@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/groupMetadata/groupMetadataRuntime.js

@@ -0,0 +1,47 @@
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { createProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/userKeyResolver.js";
+import { createRuntimePrincipalPolicyCurrentResolver, } from "../../principals/runtimePolicyRecovery.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { createCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
+import { createGroupMetadataAccess, } from "./groupMetadataAccess.js";
+export function createRuntimeGroupMetadataAccess(runtime, organizationId, stillCurrent, verifyMetadataContainer, currentRecovery) {
+    const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;
+    if (!targetSecretKey)
+        throw new Error("Group metadata identity is locked");
+    // The signed metadata projection selects exact citations. Reuse matching
+    // private evidence with its dependencies and pins before bounded online reads.
+    const warmer = createRuntimePrincipalPolicyWarmer(runtime, {
+        preferLocalCurrent: true,
+    });
+    const resolveCurrentPolicy = currentRecovery?.resolveCurrentPolicy ??
+        createRuntimePrincipalPolicyCurrentResolver(runtime);
+    const authorityInput = {
+        apiClient: runtime.apiClient,
+        execSql: runtime.infra.execSql,
+        organizationId,
+        reportSecurityIncident: runtime.util.reportSecurityIncident,
+        resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+        stillCurrent: stillCurrent ?? (() => true),
+    };
+    return createGroupMetadataAccess({
+        verifyMetadataContainer: verifyMetadataContainer ??
+            createCurrentGroupMetadataContainerVerifier({
+                ...authorityInput,
+                resolveCurrentPolicy: requireCurrentResolver(resolveCurrentPolicy),
+                recoveryBatch: currentRecovery?.recoveryBatch,
+            }),
+        apiClient: runtime.apiClient,
+        execSql: runtime.infra.execSql,
+        organizationId,
+        resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),
+        targetSecretKey,
+        stillCurrent,
+        warmReferencedPrincipalPolicies: warmer,
+    });
+}
+function requireCurrentResolver(resolve) {
+    if (!resolve)
+        throw new ProjectionDependencyUnavailableError("Group metadata requires private paged recovery");
+    return resolve;
+}
+//# sourceMappingURL=groupMetadataRuntime.js.map

