@tearleads/client-sdk 0.1.15 → 0.1.17

package/workflows/organizations/currentGroupMetadataAuthority.js

@@ -0,0 +1,53 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
+import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
+/** Authenticate metadata-root grants with current policies and only its cited predecessors. */
+export function createCurrentGroupMetadataContainerVerifier(input) {
+    return async (state, organizationReference) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const authority = await loadCurrentOrganizationAuthority({
+            ...input,
+            organizationReference,
+        });
+        await createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent: input.stillCurrent,
+        })(state, organizationReference);
+    };
+}
+/** Reuse one mutation's verified authority without broadening its lease or scope. */
+export function createSelectedCurrentGroupMetadataContainerVerifier(input) {
+    return async (state, organizationReference) => {
+        const { authority } = input;
+        const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();
+        assertProjectionVerificationCurrent(stillCurrent);
+        if (organizationReference) {
+            if (organizationReference.principalType !== "organization" ||
+                organizationReference.principalId !== input.organizationId)
+                throw new KeyingVerificationError("object_mismatch", "Current policy reference is outside its scope");
+            if (!principalHeadMatchesReference(authority.directory.policy.state, organizationReference))
+                throw new ProjectionDependencyUnavailableError("Metadata root belongs to a changed organization directory");
+        }
+        const { adminGroupId, memberGroupId } = authority.descriptor;
+        const citation = (groupId) => state.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === groupId);
+        const admins = await authority.readGroup(adminGroupId, citation(adminGroupId));
+        const members = await authority.readGroup(memberGroupId, citation(memberGroupId));
+        assertMetadataRootBinding({
+            organizationId: input.organizationId,
+            authority: {
+                descriptor: authority.descriptor,
+                adminGroupId,
+                memberGroupId,
+                adminPolicy: admins.policy,
+            },
+            members,
+            state,
+        });
+        assertProjectionVerificationCurrent(() => stillCurrent() && admins.stillCurrent() && members.stillCurrent());
+    };
+}
+//# sourceMappingURL=currentGroupMetadataAuthority.js.map

package/workflows/organizations/currentGroupMetadataAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupMetadataAuthority.js","sourceRoot":"","sources":["currentGroupMetadataAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,+FAA+F;AAC/F,MAAM,UAAU,2CAA2C,CACzD,KAGC;IAED,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;YACvD,GAAG,KAAK;YACR,qBAAqB;SACtB,CAAC,CAAC;QACH,MAAM,mDAAmD,CAAC;YACxD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mDAAmD,CAAC,KAMnE;IACC,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAC5B,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IACE,qBAAqB,CAAC,aAAa,KAAK,cAAc;gBACtD,qBAAqB,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;gBAE1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;YACJ,IACE,CAAC,6BAA6B,CAC5B,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAChC,qBAAqB,CACtB;gBAED,MAAM,IAAI,oCAAoC,CAC5C,2DAA2D,CAC5D,CAAC;QACN,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACjE,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CACtC,YAAY,EACZ,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CACvC,aAAa,EACb,QAAQ,CAAC,aAAa,CAAC,CACxB,CAAC;QACF,yBAAyB,CAAC;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE;gBACT,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,YAAY;gBACZ,aAAa;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;YACD,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,YAAY,EAAE,CACxE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\n/** Authenticate metadata-root grants with current policies and only its cited predecessors. */\nexport function createCurrentGroupMetadataContainerVerifier(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  >,\n) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const authority = await loadCurrentOrganizationAuthority({\n      ...input,\n      organizationReference,\n    });\n    await createSelectedCurrentGroupMetadataContainerVerifier({\n      authority,\n      organizationId: input.organizationId,\n      stillCurrent: input.stillCurrent,\n    })(state, organizationReference);\n  };\n}\n\n/** Reuse one mutation's verified authority without broadening its lease or scope. */\nexport function createSelectedCurrentGroupMetadataContainerVerifier(input: {\n  readonly authority: Awaited<\n    ReturnType<typeof loadCurrentOrganizationAuthority>\n  >;\n  readonly organizationId: string;\n  readonly stillCurrent: () => boolean;\n}) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    const { authority } = input;\n    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();\n    assertProjectionVerificationCurrent(stillCurrent);\n    if (organizationReference) {\n      if (\n        organizationReference.principalType !== \"organization\" ||\n        organizationReference.principalId !== input.organizationId\n      )\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Current policy reference is outside its scope\",\n        );\n      if (\n        !principalHeadMatchesReference(\n          authority.directory.policy.state,\n          organizationReference,\n        )\n      )\n        throw new ProjectionDependencyUnavailableError(\n          \"Metadata root belongs to a changed organization directory\",\n        );\n    }\n    const { adminGroupId, memberGroupId } = authority.descriptor;\n    const citation = (groupId: string) =>\n      state.referencedPrincipalHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === groupId,\n      );\n    const admins = await authority.readGroup(\n      adminGroupId,\n      citation(adminGroupId),\n    );\n    const members = await authority.readGroup(\n      memberGroupId,\n      citation(memberGroupId),\n    );\n    assertMetadataRootBinding({\n      organizationId: input.organizationId,\n      authority: {\n        descriptor: authority.descriptor,\n        adminGroupId,\n        memberGroupId,\n        adminPolicy: admins.policy,\n      },\n      members,\n      state,\n    });\n    assertProjectionVerificationCurrent(\n      () => stillCurrent() && admins.stillCurrent() && members.stillCurrent(),\n    );\n  };\n}\n"]}

package/workflows/organizations/currentGroupMutationReferences.js

@@ -0,0 +1,35 @@
+import { selectPrincipalPolicyCurrentPredecessorReferences, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+/** Select only this path's old citations, preserving the authored membership. */
+export async function resolveCurrentGroupMutationReferences(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const references = structuredClone(input.references);
+    const select = (current, predecessor, selected) => selectPrincipalPolicyCurrentPredecessorReferences({
+        current,
+        predecessor,
+        references: selected,
+    });
+    // Normalize and bound the entire request before any per-reference I/O.
+    const initial = select(input.current, input.predecessor, references);
+    if (initial.ok)
+        return initial.value;
+    if (initial.error.code !== "missing_dependency")
+        throw initial.error;
+    let current = input.current;
+    const selected = [];
+    for (const reference of references) {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        selected.push(reference);
+        let result = select(current, input.predecessor, selected);
+        if (!result.ok && result.error.code === "missing_dependency") {
+            const predecessor = await input.readPredecessorReference(reference);
+            assertProjectionVerificationCurrent(input.stillCurrent);
+            result = select(current, predecessor, selected);
+        }
+        if (!result.ok)
+            throw result.error;
+        current = result.value;
+    }
+    return current;
+}
+//# sourceMappingURL=currentGroupMutationReferences.js.map

