@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/organizations/groupPolicyMutationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyMutationContext.js","sourceRoot":"","sources":["groupPolicyMutationContext.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,8BAA8B,GAM/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+CAA+C,EAAE,MAAM,2DAA2D,CAAC;AAC5H,OAAO,EAAE,+CAA+C,EAAE,MAAM,iEAAiE,CAAC;AAClI,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AAGrG,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EACL,2BAA2B,EAC3B,8CAA8C,EAC9C,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,4CAA4C,EAC5C,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,iBAAiB,EACjB,+CAA+C,GAChD,MAAM,2BAA2B,CAAC;AAuEnC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAatC;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC5D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,aAAa,EAAE,MAAM;QACrB,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,4CAA4C,CAC1C,MAAM,CAAC,YAAY,EACnB,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtC,8CAA8C,CAC5C,KAAK,CAAC,2BAA2B,EACjC,MAAM,CAAC,sBAAsB,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,4BAA4B,CACpD,WAAW,CAAC,UAAU,EACtB,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,aAAa,GACjB,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,YAAY;QACxC,CAAC,CAAC,WAAW,CAAC,WAAW;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,4CAA4C,CAC1C,aAAa,CAAC,YAAY,EAC1B,iBAAiB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC;IAC7E,MAAM,sBAAsB,GAAG,WAAW,CAAC,aAAa,CAAC;IACzD,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACxD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB;QACxC,CAAC,CAAC,MAAM,iBAAiB,CAAC;YACtB,aAAa;YACb,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC;QACJ,CAAC,CAAC,MAAM,+CAA+C,CAAC;YACpD,aAAa;YACb,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;YACpD,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC,CAAC;IACP,0BAA0B,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClE,2BAA2B,CACzB,aAAa,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE;YACP,GAAG,qCAAqC,CAAC,WAAW,CAAC,CAAC,MAAM,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;gBACrD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;YACD,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,iBAAiB,EAAE,WAAW,CAAC,WAAW;QAC1C,aAAa;QACb,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,sBAAsB,EAAE,WAAW,CAAC,UAAU;QAC9C,wBAAwB,EAAE,WAAW,CAAC,MAAM;QAC5C,GAAG,YAAY;QACf,qBAAqB,EAAE,QAAQ,CAAC,UAAU;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB,CAAC,KAYtC;IACC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAClB,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,kBAAkB,EAAE,KAAK,CAAC,mBAAmB;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,mCAAmC,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IAChE,IAAI,CAAC,mCAAmC,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,CACP,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC,IAAI,CAC1D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,EACN,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAClC,MAAM,IAAI,KAAK,CACb,KAAK,CAAC,OAAO;YACX,4DAA4D,CAC/D,CAAC;IACJ,IACE,CAAC,KAAK,CAAC,qBAAqB;QAC5B,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;QACtE,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,EACnC,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,qEAAqE;QACrE,kDAAkD;QAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACvD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,2EAA2E;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,IAAI,CAC3D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,EACN,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;YACnC,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,OAAO;gBACZ,4DAA4D,CAC/D,CAAC;QACJ,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAqB/C;IACC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,kCAAkC,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CACpD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,2BAA2B,CAAC;QACjE,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,+CAA+C,CAAC;QACpD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE;YACjD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,kBAAkB;SAC3B;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACnD;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,wBAAwB;aACjC;SACF;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { RequestFailureKind } from \"@tearleads/api-client\";\nimport type {\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicySignerPublicKey,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n} from \"@tearleads/crypto\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  ContainerMutationRequest,\n  CreateOrganizationGroupWithPolicyRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport {\n  CONTAINER_MUTATION_ERROR_CODES,\n  type CommitOrganizationGroupPolicyResponse,\n  type CreateOrganizationGroupResponse,\n  type CurrentPrincipalMemberEnvelopesResponse,\n  type PrincipalPolicyBundleResponse,\n  type PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { retainLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport { requireOrganizationGroupHead } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../principals/externalAdminPolicy\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport {\n  acknowledgeGroupPolicyState,\n  assertGroupPolicyEnvelopesMatchAcknowledgement,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  assertPrincipalPolicyCurrentStateMatchesHead,\n  groupPolicyMutationHead,\n} from \"./groupPolicyMutationHead\";\nimport {\n  collectGroupPolicySignerPublicKeys,\n  prepareGroupPolicyVerification,\n  verifyGroupPolicy,\n  verifyGroupPolicyWithExternalOrganizationAdmins,\n} from \"./groupPolicyVerification\";\n\nexport interface PrincipalPolicyReadApi {\n  getCurrentPrincipalPolicy: (\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n  ) => Promise<PrincipalPolicyBundleResponse | null>;\n}\n\nexport interface PrincipalPolicyReadWriteApi extends PrincipalPolicyReadApi {\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n  /**\n   * Optional status-bearing variant. A rematerialized rotation the server\n   * refuses for stranding a granted path names the descendant rekeys the batch\n   * must carry; without this the refusal is a plain failure.\n   */\n  commitOrganizationGroupPolicyResult?: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options?: { readonly reportErrors?: boolean | undefined },\n  ) => Promise<\n    | {\n        readonly ok: true;\n        readonly data: CommitOrganizationGroupPolicyResponse;\n      }\n    | {\n        readonly ok: false;\n        readonly kind?: RequestFailureKind | undefined;\n        readonly message?: string | undefined;\n        readonly code?: string | undefined;\n        readonly report?: (() => void) | undefined;\n        readonly requiredContainerIds?: readonly string[] | undefined;\n        readonly status: number | null;\n      }\n  >;\n}\n\nexport interface OrganizationPrincipalPolicyApi extends PrincipalPolicyReadApi {\n  createOrganizationGroup: (\n    organizationId: string,\n    input: CreateOrganizationGroupWithPolicyRequest,\n  ) => Promise<CreateOrganizationGroupResponse | null>;\n}\n\nexport interface BuildGroupMembershipMutationInput {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly currentOrgAdminUserIds?: readonly string[] | undefined;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly isOrganizationAdminsGroup?: boolean | undefined;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}\n\ninterface LoadedGroupPolicyMutationContext\n  extends BuildGroupMembershipMutationInput {\n  readonly adminGroupId: string;\n  readonly adminPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly currentOrgAdminUserIds: readonly string[];\n  readonly organizationDescriptor: VerifiedExternalAdminPolicy[\"descriptor\"];\n  readonly organizationPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly memberGroupId: string;\n}\n\nexport async function cacheGroupPolicy(input: {\n  readonly acknowledgedMemberEnvelopes?:\n    | CurrentPrincipalMemberEnvelopesResponse\n    | undefined;\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly execSql: ExecSql;\n  readonly expectedCurrentHead?: ReferencedPrincipalHead | undefined;\n  readonly groupId: string;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse> {\n  const bundle = await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n\n  if (!bundle) {\n    throw new Error(\"Updated group policy could not be loaded\");\n  }\n\n  const signerPublicKeys = await collectGroupPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const verified = await verifyGroupPolicy({\n    currentPolicy: bundle,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n    signerPublicKeys,\n  });\n  if (input.expectedCurrentHead) {\n    assertPrincipalPolicyCurrentStateMatchesHead(\n      bundle.currentState,\n      input.expectedCurrentHead,\n    );\n  }\n  if (input.acknowledgedMemberEnvelopes) {\n    assertGroupPolicyEnvelopesMatchAcknowledgement(\n      input.acknowledgedMemberEnvelopes,\n      bundle.currentMemberEnvelopes,\n    );\n  }\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [{ bundle, policy: verified }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return bundle;\n}\n\nexport async function loadGroupPolicyMutationContext(input: {\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<LoadedGroupPolicyMutationContext> {\n  const adminPolicy = await loadOrganizationExternalAdminPolicy({\n    execSql: input.execSql,\n    getCurrentPrincipalPolicy: (principalType, principalId) =>\n      input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!adminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const expectedGroupHead = requireOrganizationGroupHead(\n    adminPolicy.descriptor,\n    input.groupId,\n  );\n  const currentPolicy =\n    input.groupId === adminPolicy.adminGroupId\n      ? adminPolicy.adminBundle\n      : await input.apiClient.getCurrentPrincipalPolicy(\"group\", input.groupId);\n  if (!currentPolicy) {\n    throw new Error(\"Group policy could not be loaded\");\n  }\n  assertPrincipalPolicyCurrentStateMatchesHead(\n    currentPolicy.currentState,\n    expectedGroupHead,\n  );\n  const verification = await prepareGroupPolicyVerification({\n    currentPolicy,\n    execSql: input.execSql,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const isOrganizationAdminsGroup = adminPolicy.adminGroupId === input.groupId;\n  const currentOrgAdminUserIds = adminPolicy.signerUserIds;\n  const externalAuthority = adminPolicy.externalAuthority;\n  if (!currentOrgAdminUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority is required\");\n  }\n  const verified = isOrganizationAdminsGroup\n    ? await verifyGroupPolicy({\n        currentPolicy,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      })\n    : await verifyGroupPolicyWithExternalOrganizationAdmins({\n        currentPolicy,\n        loadExternalAuthority: async () => externalAuthority,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      });\n  assertGroupMetadataBinding(currentPolicy, adminPolicy.descriptor);\n  requireSignerCanManageGroup(\n    currentPolicy,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [\n      ...externalAdminPolicyPersistenceEntries(adminPolicy).filter(\n        (entry) =>\n          entry.policy.principalType !== verified.principalType ||\n          entry.policy.principalId !== verified.principalId,\n      ),\n      { bundle: currentPolicy, policy: verified },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n  });\n\n  return {\n    adminGroupId: adminPolicy.adminGroupId,\n    adminPolicyBundle: adminPolicy.adminBundle,\n    currentPolicy,\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup,\n    memberGroupId: adminPolicy.memberGroupId,\n    organizationDescriptor: adminPolicy.descriptor,\n    organizationPolicyBundle: adminPolicy.bundle,\n    ...verification,\n    localPolicyCheckpoint: verified.checkpoint,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n}\n\n/**\n * Commit, answering one refusal: a rematerialized rekey or revoke that would\n * strand a level above a directly granted container is refused with the\n * descendant rekeys it must carry. The refused attempt rolled back whole, so\n * the served heads still stand; the batch is signed again with the named\n * levels woven in, replaces the container mutations, and the commit is retried\n * once. A second refusal means the tree moved underneath, and the caller's own\n * retry starts from a fresh policy.\n */\nasync function submitGroupPolicyCommit(input: {\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly carryDescendantRekeys?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<CommitOrganizationGroupPolicyResponse | null> {\n  const body = () => ({\n    groupPolicy: input.request,\n    organizationPolicy: input.organizationRequest,\n  });\n  const { commitOrganizationGroupPolicyResult } = input.apiClient;\n  if (!commitOrganizationGroupPolicyResult) {\n    return input.apiClient.commitOrganizationGroupPolicy(\n      input.organizationId,\n      input.groupId,\n      body(),\n    );\n  }\n  const first = await commitOrganizationGroupPolicyResult.call(\n    input.apiClient,\n    input.organizationId,\n    input.groupId,\n    body(),\n    { reportErrors: false },\n  );\n  if (first.ok) return first.data;\n  if (first.kind === \"cancelled\") return null;\n  if (first.kind === \"outcome-unknown\")\n    throw new Error(\n      first.message ??\n        \"Policy request may have committed; refresh before retrying\",\n    );\n  if (\n    !input.carryDescendantRekeys ||\n    first.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||\n    !first.requiredContainerIds?.length\n  ) {\n    first.report?.();\n    return null;\n  }\n  let carried: readonly ContainerMutationRequest[];\n  try {\n    carried = await input.carryDescendantRekeys(first.requiredContainerIds);\n  } catch (error) {\n    // The refusal was answerable, and the answer failed: surface both. Once\n    // the generation that owned the attempt is gone, only the failure is\n    // surfaced; a superseded refusal is not an error.\n    if (input.stillCurrent?.() !== false) first.report?.();\n    throw error;\n  }\n  if (input.stillCurrent?.() === false) return null;\n  // Nothing signed means the same refusal again; report the one already had.\n  if (carried.length === 0) {\n    first.report?.();\n    return null;\n  }\n  input.request.containerMutations = [...carried];\n  const second = await commitOrganizationGroupPolicyResult.call(\n    input.apiClient,\n    input.organizationId,\n    input.groupId,\n    body(),\n    { reportErrors: false },\n  );\n  if (!second.ok) {\n    if (second.kind === \"cancelled\") return null;\n    if (second.kind === \"outcome-unknown\")\n      throw new Error(\n        second.message ??\n          \"Policy request may have committed; refresh before retrying\",\n      );\n    second.report?.();\n    return null;\n  }\n  return second.data;\n}\n\nexport async function commitGroupPolicyMutation(input: {\n  readonly retiredContainerIds?: (() => readonly string[]) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly organizationPolicy: PrincipalPolicyBundleResponse;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  /**\n   * Re-sign the batch with the descendant rekeys a refusal named woven in; the\n   * result replaces `containerMutations` and the commit is retried once.\n   */\n  readonly carryDescendantRekeys?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stored = await submitGroupPolicyCommit(input);\n  if (!stored) {\n    throw new Error(\"Group policy update failed\");\n  }\n  const storedPolicy = stored.groupPolicy;\n  const acknowledgedPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy.currentState,\n  });\n  const groupBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy,\n  });\n  const organizationHead = await groupPolicyMutationHead(\n    input.organizationRequest,\n  );\n  const acknowledgedOrganization = await acknowledgeGroupPolicyState({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await retainLocallyAcknowledgedPrincipalPolicyBundles({\n    retiredContainers: {\n      containerIds: input.retiredContainerIds?.() ?? [],\n      organizationId: input.organizationId,\n      policy: acknowledgedPolicy,\n    },\n    entries: [\n      { bundle: groupBundle, policy: acknowledgedPolicy },\n      {\n        bundle: organizationBundle,\n        policy: acknowledgedOrganization,\n      },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return groupBundle;\n}\n"]}

