@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/documents/syncRekeys/syncRecoveryRekey.js

@@ -0,0 +1,120 @@
+import { base64ToBytes } from "../../../internal/encoding/index.js";
+import { MAX_PENDING_UPDATE_REKEYS, rekeyDocumentPendingUpdate, } from "../../../data/sqlite/documentPersistence.js";
+import { getClientSQLitePersistenceRuntime } from "../../../data/sqlite/sqlitePersistenceRuntime.js";
+import { runSerializedSqlMutation, } from "../../../data/sqlite/sqlSchema.js";
+function bytesEqual(left, right) {
+    return (left.byteLength === right.byteLength &&
+        left.every((value, index) => value === right[index]));
+}
+function pendingUpdateMatchesDecryptedUpdate(pendingUpdate, decryptedUpdate) {
+    if (pendingUpdate.partialStartVersionVector !==
+        decryptedUpdate.partialStartVersionVector ||
+        pendingUpdate.partialEndVersionVector !==
+            decryptedUpdate.partialEndVersionVector) {
+        return false;
+    }
+    return bytesEqual(base64ToBytes(pendingUpdate.updateData), decryptedUpdate.updateData);
+}
+export function settledPendingUpdateIdsFromSync(input) {
+    const settled = new Set(input.response.acceptedOutgoingUpdateIds);
+    for (const update of input.decryptedUpdates) {
+        const pendingUpdate = input.recoveryPendingUpdatesById.get(update.id);
+        if (pendingUpdate &&
+            pendingUpdateMatchesDecryptedUpdate(pendingUpdate, update)) {
+            settled.add(update.id);
+        }
+    }
+    return [...settled];
+}
+/**
+ * A read-only recovery sync settles a conflicted pending update only when the
+ * response carries it — but the server's frontier filter omits spans the
+ * request's localVersionVector already covers, which a locally-applied
+ * pending update always is. Left alone, the conflicted id is resubmitted (and
+ * 409s the whole outgoing batch) forever: a lost ack leaves the server
+ * holding the original ciphertext, and every rebuild encrypts with a fresh
+ * IV, so a byte-identical retry can never be reproduced. Re-key what
+ * recovery could not settle so the next sync pass submits the same ops under
+ * a conflict-free id; the server-side copy stays harmless because CRDT
+ * update import is idempotent.
+ *
+ * Re-keying goes through the caller's persistence implementation when given
+ * (defaulting to the built-in pending-update table) and reports only ids
+ * whose row actually changed, so a record living in some other queue never
+ * counts as progress. Returns the fresh ids so callers can treat re-keying
+ * as settlement-like progress and schedule the pass that submits them.
+ *
+ * A row whose persisted rekeyCount has reached the bound is not re-keyed
+ * again: it is reported as exhausted so the caller can surface a terminal
+ * failure instead of feeding an unbounded conflict loop that survives
+ * restarts (each session's in-memory lane cap resets, this bound does not).
+ */
+export async function rekeyUnsettledRecoveryPendingUpdates(input) {
+    const rekeyPendingUpdate = input.rekeyPendingUpdate ?? rekeyDocumentPendingUpdate;
+    const settled = new Set(input.settledPendingUpdateIds);
+    const rekeyedPendingUpdateIds = [];
+    const exhaustedPendingUpdateIds = [];
+    for (const [pendingUpdateId, record] of input.recoveryPendingUpdatesById) {
+        if (input.stillCurrent?.() === false)
+            break;
+        if (settled.has(pendingUpdateId)) {
+            continue;
+        }
+        // Known multi-tab limitation: the count is the row as loaded at pass
+        // start, so a sibling tab that settle-deleted the row can make this
+        // record a failure for work that no longer exists. The stale failure is
+        // transient — the document's next clean pass clears it.
+        if ((record.rekeyCount ?? 0) >= MAX_PENDING_UPDATE_REKEYS) {
+            exhaustedPendingUpdateIds.push(pendingUpdateId);
+            continue;
+        }
+        const outcome = await runSerializedSqlMutation(input.execSql, (lockedExecSql) => getClientSQLitePersistenceRuntime(lockedExecSql).guardedTransaction(async () => input.stillCurrent?.() === false
+            ? null
+            : rekeyPendingUpdate(lockedExecSql, pendingUpdateId), () => input.stillCurrent?.() !== false));
+        if (!outcome.committed)
+            break;
+        const nextId = outcome.result;
+        if (nextId !== null) {
+            rekeyedPendingUpdateIds.push(nextId);
+        }
+    }
+    if (input.stillCurrent?.() === false) {
+        return { exhaustedPendingUpdateIds: [], rekeyedPendingUpdateIds: [] };
+    }
+    return { exhaustedPendingUpdateIds, rekeyedPendingUpdateIds };
+}
+/**
+ * Re-key what recovery could not settle and surface exhausted rows through
+ * the caller's terminal-failure handler. The exhausted count is also
+ * returned so the sync result can carry it: a pass that recorded this
+ * failure must not read as clean to callers that clear recorded failures
+ * on success.
+ */
+export async function rekeyAndReportUnsettledRecoveryPendingUpdates(input) {
+    const { exhaustedPendingUpdateIds, rekeyedPendingUpdateIds } = await rekeyUnsettledRecoveryPendingUpdates(input);
+    if (input.stillCurrent?.() === false) {
+        return { exhaustedPendingUpdateCount: 0, rekeyedPendingUpdateIds: [] };
+    }
+    if (exhaustedPendingUpdateIds.length > 0) {
+        await input.onTerminalSubmitFailure?.(rekeyLimitSubmitFailure(exhaustedPendingUpdateIds.length));
+    }
+    return {
+        exhaustedPendingUpdateCount: exhaustedPendingUpdateIds.length,
+        rekeyedPendingUpdateIds,
+    };
+}
+/**
+ * Terminal failure recorded when conflict recovery gives up on pending
+ * updates whose persisted re-key bound is exhausted. Shaped like a submit
+ * failure so the existing write-queue surface (recordDocumentSyncFailure via
+ * onTerminalSubmitFailure) explains the stuck write without new plumbing.
+ */
+export function rekeyLimitSubmitFailure(exhaustedCount) {
+    return {
+        message: `Update conflict recovery gave up after ${MAX_PENDING_UPDATE_REKEYS} re-key attempts (${exhaustedCount} update${exhaustedCount === 1 ? "" : "s"})`,
+        ok: false,
+        report: () => { },
+        status: null,
+    };
+}
+//# sourceMappingURL=syncRecoveryRekey.js.map

