@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/organizations/groupMetadataAccess.d.ts

@@ -0,0 +1,33 @@
+import { type ContainerAccessManifestState, type GroupMetadataKey } from "../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../internal/validators/response/index.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../data/keyingProjectionVerification.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { GroupPolicyNameReader } from "./principalPolicyRequest.js";
+export interface GroupMetadataAccessInput {
+    readonly apiClient: {
+        evictContainerWriterProjection(containerId: string): void;
+        getContainerWriterProjection(containerId: string): Promise<ContainerWriterProjectionResponse | null>;
+    };
+    readonly verifyMetadataContainer: (state: ContainerAccessManifestState) => Promise<void>;
+    readonly execSql: ExecSql;
+    readonly organizationId: string;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+    readonly targetSecretKey: Uint8Array;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+/**
+ * A group's signed name does not open under the metadata key it cites, or opens
+ * to an invalid name. Every reader holding that key gets the same result. The
+ * API checks the citation but can never check the ciphertext, so a dishonest
+ * admin can sign such a name; directory walks isolate the group instead of
+ * failing every name in the organization.
+ */
+export declare class GroupMetadataUnreadableError extends Error {
+    constructor(groupId: string, cause: unknown);
+}
+/** Uses the shared metadata container's authenticated keyring, including old epochs. */
+export declare function createGroupMetadataAccess(input: GroupMetadataAccessInput): {
+    readName: GroupPolicyNameReader;
+    loadEncryptionKey(): Promise<GroupMetadataKey>;
+};

package/workflows/organizations/groupMetadataAccess.js

@@ -0,0 +1,114 @@
+import { decryptGroupMetadata, readGroupMetadata, } from "../../internal/crypto/index.js";
+import { deriveOrganizationMetadataContainerSystemSlot } from "../../internal/validators/containerSystemSlot.js";
+import { getTargetContainerContext, readContainerState, } from "../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../data/documents/shared/containerKekPath.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadContainers } from "../../data/persistence/containers/containerPersistence.js";
+import { withMetadataRootReload } from "./groupMetadataErrors.js";
+/**
+ * A group's signed name does not open under the metadata key it cites, or opens
+ * to an invalid name. Every reader holding that key gets the same result. The
+ * API checks the citation but can never check the ciphertext, so a dishonest
+ * admin can sign such a name; directory walks isolate the group instead of
+ * failing every name in the organization.
+ */
+export class GroupMetadataUnreadableError extends Error {
+    constructor(groupId, cause) {
+        super(`Group ${groupId} metadata cannot be decrypted`, { cause });
+        this.name = "GroupMetadataUnreadableError";
+    }
+}
+function loadMetadataKeyring(input, containerId) {
+    return withMetadataRootReload(() => loadMetadataKeyringOnce(input, containerId), () => input.apiClient.evictContainerWriterProjection(containerId));
+}
+async function loadMetadataKeyringOnce(input, containerId) {
+    const projection = await input.apiClient.getContainerWriterProjection(containerId);
+    if (!projection)
+        return null;
+    if (projection.containerId !== containerId ||
+        projection.organizationId !== input.organizationId)
+        throw new Error("Group metadata container is unavailable");
+    const target = getTargetContainerContext(projection);
+    const state = readContainerState(target.manifest);
+    const slot = await deriveOrganizationMetadataContainerSystemSlot({
+        organizationId: input.organizationId,
+    });
+    if (state.organizationId !== input.organizationId ||
+        state.systemSlot !== slot ||
+        state.parentContainerId !== null)
+        throw new Error("Group metadata requires the signed organization metadata container");
+    await input.verifyMetadataContainer(state);
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const keys = await unwrapContainerKekPath({
+        ...input,
+        projection,
+        secretKey: input.targetSecretKey,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const keyMaterial = keys.get(target.kek.containerKeyEpochId);
+    if (!keyMaterial)
+        throw new Error("Group metadata container key is unavailable");
+    return {
+        current: {
+            organizationId: input.organizationId,
+            containerId,
+            containerKeyEpochId: target.kek.containerKeyEpochId,
+            keyMaterial,
+        },
+        keys,
+    };
+}
+/** Uses the shared metadata container's authenticated keyring, including old epochs. */
+export function createGroupMetadataAccess(input) {
+    const loads = new Map();
+    function loaded(containerId) {
+        let pending = loads.get(containerId);
+        if (!pending) {
+            pending = loadMetadataKeyring(input, containerId);
+            loads.set(containerId, pending);
+        }
+        return pending;
+    }
+    const readName = async (bundle) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
+        if ("role" in metadata)
+            return metadata.role === "admins" ? "Admins" : "Members";
+        if (metadata.organizationId !== input.organizationId ||
+            metadata.groupId !== bundle.currentState.principalId ||
+            bundle.currentState.principalType !== "group")
+            throw new Error("Group metadata scope does not match its signed group");
+        const keyring = await loaded(metadata.containerId);
+        const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);
+        if (!keyMaterial)
+            throw new Error("Group metadata historical key is unavailable");
+        try {
+            return await decryptGroupMetadata({
+                key: { ...metadata, keyMaterial },
+                groupId: bundle.currentState.principalId,
+                payload: bundle.currentPayload.ciphertext,
+            });
+        }
+        catch (cause) {
+            throw new GroupMetadataUnreadableError(bundle.currentState.principalId, cause);
+        }
+    };
+    return {
+        readName,
+        async loadEncryptionKey() {
+            const slot = await deriveOrganizationMetadataContainerSystemSlot({
+                organizationId: input.organizationId,
+            });
+            const containers = await loadContainers(input.execSql);
+            const container = containers.find((row) => row.organizationId === input.organizationId &&
+                row.systemSlot === slot);
+            if (!container)
+                throw new Error("Organization metadata container has not been discovered");
+            const keyring = await loaded(container.id);
+            if (!keyring)
+                throw new Error("Group metadata container is unavailable");
+            return keyring.current;
+        },
+    };
+}
+//# sourceMappingURL=groupMetadataAccess.js.map

