@tearleads/client-sdk 0.1.16 → 0.1.17

package/workflows/organizations/commitCurrentGroupPolicyMutation.js

@@ -0,0 +1,72 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { prepareAuthoredGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
+import { submitGroupPolicyCommit, } from "./groupPolicyMutationContext.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+/** Commit and retain one exact compound successor without rebuilding full history. */
+export async function commitCurrentGroupPolicyMutation(input) {
+    const { context } = input;
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const [signer] = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: [input.signerUserId],
+    });
+    if (!signer)
+        throw new Error("Group policy signer is unavailable");
+    const expectedHead = await groupPolicyMutationHead(input.request);
+    const nextPolicy = await prepareAuthoredGroupPolicy({
+        verifiedCurrentPolicy: context.verifiedCurrentPolicy,
+        expectedHead,
+        request: input.request,
+        signerPublicKeys: [signer],
+        externalAuthority: context.externalAuthority,
+        localPolicyCheckpoint: context.localPolicyCheckpoint,
+        stillCurrent: context.stillCurrent,
+    });
+    const prepared = await input.prepareContainerMutations(nextPolicy);
+    input.request.containerMutations = [...prepared.requests];
+    const adminProjection = context.isOrganizationAdminsGroup
+        ? input.request.projection
+        : context.adminCurrent.current.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(adminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection,
+        adminUsers,
+        currentPolicy: context.organizationCurrent.current,
+        descriptor: context.organizationDescriptor,
+        groupHeads: replaceOrganizationGroupHead({
+            descriptor: context.organizationDescriptor,
+            nextHead: expectedHead,
+        }),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const response = await submitGroupPolicyCommit({
+        apiClient: input.apiClient,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        request: input.request,
+        organizationRequest,
+        carryDescendantRekeys: prepared.carry,
+        stillCurrent: context.stillCurrent,
+    });
+    if (!response)
+        throw new Error("Group policy update failed");
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    await context.retainAcknowledged({
+        request: input.request,
+        organizationRequest,
+        response,
+        retiredContainerIds: prepared.retiredContainerIds,
+    });
+    await prepared.acknowledge(response.groupPolicy.containerMutations, context.stillCurrent);
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    return response.groupPolicy;
+}
+//# sourceMappingURL=commitCurrentGroupPolicyMutation.js.map

package/workflows/organizations/commitCurrentGroupPolicyMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitCurrentGroupPolicyMutation.js","sourceRoot":"","sources":["commitCurrentGroupPolicyMutation.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAatD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,6BAA6B,CAAC;QACnD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC;QAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACnE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB;QACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,mBAAmB,CAAC,OAAO;QAClD,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,sBAAsB;YAC1C,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,qBAAqB,EAAE,QAAQ,CAAC,KAAK;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,QAAQ;QACR,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,WAAW,CACxB,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EACvC,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC","sourcesContent":["import type {\n  SigningKeyPair,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  type PrincipalPolicyReadWriteApi,\n  submitGroupPolicyCommit,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport type { PreparedPrincipalContainerRematerializationBatch } from \"./principalContainerRematerialization\";\nimport type { RuntimeCurrentGroupMutationContext } from \"./runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\n/** Commit and retain one exact compound successor without rebuilding full history. */\nexport async function commitCurrentGroupPolicyMutation(input: {\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly context: RuntimeCurrentGroupMutationContext;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly prepareContainerMutations: (\n    nextPolicy: VerifiedPrincipalPolicyCurrent,\n  ) => Promise<PreparedPrincipalContainerRematerializationBatch>;\n}): Promise<PrincipalPolicyMutationResponse> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const [signer] = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [input.signerUserId],\n  });\n  if (!signer) throw new Error(\"Group policy signer is unavailable\");\n  const expectedHead = await groupPolicyMutationHead(input.request);\n  const nextPolicy = await prepareAuthoredGroupPolicy({\n    verifiedCurrentPolicy: context.verifiedCurrentPolicy,\n    expectedHead,\n    request: input.request,\n    signerPublicKeys: [signer],\n    externalAuthority: context.externalAuthority,\n    localPolicyCheckpoint: context.localPolicyCheckpoint,\n    stillCurrent: context.stillCurrent,\n  });\n  const prepared = await input.prepareContainerMutations(nextPolicy);\n  input.request.containerMutations = [...prepared.requests];\n  const adminProjection = context.isOrganizationAdminsGroup\n    ? input.request.projection\n    : context.adminCurrent.current.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: context.organizationCurrent.current,\n      descriptor: context.organizationDescriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: context.organizationDescriptor,\n        nextHead: expectedHead,\n      }),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const response = await submitGroupPolicyCommit({\n    apiClient: input.apiClient,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    request: input.request,\n    organizationRequest,\n    carryDescendantRekeys: prepared.carry,\n    stillCurrent: context.stillCurrent,\n  });\n  if (!response) throw new Error(\"Group policy update failed\");\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  await context.retainAcknowledged({\n    request: input.request,\n    organizationRequest,\n    response,\n    retiredContainerIds: prepared.retiredContainerIds,\n  });\n  await prepared.acknowledge(\n    response.groupPolicy.containerMutations,\n    context.stillCurrent,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return response.groupPolicy;\n}\n"]}

