@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/client/organizations/principalMutations.js

@@ -0,0 +1,194 @@
+import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
+import { addOrganizationGroupUser, createOrganizationGroup, deleteOrganizationGroup, removeOrganizationGroupUser, revokeOrganizationContainerGrant, rotateOrganizationGroupForAccessSetShrink, } from "../../workflows/organizations/index.js";
+import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
+import { syncOrganizationMetadataProfile } from "./organizationMetadataProfileSync.js";
+import { preparePrincipalContainerMutations } from "./principalContainerMutations.js";
+function requireSigningContext(runtime) {
+    if (!runtime.auth.organizationId ||
+        !runtime.auth.userId ||
+        !runtime.crypto.signingFingerprint ||
+        !runtime.crypto.signingKeyPair) {
+        throw new Error("Organization signing context is unavailable");
+    }
+    return {
+        organizationId: runtime.auth.organizationId,
+        signerUserId: runtime.auth.userId,
+        signingFingerprint: runtime.crypto.signingFingerprint,
+        signingKeyPair: runtime.crypto.signingKeyPair,
+    };
+}
+function requireEncapsulationKeyPair(runtime) {
+    if (!runtime.crypto.encapsulationKeyPair) {
+        throw new Error("Organization encryption context is unavailable");
+    }
+    return runtime.crypto.encapsulationKeyPair;
+}
+export async function addUserToOrganizationGroup(input) {
+    const signingContext = requireSigningContext(input.runtime);
+    return runWithSecurityIncidentReporting(input.runtime.util.reportSecurityIncident, {
+        objectId: input.groupId,
+        objectKind: "principal",
+        operation: "group.member.add",
+        organizationId: signingContext.organizationId,
+    }, async () => {
+        let memberGroupId = null;
+        const bundle = await addOrganizationGroupUser({
+            apiClient: input.runtime.apiClient,
+            beforePolicyCommit: (_head, authority) => {
+                memberGroupId = authority.memberGroupId;
+            },
+            currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)
+                .secretKey,
+            execSql: input.runtime.infra.execSql,
+            expectedGroupName: input.expectedGroupName,
+            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+            groupId: input.groupId,
+            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                currentPolicy,
+                groupId: input.groupId,
+                nextPolicy,
+                organizationId: signingContext.organizationId,
+                runtime: input.runtime,
+                stillCurrent: input.stillCurrent,
+            }),
+            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            targetUserId: input.targetUserId,
+            ...signingContext,
+        });
+        if (input.groupId === memberGroupId) {
+            await syncOrganizationMetadataProfile({
+                containerContents: input.containerContents,
+                log: input.runtime.util.log,
+                organizationId: signingContext.organizationId,
+            });
+        }
+        await input.readModelCoordinator.reconcileAfterMutation(signingContext.organizationId);
+        return bundle;
+    });
+}
+export function createGroupForOrganization(input) {
+    const signingContext = requireSigningContext(input.runtime);
+    return runWithSecurityIncidentReporting(input.runtime.util.reportSecurityIncident, {
+        objectId: signingContext.organizationId,
+        objectKind: "principal",
+        operation: "group.create",
+        organizationId: signingContext.organizationId,
+    }, () => createOrganizationGroup({
+        apiClient: input.runtime.apiClient,
+        creatorEncapsulationKeyPair: requireEncapsulationKeyPair(input.runtime),
+        execSql: input.runtime.infra.execSql,
+        name: input.name,
+        metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId),
+        reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        ...signingContext,
+    }));
+}
+export function deleteGroupForOrganization(input) {
+    const signingContext = requireSigningContext(input.runtime);
+    return runWithSecurityIncidentReporting(input.runtime.util.reportSecurityIncident, {
+        objectId: input.groupId,
+        objectKind: "principal",
+        operation: "group.delete",
+        organizationId: signingContext.organizationId,
+    }, () => deleteOrganizationGroup({
+        apiClient: input.runtime.apiClient,
+        execSql: input.runtime.infra.execSql,
+        groupId: input.groupId,
+        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        ...signingContext,
+    }));
+}
+export async function removeUserFromOrganizationGroup(input) {
+    const signingContext = requireSigningContext(input.runtime);
+    return runWithSecurityIncidentReporting(input.runtime.util.reportSecurityIncident, {
+        objectId: input.groupId,
+        objectKind: "principal",
+        operation: "group.member.remove",
+        organizationId: signingContext.organizationId,
+    }, async () => {
+        let memberGroupId = null;
+        const bundle = await removeOrganizationGroupUser({
+            apiClient: input.runtime.apiClient,
+            beforePolicyCommit: (_head, authority) => {
+                memberGroupId = authority.memberGroupId;
+            },
+            execSql: input.runtime.infra.execSql,
+            expectedGroupName: input.expectedGroupName,
+            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+            groupId: input.groupId,
+            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                currentPolicy,
+                groupId: input.groupId,
+                nextPolicy,
+                organizationId: signingContext.organizationId,
+                runtime: input.runtime,
+                stillCurrent: input.stillCurrent,
+            }),
+            removedUserId: input.removedUserId,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            ...signingContext,
+        });
+        if (input.groupId === memberGroupId) {
+            await syncOrganizationMetadataProfile({
+                containerContents: input.containerContents,
+                log: input.runtime.util.log,
+                organizationId: signingContext.organizationId,
+            });
+        }
+        await input.readModelCoordinator.reconcileAfterMutation(signingContext.organizationId);
+        return bundle;
+    });
+}
+export async function revokeOrganizationGrant(input) {
+    const signingContext = requireSigningContext(input.runtime);
+    const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);
+    if (input.runtime.infra.dbStatus !== "ready") {
+        throw new Error("Organization local database is unavailable");
+    }
+    return runWithSecurityIncidentReporting(input.runtime.util.reportSecurityIncident, {
+        objectId: input.subjectId,
+        objectKind: "principal",
+        operation: "principal.grant.revoke",
+        organizationId: signingContext.organizationId,
+    }, async () => {
+        const response = input.subjectType === "group"
+            ? await rotateOrganizationGroupForAccessSetShrink({
+                apiClient: input.runtime.apiClient,
+                execSql: input.runtime.infra.execSql,
+                groupId: input.subjectId,
+                revokedContainerId: input.containerId,
+                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                    currentPolicy,
+                    groupId: input.subjectId,
+                    nextPolicy,
+                    organizationId: signingContext.organizationId,
+                    revokedContainerId: input.containerId,
+                    runtime: input.runtime,
+                    stillCurrent: input.stillCurrent,
+                }),
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                ...signingContext,
+            })
+            : await revokeOrganizationContainerGrant({
+                stillCurrent: input.stillCurrent,
+                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                apiClient: input.runtime.apiClient,
+                containerId: input.containerId,
+                encapsulationKeyPair,
+                execSql: input.runtime.infra.execSql,
+                revokedSubject: {
+                    subjectId: input.subjectId,
+                    subjectType: input.subjectType,
+                },
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+                ...signingContext,
+            });
+        await input.readModelCoordinator.reconcileAfterMutation(signingContext.organizationId);
+        return response;
+    });
+}
+//# sourceMappingURL=principalMutations.js.map