package/workflows/documents/syncRekeys/syncRecoveryRekey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncRecoveryRekey.js","sourceRoot":"","sources":["syncRecoveryRekey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EACL,yBAAyB,EAEzB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAEL,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAcxC,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,OAAO,CACL,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACpC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAC1C,aAAkC,EAClC,eAAgD;IAEhD,IACE,aAAa,CAAC,yBAAyB;QACrC,eAAe,CAAC,yBAAyB;QAC3C,aAAa,CAAC,uBAAuB;YACnC,eAAe,CAAC,uBAAuB,EACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,UAAU,CACf,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,EACvC,eAAe,CAAC,UAAU,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,IACE,aAAa;YACb,mCAAmC,CAAC,aAAa,EAAE,MAAM,CAAC,EAC1D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAM1D;IAIC,MAAM,kBAAkB,GACtB,KAAK,CAAC,kBAAkB,IAAI,0BAA0B,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,uBAAuB,GAAa,EAAE,CAAC;IAC7C,MAAM,yBAAyB,GAAa,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,MAAM;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;YAC1D,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C,KAAK,CAAC,OAAO,EACb,CAAC,aAAa,EAAE,EAAE,CAChB,iCAAiC,CAAC,aAAa,CAAC,CAAC,kBAAkB,CACjE,KAAK,IAAI,EAAE,CACT,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAC9B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,kBAAkB,CAAC,aAAa,EAAE,eAAe,CAAC,EACxD,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACvC,CACJ,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,KAIC;IAKD,MAAM,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,GAC1D,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,uBAAuB,EAAE,CACnC,uBAAuB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,2BAA2B,EAAE,yBAAyB,CAAC,MAAM;QAC7D,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,cAAsB;IAEtB,OAAO;QACL,OAAO,EAAE,0CAA0C,yBAAyB,qBAAqB,cAAc,UAAU,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;QAC3J,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;QAChB,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type { DocumentSyncSubmitFailure } from \"../../../data/documents/shared/types\";\nimport {\n  MAX_PENDING_UPDATE_REKEYS,\n  type PendingUpdateRecord,\n  rekeyDocumentPendingUpdate,\n} from \"../../../data/sqlite/documentPersistence\";\nimport { getClientSQLitePersistenceRuntime } from \"../../../data/sqlite/sqlitePersistenceRuntime\";\nimport {\n  type ExecSql,\n  runSerializedSqlMutation,\n} from \"../../../data/sqlite/sqlSchema\";\n\nexport type RekeyPendingUpdate = (\n  execSql: ExecSql,\n  id: string,\n) => Promise<string | null>;\n\ninterface DecryptedSyncUpdate {\n  id: string;\n  partialEndVersionVector: string;\n  partialStartVersionVector: string;\n  updateData: Uint8Array;\n}\n\nfunction bytesEqual(left: Uint8Array, right: Uint8Array): boolean {\n  return (\n    left.byteLength === right.byteLength &&\n    left.every((value, index) => value === right[index])\n  );\n}\n\nfunction pendingUpdateMatchesDecryptedUpdate(\n  pendingUpdate: PendingUpdateRecord,\n  decryptedUpdate: Omit<DecryptedSyncUpdate, \"id\">,\n): boolean {\n  if (\n    pendingUpdate.partialStartVersionVector !==\n      decryptedUpdate.partialStartVersionVector ||\n    pendingUpdate.partialEndVersionVector !==\n      decryptedUpdate.partialEndVersionVector\n  ) {\n    return false;\n  }\n\n  return bytesEqual(\n    base64ToBytes(pendingUpdate.updateData),\n    decryptedUpdate.updateData,\n  );\n}\n\nexport function settledPendingUpdateIdsFromSync(input: {\n  decryptedUpdates: readonly DecryptedSyncUpdate[];\n  recoveryPendingUpdatesById: ReadonlyMap<string, PendingUpdateRecord>;\n  response: DocumentSyncResponse;\n}): string[] {\n  const settled = new Set(input.response.acceptedOutgoingUpdateIds);\n\n  for (const update of input.decryptedUpdates) {\n    const pendingUpdate = input.recoveryPendingUpdatesById.get(update.id);\n    if (\n      pendingUpdate &&\n      pendingUpdateMatchesDecryptedUpdate(pendingUpdate, update)\n    ) {\n      settled.add(update.id);\n    }\n  }\n\n  return [...settled];\n}\n\n/**\n * A read-only recovery sync settles a conflicted pending update only when the\n * response carries it — but the server's frontier filter omits spans the\n * request's localVersionVector already covers, which a locally-applied\n * pending update always is. Left alone, the conflicted id is resubmitted (and\n * 409s the whole outgoing batch) forever: a lost ack leaves the server\n * holding the original ciphertext, and every rebuild encrypts with a fresh\n * IV, so a byte-identical retry can never be reproduced. Re-key what\n * recovery could not settle so the next sync pass submits the same ops under\n * a conflict-free id; the server-side copy stays harmless because CRDT\n * update import is idempotent.\n *\n * Re-keying goes through the caller's persistence implementation when given\n * (defaulting to the built-in pending-update table) and reports only ids\n * whose row actually changed, so a record living in some other queue never\n * counts as progress. Returns the fresh ids so callers can treat re-keying\n * as settlement-like progress and schedule the pass that submits them.\n *\n * A row whose persisted rekeyCount has reached the bound is not re-keyed\n * again: it is reported as exhausted so the caller can surface a terminal\n * failure instead of feeding an unbounded conflict loop that survives\n * restarts (each session's in-memory lane cap resets, this bound does not).\n */\nexport async function rekeyUnsettledRecoveryPendingUpdates(input: {\n  execSql: ExecSql;\n  recoveryPendingUpdatesById: ReadonlyMap<string, PendingUpdateRecord>;\n  rekeyPendingUpdate?: RekeyPendingUpdate | undefined;\n  settledPendingUpdateIds: readonly string[];\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<{\n  exhaustedPendingUpdateIds: string[];\n  rekeyedPendingUpdateIds: string[];\n}> {\n  const rekeyPendingUpdate =\n    input.rekeyPendingUpdate ?? rekeyDocumentPendingUpdate;\n  const settled = new Set(input.settledPendingUpdateIds);\n  const rekeyedPendingUpdateIds: string[] = [];\n  const exhaustedPendingUpdateIds: string[] = [];\n  for (const [pendingUpdateId, record] of input.recoveryPendingUpdatesById) {\n    if (input.stillCurrent?.() === false) break;\n    if (settled.has(pendingUpdateId)) {\n      continue;\n    }\n    // Known multi-tab limitation: the count is the row as loaded at pass\n    // start, so a sibling tab that settle-deleted the row can make this\n    // record a failure for work that no longer exists. The stale failure is\n    // transient — the document's next clean pass clears it.\n    if ((record.rekeyCount ?? 0) >= MAX_PENDING_UPDATE_REKEYS) {\n      exhaustedPendingUpdateIds.push(pendingUpdateId);\n      continue;\n    }\n    const outcome = await runSerializedSqlMutation(\n      input.execSql,\n      (lockedExecSql) =>\n        getClientSQLitePersistenceRuntime(lockedExecSql).guardedTransaction(\n          async () =>\n            input.stillCurrent?.() === false\n              ? null\n              : rekeyPendingUpdate(lockedExecSql, pendingUpdateId),\n          () => input.stillCurrent?.() !== false,\n        ),\n    );\n    if (!outcome.committed) break;\n    const nextId = outcome.result;\n    if (nextId !== null) {\n      rekeyedPendingUpdateIds.push(nextId);\n    }\n  }\n  if (input.stillCurrent?.() === false) {\n    return { exhaustedPendingUpdateIds: [], rekeyedPendingUpdateIds: [] };\n  }\n  return { exhaustedPendingUpdateIds, rekeyedPendingUpdateIds };\n}\n\n/**\n * Re-key what recovery could not settle and surface exhausted rows through\n * the caller's terminal-failure handler. The exhausted count is also\n * returned so the sync result can carry it: a pass that recorded this\n * failure must not read as clean to callers that clear recorded failures\n * on success.\n */\nexport async function rekeyAndReportUnsettledRecoveryPendingUpdates(\n  input: Parameters<typeof rekeyUnsettledRecoveryPendingUpdates>[0] & {\n    onTerminalSubmitFailure?:\n      | ((failure: DocumentSyncSubmitFailure) => Promise<void> | void)\n      | undefined;\n  },\n): Promise<{\n  exhaustedPendingUpdateCount: number;\n  rekeyedPendingUpdateIds: string[];\n}> {\n  const { exhaustedPendingUpdateIds, rekeyedPendingUpdateIds } =\n    await rekeyUnsettledRecoveryPendingUpdates(input);\n  if (input.stillCurrent?.() === false) {\n    return { exhaustedPendingUpdateCount: 0, rekeyedPendingUpdateIds: [] };\n  }\n  if (exhaustedPendingUpdateIds.length > 0) {\n    await input.onTerminalSubmitFailure?.(\n      rekeyLimitSubmitFailure(exhaustedPendingUpdateIds.length),\n    );\n  }\n  return {\n    exhaustedPendingUpdateCount: exhaustedPendingUpdateIds.length,\n    rekeyedPendingUpdateIds,\n  };\n}\n\n/**\n * Terminal failure recorded when conflict recovery gives up on pending\n * updates whose persisted re-key bound is exhausted. Shaped like a submit\n * failure so the existing write-queue surface (recordDocumentSyncFailure via\n * onTerminalSubmitFailure) explains the stuck write without new plumbing.\n */\nexport function rekeyLimitSubmitFailure(\n  exhaustedCount: number,\n): DocumentSyncSubmitFailure {\n  return {\n    message: `Update conflict recovery gave up after ${MAX_PENDING_UPDATE_REKEYS} re-key attempts (${exhaustedCount} update${exhaustedCount === 1 ? \"\" : \"s\"})`,\n    ok: false,\n    report: () => {},\n    status: null,\n  };\n}\n"]}