package/workflows/organizations/createCurrentOrganizationGroup.js

@@ -0,0 +1,85 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
+import { readDirectoryGroupName } from "./groupNameUniqueness.js";
+import { acknowledgeInitialGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+import { buildInitialGroupPolicyRequest, canonicalGroupNameKey, } from "./principalPolicyRequest.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+/** Create from bounded current evidence and publish its genuine genesis with the directory. */
+export async function createCurrentOrganizationGroup(input) {
+    const { context } = input;
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const nameKey = canonicalGroupNameKey(input.name);
+    // Each current recovery is queued by organization. Retain verified heads one
+    // at a time so the walk stays bounded without collecting full group histories.
+    for (const head of context.descriptor.groupHeads) {
+        const group = await context.readGroup(head.principalId);
+        const stillCurrent = () => context.stillCurrent() && group.stillCurrent();
+        assertProjectionVerificationCurrent(stillCurrent);
+        assertGroupMetadataBinding(group.current, context.descriptor);
+        const name = await readDirectoryGroupName({ ...input, readEncryptedName: input.metadataAccess.readName }, group.current);
+        // Remember independently verified heads even if uniqueness or dispatch
+        // later fails; these are observed policies, never speculative successors.
+        await advanceKeyingCheckpointsAtomically({
+            execSql: input.execSql,
+            organizationId: input.organizationId,
+            access: [],
+            policies: [...group.dependencies, group.policy],
+            stillCurrent,
+        });
+        if (name !== null && canonicalGroupNameKey(name) === nameKey)
+            throw new Error("Another signed group in this organization already carries this name");
+    }
+    const request = await buildInitialGroupPolicyRequest({
+        ...input,
+        groupId: crypto.randomUUID(),
+        includeSignerAsAdmin: false,
+        externalAuthority: {
+            ...principalPolicyReferenceFromBundle(context.admins.current),
+            principalType: "group",
+        },
+        metadataKey: await input.metadataAccess.loadEncryptionKey(),
+    });
+    const head = await groupPolicyMutationHead(request.initialGroupPolicy);
+    const adminProjection = context.admins.policy.projection;
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        ...input,
+        currentPolicy: context.directory.current,
+        descriptor: context.descriptor,
+        groupHeads: replaceOrganizationGroupHead({
+            descriptor: context.descriptor,
+            nextHead: head,
+        }),
+        adminProjection,
+        adminUsers: await resolveRequiredUserIdentities({
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+            userIds: projectionUserIds(adminProjection),
+        }),
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const stored = await input.apiClient.createOrganizationGroup(input.organizationId, { ...request, organizationPolicy: organizationRequest });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    if (!stored)
+        throw new Error("Group could not be created");
+    // Genesis really has one signed state. Reconstruct only the exact authored
+    // artifacts whose commitments match the summary, then verify them privately.
+    const { bundle } = await acknowledgeInitialGroupPolicy({
+        organizationId: input.organizationId,
+        request,
+        response: stored.group,
+        stateHash: head.stateHash,
+    });
+    const { previousStates: _previousStates, ...current } = bundle;
+    await context.retainCreatedGroup({
+        request: request.initialGroupPolicy,
+        response: { ...current, containerMutations: [] },
+        organizationRequest,
+        organizationResponse: stored.organizationPolicy,
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    return { ...stored.group, name: input.name.trim(), nameUnreadable: false };
+}
+//# sourceMappingURL=createCurrentOrganizationGroup.js.map

package/workflows/organizations/createCurrentOrganizationGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCurrentOrganizationGroup.js","sourceRoot":"","sources":["createCurrentOrganizationGroup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAKvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAErF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAgBpD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACvC,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,EAC9D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/C,YAAY;SACb,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,OAAO;YAC1D,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,iBAAiB,EAAE;YACjB,GAAG,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7D,aAAa,EAAE,OAAO;SACvB;QACD,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACzD,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,GAAG,KAAK;QACR,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,eAAe;QACf,UAAU,EAAE,MAAM,6BAA6B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;SAC5C,CAAC;KACH,CAAC,CAAC;IACL,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CACxD,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;IAC/D,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,kBAAkB;QACnC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAChD,mBAAmB;QACnB,oBAAoB,EAAE,MAAM,CAAC,kBAAkB;KAChD,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { createGroupMetadataAccess } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport { readDirectoryGroupName } from \"./groupNameUniqueness\";\nimport { acknowledgeInitialGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport {\n  buildInitialGroupPolicyRequest,\n  canonicalGroupNameKey,\n} from \"./principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"./readModel\";\nimport type { CurrentOrganizationMutationContext } from \"./runtimeCurrentOrganizationMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\n/** Create from bounded current evidence and publish its genuine genesis with the directory. */\nexport async function createCurrentOrganizationGroup(input: {\n  readonly apiClient: Pick<\n    OrganizationPrincipalPolicyApi,\n    \"createOrganizationGroup\"\n  >;\n  readonly context: CurrentOrganizationMutationContext;\n  readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n  readonly execSql: ExecSql;\n  readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n  readonly name: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<OrganizationGroupSummary> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const nameKey = canonicalGroupNameKey(input.name);\n  // Each current recovery is queued by organization. Retain verified heads one\n  // at a time so the walk stays bounded without collecting full group histories.\n  for (const head of context.descriptor.groupHeads) {\n    const group = await context.readGroup(head.principalId);\n    const stillCurrent = () => context.stillCurrent() && group.stillCurrent();\n    assertProjectionVerificationCurrent(stillCurrent);\n    assertGroupMetadataBinding(group.current, context.descriptor);\n    const name = await readDirectoryGroupName(\n      { ...input, readEncryptedName: input.metadataAccess.readName },\n      group.current,\n    );\n    // Remember independently verified heads even if uniqueness or dispatch\n    // later fails; these are observed policies, never speculative successors.\n    await advanceKeyingCheckpointsAtomically({\n      execSql: input.execSql,\n      organizationId: input.organizationId,\n      access: [],\n      policies: [...group.dependencies, group.policy],\n      stillCurrent,\n    });\n    if (name !== null && canonicalGroupNameKey(name) === nameKey)\n      throw new Error(\n        \"Another signed group in this organization already carries this name\",\n      );\n  }\n  const request = await buildInitialGroupPolicyRequest({\n    ...input,\n    groupId: crypto.randomUUID(),\n    includeSignerAsAdmin: false,\n    externalAuthority: {\n      ...principalPolicyReferenceFromBundle(context.admins.current),\n      principalType: \"group\",\n    },\n    metadataKey: await input.metadataAccess.loadEncryptionKey(),\n  });\n  const head = await groupPolicyMutationHead(request.initialGroupPolicy);\n  const adminProjection = context.admins.policy.projection;\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      ...input,\n      currentPolicy: context.directory.current,\n      descriptor: context.descriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: context.descriptor,\n        nextHead: head,\n      }),\n      adminProjection,\n      adminUsers: await resolveRequiredUserIdentities({\n        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n        userIds: projectionUserIds(adminProjection),\n      }),\n    });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const stored = await input.apiClient.createOrganizationGroup(\n    input.organizationId,\n    { ...request, organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  if (!stored) throw new Error(\"Group could not be created\");\n  // Genesis really has one signed state. Reconstruct only the exact authored\n  // artifacts whose commitments match the summary, then verify them privately.\n  const { bundle } = await acknowledgeInitialGroupPolicy({\n    organizationId: input.organizationId,\n    request,\n    response: stored.group,\n    stateHash: head.stateHash,\n  });\n  const { previousStates: _previousStates, ...current } = bundle;\n  await context.retainCreatedGroup({\n    request: request.initialGroupPolicy,\n    response: { ...current, containerMutations: [] },\n    organizationRequest,\n    organizationResponse: stored.organizationPolicy,\n  });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return { ...stored.group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}

