@tearleads/client-sdk 0.1.38 → 0.1.40

package/workflows/registration/provisionedPrincipalHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisionedPrincipalHistory.js","sourceRoot":"","sources":["provisionedPrincipalHistory.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAMvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,6CAA6C,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAyB9E;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,QAAsC;IAEtC,MAAM,OAAO,GAAG;QACd,QAAQ,CAAC,YAAY;QACrB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,WAAW;KACrB,CAAC;IACF,OAAO;QACL,KAAK,CAAC,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YACrE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CACnB,YAAY,CAAC,aAAa,KAAK,aAAa;gBAC5C,YAAY,CAAC,WAAW,KAAK,WAAW,CAC3C,CAAC;YACF,IACE,CAAC,MAAM;gBACP,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;gBACjC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;oBAC9B,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;gBAEtD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,MAAM;gBACJ,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE;oBACJ,GAAG,eAAe,CAAC,MAAM,CAAC;oBAC1B,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE;iBACzD;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAO/C;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,mCAAmC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;IACF,wEAAwE;IACxE,+DAA+D;IAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzE,MAAM,OAAO,CAAC;YACZ,GAAG,OAAO;YACV,SAAS,EAAE,kCAAkC,CAAC,KAAK,CAAC;SACrD,CAAC,CAAC;AACP,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,OAA2C;IAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,QAAQ,CACd,wEAAwE,EACxE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAA2C,EAC3C,KAAuD;IAEvD,sEAAsE;IACtE,MAAM,kBAAkB,GACtB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,wBAAwB,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,OAAO,KAAK,IAAI;QAChB,KAAK,CAAC,SAAS,EAAE;QACjB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO;QAC9C,OAAO,CAAC,kBAAkB,EAAE,KAAK,kBAAkB,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO;IAC/B,MAAM,0BAA0B,GAAgC,KAAK,EACnE,YAAY,EACZ,EAAE;QACF,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/C,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,QAAQ,EAAE,qBAAqB,KAAK,kBAAkB;YAC3D,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,CAC/D,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE,CACrC,gCAAgC,CAAC;QAC/B,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU;QACV,0BAA0B;QAC1B,wDAAwD;QACxD,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,YAAY,EAAE;KACrD,CAAC,CACH,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql, ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type {\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport { createPrincipalCurrentRecoveryBatch } from \"../principals/principalCurrentRecoveryBatch\";\nimport { queuePrincipalRecovery } from \"../principals/principalRecoveryQueue\";\n\n/** The version-1 policies a provisioning request signed and its response acknowledged. */\ninterface ProvisionedPrincipalPolicies {\n  readonly adminGroup: PrincipalPolicyBundleResponse;\n  readonly memberGroup: PrincipalPolicyBundleResponse;\n  readonly organization: PrincipalPolicyBundleResponse;\n}\n\n/**\n * Records verified recovery progress for an organization's founding policy\n * heads, so the device's first scoped recovery of them needs no history read.\n * It is bound to the provisioning scope: the database the bootstrap committed\n * to and the identity that signed it. Failure leaves the online path.\n */\nexport type ProvisionedPrincipalHistoryPrimer = (input: {\n  /** The database client the provisioning bootstrap committed to. */\n  readonly database: ExecSqlClientLike;\n  /** Whether the identity that provisioned is still the active one. */\n  readonly isCurrent: () => boolean;\n  readonly organizationId: string;\n  readonly policies: ProvisionedPrincipalPolicies;\n  readonly userId: string;\n}) => Promise<void>;\n\n/**\n * Serves only the acknowledged initial heads, each complete in one page. The\n * ordinary verifier still checks every signature, the directory binding and\n * strict Admins rules before any progress is saved.\n */\nfunction provisionedPolicyPages(\n  policies: ProvisionedPrincipalPolicies,\n): Pick<ApiClient, \"getPrincipalPolicyPages\"> {\n  const bundles = [\n    policies.organization,\n    policies.adminGroup,\n    policies.memberGroup,\n  ];\n  return {\n    async *getPrincipalPolicyPages(principalType, principalId, options = {}) {\n      const bundle = bundles.find(\n        ({ currentState }) =>\n          currentState.principalType === principalType &&\n          currentState.principalId === principalId,\n      );\n      if (\n        !bundle ||\n        options.resume !== undefined ||\n        (options.afterVersion ?? 0) !== 0 ||\n        (options.stateHash !== undefined &&\n          options.stateHash !== bundle.currentState.stateHash)\n      )\n        throw new Error(\n          \"Provisioned principal history holds only the acknowledged initial heads\",\n        );\n      yield {\n        ok: true,\n        data: {\n          ...structuredClone(bundle),\n          historyPage: { afterVersion: 0, nextAfterVersion: null },\n        },\n      };\n    },\n  };\n}\n\nasync function primeProvisionedPrincipalHistory(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly policies: ProvisionedPrincipalPolicies;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const { recover } = createPrincipalCurrentRecoveryBatch();\n  const options = {\n    apiClient: provisionedPolicyPages(input.policies),\n    execSql: input.execSql,\n    offline: false,\n    organizationId: input.organizationId,\n    protection: input.protection,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  };\n  // Scoped recovery of each group also completes the directory and strict\n  // Admins stages; Members reuses them through the shared batch.\n  for (const group of [input.policies.adminGroup, input.policies.memberGroup])\n    await recover({\n      ...options,\n      reference: principalPolicyReferenceFromBundle(group),\n    });\n}\n\n/** The runtime seams priming reads; none of them writes durable state. */\ninterface ProvisionedPrincipalHistoryRuntime {\n  readonly bindLease: () => PrincipalHistoryProtectionLease | undefined;\n  /** The runtime executor, only while `database` is its ready database. */\n  readonly execSqlFor: (database: ExecSqlClientLike) => ExecSql | null;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  /** Read-only: the identity the trust store already pins for a user. */\n  readonly loadPinnedIdentity: (\n    execSql: ExecSql,\n    userId: string,\n  ) => Promise<TrustedUserIdentity | null>;\n  readonly signingFingerprint: () => string | null;\n}\n\n/**\n * Binds priming to the exact provisioning scope, captured before any await:\n * the bootstrap's database and runtime executor, the identity whose key signed\n * the founding states, and a protection lease for that identity. Every later\n * step, and every progress write inside its transaction, rechecks that scope,\n * so a switched identity or database aborts priming without a durable write.\n * Priming never writes a trust pin; it only reads the founder's existing one.\n */\nexport function createProvisionedPrincipalHistoryPrimer(\n  runtime: ProvisionedPrincipalHistoryRuntime,\n): ProvisionedPrincipalHistoryPrimer {\n  return async (input) => {\n    try {\n      await primeInProvisioningScope(runtime, input);\n    } catch (error) {\n      runtime.logError(\n        \"Provisioned principal history was not primed; recovery reads it online\",\n        error,\n      );\n    }\n  };\n}\n\nasync function primeInProvisioningScope(\n  runtime: ProvisionedPrincipalHistoryRuntime,\n  input: Parameters<ProvisionedPrincipalHistoryPrimer>[0],\n): Promise<void> {\n  // Everything below is captured synchronously, before the first await.\n  const founderFingerprint =\n    input.policies.organization.currentState.signerUserKeyFingerprint;\n  const execSql = runtime.execSqlFor(input.database);\n  const scopeCurrent = () =>\n    execSql !== null &&\n    input.isCurrent() &&\n    runtime.execSqlFor(input.database) === execSql &&\n    runtime.signingFingerprint() === founderFingerprint;\n  const lease = scopeCurrent() ? runtime.bindLease() : undefined;\n  if (!execSql || !lease) return;\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = async (\n    signerUserId,\n  ) => {\n    if (signerUserId !== input.userId) return null;\n    assertProjectionVerificationCurrent(scopeCurrent);\n    const identity = await runtime.loadPinnedIdentity(execSql, input.userId);\n    assertProjectionVerificationCurrent(scopeCurrent);\n    return identity?.signingKeyFingerprint === founderFingerprint\n      ? identity\n      : null;\n  };\n  await queuePrincipalRecovery(execSql, input.organizationId, () =>\n    lease(({ protection, stillCurrent }) =>\n      primeProvisionedPrincipalHistory({\n        execSql,\n        organizationId: input.organizationId,\n        policies: input.policies,\n        protection,\n        resolveTrustedUserIdentity,\n        // Progress writes check this inside their transactions.\n        stillCurrent: () => stillCurrent() && scopeCurrent(),\n      }),\n    ),\n  );\n}\n"]}

package/workflows/registration/provisioningAcknowledgement.js

@@ -82,4 +82,22 @@ export async function provisioningAcknowledgedAccessHeads(input) {
     }
     return heads;
 }
+/**
+ * The signed heads of the seeded profile documents, for the discovery head
+ * cache. Each plan was checked against its create acknowledgement by
+ * {@link provisioningAcknowledgedAccessHeads}; checking again here keeps the
+ * cache entry bound to exactly the head the server returned.
+ */
+export function provisioningDiscoveryHeads(documents) {
+    return documents.map(({ plan, response }) => {
+        assertDocumentCreateResponseMatchesPlan(plan, requireResponse(response, "seeded document"));
+        return {
+            documentId: plan.documentId,
+            organizationId: plan.state.organizationId,
+            accessEpoch: plan.state.epoch,
+            accessStateHash: plan.manifestHash,
+            linkedContainerIds: plan.state.linkedContainerIds,
+        };
+    });
+}
 //# sourceMappingURL=provisioningAcknowledgement.js.map