package/workflows/organizations/groupPolicyMutationHead.js

@@ -0,0 +1,26 @@
+import { computePrincipalStateHash, } from "../../internal/crypto/index.js";
+export async function groupPolicyMutationHead(request) {
+    const state = request.state;
+    return {
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        keyEpoch: state.keyEpoch,
+        stateHash: await computePrincipalStateHash(state),
+        keyFingerprint: state.keyFingerprint,
+    };
+}
+function principalPolicyCurrentStateMatchesHead(state, head) {
+    return (state.principalType === head.principalType &&
+        state.principalId === head.principalId &&
+        state.version === head.version &&
+        state.keyEpoch === head.keyEpoch &&
+        state.stateHash === head.stateHash &&
+        state.keyFingerprint === head.keyFingerprint);
+}
+export function assertPrincipalPolicyCurrentStateMatchesHead(state, head) {
+    if (!principalPolicyCurrentStateMatchesHead(state, head)) {
+        throw new Error("Updated group policy advanced during root re-wrap");
+    }
+}
+//# sourceMappingURL=groupPolicyMutationHead.js.map

package/workflows/organizations/groupPolicyMutationHead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyMutationHead.js","sourceRoot":"","sources":["groupPolicyMutationHead.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC;AAI3B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAAoD,EACpD,IAA6B;IAE7B,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC9B,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAChC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAClC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,KAAoD,EACpD,IAA6B;IAE7B,IAAI,CAAC,sCAAsC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n  computePrincipalStateHash,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport async function groupPolicyMutationHead(\n  request: PutPrincipalPolicyRequest,\n): Promise<ReferencedPrincipalHead> {\n  const state = request.state;\n  return {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: await computePrincipalStateHash(state),\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nfunction principalPolicyCurrentStateMatchesHead(\n  state: PrincipalPolicyBundleResponse[\"currentState\"],\n  head: ReferencedPrincipalHead,\n): boolean {\n  return (\n    state.principalType === head.principalType &&\n    state.principalId === head.principalId &&\n    state.version === head.version &&\n    state.keyEpoch === head.keyEpoch &&\n    state.stateHash === head.stateHash &&\n    state.keyFingerprint === head.keyFingerprint\n  );\n}\n\nexport function assertPrincipalPolicyCurrentStateMatchesHead(\n  state: PrincipalPolicyBundleResponse[\"currentState\"],\n  head: ReferencedPrincipalHead,\n): void {\n  if (!principalPolicyCurrentStateMatchesHead(state, head)) {\n    throw new Error(\"Updated group policy advanced during root re-wrap\");\n  }\n}\n"]}