package/workflows/organizations/currentGroupMetadataAuthority.js

@@ -1,4 +1,7 @@
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
 import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
 import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
 /** Authenticate metadata-root grants with current policies and only its cited predecessors. */
@@ -9,6 +12,26 @@ export function createCurrentGroupMetadataContainerVerifier(input) {
             ...input,
             organizationReference,
         });
+        await createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent: input.stillCurrent,
+        })(state, organizationReference);
+    };
+}
+/** Reuse one mutation's verified authority without broadening its lease or scope. */
+export function createSelectedCurrentGroupMetadataContainerVerifier(input) {
+    return async (state, organizationReference) => {
+        const { authority } = input;
+        const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();
+        assertProjectionVerificationCurrent(stillCurrent);
+        if (organizationReference) {
+            if (organizationReference.principalType !== "organization" ||
+                organizationReference.principalId !== input.organizationId)
+                throw new KeyingVerificationError("object_mismatch", "Current policy reference is outside its scope");
+            if (!principalHeadMatchesReference(authority.directory.policy.state, organizationReference))
+                throw new ProjectionDependencyUnavailableError("Metadata root belongs to a changed organization directory");
+        }
         const { adminGroupId, memberGroupId } = authority.descriptor;
         const citation = (groupId) => state.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === groupId);
         const admins = await authority.readGroup(adminGroupId, citation(adminGroupId));
@@ -24,9 +47,7 @@ export function createCurrentGroupMetadataContainerVerifier(input) {
             members,
             state,
         });
-        assertProjectionVerificationCurrent(() => authority.stillCurrent() &&
-            admins.stillCurrent() &&
-            members.stillCurrent());
+        assertProjectionVerificationCurrent(() => stillCurrent() && admins.stillCurrent() && members.stillCurrent());
     };
 }
 //# sourceMappingURL=currentGroupMetadataAuthority.js.map