package/workflows/organizations/currentGroupMutationReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupMutationReferences.js","sourceRoot":"","sources":["currentGroupMutationReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iDAAiD,GAElD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CACb,OAAuC,EACvC,WAA2C,EAC3C,QAA4C,EAC5C,EAAE,CACF,iDAAiD,CAAC;QAChD,OAAO;QACP,WAAW;QACX,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;IACL,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrE,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import {\n  type ReferencedPrincipalHead,\n  selectPrincipalPolicyCurrentPredecessorReferences,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\n\n/** Select only this path's old citations, preserving the authored membership. */\nexport async function resolveCurrentGroupMutationReferences(input: {\n  readonly current: VerifiedPrincipalPolicyCurrent;\n  readonly predecessor: VerifiedPrincipalPolicyCurrent;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly readPredecessorReference: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<VerifiedPrincipalPolicyCurrent>;\n  readonly stillCurrent: () => boolean;\n}): Promise<VerifiedPrincipalPolicyCurrent> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const references = structuredClone(input.references);\n  const select = (\n    current: VerifiedPrincipalPolicyCurrent,\n    predecessor: VerifiedPrincipalPolicyCurrent,\n    selected: readonly ReferencedPrincipalHead[],\n  ) =>\n    selectPrincipalPolicyCurrentPredecessorReferences({\n      current,\n      predecessor,\n      references: selected,\n    });\n  // Normalize and bound the entire request before any per-reference I/O.\n  const initial = select(input.current, input.predecessor, references);\n  if (initial.ok) return initial.value;\n  if (initial.error.code !== \"missing_dependency\") throw initial.error;\n  let current = input.current;\n  const selected: ReferencedPrincipalHead[] = [];\n  for (const reference of references) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    selected.push(reference);\n    let result = select(current, input.predecessor, selected);\n    if (!result.ok && result.error.code === \"missing_dependency\") {\n      const predecessor = await input.readPredecessorReference(reference);\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      result = select(current, predecessor, selected);\n    }\n    if (!result.ok) throw result.error;\n    current = result.value;\n  }\n  return current;\n}\n"]}

package/workflows/organizations/currentGroupPolicyMutationContext.js

@@ -0,0 +1,79 @@
+import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { requireOrganizationGroupHead } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
+import { loadCurrentOrganizationMutationAuthority } from "./currentOrganizationMutationAuthority.js";
+import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
+import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
+/** Exact current directory, strict Admins and group evidence for one mutation. */
+export async function loadCurrentGroupPolicyMutationContext(input) {
+    input = { ...input };
+    const { authority, currentOrgAdminUserIds } = await loadCurrentOrganizationMutationAuthority(input);
+    const group = await authority.readGroup(input.groupId);
+    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();
+    assertProjectionVerificationCurrent(stillCurrent);
+    assertGroupMetadataBinding(group.current, authority.descriptor);
+    requireSignerCanManageGroup(group.current, currentOrgAdminUserIds, input.signerUserId);
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policies: [...group.dependencies, group.policy],
+        stillCurrent,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const adminHead = requireOrganizationGroupHead(authority.descriptor, authority.descriptor.adminGroupId);
+    const externalAuthority = {
+        currentHead: adminHead,
+        states: [
+            { head: adminHead, projection: authority.admins.policy.projection },
+        ],
+    };
+    const references = new Map();
+    return {
+        adminGroupId: authority.descriptor.adminGroupId,
+        adminCurrent: authority.admins,
+        currentPolicy: group.current,
+        verifiedCurrentPolicy: group.policy,
+        verifyMetadataContainer: createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent,
+        }),
+        currentOrgAdminUserIds,
+        externalAuthority,
+        isOrganizationAdminsGroup: input.groupId === authority.descriptor.adminGroupId,
+        localPolicyCheckpoint: group.policy.checkpoint,
+        memberGroupId: authority.descriptor.memberGroupId,
+        organizationDescriptor: authority.descriptor,
+        organizationCurrent: authority.directory,
+        async readPredecessorReference(reference) {
+            assertProjectionVerificationCurrent(stillCurrent);
+            const owned = structuredClone(reference);
+            const key = serializeKeyingCanonicalJson({ ...owned });
+            let pending = references.get(key);
+            if (!pending) {
+                // Keep at most one bounded selection's citations, even across many paths.
+                if (references.size === 128) {
+                    const oldest = references.keys().next().value;
+                    if (oldest !== undefined)
+                        references.delete(oldest);
+                }
+                pending = authority
+                    .readGroup(input.groupId, owned)
+                    .then((selected) => selected.policy);
+                references.set(key, pending);
+            }
+            const policy = await pending.catch((error) => {
+                if (references.get(key) === pending)
+                    references.delete(key);
+                throw error;
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            return policy;
+        },
+        stillCurrent,
+    };
+}
+//# sourceMappingURL=currentGroupPolicyMutationContext.js.map