package/client/organizations/principalMutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,gCAAgC,EAChC,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAgCnF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;YAC1C,CAAC;YACD,oBAAoB,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC7D,SAAS;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;gBACjC,aAAa;gBACb,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE,CACH,uBAAuB,CAAC;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,2BAA2B,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,CAC9B;QACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,GAAG,cAAc;KAClB,CAAC,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE,CACH,uBAAuB,CAAC;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,GAAG,cAAc;KAClB,CAAC,CACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;YAC/C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;gBACjC,aAAa;gBACb,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GACZ,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,MAAM,yCAAyC,CAAC;gBAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,kBAAkB,EAAE,KAAK,CAAC,WAAW;gBACrC,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,SAAS;oBACxB,UAAU;oBACV,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,kBAAkB,EAAE,KAAK,CAAC,WAAW;oBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;gBACJ,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBAC1C,GAAG,cAAc;aAClB,CAAC;YACJ,CAAC,CAAC,MAAM,gCAAgC,CAAC;gBACrC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,oBAAoB;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,cAAc,EAAE;oBACd,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;gBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBAC1C,+BAA+B,EAC7B,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC;gBACnD,GAAG,cAAc;aAClB,CAAC,CAAC;QACT,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  addOrganizationGroupUser,\n  createOrganizationGroup,\n  deleteOrganizationGroup,\n  removeOrganizationGroupUser,\n  revokeOrganizationContainerGrant,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"../../workflows/organizations\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\nexport interface OrganizationGrantRef {\n  containerId: string;\n  subjectId: string;\n  subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n  groupId: string;\n  expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n  organizationId: string;\n  signerUserId: string;\n  signingFingerprint: string;\n  signingKeyPair: NonNullable<\n    InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n  >;\n}\n\nfunction requireSigningContext(\n  runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.auth.userId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair\n  ) {\n    throw new Error(\"Organization signing context is unavailable\");\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerUserId: runtime.auth.userId,\n    signingFingerprint: runtime.crypto.signingFingerprint,\n    signingKeyPair: runtime.crypto.signingKeyPair,\n  };\n}\n\nfunction requireEncapsulationKeyPair(\n  runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n  if (!runtime.crypto.encapsulationKeyPair) {\n    throw new Error(\"Organization encryption context is unavailable\");\n  }\n\n  return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n  readonly stillCurrent: () => boolean;\n  readonly containerContents: ContainerContents;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n  input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.add\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const bundle = await addOrganizationGroupUser({\n        apiClient: input.runtime.apiClient,\n        beforePolicyCommit: (_head, authority) => {\n          memberGroupId = authority.memberGroupId;\n        },\n        currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)\n          .secretKey,\n        execSql: input.runtime.infra.execSql,\n        expectedGroupName: input.expectedGroupName,\n        readEncryptedName: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ).readName,\n        groupId: input.groupId,\n        prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n          preparePrincipalContainerMutations({\n            currentPolicy,\n            groupId: input.groupId,\n            nextPolicy,\n            organizationId: signingContext.organizationId,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          }),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        targetUserId: input.targetUserId,\n        ...signingContext,\n      });\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport function createGroupForOrganization(input: {\n  readonly name: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: signingContext.organizationId,\n      objectKind: \"principal\",\n      operation: \"group.create\",\n      organizationId: signingContext.organizationId,\n    },\n    () =>\n      createOrganizationGroup({\n        apiClient: input.runtime.apiClient,\n        creatorEncapsulationKeyPair: requireEncapsulationKeyPair(input.runtime),\n        execSql: input.runtime.infra.execSql,\n        name: input.name,\n        metadataAccess: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n        ),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      }),\n  );\n}\n\nexport function deleteGroupForOrganization(input: {\n  readonly groupId: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.delete\",\n      organizationId: signingContext.organizationId,\n    },\n    () =>\n      deleteOrganizationGroup({\n        apiClient: input.runtime.apiClient,\n        execSql: input.runtime.infra.execSql,\n        groupId: input.groupId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      }),\n  );\n}\n\nexport async function removeUserFromOrganizationGroup(\n  input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.remove\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const bundle = await removeOrganizationGroupUser({\n        apiClient: input.runtime.apiClient,\n        beforePolicyCommit: (_head, authority) => {\n          memberGroupId = authority.memberGroupId;\n        },\n        execSql: input.runtime.infra.execSql,\n        expectedGroupName: input.expectedGroupName,\n        readEncryptedName: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ).readName,\n        groupId: input.groupId,\n        prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n          preparePrincipalContainerMutations({\n            currentPolicy,\n            groupId: input.groupId,\n            nextPolicy,\n            organizationId: signingContext.organizationId,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          }),\n        removedUserId: input.removedUserId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      });\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport async function revokeOrganizationGrant(\n  input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n  if (input.runtime.infra.dbStatus !== \"ready\") {\n    throw new Error(\"Organization local database is unavailable\");\n  }\n\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.subjectId,\n      objectKind: \"principal\",\n      operation: \"principal.grant.revoke\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const response =\n        input.subjectType === \"group\"\n          ? await rotateOrganizationGroupForAccessSetShrink({\n              apiClient: input.runtime.apiClient,\n              execSql: input.runtime.infra.execSql,\n              groupId: input.subjectId,\n              revokedContainerId: input.containerId,\n              prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n                preparePrincipalContainerMutations({\n                  currentPolicy,\n                  groupId: input.subjectId,\n                  nextPolicy,\n                  organizationId: signingContext.organizationId,\n                  revokedContainerId: input.containerId,\n                  runtime: input.runtime,\n                  stillCurrent: input.stillCurrent,\n                }),\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              ...signingContext,\n            })\n          : await revokeOrganizationContainerGrant({\n              stillCurrent: input.stillCurrent,\n              reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n              apiClient: input.runtime.apiClient,\n              containerId: input.containerId,\n              encapsulationKeyPair,\n              execSql: input.runtime.infra.execSql,\n              revokedSubject: {\n                subjectId: input.subjectId,\n                subjectType: input.subjectType,\n              },\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              warmReferencedPrincipalPolicies:\n                createRuntimePrincipalPolicyWarmer(input.runtime),\n              ...signingContext,\n            });\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return response;\n    },\n  );\n}\n"]}