package/workflows/organizations/currentGroupMetadataAuthority.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentGroupMetadataAuthority.js","sourceRoot":"","sources":["currentGroupMetadataAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,+FAA+F;AAC/F,MAAM,UAAU,2CAA2C,CACzD,KAGC;IAED,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;YACvD,GAAG,KAAK;YACR,qBAAqB;SACtB,CAAC,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACjE,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CACtC,YAAY,EACZ,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CACvC,aAAa,EACb,QAAQ,CAAC,aAAa,CAAC,CACxB,CAAC;QACF,yBAAyB,CAAC;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE;gBACT,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,YAAY;gBACZ,aAAa;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;YACD,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CACjC,GAAG,EAAE,CACH,SAAS,CAAC,YAAY,EAAE;YACxB,MAAM,CAAC,YAAY,EAAE;YACrB,OAAO,CAAC,YAAY,EAAE,CACzB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\n/** Authenticate metadata-root grants with current policies and only its cited predecessors. */\nexport function createCurrentGroupMetadataContainerVerifier(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  >,\n) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const authority = await loadCurrentOrganizationAuthority({\n      ...input,\n      organizationReference,\n    });\n    const { adminGroupId, memberGroupId } = authority.descriptor;\n    const citation = (groupId: string) =>\n      state.referencedPrincipalHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === groupId,\n      );\n    const admins = await authority.readGroup(\n      adminGroupId,\n      citation(adminGroupId),\n    );\n    const members = await authority.readGroup(\n      memberGroupId,\n      citation(memberGroupId),\n    );\n    assertMetadataRootBinding({\n      organizationId: input.organizationId,\n      authority: {\n        descriptor: authority.descriptor,\n        adminGroupId,\n        memberGroupId,\n        adminPolicy: admins.policy,\n      },\n      members,\n      state,\n    });\n    assertProjectionVerificationCurrent(\n      () =>\n        authority.stillCurrent() &&\n        admins.stillCurrent() &&\n        members.stillCurrent(),\n    );\n  };\n}\n"]}
+{"version":3,"file":"currentGroupMetadataAuthority.js","sourceRoot":"","sources":["currentGroupMetadataAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,+FAA+F;AAC/F,MAAM,UAAU,2CAA2C,CACzD,KAGC;IAED,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;YACvD,GAAG,KAAK;YACR,qBAAqB;SACtB,CAAC,CAAC;QACH,MAAM,mDAAmD,CAAC;YACxD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mDAAmD,CAAC,KAMnE;IACC,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAC5B,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IACE,qBAAqB,CAAC,aAAa,KAAK,cAAc;gBACtD,qBAAqB,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;gBAE1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;YACJ,IACE,CAAC,6BAA6B,CAC5B,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAChC,qBAAqB,CACtB;gBAED,MAAM,IAAI,oCAAoC,CAC5C,2DAA2D,CAC5D,CAAC;QACN,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACjE,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CACtC,YAAY,EACZ,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CACvC,aAAa,EACb,QAAQ,CAAC,aAAa,CAAC,CACxB,CAAC;QACF,yBAAyB,CAAC;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE;gBACT,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,YAAY;gBACZ,aAAa;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;YACD,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,YAAY,EAAE,CACxE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\n/** Authenticate metadata-root grants with current policies and only its cited predecessors. */\nexport function createCurrentGroupMetadataContainerVerifier(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  >,\n) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const authority = await loadCurrentOrganizationAuthority({\n      ...input,\n      organizationReference,\n    });\n    await createSelectedCurrentGroupMetadataContainerVerifier({\n      authority,\n      organizationId: input.organizationId,\n      stillCurrent: input.stillCurrent,\n    })(state, organizationReference);\n  };\n}\n\n/** Reuse one mutation's verified authority without broadening its lease or scope. */\nexport function createSelectedCurrentGroupMetadataContainerVerifier(input: {\n  readonly authority: Awaited<\n    ReturnType<typeof loadCurrentOrganizationAuthority>\n  >;\n  readonly organizationId: string;\n  readonly stillCurrent: () => boolean;\n}) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    const { authority } = input;\n    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();\n    assertProjectionVerificationCurrent(stillCurrent);\n    if (organizationReference) {\n      if (\n        organizationReference.principalType !== \"organization\" ||\n        organizationReference.principalId !== input.organizationId\n      )\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Current policy reference is outside its scope\",\n        );\n      if (\n        !principalHeadMatchesReference(\n          authority.directory.policy.state,\n          organizationReference,\n        )\n      )\n        throw new ProjectionDependencyUnavailableError(\n          \"Metadata root belongs to a changed organization directory\",\n        );\n    }\n    const { adminGroupId, memberGroupId } = authority.descriptor;\n    const citation = (groupId: string) =>\n      state.referencedPrincipalHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === groupId,\n      );\n    const admins = await authority.readGroup(\n      adminGroupId,\n      citation(adminGroupId),\n    );\n    const members = await authority.readGroup(\n      memberGroupId,\n      citation(memberGroupId),\n    );\n    assertMetadataRootBinding({\n      organizationId: input.organizationId,\n      authority: {\n        descriptor: authority.descriptor,\n        adminGroupId,\n        memberGroupId,\n        adminPolicy: admins.policy,\n      },\n      members,\n      state,\n    });\n    assertProjectionVerificationCurrent(\n      () => stillCurrent() && admins.stillCurrent() && members.stillCurrent(),\n    );\n  };\n}\n"]}

package/workflows/organizations/currentGroupMutationReferences.js

@@ -0,0 +1,35 @@
+import { selectPrincipalPolicyCurrentPredecessorReferences, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+/** Select only this path's old citations, preserving the authored membership. */
+export async function resolveCurrentGroupMutationReferences(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const references = structuredClone(input.references);
+    const select = (current, predecessor, selected) => selectPrincipalPolicyCurrentPredecessorReferences({
+        current,
+        predecessor,
+        references: selected,
+    });
+    // Normalize and bound the entire request before any per-reference I/O.
+    const initial = select(input.current, input.predecessor, references);
+    if (initial.ok)
+        return initial.value;
+    if (initial.error.code !== "missing_dependency")
+        throw initial.error;
+    let current = input.current;
+    const selected = [];
+    for (const reference of references) {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        selected.push(reference);
+        let result = select(current, input.predecessor, selected);
+        if (!result.ok && result.error.code === "missing_dependency") {
+            const predecessor = await input.readPredecessorReference(reference);
+            assertProjectionVerificationCurrent(input.stillCurrent);
+            result = select(current, predecessor, selected);
+        }
+        if (!result.ok)
+            throw result.error;
+        current = result.value;
+    }
+    return current;
+}
+//# sourceMappingURL=currentGroupMutationReferences.js.map

package/workflows/organizations/currentGroupMutationReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupMutationReferences.js","sourceRoot":"","sources":["currentGroupMutationReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iDAAiD,GAElD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CACb,OAAuC,EACvC,WAA2C,EAC3C,QAA4C,EAC5C,EAAE,CACF,iDAAiD,CAAC;QAChD,OAAO;QACP,WAAW;QACX,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;IACL,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrE,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import {\n  type ReferencedPrincipalHead,\n  selectPrincipalPolicyCurrentPredecessorReferences,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\n\n/** Select only this path's old citations, preserving the authored membership. */\nexport async function resolveCurrentGroupMutationReferences(input: {\n  readonly current: VerifiedPrincipalPolicyCurrent;\n  readonly predecessor: VerifiedPrincipalPolicyCurrent;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly readPredecessorReference: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<VerifiedPrincipalPolicyCurrent>;\n  readonly stillCurrent: () => boolean;\n}): Promise<VerifiedPrincipalPolicyCurrent> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const references = structuredClone(input.references);\n  const select = (\n    current: VerifiedPrincipalPolicyCurrent,\n    predecessor: VerifiedPrincipalPolicyCurrent,\n    selected: readonly ReferencedPrincipalHead[],\n  ) =>\n    selectPrincipalPolicyCurrentPredecessorReferences({\n      current,\n      predecessor,\n      references: selected,\n    });\n  // Normalize and bound the entire request before any per-reference I/O.\n  const initial = select(input.current, input.predecessor, references);\n  if (initial.ok) return initial.value;\n  if (initial.error.code !== \"missing_dependency\") throw initial.error;\n  let current = input.current;\n  const selected: ReferencedPrincipalHead[] = [];\n  for (const reference of references) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    selected.push(reference);\n    let result = select(current, input.predecessor, selected);\n    if (!result.ok && result.error.code === \"missing_dependency\") {\n      const predecessor = await input.readPredecessorReference(reference);\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      result = select(current, predecessor, selected);\n    }\n    if (!result.ok) throw result.error;\n    current = result.value;\n  }\n  return current;\n}\n"]}