package/workflows/registration/provisioningAcknowledgement.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioningAcknowledgement.js","sourceRoot":"","sources":["provisioningAcknowledgement.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wCAAwC,EAAE,MAAM,sDAAsD,CAAC;AAChH,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,EAEL,iCAAiC,GAClC,MAAM,iEAAiE,CAAC;AAczE,SAAS,eAAe,CAAI,KAAoB,EAAE,KAAa;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CACf,MAA0B,EAC1B,QAAgB,EAChB,KAAa;IAEb,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,WAAW,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAMnC;IACC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,GAAG,KAAK,CAAC;IACxE,IACE,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;QACxC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB;QACxD,QAAQ,CAAC,eAAe,KAAK,iBAAiB,CAAC,WAAW;QAC1D,QAAQ,CAAC,sBAAsB,KAAK,wBAAwB,CAAC,UAAU;QACvE,QAAQ,CAAC,uBAAuB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,KAAK;QACrE,QAAQ,CAAC,2BAA2B,KAAK,iBAAiB,CAAC,YAAY,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAGrC;IACC,uCAAuC,CACrC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EACnC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACF,OAAO;QACL,MAAM,wCAAwC,CAAC;YAC7C,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;SACnC,CAAC;QACF,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAGrB;IACC,uCAAuC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,OAAO,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAWzD;IACC,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,uCAAuC,CACrC,KAAK,CAAC,wBAAwB,EAC9B,QAAQ,CAAC,oBAAoB,CAC9B,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CACrC,QAAQ,CAAC,sBAAsB,EAC/B,0BAA0B,CAC3B,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CACpC,QAAQ,CAAC,qBAAqB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,qBAAqB,GAAG,eAAe,CAC3C,QAAQ,CAAC,6BAA6B,EACtC,iCAAiC,CAClC,CAAC;IACF,MAAM,oBAAoB,GAAG,eAAe,CAC1C,QAAQ,CAAC,2BAA2B,EACpC,+BAA+B,CAChC,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,wBAAwB,EACjC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,EAC7C,6BAA6B,CAC9B,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,uBAAuB,EAChC,KAAK,CAAC,yBAAyB,CAAC,UAAU,EAC1C,4BAA4B,CAC7B,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,+BAA+B,EACxC,KAAK,CAAC,oBAAoB,CAAC,aAAa,CAAC,WAAW,EACpD,oCAAoC,CACrC,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,6BAA6B,EACtC,KAAK,CAAC,+BAA+B,CAAC,UAAU,EAChD,kCAAkC,CACnC,CAAC;IAEF,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,eAAe,CAAC,MAAM,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAA4C;QACrD,iCAAiC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC1D,iCAAiC,CAAC,KAAK,CAAC,wBAAwB,CAAC;QACjE,GAAG,CAAC,MAAM,sBAAsB,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,aAAa;YAC7B,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC;YACX,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACrC,QAAQ,EAAE,cAAc;SACzB,CAAC;QACF,GAAG,CAAC,MAAM,sBAAsB,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,oBAAoB;YACpC,QAAQ,EAAE,qBAAqB;SAChC,CAAC,CAAC;QACH,YAAY,CAAC;YACX,IAAI,EAAE,KAAK,CAAC,+BAA+B;YAC3C,QAAQ,EAAE,oBAAoB;SAC/B,CAAC;KACH,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,sBAAsB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type {\n  ContainerCreateWithMetadataDocumentResponse,\n  DocumentCreateResponse,\n  OrganizationProvisioningResponse,\n} from \"@tearleads/validators/response\";\nimport { locallyAcknowledgedContainerMutationHead } from \"../../data/containers/shared/mutationAcknowledgement\";\nimport { assertDocumentCreateResponseMatchesPlan } from \"../../data/documents/shared/responses\";\nimport {\n  type LocallyAcknowledgedAccessManifestHead,\n  locallyAuthoredAccessManifestHead,\n} from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\n\ntype ContainerPlan = Parameters<\n  typeof locallyAcknowledgedContainerMutationHead\n>[0][\"plan\"];\ntype DocumentPlan = Parameters<\n  typeof assertDocumentCreateResponseMatchesPlan\n>[0];\n\ninterface ProvisioningContainerArtifact {\n  readonly containerPlan: ContainerPlan;\n  readonly metadataDocumentPlan: DocumentPlan;\n}\n\nfunction requireResponse<T>(value: T | undefined, label: string): T {\n  if (!value) {\n    throw new Error(`Organization provisioning response is missing ${label}`);\n  }\n  return value;\n}\n\nfunction assertId(\n  actual: string | undefined,\n  expected: string,\n  label: string,\n): void {\n  if (actual !== expected) {\n    throw new Error(`Organization provisioning response ${label} mismatch`);\n  }\n}\n\nfunction assertProvisioningIdentity(input: {\n  expectedOrganizationId: string;\n  expectedUserId: string;\n  response: OrganizationProvisioningResponse;\n  rootContainerPlan: ContainerPlan;\n  rootMetadataDocumentPlan: DocumentPlan;\n}): void {\n  const { response, rootContainerPlan, rootMetadataDocumentPlan } = input;\n  if (\n    response.userId !== input.expectedUserId ||\n    response.organizationId !== input.expectedOrganizationId ||\n    response.rootContainerId !== rootContainerPlan.containerId ||\n    response.rootMetadataDocumentId !== rootMetadataDocumentPlan.documentId ||\n    response.rootMetadataAccessEpoch !== rootContainerPlan.manifest.epoch ||\n    response.rootMetadataAccessStateHash !== rootContainerPlan.manifestHash\n  ) {\n    throw new Error(\"Organization provisioning response identity mismatch\");\n  }\n}\n\nasync function containerArtifactHeads(input: {\n  artifact: ProvisioningContainerArtifact;\n  response: ContainerCreateWithMetadataDocumentResponse;\n}): Promise<LocallyAcknowledgedAccessManifestHead[]> {\n  assertDocumentCreateResponseMatchesPlan(\n    input.artifact.metadataDocumentPlan,\n    input.response.metadataDocument,\n  );\n  return [\n    await locallyAcknowledgedContainerMutationHead({\n      plan: input.artifact.containerPlan,\n      response: input.response.container,\n    }),\n    locallyAuthoredAccessManifestHead(input.artifact.metadataDocumentPlan),\n  ];\n}\n\nfunction documentHead(input: {\n  plan: DocumentPlan;\n  response: DocumentCreateResponse;\n}): LocallyAcknowledgedAccessManifestHead {\n  assertDocumentCreateResponseMatchesPlan(input.plan, input.response);\n  return locallyAuthoredAccessManifestHead(input.plan);\n}\n\nexport async function provisioningAcknowledgedAccessHeads(input: {\n  expectedOrganizationId: string;\n  expectedUserId: string;\n  organizationMetadata: ProvisioningContainerArtifact;\n  organizationProfileDocumentPlan: DocumentPlan;\n  response: OrganizationProvisioningResponse;\n  rootContainerPlan: ContainerPlan;\n  rootMetadataDocumentPlan: DocumentPlan;\n  rosterProfile: ProvisioningContainerArtifact;\n  rosterProfileDocumentPlan: DocumentPlan;\n  systemContainers: readonly ProvisioningContainerArtifact[];\n}): Promise<LocallyAcknowledgedAccessManifestHead[]> {\n  assertProvisioningIdentity(input);\n  const response = input.response;\n  assertDocumentCreateResponseMatchesPlan(\n    input.rootMetadataDocumentPlan,\n    response.rootMetadataDocument,\n  );\n  const rosterContainer = requireResponse(\n    response.rosterProfileContainer,\n    \"roster profile container\",\n  );\n  const rosterDocument = requireResponse(\n    response.rosterProfileDocument,\n    \"roster profile document\",\n  );\n  const organizationContainer = requireResponse(\n    response.organizationMetadataContainer,\n    \"organization metadata container\",\n  );\n  const organizationDocument = requireResponse(\n    response.organizationProfileDocument,\n    \"organization profile document\",\n  );\n  assertId(\n    response.rosterProfileContainerId,\n    input.rosterProfile.containerPlan.containerId,\n    \"roster profile container id\",\n  );\n  assertId(\n    response.rosterProfileDocumentId,\n    input.rosterProfileDocumentPlan.documentId,\n    \"roster profile document id\",\n  );\n  assertId(\n    response.organizationMetadataContainerId,\n    input.organizationMetadata.containerPlan.containerId,\n    \"organization metadata container id\",\n  );\n  assertId(\n    response.organizationProfileDocumentId,\n    input.organizationProfileDocumentPlan.documentId,\n    \"organization profile document id\",\n  );\n\n  const systemResponses = response.systemContainers;\n  if (systemResponses.length !== input.systemContainers.length) {\n    throw new Error(\n      \"Organization provisioning response system container count mismatch\",\n    );\n  }\n  const heads: LocallyAcknowledgedAccessManifestHead[] = [\n    locallyAuthoredAccessManifestHead(input.rootContainerPlan),\n    locallyAuthoredAccessManifestHead(input.rootMetadataDocumentPlan),\n    ...(await containerArtifactHeads({\n      artifact: input.rosterProfile,\n      response: rosterContainer,\n    })),\n    documentHead({\n      plan: input.rosterProfileDocumentPlan,\n      response: rosterDocument,\n    }),\n    ...(await containerArtifactHeads({\n      artifact: input.organizationMetadata,\n      response: organizationContainer,\n    })),\n    documentHead({\n      plan: input.organizationProfileDocumentPlan,\n      response: organizationDocument,\n    }),\n  ];\n  for (const [index, artifact] of input.systemContainers.entries()) {\n    const systemResponse = systemResponses[index];\n    if (!systemResponse) {\n      throw new Error(\"Organization provisioning system response is missing\");\n    }\n    heads.push(\n      ...(await containerArtifactHeads({ artifact, response: systemResponse })),\n    );\n  }\n  return heads;\n}\n"]}