package/workflows/documents/syncRekeys/syncRekeyCommit.js

@@ -0,0 +1,18 @@
+import { serializeKeyingCanonicalJson, toFingerprint } from "../../../internal/crypto/index.js";
+const textEncoder = new TextEncoder();
+/**
+ * Identifies one logical inline-rekey flush across plan rematerialization.
+ * Rotation baselines and signed rekey events can be freshly randomized on a
+ * retry. The durable FIFO head and pre-rekey projection stay stable even when
+ * a new local edit is appended to the queue after a response is lost.
+ */
+export async function computeInlineRekeyCommitId(input) {
+    return toFingerprint(textEncoder.encode(serializeKeyingCanonicalJson({
+        domain: "tearleads.document-sync.inline-rekey-commit",
+        documentId: input.projection.documentId,
+        headPendingUpdateId: input.headPendingUpdateId,
+        predecessorTargetHash: input.projection.documentKekTargets.documentKeyTargetHash,
+        version: 1,
+    })));
+}
+//# sourceMappingURL=syncRekeyCommit.js.map

package/workflows/organizations/groupMetadata/currentGroupMetadataAuthority.js

@@ -0,0 +1,53 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { principalHeadMatchesReference } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { loadCurrentOrganizationAuthority } from "../currentOrganizationAuthority.js";
+import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
+/** Authenticate metadata-root grants with current policies and only its cited predecessors. */
+export function createCurrentGroupMetadataContainerVerifier(input) {
+    return async (state, organizationReference) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const authority = await loadCurrentOrganizationAuthority({
+            ...input,
+            organizationReference,
+        });
+        await createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent: input.stillCurrent,
+        })(state, organizationReference);
+    };
+}
+/** Reuse one mutation's verified authority without broadening its lease or scope. */
+export function createSelectedCurrentGroupMetadataContainerVerifier(input) {
+    return async (state, organizationReference) => {
+        const { authority } = input;
+        const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();
+        assertProjectionVerificationCurrent(stillCurrent);
+        if (organizationReference) {
+            if (organizationReference.principalType !== "organization" ||
+                organizationReference.principalId !== input.organizationId)
+                throw new KeyingVerificationError("object_mismatch", "Current policy reference is outside its scope");
+            if (!principalHeadMatchesReference(authority.directory.policy.state, organizationReference))
+                throw new ProjectionDependencyUnavailableError("Metadata root belongs to a changed organization directory");
+        }
+        const { adminGroupId, memberGroupId } = authority.descriptor;
+        const citation = (groupId) => state.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === groupId);
+        const admins = await authority.readGroup(adminGroupId, citation(adminGroupId));
+        const members = await authority.readGroup(memberGroupId, citation(memberGroupId));
+        assertMetadataRootBinding({
+            organizationId: input.organizationId,
+            authority: {
+                descriptor: authority.descriptor,
+                adminGroupId,
+                memberGroupId,
+                adminPolicy: admins.policy,
+            },
+            members,
+            state,
+        });
+        assertProjectionVerificationCurrent(() => stillCurrent() && admins.stillCurrent() && members.stillCurrent());
+    };
+}
+//# sourceMappingURL=currentGroupMetadataAuthority.js.map