package/workflows/organizations/currentGroupPolicyMutationContext.js

@@ -0,0 +1,79 @@
+import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { requireOrganizationGroupHead } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
+import { loadCurrentOrganizationMutationAuthority } from "./currentOrganizationMutationAuthority.js";
+import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
+import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
+/** Exact current directory, strict Admins and group evidence for one mutation. */
+export async function loadCurrentGroupPolicyMutationContext(input) {
+    input = { ...input };
+    const { authority, currentOrgAdminUserIds } = await loadCurrentOrganizationMutationAuthority(input);
+    const group = await authority.readGroup(input.groupId);
+    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();
+    assertProjectionVerificationCurrent(stillCurrent);
+    assertGroupMetadataBinding(group.current, authority.descriptor);
+    requireSignerCanManageGroup(group.current, currentOrgAdminUserIds, input.signerUserId);
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policies: [...group.dependencies, group.policy],
+        stillCurrent,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const adminHead = requireOrganizationGroupHead(authority.descriptor, authority.descriptor.adminGroupId);
+    const externalAuthority = {
+        currentHead: adminHead,
+        states: [
+            { head: adminHead, projection: authority.admins.policy.projection },
+        ],
+    };
+    const references = new Map();
+    return {
+        adminGroupId: authority.descriptor.adminGroupId,
+        adminCurrent: authority.admins,
+        currentPolicy: group.current,
+        verifiedCurrentPolicy: group.policy,
+        verifyMetadataContainer: createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent,
+        }),
+        currentOrgAdminUserIds,
+        externalAuthority,
+        isOrganizationAdminsGroup: input.groupId === authority.descriptor.adminGroupId,
+        localPolicyCheckpoint: group.policy.checkpoint,
+        memberGroupId: authority.descriptor.memberGroupId,
+        organizationDescriptor: authority.descriptor,
+        organizationCurrent: authority.directory,
+        async readPredecessorReference(reference) {
+            assertProjectionVerificationCurrent(stillCurrent);
+            const owned = structuredClone(reference);
+            const key = serializeKeyingCanonicalJson({ ...owned });
+            let pending = references.get(key);
+            if (!pending) {
+                // Keep at most one bounded selection's citations, even across many paths.
+                if (references.size === 128) {
+                    const oldest = references.keys().next().value;
+                    if (oldest !== undefined)
+                        references.delete(oldest);
+                }
+                pending = authority
+                    .readGroup(input.groupId, owned)
+                    .then((selected) => selected.policy);
+                references.set(key, pending);
+            }
+            const policy = await pending.catch((error) => {
+                if (references.get(key) === pending)
+                    references.delete(key);
+                throw error;
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            return policy;
+        },
+        stillCurrent,
+    };
+}
+//# sourceMappingURL=currentGroupPolicyMutationContext.js.map

package/workflows/organizations/currentGroupPolicyMutationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupPolicyMutationContext.js","sourceRoot":"","sources":["currentGroupPolicyMutationContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AAGrG,OAAO,EAAE,mDAAmD,EAAE,MAAM,iCAAiC,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAY3D;IACC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACrB,MAAM,EAAE,SAAS,EAAE,sBAAsB,EAAE,GACzC,MAAM,wCAAwC,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAChE,2BAA2B,CACzB,KAAK,CAAC,OAAO,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;QAC/C,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,4BAA4B,CAC5C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CAAC,YAAY,CAClC,CAAC;IACF,MAAM,iBAAiB,GAAqC;QAC1D,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;SACpE;KACF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC9E,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY;QAC/C,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,aAAa,EAAE,KAAK,CAAC,OAAO;QAC5B,qBAAqB,EAAE,KAAK,CAAC,MAAM;QACnC,uBAAuB,EACrB,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC;QACJ,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB,EACvB,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,UAAU,CAAC,YAAY;QACrD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QAC9C,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,aAAa;QACjD,sBAAsB,EAAE,SAAS,CAAC,UAAU;QAC5C,mBAAmB,EAAE,SAAS,CAAC,SAAS;QACxC,KAAK,CAAC,wBAAwB,CAAC,SAAkC;YAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,IAAI,UAAU,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;oBAC9C,IAAI,MAAM,KAAK,SAAS;wBAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,GAAG,SAAS;qBAChB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC;qBAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACvC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACpD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;oBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,YAAY;KACb,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyExternalAuthority,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { requireOrganizationGroupHead } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { createRuntimePrincipalPolicyCurrentResolver } from \"../principals/runtimePolicyRecovery\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\nimport { loadCurrentOrganizationMutationAuthority } from \"./currentOrganizationMutationAuthority\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\n\n/** Exact current directory, strict Admins and group evidence for one mutation. */\nexport async function loadCurrentGroupPolicyMutationContext(input: {\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly resolveCurrentPolicy: NonNullable<\n    ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>\n  >;\n  readonly recoverPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<void>;\n  readonly stillCurrent: () => boolean;\n}) {\n  input = { ...input };\n  const { authority, currentOrgAdminUserIds } =\n    await loadCurrentOrganizationMutationAuthority(input);\n  const group = await authority.readGroup(input.groupId);\n  const stillCurrent = () =>\n    input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();\n  assertProjectionVerificationCurrent(stillCurrent);\n  assertGroupMetadataBinding(group.current, authority.descriptor);\n  requireSignerCanManageGroup(\n    group.current,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [...group.dependencies, group.policy],\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const adminHead = requireOrganizationGroupHead(\n    authority.descriptor,\n    authority.descriptor.adminGroupId,\n  );\n  const externalAuthority: PrincipalPolicyExternalAuthority = {\n    currentHead: adminHead,\n    states: [\n      { head: adminHead, projection: authority.admins.policy.projection },\n    ],\n  };\n  const references = new Map<string, Promise<VerifiedPrincipalPolicyCurrent>>();\n  return {\n    adminGroupId: authority.descriptor.adminGroupId,\n    adminCurrent: authority.admins,\n    currentPolicy: group.current,\n    verifiedCurrentPolicy: group.policy,\n    verifyMetadataContainer:\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup:\n      input.groupId === authority.descriptor.adminGroupId,\n    localPolicyCheckpoint: group.policy.checkpoint,\n    memberGroupId: authority.descriptor.memberGroupId,\n    organizationDescriptor: authority.descriptor,\n    organizationCurrent: authority.directory,\n    async readPredecessorReference(reference: ReferencedPrincipalHead) {\n      assertProjectionVerificationCurrent(stillCurrent);\n      const owned = structuredClone(reference);\n      const key = serializeKeyingCanonicalJson({ ...owned });\n      let pending = references.get(key);\n      if (!pending) {\n        // Keep at most one bounded selection's citations, even across many paths.\n        if (references.size === 128) {\n          const oldest = references.keys().next().value;\n          if (oldest !== undefined) references.delete(oldest);\n        }\n        pending = authority\n          .readGroup(input.groupId, owned)\n          .then((selected) => selected.policy);\n        references.set(key, pending);\n      }\n      const policy = await pending.catch((error: unknown) => {\n        if (references.get(key) === pending) references.delete(key);\n        throw error;\n      });\n      assertProjectionVerificationCurrent(stillCurrent);\n      return policy;\n    },\n    stillCurrent,\n  };\n}\n"]}