+{"version":3,"file":"provisioningAcknowledgement.js","sourceRoot":"","sources":["provisioningAcknowledgement.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wCAAwC,EAAE,MAAM,sDAAsD,CAAC;AAChH,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAEhG,OAAO,EAEL,iCAAiC,GAClC,MAAM,iEAAiE,CAAC;AAczE,SAAS,eAAe,CAAI,KAAoB,EAAE,KAAa;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CACf,MAA0B,EAC1B,QAAgB,EAChB,KAAa;IAEb,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,WAAW,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAMnC;IACC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,GAAG,KAAK,CAAC;IACxE,IACE,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;QACxC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB;QACxD,QAAQ,CAAC,eAAe,KAAK,iBAAiB,CAAC,WAAW;QAC1D,QAAQ,CAAC,sBAAsB,KAAK,wBAAwB,CAAC,UAAU;QACvE,QAAQ,CAAC,uBAAuB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,KAAK;QACrE,QAAQ,CAAC,2BAA2B,KAAK,iBAAiB,CAAC,YAAY,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAGrC;IACC,uCAAuC,CACrC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EACnC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACF,OAAO;QACL,MAAM,wCAAwC,CAAC;YAC7C,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;SACnC,CAAC;QACF,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAGrB;IACC,uCAAuC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,OAAO,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAWzD;IACC,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,uCAAuC,CACrC,KAAK,CAAC,wBAAwB,EAC9B,QAAQ,CAAC,oBAAoB,CAC9B,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CACrC,QAAQ,CAAC,sBAAsB,EAC/B,0BAA0B,CAC3B,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CACpC,QAAQ,CAAC,qBAAqB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,qBAAqB,GAAG,eAAe,CAC3C,QAAQ,CAAC,6BAA6B,EACtC,iCAAiC,CAClC,CAAC;IACF,MAAM,oBAAoB,GAAG,eAAe,CAC1C,QAAQ,CAAC,2BAA2B,EACpC,+BAA+B,CAChC,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,wBAAwB,EACjC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,EAC7C,6BAA6B,CAC9B,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,uBAAuB,EAChC,KAAK,CAAC,yBAAyB,CAAC,UAAU,EAC1C,4BAA4B,CAC7B,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,+BAA+B,EACxC,KAAK,CAAC,oBAAoB,CAAC,aAAa,CAAC,WAAW,EACpD,oCAAoC,CACrC,CAAC;IACF,QAAQ,CACN,QAAQ,CAAC,6BAA6B,EACtC,KAAK,CAAC,+BAA+B,CAAC,UAAU,EAChD,kCAAkC,CACnC,CAAC;IAEF,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,eAAe,CAAC,MAAM,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAA4C;QACrD,iCAAiC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC1D,iCAAiC,CAAC,KAAK,CAAC,wBAAwB,CAAC;QACjE,GAAG,CAAC,MAAM,sBAAsB,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,aAAa;YAC7B,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC;YACX,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACrC,QAAQ,EAAE,cAAc;SACzB,CAAC;QACF,GAAG,CAAC,MAAM,sBAAsB,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,oBAAoB;YACpC,QAAQ,EAAE,qBAAqB;SAChC,CAAC,CAAC;QACH,YAAY,CAAC;YACX,IAAI,EAAE,KAAK,CAAC,+BAA+B;YAC3C,QAAQ,EAAE,oBAAoB;SAC/B,CAAC;KACH,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,sBAAsB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAGG;IAEH,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC1C,uCAAuC,CACrC,IAAI,EACJ,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAC7C,CAAC;QACF,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;YACzC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YAC7B,eAAe,EAAE,IAAI,CAAC,YAAY;YAClC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB;SAClD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerCreateWithMetadataDocumentResponse,\n  DocumentCreateResponse,\n  OrganizationProvisioningResponse,\n} from \"@tearleads/validators/response\";\nimport { locallyAcknowledgedContainerMutationHead } from \"../../data/containers/shared/mutationAcknowledgement\";\nimport { assertDocumentCreateResponseMatchesPlan } from \"../../data/documents/shared/responses\";\nimport type { AuthoredDiscoveryHead } from \"../../data/persistence/documents/documentDiscoveryEvidencePersistence\";\nimport {\n  type LocallyAcknowledgedAccessManifestHead,\n  locallyAuthoredAccessManifestHead,\n} from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\n\ntype ContainerPlan = Parameters<\n  typeof locallyAcknowledgedContainerMutationHead\n>[0][\"plan\"];\ntype DocumentPlan = Parameters<\n  typeof assertDocumentCreateResponseMatchesPlan\n>[0];\n\ninterface ProvisioningContainerArtifact {\n  readonly containerPlan: ContainerPlan;\n  readonly metadataDocumentPlan: DocumentPlan;\n}\n\nfunction requireResponse<T>(value: T | undefined, label: string): T {\n  if (!value) {\n    throw new Error(`Organization provisioning response is missing ${label}`);\n  }\n  return value;\n}\n\nfunction assertId(\n  actual: string | undefined,\n  expected: string,\n  label: string,\n): void {\n  if (actual !== expected) {\n    throw new Error(`Organization provisioning response ${label} mismatch`);\n  }\n}\n\nfunction assertProvisioningIdentity(input: {\n  expectedOrganizationId: string;\n  expectedUserId: string;\n  response: OrganizationProvisioningResponse;\n  rootContainerPlan: ContainerPlan;\n  rootMetadataDocumentPlan: DocumentPlan;\n}): void {\n  const { response, rootContainerPlan, rootMetadataDocumentPlan } = input;\n  if (\n    response.userId !== input.expectedUserId ||\n    response.organizationId !== input.expectedOrganizationId ||\n    response.rootContainerId !== rootContainerPlan.containerId ||\n    response.rootMetadataDocumentId !== rootMetadataDocumentPlan.documentId ||\n    response.rootMetadataAccessEpoch !== rootContainerPlan.manifest.epoch ||\n    response.rootMetadataAccessStateHash !== rootContainerPlan.manifestHash\n  ) {\n    throw new Error(\"Organization provisioning response identity mismatch\");\n  }\n}\n\nasync function containerArtifactHeads(input: {\n  artifact: ProvisioningContainerArtifact;\n  response: ContainerCreateWithMetadataDocumentResponse;\n}): Promise<LocallyAcknowledgedAccessManifestHead[]> {\n  assertDocumentCreateResponseMatchesPlan(\n    input.artifact.metadataDocumentPlan,\n    input.response.metadataDocument,\n  );\n  return [\n    await locallyAcknowledgedContainerMutationHead({\n      plan: input.artifact.containerPlan,\n      response: input.response.container,\n    }),\n    locallyAuthoredAccessManifestHead(input.artifact.metadataDocumentPlan),\n  ];\n}\n\nfunction documentHead(input: {\n  plan: DocumentPlan;\n  response: DocumentCreateResponse;\n}): LocallyAcknowledgedAccessManifestHead {\n  assertDocumentCreateResponseMatchesPlan(input.plan, input.response);\n  return locallyAuthoredAccessManifestHead(input.plan);\n}\n\nexport async function provisioningAcknowledgedAccessHeads(input: {\n  expectedOrganizationId: string;\n  expectedUserId: string;\n  organizationMetadata: ProvisioningContainerArtifact;\n  organizationProfileDocumentPlan: DocumentPlan;\n  response: OrganizationProvisioningResponse;\n  rootContainerPlan: ContainerPlan;\n  rootMetadataDocumentPlan: DocumentPlan;\n  rosterProfile: ProvisioningContainerArtifact;\n  rosterProfileDocumentPlan: DocumentPlan;\n  systemContainers: readonly ProvisioningContainerArtifact[];\n}): Promise<LocallyAcknowledgedAccessManifestHead[]> {\n  assertProvisioningIdentity(input);\n  const response = input.response;\n  assertDocumentCreateResponseMatchesPlan(\n    input.rootMetadataDocumentPlan,\n    response.rootMetadataDocument,\n  );\n  const rosterContainer = requireResponse(\n    response.rosterProfileContainer,\n    \"roster profile container\",\n  );\n  const rosterDocument = requireResponse(\n    response.rosterProfileDocument,\n    \"roster profile document\",\n  );\n  const organizationContainer = requireResponse(\n    response.organizationMetadataContainer,\n    \"organization metadata container\",\n  );\n  const organizationDocument = requireResponse(\n    response.organizationProfileDocument,\n    \"organization profile document\",\n  );\n  assertId(\n    response.rosterProfileContainerId,\n    input.rosterProfile.containerPlan.containerId,\n    \"roster profile container id\",\n  );\n  assertId(\n    response.rosterProfileDocumentId,\n    input.rosterProfileDocumentPlan.documentId,\n    \"roster profile document id\",\n  );\n  assertId(\n    response.organizationMetadataContainerId,\n    input.organizationMetadata.containerPlan.containerId,\n    \"organization metadata container id\",\n  );\n  assertId(\n    response.organizationProfileDocumentId,\n    input.organizationProfileDocumentPlan.documentId,\n    \"organization profile document id\",\n  );\n\n  const systemResponses = response.systemContainers;\n  if (systemResponses.length !== input.systemContainers.length) {\n    throw new Error(\n      \"Organization provisioning response system container count mismatch\",\n    );\n  }\n  const heads: LocallyAcknowledgedAccessManifestHead[] = [\n    locallyAuthoredAccessManifestHead(input.rootContainerPlan),\n    locallyAuthoredAccessManifestHead(input.rootMetadataDocumentPlan),\n    ...(await containerArtifactHeads({\n      artifact: input.rosterProfile,\n      response: rosterContainer,\n    })),\n    documentHead({\n      plan: input.rosterProfileDocumentPlan,\n      response: rosterDocument,\n    }),\n    ...(await containerArtifactHeads({\n      artifact: input.organizationMetadata,\n      response: organizationContainer,\n    })),\n    documentHead({\n      plan: input.organizationProfileDocumentPlan,\n      response: organizationDocument,\n    }),\n  ];\n  for (const [index, artifact] of input.systemContainers.entries()) {\n    const systemResponse = systemResponses[index];\n    if (!systemResponse) {\n      throw new Error(\"Organization provisioning system response is missing\");\n    }\n    heads.push(\n      ...(await containerArtifactHeads({ artifact, response: systemResponse })),\n    );\n  }\n  return heads;\n}\n\n/**\n * The signed heads of the seeded profile documents, for the discovery head\n * cache. Each plan was checked against its create acknowledgement by\n * {@link provisioningAcknowledgedAccessHeads}; checking again here keeps the\n * cache entry bound to exactly the head the server returned.\n */\nexport function provisioningDiscoveryHeads(\n  documents: readonly {\n    plan: DocumentPlan;\n    response: DocumentCreateResponse | undefined;\n  }[],\n): AuthoredDiscoveryHead[] {\n  return documents.map(({ plan, response }) => {\n    assertDocumentCreateResponseMatchesPlan(\n      plan,\n      requireResponse(response, \"seeded document\"),\n    );\n    return {\n      documentId: plan.documentId,\n      organizationId: plan.state.organizationId,\n      accessEpoch: plan.state.epoch,\n      accessStateHash: plan.manifestHash,\n      linkedContainerIds: plan.state.linkedContainerIds,\n    };\n  });\n}\n"]}