package/workflows/organizations/currentGroupPolicyMutationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupPolicyMutationContext.js","sourceRoot":"","sources":["currentGroupPolicyMutationContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AAGrG,OAAO,EAAE,mDAAmD,EAAE,MAAM,iCAAiC,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAY3D;IACC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACrB,MAAM,EAAE,SAAS,EAAE,sBAAsB,EAAE,GACzC,MAAM,wCAAwC,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAChE,2BAA2B,CACzB,KAAK,CAAC,OAAO,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;QAC/C,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,4BAA4B,CAC5C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CAAC,YAAY,CAClC,CAAC;IACF,MAAM,iBAAiB,GAAqC;QAC1D,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;SACpE;KACF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC9E,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY;QAC/C,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,aAAa,EAAE,KAAK,CAAC,OAAO;QAC5B,qBAAqB,EAAE,KAAK,CAAC,MAAM;QACnC,uBAAuB,EACrB,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC;QACJ,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB,EACvB,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,UAAU,CAAC,YAAY;QACrD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QAC9C,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,aAAa;QACjD,sBAAsB,EAAE,SAAS,CAAC,UAAU;QAC5C,mBAAmB,EAAE,SAAS,CAAC,SAAS;QACxC,KAAK,CAAC,wBAAwB,CAAC,SAAkC;YAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,IAAI,UAAU,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;oBAC9C,IAAI,MAAM,KAAK,SAAS;wBAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,GAAG,SAAS;qBAChB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC;qBAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACvC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACpD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;oBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,YAAY;KACb,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyExternalAuthority,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { requireOrganizationGroupHead } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { createRuntimePrincipalPolicyCurrentResolver } from \"../principals/runtimePolicyRecovery\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\nimport { loadCurrentOrganizationMutationAuthority } from \"./currentOrganizationMutationAuthority\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\n\n/** Exact current directory, strict Admins and group evidence for one mutation. */\nexport async function loadCurrentGroupPolicyMutationContext(input: {\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly resolveCurrentPolicy: NonNullable<\n    ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>\n  >;\n  readonly recoverPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<void>;\n  readonly stillCurrent: () => boolean;\n}) {\n  input = { ...input };\n  const { authority, currentOrgAdminUserIds } =\n    await loadCurrentOrganizationMutationAuthority(input);\n  const group = await authority.readGroup(input.groupId);\n  const stillCurrent = () =>\n    input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();\n  assertProjectionVerificationCurrent(stillCurrent);\n  assertGroupMetadataBinding(group.current, authority.descriptor);\n  requireSignerCanManageGroup(\n    group.current,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [...group.dependencies, group.policy],\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const adminHead = requireOrganizationGroupHead(\n    authority.descriptor,\n    authority.descriptor.adminGroupId,\n  );\n  const externalAuthority: PrincipalPolicyExternalAuthority = {\n    currentHead: adminHead,\n    states: [\n      { head: adminHead, projection: authority.admins.policy.projection },\n    ],\n  };\n  const references = new Map<string, Promise<VerifiedPrincipalPolicyCurrent>>();\n  return {\n    adminGroupId: authority.descriptor.adminGroupId,\n    adminCurrent: authority.admins,\n    currentPolicy: group.current,\n    verifiedCurrentPolicy: group.policy,\n    verifyMetadataContainer:\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup:\n      input.groupId === authority.descriptor.adminGroupId,\n    localPolicyCheckpoint: group.policy.checkpoint,\n    memberGroupId: authority.descriptor.memberGroupId,\n    organizationDescriptor: authority.descriptor,\n    organizationCurrent: authority.directory,\n    async readPredecessorReference(reference: ReferencedPrincipalHead) {\n      assertProjectionVerificationCurrent(stillCurrent);\n      const owned = structuredClone(reference);\n      const key = serializeKeyingCanonicalJson({ ...owned });\n      let pending = references.get(key);\n      if (!pending) {\n        // Keep at most one bounded selection's citations, even across many paths.\n        if (references.size === 128) {\n          const oldest = references.keys().next().value;\n          if (oldest !== undefined) references.delete(oldest);\n        }\n        pending = authority\n          .readGroup(input.groupId, owned)\n          .then((selected) => selected.policy);\n        references.set(key, pending);\n      }\n      const policy = await pending.catch((error: unknown) => {\n        if (references.get(key) === pending) references.delete(key);\n        throw error;\n      });\n      assertProjectionVerificationCurrent(stillCurrent);\n      return policy;\n    },\n    stillCurrent,\n  };\n}\n"]}

package/workflows/organizations/currentOrganizationAuthority.js

@@ -0,0 +1,88 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { validateKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { assertCurrentMatchesVerifiedPolicy } from "../../data/persistence/verifiedPrincipalPolicyCurrent.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
+/** One directory view with bounded, authenticated current artifacts for its groups. */
+export async function loadCurrentOrganizationAuthority(input) {
+    if (input.organizationReference)
+        assertReferenceScope(input.organizationReference, "organization", input.organizationId);
+    const recoveryBatch = input.recoveryBatch ?? {};
+    const resolve = (reference) => input.resolveCurrentPolicy({
+        organizationId: input.organizationId,
+        reference: reference ?? undefined,
+        preferLocalCurrent: true,
+        recoveryBatch,
+        stillCurrent: input.stillCurrent,
+    });
+    const directory = await resolve(input.organizationReference);
+    await assertExactCurrent(directory, input.organizationReference ?? directory.policy.state);
+    const descriptor = parseOrganizationAuthorityDescriptor(directory.current.currentPayload.ciphertext);
+    if (descriptor.organizationId !== input.organizationId)
+        throw new KeyingVerificationError("object_mismatch", "Organization current policy payload is outside its scope");
+    const adminHead = requireOrganizationGroupHead(descriptor, descriptor.adminGroupId);
+    const admins = await resolve(adminHead);
+    await assertExactCurrent(admins, adminHead);
+    assertDirectoryDependency(admins, directory);
+    const stillCurrent = () => input.stillCurrent() && directory.stillCurrent() && admins.stillCurrent();
+    const validate = async (value) => {
+        assertProjectionVerificationCurrent(stillCurrent);
+        await validateKeyingCheckpointsAtomically({
+            access: [],
+            execSql: input.execSql,
+            policies: [...value.dependencies, value.policy],
+            stillCurrent: () => stillCurrent() && value.stillCurrent(),
+        });
+        assertProjectionVerificationCurrent(() => stillCurrent() && value.stillCurrent());
+    };
+    await validate(admins);
+    return {
+        admins,
+        descriptor,
+        directory,
+        stillCurrent,
+        async readGroup(groupId, reference) {
+            assertProjectionVerificationCurrent(stillCurrent);
+            const head = requireOrganizationGroupHead(descriptor, groupId);
+            const selected = reference ?? head;
+            assertReferenceScope(selected, "group", groupId);
+            const result = groupId === descriptor.adminGroupId &&
+                principalHeadMatchesReference(admins.policy.state, selected)
+                ? admins
+                : await resolve(selected);
+            await assertExactCurrent(result, head);
+            assertDirectoryDependency(result, directory);
+            if (groupId !== descriptor.adminGroupId)
+                assertAdminsDependency(result, adminHead);
+            await validate(result);
+            return result;
+        },
+    };
+}
+function assertReferenceScope(reference, principalType, principalId) {
+    if (reference.principalType !== principalType ||
+        reference.principalId !== principalId)
+        throw new KeyingVerificationError("object_mismatch", "Current policy reference is outside its scope");
+}
+async function assertExactCurrent(value, expected) {
+    assertProjectionVerificationCurrent(value.stillCurrent);
+    await assertCurrentMatchesVerifiedPolicy(value);
+    if (!principalHeadMatchesReference(value.policy.state, expected))
+        throw new ProjectionDependencyUnavailableError("Current policy changed from the selected organization directory");
+    assertProjectionVerificationCurrent(value.stillCurrent);
+}
+function assertDirectoryDependency(value, directory) {
+    const dependency = value.dependencies.find((policy) => policy.principalType === "organization" &&
+        policy.principalId === directory.policy.principalId);
+    if (!dependency ||
+        !principalHeadMatchesReference(dependency.state, directory.policy.state))
+        throw new ProjectionDependencyUnavailableError("Current policy belongs to a changed organization directory");
+}
+function assertAdminsDependency(value, expected) {
+    const authority = value.dependencies.find((policy) => policy.principalType === "group" &&
+        policy.principalId === expected.principalId);
+    if (!authority || !principalHeadMatchesReference(authority.state, expected))
+        throw new KeyingVerificationError("missing_dependency", "Current group policy omits its exact Admins dependency");
+}
+//# sourceMappingURL=currentOrganizationAuthority.js.map