package/workflows/organizations/groupMetadataAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataAccess.js","sourceRoot":"","sources":["groupMetadataAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EAEpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAE1G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAKtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAC;AAExF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAuB/D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,SAAS,OAAO,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,KAA+B,EAC/B,WAAmB;IAEnB,OAAO,sBAAsB,CAC3B,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EACjD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA+B,EAC/B,WAAmB;IAEnB,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IACE,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAElD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAEhC,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,MAAM,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;QACxC,GAAG,KAAK;QACR,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;YACnD,WAAW;SACZ;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAMlB,CAAC;IACJ,SAAS,MAAM,CAAC,WAAmB;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAA0B,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,IAAI,QAAQ;YACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IACE,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW;YACpD,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;YAE7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;gBACxC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,MAAM,CAAC,YAAY,CAAC,WAAW,EAC/B,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,KAAK,CAAC,iBAAiB;YACrB,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;gBAC3C,GAAG,CAAC,UAAU,KAAK,IAAI,CAC1B,CAAC;YACF,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  decryptGroupMetadata,\n  type GroupMetadataKey,\n  readGroupMetadata,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../data/documents/shared/containerKekPath\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadContainers } from \"../../data/persistence/containers/containerPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { withMetadataRootReload } from \"./groupMetadataErrors\";\nimport type { GroupPolicyNameReader } from \"./principalPolicyRequest\";\n\nexport interface GroupMetadataAccessInput {\n  readonly apiClient: {\n    evictContainerWriterProjection(containerId: string): void;\n    getContainerWriterProjection(\n      containerId: string,\n    ): Promise<ContainerWriterProjectionResponse | null>;\n  };\n  readonly verifyMetadataContainer: (\n    state: ContainerAccessManifestState,\n  ) => Promise<void>;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly targetSecretKey: Uint8Array;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/**\n * A group's signed name does not open under the metadata key it cites, or opens\n * to an invalid name. Every reader holding that key gets the same result. The\n * API checks the citation but can never check the ciphertext, so a dishonest\n * admin can sign such a name; directory walks isolate the group instead of\n * failing every name in the organization.\n */\nexport class GroupMetadataUnreadableError extends Error {\n  constructor(groupId: string, cause: unknown) {\n    super(`Group ${groupId} metadata cannot be decrypted`, { cause });\n    this.name = \"GroupMetadataUnreadableError\";\n  }\n}\n\nfunction loadMetadataKeyring(\n  input: GroupMetadataAccessInput,\n  containerId: string,\n) {\n  return withMetadataRootReload(\n    () => loadMetadataKeyringOnce(input, containerId),\n    () => input.apiClient.evictContainerWriterProjection(containerId),\n  );\n}\n\nasync function loadMetadataKeyringOnce(\n  input: GroupMetadataAccessInput,\n  containerId: string,\n) {\n  const projection =\n    await input.apiClient.getContainerWriterProjection(containerId);\n  if (!projection) return null;\n  if (\n    projection.containerId !== containerId ||\n    projection.organizationId !== input.organizationId\n  )\n    throw new Error(\"Group metadata container is unavailable\");\n  const target = getTargetContainerContext(projection);\n  const state = readContainerState(target.manifest);\n  const slot = await deriveOrganizationMetadataContainerSystemSlot({\n    organizationId: input.organizationId,\n  });\n  if (\n    state.organizationId !== input.organizationId ||\n    state.systemSlot !== slot ||\n    state.parentContainerId !== null\n  )\n    throw new Error(\n      \"Group metadata requires the signed organization metadata container\",\n    );\n  await input.verifyMetadataContainer(state);\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const keys = await unwrapContainerKekPath({\n    ...input,\n    projection,\n    secretKey: input.targetSecretKey,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const keyMaterial = keys.get(target.kek.containerKeyEpochId);\n  if (!keyMaterial)\n    throw new Error(\"Group metadata container key is unavailable\");\n  return {\n    current: {\n      organizationId: input.organizationId,\n      containerId,\n      containerKeyEpochId: target.kek.containerKeyEpochId,\n      keyMaterial,\n    },\n    keys,\n  };\n}\n\n/** Uses the shared metadata container's authenticated keyring, including old epochs. */\nexport function createGroupMetadataAccess(input: GroupMetadataAccessInput) {\n  const loads = new Map<\n    string,\n    Promise<{\n      current: GroupMetadataKey;\n      keys: ReadonlyMap<string, Uint8Array>;\n    } | null>\n  >();\n  function loaded(containerId: string) {\n    let pending = loads.get(containerId);\n    if (!pending) {\n      pending = loadMetadataKeyring(input, containerId);\n      loads.set(containerId, pending);\n    }\n    return pending;\n  }\n  const readName: GroupPolicyNameReader = async (bundle) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n    if (\"role\" in metadata)\n      return metadata.role === \"admins\" ? \"Admins\" : \"Members\";\n    if (\n      metadata.organizationId !== input.organizationId ||\n      metadata.groupId !== bundle.currentState.principalId ||\n      bundle.currentState.principalType !== \"group\"\n    )\n      throw new Error(\"Group metadata scope does not match its signed group\");\n    const keyring = await loaded(metadata.containerId);\n    const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);\n    if (!keyMaterial)\n      throw new Error(\"Group metadata historical key is unavailable\");\n    try {\n      return await decryptGroupMetadata({\n        key: { ...metadata, keyMaterial },\n        groupId: bundle.currentState.principalId,\n        payload: bundle.currentPayload.ciphertext,\n      });\n    } catch (cause) {\n      throw new GroupMetadataUnreadableError(\n        bundle.currentState.principalId,\n        cause,\n      );\n    }\n  };\n  return {\n    readName,\n    async loadEncryptionKey(): Promise<GroupMetadataKey> {\n      const slot = await deriveOrganizationMetadataContainerSystemSlot({\n        organizationId: input.organizationId,\n      });\n      const containers = await loadContainers(input.execSql);\n      const container = containers.find(\n        (row) =>\n          row.organizationId === input.organizationId &&\n          row.systemSlot === slot,\n      );\n      if (!container)\n        throw new Error(\n          \"Organization metadata container has not been discovered\",\n        );\n      const keyring = await loaded(container.id);\n      if (!keyring) throw new Error(\"Group metadata container is unavailable\");\n      return keyring.current;\n    },\n  };\n}\n"]}