package/workflows/organizations/groupMetadata/groupMetadataRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMetadataRuntime.js","sourceRoot":"","sources":["groupMetadataRuntime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAC;AAI7G,OAAO,EACL,2CAA2C,GAE5C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAE1F,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAkB/B,MAAM,UAAU,gCAAgC,CAC9C,OAA6B,EAC7B,cAAsB,EACtB,YAA4B,EAC5B,uBAA6E,EAC7E,eAKC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACvE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,yEAAyE;IACzE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,kCAAkC,CAAC,OAAO,EAAE;QACzD,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,eAAe,EAAE,oBAAoB;QACrC,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC3C,CAAC;IACF,OAAO,yBAAyB,CAAC;QAC/B,uBAAuB,EACrB,uBAAuB;YACvB,2CAA2C,CAAC;gBAC1C,GAAG,cAAc;gBACjB,oBAAoB,EAAE,sBAAsB,CAAC,oBAAoB,CAAC;gBAClE,aAAa,EAAE,eAAe,EAAE,aAAa;aAC9C,CAAC;QACJ,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,eAAe;QACf,YAAY;QACZ,+BAA+B,EAAE,MAAM;KACxC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAuE;IAEvE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oCAAoC,CAC5C,gDAAgD,CACjD,CAAC;IACJ,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { EncapsulationKeyPair } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { createProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  createRuntimePrincipalPolicyCurrentResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"../../principals/runtimePolicyRecovery\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport type { PrincipalPolicyReadApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { createCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\nimport {\n  createGroupMetadataAccess,\n  type GroupMetadataAccessInput,\n} from \"./groupMetadataAccess\";\n\ninterface GroupMetadataRuntime {\n  readonly state?: PrincipalPolicyRecoveryRuntime[\"state\"];\n  readonly apiClient: GroupMetadataAccessInput[\"apiClient\"] &\n    PrincipalPolicyReadApi &\n    PrincipalPolicyRecoveryRuntime[\"apiClient\"];\n  readonly crypto: {\n    readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n}\n\nexport function createRuntimeGroupMetadataAccess(\n  runtime: GroupMetadataRuntime,\n  organizationId: string,\n  stillCurrent?: () => boolean,\n  verifyMetadataContainer?: GroupMetadataAccessInput[\"verifyMetadataContainer\"],\n  currentRecovery?: {\n    readonly resolveCurrentPolicy: ReturnType<\n      typeof createRuntimePrincipalPolicyCurrentResolver\n    >;\n    readonly recoveryBatch: object;\n  },\n) {\n  const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!targetSecretKey) throw new Error(\"Group metadata identity is locked\");\n  // The signed metadata projection selects exact citations. Reuse matching\n  // private evidence with its dependencies and pins before bounded online reads.\n  const warmer = createRuntimePrincipalPolicyWarmer(runtime, {\n    preferLocalCurrent: true,\n  });\n  const resolveCurrentPolicy =\n    currentRecovery?.resolveCurrentPolicy ??\n    createRuntimePrincipalPolicyCurrentResolver(runtime);\n  const authorityInput = {\n    apiClient: runtime.apiClient,\n    execSql: runtime.infra.execSql,\n    organizationId,\n    reportSecurityIncident: runtime.util.reportSecurityIncident,\n    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n    stillCurrent: stillCurrent ?? (() => true),\n  };\n  return createGroupMetadataAccess({\n    verifyMetadataContainer:\n      verifyMetadataContainer ??\n      createCurrentGroupMetadataContainerVerifier({\n        ...authorityInput,\n        resolveCurrentPolicy: requireCurrentResolver(resolveCurrentPolicy),\n        recoveryBatch: currentRecovery?.recoveryBatch,\n      }),\n    apiClient: runtime.apiClient,\n    execSql: runtime.infra.execSql,\n    organizationId,\n    resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n    targetSecretKey,\n    stillCurrent,\n    warmReferencedPrincipalPolicies: warmer,\n  });\n}\n\nfunction requireCurrentResolver(\n  resolve: ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>,\n) {\n  if (!resolve)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group metadata requires private paged recovery\",\n    );\n  return resolve;\n}\n"]}

package/workflows/organizations/groupMetadata/runtimeGroupMetadataAuthority.js

@@ -0,0 +1,16 @@
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { createRuntimePrincipalPolicyCurrentResolver, } from "../../principals/runtimePolicyRecovery.js";
+import { createCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
+/** Remote metadata destinations require the same private authority as name reads. */
+export async function verifyRuntimeGroupMetadataAuthority(input) {
+    const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(input.runtime);
+    if (!resolveCurrentPolicy)
+        throw new ProjectionDependencyUnavailableError("Group metadata requires private paged recovery");
+    await createCurrentGroupMetadataContainerVerifier({
+        execSql: input.runtime.infra.execSql,
+        organizationId: input.organizationId,
+        resolveCurrentPolicy,
+        stillCurrent: input.stillCurrent,
+    })(input.state, input.organizationReference);
+}
+//# sourceMappingURL=runtimeGroupMetadataAuthority.js.map

package/workflows/organizations/groupMetadata/runtimeGroupMetadataAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeGroupMetadataAuthority.js","sourceRoot":"","sources":["runtimeGroupMetadataAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EACL,2CAA2C,GAE5C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAE9F,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,MAAM,oBAAoB,GAAG,2CAA2C,CACtE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,oBAAoB;QACvB,MAAM,IAAI,oCAAoC,CAC5C,gDAAgD,CACjD,CAAC;IACJ,MAAM,2CAA2C,CAAC;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  createRuntimePrincipalPolicyCurrentResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"../../principals/runtimePolicyRecovery\";\nimport { createCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\n\n/** Remote metadata destinations require the same private authority as name reads. */\nexport async function verifyRuntimeGroupMetadataAuthority(input: {\n  readonly runtime: PrincipalPolicyRecoveryRuntime;\n  readonly organizationId: string;\n  readonly state: ContainerAccessManifestState;\n  readonly organizationReference?: ReferencedPrincipalHead | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(\n    input.runtime,\n  );\n  if (!resolveCurrentPolicy)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group metadata requires private paged recovery\",\n    );\n  await createCurrentGroupMetadataContainerVerifier({\n    execSql: input.runtime.infra.execSql,\n    organizationId: input.organizationId,\n    resolveCurrentPolicy,\n    stillCurrent: input.stillCurrent,\n  })(input.state, input.organizationReference);\n}\n"]}

