bundle) {
+    return makeVerifiedPrincipalPolicy({
+        principalType: bundle.currentState.principalType,
+        principalId: bundle.currentState.principalId,
+        version: bundle.currentState.version,
+        keyEpoch: bundle.currentState.keyEpoch,
+        stateHash: bundle.currentState.stateHash,
+        state: bundle.currentState,
+        projection: bundle.currentProjection,
+        grants: bundle.currentGrants,
+        history: [
+            ...bundle.previousStates,
+            {
+                state: bundle.currentState,
+                projection: bundle.currentProjection,
+                grants: bundle.currentGrants,
+            },
+        ],
+        checkpoint: {
+            principalType: bundle.currentState.principalType,
+            principalId: bundle.currentState.principalId,
+            version: bundle.currentState.version,
+            stateHash: bundle.currentState.stateHash,
+        },
+    });
+}
+export async function persistRegistrationPrincipalPolicies(input) {
+    await persistLocallyAcknowledgedPrincipalPolicyBundles({
+        entries: [input.adminGroup, input.memberGroup, input.organization].map((bundle) => ({
+            bundle,
+            policy: verifiedPrincipalPolicyFromBundle(bundle),
+        })),
+        execSql: input.execSql,
+        organizationId: input.organization.currentState.principalId,
+        updatedAt: new Date().toISOString(),
+    });
+}
+//# sourceMappingURL=registrationPrincipalPolicyPersistence.js.map

package/workflows/registration/registrationPrincipalPolicyPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registrationPrincipalPolicyPersistence.js","sourceRoot":"","sources":["registrationPrincipalPolicyPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAE5B,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,gDAAgD,EAAE,MAAM,iEAAiE,CAAC;AAGnI,KAAK,UAAU,uCAAuC,CACpD,aAAuC,EACvC,WAAmB,EACnB,MAAiC;IAEjC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhE,OAAO;QACL,YAAY,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;QACvD,cAAc,EAAE;YACd,aAAa;YACb,WAAW;YACX,SAAS;YACT,GAAG,MAAM,CAAC,gBAAgB;YAC1B,SAAS;SACV;QACD,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,iBAAiB,EAAE,MAAM,CAAC,UAAU;QACpC,sBAAsB,EAAE;YACtB,aAAa;YACb,WAAW;YACX,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;YAC5B,SAAS,EAAE,MAAM,CAAC,eAAe;SAClC;QACD,cAAc,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAAqC;IAErC,OAAO,uCAAuC,CAC5C,OAAO,EACP,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mDAAmD,CACvE,KAAuD;IAEvD,OAAO,uCAAuC,CAC5C,cAAc,EACd,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,KAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,KAAK,CAAC,CAAC;IAEzE,OAAO,iCAAiC,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,iCAAiC,CACxC,MAAqC;IAErC,OAAO,2BAA2B,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;QACpC,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,cAAc;YACxB;gBACE,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;gBACpC,MAAM,EAAE,MAAM,CAAC,aAAa;aAC7B;SACF;QACD,UAAU,EAAE;YACV,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;YAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;YACpC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CACpE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACX,MAAM;YACN,MAAM,EAAE,iCAAiC,CAAC,MAAM,CAAC;SAClD,CAAC,CACH;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW;QAC3D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  computePrincipalStateHash,\n  makeVerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  CreateOrganizationGroupRequest,\n  PutPrincipalPolicyRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nasync function principalPolicyBundleFromInitialRequest(\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  policy: PutPrincipalPolicyRequest,\n): Promise<PrincipalPolicyBundleResponse> {\n  const createdAt = new Date().toISOString();\n  const stateHash = await computePrincipalStateHash(policy.state);\n\n  return {\n    currentState: { ...policy.state, stateHash, createdAt },\n    currentPayload: {\n      principalType,\n      principalId,\n      stateHash,\n      ...policy.encryptedPayload,\n      createdAt,\n    },\n    currentGrants: policy.grants,\n    currentProjection: policy.projection,\n    currentMemberEnvelopes: {\n      principalType,\n      principalId,\n      stateHash,\n      epoch: policy.state.keyEpoch,\n      envelopes: policy.memberEnvelopes,\n    },\n    previousStates: [],\n  };\n}\n\nexport async function principalPolicyBundleFromInitialGroupRequest(\n  input: CreateOrganizationGroupRequest,\n): Promise<PrincipalPolicyBundleResponse> {\n  return principalPolicyBundleFromInitialRequest(\n    \"group\",\n    input.groupId,\n    input.initialGroupPolicy,\n  );\n}\n\nexport async function principalPolicyBundleFromInitialOrganizationRequest(\n  input: RegistrationRequest[\"initialOrganizationPolicy\"],\n): Promise<PrincipalPolicyBundleResponse> {\n  return principalPolicyBundleFromInitialRequest(\n    \"organization\",\n    input.state.principalId,\n    input,\n  );\n}\n\nexport async function verifiedPrincipalPolicyFromInitialGroupRequest(\n  input: CreateOrganizationGroupRequest,\n): Promise<VerifiedPrincipalPolicy> {\n  const bundle = await principalPolicyBundleFromInitialGroupRequest(input);\n\n  return verifiedPrincipalPolicyFromBundle(bundle);\n}\n\nfunction verifiedPrincipalPolicyFromBundle(\n  bundle: PrincipalPolicyBundleResponse,\n): VerifiedPrincipalPolicy {\n  return makeVerifiedPrincipalPolicy({\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    state: bundle.currentState,\n    projection: bundle.currentProjection,\n    grants: bundle.currentGrants,\n    history: [\n      ...bundle.previousStates,\n      {\n        state: bundle.currentState,\n        projection: bundle.currentProjection,\n        grants: bundle.currentGrants,\n      },\n    ],\n    checkpoint: {\n      principalType: bundle.currentState.principalType,\n      principalId: bundle.currentState.principalId,\n      version: bundle.currentState.version,\n      stateHash: bundle.currentState.stateHash,\n    },\n  });\n}\n\nexport async function persistRegistrationPrincipalPolicies(input: {\n  readonly adminGroup: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly memberGroup: PrincipalPolicyBundleResponse;\n  readonly organization: PrincipalPolicyBundleResponse;\n}): Promise<void> {\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [input.adminGroup, input.memberGroup, input.organization].map(\n      (bundle) => ({\n        bundle,\n        policy: verifiedPrincipalPolicyFromBundle(bundle),\n      }),\n    ),\n    execSql: input.execSql,\n    organizationId: input.organization.currentState.principalId,\n    updatedAt: new Date().toISOString(),\n  });\n}\n"]}