package/workflows/organizations/groupMetadataBinding.js

@@ -0,0 +1,19 @@
+import { readGroupMetadata } from "../../internal/crypto/index.js";
+/** Built-in labels derive from the role assigned by the signed organization. */
+export function assertGroupMetadataBinding(bundle, descriptor) {
+    const groupId = bundle.currentState.principalId;
+    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
+    const expectedRole = groupId === descriptor.adminGroupId
+        ? "admins"
+        : groupId === descriptor.memberGroupId
+            ? "members"
+            : null;
+    if ("role" in metadata
+        ? metadata.role !== expectedRole
+        : expectedRole !== null ||
+            metadata.organizationId !== descriptor.organizationId ||
+            metadata.groupId !== groupId) {
+        throw new Error("Group metadata does not match the signed organization directory");
+    }
+}
+//# sourceMappingURL=groupMetadataBinding.js.map

package/workflows/organizations/groupMetadataBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataBinding.js","sourceRoot":"","sources":["groupMetadataBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAItD,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,MAAqC,EACrC,UAA2C;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,KAAK,UAAU,CAAC,YAAY;QACjC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,aAAa;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC;IACb,IACE,MAAM,IAAI,QAAQ;QAChB,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;QAChC,CAAC,CAAC,YAAY,KAAK,IAAI;YACrB,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACrD,QAAQ,CAAC,OAAO,KAAK,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { readGroupMetadata } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { OrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\n\n/** Built-in labels derive from the role assigned by the signed organization. */\nexport function assertGroupMetadataBinding(\n  bundle: PrincipalPolicyBundleResponse,\n  descriptor: OrganizationAuthorityDescriptor,\n): void {\n  const groupId = bundle.currentState.principalId;\n  const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n  const expectedRole =\n    groupId === descriptor.adminGroupId\n      ? \"admins\"\n      : groupId === descriptor.memberGroupId\n        ? \"members\"\n        : null;\n  if (\n    \"role\" in metadata\n      ? metadata.role !== expectedRole\n      : expectedRole !== null ||\n        metadata.organizationId !== descriptor.organizationId ||\n        metadata.groupId !== groupId\n  ) {\n    throw new Error(\n      \"Group metadata does not match the signed organization directory\",\n    );\n  }\n}\n"]}

package/workflows/organizations/groupMetadataContainerAuthority.js

@@ -0,0 +1,86 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyBundle } from "../../data/persistence/principalPolicyPersistence.js";
+import { previousStatesIncludeHead, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { MetadataRootBehindDirectoryError } from "./groupMetadataErrors.js";
+import { verifyDirectoryGroup } from "./groupNameUniqueness.js";
+import { loadGroupNameDirectoryAuthority } from "./organizationGroupNamePolicies.js";
+/** A public system slot alone cannot bind a self-authorized root to an organization. */
+export function createGroupMetadataContainerVerifier(input) {
+    return async (state) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const cached = await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
+        let authority = await loadGroupNameDirectoryAuthority({
+            ...input,
+            organizationPolicyReference: cached
+                ? principalPolicyReferenceFromBundle(cached)
+                : null,
+        });
+        if (cached &&
+            authority &&
+            state.referencedPrincipalHeads.some((head) => !authority?.descriptor.groupHeads.some((known) => principalHeadMatchesReference(head, known)))) {
+            authority = await loadGroupNameDirectoryAuthority(input);
+        }
+        if (!authority)
+            throw new Error("Organization metadata authority is unavailable");
+        const memberHead = requireOrganizationGroupHead(authority.descriptor, authority.memberGroupId);
+        const members = await verifyDirectoryGroup({
+            ...input,
+            descriptor: authority.descriptor,
+            externalAuthority: authority.externalAuthority,
+        }, memberHead);
+        assertMetadataRootBinding({
+            authority,
+            members,
+            organizationId: input.organizationId,
+            state,
+        });
+        assertProjectionVerificationCurrent(input.stillCurrent);
+    };
+}
+function assertMetadataRootBinding(input) {
+    const { authority, state } = input;
+    const expected = [
+        {
+            bundle: authority.adminBundle,
+            id: authority.adminGroupId,
+            level: "admin",
+            grants: authority.adminPolicy.grants,
+        },
+        {
+            bundle: input.members.bundle,
+            id: authority.memberGroupId,
+            level: "read",
+            grants: input.members.policy.grants,
+        },
+    ];
+    const cited = (groupId) => state.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === groupId);
+    const unbound = new KeyingVerificationError("object_mismatch", "Organization metadata root is not bound to the reserved group grants");
+    if (state.organizationId !== input.organizationId ||
+        state.parentContainerId !== null ||
+        state.directGrants.length !== 2 ||
+        state.referencedPrincipalHeads.length !== 2 ||
+        expected.some((role) => !role.grants.some((grant) => grant.containerId === state.containerId &&
+            grant.accessLevel === role.level) ||
+            !state.directGrants.some((grant) => grant.subjectType === "group" &&
+                grant.subjectId === role.id &&
+                grant.accessLevel === role.level) ||
+            !cited(role.id)))
+        throw unbound;
+    const superseded = expected.flatMap((role) => {
+        const head = cited(role.id);
+        return head &&
+            !principalHeadMatchesReference(head, requireOrganizationGroupHead(authority.descriptor, role.id))
+            ? [{ bundle: role.bundle, head }]
+            : [];
+    });
+    if (superseded.length === 0)
+        return;
+    // A root read before a reserved-group commit cites a verified predecessor
+    // of the directory's head; any other head is not an honest race.
+    if (superseded.every(({ bundle, head }) => previousStatesIncludeHead(bundle, head)))
+        throw new MetadataRootBehindDirectoryError();
+    throw unbound;
+}
+//# sourceMappingURL=groupMetadataContainerAuthority.js.map