package/workflows/organizations/groupMetadata/currentGroupMetadataAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupMetadataAuthority.js","sourceRoot":"","sources":["currentGroupMetadataAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,+FAA+F;AAC/F,MAAM,UAAU,2CAA2C,CACzD,KAGC;IAED,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;YACvD,GAAG,KAAK;YACR,qBAAqB;SACtB,CAAC,CAAC;QACH,MAAM,mDAAmD,CAAC;YACxD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mDAAmD,CAAC,KAMnE;IACC,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAC5B,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IACE,qBAAqB,CAAC,aAAa,KAAK,cAAc;gBACtD,qBAAqB,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;gBAE1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;YACJ,IACE,CAAC,6BAA6B,CAC5B,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAChC,qBAAqB,CACtB;gBAED,MAAM,IAAI,oCAAoC,CAC5C,2DAA2D,CAC5D,CAAC;QACN,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACjE,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CACtC,YAAY,EACZ,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CACvC,aAAa,EACb,QAAQ,CAAC,aAAa,CAAC,CACxB,CAAC;QACF,yBAAyB,CAAC;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE;gBACT,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,YAAY;gBACZ,aAAa;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;YACD,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,YAAY,EAAE,CACxE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"../currentOrganizationAuthority\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\n/** Authenticate metadata-root grants with current policies and only its cited predecessors. */\nexport function createCurrentGroupMetadataContainerVerifier(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  >,\n) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const authority = await loadCurrentOrganizationAuthority({\n      ...input,\n      organizationReference,\n    });\n    await createSelectedCurrentGroupMetadataContainerVerifier({\n      authority,\n      organizationId: input.organizationId,\n      stillCurrent: input.stillCurrent,\n    })(state, organizationReference);\n  };\n}\n\n/** Reuse one mutation's verified authority without broadening its lease or scope. */\nexport function createSelectedCurrentGroupMetadataContainerVerifier(input: {\n  readonly authority: Awaited<\n    ReturnType<typeof loadCurrentOrganizationAuthority>\n  >;\n  readonly organizationId: string;\n  readonly stillCurrent: () => boolean;\n}) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    const { authority } = input;\n    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();\n    assertProjectionVerificationCurrent(stillCurrent);\n    if (organizationReference) {\n      if (\n        organizationReference.principalType !== \"organization\" ||\n        organizationReference.principalId !== input.organizationId\n      )\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Current policy reference is outside its scope\",\n        );\n      if (\n        !principalHeadMatchesReference(\n          authority.directory.policy.state,\n          organizationReference,\n        )\n      )\n        throw new ProjectionDependencyUnavailableError(\n          \"Metadata root belongs to a changed organization directory\",\n        );\n    }\n    const { adminGroupId, memberGroupId } = authority.descriptor;\n    const citation = (groupId: string) =>\n      state.referencedPrincipalHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === groupId,\n      );\n    const admins = await authority.readGroup(\n      adminGroupId,\n      citation(adminGroupId),\n    );\n    const members = await authority.readGroup(\n      memberGroupId,\n      citation(memberGroupId),\n    );\n    assertMetadataRootBinding({\n      organizationId: input.organizationId,\n      authority: {\n        descriptor: authority.descriptor,\n        adminGroupId,\n        memberGroupId,\n        adminPolicy: admins.policy,\n      },\n      members,\n      state,\n    });\n    assertProjectionVerificationCurrent(\n      () => stillCurrent() && admins.stillCurrent() && members.stillCurrent(),\n    );\n  };\n}\n"]}

package/workflows/organizations/groupMetadata/groupMetadataAccess.d.ts

@@ -0,0 +1,33 @@
+import { type ContainerAccessManifestState, type GroupMetadataKey, type ReferencedPrincipalHead } from "../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { GroupPolicyNameReader } from "../principalPolicy/principalPolicyRequest.js";
+export interface GroupMetadataAccessInput {
+    readonly apiClient: {
+        evictContainerWriterProjection(containerId: string): void;
+        getContainerWriterProjection(containerId: string): Promise<ContainerWriterProjectionResponse | null>;
+    };
+    readonly verifyMetadataContainer: (state: ContainerAccessManifestState, organizationReference?: ReferencedPrincipalHead | undefined) => Promise<void>;
+    readonly execSql: ExecSql;
+    readonly organizationId: string;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+    readonly targetSecretKey: Uint8Array;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+/**
+ * A group's signed name does not open under the metadata key it cites, or opens
+ * to an invalid name. Every reader holding that key gets the same result. The
+ * API checks the citation but can never check the ciphertext, so a dishonest
+ * admin can sign such a name; directory walks isolate the group instead of
+ * failing every name in the organization.
+ */
+export declare class GroupMetadataUnreadableError extends Error {
+    constructor(groupId: string, cause: unknown);
+}
+/** Uses the shared metadata container's authenticated keyring, including old epochs. */
+export declare function createGroupMetadataAccess(input: GroupMetadataAccessInput): {
+    readName: GroupPolicyNameReader;
+    loadEncryptionKey(): Promise<GroupMetadataKey>;
+};