package/workflows/registration/rootMetadataBootstrap.d.ts

@@ -0,0 +1,5 @@
+export interface InitialRootMetadataBootstrap {
+    initialUpdate: Uint8Array;
+    metadataDocumentId: string;
+}
+export declare function createInitialRootMetadataBootstrap(containerId: string): Promise<InitialRootMetadataBootstrap>;

package/workflows/registration/rootMetadataBootstrap.js

@@ -0,0 +1,13 @@
+import { createInitializedContainerMetadataDocument } from "../../data/containers/containerMetadataDocument.js";
+export async function createInitialRootMetadataBootstrap(containerId) {
+    const metadataDocumentId = crypto.randomUUID();
+    const { initialUpdate } = await createInitializedContainerMetadataDocument(containerId, {
+        icon: null,
+        name: "/",
+    });
+    return {
+        initialUpdate,
+        metadataDocumentId,
+    };
+}
+//# sourceMappingURL=rootMetadataBootstrap.js.map

package/workflows/registration/rootMetadataBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootMetadataBootstrap.js","sourceRoot":"","sources":["rootMetadataBootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAO7G,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,WAAmB;IAEnB,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,GAAG;KACV,CACF,CAAC;IAEF,OAAO;QACL,aAAa;QACb,kBAAkB;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import { createInitializedContainerMetadataDocument } from \"../../data/containers/containerMetadataDocument\";\n\nexport interface InitialRootMetadataBootstrap {\n  initialUpdate: Uint8Array;\n  metadataDocumentId: string;\n}\n\nexport async function createInitialRootMetadataBootstrap(\n  containerId: string,\n): Promise<InitialRootMetadataBootstrap> {\n  const metadataDocumentId = crypto.randomUUID();\n  const { initialUpdate } = await createInitializedContainerMetadataDocument(\n    containerId,\n    {\n      icon: null,\n      name: \"/\",\n    },\n  );\n\n  return {\n    initialUpdate,\n    metadataDocumentId,\n  };\n}\n"]}