package/workflows/organizations/groupMetadataContainerAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataContainerAuthority.js","sourceRoot":"","sources":["groupMetadataContainerAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAEvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAOlF,wFAAwF;AACxF,MAAM,UAAU,oCAAoC,CAAC,KAAY;IAC/D,OAAO,KAAK,EAAE,KAAmC,EAAiB,EAAE;QAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACpD,GAAG,KAAK;YACR,2BAA2B,EAAE,MAAM;gBACjC,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC;gBAC5C,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QACH,IACE,MAAM;YACN,SAAS;YACT,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,CAC3C,CACJ,EACD,CAAC;YACD,SAAS,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,4BAA4B,CAC7C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,aAAa,CACxB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,EACD,UAAU,CACX,CAAC;QACF,yBAAyB,CAAC;YACxB,SAAS;YACT,OAAO;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAMD,SAAS,yBAAyB,CAAC,KAKlC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf;YACE,MAAM,EAAE,SAAS,CAAC,WAAW;YAC7B,EAAE,EAAE,SAAS,CAAC,YAAY;YAC1B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM;SACrC;QACD;YACE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,EAAE,EAAE,SAAS,CAAC,aAAa;YAC3B,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;SACpC;KACF,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAChC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACzE,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,uBAAuB,CACzC,iBAAiB,EACjB,sEAAsE,CACvE,CAAC;IACF,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAChC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,KAAK,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC;QAC3C,QAAQ,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YACvC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CACnC;YACD,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CACtB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;gBAC7B,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE;gBAC3B,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CACnC;YACD,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAClB;QAED,MAAM,OAAO,CAAC;IAChB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI;YACT,CAAC,6BAA6B,CAC5B,IAAI,EACJ,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAC5D;YACD,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,0EAA0E;IAC1E,iEAAiE;IACjE,IACE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACpC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,CACxC;QAED,MAAM,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,OAAO,CAAC;AAChB,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  KeyingVerificationError,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyBundle } from \"../../data/persistence/principalPolicyPersistence\";\nimport {\n  previousStatesIncludeHead,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport { MetadataRootBehindDirectoryError } from \"./groupMetadataErrors\";\nimport { verifyDirectoryGroup } from \"./groupNameUniqueness\";\nimport { loadGroupNameDirectoryAuthority } from \"./organizationGroupNamePolicies\";\n\ntype Input = Omit<\n  Parameters<typeof loadGroupNameDirectoryAuthority>[0],\n  \"organizationPolicyReference\"\n> & { readonly reportSecurityIncident: SecurityIncidentReporter };\n\n/** A public system slot alone cannot bind a self-authorized root to an organization. */\nexport function createGroupMetadataContainerVerifier(input: Input) {\n  return async (state: ContainerAccessManifestState): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const cached = await loadPrincipalPolicyBundle(\n      input.execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    let authority = await loadGroupNameDirectoryAuthority({\n      ...input,\n      organizationPolicyReference: cached\n        ? principalPolicyReferenceFromBundle(cached)\n        : null,\n    });\n    if (\n      cached &&\n      authority &&\n      state.referencedPrincipalHeads.some(\n        (head) =>\n          !authority?.descriptor.groupHeads.some((known) =>\n            principalHeadMatchesReference(head, known),\n          ),\n      )\n    ) {\n      authority = await loadGroupNameDirectoryAuthority(input);\n    }\n    if (!authority)\n      throw new Error(\"Organization metadata authority is unavailable\");\n    const memberHead = requireOrganizationGroupHead(\n      authority.descriptor,\n      authority.memberGroupId,\n    );\n    const members = await verifyDirectoryGroup(\n      {\n        ...input,\n        descriptor: authority.descriptor,\n        externalAuthority: authority.externalAuthority,\n      },\n      memberHead,\n    );\n    assertMetadataRootBinding({\n      authority,\n      members,\n      organizationId: input.organizationId,\n      state,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  };\n}\n\ntype DirectoryAuthority = NonNullable<\n  Awaited<ReturnType<typeof loadGroupNameDirectoryAuthority>>\n>;\n\nfunction assertMetadataRootBinding(input: {\n  readonly authority: DirectoryAuthority;\n  readonly members: Awaited<ReturnType<typeof verifyDirectoryGroup>>;\n  readonly organizationId: string;\n  readonly state: ContainerAccessManifestState;\n}): void {\n  const { authority, state } = input;\n  const expected = [\n    {\n      bundle: authority.adminBundle,\n      id: authority.adminGroupId,\n      level: \"admin\",\n      grants: authority.adminPolicy.grants,\n    },\n    {\n      bundle: input.members.bundle,\n      id: authority.memberGroupId,\n      level: \"read\",\n      grants: input.members.policy.grants,\n    },\n  ];\n  const cited = (groupId: string) =>\n    state.referencedPrincipalHeads.find(\n      (head) => head.principalType === \"group\" && head.principalId === groupId,\n    );\n  const unbound = new KeyingVerificationError(\n    \"object_mismatch\",\n    \"Organization metadata root is not bound to the reserved group grants\",\n  );\n  if (\n    state.organizationId !== input.organizationId ||\n    state.parentContainerId !== null ||\n    state.directGrants.length !== 2 ||\n    state.referencedPrincipalHeads.length !== 2 ||\n    expected.some(\n      (role) =>\n        !role.grants.some(\n          (grant) =>\n            grant.containerId === state.containerId &&\n            grant.accessLevel === role.level,\n        ) ||\n        !state.directGrants.some(\n          (grant) =>\n            grant.subjectType === \"group\" &&\n            grant.subjectId === role.id &&\n            grant.accessLevel === role.level,\n        ) ||\n        !cited(role.id),\n    )\n  )\n    throw unbound;\n  const superseded = expected.flatMap((role) => {\n    const head = cited(role.id);\n    return head &&\n      !principalHeadMatchesReference(\n        head,\n        requireOrganizationGroupHead(authority.descriptor, role.id),\n      )\n      ? [{ bundle: role.bundle, head }]\n      : [];\n  });\n  if (superseded.length === 0) return;\n  // A root read before a reserved-group commit cites a verified predecessor\n  // of the directory's head; any other head is not an honest race.\n  if (\n    superseded.every(({ bundle, head }) =>\n      previousStatesIncludeHead(bundle, head),\n    )\n  )\n    throw new MetadataRootBehindDirectoryError();\n  throw unbound;\n}\n"]}