package/workflows/registration/registerIdentity.d.ts

@@ -6,6 +6,7 @@ import type { ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
 import type { LocalUserIdentityCandidate } from "../../data/trustedUserIdentity/index.js";
 import type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
 import { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
+import type { ProvisionedPrincipalHistoryPrimer } from "./provisionedPrincipalHistory.js";
 import { type ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
 export type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
 export type { ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
@@ -35,6 +36,8 @@ export interface RegisterIdentityInput {
      */
     organizationProfileName?: string | undefined;
     pinLocalUserIdentity: (userId: string, candidate: LocalUserIdentityCandidate) => Promise<void>;
+    /** Seeds verified recovery progress for the founding policy heads. */
+    primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;
     /**
      * App-owned system containers to provision atomically with the personal
      * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.

package/workflows/registration/registerIdentity.js

@@ -260,6 +260,7 @@ export async function registerIdentity(input) {
         log: input.log,
         logError: input.logError,
         organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,
+        primePrincipalHistory: input.primePrincipalHistory,
         response,
         rootContainer: artifacts.rootContainer,
         rootMetadataDocument: artifacts.rootMetadataDocument,

package/workflows/registration/registerIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"registerIdentity.js","sourceRoot":"","sources":["registerIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,yBAAyB,EACzB,uBAAuB,EAGvB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAG9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAC7F,OAAO,EACL,yCAAyC,EACzC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAI7E,OAAO,EAAE,oCAAoC,EAAE,CAAC;AA+FhD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,wBAAwB,GAAG,MAAM,aAAa,CAClD,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,aAAa,CACzD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,UAAU,GAAG;QACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,OAAgB;SACvB;KACF,CAAC;IACF,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CACjD,eAAe,CAAC,SAAS,EACzB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAC/B,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG;QACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,+BAA+B;YACrD,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,CAAC;QACX,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,wBAAwB;KACzB,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM,EAAE,EAAE;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;QAC7D,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE;YAC5D;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,OAAO;aACrB;SACF;QACD,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;QACpE,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,MAAM;aACpB;SACF;QACD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,qCAAqC,CAC3E;QACE,YAAY,EAAE,iBAAiB,CAAC,OAAO;QACvC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC7D,uBAAuB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;SAC/D,CAAC;QACF,aAAa,EAAE,kBAAkB,CAAC,OAAO;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACpE,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5D,MAAM,EACJ,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,GACnB,GAAG,MAAM,mCAAmC,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,+BAA+B;QAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC;QACnD,cAAc;QACd,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,MAAM,EACJ,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,GAAG,MAAM,4BAA4B,CAAC;QACrC,UAAU,EAAE,iBAAiB;QAC7B,MAAM;QACN,SAAS;QACT,+BAA+B,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,iBAAiB;QACjB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,6BAA6B,GACjC,MAAM,yCAAyC,CAAC;QAC9C,MAAM;QACN,WAAW,EAAE,+BAA+B;QAC5C,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACL,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,oCAAoC,CAAC;QACnC,MAAM;QACN,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;QACzD,IAAI;QACJ,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,SAAS;QACT,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;QAChD,cAAc;QACd,6BAA6B;QAC7B,aAAa;QACb,oBAAoB;QACpB,2BAA2B;QAC3B,sBAAsB;QACtB,yBAAyB;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE;YACT,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CACjD,SAAS,EACT,SAAS,CAAC,cAAc,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,cAAc,CAAC,gBAAgB,EACrC,KAAK,CAAC,oBAAoB,CAAC,SAAS,EACpC,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,SAAS,CAAC,yBAAyB,EACnC,SAAS,CAAC,oBAAoB,EAC9B,SAAS,CAAC,2BAA2B,EACrC,SAAS,CAAC,sBAAsB,CAAC,gBAAgB,EACjD,SAAS,CAAC,sBAAsB,CAAC,sBAAsB,EACvD,SAAS,CAAC,6BAA6B,CAAC,gBAAgB,EACxD,SAAS,CAAC,6BAA6B,CAAC,kCAAkC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,GAAG,CACrC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE;YAC1C,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { RegistrationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { encodeOrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type { LocalUserIdentityCandidate } from \"../../data/trustedUserIdentity\";\nimport { validateUserIdentityKeys } from \"../../data/trustedUserIdentity\";\nimport { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { groupPolicyMutationHead } from \"../organizations/groupPolicyMutationHead\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"../organizations/principalPolicy\";\nimport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nimport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nimport {\n  buildInitialOrganizationMetadataBootstrap,\n  buildInitialRootProvisioning,\n  buildInitialRosterProfileBootstrap,\n  buildInitialSystemContainerBootstrap,\n  type ProvisionedSystemContainerSpec,\n} from \"./provisioningBootstrapBuilders\";\nimport { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nexport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\nexport { persistOrganizationProvisioningState };\n\nexport interface RegistrationApi {\n  registerUser(\n    userId: string,\n    organizationId: string,\n    rootContainerId: string,\n    signingPublicKey: Uint8Array,\n    encapsulationPublicKey: Uint8Array,\n    initialAdminGroup: RegistrationRequest[\"initialAdminGroup\"],\n    initialMemberGroup: RegistrationRequest[\"initialMemberGroup\"],\n    initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"],\n    initialRootContainer: RegistrationRequest[\"initialRootContainer\"],\n    initialRootMetadataDocument: ProvisionedDocumentRequest,\n    initialRosterProfileContainer: RegistrationRequest[\"initialRosterProfileContainer\"],\n    initialRosterProfileDocument: ProvisionedDocumentRequest | undefined,\n    initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest,\n    initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined,\n    initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined,\n  ): Promise<RegistrationResponse | null>;\n}\n\ninterface OrganizationProvisioningPrincipalPolicies {\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  organizationId: string;\n  signingFingerprint: string;\n}\n\nexport interface RegisterIdentityInput {\n  apiClient: RegistrationApi;\n  containerId: string;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  /**\n   * Reports whether the identity that started this registration is still\n   * current. Forwarded to the bootstrap persist's in-mutex currency check,\n   * so an identity replaced while the persist waits for the mutation queue\n   * cannot write its bootstrap through a client the replacement owns.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /**\n   * Overrides the seeded personal-org profile name; defaults to \"Personal Org\".\n   */\n  organizationProfileName?: string | undefined;\n  pinLocalUserIdentity: (\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ) => Promise<void>;\n  /**\n   * App-owned system containers to provision atomically with the personal\n   * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname; defaults to \"You\". The\n   * demo host passes each pane's peer-labeled self name (\"Peer 1 (You)\").\n   */\n  rosterProfileNickname?: string | undefined;\n  signingKeyFingerprint?: string | null | undefined;\n  signingKeyPair: SigningKeyPair;\n}\n\n/**\n * The freshly built provisioning artifacts, shared by registration and\n * additional-organization creation. `registerIdentity` generates a new\n * `userId`; creating an additional organization reuses the caller's existing\n * one. Everything here is derived purely from the caller's key material, so it\n * is identical for both flows.\n */\nexport interface OrganizationProvisioningArtifactsInput {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the organization\n   * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and\n   * organization-metadata system containers.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  rootContainerId: string;\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}\n\nexport async function buildInitialOrganizationPolicyRequest(input: {\n  adminGroupId: string;\n  groupHeads: readonly ReferencedPrincipalHead[];\n  encapsulationPublicKey: Uint8Array;\n  memberGroupId: string;\n  organizationId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<RegistrationRequest[\"initialOrganizationPolicy\"]> {\n  const organizationKem = generateKemSeedAndKeyPair();\n  const signerUserKeyFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const userEncapsulationKeyFingerprint = await toFingerprint(\n    input.encapsulationPublicKey,\n  );\n  const projection = [\n    {\n      userId: input.userId,\n      role: \"admin\" as const,\n    },\n  ];\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    version: 2,\n    organizationId: input.organizationId,\n    adminGroupId: input.adminGroupId,\n    memberGroupId: input.memberGroupId,\n    groupHeads: input.groupHeads.map((head) => {\n      if (head.principalType !