package/workflows/root/dataUsage.d.ts

@@ -0,0 +1,11 @@
+import type { RequestResult } from "../../internal/api-client/index.js";
+import type { OrganizationDataUsageResponse, RootDataUsageReportResponse } from "../../internal/validators/response/index.js";
+import { type RootRequestOutcome } from "./identities.js";
+import type { RootOrganizationsQueryInput } from "./organizations.js";
+export type RootDataUsageReportPage = RootDataUsageReportResponse;
+export interface RootDataUsageApi {
+    getRootOrganizationDataUsageResult(organizationId: string): Promise<RequestResult<OrganizationDataUsageResponse>>;
+    listRootDataUsageReportResult(query?: RootOrganizationsQueryInput): Promise<RequestResult<RootDataUsageReportResponse>>;
+}
+export declare function loadRootOrganizationDataUsage(api: RootDataUsageApi, organizationId: string): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;
+export declare function listRootDataUsageReport(api: RootDataUsageApi, query?: RootOrganizationsQueryInput): Promise<RootRequestOutcome<RootDataUsageReportPage>>;

package/workflows/root/dataUsage.js

@@ -0,0 +1,8 @@
+import { toOutcome } from "./identities.js";
+export async function loadRootOrganizationDataUsage(api, organizationId) {
+    return toOutcome(await api.getRootOrganizationDataUsageResult(organizationId));
+}
+export async function listRootDataUsageReport(api, query = {}) {
+    return toOutcome(await api.listRootDataUsageReportResult(query));
+}
+//# sourceMappingURL=dataUsage.js.map

package/workflows/root/dataUsage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataUsage.js","sourceRoot":"","sources":["dataUsage.ts"],"names":[],"mappings":"AAKA,OAAO,EAA2B,SAAS,EAAE,MAAM,cAAc,CAAC;AAYlE,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAqB,EACrB,cAAsB;IAEtB,OAAO,SAAS,CACd,MAAM,GAAG,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAC7D,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAqB,EACrB,QAAqC,EAAE;IAEvC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type {\n  OrganizationDataUsageResponse,\n  RootDataUsageReportResponse,\n} from \"@tearleads/validators/response\";\nimport { type RootRequestOutcome, toOutcome } from \"./identities\";\nimport type { RootOrganizationsQueryInput } from \"./organizations\";\n\nexport type RootDataUsageReportPage = RootDataUsageReportResponse;\nexport interface RootDataUsageApi {\n  getRootOrganizationDataUsageResult(\n    organizationId: string,\n  ): Promise<RequestResult<OrganizationDataUsageResponse>>;\n  listRootDataUsageReportResult(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RequestResult<RootDataUsageReportResponse>>;\n}\nexport async function loadRootOrganizationDataUsage(\n  api: RootDataUsageApi,\n  organizationId: string,\n): Promise<RootRequestOutcome<OrganizationDataUsageResponse>> {\n  return toOutcome(\n    await api.getRootOrganizationDataUsageResult(organizationId),\n  );\n}\nexport async function listRootDataUsageReport(\n  api: RootDataUsageApi,\n  query: RootOrganizationsQueryInput = {},\n): Promise<RootRequestOutcome<RootDataUsageReportPage>> {\n  return toOutcome(await api.listRootDataUsageReportResult(query));\n}\n"]}

package/workflows/root/identities.d.ts

@@ -0,0 +1,38 @@
+import type { RequestResult } from "../../internal/api-client/index.js";
+import type { RootIdentitiesQuery } from "../../internal/validators/operation/index.js";
+import type { RootIdentitiesResponse, RootIdentityDetailResponse, RootIdentityOrganizationResponse, RootIdentityOrganizationsResponse, RootIdentitySessionResponse, RootIdentitySummaryResponse } from "../../internal/validators/response/index.js";
+/** One registered identity as the platform operator sees it (wire shape). */
+export type RootIdentity = RootIdentitySummaryResponse;
+/** A page of identities plus the opaque cursor for the next page. */
+export type RootIdentitiesPage = RootIdentitiesResponse;
+/** A live session of an inspected identity (wire shape). */
+export type RootIdentitySession = RootIdentitySessionResponse;
+/** An identity with its live sessions (wire shape). */
+export type RootIdentityDetail = RootIdentityDetailResponse;
+/** One organization the identity belongs to, with roster and billing state. */
+export type RootIdentityOrganization = RootIdentityOrganizationResponse;
+/** Listing filters and paging for `listRootIdentities`. */
+export type RootIdentitiesQueryInput = RootIdentitiesQuery;
+/**
+ * Terminal outcome of a root request. Failures carry the HTTP status when one
+ * was received (403 means the session is no longer root) and a message that
+ * is safe to surface to the operator.
+ */
+export type RootRequestOutcome<Data> = {
+    readonly data: Data;
+    readonly ok: true;
+} | {
+    readonly message: string;
+    readonly ok: false;
+    readonly status: number | null;
+};
+/** The root methods these workflows need from the api client. */
+export interface RootIdentitiesApi {
+    readonly getRootIdentityResult: (userId: string) => Promise<RequestResult<RootIdentityDetailResponse>>;
+    readonly listRootIdentitiesResult: (query?: RootIdentitiesQuery) => Promise<RequestResult<RootIdentitiesResponse>>;
+    readonly listRootIdentityOrganizationsResult: (userId: string) => Promise<RequestResult<RootIdentityOrganizationsResponse>>;
+}
+export declare function toOutcome<Data>(result: RequestResult<Data>): RootRequestOutcome<Data>;
+export declare function listRootIdentities(api: RootIdentitiesApi, query?: RootIdentitiesQueryInput): Promise<RootRequestOutcome<RootIdentitiesPage>>;
+export declare function loadRootIdentity(api: RootIdentitiesApi, userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;
+export declare function listRootIdentityOrganizations(api: RootIdentitiesApi, userId: string): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;