package/workflows/organizations/groupMetadata/groupMetadataAccess.js

@@ -0,0 +1,114 @@
+import { decryptGroupMetadata, readGroupMetadata, } from "../../../internal/crypto/index.js";
+import { deriveOrganizationMetadataContainerSystemSlot } from "../../../internal/validators/containerSystemSlot.js";
+import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../data/documents/shared/containerKekPath.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadContainers } from "../../../data/persistence/containers/containerPersistence.js";
+import { withMetadataRootReload } from "./groupMetadataErrors.js";
+/**
+ * A group's signed name does not open under the metadata key it cites, or opens
+ * to an invalid name. Every reader holding that key gets the same result. The
+ * API checks the citation but can never check the ciphertext, so a dishonest
+ * admin can sign such a name; directory walks isolate the group instead of
+ * failing every name in the organization.
+ */
+export class GroupMetadataUnreadableError extends Error {
+    constructor(groupId, cause) {
+        super(`Group ${groupId} metadata cannot be decrypted`, { cause });
+        this.name = "GroupMetadataUnreadableError";
+    }
+}
+function loadMetadataKeyring(input, containerId) {
+    return withMetadataRootReload(() => loadMetadataKeyringOnce(input, containerId), () => input.apiClient.evictContainerWriterProjection(containerId));
+}
+async function loadMetadataKeyringOnce(input, containerId) {
+    const projection = await input.apiClient.getContainerWriterProjection(containerId);
+    if (!projection)
+        return null;
+    if (projection.containerId !== containerId ||
+        projection.organizationId !== input.organizationId)
+        throw new Error("Group metadata container is unavailable");
+    const target = getTargetContainerContext(projection);
+    const state = readContainerState(target.manifest);
+    const slot = await deriveOrganizationMetadataContainerSystemSlot({
+        organizationId: input.organizationId,
+    });
+    if (state.organizationId !== input.organizationId ||
+        state.systemSlot !== slot ||
+        state.parentContainerId !== null)
+        throw new Error("Group metadata requires the signed organization metadata container");
+    await input.verifyMetadataContainer(state, projection.policyEvidence.organization?.head);
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const keys = await unwrapContainerKekPath({
+        ...input,
+        projection,
+        secretKey: input.targetSecretKey,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const keyMaterial = keys.get(target.kek.containerKeyEpochId);
+    if (!keyMaterial)
+        throw new Error("Group metadata container key is unavailable");
+    return {
+        current: {
+            organizationId: input.organizationId,
+            containerId,
+            containerKeyEpochId: target.kek.containerKeyEpochId,
+            keyMaterial,
+        },
+        keys,
+    };
+}
+/** Uses the shared metadata container's authenticated keyring, including old epochs. */
+export function createGroupMetadataAccess(input) {
+    const loads = new Map();
+    function loaded(containerId) {
+        let pending = loads.get(containerId);
+        if (!pending) {
+            pending = loadMetadataKeyring(input, containerId);
+            loads.set(containerId, pending);
+        }
+        return pending;
+    }
+    const readName = async (bundle) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
+        if ("role" in metadata)
+            return metadata.role === "admins" ? "Admins" : "Members";
+        if (metadata.organizationId !== input.organizationId ||
+            metadata.groupId !== bundle.currentState.principalId ||
+            bundle.currentState.principalType !== "group")
+            throw new Error("Group metadata scope does not match its signed group");
+        const keyring = await loaded(metadata.containerId);
+        const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);
+        if (!keyMaterial)
+            throw new Error("Group metadata historical key is unavailable");
+        try {
+            return await decryptGroupMetadata({
+                key: { ...metadata, keyMaterial },
+                groupId: bundle.currentState.principalId,
+                payload: bundle.currentPayload.ciphertext,
+            });
+        }
+        catch (cause) {
+            throw new GroupMetadataUnreadableError(bundle.currentState.principalId, cause);
+        }
+    };
+    return {
+        readName,
+        async loadEncryptionKey() {
+            const slot = await deriveOrganizationMetadataContainerSystemSlot({
+                organizationId: input.organizationId,
+            });
+            const containers = await loadContainers(input.execSql);
+            const container = containers.find((row) => row.organizationId === input.organizationId &&
+                row.systemSlot === slot);
+            if (!container)
+                throw new Error("Organization metadata container has not been discovered");
+            const keyring = await loaded(container.id);
+            if (!keyring)
+                throw new Error("Group metadata container is unavailable");
+            return keyring.current;
+        },
+    };
+}
+//# sourceMappingURL=groupMetadataAccess.js.map