package/workflows/organizations/currentOrganizationGroupNames.js

@@ -9,6 +9,10 @@ import { readGroupPolicyPayloadName, } from "./principalPolicyRequest.js";
 /** Names consume verified current artifacts; paged recovery retains their separate evidence. */
 export async function hydrateCurrentOrganizationGroupNames(input) {
     const authority = await loadCurrentOrganizationAuthority(input);
+    const nameInput = {
+        ...input,
+        readEncryptedName: input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,
+    };
     const names = [];
     const unreadable = new Set();
     const lifetimes = [authority.stillCurrent];
@@ -19,7 +23,7 @@ export async function hydrateCurrentOrganizationGroupNames(input) {
         const verified = await authority.readGroup(group.groupId);
         lifetimes.push(verified.stillCurrent);
         assertGroupMetadataBinding(verified.current, authority.descriptor);
-        const name = await readCurrentGroupName(input, verified.current);
+        const name = await readCurrentGroupName(nameInput, verified.current);
         if (name === null)
             unreadable.add(group.groupId);
         else

package/workflows/organizations/currentOrganizationGroupNames.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentOrganizationGroupNames.js","sourceRoot":"","sources":["currentOrganizationGroupNames.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAE1H,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAEL,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AASlC,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAY;IAEZ,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAsB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;YAE/C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/D,YAAY;KACb,CAAC,CAAC;IACH,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAY,EACZ,OAA6C;IAE7C,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE;YAC7D,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;YAC1C,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { saveOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\ntype Input = Parameters<typeof loadCurrentOrganizationAuthority>[0] & {\n  readonly directory: OrganizationDirectoryAndGroups;\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n};\n\n/** Names consume verified current artifacts; paged recovery retains their separate evidence. */\nexport async function hydrateCurrentOrganizationGroupNames(\n  input: Input,\n): Promise<OrganizationDirectoryAndGroups> {\n  const authority = await loadCurrentOrganizationAuthority(input);\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadable = new Set<string>();\n  const lifetimes: (() => boolean)[] = [authority.stillCurrent];\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await authority.readGroup(group.groupId);\n    lifetimes.push(verified.stillCurrent);\n    assertGroupMetadataBinding(verified.current, authority.descriptor);\n    const name = await readCurrentGroupName(input, verified.current);\n    if (name === null) unreadable.add(group.groupId);\n    else\n      names.push({ groupId: group.groupId, name, stateHash: head.stateHash });\n  }\n  const stillCurrent = () =>\n    input.stillCurrent() && lifetimes.every((current) => current());\n  assertProjectionVerificationCurrent(stillCurrent);\n  // Match the authority admission performed by the full-bundle path. Group\n  // name reads alone do not move group checkpoints.\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [authority.directory.policy, authority.admins.policy],\n    stillCurrent,\n  });\n  await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadable.has(group.groupId),\n    })),\n  };\n}\n\nasync function readCurrentGroupName(\n  input: Input,\n  current: Parameters<GroupPolicyNameReader>[0],\n) {\n  try {\n    return await readGroupPolicyPayloadName(current, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: current.currentState.stateHash },\n        objectId: current.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n"]}
+{"version":3,"file":"currentOrganizationGroupNames.js","sourceRoot":"","sources":["currentOrganizationGroupNames.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAE1H,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAEL,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAclC,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAY;IAEZ,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG;QAChB,GAAG,KAAK;QACR,iBAAiB,EACf,KAAK,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,iBAAiB;KACxE,CAAC;IACF,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAsB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;YAE/C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/D,YAAY;KACb,CAAC,CAAC;IACH,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAY,EACZ,OAA6C;IAE7C,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE;YAC7D,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;YAC1C,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { saveOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\ntype Input = Parameters<typeof loadCurrentOrganizationAuthority>[0] & {\n  readonly directory: OrganizationDirectoryAndGroups;\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly createCurrentNameReader?:\n    | ((\n        authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>,\n      ) => GroupPolicyNameReader)\n    | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n};\n\n/** Names consume verified current artifacts; paged recovery retains their separate evidence. */\nexport async function hydrateCurrentOrganizationGroupNames(\n  input: Input,\n): Promise<OrganizationDirectoryAndGroups> {\n  const authority = await loadCurrentOrganizationAuthority(input);\n  const nameInput = {\n    ...input,\n    readEncryptedName:\n      input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,\n  };\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadable = new Set<string>();\n  const lifetimes: (() => boolean)[] = [authority.stillCurrent];\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await authority.readGroup(group.groupId);\n    lifetimes.push(verified.stillCurrent);\n    assertGroupMetadataBinding(verified.current, authority.descriptor);\n    const name = await readCurrentGroupName(nameInput, verified.current);\n    if (name === null) unreadable.add(group.groupId);\n    else\n      names.push({ groupId: group.groupId, name, stateHash: head.stateHash });\n  }\n  const stillCurrent = () =>\n    input.stillCurrent() && lifetimes.every((current) => current());\n  assertProjectionVerificationCurrent(stillCurrent);\n  // Match the authority admission performed by the full-bundle path. Group\n  // name reads alone do not move group checkpoints.\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [authority.directory.policy, authority.admins.policy],\n    stillCurrent,\n  });\n  await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadable.has(group.groupId),\n    })),\n  };\n}\n\nasync function readCurrentGroupName(\n  input: Input,\n  current: Parameters<GroupPolicyNameReader>[0],\n) {\n  try {\n    return await readGroupPolicyPayloadName(current, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: current.currentState.stateHash },\n        objectId: current.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n"]}