package/workflows/root/identities.js

@@ -0,0 +1,19 @@
+export function toOutcome(result) {
+    if (result.ok) {
+        return { data: result.data, ok: true };
+    }
+    return { message: result.message, ok: false, status: result.status };
+}
+export async function listRootIdentities(api, query = {}) {
+    return toOutcome(await api.listRootIdentitiesResult(query));
+}
+export async function loadRootIdentity(api, userId) {
+    return toOutcome(await api.getRootIdentityResult(userId));
+}
+export async function listRootIdentityOrganizations(api, userId) {
+    const result = await api.listRootIdentityOrganizationsResult(userId);
+    return result.ok
+        ? { data: result.data.organizations, ok: true }
+        : toOutcome(result);
+}
+//# sourceMappingURL=identities.js.map

package/workflows/root/identities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identities.js","sourceRoot":"","sources":["identities.ts"],"names":[],"mappings":"AAuDA,MAAM,UAAU,SAAS,CACvB,MAA2B;IAE3B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAsB,EACtB,QAAkC,EAAE;IAEpC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAsB,EACtB,MAAc;IAEd,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,EAAE;QACd,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE;QAC/C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { RootIdentitiesQuery } from \"@tearleads/validators/operation\";\nimport type {\n  RootIdentitiesResponse,\n  RootIdentityDetailResponse,\n  RootIdentityOrganizationResponse,\n  RootIdentityOrganizationsResponse,\n  RootIdentitySessionResponse,\n  RootIdentitySummaryResponse,\n} from \"@tearleads/validators/response\";\n\n/** One registered identity as the platform operator sees it (wire shape). */\nexport type RootIdentity = RootIdentitySummaryResponse;\n\n/** A page of identities plus the opaque cursor for the next page. */\nexport type RootIdentitiesPage = RootIdentitiesResponse;\n\n/** A live session of an inspected identity (wire shape). */\nexport type RootIdentitySession = RootIdentitySessionResponse;\n\n/** An identity with its live sessions (wire shape). */\nexport type RootIdentityDetail = RootIdentityDetailResponse;\n\n/** One organization the identity belongs to, with roster and billing state. */\nexport type RootIdentityOrganization = RootIdentityOrganizationResponse;\n\n/** Listing filters and paging for `listRootIdentities`. */\nexport type RootIdentitiesQueryInput = RootIdentitiesQuery;\n\n/**\n * Terminal outcome of a root request. Failures carry the HTTP status when one\n * was received (403 means the session is no longer root) and a message that\n * is safe to surface to the operator.\n */\nexport type RootRequestOutcome<Data> =\n  | { readonly data: Data; readonly ok: true }\n  | {\n      readonly message: string;\n      readonly ok: false;\n      readonly status: number | null;\n    };\n\n/** The root methods these workflows need from the api client. */\nexport interface RootIdentitiesApi {\n  readonly getRootIdentityResult: (\n    userId: string,\n  ) => Promise<RequestResult<RootIdentityDetailResponse>>;\n  readonly listRootIdentitiesResult: (\n    query?: RootIdentitiesQuery,\n  ) => Promise<RequestResult<RootIdentitiesResponse>>;\n  readonly listRootIdentityOrganizationsResult: (\n    userId: string,\n  ) => Promise<RequestResult<RootIdentityOrganizationsResponse>>;\n}\n\nexport function toOutcome<Data>(\n  result: RequestResult<Data>,\n): RootRequestOutcome<Data> {\n  if (result.ok) {\n    return { data: result.data, ok: true };\n  }\n  return { message: result.message, ok: false, status: result.status };\n}\n\nexport async function listRootIdentities(\n  api: RootIdentitiesApi,\n  query: RootIdentitiesQueryInput = {},\n): Promise<RootRequestOutcome<RootIdentitiesPage>> {\n  return toOutcome(await api.listRootIdentitiesResult(query));\n}\n\nexport async function loadRootIdentity(\n  api: RootIdentitiesApi,\n  userId: string,\n): Promise<RootRequestOutcome<RootIdentityDetail>> {\n  return toOutcome(await api.getRootIdentityResult(userId));\n}\n\nexport async function listRootIdentityOrganizations(\n  api: RootIdentitiesApi,\n  userId: string,\n): Promise<RootRequestOutcome<RootIdentityOrganization[]>> {\n  const result = await api.listRootIdentityOrganizationsResult(userId);\n  return result.ok\n    ? { data: result.data.organizations, ok: true }\n    : toOutcome(result);\n}\n"]}