== \"group\") {\n        throw new Error(\"Organization directory can contain only group heads\");\n      }\n      return { ...head, principalType: \"group\" };\n    }),\n  });\n  const [memberEnvelope] = await wrapDekForRecipients(\n    organizationKem.secretKey,\n    [input.encapsulationPublicKey],\n  );\n\n  if (!memberEnvelope) {\n    throw new Error(\"Failed to wrap organization key for registering user\");\n  }\n  const memberEnvelopes = [\n    {\n      userId: input.userId,\n      memberKeyFingerprint: userEncapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),\n    },\n  ];\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.organizationId,\n      version: 1,\n      prevStateHash: null,\n      keyEpoch: 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: [{ userId: input.userId }],\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.userId,\n      signerUserKeyFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants: [],\n    memberEnvelopes,\n  };\n}\n\nasync function createOrganizationPrincipalPolicies(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationMetadataContainerId: string;\n  rootContainerId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<OrganizationProvisioningPrincipalPolicies> {\n  const organizationId = crypto.randomUUID();\n  const signingFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const initialAdminGroup = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      { containerId: input.rootContainerId, accessLevel: \"admin\" },\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"admin\",\n      },\n    ],\n    name: \"Admins\",\n    builtinRole: \"admins\",\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"read\",\n      },\n    ],\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest(\n    {\n      adminGroupId: initialAdminGroup.groupId,\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      groupHeads: await Promise.all([\n        groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),\n        groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),\n      ]),\n      memberGroupId: initialMemberGroup.groupId,\n      organizationId,\n      signingKeyPair: input.signingKeyPair,\n      userId: input.userId,\n    },\n  );\n\n  return {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  };\n}\n\nfunction requireOrganizationProvisioningAuthor(input: {\n  readonly organizationId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}) {\n  const author = resolveDocumentCreateAuthor({\n    auth: { organizationId: input.organizationId, userId: input.userId },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\n      `Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`,\n    );\n  }\n  return author;\n}\n\n/** Builds the signed artifacts shared by registration and org creation. */\nexport async function buildOrganizationProvisioningArtifacts(\n  input: OrganizationProvisioningArtifactsInput,\n): Promise<OrganizationProvisioningArtifacts> {\n  const bootstrap = await createInitialRootMetadataBootstrap(\n    input.rootContainerId,\n  );\n  const organizationMetadataContainerId = crypto.randomUUID();\n  const {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  } = await createOrganizationPrincipalPolicies({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationMetadataContainerId,\n    rootContainerId: input.rootContainerId,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n  const author = requireOrganizationProvisioningAuthor({\n    organizationId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n\n  const {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n  } = await buildInitialRootProvisioning({\n    adminGroup: initialAdminGroup,\n    author,\n    bootstrap,\n    recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    rootContainerId: input.rootContainerId,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({\n    author,\n    encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    initialAdminGroup,\n    rosterProfileNickname: input.rosterProfileNickname,\n    rootContainer,\n    rootContainerProjection,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const organizationMetadataBootstrap =\n    await buildInitialOrganizationMetadataBootstrap({\n      author,\n      containerId: organizationMetadataContainerId,\n      initialAdminGroup,\n      initialMemberGroup,\n      organizationProfileName: input.organizationProfileName,\n      rootContainer,\n      rootContainerProjection,\n      targetSecretKey: input.encapsulationKeyPair.secretKey,\n    });\n  const systemContainerBootstraps = await Promise.all(\n    (input.provisionedSystemContainers ?? []).map((spec) =>\n      buildInitialSystemContainerBootstrap({\n        author,\n        initialAdminGroup,\n        rootContainer,\n        rootContainerProjection,\n        signingPrivateKey: input.signingKeyPair.signingPrivateKey,\n        spec,\n        targetSecretKey: input.encapsulationKeyPair.secretKey,\n      }),\n    ),\n  );\n\n  return {\n    replacementAuthorization: null,\n    bootstrap,\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    initialRootContainer: rootContainer.plan.request,\n    organizationId,\n    organizationMetadataBootstrap,\n    rootContainer,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n    rosterProfileBootstrap,\n    systemContainerBootstraps,\n  };\n}\n\nexport async function registerIdentity(\n  input: RegisterIdentityInput,\n): Promise<RegistrationResponse | null> {\n  input.log?.(\"Registering identity...\");\n  await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingKeyFingerprint: input.signingKeyFingerprint,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    },\n  });\n\n  const newUserId = crypto.randomUUID();\n  const artifacts = await buildOrganizationProvisioningArtifacts({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId: input.containerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: newUserId,\n  });\n\n  const response = await input.apiClient.registerUser(\n    newUserId,\n    artifacts.organizationId,\n    input.containerId,\n    input.signingKeyPair.signingPublicKey,\n    input.encapsulationKeyPair.publicKey,\n    artifacts.initialAdminGroup,\n    artifacts.initialMemberGroup,\n    artifacts.initialOrganizationPolicy,\n    artifacts.initialRootContainer,\n    artifacts.rootMetadataDocumentRequest,\n    artifacts.rosterProfileBootstrap.containerRequest,\n    artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    artifacts.organizationMetadataBootstrap.containerRequest,\n    artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest,\n    artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n  );\n  if (!response) {\n    return null;\n  }\n  if (response.userId !== newUserId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Registration response user does not match the requested identity\",\n    );\n  }\n  // Pinned only once the server has confirmed this user, and before anything\n  // is persisted under it. The trust store binds each signing key to one user,\n  // so a pin for an id the server never accepted — a retry after a lost\n  // response, or a restored key that is already registered — would later\n  // refuse the key's real user at login. Like the persistence below, it is a\n  // durable write, so it is skipped once the registering identity has been\n  // replaced: the caller discards this result.\n  if (input.isIdentityCurrent?.() ?? true) {\n    await input.pinLocalUserIdentity(newUserId, {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  }\n\n  input.log?.(`Key registered (${response.userId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: input.containerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}
+{"version":3,"file":"registerIdentity.js","sourceRoot":"","sources":["registerIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,yBAAyB,EACzB,uBAAuB,EAGvB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAG9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAE7F,OAAO,EACL,yCAAyC,EACzC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAI7E,OAAO,EAAE,oCAAoC,EAAE,CAAC;AAiGhD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,wBAAwB,GAAG,MAAM,aAAa,CAClD,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,aAAa,CACzD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,UAAU,GAAG;QACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,OAAgB;SACvB;KACF,CAAC;IACF,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CACjD,eAAe,CAAC,SAAS,EACzB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAC/B,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG;QACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,+BAA+B;YACrD,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,CAAC;QACX,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,wBAAwB;KACzB,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM,EAAE,EAAE;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;QAC7D,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE;YAC5D;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,OAAO;aACrB;SACF;QACD,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;QACpE,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,MAAM;aACpB;SACF;QACD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,qCAAqC,CAC3E;QACE,YAAY,EAAE,iBAAiB,CAAC,OAAO;QACvC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC7D,uBAAuB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;SAC/D,CAAC;QACF,aAAa,EAAE,kBAAkB,CAAC,OAAO;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACpE,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5D,MAAM,EACJ,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,GACnB,GAAG,MAAM,mCAAmC,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,+BAA+B;QAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC;QACnD,cAAc;QACd,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,MAAM,EACJ,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,GAAG,MAAM,4BAA4B,CAAC;QACrC,UAAU,EAAE,iBAAiB;QAC7B,MAAM;QACN,SAAS;QACT,+BAA+B,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,iBAAiB;QACjB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,6BAA6B,GACjC,MAAM,yCAAyC,CAAC;QAC9C,MAAM;QACN,WAAW,EAAE,+BAA+B;QAC5C,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACL,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,oCAAoC,CAAC;QACnC,MAAM;QACN,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;QACzD,IAAI;QACJ,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,SAAS;QACT,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;QAChD,cAAc;QACd,6BAA6B;QAC7B,aAAa;QACb,oBAAoB;QACpB,2BAA2B;QAC3B,sBAAsB;QACtB,yBAAyB;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE;YACT,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CACjD,SAAS,EACT,SAAS,CAAC,cAAc,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,cAAc,CAAC,gBAAgB,EACrC,KAAK,CAAC,oBAAoB,CAAC,SAAS,EACpC,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,SAAS,CAAC,yBAAyB,EACnC,SAAS,CAAC,oBAAoB,EAC9B,SAAS,CAAC,2BAA2B,EACrC,SAAS,CAAC,sBAAsB,CAAC,gBAAgB,EACjD,SAAS,CAAC,sBAAsB,CAAC,sBAAsB,EACvD,SAAS,CAAC,6BAA6B,CAAC,gBAAgB,EACxD,SAAS,CAAC,6BAA6B,CAAC,kCAAkC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,GAAG,CACrC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE;YAC1C,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { RegistrationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { encodeOrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type { LocalUserIdentityCandidate } from \"../../data/trustedUserIdentity\";\nimport { validateUserIdentityKeys } from \"../../data/trustedUserIdentity\";\nimport { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { groupPolicyMutationHead } from \"../organizations/groupPolicyMutationHead\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"../organizations/principalPolicy\";\nimport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nimport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"./provisionedPrincipalHistory\";\nimport {\n  buildInitialOrganizationMetadataBootstrap,\n  buildInitialRootProvisioning,\n  buildInitialRosterProfileBootstrap,\n  buildInitialSystemContainerBootstrap,\n  type ProvisionedSystemContainerSpec,\n} from \"./provisioningBootstrapBuilders\";\nimport { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nexport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\nexport { persistOrganizationProvisioningState };\n\nexport interface RegistrationApi {\n  registerUser(\n    userId: string,\n    organizationId: string,\n    rootContainerId: string,\n    signingPublicKey: Uint8Array,\n    encapsulationPublicKey: Uint8Array,\n    initialAdminGroup: RegistrationRequest[\"initialAdminGroup\"],\n    initialMemberGroup: RegistrationRequest[\"initialMemberGroup\"],\n    initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"],\n    initialRootContainer: RegistrationRequest[\"initialRootContainer\"],\n    initialRootMetadataDocument: ProvisionedDocumentRequest,\n    initialRosterProfileContainer: RegistrationRequest[\"initialRosterProfileContainer\"],\n    initialRosterProfileDocument: ProvisionedDocumentRequest | undefined,\n    initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest,\n    initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined,\n    initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined,\n  ): Promise<RegistrationResponse | null>;\n}\n\ninterface OrganizationProvisioningPrincipalPolicies {\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  organizationId: string;\n  signingFingerprint: string;\n}\n\nexport interface RegisterIdentityInput {\n  apiClient: RegistrationApi;\n  containerId: string;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  /**\n   * Reports whether the identity that started this registration is still\n   * current. Forwarded to the bootstrap persist's in-mutex currency check,\n   * so an identity replaced while the persist waits for the mutation queue\n   * cannot write its bootstrap through a client the replacement owns.