package/workflows/organizations/groupNames/currentOrganizationGroupNames.js

@@ -0,0 +1,72 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { saveOrganizationGroupDisplayNames } from "../../../data/persistence/organizations/organizationGroupNamePersistence.js";
+import { loadCurrentOrganizationAuthority } from "../currentOrganizationAuthority.js";
+import { GroupMetadataUnreadableError } from "../groupMetadata/groupMetadataAccess.js";
+import { assertGroupMetadataBinding } from "../groupMetadata/groupMetadataBinding.js";
+import { readGroupPolicyPayloadName, } from "../principalPolicy/principalPolicyRequest.js";
+/** Names consume verified current artifacts; paged recovery retains their separate evidence. */
+export async function hydrateCurrentOrganizationGroupNames(input) {
+    const authority = await loadCurrentOrganizationAuthority(input);
+    const nameInput = {
+        ...input,
+        readEncryptedName: input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,
+    };
+    const names = [];
+    const unreadable = new Set();
+    const lifetimes = [authority.stillCurrent];
+    for (const group of input.directory.groups) {
+        const head = authority.descriptor.groupHeads.find((head) => head.principalId === group.groupId);
+        if (!head || head.stateHash !== group.currentState?.stateHash)
+            throw new Error("Group listing does not match the signed directory");
+        const verified = await authority.readGroup(group.groupId);
+        lifetimes.push(verified.stillCurrent);
+        assertGroupMetadataBinding(verified.current, authority.descriptor);
+        const name = await readCurrentGroupName(nameInput, verified.current);
+        if (name === null)
+            unreadable.add(group.groupId);
+        else
+            names.push({ groupId: group.groupId, name, stateHash: head.stateHash });
+    }
+    const stillCurrent = () => input.stillCurrent() && lifetimes.every((current) => current());
+    assertProjectionVerificationCurrent(stillCurrent);
+    // Match the authority admission performed by the full-bundle path. Group
+    // name reads alone do not move group checkpoints.
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policies: [authority.directory.policy, authority.admins.policy],
+        stillCurrent,
+    });
+    await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));
+    return {
+        ...input.directory,
+        groups: input.directory.groups.map((group) => ({
+            ...group,
+            name: byId.get(group.groupId) ?? "",
+            nameUnreadable: unreadable.has(group.groupId),
+        })),
+    };
+}
+async function readCurrentGroupName(input, current) {
+    try {
+        return await readGroupPolicyPayloadName(current, input.readEncryptedName);
+    }
+    catch (error) {
+        if (!(error instanceof GroupMetadataUnreadableError))
+            throw error;
+        await input.reportSecurityIncident(new KeyingVerificationError("invalid_shape", "Signed group name does not open under the cited metadata key"), {
+            evidenceHashes: { stateHash: current.currentState.stateHash },
+            objectId: current.currentState.principalId,
+            objectKind: "principal",
+            operation: "organization.groupName",
+            organizationId: input.organizationId,
+        });
+        return null;
+    }
+}
+//# sourceMappingURL=currentOrganizationGroupNames.js.map