package/workflows/organizations/groupPolicyRequests.js

@@ -0,0 +1,175 @@
+import { generateKemSeedAndKeyPair, KeyingVerificationError, toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { principalSecretKeyMatchesState } from "../../data/principals/principalKeyValidation.js";
+import { isDirectGroupAdmin, requireSignerCanManageGroup, } from "./groupMutationAuthorization.js";
+import { verifyGroupPolicy } from "./groupPolicyVerification.js";
+import { rewrapProjectionMemberEnvelopes, toRecipientEntries, } from "./principalPolicyRecipients.js";
+import { signedGroupPolicyRequest, userProjectionMember, } from "./principalPolicyRequest.js";
+/**
+ * The signed policy commits both the group's public key and the member
+ * envelopes that are supposed to wrap its secret. An envelope that unwraps to
+ * a different secret means a prior admin (or the server) published a policy
+ * whose envelopes do not match its signed key. Rotating repairs the group, but
+ * the mismatch is evidence and is recorded before the repair proceeds.
+ */
+async function reportPrincipalEnvelopeMismatch(input) {
+    const state = input.currentPolicy.currentState;
+    await input.reportSecurityIncident?.(new KeyingVerificationError("object_mismatch", "Group member envelope does not unwrap the signed principal key"), {
+        evidenceHashes: {
+            principalKeyFingerprint: state.keyFingerprint,
+            principalStateHash: state.stateHash,
+        },
+        objectId: state.principalId,
+        objectKind: "principal",
+        operation: "group.policy.envelope_mismatch",
+    });
+}
+function hasAdmin(projection) {
+    return projection.some((member) => member.role === "admin");
+}
+function requireExternalAuthority(authority) {
+    if (!authority) {
+        throw new Error("External principal authority could not be verified");
+    }
+    return authority;
+}
+async function verifyAndAuthorizeGroupMutation(input) {
+    await verifyGroupPolicy({
+        currentPolicy: input.currentPolicy,
+        ...(input.externalAuthority
+            ? { externalAuthority: input.externalAuthority }
+            : {}),
+        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
+        signerPublicKeys: input.currentPolicySignerPublicKeys,
+    });
+    requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
+}
+async function buildRotatedKeyGroupPolicyRequest(input, projection, users, grants = input.currentPolicy.currentGrants) {
+    const groupKem = generateKemSeedAndKeyPair();
+    const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
+        projection,
+        secretKey: groupKem.secretKey,
+        users,
+    });
+    return signedGroupPolicyRequest({
+        currentPolicy: input.currentPolicy,
+        encapsulationPublicKey: bytesToBase64(groupKem.publicKey),
+        externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+            ? null
+            : requireExternalAuthority(input.externalAuthority).currentHead,
+        keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,
+        keyFingerprint: await toFingerprint(groupKem.publicKey),
+        grants,
+        memberEnvelopes,
+        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+        principalId: input.currentPolicy.currentState.principalId,
+        projection,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+}
+async function buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey) {
+    const groupSecretKey = await unwrapDek(toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes), input.currentUserSecretKey);
+    if (!(await principalSecretKeyMatchesState(groupSecretKey, input.currentPolicy.currentState))) {
+        await reportPrincipalEnvelopeMismatch(input);
+        return buildRotatedKeyGroupPolicyRequest(input, projection, [
+            ...input.currentUsers,
+            input.targetUser,
+        ]);
+    }
+    const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [
+        input.targetUser.encapsulationPublicKey,
+    ]);
+    if (!targetEnvelope) {
+        throw new Error("Failed to wrap group key for target user");
+    }
+    const memberEnvelopes = [
+        ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter((envelope) => envelope.userId !== targetKey),
+        {
+            userId: input.targetUser.userId,
+            memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,
+            kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),
+            wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),
+        },
+    ];
+    return signedGroupPolicyRequest({
+        currentPolicy: input.currentPolicy,
+        encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
+        externalAuthority: null,
+        keyEpoch: input.currentPolicy.currentState.keyEpoch,
+        keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
+        grants: input.currentPolicy.currentGrants,
+        memberEnvelopes,
+        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+        principalId: input.currentPolicy.currentState.principalId,
+        projection,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+}
+export async function buildAddGroupUserPolicyRequest(input) {
+    await verifyAndAuthorizeGroupMutation(input);
+    const targetKey = input.targetUser.userId;
+    const currentProjection = input.currentPolicy.currentProjection;
+    if (currentProjection.some((member) => member.userId === targetKey)) {
+        throw new Error("User is already a group member");
+    }
+    const projection = [
+        ...currentProjection,
+        userProjectionMember(input.targetUser.userId, input.isOrganizationAdminsGroup ? "admin" : "member"),
+    ];
+    return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+        ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)
+        : buildRotatedKeyGroupPolicyRequest(input, projection, [
+            ...input.currentUsers,
+            input.targetUser,
+        ]);
+}
+export async function buildRemoveGroupUserPolicyRequest(input) {
+    await verifyAndAuthorizeGroupMutation(input);
+    const key = input.removedUserId;
+    const projection = input.currentPolicy.currentProjection.filter((member) => member.userId !== key);
+    if (projection.length === input.currentPolicy.currentProjection.length) {
+        throw new Error("User is not a group member");
+    }
+    if (hasAdmin(input.currentPolicy.currentProjection) &&
+        !hasAdmin(projection)) {
+        throw new Error("Cannot remove the last group admin");
+    }
+    return buildRotatedKeyGroupPolicyRequest(input, projection, input.remainingUsers);
+}
+export async function buildGroupAccessSetShrinkPolicyRequest(input) {
+    await verifyAndAuthorizeGroupMutation(input);
+    return buildRotatedKeyGroupPolicyRequest(input, [...input.currentPolicy.currentProjection], input.currentUsers, input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.revokedContainerId));
+}
+/** Signs a complete successor grant projection without rotating group key material. */
+export async function buildSetGroupContainerGrantPolicyRequest(input) {
+    await verifyAndAuthorizeGroupMutation(input);
+    const grants = [
+        ...input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.containerId),
+        { accessLevel: input.accessLevel, containerId: input.containerId },
+    ];
+    return signedGroupPolicyRequest({
+        currentPolicy: input.currentPolicy,
+        encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
+        externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+            ? null
+            : requireExternalAuthority(input.externalAuthority).currentHead,
+        keyEpoch: input.currentPolicy.currentState.keyEpoch,
+        keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
+        grants,
+        memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,
+        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+        principalId: input.currentPolicy.currentState.principalId,
+        projection: input.currentPolicy.currentProjection,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+}
+//# sourceMappingURL=groupPolicyRequests.js.map