package/workflows/organizations/groupMetadataErrors.js

@@ -0,0 +1,40 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+/**
+ * The organization metadata root was read before a reserved-group commit that
+ * the signed directory already reflects: each head it cites that differs from
+ * the directory is a verified predecessor of the directory's head. That is an
+ * honest read race, so readers reload the root rather than report tampering
+ * (#2365 finding 22).
+ */
+export class MetadataRootBehindDirectoryError extends Error {
+    constructor() {
+        super("Organization metadata root cites a superseded reserved-group head");
+        this.name = "MetadataRootBehindDirectoryError";
+    }
+}
+/**
+ * Runs `load`, then once more after `evictRoot` if the root it read was
+ * behind; `reread` tells `load` to skip any root it was handed. Honest servers
+ * re-cite the reserved groups in the commit that advances them, so a root
+ * still behind after a fresh read is an incident.
+ */
+export async function withMetadataRootReload(load, evictRoot) {
+    try {
+        return await load(false);
+    }
+    catch (error) {
+        if (!(error instanceof MetadataRootBehindDirectoryError))
+            throw error;
+    }
+    evictRoot();
+    try {
+        return await load(true);
+    }
+    catch (error) {
+        if (error instanceof MetadataRootBehindDirectoryError) {
+            throw new KeyingVerificationError("object_mismatch", "Organization metadata root is still behind the signed directory after a reload");
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=groupMetadataErrors.js.map

package/workflows/organizations/groupMetadataErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataErrors.js","sourceRoot":"","sources":["groupMetadataErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACzD;QACE,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA0C,EAC1C,SAAqB;IAErB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,gCAAgC,CAAC;YAAE,MAAM,KAAK,CAAC;IACxE,CAAC;IACD,SAAS,EAAE,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gCAAgC,EAAE,CAAC;YACtD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\n\n/**\n * The organization metadata root was read before a reserved-group commit that\n * the signed directory already reflects: each head it cites that differs from\n * the directory is a verified predecessor of the directory's head. That is an\n * honest read race, so readers reload the root rather than report tampering\n * (#2365 finding 22).\n */\nexport class MetadataRootBehindDirectoryError extends Error {\n  constructor() {\n    super(\"Organization metadata root cites a superseded reserved-group head\");\n    this.name = \"MetadataRootBehindDirectoryError\";\n  }\n}\n\n/**\n * Runs `load`, then once more after `evictRoot` if the root it read was\n * behind; `reread` tells `load` to skip any root it was handed. Honest servers\n * re-cite the reserved groups in the commit that advances them, so a root\n * still behind after a fresh read is an incident.\n */\nexport async function withMetadataRootReload<Result>(\n  load: (reread: boolean) => Promise<Result>,\n  evictRoot: () => void,\n): Promise<Result> {\n  try {\n    return await load(false);\n  } catch (error) {\n    if (!(error instanceof MetadataRootBehindDirectoryError)) throw error;\n  }\n  evictRoot();\n  try {\n    return await load(true);\n  } catch (error) {\n    if (error instanceof MetadataRootBehindDirectoryError) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Organization metadata root is still behind the signed directory after a reload\",\n      );\n    }\n    throw error;\n  }\n}\n"]}

package/workflows/organizations/groupMetadataRuntime.js

@@ -0,0 +1,28 @@
+import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
+import { createRuntimePrincipalPolicyWarmer } from "../principals/runtimePolicyWarmer.js";
+import { createGroupMetadataAccess, } from "./groupMetadataAccess.js";
+import { createGroupMetadataContainerVerifier } from "./groupMetadataContainerAuthority.js";
+export function createRuntimeGroupMetadataAccess(runtime, organizationId, stillCurrent) {
+    const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;
+    if (!targetSecretKey)
+        throw new Error("Group metadata identity is locked");
+    const warmer = createRuntimePrincipalPolicyWarmer(runtime);
+    return createGroupMetadataAccess({
+        verifyMetadataContainer: createGroupMetadataContainerVerifier({
+            apiClient: runtime.apiClient,
+            execSql: runtime.infra.execSql,
+            organizationId,
+            reportSecurityIncident: runtime.util.reportSecurityIncident,
+            resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+            stillCurrent: stillCurrent ?? (() => true),
+        }),
+        apiClient: runtime.apiClient,
+        execSql: runtime.infra.execSql,
+        organizationId,
+        resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),
+        targetSecretKey,
+        stillCurrent,
+        warmReferencedPrincipalPolicies: warmer,
+    });
+}
+//# sourceMappingURL=groupMetadataRuntime.js.map