package/workflows/organizations/groupMetadata/groupMetadataAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataAccess.js","sourceRoot":"","sources":["groupMetadataAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAE1G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAKzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,2DAA2D,CAAC;AAG3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAuB/D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,SAAS,OAAO,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,KAA+B,EAC/B,WAAmB;IAEnB,OAAO,sBAAsB,CAC3B,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EACjD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA+B,EAC/B,WAAmB;IAEnB,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IACE,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAElD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAEhC,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,MAAM,KAAK,CAAC,uBAAuB,CACjC,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAC7C,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;QACxC,GAAG,KAAK;QACR,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;YACnD,WAAW;SACZ;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAMlB,CAAC;IACJ,SAAS,MAAM,CAAC,WAAmB;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAA0B,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,IAAI,QAAQ;YACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IACE,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW;YACpD,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;YAE7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;gBACxC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,MAAM,CAAC,YAAY,CAAC,WAAW,EAC/B,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,KAAK,CAAC,iBAAiB;YACrB,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;gBAC3C,GAAG,CAAC,UAAU,KAAK,IAAI,CAC1B,CAAC;YACF,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  decryptGroupMetadata,\n  type GroupMetadataKey,\n  type ReferencedPrincipalHead,\n  readGroupMetadata,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/containerKekPath\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadContainers } from \"../../../data/persistence/containers/containerPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { GroupPolicyNameReader } from \"../principalPolicy/principalPolicyRequest\";\nimport { withMetadataRootReload } from \"./groupMetadataErrors\";\n\nexport interface GroupMetadataAccessInput {\n  readonly apiClient: {\n    evictContainerWriterProjection(containerId: string): void;\n    getContainerWriterProjection(\n      containerId: string,\n    ): Promise<ContainerWriterProjectionResponse | null>;\n  };\n  readonly verifyMetadataContainer: (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead | undefined,\n  ) => Promise<void>;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly targetSecretKey: Uint8Array;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/**\n * A group's signed name does not open under the metadata key it cites, or opens\n * to an invalid name. Every reader holding that key gets the same result. The\n * API checks the citation but can never check the ciphertext, so a dishonest\n * admin can sign such a name; directory walks isolate the group instead of\n * failing every name in the organization.\n */\nexport class GroupMetadataUnreadableError extends Error {\n  constructor(groupId: string, cause: unknown) {\n    super(`Group ${groupId} metadata cannot be decrypted`, { cause });\n    this.name = \"GroupMetadataUnreadableError\";\n  }\n}\n\nfunction loadMetadataKeyring(\n  input: GroupMetadataAccessInput,\n  containerId: string,\n) {\n  return withMetadataRootReload(\n    () => loadMetadataKeyringOnce(input, containerId),\n    () => input.apiClient.evictContainerWriterProjection(containerId),\n  );\n}\n\nasync function loadMetadataKeyringOnce(\n  input: GroupMetadataAccessInput,\n  containerId: string,\n) {\n  const projection =\n    await input.apiClient.getContainerWriterProjection(containerId);\n  if (!projection) return null;\n  if (\n    projection.containerId !== containerId ||\n    projection.organizationId !== input.organizationId\n  )\n    throw new Error(\"Group metadata container is unavailable\");\n  const target = getTargetContainerContext(projection);\n  const state = readContainerState(target.manifest);\n  const slot = await deriveOrganizationMetadataContainerSystemSlot({\n    organizationId: input.organizationId,\n  });\n  if (\n    state.organizationId !== input.organizationId ||\n    state.systemSlot !== slot ||\n    state.parentContainerId !== null\n  )\n    throw new Error(\n      \"Group metadata requires the signed organization metadata container\",\n    );\n  await input.verifyMetadataContainer(\n    state,\n    projection.policyEvidence.organization?.head,\n  );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const keys = await unwrapContainerKekPath({\n    ...input,\n    projection,\n    secretKey: input.targetSecretKey,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const keyMaterial = keys.get(target.kek.containerKeyEpochId);\n  if (!keyMaterial)\n    throw new Error(\"Group metadata container key is unavailable\");\n  return {\n    current: {\n      organizationId: input.organizationId,\n      containerId,\n      containerKeyEpochId: target.kek.containerKeyEpochId,\n      keyMaterial,\n    },\n    keys,\n  };\n}\n\n/** Uses the shared metadata container's authenticated keyring, including old epochs. */\nexport function createGroupMetadataAccess(input: GroupMetadataAccessInput) {\n  const loads = new Map<\n    string,\n    Promise<{\n      current: GroupMetadataKey;\n      keys: ReadonlyMap<string, Uint8Array>;\n    } | null>\n  >();\n  function loaded(containerId: string) {\n    let pending = loads.get(containerId);\n    if (!pending) {\n      pending = loadMetadataKeyring(input, containerId);\n      loads.set(containerId, pending);\n    }\n    return pending;\n  }\n  const readName: GroupPolicyNameReader = async (bundle) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n    if (\"role\" in metadata)\n      return metadata.role === \"admins\" ? \"Admins\" : \"Members\";\n    if (\n      metadata.organizationId !== input.organizationId ||\n      metadata.groupId !== bundle.currentState.principalId ||\n      bundle.currentState.principalType !== \"group\"\n    )\n      throw new Error(\"Group metadata scope does not match its signed group\");\n    const keyring = await loaded(metadata.containerId);\n    const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);\n    if (!keyMaterial)\n      throw new Error(\"Group metadata historical key is unavailable\");\n    try {\n      return await decryptGroupMetadata({\n        key: { ...metadata, keyMaterial },\n        groupId: bundle.currentState.principalId,\n        payload: bundle.currentPayload.ciphertext,\n      });\n    } catch (cause) {\n      throw new GroupMetadataUnreadableError(\n        bundle.currentState.principalId,\n        cause,\n      );\n    }\n  };\n  return {\n    readName,\n    async loadEncryptionKey(): Promise<GroupMetadataKey> {\n      const slot = await deriveOrganizationMetadataContainerSystemSlot({\n        organizationId: input.organizationId,\n      });\n      const containers = await loadContainers(input.execSql);\n      const container = containers.find(\n        (row) =>\n          row.organizationId === input.organizationId &&\n          row.systemSlot === slot,\n      );\n      if (!container)\n        throw new Error(\n          \"Organization metadata container has not been discovered\",\n        );\n      const keyring = await loaded(container.id);\n      if (!keyring) throw new Error(\"Group metadata container is unavailable\");\n      return keyring.current;\n    },\n  };\n}\n"]}

package/workflows/organizations/groupMetadata/groupMetadataBinding.js

@@ -0,0 +1,19 @@
+import { readGroupMetadata } from "../../../internal/crypto/index.js";
+/** Built-in labels derive from the role assigned by the signed organization. */
+export function assertGroupMetadataBinding(bundle, descriptor) {
+    const groupId = bundle.currentState.principalId;
+    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
+    const expectedRole = groupId === descriptor.adminGroupId
+        ? "admins"
+        : groupId === descriptor.memberGroupId
+            ? "members"
+            : null;
+    if ("role" in metadata
+        ? metadata.role !== expectedRole
+        : expectedRole !== null ||
+            metadata.organizationId !== descriptor.organizationId ||
+            metadata.groupId !== groupId) {
+        throw new Error("Group metadata does not match the signed organization directory");
+    }
+}
+//# sourceMappingURL=groupMetadataBinding.js.map

package/workflows/organizations/groupMetadata/groupMetadataBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataBinding.js","sourceRoot":"","sources":["groupMetadataBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAItD,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,MAGC,EACD,UAA2C;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,KAAK,UAAU,CAAC,YAAY;QACjC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,aAAa;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC;IACb,IACE,MAAM,IAAI,QAAQ;QAChB,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;QAChC,CAAC,CAAC,YAAY,KAAK,IAAI;YACrB,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACrD,QAAQ,CAAC,OAAO,KAAK,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { readGroupMetadata } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { OrganizationAuthorityDescriptor } from \"../../../data/principals/organizationAuthorityDescriptor\";\n\n/** Built-in labels derive from the role assigned by the signed organization. */\nexport function assertGroupMetadataBinding(\n  bundle: Pick<\n    PrincipalPolicyBundleResponse,\n    \"currentState\" | \"currentPayload\"\n  >,\n  descriptor: OrganizationAuthorityDescriptor,\n): void {\n  const groupId = bundle.currentState.principalId;\n  const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n  const expectedRole =\n    groupId === descriptor.adminGroupId\n      ? \"admins\"\n      : groupId === descriptor.memberGroupId\n        ? \"members\"\n        : null;\n  if (\n    \"role\" in metadata\n      ? metadata.role !== expectedRole\n      : expectedRole !== null ||\n        metadata.organizationId !== descriptor.organizationId ||\n        metadata.groupId !== groupId\n  ) {\n    throw new Error(\n      \"Group metadata does not match the signed organization directory\",\n    );\n  }\n}\n"]}