package/workflows/organizations/groupPolicyRequests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAG9F,OAAO,EACL,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,KAAwC;IAExC,MAAM,iBAAiB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB,EAAE,KAAK,CAAC,6BAA6B;KACtD,CAAC,CAAC;IACH,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;IAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,GAAG,iBAAiB;QACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;KACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,yCAAyC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC;QACzE,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YACnD,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;QAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;QACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;KACnE,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM;QACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;QACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;QACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  toFingerprint,\n  unwrapDek,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalContainerGrantRequest,\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\nimport {\n  isDirectGroupAdmin,\n  requireSignerCanManageGroup,\n} from \"./groupMutationAuthorization\";\nimport type { BuildGroupMembershipMutationInput } from \"./groupPolicyMutationContext\";\nimport { verifyGroupPolicy } from \"./groupPolicyVerification\";\nimport {\n  rewrapProjectionMemberEnvelopes,\n  toRecipientEntries,\n} from \"./principalPolicyRecipients\";\nimport {\n  signedGroupPolicyRequest,\n  userProjectionMember,\n} from \"./principalPolicyRequest\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n  readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly targetUser: TrustedUserIdentity;\n};\n\n/**\n * The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n */\nasync function reportPrincipalEnvelopeMismatch(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n  const state = input.currentPolicy.currentState;\n  await input.reportSecurityIncident?.(\n    new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Group member envelope does not unwrap the signed principal key\",\n    ),\n    {\n      evidenceHashes: {\n        principalKeyFingerprint: state.keyFingerprint,\n        principalStateHash: state.stateHash,\n      },\n      objectId: state.principalId,\n      objectKind: \"principal\",\n      operation: \"group.policy.envelope_mismatch\",\n    },\n  );\n}\n\nfunction hasAdmin(\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n  return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n  authority: PrincipalPolicyExternalAuthority | undefined,\n): PrincipalPolicyExternalAuthority {\n  if (!authority) {\n    throw new Error(\"External principal authority could not be verified\");\n  }\n  return authority;\n}\n\nasync function verifyAndAuthorizeGroupMutation(\n  input: BuildGroupMembershipMutationInput,\n): Promise<void> {\n  await verifyGroupPolicy({\n    currentPolicy: input.currentPolicy,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n    signerPublicKeys: input.currentPolicySignerPublicKeys,\n  });\n  requireSignerCanManageGroup(\n    input.currentPolicy,\n    input.currentOrgAdminUserIds ?? [],\n    input.signerUserId,\n  );\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n  input: BuildGroupMembershipMutationInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  users: ReadonlyArray<TrustedUserIdentity>,\n  grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: groupKem.secretKey,\n    users,\n  });\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n    externalAuthority: isDirectGroupAdmin(\n      input.currentPolicy,\n      input.signerUserId,\n    )\n      ? null\n      : requireExternalAuthority(input.externalAuthority).currentHead,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n    keyFingerprint: await toFingerprint(groupKem.publicKey),\n    grants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupSecretKey = await unwrapDek(\n    toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n    input.currentUserSecretKey,\n  );\n  if (\n    !(await principalSecretKeyMatchesState(\n      groupSecretKey,\n      input.currentPolicy.currentState,\n    ))\n  ) {\n    await reportPrincipalEnvelopeMismatch(input);\n    return buildRotatedKeyGroupPolicyRequest(input, projection, [\n      ...input.currentUsers,\n      input.targetUser,\n    ]);\n  }\n  const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n    input.targetUser.encapsulationPublicKey,\n  ]);\n\n  if (!targetEnvelope) {\n    throw new Error(\"Failed to wrap group key for target user\");\n  }\n\n  const memberEnvelopes = [\n    ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n      (envelope) => envelope.userId !== targetKey,\n    ),\n    {\n      userId: input.targetUser.userId,\n      memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n    },\n  ];\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey:\n      input.currentPolicy.currentState.encapsulationPublicKey,\n    externalAuthority: null,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch,\n    keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n    grants: input.currentPolicy.currentGrants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n\n  const targetKey = input.targetUser.userId;\n  const currentProjection = input.currentPolicy.currentProjection;\n  if (currentProjection.some((member) => member.userId === targetKey)) {\n    throw new Error(\"User is already a group member\");\n  }\n\n  const projection = [\n    ...currentProjection,\n    userProjectionMember(\n      input.targetUser.userId,\n      input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n    ),\n  ];\n\n  return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n    ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)\n    : buildRotatedKeyGroupPolicyRequest(input, projection, [\n        ...input.currentUsers,\n        input.targetUser,\n      ]);\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly removedUserId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n\n  const key = input.removedUserId;\n  const projection = input.currentPolicy.currentProjection.filter(\n    (member) => member.userId !== key,\n  );\n\n  if (projection.length === input.currentPolicy.currentProjection.length) {\n    throw new Error(\"User is not a group member\");\n  }\n\n  if (\n    hasAdmin(input.currentPolicy.currentProjection) &&\n    !hasAdmin(projection)\n  ) {\n    throw new Error(\"Cannot remove the last group admin\");\n  }\n\n  return buildRotatedKeyGroupPolicyRequest(\n    input,\n    projection,\n    input.remainingUsers,\n  );\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly revokedContainerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n\n  return buildRotatedKeyGroupPolicyRequest(\n    input,\n    [...input.currentPolicy.currentProjection],\n    input.currentUsers,\n    input.currentPolicy.currentGrants.filter(\n      (grant) => grant.containerId !== input.revokedContainerId,\n    ),\n  );\n}\n\n/** Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n    readonly containerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n  const grants = [\n    ...input.currentPolicy.currentGrants.filter(\n      (grant) => grant.containerId !== input.containerId,\n    ),\n    { accessLevel: input.accessLevel, containerId: input.containerId },\n  ];\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey:\n      input.currentPolicy.currentState.encapsulationPublicKey,\n    externalAuthority: isDirectGroupAdmin(\n      input.currentPolicy,\n      input.signerUserId,\n    )\n      ? null\n      : requireExternalAuthority(input.externalAuthority).currentHead,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch,\n    keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n    grants,\n    memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection: input.currentPolicy.currentProjection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n"]}