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /**\n   * Overrides the seeded personal-org profile name; defaults to \"Personal Org\".\n   */\n  organizationProfileName?: string | undefined;\n  pinLocalUserIdentity: (\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ) => Promise<void>;\n  /** Seeds verified recovery progress for the founding policy heads. */\n  primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n  /**\n   * App-owned system containers to provision atomically with the personal\n   * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname; defaults to \"You\". The\n   * demo host passes each pane's peer-labeled self name (\"Peer 1 (You)\").\n   */\n  rosterProfileNickname?: string | undefined;\n  signingKeyFingerprint?: string | null | undefined;\n  signingKeyPair: SigningKeyPair;\n}\n\n/**\n * The freshly built provisioning artifacts, shared by registration and\n * additional-organization creation. `registerIdentity` generates a new\n * `userId`; creating an additional organization reuses the caller's existing\n * one. Everything here is derived purely from the caller's key material, so it\n * is identical for both flows.\n */\nexport interface OrganizationProvisioningArtifactsInput {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the organization\n   * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and\n   * organization-metadata system containers.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  rootContainerId: string;\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}\n\nexport async function buildInitialOrganizationPolicyRequest(input: {\n  adminGroupId: string;\n  groupHeads: readonly ReferencedPrincipalHead[];\n  encapsulationPublicKey: Uint8Array;\n  memberGroupId: string;\n  organizationId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<RegistrationRequest[\"initialOrganizationPolicy\"]> {\n  const organizationKem = generateKemSeedAndKeyPair();\n  const signerUserKeyFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const userEncapsulationKeyFingerprint = await toFingerprint(\n    input.encapsulationPublicKey,\n  );\n  const projection = [\n    {\n      userId: input.userId,\n      role: \"admin\" as const,\n    },\n  ];\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    version: 2,\n    organizationId: input.organizationId,\n    adminGroupId: input.adminGroupId,\n    memberGroupId: input.memberGroupId,\n    groupHeads: input.groupHeads.map((head) => {\n      if (head.principalType !== \"group\") {\n        throw new Error(\"Organization directory can contain only group heads\");\n      }\n      return { ...head, principalType: \"group\" };\n    }),\n  });\n  const [memberEnvelope] = await wrapDekForRecipients(\n    organizationKem.secretKey,\n    [input.encapsulationPublicKey],\n  );\n\n  if (!memberEnvelope) {\n    throw new Error(\"Failed to wrap organization key for registering user\");\n  }\n  const memberEnvelopes = [\n    {\n      userId: input.userId,\n      memberKeyFingerprint: userEncapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),\n    },\n  ];\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.organizationId,\n      version: 1,\n      prevStateHash: null,\n      keyEpoch: 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: [{ userId: input.userId }],\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.userId,\n      signerUserKeyFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants: [],\n    memberEnvelopes,\n  };\n}\n\nasync function createOrganizationPrincipalPolicies(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationMetadataContainerId: string;\n  rootContainerId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<OrganizationProvisioningPrincipalPolicies> {\n  const organizationId = crypto.randomUUID();\n  const signingFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const initialAdminGroup = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      { containerId: input.rootContainerId, accessLevel: \"admin\" },\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"admin\",\n      },\n    ],\n    name: \"Admins\",\n    builtinRole: \"admins\",\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"read\",\n      },\n    ],\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest(\n    {\n      adminGroupId: initialAdminGroup.groupId,\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      groupHeads: await Promise.all([\n        groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),\n        groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),\n      ]),\n      memberGroupId: initialMemberGroup.groupId,\n      organizationId,\n      signingKeyPair: input.signingKeyPair,\n      userId: input.userId,\n    },\n  );\n\n  return {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  };\n}\n\nfunction requireOrganizationProvisioningAuthor(input: {\n  readonly organizationId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}) {\n  const author = resolveDocumentCreateAuthor({\n    auth: { organizationId: input.organizationId, userId: input.userId },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\n      `Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`,\n    );\n  }\n  return author;\n}\n\n/** Builds the signed artifacts shared by registration and org creation. */\nexport async function buildOrganizationProvisioningArtifacts(\n  input: OrganizationProvisioningArtifactsInput,\n): Promise<OrganizationProvisioningArtifacts> {\n  const bootstrap = await createInitialRootMetadataBootstrap(\n    input.rootContainerId,\n  );\n  const organizationMetadataContainerId = crypto.randomUUID();\n  const {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  } = await createOrganizationPrincipalPolicies({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationMetadataContainerId,\n    rootContainerId: input.rootContainerId,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n  const author = requireOrganizationProvisioningAuthor({\n    organizationId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n\n  const {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n  } = await buildInitialRootProvisioning({\n    adminGroup: initialAdminGroup,\n    author,\n    bootstrap,\n    recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    rootContainerId: input.rootContainerId,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({\n    author,\n    encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    initialAdminGroup,\n    rosterProfileNickname: input.rosterProfileNickname,\n    rootContainer,\n    rootContainerProjection,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const organizationMetadataBootstrap =\n    await buildInitialOrganizationMetadataBootstrap({\n      author,\n      containerId: organizationMetadataContainerId,\n      initialAdminGroup,\n      initialMemberGroup,\n      organizationProfileName: input.organizationProfileName,\n      rootContainer,\n      rootContainerProjection,\n      targetSecretKey: input.encapsulationKeyPair.secretKey,\n    });\n  const systemContainerBootstraps = await Promise.all(\n    (input.provisionedSystemContainers ?? []).map((spec) =>\n      buildInitialSystemContainerBootstrap({\n        author,\n        initialAdminGroup,\n        rootContainer,\n        rootContainerProjection,\n        signingPrivateKey: input.signingKeyPair.signingPrivateKey,\n        spec,\n        targetSecretKey: input.encapsulationKeyPair.secretKey,\n      }),\n    ),\n  );\n\n  return {\n    replacementAuthorization: null,\n    bootstrap,\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    initialRootContainer: rootContainer.plan.request,\n    organizationId,\n    organizationMetadataBootstrap,\n    rootContainer,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n    rosterProfileBootstrap,\n    systemContainerBootstraps,\n  };\n}\n\nexport async function registerIdentity(\n  input: RegisterIdentityInput,\n): Promise<RegistrationResponse | null> {\n  input.log?.(\"Registering identity...\");\n  await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingKeyFingerprint: input.signingKeyFingerprint,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    },\n  });\n\n  const newUserId = crypto.randomUUID();\n  const artifacts = await buildOrganizationProvisioningArtifacts({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId: input.containerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: newUserId,\n  });\n\n  const response = await input.apiClient.registerUser(\n    newUserId,\n    artifacts.organizationId,\n    input.containerId,\n    input.signingKeyPair.signingPublicKey,\n    input.encapsulationKeyPair.publicKey,\n    artifacts.initialAdminGroup,\n    artifacts.initialMemberGroup,\n    artifacts.initialOrganizationPolicy,\n    artifacts.initialRootContainer,\n    artifacts.rootMetadataDocumentRequest,\n    artifacts.rosterProfileBootstrap.containerRequest,\n    artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    artifacts.organizationMetadataBootstrap.containerRequest,\n    artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest,\n    artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n  );\n  if (!response) {\n    return null;\n  }\n  if (response.userId !== newUserId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Registration response user does not match the requested identity\",\n    );\n  }\n  // Pinned only once the server has confirmed this user, and before anything\n  // is persisted under it. The trust store binds each signing key to one user,\n  // so a pin for an id the server never accepted — a retry after a lost\n  // response, or a restored key that is already registered — would later\n  // refuse the key's real user at login. Like the persistence below, it is a\n  // durable write, so it is skipped once the registering identity has been\n  // replaced: the caller discards this result.\n  if (input.isIdentityCurrent?.() ?? true) {\n    await input.pinLocalUserIdentity(newUserId, {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  }\n\n  input.log?.(`Key registered (${response.userId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: input.containerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    primePrincipalHistory: input.primePrincipalHistory,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}