package/workflows/organizations/groupMetadataRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataRuntime.js","sourceRoot":"","sources":["groupMetadataRuntime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAI1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AAiBzF,MAAM,UAAU,gCAAgC,CAC9C,OAA6B,EAC7B,cAAsB,EACtB,YAA4B;IAE5B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACvE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,yBAAyB,CAAC;QAC/B,uBAAuB,EAAE,oCAAoC,CAAC;YAC5D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,cAAc;YACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,YAAY,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SAC3C,CAAC;QACF,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,eAAe;QACf,YAAY;QACZ,+BAA+B,EAAE,MAAM;KACxC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { EncapsulationKeyPair } from \"@tearleads/crypto\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../principals/runtimePolicyWarmer\";\nimport {\n  createGroupMetadataAccess,\n  type GroupMetadataAccessInput,\n} from \"./groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"./groupMetadataContainerAuthority\";\nimport type { PrincipalPolicyReadApi } from \"./groupPolicyMutationContext\";\n\ninterface GroupMetadataRuntime {\n  readonly apiClient: GroupMetadataAccessInput[\"apiClient\"] &\n    PrincipalPolicyReadApi;\n  readonly crypto: {\n    readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n}\n\nexport function createRuntimeGroupMetadataAccess(\n  runtime: GroupMetadataRuntime,\n  organizationId: string,\n  stillCurrent?: () => boolean,\n) {\n  const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!targetSecretKey) throw new Error(\"Group metadata identity is locked\");\n  const warmer = createRuntimePrincipalPolicyWarmer(runtime);\n  return createGroupMetadataAccess({\n    verifyMetadataContainer: createGroupMetadataContainerVerifier({\n      apiClient: runtime.apiClient,\n      execSql: runtime.infra.execSql,\n      organizationId,\n      reportSecurityIncident: runtime.util.reportSecurityIncident,\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      stillCurrent: stillCurrent ?? (() => true),\n    }),\n    apiClient: runtime.apiClient,\n    execSql: runtime.infra.execSql,\n    organizationId,\n    resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n    targetSecretKey,\n    stillCurrent,\n    warmReferencedPrincipalPolicies: warmer,\n  });\n}\n"]}

package/workflows/organizations/groupMutationAuthorization.js

@@ -0,0 +1,10 @@
+export function isDirectGroupAdmin(policy, userId) {
+    return policy.currentProjection.some((member) => member.userId === userId && member.role === "admin");
+}
+export function requireSignerCanManageGroup(policy, organizationAdminUserIds, signerUserId) {
+    if (!organizationAdminUserIds.includes(signerUserId) &&
+        !isDirectGroupAdmin(policy, signerUserId)) {
+        throw new Error("Group admin membership is required");
+    }
+}
+//# sourceMappingURL=groupMutationAuthorization.js.map

package/workflows/organizations/groupMutationAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMutationAuthorization.js","sourceRoot":"","sources":["groupMutationAuthorization.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,kBAAkB,CAChC,MAAqC,EACrC,MAAc;IAEd,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAAqC,EACrC,wBAA2C,EAC3C,YAAoB;IAEpB,IACE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChD,CAAC,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function isDirectGroupAdmin(\n  policy: PrincipalPolicyBundleResponse,\n  userId: string,\n): boolean {\n  return policy.currentProjection.some(\n    (member) => member.userId === userId && member.role === \"admin\",\n  );\n}\n\nexport function requireSignerCanManageGroup(\n  policy: PrincipalPolicyBundleResponse,\n  organizationAdminUserIds: readonly string[],\n  signerUserId: string,\n): void {\n  if (\n    !organizationAdminUserIds.includes(signerUserId) &&\n    !isDirectGroupAdmin(policy, signerUserId)\n  ) {\n    throw new Error(\"Group admin membership is required\");\n  }\n}\n"]}