package/workflows/organizations/groupPolicyVerification.js

@@ -0,0 +1,74 @@
+import { verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../data/keyingProjectionVerification/error.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from "../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../principals/policyVerification.js";
+function signerPublicKeyLoadErrorMessage(code) {
+    switch (code) {
+        case "fingerprint-mismatch":
+            return "Group policy signer key fingerprint mismatch";
+        case "not-found":
+            return "Group policy signer key could not be loaded";
+    }
+}
+function groupPolicyReference(bundle) {
+    const state = bundle.currentState;
+    return {
+        principalType: "group",
+        principalId: state.principalId,
+        version: state.version,
+        keyEpoch: state.keyEpoch,
+        stateHash: state.stateHash,
+        keyFingerprint: state.keyFingerprint,
+    };
+}
+export async function collectGroupPolicySignerPublicKeys(input) {
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: input.bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));
+    }
+    return signerPublicKeys.signerPublicKeys;
+}
+export async function verifyGroupPolicy(input) {
+    const verified = await verifyPrincipalPolicyBundle({
+        bundle: input.currentPolicy,
+        ...(input.externalAuthority
+            ? { externalAuthority: input.externalAuthority }
+            : {}),
+        expectedReference: groupPolicyReference(input.currentPolicy),
+        localCheckpoint: input.localPolicyCheckpoint,
+        signerPublicKeys: input.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Group policy verification failed");
+    }
+    return verified.value;
+}
+export async function verifyGroupPolicyWithExternalOrganizationAdmins(input) {
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle: input.currentPolicy,
+        expectedReference: groupPolicyReference(input.currentPolicy),
+        loadExternalAuthority: input.loadExternalAuthority,
+        localCheckpoint: input.localPolicyCheckpoint,
+        signerPublicKeys: input.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Group policy verification failed");
+    }
+    return verified.value;
+}
+export async function prepareGroupPolicyVerification(input) {
+    const principalId = input.currentPolicy.currentState.principalId;
+    const localPolicyCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", principalId);
+    return {
+        currentPolicySignerPublicKeys: await collectGroupPolicySignerPublicKeys({
+            bundle: input.currentPolicy,
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        }),
+        localPolicyCheckpoint,
+    };
+}
+//# sourceMappingURL=groupPolicyVerification.js.map

package/workflows/organizations/groupPolicyVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyVerification.js","sourceRoot":"","sources":["groupPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,yDAAyD,EAAE,MAAM,mDAAmD,CAAC;AAG9H,OAAO,EACL,sCAAsC,GAEvC,MAAM,kCAAkC,CAAC;AAE1C,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,8CAA8C,CAAC;QACxD,KAAK,WAAW;YACd,OAAO,6CAA6C,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IAEH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAKrE;IACC,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IAIC,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC;IACjE,MAAM,qBAAqB,GAAG,MAAM,6BAA6B,CAC/D,KAAK,CAAC,OAAO,EACb,OAAO,EACP,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;YACtE,MAAM,EAAE,KAAK,CAAC,aAAa;YAC3B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,qBAAqB;KACtB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../principals/policyVerification\";\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"Group policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"Group policy signer key could not be loaded\";\n  }\n}\n\nfunction groupPolicyReference(\n  bundle: PrincipalPolicyBundleResponse,\n): ReferencedPrincipalHead {\n  const state = bundle.currentState;\n  return {\n    principalType: \"group\",\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nexport async function collectGroupPolicySignerPublicKeys(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: input.bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  return signerPublicKeys.signerPublicKeys;\n}\n\nexport async function verifyGroupPolicy(input: {\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.currentPolicy,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    expectedReference: groupPolicyReference(input.currentPolicy),\n    localCheckpoint: input.localPolicyCheckpoint,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Group policy verification failed\",\n    );\n  }\n\n  return verified.value;\n}\n\nexport async function verifyGroupPolicyWithExternalOrganizationAdmins(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n  const verified: KeyingVerificationResult<VerifiedPrincipalPolicy> =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle: input.currentPolicy,\n      expectedReference: groupPolicyReference(input.currentPolicy),\n      loadExternalAuthority: input.loadExternalAuthority,\n      localCheckpoint: input.localPolicyCheckpoint,\n      signerPublicKeys: input.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Group policy verification failed\",\n    );\n  }\n  return verified.value;\n}\n\nexport async function prepareGroupPolicyVerification(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<{\n  readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n}> {\n  const principalId = input.currentPolicy.currentState.principalId;\n  const localPolicyCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    principalId,\n  );\n\n  return {\n    currentPolicySignerPublicKeys: await collectGroupPolicySignerPublicKeys({\n      bundle: input.currentPolicy,\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    localPolicyCheckpoint,\n  };\n}\n"]}

package/workflows/organizations/index.d.ts

@@ -0,0 +1,15 @@
+export { type OrganizationReadModelInvalidationListener, subscribeOrganizationReadModelInvalidation, } from "../../data/persistence/organizations/organizationReadModelInvalidation.js";
+export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, type OrganizationBilling, type OrganizationBillingHistory, type OrganizationBillingHistoryEntry, type OrganizationBillingManagementUrl, type OrganizationBillingView, type OrganizationNativePurchaseEligibility, resolveOrganizationBillingView, type StripeCheckoutIntent, type StripeCheckoutOptions, startOrganizationTrial, } from "./billing.js";
+export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
+export { type CreateOrganizationApi, type CreateOrganizationInput, createOrganization, } from "./createOrganization.js";
+export { loadLocalOrganizationDataUsage, type OrganizationDataUsage, type ReconcileOrganizationDataUsageInput, reconcileOrganizationDataUsage, } from "./dataUsageReadModel.js";
+export { deleteOrganizationGroup } from "./deleteOrganizationGroup.js";
+export { GroupMembershipNameMismatchError } from "./groupMembershipName.js";
+export { type LocalOrganizationSummary, listLocalOrganizations, } from "./listLocalOrganizations.js";
+export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
+export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
+export { type ImportedOrganizationUser, importOrganizationUser, } from "./organizationUserImport.js";
+export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
+export { buildOrganizationGroupPolicyHistory, type OrganizationContainerGrant, type OrganizationContainerGrants, type OrganizationDirectory, type OrganizationDirectoryAndGroups, type OrganizationDirectoryUser, type OrganizationGroupContainer, type OrganizationGroupContainers, type OrganizationGroupDetails, type OrganizationGroupMember, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationGroupPolicyHistoryEntry, type OrganizationGroupSummary, type OrganizationPolicyGrantChange, type OrganizationPolicyGroupChange, type OrganizationPolicyHistory, type OrganizationPolicyHistoryEntry, type OrganizationPrincipalMemberChange, type OrganizationPrincipalMemberChangeType, type OrganizationPrincipalPolicyHistory, type OrganizationPrincipalPolicyHistoryEntry, type OrganizationProfile, type OrganizationUserDetail, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
+export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, type ReconcileOrganizationDirectoryAndGroupsInput, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
+export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";