package/client/principalHistoryProtection.d.ts

@@ -0,0 +1,19 @@
+import type { PrincipalHistoryProtectionLease } from "../data/principals/principalHistoryProtection.js";
+export interface PrincipalHistoryKeyScope {
+    readonly identityTrustDomain: string;
+    readonly signingFingerprint: string;
+}
+/** Return a fresh owned 32-byte key. The SDK clears it after each operation. */
+export type PrincipalHistoryKeyProvider = (scope: PrincipalHistoryKeyScope) => Promise<Uint8Array>;
+interface RuntimeProtectionScope extends PrincipalHistoryKeyScope {
+    readonly database: object;
+    readonly generation: number;
+}
+export declare function createPrincipalHistoryProtectionCustody(input: {
+    readonly readScope: () => RuntimeProtectionScope | null;
+    readonly keyProvider?: PrincipalHistoryKeyProvider | undefined;
+}): {
+    retire(): void;
+    bind(): PrincipalHistoryProtectionLease | undefined;
+};
+export {};

package/client/principalHistoryProtection.js

@@ -0,0 +1,76 @@
+import { KeyingVerificationError } from "../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../data/keyingProjectionVerification/types.js";
+function sameKeyScope(a, b) {
+    return (a?.database === b.database &&
+        a.identityTrustDomain === b.identityTrustDomain &&
+        a.signingFingerprint === b.signingFingerprint);
+}
+export function createPrincipalHistoryProtectionCustody(input) {
+    let retirement = 0;
+    let ephemeral = null;
+    const clearEphemeral = () => {
+        ephemeral?.key.fill(0);
+        ephemeral = null;
+    };
+    return {
+        retire() {
+            retirement += 1;
+            clearEphemeral();
+        },
+        bind() {
+            const scope = input.readScope();
+            if (!scope) {
+                clearEphemeral();
+                return undefined;
+            }
+            if (ephemeral && !sameKeyScope(ephemeral.scope, scope))
+                clearEphemeral();
+            const boundRetirement = retirement;
+            const boundGeneration = scope.generation;
+            const stillCurrent = () => {
+                const current = input.readScope();
+                return (retirement === boundRetirement &&
+                    current?.generation === boundGeneration &&
+                    sameKeyScope(current, scope));
+            };
+            const context = JSON.stringify([
+                "tearleads.sdk.principal-history.runtime.v1",
+                scope.identityTrustDomain,
+                scope.signingFingerprint,
+            ]);
+            return async (operation) => {
+                assertProjectionVerificationCurrent(stillCurrent);
+                let key;
+                try {
+                    if (input.keyProvider) {
+                        key = await input.keyProvider({
+                            identityTrustDomain: scope.identityTrustDomain,
+                            signingFingerprint: scope.signingFingerprint,
+                        });
+                    }
+                    else {
+                        ephemeral ??= {
+                            scope,
+                            key: crypto.getRandomValues(new Uint8Array(32)),
+                        };
+                        key = new Uint8Array(ephemeral.key);
+                    }
+                    if (!(key instanceof Uint8Array) || key.byteLength !== 32)
+                        throw new KeyingVerificationError("invalid_shape", "Principal history key provider must return 32 private bytes");
+                    assertProjectionVerificationCurrent(stillCurrent);
+                    const result = await operation({
+                        protection: { localKey: key, context },
+                        stillCurrent,
+                    });
+                    assertProjectionVerificationCurrent(stillCurrent);
+                    return result;
+                }
+                finally {
+                    if (key instanceof Uint8Array)
+                        key.fill(0);
+                }
+            };
+        },
+    };
+}
+//# sourceMappingURL=principalHistoryProtection.js.map