package/workflows/organizations/currentOrganizationMutationAuthority.js

@@ -0,0 +1,16 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { organizationAdminSignerUserIds } from "../../data/principals/principalPolicyAdminSigners.js";
+import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
+/** Resolve uncertain work and verify the signing administrator before any mutation pins. */
+export async function loadCurrentOrganizationMutationAuthority(input) {
+    const owned = { ...input };
+    assertProjectionVerificationCurrent(owned.stillCurrent);
+    await owned.recoverPendingPrincipalMutation(owned.organizationId);
+    assertProjectionVerificationCurrent(owned.stillCurrent);
+    const authority = await loadCurrentOrganizationAuthority(owned);
+    const currentOrgAdminUserIds = organizationAdminSignerUserIds(authority.admins.policy);
+    if (!currentOrgAdminUserIds.includes(owned.signerUserId))
+        throw new Error("Organization admin authority is required");
+    return { authority, currentOrgAdminUserIds };
+}
+//# sourceMappingURL=currentOrganizationMutationAuthority.js.map

package/workflows/organizations/currentOrganizationMutationAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationMutationAuthority.js","sourceRoot":"","sources":["currentOrganizationMutationAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAQC;IAED,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3B,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,+BAA+B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,sBAAsB,GAAG,8BAA8B,CAC3D,SAAS,CAAC,MAAM,CAAC,MAAM,CACxB,CAAC;IACF,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { organizationAdminSignerUserIds } from \"../../data/principals/principalPolicyAdminSigners\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\n\n/** Resolve uncertain work and verify the signing administrator before any mutation pins. */\nexport async function loadCurrentOrganizationMutationAuthority(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  > & {\n    readonly signerUserId: string;\n    readonly recoverPendingPrincipalMutation: (\n      organizationId: string,\n    ) => Promise<void>;\n  },\n) {\n  const owned = { ...input };\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  await owned.recoverPendingPrincipalMutation(owned.organizationId);\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  const authority = await loadCurrentOrganizationAuthority(owned);\n  const currentOrgAdminUserIds = organizationAdminSignerUserIds(\n    authority.admins.policy,\n  );\n  if (!currentOrgAdminUserIds.includes(owned.signerUserId))\n    throw new Error(\"Organization admin authority is required\");\n  return { authority, currentOrgAdminUserIds };\n}\n"]}

package/workflows/organizations/currentOrganizationMutationRetention.js

@@ -0,0 +1,53 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { scopedGroupHistoryProtection } from "../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+/** Couple directory acknowledgements to any newly created group under the same lease. */
+export function createCurrentOrganizationMutationRetention(input) {
+    const retain = async (entries) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        await retainAcknowledgedPrincipalCurrents({
+            execSql: input.runtime.infra.execSql,
+            organizationId: input.organizationId,
+            entries,
+            stillCurrent: input.stillCurrent,
+        });
+    };
+    return {
+        retainDirectory: (request, response) => retain([{ request, response, recovery: input.directoryRecovery }]),
+        retainCreatedGroup: (receipt) => {
+            const adminHead = {
+                ...principalPolicyReferenceFromBundle(input.authority.admins.current),
+                principalType: "group",
+            };
+            return retain([
+                {
+                    initialGroup: true,
+                    request: receipt.request,
+                    response: receipt.response,
+                    recovery: {
+                        apiClient: { getPrincipalPolicyPages: input.readPages },
+                        expectedHead: principalPolicyReferenceFromBundle(receipt.response),
+                        protection: scopedGroupHistoryProtection(input.protection, input.organizationId, input.authority.descriptor.adminGroupId),
+                        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                        loadExternalAuthority: async () => ({
+                            currentHead: adminHead,
+                            states: [
+                                {
+                                    head: adminHead,
+                                    projection: input.authority.admins.policy.projection,
+                                },
+                            ],
+                        }),
+                    },
+                },
+                {
+                    request: receipt.organizationRequest,
+                    response: receipt.organizationResponse,
+                    recovery: input.directoryRecovery,
+                },
+            ]);
+        },
+    };
+}
+//# sourceMappingURL=currentOrganizationMutationRetention.js.map