package/workflows/organizations/index.js

@@ -0,0 +1,16 @@
+export { subscribeOrganizationReadModelInvalidation, } from "../../data/persistence/organizations/organizationReadModelInvalidation.js";
+export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, resolveOrganizationBillingView, startOrganizationTrial, } from "./billing.js";
+export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
+export { createOrganization, } from "./createOrganization.js";
+export { loadLocalOrganizationDataUsage, reconcileOrganizationDataUsage, } from "./dataUsageReadModel.js";
+export { deleteOrganizationGroup } from "./deleteOrganizationGroup.js";
+export { GroupMembershipNameMismatchError } from "./groupMembershipName.js";
+export { listLocalOrganizations, } from "./listLocalOrganizations.js";
+export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
+export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
+export { importOrganizationUser, } from "./organizationUserImport.js";
+export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
+export { buildOrganizationGroupPolicyHistory, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
+export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
+export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";
+//# sourceMappingURL=index.js.map

package/workflows/organizations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAGL,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EAEjC,uCAAuC,GACxC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n  type OrganizationReadModelInvalidationListener,\n  subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  type OrganizationBilling,\n  type OrganizationBillingHistory,\n  type OrganizationBillingHistoryEntry,\n  type OrganizationBillingManagementUrl,\n  type OrganizationBillingView,\n  type OrganizationNativePurchaseEligibility,\n  resolveOrganizationBillingView,\n  type StripeCheckoutIntent,\n  type StripeCheckoutOptions,\n  startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport {\n  type CreateOrganizationApi,\n  type CreateOrganizationInput,\n  createOrganization,\n} from \"./createOrganization\";\nexport {\n  loadLocalOrganizationDataUsage,\n  type OrganizationDataUsage,\n  type ReconcileOrganizationDataUsageInput,\n  reconcileOrganizationDataUsage,\n} from \"./dataUsageReadModel\";\nexport { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nexport { GroupMembershipNameMismatchError } from \"./groupMembershipName\";\nexport {\n  type LocalOrganizationSummary,\n  listLocalOrganizations,\n} from \"./listLocalOrganizations\";\nexport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupPolicyHistory,\n  loadLocalOrganizationPolicyHistory,\n  loadLocalOrganizationPolicyReference,\n  loadLocalOrganizationUserDetail,\n} from \"./localReadModelDetails\";\nexport {\n  buildOrganizationProfileDocumentPatch,\n  createInitializedOrganizationProfileDocument,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  getOrganizationProfileDocumentLocalId,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n  type ImportedOrganizationUser,\n  importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  createOrganizationGroup,\n  removeOrganizationGroupUser,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n  buildOrganizationGroupPolicyHistory,\n  type OrganizationContainerGrant,\n  type OrganizationContainerGrants,\n  type OrganizationDirectory,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationDirectoryUser,\n  type OrganizationGroupContainer,\n  type OrganizationGroupContainers,\n  type OrganizationGroupDetails,\n  type OrganizationGroupMember,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationGroupPolicyHistoryEntry,\n  type OrganizationGroupSummary,\n  type OrganizationPolicyGrantChange,\n  type OrganizationPolicyGroupChange,\n  type OrganizationPolicyHistory,\n  type OrganizationPolicyHistoryEntry,\n  type OrganizationPrincipalMemberChange,\n  type OrganizationPrincipalMemberChangeType,\n  type OrganizationPrincipalPolicyHistory,\n  type OrganizationPrincipalPolicyHistoryEntry,\n  type OrganizationProfile,\n  type OrganizationUserDetail,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupMembers,\n  type ReconcileOrganizationDirectoryAndGroupsInput,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"./readModelProjection\";\nexport {\n  buildRosterProfileDocumentPatch,\n  createInitializedRosterProfileDocument,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}

package/workflows/organizations/listLocalOrganizations.d.ts

@@ -0,0 +1,20 @@
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+/**
+ * A locally-known organization the user belongs to, derived from its persisted
+ * root container. `name` is the decrypted organization-profile display name when
+ * one is stored locally, or null when it has not synced yet.
+ */
+export interface LocalOrganizationSummary {
+    name: string | null;
+    organizationId: string;
+    rootContainerId: string;
+}
+/**
+ * Enumerates the organizations the user can manage from local state: one per
+ * persisted root container. This is intentionally offline — the Explorer already
+ * resolves files across organizations by effective permission, so listing the
+ * organizations to manage needs no server round-trip.
+ */
+export declare function listLocalOrganizations(input: {
+    execSql: ExecSql;
+}): Promise<LocalOrganizationSummary[]>;