package/client/principalHistoryProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryProtection.js","sourceRoot":"","sources":["principalHistoryProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,4CAA4C,CAAC;AAkBjG,SAAS,YAAY,CACnB,CAAgC,EAChC,CAAyB;IAEzB,OAAO,CACL,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ;QAC1B,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,mBAAmB;QAC/C,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,kBAAkB,CAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IACC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GACX,IAAI,CAAC;IACP,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC,CAAC;IACF,OAAO;QACL,MAAM;YACJ,UAAU,IAAI,CAAC,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,cAAc,EAAE,CAAC;gBACjB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,cAAc,EAAE,CAAC;YACzE,MAAM,eAAe,GAAG,UAAU,CAAC;YACnC,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC;YACzC,MAAM,YAAY,GAAG,GAAG,EAAE;gBACxB,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAClC,OAAO,CACL,UAAU,KAAK,eAAe;oBAC9B,OAAO,EAAE,UAAU,KAAK,eAAe;oBACvC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAC7B,CAAC;YACJ,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,4CAA4C;gBAC5C,KAAK,CAAC,mBAAmB;gBACzB,KAAK,CAAC,kBAAkB;aACzB,CAAC,CAAC;YACH,OAAO,KAAK,EAAE,SAAS,EAAE,EAAE;gBACzB,mCAAmC,CAAC,YAAY,CAAC,CAAC;gBAClD,IAAI,GAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;wBACtB,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;4BAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;4BAC9C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;yBAC7C,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,SAAS,KAAK;4BACZ,KAAK;4BACL,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;yBAChD,CAAC;wBACF,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACtC,CAAC;oBACD,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE;wBACvD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;oBACJ,mCAAmC,CAAC,YAAY,CAAC,CAAC;oBAClD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;wBAC7B,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE;wBACtC,YAAY;qBACb,CAAC,CAAC;oBACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;oBAClD,OAAO,MAAM,CAAC;gBAChB,CAAC;wBAAS,CAAC;oBACT,IAAI,GAAG,YAAY,UAAU;wBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../data/keyingProjectionVerification/types\";\nimport type { PrincipalHistoryProtectionLease } from \"../data/principals/principalHistoryProtection\";\n\nexport interface PrincipalHistoryKeyScope {\n  readonly identityTrustDomain: string;\n  readonly signingFingerprint: string;\n}\n\n/** Return a fresh owned 32-byte key. The SDK clears it after each operation. */\nexport type PrincipalHistoryKeyProvider = (\n  scope: PrincipalHistoryKeyScope,\n) => Promise<Uint8Array>;\n\ninterface RuntimeProtectionScope extends PrincipalHistoryKeyScope {\n  readonly database: object;\n  readonly generation: number;\n}\n\nfunction sameKeyScope(\n  a: RuntimeProtectionScope | null,\n  b: RuntimeProtectionScope,\n): boolean {\n  return (\n    a?.database === b.database &&\n    a.identityTrustDomain === b.identityTrustDomain &&\n    a.signingFingerprint === b.signingFingerprint\n  );\n}\n\nexport function createPrincipalHistoryProtectionCustody(input: {\n  readonly readScope: () => RuntimeProtectionScope | null;\n  readonly keyProvider?: PrincipalHistoryKeyProvider | undefined;\n}) {\n  let retirement = 0;\n  let ephemeral: { scope: RuntimeProtectionScope; key: Uint8Array } | null =\n    null;\n  const clearEphemeral = () => {\n    ephemeral?.key.fill(0);\n    ephemeral = null;\n  };\n  return {\n    retire() {\n      retirement += 1;\n      clearEphemeral();\n    },\n    bind(): PrincipalHistoryProtectionLease | undefined {\n      const scope = input.readScope();\n      if (!scope) {\n        clearEphemeral();\n        return undefined;\n      }\n      if (ephemeral && !sameKeyScope(ephemeral.scope, scope)) clearEphemeral();\n      const boundRetirement = retirement;\n      const boundGeneration = scope.generation;\n      const stillCurrent = () => {\n        const current = input.readScope();\n        return (\n          retirement === boundRetirement &&\n          current?.generation === boundGeneration &&\n          sameKeyScope(current, scope)\n        );\n      };\n      const context = JSON.stringify([\n        \"tearleads.sdk.principal-history.runtime.v1\",\n        scope.identityTrustDomain,\n        scope.signingFingerprint,\n      ]);\n      return async (operation) => {\n        assertProjectionVerificationCurrent(stillCurrent);\n        let key: Uint8Array | undefined;\n        try {\n          if (input.keyProvider) {\n            key = await input.keyProvider({\n              identityTrustDomain: scope.identityTrustDomain,\n              signingFingerprint: scope.signingFingerprint,\n            });\n          } else {\n            ephemeral ??= {\n              scope,\n              key: crypto.getRandomValues(new Uint8Array(32)),\n            };\n            key = new Uint8Array(ephemeral.key);\n          }\n          if (!(key instanceof Uint8Array) || key.byteLength !== 32)\n            throw new KeyingVerificationError(\n              \"invalid_shape\",\n              \"Principal history key provider must return 32 private bytes\",\n            );\n          assertProjectionVerificationCurrent(stillCurrent);\n          const result = await operation({\n            protection: { localKey: key, context },\n            stillCurrent,\n          });\n          assertProjectionVerificationCurrent(stillCurrent);\n          return result;\n        } finally {\n          if (key instanceof Uint8Array) key.fill(0);\n        }\n      };\n    },\n  };\n}\n"]}