package/workflows/organizations/groupNameUniqueness.js

@@ -0,0 +1,151 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../data/keyingProjectionVerification/error.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../data/persistence/principalPolicyReferencePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../principals/policyVerification.js";
+import { GroupMetadataUnreadableError } from "./groupMetadataAccess.js";
+import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
+import { canonicalGroupNameKey, readGroupPolicyPayloadName, } from "./principalPolicyRequest.js";
+/**
+ * Loads one directory group at its committed head: from the local retained
+ * bundles when they already hold that head, and from the API otherwise.
+ */
+async function loadDirectoryGroupBundle(input, head) {
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", head.principalId);
+    const cached = await loadPrincipalPolicyBundleForReference(input.execSql, head, localCheckpoint);
+    const bundle = cached ??
+        (await input.apiClient.getCurrentPrincipalPolicy("group", head.principalId));
+    if (!bundle) {
+        throw new Error(`Organization directory group ${head.principalId} could not be loaded`);
+    }
+    if (!principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), head)) {
+        // Head drift is reachable by a concurrent admin mutation, so it is a
+        // plain error to retry on, not an incident (as in the share path). The
+        // typed errors stay for signature and projection failures.
+        throw new Error("Organization directory group policy does not match the signed organization directory");
+    }
+    return { bundle, localCheckpoint };
+}
+/**
+ * A bundle served from local retention was verified when it was retained, and
+ * is verified again here on purpose: the re-check costs local CPU only, and it
+ * keeps the name a group vouches for independent of what any earlier caller
+ * trusted at retention time.
+ */
+export async function verifyDirectoryGroup(input, head) {
+    const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(input, head);
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(`Organization directory group signer key could not be loaded (${signerPublicKeys.error})`);
+    }
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: head,
+        loadExternalAuthority: async () => input.externalAuthority,
+        localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Organization directory group verification failed");
+    }
+    assertGroupMetadataBinding(bundle, input.descriptor);
+    const name = await readDirectoryGroupName(input, bundle);
+    return {
+        bundle,
+        name,
+        nameKey: name === null ? null : canonicalGroupNameKey(name),
+        policy: verified.value,
+    };
+}
+/**
+ * A verified group whose name no member can open has no name to select by. The
+ * walk isolates it rather than failing every name in the organization, but it
+ * still records the incident: only a dishonest admin signs such a name.
+ */
+async function readDirectoryGroupName(input, bundle) {
+    try {
+        return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);
+    }
+    catch (error) {
+        if (!(error instanceof GroupMetadataUnreadableError))
+            throw error;
+        await input.reportSecurityIncident(new KeyingVerificationError("invalid_shape", "Signed group name does not open under the cited metadata key"), {
+            evidenceHashes: { stateHash: bundle.currentState.stateHash },
+            objectId: bundle.currentState.principalId,
+            objectKind: "principal",
+            operation: "organization.groupName",
+            organizationId: input.organizationId,
+        });
+        return null;
+    }
+}
+/**
+ * Signed group names are the only authenticated label a member can choose a
+ * group by, and the API does not make them unique within an organization. So
+ * uniqueness is enforced here, where a name enters: before an admin signs a
+ * new group, every group committed in the signed organization directory
+ * (the reserved Admins and Members groups included) is loaded, verified
+ * against its directory head, and its committed name compared by canonical
+ * key. A share then needs only the target's verified name. A compromised
+ * server cannot mint a signed group, so it cannot create the duplicate this
+ * check refuses.
+ *
+ * The walk is fail-closed: one group that cannot be loaded or verified blocks
+ * the creation, since an unverifiable group could carry any name. A verified
+ * group whose name does not decrypt is skipped: no member can open that name,
+ * so it cannot collide with one. It runs the
+ * loads in parallel and retains every verified bundle, so a later creation
+ * finds unchanged groups locally and fetches only those whose head moved.
+ */
+const DIRECTORY_WALK_CONCURRENCY = 4;
+/** Runs `work` over `items` with at most `limit` in flight, keeping order. */
+async function mapWithConcurrency(items, limit, work) {
+    const results = [];
+    let next = 0;
+    const worker = async () => {
+        for (;;) {
+            const index = next++;
+            const item = items[index];
+            if (index >= items.length || item === undefined)
+                return;
+            results[index] = await work(item);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
+}
+export async function assertGroupNameUniqueInDirectory(input) {
+    const nameKey = canonicalGroupNameKey(input.name);
+    // Each verified bundle is retained as soon as it verifies, so a failure
+    // later in the walk (or a taken name) still leaves the cache warm for the
+    // retry. Retention runs in a transaction on the shared connection, so the
+    // writes are chained one after another while the loads stay concurrent.
+    const retainedAt = new Date().toISOString();
+    let retention = Promise.resolve();
+    const verifyAndRetain = async (head) => {
+        const group = await verifyDirectoryGroup(input, head);
+        retention = retention.then(() => retainVerifiedPrincipalPolicyBundle({
+            bundle: group.bundle,
+            execSql: input.execSql,
+            organizationId: input.organizationId,
+            policy: group.policy,
+            updatedAt: retainedAt,
+        }));
+        await retention;
+        return group;
+    };
+    const groups = await mapWithConcurrency(input.descriptor.groupHeads, DIRECTORY_WALK_CONCURRENCY, verifyAndRetain);
+    // A taken name is user input to correct, not evidence of tampering, so this
+    // is a plain error: group creation runs under security-incident reporting,
+    // which records every KeyingVerificationError.
+    if (groups.some((group) => group.nameKey === nameKey)) {
+        throw new Error("Another signed group in this organization already carries this name");
+    }
+}
+//# sourceMappingURL=groupNameUniqueness.js.map