package/workflows/organizations/currentOrganizationAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationAuthority.js","sourceRoot":"","sources":["currentOrganizationAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,2DAA2D,CAAC;AAChH,OAAO,EAAE,kCAAkC,EAAE,MAAM,uDAAuD,CAAC;AAC3G,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAoB/D,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAwC;IAExC,IAAI,KAAK,CAAC,qBAAqB;QAC7B,oBAAoB,CAClB,KAAK,CAAC,qBAAqB,EAC3B,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,SAA0C,EAAE,EAAE,CAC7D,KAAK,CAAC,oBAAoB,CAAC;QACzB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,kBAAkB,EAAE,IAAI;QACxB,aAAa;QACb,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC7D,MAAM,kBAAkB,CACtB,SAAS,EACT,KAAK,CAAC,qBAAqB,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CACtD,CAAC;IACF,MAAM,UAAU,GAAG,oCAAoC,CACrD,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAC5C,CAAC;IACF,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,MAAM,SAAS,GAAG,4BAA4B,CAC5C,UAAU,EACV,UAAU,CAAC,YAAY,CACxB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAqC,EAAE,EAAE;QAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,mCAAmC,CAAC;YACxC,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE;SAC3D,CAAC,CAAC;QACH,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAC7C,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO;QACL,MAAM;QACN,UAAU;QACV,SAAS;QACT,YAAY;QACZ,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAmC;YAClE,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,SAAS,IAAI,IAAI,CAAC;YACnC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,MAAM,GACV,OAAO,KAAK,UAAU,CAAC,YAAY;gBACnC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAC1D,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvC,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,UAAU,CAAC,YAAY;gBACrC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAAkC,EAClC,aAAuD,EACvD,WAAmB;IAEnB,IACE,SAAS,CAAC,aAAa,KAAK,aAAa;QACzC,SAAS,CAAC,WAAW,KAAK,WAAW;QAErC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAqC,EACrC,QAAiC;IAEjC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC9D,MAAM,IAAI,oCAAoC,CAC5C,iEAAiE,CAClE,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAqC,EACrC,SAAyC;IAEzC,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CACxC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,cAAc;QACvC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,MAAM,CAAC,WAAW,CACtD,CAAC;IACF,IACE,CAAC,UAAU;QACX,CAAC,6BAA6B,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;QAExE,MAAM,IAAI,oCAAoC,CAC5C,4DAA4D,CAC7D,CAAC;AACN,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAqC,EACrC,QAAiC;IAEjC,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CACvC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,OAAO;QAChC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9C,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;QACzE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,wDAAwD,CACzD,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { validateKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"../../data/persistence/verifiedPrincipalPolicyCurrent\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type {\n  createRuntimePrincipalPolicyCurrentResolver,\n  ResolvedPrincipalPolicyCurrent,\n} from \"../principals/runtimePolicyRecovery\";\n\ntype CurrentPolicyResolver = NonNullable<\n  ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>\n>;\n\ninterface CurrentOrganizationAuthorityInput {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly organizationReference?: ReferencedPrincipalHead | null | undefined;\n  readonly resolveCurrentPolicy: CurrentPolicyResolver;\n  readonly recoveryBatch?: object | undefined;\n  readonly stillCurrent: () => boolean;\n}\n\n/** One directory view with bounded, authenticated current artifacts for its groups. */\nexport async function loadCurrentOrganizationAuthority(\n  input: CurrentOrganizationAuthorityInput,\n) {\n  if (input.organizationReference)\n    assertReferenceScope(\n      input.organizationReference,\n      \"organization\",\n      input.organizationId,\n    );\n  const recoveryBatch = input.recoveryBatch ?? {};\n  const resolve = (reference?: ReferencedPrincipalHead | null) =>\n    input.resolveCurrentPolicy({\n      organizationId: input.organizationId,\n      reference: reference ?? undefined,\n      preferLocalCurrent: true,\n      recoveryBatch,\n      stillCurrent: input.stillCurrent,\n    });\n  const directory = await resolve(input.organizationReference);\n  await assertExactCurrent(\n    directory,\n    input.organizationReference ?? directory.policy.state,\n  );\n  const descriptor = parseOrganizationAuthorityDescriptor(\n    directory.current.currentPayload.ciphertext,\n  );\n  if (descriptor.organizationId !== input.organizationId)\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Organization current policy payload is outside its scope\",\n    );\n  const adminHead = requireOrganizationGroupHead(\n    descriptor,\n    descriptor.adminGroupId,\n  );\n  const admins = await resolve(adminHead);\n  await assertExactCurrent(admins, adminHead);\n  assertDirectoryDependency(admins, directory);\n  const stillCurrent = () =>\n    input.stillCurrent() && directory.stillCurrent() && admins.stillCurrent();\n  const validate = async (value: ResolvedPrincipalPolicyCurrent) => {\n    assertProjectionVerificationCurrent(stillCurrent);\n    await validateKeyingCheckpointsAtomically({\n      access: [],\n      execSql: input.execSql,\n      policies: [...value.dependencies, value.policy],\n      stillCurrent: () => stillCurrent() && value.stillCurrent(),\n    });\n    assertProjectionVerificationCurrent(\n      () => stillCurrent() && value.stillCurrent(),\n    );\n  };\n  await validate(admins);\n  return {\n    admins,\n    descriptor,\n    directory,\n    stillCurrent,\n    async readGroup(groupId: string, reference?: ReferencedPrincipalHead) {\n      assertProjectionVerificationCurrent(stillCurrent);\n      const head = requireOrganizationGroupHead(descriptor, groupId);\n      const selected = reference ?? head;\n      assertReferenceScope(selected, \"group\", groupId);\n      const result =\n        groupId === descriptor.adminGroupId &&\n        principalHeadMatchesReference(admins.policy.state, selected)\n          ? admins\n          : await resolve(selected);\n      await assertExactCurrent(result, head);\n      assertDirectoryDependency(result, directory);\n      if (groupId !== descriptor.adminGroupId)\n        assertAdminsDependency(result, adminHead);\n      await validate(result);\n      return result;\n    },\n  };\n}\n\nfunction assertReferenceScope(\n  reference: ReferencedPrincipalHead,\n  principalType: ReferencedPrincipalHead[\"principalType\"],\n  principalId: string,\n) {\n  if (\n    reference.principalType !== principalType ||\n    reference.principalId !== principalId\n  )\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Current policy reference is outside its scope\",\n    );\n}\n\nasync function assertExactCurrent(\n  value: ResolvedPrincipalPolicyCurrent,\n  expected: ReferencedPrincipalHead,\n) {\n  assertProjectionVerificationCurrent(value.stillCurrent);\n  await assertCurrentMatchesVerifiedPolicy(value);\n  if (!principalHeadMatchesReference(value.policy.state, expected))\n    throw new ProjectionDependencyUnavailableError(\n      \"Current policy changed from the selected organization directory\",\n    );\n  assertProjectionVerificationCurrent(value.stillCurrent);\n}\n\nfunction assertDirectoryDependency(\n  value: ResolvedPrincipalPolicyCurrent,\n  directory: ResolvedPrincipalPolicyCurrent,\n) {\n  const dependency = value.dependencies.find(\n    (policy) =>\n      policy.principalType === \"organization\" &&\n      policy.principalId === directory.policy.principalId,\n  );\n  if (\n    !dependency ||\n    !principalHeadMatchesReference(dependency.state, directory.policy.state)\n  )\n    throw new ProjectionDependencyUnavailableError(\n      \"Current policy belongs to a changed organization directory\",\n    );\n}\n\nfunction assertAdminsDependency(\n  value: ResolvedPrincipalPolicyCurrent,\n  expected: ReferencedPrincipalHead,\n) {\n  const authority = value.dependencies.find(\n    (policy) =>\n      policy.principalType === \"group\" &&\n      policy.principalId === expected.principalId,\n  );\n  if (!authority || !principalHeadMatchesReference(authority.state, expected))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Current group policy omits its exact Admins dependency\",\n    );\n}\n"]}