package/workflows/sync/remoteReset.js

@@ -4,7 +4,7 @@ import { deleteDocumentPlacementRowsByContainerIds, deleteDocumentPlacementRowsB
 import { clearDocumentDiscoveryEvidenceOnRemoteReset } from "../../data/persistence/documents/documentDiscoveryReset.js";
 import { documentIntentLinkTargets } from "../../data/sqlite/documentPlacementIntentSchema.js";
 import { organizationDataUsageCategories, organizationDataUsageSnapshots, } from "../../data/sqlite/organizationDataUsageSchema.js";
-import { organizationPresentationDenials, organizationReadModelContainerGrants, organizationReadModelDirectoryUsers, organizationReadModelGroupMembers, organizationReadModelGroupMemberships, organizationReadModelGroups, organizationReadModelPolicyHeads, organizationReadModelRequesters, organizationReadModelState, } from "../../data/sqlite/organizationReadModelSchema.js";
+import { organizationPresentationDenials, organizationReadModelContainerGrants, organizationReadModelDirectoryUsers, organizationReadModelGroupMembers, organizationReadModelGroups, organizationReadModelRequesters, organizationReadModelState, } from "../../data/sqlite/organizationReadModelSchema.js";
 import { clientSqlTables, containerCreateIntents, containerHydrationTombstones, containerMoveIntents, containers, documentAttachmentBlobProjection, documentMoveIntents, documentPendingAttachments, documentPendingUpdates, documentProjection, documentSyncFailures, documents, dormantContainerMetadata, dormantMetadataSweepRequests, } from "../../data/sqlite/schema.js";
 import { getClientSQLitePersistenceRuntime, } from "../../data/sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../data/sqlite/sqlTableSchema.js";
@@ -22,10 +22,8 @@ async function clearOrganizationPresentationRows(tx, organizationId) {
         organizationDataUsageSnapshots,
         organizationReadModelContainerGrants,
         organizationReadModelGroupMembers,
-        organizationReadModelGroupMemberships,
         organizationReadModelDirectoryUsers,
         organizationReadModelGroups,
-        organizationReadModelPolicyHeads,
         organizationReadModelRequesters,
         organizationReadModelState,
         organizationPresentationDenials,

package/workflows/sync/remoteReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,qCAAqC,EACrC,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,UAAU,EACV,gCAAgC,EAChC,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,+BAA+B;QAC/B,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,qCAAqC;QACrC,mCAAmC;QACnC,2BAA2B;QAC3B,gCAAgC;QAChC,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,oBAAoB,CAAC;aAC5B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aAClE,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAC7D,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE;aACL,MAAM,CAAC,mBAAmB,CAAC;aAC3B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACzD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3B,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAC/C,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAChD,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE;aACL,MAAM,CAAC,oBAAoB,CAAC;aAC5B,KAAK,CACJ,EAAE,CACA,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3B,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAC7C,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAC9C,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;KACpB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,MAAM;YACT,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/documentPlacementIntentSchema\";\nimport {\n  organizationDataUsageCategories,\n  organizationDataUsageSnapshots,\n} from \"../../data/sqlite/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroupMemberships,\n  organizationReadModelGroups,\n  organizationReadModelPolicyHeads,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/organizationReadModelSchema\";\nimport {\n  clientSqlTables,\n  containerCreateIntents,\n  containerHydrationTombstones,\n  containerMoveIntents,\n  containers,\n  documentAttachmentBlobProjection,\n  documentMoveIntents,\n  documentPendingAttachments,\n  documentPendingUpdates,\n  documentProjection,\n  documentSyncFailures,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n} from \"../../data/sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageCategories,\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelGroupMemberships,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelPolicyHeads,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(containerMoveIntents)\n      .where(inArray(containerMoveIntents.containerId, containerBatch))\n      .run();\n    await input.tx\n      .delete(containerCreateIntents)\n      .where(inArray(containerCreateIntents.containerId, containerBatch))\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: documentMoveIntents.id })\n            .from(documentMoveIntents)\n            .where(inArray(documentMoveIntents.localId, localIdBatch)),\n        ),\n      )\n      .run();\n    await tx\n      .delete(documentMoveIntents)\n      .where(inArray(documentMoveIntents.localId, localIdBatch))\n      .run();\n  }\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await tx\n      .delete(documentPendingUpdates)\n      .where(\n        or(\n          ...documentBatch.map((row) =>\n            and(\n              eq(documentPendingUpdates.appKind, row.appKind),\n              eq(documentPendingUpdates.localId, row.localId),\n            ),\n          ),\n        ),\n      )\n      .run();\n    await tx\n      .delete(documentSyncFailures)\n      .where(\n        or(\n          ...documentBatch.map((row) =>\n            and(\n              eq(documentSyncFailures.appKind, row.appKind),\n              eq(documentSyncFailures.localId, row.localId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentPendingUpdates)\n      .values(\n        updateBatch.map((update) => ({\n          ...update,\n          id: crypto.randomUUID(),\n          createdAt: input.now,\n        })),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(containerCreateIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          containerId: row.id,\n          parentContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}
+{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,UAAU,EACV,gCAAgC,EAChC,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,+BAA+B;QAC/B,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,mCAAmC;QACnC,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,oBAAoB,CAAC;aAC5B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aAClE,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAC7D,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE;aACL,MAAM,CAAC,mBAAmB,CAAC;aAC3B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACzD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,EAAE,CACA,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3B,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAC/C,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAChD,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE;aACL,MAAM,CAAC,oBAAoB,CAAC;aAC5B,KAAK,CACJ,EAAE,CACA,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3B,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAC7C,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAC9C,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;KACpB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,MAAM;YACT,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/documentPlacementIntentSchema\";\nimport {\n  organizationDataUsageCategories,\n  organizationDataUsageSnapshots,\n} from \"../../data/sqlite/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/organizationReadModelSchema\";\nimport {\n  clientSqlTables,\n  containerCreateIntents,\n  containerHydrationTombstones,\n  containerMoveIntents,\n  containers,\n  documentAttachmentBlobProjection,\n  documentMoveIntents,\n  documentPendingAttachments,\n  documentPendingUpdates,\n  documentProjection,\n  documentSyncFailures,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n} from \"../../data/sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageCategories,\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(containerMoveIntents)\n      .where(inArray(containerMoveIntents.containerId, containerBatch))\n      .run();\n    await input.tx\n      .delete(containerCreateIntents)\n      .where(inArray(containerCreateIntents.containerId, containerBatch))\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: documentMoveIntents.id })\n            .from(documentMoveIntents)\n            .where(inArray(documentMoveIntents.localId, localIdBatch)),\n        ),\n      )\n      .run();\n    await tx\n      .delete(documentMoveIntents)\n      .where(inArray(documentMoveIntents.localId, localIdBatch))\n      .run();\n  }\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await tx\n      .delete(documentPendingUpdates)\n      .where(\n        or(\n          ...documentBatch.map((row) =>\n            and(\n              eq(documentPendingUpdates.appKind, row.appKind),\n              eq(documentPendingUpdates.localId, row.localId),\n            ),\n          ),\n        ),\n      )\n      .run();\n    await tx\n      .delete(documentSyncFailures)\n      .where(\n        or(\n          ...documentBatch.map((row) =>\n            and(\n              eq(documentSyncFailures.appKind, row.appKind),\n              eq(documentSyncFailures.localId, row.localId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentPendingUpdates)\n      .values(\n        updateBatch.map((update) => ({\n          ...update,\n          id: crypto.randomUUID(),\n          createdAt: input.now,\n        })),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(containerCreateIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          containerId: row.id,\n          parentContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}