package/client/root/index.d.ts

@@ -0,0 +1,43 @@
+import type { OrganizationDataUsageResponse } from "../../internal/validators/response/index.js";
+import { type RootDataUsageApi, type RootDataUsageReportPage, type RootIdentitiesApi, type RootIdentitiesPage, type RootIdentitiesQueryInput, type RootIdentityDetail, type RootIdentityOrganization, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, type RootRequestOutcome } from "../../workflows/root/index.js";
+import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput } from "../../workflows/runtimeInput.js";
+import type { Session } from "../session/sessionTypes.js";
+import type { InternalRuntime } from "../workflowRuntime.js";
+/**
+ * Platform-operator lookups. Every call is refused locally unless the session
+ * is authenticated and the server reported it as root at login; the API still
+ * enforces root access on its own, so this gate only avoids doomed requests.
+ */
+type RootApi = RootIdentitiesApi & RootOrganizationsApi & RootDataUsageApi;
+export interface Root {
+    loadOrganizationDataUsage(organizationId: string): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;
+    listDataUsageReport(query?: RootOrganizationsQueryInput): Promise<RootRequestOutcome<RootDataUsageReportPage>>;
+    listOrganizations(query?: RootOrganizationsQueryInput): Promise<RootRequestOutcome<RootOrganizationsPage>>;
+    loadOrganization(organizationId: string): Promise<RootRequestOutcome<RootOrganizationDetail>>;
+    listOrganizationIdentities(organizationId: string, query?: RootOrganizationPageQueryInput): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;
+    /** Whether the current session may use the root surface at all. */
+    readonly isAvailable: boolean;
+    listIdentities(query?: RootIdentitiesQueryInput): Promise<RootRequestOutcome<RootIdentitiesPage>>;
+    listIdentityOrganizations(userId: string): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;
+    loadIdentity(userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;
+}
+/**
+ * What the facade needs from the runtime: change notifications, the current
+ * auth snapshot, the signing identity (which can change or vanish without
+ * touching the session), and the api client. Narrower than the full runtime
+ * so tests can drive it with a fake.
+ */
+export interface RootRuntime {
+    /** The session's current auth token; a new one marks a fresh login. */
+    authToken(): string | null;
+    subscribe(listener: () => void): () => void;
+    workflowInput(): {
+        readonly apiClient: RootApi;
+        readonly auth: WorkflowRuntimeAuthInput;
+        readonly crypto: Pick<WorkflowRuntimeCryptoInput, "signingFingerprint">;
+    };
+}
+/** The SDK's internal runtime, narrowed to what the root facade observes. */
+export declare function rootRuntimeOf(runtime: Pick<InternalRuntime, "publicRuntime" | "workflowInput">, session: Pick<Session, "authToken">): RootRuntime;
+export declare function createRoot(runtimeService: RootRuntime): Root;
+export {};