package/workflows/organizations/currentOrganizationGroupNames.js

@@ -0,0 +1,72 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { saveOrganizationGroupDisplayNames } from "../../data/persistence/organizations/organizationGroupNamePersistence.js";
+import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
+import { GroupMetadataUnreadableError } from "./groupMetadataAccess.js";
+import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
+import { readGroupPolicyPayloadName, } from "./principalPolicyRequest.js";
+/** Names consume verified current artifacts; paged recovery retains their separate evidence. */
+export async function hydrateCurrentOrganizationGroupNames(input) {
+    const authority = await loadCurrentOrganizationAuthority(input);
+    const nameInput = {
+        ...input,
+        readEncryptedName: input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,
+    };
+    const names = [];
+    const unreadable = new Set();
+    const lifetimes = [authority.stillCurrent];
+    for (const group of input.directory.groups) {
+        const head = authority.descriptor.groupHeads.find((head) => head.principalId === group.groupId);
+        if (!head || head.stateHash !== group.currentState?.stateHash)
+            throw new Error("Group listing does not match the signed directory");
+        const verified = await authority.readGroup(group.groupId);
+        lifetimes.push(verified.stillCurrent);
+        assertGroupMetadataBinding(verified.current, authority.descriptor);
+        const name = await readCurrentGroupName(nameInput, verified.current);
+        if (name === null)
+            unreadable.add(group.groupId);
+        else
+            names.push({ groupId: group.groupId, name, stateHash: head.stateHash });
+    }
+    const stillCurrent = () => input.stillCurrent() && lifetimes.every((current) => current());
+    assertProjectionVerificationCurrent(stillCurrent);
+    // Match the authority admission performed by the full-bundle path. Group
+    // name reads alone do not move group checkpoints.
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policies: [authority.directory.policy, authority.admins.policy],
+        stillCurrent,
+    });
+    await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));
+    return {
+        ...input.directory,
+        groups: input.directory.groups.map((group) => ({
+            ...group,
+            name: byId.get(group.groupId) ?? "",
+            nameUnreadable: unreadable.has(group.groupId),
+        })),
+    };
+}
+async function readCurrentGroupName(input, current) {
+    try {
+        return await readGroupPolicyPayloadName(current, input.readEncryptedName);
+    }
+    catch (error) {
+        if (!(error instanceof GroupMetadataUnreadableError))
+            throw error;
+        await input.reportSecurityIncident(new KeyingVerificationError("invalid_shape", "Signed group name does not open under the cited metadata key"), {
+            evidenceHashes: { stateHash: current.currentState.stateHash },
+            objectId: current.currentState.principalId,
+            objectKind: "principal",
+            operation: "organization.groupName",
+            organizationId: input.organizationId,
+        });
+        return null;
+    }
+}
+//# sourceMappingURL=currentOrganizationGroupNames.js.map