package/workflows/organizations/groupNames/currentOrganizationGroupNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationGroupNames.js","sourceRoot":"","sources":["currentOrganizationGroupNames.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,iCAAiC,EAAE,MAAM,0EAA0E,CAAC;AAE7H,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAEL,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AAcnD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAY;IAEZ,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG;QAChB,GAAG,KAAK;QACR,iBAAiB,EACf,KAAK,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,iBAAiB;KACxE,CAAC;IACF,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAsB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;YAE/C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/D,YAAY;KACb,CAAC,CAAC;IACH,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAY,EACZ,OAA6C;IAE7C,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE;YAC7D,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;YAC1C,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { saveOrganizationGroupDisplayNames } from \"../../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport { loadCurrentOrganizationAuthority } from \"../currentOrganizationAuthority\";\nimport { GroupMetadataUnreadableError } from \"../groupMetadata/groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport type { OrganizationDirectoryAndGroups } from \"../readModel\";\n\ntype Input = Parameters<typeof loadCurrentOrganizationAuthority>[0] & {\n  readonly directory: OrganizationDirectoryAndGroups;\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly createCurrentNameReader?:\n    | ((\n        authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>,\n      ) => GroupPolicyNameReader)\n    | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n};\n\n/** Names consume verified current artifacts; paged recovery retains their separate evidence. */\nexport async function hydrateCurrentOrganizationGroupNames(\n  input: Input,\n): Promise<OrganizationDirectoryAndGroups> {\n  const authority = await loadCurrentOrganizationAuthority(input);\n  const nameInput = {\n    ...input,\n    readEncryptedName:\n      input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,\n  };\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadable = new Set<string>();\n  const lifetimes: (() => boolean)[] = [authority.stillCurrent];\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await authority.readGroup(group.groupId);\n    lifetimes.push(verified.stillCurrent);\n    assertGroupMetadataBinding(verified.current, authority.descriptor);\n    const name = await readCurrentGroupName(nameInput, verified.current);\n    if (name === null) unreadable.add(group.groupId);\n    else\n      names.push({ groupId: group.groupId, name, stateHash: head.stateHash });\n  }\n  const stillCurrent = () =>\n    input.stillCurrent() && lifetimes.every((current) => current());\n  assertProjectionVerificationCurrent(stillCurrent);\n  // Match the authority admission performed by the full-bundle path. Group\n  // name reads alone do not move group checkpoints.\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [authority.directory.policy, authority.admins.policy],\n    stillCurrent,\n  });\n  await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadable.has(group.groupId),\n    })),\n  };\n}\n\nasync function readCurrentGroupName(\n  input: Input,\n  current: Parameters<GroupPolicyNameReader>[0],\n) {\n  try {\n    return await readGroupPolicyPayloadName(current, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: current.currentState.stateHash },\n        objectId: current.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n"]}

package/workflows/organizations/groupNames/groupMembershipName.d.ts

@@ -0,0 +1,8 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
+import { type GroupPolicyNameReader } from "../principalPolicy/principalPolicyRequest.js";
+export declare class GroupMembershipNameMismatchError extends KeyingVerificationError {
+    constructor(reason: "forbidden_characters" | "name_mismatch");
+}
+/** Check the selected label only after verifying the signed policy bundle. */
+export declare function assertGroupMembershipName(verifiedBundle: Pick<PrincipalPolicyBundleResponse, "currentState" | "currentPayload">, expectedGroupName: string, readEncryptedName?: GroupPolicyNameReader): Promise<void>;

package/workflows/organizations/groupNames/groupMembershipName.js

@@ -0,0 +1,18 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { groupPolicyNameMismatch, } from "../principalPolicy/principalPolicyRequest.js";
+export class GroupMembershipNameMismatchError extends KeyingVerificationError {
+    constructor(reason) {
+        super("object_mismatch", reason === "forbidden_characters"
+            ? "Group membership name contains forbidden control or format characters"
+            : "Group membership name does not match the signed group policy");
+        this.name = "GroupMembershipNameMismatchError";
+    }
+}
+/** Check the selected label only after verifying the signed policy bundle. */
+export async function assertGroupMembershipName(verifiedBundle, expectedGroupName, readEncryptedName) {
+    const mismatch = await groupPolicyNameMismatch(verifiedBundle, expectedGroupName, readEncryptedName);
+    if (mismatch) {
+        throw new GroupMembershipNameMismatchError(mismatch);
+    }
+}
+//# sourceMappingURL=groupMembershipName.js.map