package/client/root/index.js

@@ -0,0 +1,104 @@
+import { listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOrganization, loadRootOrganizationDataUsage, } from "../../workflows/root/index.js";
+/** The SDK's internal runtime, narrowed to what the root facade observes. */
+export function rootRuntimeOf(runtime, session) {
+    return {
+        authToken: () => session.authToken,
+        subscribe: (listener) => runtime.publicRuntime.subscribe(listener),
+        workflowInput: () => runtime.workflowInput(),
+    };
+}
+const NOT_AVAILABLE = {
+    message: "The current session is not a platform operator.",
+    ok: false,
+    status: null,
+};
+const SESSION_CHANGED = {
+    message: "The session changed while the request was in flight.",
+    ok: false,
+    status: null,
+};
+export function createRoot(runtimeService) {
+    const principal = () => {
+        const runtime = runtimeService.workflowInput();
+        return {
+            fingerprint: runtime.crypto.signingFingerprint,
+            isAuthenticated: runtime.auth.isAuthenticated,
+            isRoot: runtime.auth.isRoot === true,
+            userId: runtime.auth.userId,
+        };
+    };
+    // Root standing belongs to the signing identity that authenticated, not to
+    // whichever key pair is loaded now. The fingerprint is bound whenever a
+    // login completes, which is observable as a new auth token carrying the
+    // server's verdict, or when the session first becomes root. A principal
+    // change without a new token (a key swap while the old token lingers)
+    // unbinds root until the next login. Every principal change is also
+    // counted as it happens, so a round trip such as logout then login, or a
+    // switch to another identity and back, is still two changes even though
+    // the endpoints match; a token renewal alone changes no principal, so a
+    // retried lookup is still returned.
+    let observed = principal();
+    let observedToken = runtimeService.authToken();
+    let boundFingerprint = observed.isAuthenticated && observed.isRoot ? observed.fingerprint : null;
+    let lifecycle = 0;
+    runtimeService.subscribe(() => {
+        const next = principal();
+        const token = runtimeService.authToken();
+        const freshToken = token !== null && token !== observedToken;
+        const wasRoot = observed.isAuthenticated && observed.isRoot;
+        const isRootNow = next.isAuthenticated && next.isRoot;
+        const changed = next.fingerprint !== observed.fingerprint ||
+            next.isAuthenticated !== observed.isAuthenticated ||
+            next.isRoot !== observed.isRoot ||
+            next.userId !== observed.userId;
+        if (changed) {
+            lifecycle += 1;
+        }
+        if (!isRootNow) {
+            boundFingerprint = null;
+        }
+        else if (freshToken || !wasRoot) {
+            boundFingerprint = next.fingerprint;
+        }
+        else if (changed) {
+            boundFingerprint = null;
+        }
+        observed = next;
+        observedToken = token;
+    });
+    const activeApi = () => {
+        const runtime = runtimeService.workflowInput();
+        return runtime.auth.isAuthenticated &&
+            runtime.auth.isRoot === true &&
+            boundFingerprint !== null &&
+            runtime.crypto.signingFingerprint === boundFingerprint
+            ? runtime.apiClient
+            : null;
+    };
+    const guarded = async (request) => {
+        const api = activeApi();
+        if (!api) {
+            return NOT_AVAILABLE;
+        }
+        const startedIn = lifecycle;
+        const outcome = await request(api);
+        if (activeApi() === null || lifecycle !== startedIn) {
+            return SESSION_CHANGED;
+        }
+        return outcome;
+    };
+    return {
+        get isAvailable() {
+            return activeApi() !== null;
+        },
+        loadOrganizationDataUsage: (organizationId) => guarded((api) => loadRootOrganizationDataUsage(api, organizationId)),
+        listDataUsageReport: (query) => guarded((api) => listRootDataUsageReport(api, query)),
+        listOrganizations: (query) => guarded((api) => listRootOrganizations(api, query)),
+        loadOrganization: (organizationId) => guarded((api) => loadRootOrganization(api, organizationId)),
+        listOrganizationIdentities: (organizationId, query) => guarded((api) => listRootOrganizationIdentities(api, organizationId, query)),
+        listIdentities: (query) => guarded((api) => listRootIdentities(api, query)),
+        listIdentityOrganizations: (userId) => guarded((api) => listRootIdentityOrganizations(api, userId)),
+        loadIdentity: (userId) => guarded((api) => loadRootIdentity(api, userId)),
+    };
+}
+//# sourceMappingURL=index.js.map