package/workflows/organizations/currentOrganizationGroupNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationGroupNames.js","sourceRoot":"","sources":["currentOrganizationGroupNames.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAE1H,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAEL,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAclC,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAY;IAEZ,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG;QAChB,GAAG,KAAK;QACR,iBAAiB,EACf,KAAK,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,iBAAiB;KACxE,CAAC;IACF,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAsB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;YAE/C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/D,YAAY;KACb,CAAC,CAAC;IACH,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAY,EACZ,OAA6C;IAE7C,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE;YAC7D,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;YAC1C,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { saveOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\ntype Input = Parameters<typeof loadCurrentOrganizationAuthority>[0] & {\n  readonly directory: OrganizationDirectoryAndGroups;\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly createCurrentNameReader?:\n    | ((\n        authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>,\n      ) => GroupPolicyNameReader)\n    | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n};\n\n/** Names consume verified current artifacts; paged recovery retains their separate evidence. */\nexport async function hydrateCurrentOrganizationGroupNames(\n  input: Input,\n): Promise<OrganizationDirectoryAndGroups> {\n  const authority = await loadCurrentOrganizationAuthority(input);\n  const nameInput = {\n    ...input,\n    readEncryptedName:\n      input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,\n  };\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadable = new Set<string>();\n  const lifetimes: (() => boolean)[] = [authority.stillCurrent];\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await authority.readGroup(group.groupId);\n    lifetimes.push(verified.stillCurrent);\n    assertGroupMetadataBinding(verified.current, authority.descriptor);\n    const name = await readCurrentGroupName(nameInput, verified.current);\n    if (name === null) unreadable.add(group.groupId);\n    else\n      names.push({ groupId: group.groupId, name, stateHash: head.stateHash });\n  }\n  const stillCurrent = () =>\n    input.stillCurrent() && lifetimes.every((current) => current());\n  assertProjectionVerificationCurrent(stillCurrent);\n  // Match the authority admission performed by the full-bundle path. Group\n  // name reads alone do not move group checkpoints.\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [authority.directory.policy, authority.admins.policy],\n    stillCurrent,\n  });\n  await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadable.has(group.groupId),\n    })),\n  };\n}\n\nasync function readCurrentGroupName(\n  input: Input,\n  current: Parameters<GroupPolicyNameReader>[0],\n) {\n  try {\n    return await readGroupPolicyPayloadName(current, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: current.currentState.stateHash },\n        objectId: current.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n"]}

package/workflows/organizations/currentOrganizationMutationAuthority.js

@@ -0,0 +1,16 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { organizationAdminSignerUserIds } from "../../data/principals/principalPolicyAdminSigners.js";
+import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
+/** Resolve uncertain work and verify the signing administrator before any mutation pins. */
+export async function loadCurrentOrganizationMutationAuthority(input) {
+    const owned = { ...input };
+    assertProjectionVerificationCurrent(owned.stillCurrent);
+    await owned.recoverPendingPrincipalMutation(owned.organizationId);
+    assertProjectionVerificationCurrent(owned.stillCurrent);
+    const authority = await loadCurrentOrganizationAuthority(owned);
+    const currentOrgAdminUserIds = organizationAdminSignerUserIds(authority.admins.policy);
+    if (!currentOrgAdminUserIds.includes(owned.signerUserId))
+        throw new Error("Organization admin authority is required");
+    return { authority, currentOrgAdminUserIds };
+}
+//# sourceMappingURL=currentOrganizationMutationAuthority.js.map

package/workflows/organizations/currentOrganizationMutationAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationMutationAuthority.js","sourceRoot":"","sources":["currentOrganizationMutationAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAQC;IAED,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3B,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,+BAA+B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,sBAAsB,GAAG,8BAA8B,CAC3D,SAAS,CAAC,MAAM,CAAC,MAAM,CACxB,CAAC;IACF,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { organizationAdminSignerUserIds } from \"../../data/principals/principalPolicyAdminSigners\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\n\n/** Resolve uncertain work and verify the signing administrator before any mutation pins. */\nexport async function loadCurrentOrganizationMutationAuthority(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  > & {\n    readonly signerUserId: string;\n    readonly recoverPendingPrincipalMutation: (\n      organizationId: string,\n    ) => Promise<void>;\n  },\n) {\n  const owned = { ...input };\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  await owned.recoverPendingPrincipalMutation(owned.organizationId);\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  const authority = await loadCurrentOrganizationAuthority(owned);\n  const currentOrgAdminUserIds = organizationAdminSignerUserIds(\n    authority.admins.policy,\n  );\n  if (!currentOrgAdminUserIds.includes(owned.signerUserId))\n    throw new Error(\"Organization admin authority is required\");\n  return { authority, currentOrgAdminUserIds };\n}\n"]}

package/workflows/organizations/currentOrganizationMutationRetention.js

@@ -0,0 +1,53 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { scopedGroupHistoryProtection } from "../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+/** Couple directory acknowledgements to any newly created group under the same lease. */
+export function createCurrentOrganizationMutationRetention(input) {
+    const retain = async (entries) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        await retainAcknowledgedPrincipalCurrents({
+            execSql: input.runtime.infra.execSql,
+            organizationId: input.organizationId,
+            entries,
+            stillCurrent: input.stillCurrent,
+        });
+    };
+    return {
+        retainDirectory: (request, response) => retain([{ request, response, recovery: input.directoryRecovery }]),
+        retainCreatedGroup: (receipt) => {
+            const adminHead = {
+                ...principalPolicyReferenceFromBundle(input.authority.admins.current),
+                principalType: "group",
+            };
+            return retain([
+                {
+                    initialGroup: true,
+                    request: receipt.request,
+                    response: receipt.response,
+                    recovery: {
+                        apiClient: { getPrincipalPolicyPages: input.readPages },
+                        expectedHead: principalPolicyReferenceFromBundle(receipt.response),
+                        protection: scopedGroupHistoryProtection(input.protection, input.organizationId, input.authority.descriptor.adminGroupId),
+                        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                        loadExternalAuthority: async () => ({
+                            currentHead: adminHead,
+                            states: [
+                                {
+                                    head: adminHead,
+                                    projection: input.authority.admins.policy.projection,
+                                },
+                            ],
+                        }),
+                    },
+                },
+                {
+                    request: receipt.organizationRequest,
+                    response: receipt.organizationResponse,
+                    recovery: input.directoryRecovery,
+                },
+            ]);
+        },
+    };
+}
+//# sourceMappingURL=currentOrganizationMutationRetention.js.map