package/workflows/organizations/groupNameUniqueness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupNameUniqueness.js","sourceRoot":"","sources":["groupNameUniqueness.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AACnH,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAEL,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,mDAAmD,CAAC;AAI3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AA4BlC;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,MAAM,MAAM,GACV,MAAM;QACN,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,WAAW,sBAAsB,CACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,IAAI,CACL,EACD,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,wBAAwB,CAChE,KAAK,EACL,IAAI,CACL,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,gBAAgB,CAAC,KAAK,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,IAAI;QACvB,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB;QAC1D,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO;QACL,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3D,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAA8B,EAC9B,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;YAC5D,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YACzC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAuB,EACvB,KAAa,EACb,IAA6B;IAE7B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAC9D,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA0D;IAE1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,EAC3B,IAAwB,EACS,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9B,mCAAmC,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,UAAU;SACtB,CAAC,CACH,CAAC;QACF,MAAM,SAAS,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,UAAU,CAAC,UAAU,EAC3B,0BAA0B,EAC1B,eAAe,CAChB,CAAC;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n  canonicalGroupNameKey,\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\n\nexport interface DirectoryGroupWalkInput {\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly apiClient: {\n    getCurrentPrincipalPolicy: (\n      principalType: \"group\" | \"organization\",\n      principalId: string,\n    ) => Promise<PrincipalPolicyBundleResponse | null>;\n  };\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly execSql: ExecSql;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\ntype DirectoryGroupHead = OrganizationAuthorityDescriptor[\"groupHeads\"][number];\n\ninterface VerifiedDirectoryGroup {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  /** Null when the signed name does not decrypt for any member. */\n  readonly name: string | null;\n  readonly nameKey: string | null;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\n/**\n * Loads one directory group at its committed head: from the local retained\n * bundles when they already hold that head, and from the API otherwise.\n */\nasync function loadDirectoryGroupBundle(\n  input: DirectoryGroupWalkInput,\n  head: DirectoryGroupHead,\n) {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    head.principalId,\n  );\n  const cached = await loadPrincipalPolicyBundleForReference(\n    input.execSql,\n    head,\n    localCheckpoint,\n  );\n  const bundle =\n    cached ??\n    (await input.apiClient.getCurrentPrincipalPolicy(\n      \"group\",\n      head.principalId,\n    ));\n  if (!bundle) {\n    throw new Error(\n      `Organization directory group ${head.principalId} could not be loaded`,\n    );\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      head,\n    )\n  ) {\n    // Head drift is reachable by a concurrent admin mutation, so it is a\n    // plain error to retry on, not an incident (as in the share path). The\n    // typed errors stay for signature and projection failures.\n    throw new Error(\n      \"Organization directory group policy does not match the signed organization directory\",\n    );\n  }\n  return { bundle, localCheckpoint };\n}\n\n/**\n * A bundle served from local retention was verified when it was retained, and\n * is verified again here on purpose: the re-check costs local CPU only, and it\n * keeps the name a group vouches for independent of what any earlier caller\n * trusted at retention time.\n */\nexport async function verifyDirectoryGroup(\n  input: DirectoryGroupWalkInput,\n  head: DirectoryGroupHead,\n): Promise<VerifiedDirectoryGroup> {\n  const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(\n    input,\n    head,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(\n      `Organization directory group signer key could not be loaded (${signerPublicKeys.error})`,\n    );\n  }\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: head,\n      loadExternalAuthority: async () => input.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Organization directory group verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, input.descriptor);\n  const name = await readDirectoryGroupName(input, bundle);\n  return {\n    bundle,\n    name,\n    nameKey: name === null ? null : canonicalGroupNameKey(name),\n    policy: verified.value,\n  };\n}\n\n/**\n * A verified group whose name no member can open has no name to select by. The\n * walk isolates it rather than failing every name in the organization, but it\n * still records the incident: only a dishonest admin signs such a name.\n */\nasync function readDirectoryGroupName(\n  input: DirectoryGroupWalkInput,\n  bundle: PrincipalPolicyBundleResponse,\n): Promise<string | null> {\n  try {\n    return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: bundle.currentState.stateHash },\n        objectId: bundle.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n\n/**\n * Signed group names are the only authenticated label a member can choose a\n * group by, and the API does not make them unique within an organization. So\n * uniqueness is enforced here, where a name enters: before an admin signs a\n * new group, every group committed in the signed organization directory\n * (the reserved Admins and Members groups included) is loaded, verified\n * against its directory head, and its committed name compared by canonical\n * key. A share then needs only the target's verified name. A compromised\n * server cannot mint a signed group, so it cannot create the duplicate this\n * check refuses.\n *\n * The walk is fail-closed: one group that cannot be loaded or verified blocks\n * the creation, since an unverifiable group could carry any name. A verified\n * group whose name does not decrypt is skipped: no member can open that name,\n * so it cannot collide with one. It runs the\n * loads in parallel and retains every verified bundle, so a later creation\n * finds unchanged groups locally and fetches only those whose head moved.\n */\nconst DIRECTORY_WALK_CONCURRENCY = 4;\n\n/** Runs `work` over `items` with at most `limit` in flight, keeping order. */\nasync function mapWithConcurrency<T, R>(\n  items: ReadonlyArray<T>,\n  limit: number,\n  work: (item: T) => Promise<R>,\n): Promise<R[]> {\n  const results: R[] = [];\n  let next = 0;\n  const worker = async () => {\n    for (;;) {\n      const index = next++;\n      const item = items[index];\n      if (index >= items.length || item === undefined) return;\n      results[index] = await work(item);\n    }\n  };\n  await Promise.all(\n    Array.from({ length: Math.min(limit, items.length) }, worker),\n  );\n  return results;\n}\n\nexport async function assertGroupNameUniqueInDirectory(\n  input: DirectoryGroupWalkInput & { readonly name: string },\n): Promise<void> {\n  const nameKey = canonicalGroupNameKey(input.name);\n  // Each verified bundle is retained as soon as it verifies, so a failure\n  // later in the walk (or a taken name) still leaves the cache warm for the\n  // retry. Retention runs in a transaction on the shared connection, so the\n  // writes are chained one after another while the loads stay concurrent.\n  const retainedAt = new Date().toISOString();\n  let retention: Promise<void> = Promise.resolve();\n  const verifyAndRetain = async (\n    head: DirectoryGroupHead,\n  ): Promise<VerifiedDirectoryGroup> => {\n    const group = await verifyDirectoryGroup(input, head);\n    retention = retention.then(() =>\n      retainVerifiedPrincipalPolicyBundle({\n        bundle: group.bundle,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        policy: group.policy,\n        updatedAt: retainedAt,\n      }),\n    );\n    await retention;\n    return group;\n  };\n  const groups = await mapWithConcurrency(\n    input.descriptor.groupHeads,\n    DIRECTORY_WALK_CONCURRENCY,\n    verifyAndRetain,\n  );\n  // A taken name is user input to correct, not evidence of tampering, so this\n  // is a plain error: group creation runs under security-incident reporting,\n  // which records every KeyingVerificationError.\n  if (groups.some((group) => group.nameKey === nameKey)) {\n    throw new Error(\n      \"Another signed group in this organization already carries this name\",\n    );\n  }\n}\n"]}