package/workflows/organizations/groupNames/groupMembershipName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupMembershipName.js","sourceRoot":"","sources":["groupMembershipName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAEL,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AAEnD,MAAM,OAAO,gCAAiC,SAAQ,uBAAuB;IAC3E,YAAY,MAAgD;QAC1D,KAAK,CACH,iBAAiB,EACjB,MAAM,KAAK,sBAAsB;YAC/B,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,8DAA8D,CACnE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAGC,EACD,iBAAyB,EACzB,iBAAyC;IAEzC,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,cAAc,EACd,iBAAiB,EACjB,iBAAiB,CAClB,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../principalPolicy/principalPolicyRequest\";\n\nexport class GroupMembershipNameMismatchError extends KeyingVerificationError {\n  constructor(reason: \"forbidden_characters\" | \"name_mismatch\") {\n    super(\n      \"object_mismatch\",\n      reason === \"forbidden_characters\"\n        ? \"Group membership name contains forbidden control or format characters\"\n        : \"Group membership name does not match the signed group policy\",\n    );\n    this.name = \"GroupMembershipNameMismatchError\";\n  }\n}\n\n/** Check the selected label only after verifying the signed policy bundle. */\nexport async function assertGroupMembershipName(\n  verifiedBundle: Pick<\n    PrincipalPolicyBundleResponse,\n    \"currentState\" | \"currentPayload\"\n  >,\n  expectedGroupName: string,\n  readEncryptedName?: GroupPolicyNameReader,\n): Promise<void> {\n  const mismatch = await groupPolicyNameMismatch(\n    verifiedBundle,\n    expectedGroupName,\n    readEncryptedName,\n  );\n  if (mismatch) {\n    throw new GroupMembershipNameMismatchError(mismatch);\n  }\n}\n"]}