package/workflows/organizations/currentOrganizationMutationRetention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationMutationRetention.js","sourceRoot":"","sources":["currentOrganizationMutationRetention.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGvG,OAAO,EAEL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,yFAAyF;AACzF,MAAM,UAAU,0CAA0C,CAAC,KAU1D;IACC,MAAM,MAAM,GAAG,KAAK,EAClB,OAAqD,EACrD,EAAE;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,eAAe,EAAE,CACf,OAAkC,EAClC,QAAyC,EACzC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACvE,kBAAkB,EAAE,CAAC,OAKpB,EAAE,EAAE;YACH,MAAM,SAAS,GAAG;gBAChB,GAAG,kCAAkC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;gBACrE,aAAa,EAAE,OAAgB;aAChC,CAAC;YACF,OAAO,MAAM,CAAC;gBACZ;oBACE,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE;wBACR,SAAS,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,SAAS,EAAE;wBACvD,YAAY,EAAE,kCAAkC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAClE,UAAU,EAAE,4BAA4B,CACtC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CACxC;wBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;wBAC1C,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;4BAClC,WAAW,EAAE,SAAS;4BACtB,MAAM,EAAE;gCACN;oCACE,IAAI,EAAE,SAAS;oCACf,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;iCACrD;6BACF;yBACF,CAAC;qBACH;iBACF;gBACD;oBACE,OAAO,EAAE,OAAO,CAAC,mBAAmB;oBACpC,QAAQ,EAAE,OAAO,CAAC,oBAAoB;oBACtC,QAAQ,EAAE,KAAK,CAAC,iBAAiB;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { scopedGroupHistoryProtection } from \"../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"../principals/runtimePolicyRecovery\";\nimport type { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport {\n  type AcknowledgedPrincipalCurrentInput,\n  retainAcknowledgedPrincipalCurrents,\n} from \"./retainAcknowledgedPrincipalCurrents\";\n\n/** Couple directory acknowledgements to any newly created group under the same lease. */\nexport function createCurrentOrganizationMutationRetention(input: {\n  readonly runtime: PrincipalPolicyRecoveryRuntime;\n  readonly authority: Awaited<\n    ReturnType<typeof loadCurrentOrganizationAuthority>\n  >;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly readPages: ApiClient[\"getPrincipalPolicyPages\"];\n  readonly organizationId: string;\n  readonly directoryRecovery: AcknowledgedPrincipalCurrentInput[\"recovery\"];\n  readonly stillCurrent: () => boolean;\n}) {\n  const retain = async (\n    entries: readonly AcknowledgedPrincipalCurrentInput[],\n  ) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    await retainAcknowledgedPrincipalCurrents({\n      execSql: input.runtime.infra.execSql,\n      organizationId: input.organizationId,\n      entries,\n      stillCurrent: input.stillCurrent,\n    });\n  };\n  return {\n    retainDirectory: (\n      request: PutPrincipalPolicyRequest,\n      response: PrincipalPolicyMutationResponse,\n    ) => retain([{ request, response, recovery: input.directoryRecovery }]),\n    retainCreatedGroup: (receipt: {\n      readonly request: PutPrincipalPolicyRequest;\n      readonly response: PrincipalPolicyMutationResponse;\n      readonly organizationRequest: PutPrincipalPolicyRequest;\n      readonly organizationResponse: PrincipalPolicyMutationResponse;\n    }) => {\n      const adminHead = {\n        ...principalPolicyReferenceFromBundle(input.authority.admins.current),\n        principalType: \"group\" as const,\n      };\n      return retain([\n        {\n          initialGroup: true,\n          request: receipt.request,\n          response: receipt.response,\n          recovery: {\n            apiClient: { getPrincipalPolicyPages: input.readPages },\n            expectedHead: principalPolicyReferenceFromBundle(receipt.response),\n            protection: scopedGroupHistoryProtection(\n              input.protection,\n              input.organizationId,\n              input.authority.descriptor.adminGroupId,\n            ),\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n            loadExternalAuthority: async () => ({\n              currentHead: adminHead,\n              states: [\n                {\n                  head: adminHead,\n                  projection: input.authority.admins.policy.projection,\n                },\n              ],\n            }),\n          },\n        },\n        {\n          request: receipt.organizationRequest,\n          response: receipt.organizationResponse,\n          recovery: input.directoryRecovery,\n        },\n      ]);\n    },\n  };\n}\n"]}