package/client/root/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAe9B,MAAM,sBAAsB,CAAC;AA4D9B,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,OAAiE,EACjE,OAAmC;IAEnC,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAA8B;IAC/C,OAAO,EAAE,iDAAiD;IAC1D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,eAAe,GAA8B;IACjD,OAAO,EAAE,sDAAsD;IAC/D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,cAA2B;IACpD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YACpC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;IAC/C,IAAI,gBAAgB,GAClB,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE;QAC5B,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,aAAa,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC;QACtD,MAAM,OAAO,GACX,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACzC,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC/B,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,GAAmB,EAAE;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe;YACjC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAC5B,gBAAgB,KAAK,IAAI;YACzB,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB;YACtD,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,OAA4D,EACzB,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,EAAE,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,WAAW;YACb,OAAO,SAAS,EAAE,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,yBAAyB,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5C,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,gBAAgB,EAAE,CAAC,cAAc,EAAE,EAAE,CACnC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7D,0BAA0B,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CACpD,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,8BAA8B,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAC3D;QACH,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3E,yBAAyB,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC","sourcesContent":["import type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootRequestOutcome,\n} from \"../../workflows/root\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n} from \"../../workflows/runtimeInput\";\nimport type { Session } from \"../session/sessionTypes\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\n\n/**\n * Platform-operator lookups. Every call is refused locally unless the session\n * is authenticated and the server reported it as root at login; the API still\n * enforces root access on its own, so this gate only avoids doomed requests.\n */\ntype RootApi = RootIdentitiesApi & RootOrganizationsApi & RootDataUsageApi;\n\nexport interface Root {\n  loadOrganizationDataUsage(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;\n  listDataUsageReport(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootDataUsageReportPage>>;\n  listOrganizations(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationsPage>>;\n  loadOrganization(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<RootOrganizationDetail>>;\n  listOrganizationIdentities(\n    organizationId: string,\n    query?: RootOrganizationPageQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;\n  /** Whether the current session may use the root surface at all. */\n  readonly isAvailable: boolean;\n  listIdentities(\n    query?: RootIdentitiesQueryInput,\n  ): Promise<RootRequestOutcome<RootIdentitiesPage>>;\n  listIdentityOrganizations(\n    userId: string,\n  ): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;\n  loadIdentity(userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;\n}\n\n/**\n * What the facade needs from the runtime: change notifications, the current\n * auth snapshot, the signing identity (which can change or vanish without\n * touching the session), and the api client. Narrower than the full runtime\n * so tests can drive it with a fake.\n */\nexport interface RootRuntime {\n  /** The session's current auth token; a new one marks a fresh login. */\n  authToken(): string | null;\n  subscribe(listener: () => void): () => void;\n  workflowInput(): {\n    readonly apiClient: RootApi;\n    readonly auth: WorkflowRuntimeAuthInput;\n    readonly crypto: Pick<WorkflowRuntimeCryptoInput, \"signingFingerprint\">;\n  };\n}\n\n/** The SDK's internal runtime, narrowed to what the root facade observes. */\nexport function rootRuntimeOf(\n  runtime: Pick<InternalRuntime, \"publicRuntime\" | \"workflowInput\">,\n  session: Pick<Session, \"authToken\">,\n): RootRuntime {\n  return {\n    authToken: () => session.authToken,\n    subscribe: (listener) => runtime.publicRuntime.subscribe(listener),\n    workflowInput: () => runtime.workflowInput(),\n  };\n}\n\nconst NOT_AVAILABLE: RootRequestOutcome<never> = {\n  message: \"The current session is not a platform operator.\",\n  ok: false,\n  status: null,\n};\n\nconst SESSION_CHANGED: RootRequestOutcome<never> = {\n  message: \"The session changed while the request was in flight.\",\n  ok: false,\n  status: null,\n};\n\nexport function createRoot(runtimeService: RootRuntime): Root {\n  const principal = () => {\n    const runtime = runtimeService.workflowInput();\n    return {\n      fingerprint: runtime.crypto.signingFingerprint,\n      isAuthenticated: runtime.auth.isAuthenticated,\n      isRoot: runtime.auth.isRoot === true,\n      userId: runtime.auth.userId,\n    };\n  };\n\n  // Root standing belongs to the signing identity that authenticated, not to\n  // whichever key pair is loaded now. The fingerprint is bound whenever a\n  // login completes, which is observable as a new auth token carrying the\n  // server's verdict, or when the session first becomes root. A principal\n  // change without a new token (a key swap while the old token lingers)\n  // unbinds root until the next login. Every principal change is also\n  // counted as it happens, so a round trip such as logout then login, or a\n  // switch to another identity and back, is still two changes even though\n  // the endpoints match; a token renewal alone changes no principal, so a\n  // retried lookup is still returned.\n  let observed = principal();\n  let observedToken = runtimeService.authToken();\n  let boundFingerprint: string | null =\n    observed.isAuthenticated && observed.isRoot ? observed.fingerprint : null;\n  let lifecycle = 0;\n  runtimeService.subscribe(() => {\n    const next = principal();\n    const token = runtimeService.authToken();\n    const freshToken = token !== null && token !== observedToken;\n    const wasRoot = observed.isAuthenticated && observed.isRoot;\n    const isRootNow = next.isAuthenticated && next.isRoot;\n    const changed =\n      next.fingerprint !== observed.fingerprint ||\n      next.isAuthenticated !== observed.isAuthenticated ||\n      next.isRoot !== observed.isRoot ||\n      next.userId !== observed.userId;\n    if (changed) {\n      lifecycle += 1;\n    }\n    if (!isRootNow) {\n      boundFingerprint = null;\n    } else if (freshToken || !wasRoot) {\n      boundFingerprint = next.fingerprint;\n    } else if (changed) {\n      boundFingerprint = null;\n    }\n    observed = next;\n    observedToken = token;\n  });\n\n  const activeApi = (): RootApi | null => {\n    const runtime = runtimeService.workflowInput();\n    return runtime.auth.isAuthenticated &&\n      runtime.auth.isRoot === true &&\n      boundFingerprint !== null &&\n      runtime.crypto.signingFingerprint === boundFingerprint\n      ? runtime.apiClient\n      : null;\n  };\n\n  const guarded = async <Data>(\n    request: (api: RootApi) => Promise<RootRequestOutcome<Data>>,\n  ): Promise<RootRequestOutcome<Data>> => {\n    const api = activeApi();\n    if (!api) {\n      return NOT_AVAILABLE;\n    }\n    const startedIn = lifecycle;\n    const outcome = await request(api);\n    if (activeApi() === null || lifecycle !== startedIn) {\n      return SESSION_CHANGED;\n    }\n    return outcome;\n  };\n\n  return {\n    get isAvailable() {\n      return activeApi() !== null;\n    },\n    loadOrganizationDataUsage: (organizationId) =>\n      guarded((api) => loadRootOrganizationDataUsage(api, organizationId)),\n    listDataUsageReport: (query) =>\n      guarded((api) => listRootDataUsageReport(api, query)),\n    listOrganizations: (query) =>\n      guarded((api) => listRootOrganizations(api, query)),\n    loadOrganization: (organizationId) =>\n      guarded((api) => loadRootOrganization(api, organizationId)),\n    listOrganizationIdentities: (organizationId, query) =>\n      guarded((api) =>\n        listRootOrganizationIdentities(api, organizationId, query),\n      ),\n    listIdentities: (query) => guarded((api) => listRootIdentities(api, query)),\n    listIdentityOrganizations: (userId) =>\n      guarded((api) => listRootIdentityOrganizations(api, userId)),\n    loadIdentity: (userId) => guarded((api) => loadRootIdentity(api, userId)),\n  };\n}\n"]}