package/workflows/organizations/currentOrganizationMutationRetention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationMutationRetention.js","sourceRoot":"","sources":["currentOrganizationMutationRetention.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGvG,OAAO,EAEL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,yFAAyF;AACzF,MAAM,UAAU,0CAA0C,CAAC,KAU1D;IACC,MAAM,MAAM,GAAG,KAAK,EAClB,OAAqD,EACrD,EAAE;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,eAAe,EAAE,CACf,OAAkC,EAClC,QAAyC,EACzC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACvE,kBAAkB,EAAE,CAAC,OAKpB,EAAE,EAAE;YACH,MAAM,SAAS,GAAG;gBAChB,GAAG,kCAAkC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;gBACrE,aAAa,EAAE,OAAgB;aAChC,CAAC;YACF,OAAO,MAAM,CAAC;gBACZ;oBACE,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE;wBACR,SAAS,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,SAAS,EAAE;wBACvD,YAAY,EAAE,kCAAkC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAClE,UAAU,EAAE,4BAA4B,CACtC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CACxC;wBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;wBAC1C,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;4BAClC,WAAW,EAAE,SAAS;4BACtB,MAAM,EAAE;gCACN;oCACE,IAAI,EAAE,SAAS;oCACf,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;iCACrD;6BACF;yBACF,CAAC;qBACH;iBACF;gBACD;oBACE,OAAO,EAAE,OAAO,CAAC,mBAAmB;oBACpC,QAAQ,EAAE,OAAO,CAAC,oBAAoB;oBACtC,QAAQ,EAAE,KAAK,CAAC,iBAAiB;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { scopedGroupHistoryProtection } from \"../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"../principals/runtimePolicyRecovery\";\nimport type { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport {\n  type AcknowledgedPrincipalCurrentInput,\n  retainAcknowledgedPrincipalCurrents,\n} from \"./retainAcknowledgedPrincipalCurrents\";\n\n/** Couple directory acknowledgements to any newly created group under the same lease. */\nexport function createCurrentOrganizationMutationRetention(input: {\n  readonly runtime: PrincipalPolicyRecoveryRuntime;\n  readonly authority: Awaited<\n    ReturnType<typeof loadCurrentOrganizationAuthority>\n  >;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly readPages: ApiClient[\"getPrincipalPolicyPages\"];\n  readonly organizationId: string;\n  readonly directoryRecovery: AcknowledgedPrincipalCurrentInput[\"recovery\"];\n  readonly stillCurrent: () => boolean;\n}) {\n  const retain = async (\n    entries: readonly AcknowledgedPrincipalCurrentInput[],\n  ) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    await retainAcknowledgedPrincipalCurrents({\n      execSql: input.runtime.infra.execSql,\n      organizationId: input.organizationId,\n      entries,\n      stillCurrent: input.stillCurrent,\n    });\n  };\n  return {\n    retainDirectory: (\n      request: PutPrincipalPolicyRequest,\n      response: PrincipalPolicyMutationResponse,\n    ) => retain([{ request, response, recovery: input.directoryRecovery }]),\n    retainCreatedGroup: (receipt: {\n      readonly request: PutPrincipalPolicyRequest;\n      readonly response: PrincipalPolicyMutationResponse;\n      readonly organizationRequest: PutPrincipalPolicyRequest;\n      readonly organizationResponse: PrincipalPolicyMutationResponse;\n    }) => {\n      const adminHead = {\n        ...principalPolicyReferenceFromBundle(input.authority.admins.current),\n        principalType: \"group\" as const,\n      };\n      return retain([\n        {\n          initialGroup: true,\n          request: receipt.request,\n          response: receipt.response,\n          recovery: {\n            apiClient: { getPrincipalPolicyPages: input.readPages },\n            expectedHead: principalPolicyReferenceFromBundle(receipt.response),\n            protection: scopedGroupHistoryProtection(\n              input.protection,\n              input.organizationId,\n              input.authority.descriptor.adminGroupId,\n            ),\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n            loadExternalAuthority: async () => ({\n              currentHead: adminHead,\n              states: [\n                {\n                  head: adminHead,\n                  projection: input.authority.admins.policy.projection,\n                },\n              ],\n            }),\n          },\n        },\n        {\n          request: receipt.organizationRequest,\n          response: receipt.organizationResponse,\n          recovery: input.directoryRecovery,\n        },\n      ]);\n    },\n  };\n}\n"]}

package/workflows/organizations/currentPrincipalMutationLease.js

@@ -0,0 +1,38 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { readPrincipalHistoryProtection } from "../../data/principals/principalHistoryRuntime.js";
+import { directoryHistoryProtection } from "../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { createRuntimePrincipalPolicyCurrentResolver, } from "../principals/runtimePolicyRecovery.js";
+/** One lifetime fence and private custody boundary for every current-policy mutation. */
+export function createCurrentPrincipalMutationLease(runtime) {
+    const lease = readPrincipalHistoryProtection(runtime);
+    const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(runtime);
+    const readPages = runtime.apiClient.getPrincipalPolicyPages?.bind(runtime.apiClient);
+    if (!lease || !resolveCurrentPolicy || !readPages)
+        return undefined;
+    return async (callerCurrent, work) => lease(async ({ protection, stillCurrent: leaseCurrent }) => {
+        let active = true;
+        const stillCurrent = () => active && leaseCurrent() && callerCurrent();
+        try {
+            assertProjectionVerificationCurrent(stillCurrent);
+            const result = await work({
+                protection,
+                stillCurrent,
+                resolveCurrentPolicy,
+                readPages,
+                directoryRecovery: (current) => ({
+                    apiClient: { getPrincipalPolicyPages: readPages },
+                    expectedHead: principalPolicyReferenceFromBundle(current),
+                    protection: directoryHistoryProtection(protection),
+                    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+                }),
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            return result;
+        }
+        finally {
+            active = false;
+        }
+    });
+}
+//# sourceMappingURL=currentPrincipalMutationLease.js.map