package/workflows/organizations/groupMetadata/groupMetadataContainerAuthority.js

@@ -0,0 +1,41 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { verifyDirectoryGroup } from "../groupNames/groupNameUniqueness.js";
+import { loadGroupNameDirectoryAuthority } from "../groupNames/organizationGroupNamePolicies.js";
+import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
+/** A public system slot alone cannot bind a self-authorized root to an organization. */
+export function createGroupMetadataContainerVerifier(input) {
+    return async (state) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const cached = await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
+        let authority = await loadGroupNameDirectoryAuthority({
+            ...input,
+            organizationPolicyReference: cached
+                ? principalPolicyReferenceFromBundle(cached)
+                : null,
+        });
+        if (cached &&
+            authority &&
+            state.referencedPrincipalHeads.some((head) => !authority?.descriptor.groupHeads.some((known) => principalHeadMatchesReference(head, known)))) {
+            authority = await loadGroupNameDirectoryAuthority(input);
+        }
+        if (!authority)
+            throw new Error("Organization metadata authority is unavailable");
+        const memberHead = requireOrganizationGroupHead(authority.descriptor, authority.memberGroupId);
+        const members = await verifyDirectoryGroup({
+            ...input,
+            descriptor: authority.descriptor,
+            externalAuthority: authority.externalAuthority,
+        }, memberHead);
+        assertMetadataRootBinding({
+            authority,
+            members,
+            organizationId: input.organizationId,
+            state,
+        });
+        assertProjectionVerificationCurrent(input.stillCurrent);
+    };
+}
+//# sourceMappingURL=groupMetadataContainerAuthority.js.map

package/workflows/organizations/groupMetadata/groupMetadataContainerAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataContainerAuthority.js","sourceRoot":"","sources":["groupMetadataContainerAuthority.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAE1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAOvE,wFAAwF;AACxF,MAAM,UAAU,oCAAoC,CAAC,KAAY;IAC/D,OAAO,KAAK,EAAE,KAAmC,EAAiB,EAAE;QAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACpD,GAAG,KAAK;YACR,2BAA2B,EAAE,MAAM;gBACjC,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC;gBAC5C,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QACH,IACE,MAAM;YACN,SAAS;YACT,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,CAC3C,CACJ,EACD,CAAC;YACD,SAAS,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,4BAA4B,CAC7C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,aAAa,CACxB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,EACD,UAAU,CACX,CAAC;QACF,yBAAyB,CAAC;YACxB,SAAS;YACT,OAAO;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerAccessManifestState } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport { verifyDirectoryGroup } from \"../groupNames/groupNameUniqueness\";\nimport { loadGroupNameDirectoryAuthority } from \"../groupNames/organizationGroupNamePolicies\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\ntype Input = Omit<\n  Parameters<typeof loadGroupNameDirectoryAuthority>[0],\n  \"organizationPolicyReference\"\n> & { readonly reportSecurityIncident: SecurityIncidentReporter };\n\n/** A public system slot alone cannot bind a self-authorized root to an organization. */\nexport function createGroupMetadataContainerVerifier(input: Input) {\n  return async (state: ContainerAccessManifestState): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const cached = await loadPrincipalPolicyBundle(\n      input.execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    let authority = await loadGroupNameDirectoryAuthority({\n      ...input,\n      organizationPolicyReference: cached\n        ? principalPolicyReferenceFromBundle(cached)\n        : null,\n    });\n    if (\n      cached &&\n      authority &&\n      state.referencedPrincipalHeads.some(\n        (head) =>\n          !authority?.descriptor.groupHeads.some((known) =>\n            principalHeadMatchesReference(head, known),\n          ),\n      )\n    ) {\n      authority = await loadGroupNameDirectoryAuthority(input);\n    }\n    if (!authority)\n      throw new Error(\"Organization metadata authority is unavailable\");\n    const memberHead = requireOrganizationGroupHead(\n      authority.descriptor,\n      authority.memberGroupId,\n    );\n    const members = await verifyDirectoryGroup(\n      {\n        ...input,\n        descriptor: authority.descriptor,\n        externalAuthority: authority.externalAuthority,\n      },\n      memberHead,\n    );\n    assertMetadataRootBinding({\n      authority,\n      members,\n      organizationId: input.organizationId,\n      state,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  };\n}\n"]}

package/workflows/organizations/groupMetadata/groupMetadataErrors.js

@@ -0,0 +1,40 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+/**
+ * The organization metadata root was read before a reserved-group commit that
+ * the signed directory already reflects: each head it cites that differs from
+ * the directory is a verified predecessor of the directory's head. That is an
+ * honest read race, so readers reload the root rather than report tampering
+ * (#2365 finding 22).
+ */
+export class MetadataRootBehindDirectoryError extends Error {
+    constructor() {
+        super("Organization metadata root cites a superseded reserved-group head");
+        this.name = "MetadataRootBehindDirectoryError";
+    }
+}
+/**
+ * Runs `load`, then once more after `evictRoot` if the root it read was
+ * behind; `reread` tells `load` to skip any root it was handed. Honest servers
+ * re-cite the reserved groups in the commit that advances them, so a root
+ * still behind after a fresh read is an incident.
+ */
+export async function withMetadataRootReload(load, evictRoot) {
+    try {
+        return await load(false);
+    }
+    catch (error) {
+        if (!(error instanceof MetadataRootBehindDirectoryError))
+            throw error;
+    }
+    evictRoot();
+    try {
+        return await load(true);
+    }
+    catch (error) {
+        if (error instanceof MetadataRootBehindDirectoryError) {
+            throw new KeyingVerificationError("object_mismatch", "Organization metadata root is still behind the signed directory after a reload");
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=groupMetadataErrors.js.map