package/workflows/organizations/currentPolicyMutationAcknowledgement.js

@@ -0,0 +1,65 @@
+import { verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrentSuccessor, } from "../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../data/keyingCanonicalJson.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { assertPrincipalPolicyCurrentStateMatchesHead } from "./groupPolicyMutationHead.js";
+/** Verify a single authored successor; this neither admits it nor persists a pin. */
+export async function verifyCurrentPolicyMutation(input, acknowledgedState) {
+    const previous = input.verifiedCurrentPolicy;
+    const stillCurrent = input.stillCurrent;
+    const owned = structuredClone({
+        expectedHead: input.expectedHead,
+        request: input.request,
+        signerPublicKeys: input.signerPublicKeys,
+        externalAuthority: input.externalAuthority,
+        localPolicyCheckpoint: input.localPolicyCheckpoint,
+        acknowledgedState,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const { request, expectedHead } = owned;
+    const state = owned.acknowledgedState ?? {
+        ...request.state,
+        stateHash: expectedHead.stateHash,
+        createdAt: request.state.signedAt,
+    };
+    if (owned.acknowledgedState) {
+        const { createdAt: _createdAt, stateHash, ...responseState } = state;
+        if (stateHash !== expectedHead.stateHash ||
+            canonicalKeyingJsonString(responseState, "stored group policy state") !==
+                canonicalKeyingJsonString(request.state, "authored group policy state"))
+            throw new Error("Group policy state acknowledgement mismatch");
+    }
+    const verified = await verifyPrincipalPolicyCurrentSuccessor({
+        previous,
+        signerPublicKeys: owned.signerPublicKeys,
+        externalAuthority: owned.externalAuthority,
+        current: {
+            currentState: state,
+            currentProjection: request.projection,
+            currentGrants: request.grants,
+            currentPayload: {
+                ...request.encryptedPayload,
+                principalId: state.principalId,
+                principalType: state.principalType,
+                stateHash: state.stateHash,
+            },
+            currentMemberEnvelopes: {
+                envelopes: request.memberEnvelopes,
+                principalId: state.principalId,
+                principalType: state.principalType,
+                stateHash: state.stateHash,
+                epoch: state.keyEpoch,
+            },
+        },
+    });
+    if (!verified.ok)
+        throw verified.error;
+    assertPrincipalPolicyCurrentStateMatchesHead(verified.value.state, expectedHead);
+    verifyPrincipalPolicyCheckpoint({
+        chain: verified.value.retainedHistory,
+        currentState: verified.value.state,
+        localCheckpoint: owned.localPolicyCheckpoint,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    return verified.value;
+}
+//# sourceMappingURL=currentPolicyMutationAcknowledgement.js.map

package/workflows/organizations/currentPolicyMutationAcknowledgement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentPolicyMutationAcknowledgement.js","sourceRoot":"","sources":["currentPolicyMutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,4CAA4C,EAAE,MAAM,2BAA2B,CAAC;AAazF,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAiC,EACjC,iBAA0C;IAE1C,MAAM,QAAQ,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,iBAAiB;KAClB,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,IAAI;QACvC,GAAG,OAAO,CAAC,KAAK;QAChB,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;KAClC,CAAC;IACF,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC;QACrE,IACE,SAAS,KAAK,YAAY,CAAC,SAAS;YACpC,yBAAyB,CAAC,aAAa,EAAE,2BAA2B,CAAC;gBACnE,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,6BAA6B,CAAC;YAEzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAAC;QAC3D,QAAQ;QACR,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE;YACP,YAAY,EAAE,KAAK;YACnB,iBAAiB,EAAE,OAAO,CAAC,UAAU;YACrC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,cAAc,EAAE;gBACd,GAAG,OAAO,CAAC,gBAAgB;gBAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;YACD,sBAAsB,EAAE;gBACtB,SAAS,EAAE,OAAO,CAAC,eAAe;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,QAAQ;aACtB;SACF;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,4CAA4C,CAC1C,QAAQ,CAAC,KAAK,CAAC,KAAK,EACpB,YAAY,CACb,CAAC;IACF,+BAA+B,CAAC;QAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;QACrC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;QAClC,eAAe,EAAE,KAAK,CAAC,qBAAqB;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC","sourcesContent":["import {\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrentSuccessor,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../data/keyingCanonicalJson\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { assertPrincipalPolicyCurrentStateMatchesHead } from \"./groupPolicyMutationHead\";\n\nexport interface CurrentPolicyMutationInput {\n  readonly currentPolicy?: never;\n  readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly stillCurrent: () => boolean;\n}\n\n/** Verify a single authored successor; this neither admits it nor persists a pin. */\nexport async function verifyCurrentPolicyMutation(\n  input: CurrentPolicyMutationInput,\n  acknowledgedState?: PrincipalStateResponse,\n): Promise<VerifiedPrincipalPolicyCurrent> {\n  const previous = input.verifiedCurrentPolicy;\n  const stillCurrent = input.stillCurrent;\n  const owned = structuredClone({\n    expectedHead: input.expectedHead,\n    request: input.request,\n    signerPublicKeys: input.signerPublicKeys,\n    externalAuthority: input.externalAuthority,\n    localPolicyCheckpoint: input.localPolicyCheckpoint,\n    acknowledgedState,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const { request, expectedHead } = owned;\n  const state = owned.acknowledgedState ?? {\n    ...request.state,\n    stateHash: expectedHead.stateHash,\n    createdAt: request.state.signedAt,\n  };\n  if (owned.acknowledgedState) {\n    const { createdAt: _createdAt, stateHash, ...responseState } = state;\n    if (\n      stateHash !== expectedHead.stateHash ||\n      canonicalKeyingJsonString(responseState, \"stored group policy state\") !==\n        canonicalKeyingJsonString(request.state, \"authored group policy state\")\n    )\n      throw new Error(\"Group policy state acknowledgement mismatch\");\n  }\n  const verified = await verifyPrincipalPolicyCurrentSuccessor({\n    previous,\n    signerPublicKeys: owned.signerPublicKeys,\n    externalAuthority: owned.externalAuthority,\n    current: {\n      currentState: state,\n      currentProjection: request.projection,\n      currentGrants: request.grants,\n      currentPayload: {\n        ...request.encryptedPayload,\n        principalId: state.principalId,\n        principalType: state.principalType,\n        stateHash: state.stateHash,\n      },\n      currentMemberEnvelopes: {\n        envelopes: request.memberEnvelopes,\n        principalId: state.principalId,\n        principalType: state.principalType,\n        stateHash: state.stateHash,\n        epoch: state.keyEpoch,\n      },\n    },\n  });\n  if (!verified.ok) throw verified.error;\n  assertPrincipalPolicyCurrentStateMatchesHead(\n    verified.value.state,\n    expectedHead,\n  );\n  verifyPrincipalPolicyCheckpoint({\n    chain: verified.value.retainedHistory,\n    currentState: verified.value.state,\n    localCheckpoint: owned.localPolicyCheckpoint,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return verified.value;\n}\n"]}