package/client/rootContainerAdoption.js

@@ -0,0 +1,18 @@
+export function adoptSessionRootContainer(dependencies, input) {
+    const session = dependencies.session;
+    if (dependencies.getDomainScope() !== input.domainScope ||
+        !session.isAuthenticated ||
+        session.organizationId !== input.organizationId ||
+        session.userId !== input.userId) {
+        return false;
+    }
+    if (session.containerId === input.nextContainerId) {
+        return "already-adopted";
+    }
+    if (session.containerId !== input.expectedContainerId) {
+        return false;
+    }
+    session.setContainerId(input.nextContainerId);
+    return true;
+}
+//# sourceMappingURL=rootContainerAdoption.js.map

package/client/rootContainerAdoption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootContainerAdoption.js","sourceRoot":"","sources":["rootContainerAdoption.ts"],"names":[],"mappings":"AAmBA,MAAM,UAAU,yBAAyB,CACvC,YAA+C,EAC/C,KAAyC;IAEzC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IACrC,IACE,YAAY,CAAC,cAAc,EAAE,KAAK,KAAK,CAAC,WAAW;QACnD,CAAC,OAAO,CAAC,eAAe;QACxB,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC/C,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAClD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { DomainScope } from \"../data/domainScope\";\nimport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n} from \"../workflows/container-contents/runtime\";\nimport type { Session } from \"./session/sessionTypes\";\n\ninterface RootContainerAdoptionDependencies {\n  readonly getDomainScope: () => DomainScope;\n  readonly session: Pick<\n    Session,\n    | \"containerId\"\n    | \"isAuthenticated\"\n    | \"organizationId\"\n    | \"setContainerId\"\n    | \"userId\"\n  >;\n}\n\nexport function adoptSessionRootContainer(\n  dependencies: RootContainerAdoptionDependencies,\n  input: ContainerContentsRootAdoptionInput,\n): ReturnType<ContainerContentsRootAdopter> {\n  const session = dependencies.session;\n  if (\n    dependencies.getDomainScope() !== input.domainScope ||\n    !session.isAuthenticated ||\n    session.organizationId !== input.organizationId ||\n    session.userId !== input.userId\n  ) {\n    return false;\n  }\n  if (session.containerId === input.nextContainerId) {\n    return \"already-adopted\";\n  }\n  if (session.containerId !== input.expectedContainerId) {\n    return false;\n  }\n\n  session.setContainerId(input.nextContainerId);\n  return true;\n}\n"]}

package/client/securityIncidents.d.ts

@@ -0,0 +1,37 @@
+import { type KeyingVerificationError } from "../internal/crypto/index.js";
+import type { SecurityIncident, SecurityIncidentContext, SecurityIncidentObjectKind, SecurityIncidentReporter } from "../data/securityIncidents.js";
+import type { Database } from "./database.js";
+export type { SecurityIncident, SecurityIncidentObjectKind };
+export type SecurityIncidentListener = (incident: SecurityIncident) => void;
+/**
+ * Where a reported incident ended up: `recorded` rows are durable in the local
+ * ledger, `buffered` ones wait in memory for a retried write, and `failed`
+ * ones were dropped, so only `recorded` justifies telling a user it was kept.
+ * Hosts name it as `Awaited<ReturnType<SecurityIncidents["record"]>>`.
+ */
+type SecurityIncidentRecordingStatus = "buffered" | "failed" | "recorded";
+export interface SecurityIncidents {
+    /** Returns null while the local database is unavailable. */
+    list(): Promise<ReadonlyArray<SecurityIncident> | null>;
+    /**
+     * Durably record a terminal verification failure the host detected itself,
+     * such as conflicting purge proofs found while merging a local backup. The
+     * report is redacted, coalesced, retained, and buffered exactly like an
+     * SDK-detected incident; one error instance is recorded at most once, and
+     * repeats of it resolve with the status of the first report.
+     */
+    record(error: KeyingVerificationError, context: SecurityIncidentContext): Promise<SecurityIncidentRecordingStatus>;
+    subscribe(listener: SecurityIncidentListener): () => void;
+}
+interface SecurityIncidentServiceOptions {
+    readonly database: Database;
+    readonly logError: (message: string | Error, cause?: unknown) => void;
+    readonly onIncident?: SecurityIncidentListener | undefined;
+    readonly trustDomain: string | null;
+}
+interface SecurityIncidentServiceResult {
+    readonly dispose: () => void;
+    readonly incidents: SecurityIncidents;
+    readonly report: SecurityIncidentReporter;
+}
+export declare function createSecurityIncidentService(options: SecurityIncidentServiceOptions): SecurityIncidentServiceResult;