package/workflows/organizations/groupMetadata/groupMetadataRootBinding.js

@@ -0,0 +1,51 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyEvidenceEntries } from "../../../data/principals/principalPolicyEvidence.js";
+import { MetadataRootBehindDirectoryError } from "./groupMetadataErrors.js";
+/** Root bindings consume verified current grants and explicitly retained predecessor citations. */
+export function assertMetadataRootBinding(input) {
+    const { authority, state } = input;
+    const expected = [
+        {
+            policy: authority.adminPolicy,
+            id: authority.adminGroupId,
+            level: "admin",
+            grants: authority.adminPolicy.grants,
+        },
+        {
+            policy: input.members.policy,
+            id: authority.memberGroupId,
+            level: "read",
+            grants: input.members.policy.grants,
+        },
+    ];
+    const cited = (groupId) => state.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === groupId);
+    const unbound = new KeyingVerificationError("object_mismatch", "Organization metadata root is not bound to the reserved group grants");
+    if (state.organizationId !== input.organizationId ||
+        state.parentContainerId !== null ||
+        state.directGrants.length !== 2 ||
+        state.referencedPrincipalHeads.length !== 2 ||
+        expected.some((role) => !principalHeadMatchesReference(role.policy.state, requireOrganizationGroupHead(authority.descriptor, role.id)) ||
+            !role.grants.some((grant) => grant.containerId === state.containerId &&
+                grant.accessLevel === role.level) ||
+            !state.directGrants.some((grant) => grant.subjectType === "group" &&
+                grant.subjectId === role.id &&
+                grant.accessLevel === role.level) ||
+            !cited(role.id)))
+        throw unbound;
+    const superseded = expected.flatMap((role) => {
+        const head = cited(role.id);
+        return head &&
+            !principalHeadMatchesReference(head, requireOrganizationGroupHead(authority.descriptor, role.id))
+            ? [{ policy: role.policy, head }]
+            : [];
+    });
+    if (superseded.length === 0)
+        return;
+    // A root read before a reserved-group commit cites a verified predecessor
+    // of the directory's head; any other head is not an honest race.
+    if (superseded.every(({ policy, head }) => principalPolicyEvidenceEntries(policy).some(({ state }) => principalHeadMatchesReference(state, head))))
+        throw new MetadataRootBehindDirectoryError();
+    throw unbound;
+}
+//# sourceMappingURL=groupMetadataRootBinding.js.map

package/workflows/organizations/groupMetadata/groupMetadataRootBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataRootBinding.js","sourceRoot":"","sources":["groupMetadataRootBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kDAAkD,CAAC;AAClG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAEzE,mGAAmG;AACnG,MAAM,UAAU,yBAAyB,CAAC,KAUzC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf;YACE,MAAM,EAAE,SAAS,CAAC,WAAW;YAC7B,EAAE,EAAE,SAAS,CAAC,YAAY;YAC1B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM;SACrC;QACD;YACE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,EAAE,EAAE,SAAS,CAAC,aAAa;YAC3B,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;SACpC;KACF,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAChC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACzE,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,uBAAuB,CACzC,iBAAiB,EACjB,sEAAsE,CACvE,CAAC;IACF,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAChC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,KAAK,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC;QAC3C,QAAQ,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,6BAA6B,CAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EACjB,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAC5D;YACD,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACvC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CACnC;YACD,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CACtB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;gBAC7B,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE;gBAC3B,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CACnC;YACD,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAClB;QAED,MAAM,OAAO,CAAC;IAChB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI;YACT,CAAC,6BAA6B,CAC5B,IAAI,EACJ,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAC5D;YACD,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,0EAA0E;IAC1E,iEAAiE;IACjE,IACE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACpC,8BAA8B,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACxD,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAC3C,CACF;QAED,MAAM,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,OAAO,CAAC;AAChB,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  KeyingVerificationError,\n  type PrincipalPolicyAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyEvidenceEntries } from \"../../../data/principals/principalPolicyEvidence\";\nimport { MetadataRootBehindDirectoryError } from \"./groupMetadataErrors\";\n\n/** Root bindings consume verified current grants and explicitly retained predecessor citations. */\nexport function assertMetadataRootBinding(input: {\n  readonly authority: {\n    readonly descriptor: OrganizationAuthorityDescriptor;\n    readonly adminGroupId: string;\n    readonly memberGroupId: string;\n    readonly adminPolicy: PrincipalPolicyAuthorization;\n  };\n  readonly members: { readonly policy: PrincipalPolicyAuthorization };\n  readonly organizationId: string;\n  readonly state: ContainerAccessManifestState;\n}): void {\n  const { authority, state } = input;\n  const expected = [\n    {\n      policy: authority.adminPolicy,\n      id: authority.adminGroupId,\n      level: \"admin\",\n      grants: authority.adminPolicy.grants,\n    },\n    {\n      policy: input.members.policy,\n      id: authority.memberGroupId,\n      level: \"read\",\n      grants: input.members.policy.grants,\n    },\n  ];\n  const cited = (groupId: string) =>\n    state.referencedPrincipalHeads.find(\n      (head) => head.principalType === \"group\" && head.principalId === groupId,\n    );\n  const unbound = new KeyingVerificationError(\n    \"object_mismatch\",\n    \"Organization metadata root is not bound to the reserved group grants\",\n  );\n  if (\n    state.organizationId !== input.organizationId ||\n    state.parentContainerId !== null ||\n    state.directGrants.length !== 2 ||\n    state.referencedPrincipalHeads.length !== 2 ||\n    expected.some(\n      (role) =>\n        !principalHeadMatchesReference(\n          role.policy.state,\n          requireOrganizationGroupHead(authority.descriptor, role.id),\n        ) ||\n        !role.grants.some(\n          (grant) =>\n            grant.containerId === state.containerId &&\n            grant.accessLevel === role.level,\n        ) ||\n        !state.directGrants.some(\n          (grant) =>\n            grant.subjectType === \"group\" &&\n            grant.subjectId === role.id &&\n            grant.accessLevel === role.level,\n        ) ||\n        !cited(role.id),\n    )\n  )\n    throw unbound;\n  const superseded = expected.flatMap((role) => {\n    const head = cited(role.id);\n    return head &&\n      !principalHeadMatchesReference(\n        head,\n        requireOrganizationGroupHead(authority.descriptor, role.id),\n      )\n      ? [{ policy: role.policy, head }]\n      : [];\n  });\n  if (superseded.length === 0) return;\n  // A root read before a reserved-group commit cites a verified predecessor\n  // of the directory's head; any other head is not an honest race.\n  if (\n    superseded.every(({ policy, head }) =>\n      principalPolicyEvidenceEntries(policy).some(({ state }) =>\n        principalHeadMatchesReference(state, head),\n      ),\n    )\n  )\n    throw new MetadataRootBehindDirectoryError();\n  throw unbound;\n}\n"]}