package/workflows/organizations/listLocalOrganizations.js

@@ -0,0 +1,137 @@
+import { readStoredDocumentState } from "../../data/documents/documentKinds.js";
+import { sqlContainerContentsPersistence } from "../../data/persistence/container-contents/containerContentsPersistence.js";
+import { DOCUMENTS_APP_KIND, sqlDocumentsPersistence, } from "../../data/persistence/documents/documentsPersistence.js";
+import { loadOrganizationProfileDocumentIds } from "../../data/persistence/organizations/organizationProfileDocumentPointers.js";
+import { findLocalIdByDocumentId } from "../../data/sqlite/documentPersistence.js";
+import { loadPersistedDocumentContent } from "../documents/historyContent.js";
+import { getOrganizationProfileDocumentLocalId, readOrganizationProfileName, } from "./organizationProfile.js";
+import { deriveOrganizationMetadataContainerSystemSlot } from "./rosterProfileContainer.js";
+// Reads and decrypts the `name` field of the organization_profile document
+// persisted under `documentLocalId`, or null if it is absent, empty, or
+// unparseable. A single corrupt profile must not break the whole list, so every
+// failure collapses to a null (unnamed) organization.
+async function readOrganizationNameFromDocument(execSql, documentLocalId) {
+    try {
+        const doc = await loadPersistedDocumentContent({
+            execSql,
+            localId: documentLocalId,
+            persistence: sqlDocumentsPersistence,
+        });
+        if (!doc) {
+            return null;
+        }
+        return readOrganizationProfileName(readStoredDocumentState(doc).structuredFields);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolves an organization's decrypted display name from local state.
+ *
+ * The same organization_profile document is addressed by several different
+ * local-id conventions depending on how it arrived, so one lookup by id is not
+ * enough:
+ *
+ *  - The org's own **provisioner** (and any admin who later edits the name)
+ *    writes the document under the deterministic alias
+ *    `org-profile:<organizationId>` — resolved by the fast path below.
+ *  - A **device that only synced it** — a member of another org, or this same
+ *    user's freshly re-hydrated device after an identity restore — never runs
+ *    that write. The sync ingest keys the document under the server documentId
+ *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),
+ *    so the alias lookup misses.
+ *
+ * Two fallbacks cover the synced case, in order of authority:
+ *
+ *  1. The **organization read model** records the org's `profileDocumentId`.
+ *     That pointer is container-independent, so it resolves the name wherever
+ *     the document happens to be linked — including a profile document created
+ *     by an admin through the org-manager editor rather than by provisioning.
+ *  2. Failing that, locate the org's metadata container by its deterministic
+ *     system slot and read whichever profile document is linked there. Keying on
+ *     the system slot (rather than the document kind) keeps it correct even
+ *     before the projected document kind has been rebuilt from a freshly-synced
+ *     snapshot, and it still works before the read model has been projected.
+ */
+async function readLocalOrganizationName(execSql, organizationId, organizationContainers, profileDocumentId) {
+    const aliasName = await readOrganizationNameFromDocument(execSql, getOrganizationProfileDocumentLocalId({ organizationId }));
+    if (aliasName !== null) {
+        return aliasName;
+    }
+    if (profileDocumentId) {
+        // Reach the row wherever it landed: a device that only synced the document
+        // keys it under the server documentId rather than any local alias.
+        const syncedLocalId = await findLocalIdByDocumentId(execSql, DOCUMENTS_APP_KIND, profileDocumentId);
+        const syncedName = syncedLocalId
+            ? await readOrganizationNameFromDocument(execSql, syncedLocalId)
+            : null;
+        if (syncedName !== null) {
+            return syncedName;
+        }
+    }
+    const metadataSystemSlot = await deriveOrganizationMetadataContainerSystemSlot({ organizationId });
+    const metadataContainer = organizationContainers.find((container) => container.systemSlot === metadataSystemSlot);
+    if (!metadataContainer) {
+        return null;
+    }
+    const documentLocalIds = await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(execSql, metadataContainer.id);
+    for (const documentLocalId of documentLocalIds) {
+        const name = await readOrganizationNameFromDocument(execSql, documentLocalId);
+        if (name !== null) {
+            return name;
+        }
+    }
+    return null;
+}
+/**
+ * Enumerates the organizations the user can manage from local state: one per
+ * persisted root container. This is intentionally offline — the Explorer already
+ * resolves files across organizations by effective permission, so listing the
+ * organizations to manage needs no server round-trip.
+ */
+export async function listLocalOrganizations(input) {
+    const containers = await sqlContainerContentsPersistence.loadContainers(input.execSql);
+    // A projected read model is not a precondition for listing organizations, so
+    // an unreadable one degrades to the container-derived lookups below.
+    const profileDocumentIdsByOrganizationId = await loadOrganizationProfileDocumentIds(input.execSql).catch(() => new Map());
+    // Group every persisted container by org so name resolution can locate an
+    // org's independent metadata root without a second DB scan.
+    const containersByOrganizationId = new Map();
+    for (const { container } of containers) {
+        const entry = {
+            id: container.id,
+            systemSlot: container.systemSlot ?? null,
+        };
+        const group = containersByOrganizationId.get(container.organizationId);
+        if (group) {
+            group.push(entry);
+        }
+        else {
+            containersByOrganizationId.set(container.organizationId, [entry]);
+        }
+    }
+    const seen = new Set();
+    const rootContainers = containers.filter(({ container }) => {
+        if (container.parentId !== null ||
+            container.systemSlot ||
+            seen.has(container.organizationId)) {
+            return false;
+        }
+        seen.add(container.organizationId);
+        return true;
+    });
+    rootContainers.sort((left, right) => (left.container.localCreatedAt ?? "").localeCompare(right.container.localCreatedAt ?? "") ||
+        left.container.organizationId.localeCompare(right.container.organizationId) ||
+        left.container.id.localeCompare(right.container.id));
+    // Read each organization's profile name concurrently; readLocalOrganizationName
+    // already falls back to null per organization, so a single corrupt profile
+    // cannot reject the batch.
+    return Promise.all(rootContainers.map(async ({ container }) => ({
+        name: await readLocalOrganizationName(input.execSql, container.organizationId, containersByOrganizationId.get(container.organizationId) ?? [], profileDocumentIdsByOrganizationId.get(container.organizationId) ??
+            null),
+        organizationId: container.organizationId,
+        rootContainerId: container.id,
+    })));
+}
+//# sourceMappingURL=listLocalOrganizations.js.map