package/data/persistence/organizations/organizationReadModelPolicyHeadPersistence.js

@@ -1,64 +0,0 @@
-import { and, eq } from "drizzle-orm";
-import { organizationReadModelPolicyHeads } from "../../sqlite/organizationReadModelSchema.js";
-const POLICY_HEAD_INSERT_BATCH_SIZE = 100;
-function toPolicyHeadRow(input) {
-    return {
-        organizationId: input.organizationId,
-        principalType: input.principalType,
-        principalId: input.principalId,
-        stateHash: input.currentState.stateHash,
-        stateVersion: input.currentState.version,
-        keyEpoch: input.currentState.keyEpoch,
-        keyFingerprint: input.currentState.keyFingerprint,
-        memberCount: input.currentState.memberCount,
-    };
-}
-export async function replaceGroupPolicyHeads(input) {
-    await input.tx
-        .delete(organizationReadModelPolicyHeads)
-        .where(and(eq(organizationReadModelPolicyHeads.organizationId, input.organizationId), eq(organizationReadModelPolicyHeads.principalType, "group")))
-        .run();
-    const rows = input.groups.groups.flatMap((group) => group.currentState
-        ? [
-            toPolicyHeadRow({
-                currentState: group.currentState,
-                organizationId: input.organizationId,
-                principalId: group.groupId,
-                principalType: "group",
-            }),
-        ]
-        : []);
-    for (let index = 0; index < rows.length; index += POLICY_HEAD_INSERT_BATCH_SIZE) {
-        await input.tx
-            .insert(organizationReadModelPolicyHeads)
-            .values(rows.slice(index, index + POLICY_HEAD_INSERT_BATCH_SIZE))
-            .run();
-    }
-}
-export async function applyOrganizationPolicyLane(input) {
-    const row = toPolicyHeadRow({
-        currentState: input.organizationPolicy.currentState,
-        organizationId: input.organizationId,
-        principalId: input.organizationId,
-        principalType: "organization",
-    });
-    await input.tx
-        .insert(organizationReadModelPolicyHeads)
-        .values(row)
-        .onConflictDoUpdate({
-        target: [
-            organizationReadModelPolicyHeads.organizationId,
-            organizationReadModelPolicyHeads.principalType,
-            organizationReadModelPolicyHeads.principalId,
-        ],
-        set: {
-            stateHash: row.stateHash,
-            stateVersion: row.stateVersion,
-            keyEpoch: row.keyEpoch,
-            keyFingerprint: row.keyFingerprint,
-            memberCount: row.memberCount,
-        },
-    })
-        .run();
-}
-//# sourceMappingURL=organizationReadModelPolicyHeadPersistence.js.map

package/data/persistence/organizations/organizationReadModelPolicyHeadPersistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organizationReadModelPolicyHeadPersistence.js","sourceRoot":"","sources":["organizationReadModelPolicyHeadPersistence.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAI5F,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAE1C,SAAS,eAAe,CAAC,KAKxB;IACC,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO;QACxC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ;QACrC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,cAAc;QACjD,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,gCAAgC,CAAC;SACxC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,gCAAgC,CAAC,cAAc,EAC/C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CAAC,gCAAgC,CAAC,aAAa,EAAE,OAAO,CAAC,CAC5D,CACF;SACA,GAAG,EAAE,CAAC;IAET,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACjD,KAAK,CAAC,YAAY;QAChB,CAAC,CAAC;YACE,eAAe,CAAC;gBACd,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,aAAa,EAAE,OAAO;aACvB,CAAC;SACH;QACH,CAAC,CAAC,EAAE,CACP,CAAC;IACF,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,IAAI,CAAC,MAAM,EACnB,KAAK,IAAI,6BAA6B,EACtC,CAAC;QACD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,6BAA6B,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,YAAY;QACnD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,gCAAgC,CAAC;SACxC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,gCAAgC,CAAC,cAAc;YAC/C,gCAAgC,CAAC,aAAa;YAC9C,gCAAgC,CAAC,WAAW;SAC7C;QACD,GAAG,EAAE;YACH,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B;KACF,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC","sourcesContent":["import type {\n  ListOrganizationGroupsResponse,\n  OrganizationGroupCurrentStateResponse,\n  OrganizationReadModelOrganizationPolicyResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport { organizationReadModelPolicyHeads } from \"../../sqlite/organizationReadModelSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport type { OrganizationReadModelPolicyHead } from \"./organizationReadModelProjection\";\n\nconst POLICY_HEAD_INSERT_BATCH_SIZE = 100;\n\nfunction toPolicyHeadRow(input: {\n  readonly currentState: OrganizationGroupCurrentStateResponse;\n  readonly organizationId: string;\n  readonly principalId: string;\n  readonly principalType: OrganizationReadModelPolicyHead[\"principalType\"];\n}) {\n  return {\n    organizationId: input.organizationId,\n    principalType: input.principalType,\n    principalId: input.principalId,\n    stateHash: input.currentState.stateHash,\n    stateVersion: input.currentState.version,\n    keyEpoch: input.currentState.keyEpoch,\n    keyFingerprint: input.currentState.keyFingerprint,\n    memberCount: input.currentState.memberCount,\n  };\n}\n\nexport async function replaceGroupPolicyHeads(input: {\n  readonly groups: ListOrganizationGroupsResponse;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelPolicyHeads)\n    .where(\n      and(\n        eq(\n          organizationReadModelPolicyHeads.organizationId,\n          input.organizationId,\n        ),\n        eq(organizationReadModelPolicyHeads.principalType, \"group\"),\n      ),\n    )\n    .run();\n\n  const rows = input.groups.groups.flatMap((group) =>\n    group.currentState\n      ? [\n          toPolicyHeadRow({\n            currentState: group.currentState,\n            organizationId: input.organizationId,\n            principalId: group.groupId,\n            principalType: \"group\",\n          }),\n        ]\n      : [],\n  );\n  for (\n    let index = 0;\n    index < rows.length;\n    index += POLICY_HEAD_INSERT_BATCH_SIZE\n  ) {\n    await input.tx\n      .insert(organizationReadModelPolicyHeads)\n      .values(rows.slice(index, index + POLICY_HEAD_INSERT_BATCH_SIZE))\n      .run();\n  }\n}\n\nexport async function applyOrganizationPolicyLane(input: {\n  readonly organizationId: string;\n  readonly organizationPolicy: OrganizationReadModelOrganizationPolicyResponse;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const row = toPolicyHeadRow({\n    currentState: input.organizationPolicy.currentState,\n    organizationId: input.organizationId,\n    principalId: input.organizationId,\n    principalType: \"organization\",\n  });\n  await input.tx\n    .insert(organizationReadModelPolicyHeads)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        organizationReadModelPolicyHeads.organizationId,\n        organizationReadModelPolicyHeads.principalType,\n        organizationReadModelPolicyHeads.principalId,\n      ],\n      set: {\n        stateHash: row.stateHash,\n        stateVersion: row.stateVersion,\n        keyEpoch: row.keyEpoch,\n        keyFingerprint: row.keyFingerprint,\n        memberCount: row.memberCount,\n      },\n    })\n    .run();\n}\n"]}