package/workflows/root/index.d.ts

@@ -0,0 +1,3 @@
+export { listRootDataUsageReport, loadRootOrganizationDataUsage, type RootDataUsageApi, type RootDataUsageReportPage, } from "./dataUsage.js";
+export { listRootIdentities, listRootIdentityOrganizations, loadRootIdentity, type RootIdentitiesApi, type RootIdentitiesPage, type RootIdentitiesQueryInput, type RootIdentity, type RootIdentityDetail, type RootIdentityOrganization, type RootIdentitySession, type RootRequestOutcome, } from "./identities.js";
+export { listRootOrganizationIdentities, listRootOrganizations, loadRootOrganization, type RootOrganization, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationIdentity, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, } from "./organizations.js";

package/workflows/root/index.js

@@ -0,0 +1,4 @@
+export { listRootDataUsageReport, loadRootOrganizationDataUsage, } from "./dataUsage.js";
+export { listRootIdentities, listRootIdentityOrganizations, loadRootIdentity, } from "./identities.js";
+export { listRootOrganizationIdentities, listRootOrganizations, loadRootOrganization, } from "./organizations.js";
+//# sourceMappingURL=index.js.map

package/workflows/root/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAG9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,gBAAgB,GASjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,oBAAoB,GASrB,MAAM,iBAAiB,CAAC","sourcesContent":["export {\n  listRootDataUsageReport,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n} from \"./dataUsage\";\nexport {\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  loadRootIdentity,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentity,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootIdentitySession,\n  type RootRequestOutcome,\n} from \"./identities\";\nexport {\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootOrganization,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./organizations\";\n"]}

package/workflows/root/organizations.d.ts

@@ -0,0 +1,19 @@
+import type { RequestResult } from "../../internal/api-client/index.js";
+import type { RootOrganizationPageQuery, RootOrganizationsQuery } from "../../internal/validators/operation/index.js";
+import type { RootOrganizationDetailResponse, RootOrganizationIdentitiesResponse, RootOrganizationIdentityResponse, RootOrganizationSummaryResponse, RootOrganizationsResponse } from "../../internal/validators/response/index.js";
+import { type RootRequestOutcome } from "./identities.js";
+export type RootOrganization = RootOrganizationSummaryResponse;
+export type RootOrganizationsPage = RootOrganizationsResponse;
+export type RootOrganizationDetail = RootOrganizationDetailResponse;
+export type RootOrganizationIdentity = RootOrganizationIdentityResponse;
+export type RootOrganizationIdentitiesPage = RootOrganizationIdentitiesResponse;
+export type RootOrganizationsQueryInput = RootOrganizationsQuery;
+export type RootOrganizationPageQueryInput = RootOrganizationPageQuery;
+export interface RootOrganizationsApi {
+    listRootOrganizationsResult(query?: RootOrganizationsQuery): Promise<RequestResult<RootOrganizationsResponse>>;
+    getRootOrganizationResult(organizationId: string): Promise<RequestResult<RootOrganizationDetailResponse>>;
+    listRootOrganizationIdentitiesResult(organizationId: string, query?: RootOrganizationPageQuery): Promise<RequestResult<RootOrganizationIdentitiesResponse>>;
+}
+export declare function listRootOrganizations(api: RootOrganizationsApi, query?: RootOrganizationsQueryInput): Promise<RootRequestOutcome<RootOrganizationsPage>>;
+export declare function loadRootOrganization(api: RootOrganizationsApi, organizationId: string): Promise<RootRequestOutcome<RootOrganizationDetail>>;
+export declare function listRootOrganizationIdentities(api: RootOrganizationsApi, organizationId: string, query?: RootOrganizationPageQueryInput): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;