package/workflows/organizations/groupNames/groupNameUniqueness.js

@@ -0,0 +1,151 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../data/persistence/principalPolicyReferencePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { principalHeadMatchesReference, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../../principals/policyVerification.js";
+import { GroupMetadataUnreadableError } from "../groupMetadata/groupMetadataAccess.js";
+import { assertGroupMetadataBinding } from "../groupMetadata/groupMetadataBinding.js";
+import { canonicalGroupNameKey, readGroupPolicyPayloadName, } from "../principalPolicy/principalPolicyRequest.js";
+/**
+ * Loads one directory group at its committed head: from the local retained
+ * bundles when they already hold that head, and from the API otherwise.
+ */
+async function loadDirectoryGroupBundle(input, head) {
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", head.principalId);
+    const cached = await loadPrincipalPolicyBundleForReference(input.execSql, head, localCheckpoint);
+    const bundle = cached ??
+        (await input.apiClient.getCurrentPrincipalPolicy("group", head.principalId));
+    if (!bundle) {
+        throw new Error(`Organization directory group ${head.principalId} could not be loaded`);
+    }
+    if (!principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), head)) {
+        // Head drift is reachable by a concurrent admin mutation, so it is a
+        // plain error to retry on, not an incident (as in the share path). The
+        // typed errors stay for signature and projection failures.
+        throw new Error("Organization directory group policy does not match the signed organization directory");
+    }
+    return { bundle, localCheckpoint };
+}
+/**
+ * A bundle served from local retention was verified when it was retained, and
+ * is verified again here on purpose: the re-check costs local CPU only, and it
+ * keeps the name a group vouches for independent of what any earlier caller
+ * trusted at retention time.
+ */
+export async function verifyDirectoryGroup(input, head) {
+    const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(input, head);
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(`Organization directory group signer key could not be loaded (${signerPublicKeys.error})`);
+    }
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: head,
+        loadExternalAuthority: async () => input.externalAuthority,
+        localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Organization directory group verification failed");
+    }
+    assertGroupMetadataBinding(bundle, input.descriptor);
+    const name = await readDirectoryGroupName(input, bundle);
+    return {
+        bundle,
+        name,
+        nameKey: name === null ? null : canonicalGroupNameKey(name),
+        policy: verified.value,
+    };
+}
+/**
+ * A verified group whose name no member can open has no name to select by. The
+ * walk isolates it rather than failing every name in the organization, but it
+ * still records the incident: only a dishonest admin signs such a name.
+ */
+export async function readDirectoryGroupName(input, bundle) {
+    try {
+        return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);
+    }
+    catch (error) {
+        if (!(error instanceof GroupMetadataUnreadableError))
+            throw error;
+        await input.reportSecurityIncident(new KeyingVerificationError("invalid_shape", "Signed group name does not open under the cited metadata key"), {
+            evidenceHashes: { stateHash: bundle.currentState.stateHash },
+            objectId: bundle.currentState.principalId,
+            objectKind: "principal",
+            operation: "organization.groupName",
+            organizationId: input.organizationId,
+        });
+        return null;
+    }
+}
+/**
+ * Signed group names are the only authenticated label a member can choose a
+ * group by, and the API does not make them unique within an organization. So
+ * uniqueness is enforced here, where a name enters: before an admin signs a
+ * new group, every group committed in the signed organization directory
+ * (the reserved Admins and Members groups included) is loaded, verified
+ * against its directory head, and its committed name compared by canonical
+ * key. A share then needs only the target's verified name. A compromised
+ * server cannot mint a signed group, so it cannot create the duplicate this
+ * check refuses.
+ *
+ * The walk is fail-closed: one group that cannot be loaded or verified blocks
+ * the creation, since an unverifiable group could carry any name. A verified
+ * group whose name does not decrypt is skipped: no member can open that name,
+ * so it cannot collide with one. It runs the
+ * loads in parallel and retains every verified bundle, so a later creation
+ * finds unchanged groups locally and fetches only those whose head moved.
+ */
+const DIRECTORY_WALK_CONCURRENCY = 4;
+/** Runs `work` over `items` with at most `limit` in flight, keeping order. */
+async function mapWithConcurrency(items, limit, work) {
+    const results = [];
+    let next = 0;
+    const worker = async () => {
+        for (;;) {
+            const index = next++;
+            const item = items[index];
+            if (index >= items.length || item === undefined)
+                return;
+            results[index] = await work(item);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
+}
+export async function assertGroupNameUniqueInDirectory(input) {
+    const nameKey = canonicalGroupNameKey(input.name);
+    // Each verified bundle is retained as soon as it verifies, so a failure
+    // later in the walk (or a taken name) still leaves the cache warm for the
+    // retry. Retention runs in a transaction on the shared connection, so the
+    // writes are chained one after another while the loads stay concurrent.
+    const retainedAt = new Date().toISOString();
+    let retention = Promise.resolve();
+    const verifyAndRetain = async (head) => {
+        const group = await verifyDirectoryGroup(input, head);
+        retention = retention.then(() => retainVerifiedPrincipalPolicyBundle({
+            bundle: group.bundle,
+            execSql: input.execSql,
+            organizationId: input.organizationId,
+            policy: group.policy,
+            updatedAt: retainedAt,
+        }));
+        await retention;
+        return group;
+    };
+    const groups = await mapWithConcurrency(input.descriptor.groupHeads, DIRECTORY_WALK_CONCURRENCY, verifyAndRetain);
+    // A taken name is user input to correct, not evidence of tampering, so this
+    // is a plain error: group creation runs under security-incident reporting,
+    // which records every KeyingVerificationError.
+    if (groups.some((group) => group.nameKey === nameKey)) {
+        throw new Error("Another signed group in this organization already carries this name");
+    }
+}
+//# sourceMappingURL=groupNameUniqueness.js.map

package/workflows/organizations/groupNames/groupNameUniqueness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupNameUniqueness.js","sourceRoot":"","sources":["groupNameUniqueness.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+DAA+D,CAAC;AACtH,OAAO,EAAE,mCAAmC,EAAE,MAAM,uEAAuE,CAAC;AAC5H,OAAO,EAEL,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,sDAAsD,CAAC;AAK9D,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EACL,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AAuBnD;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,MAAM,MAAM,GACV,MAAM;QACN,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,WAAW,sBAAsB,CACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,IAAI,CACL,EACD,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,wBAAwB,CAChE,KAAK,EACL,IAAI,CACL,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,gBAAgB,CAAC,KAAK,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,IAAI;QACvB,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB;QAC1D,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO;QACL,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3D,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAGC,EACD,MAAwD;IAExD,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;YAC5D,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YACzC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAuB,EACvB,KAAa,EACb,IAA6B;IAE7B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAC9D,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA0D;IAE1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,EAC3B,IAAwB,EACS,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9B,mCAAmC,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,UAAU;SACtB,CAAC,CACH,CAAC;QACF,MAAM,SAAS,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,UAAU,CAAC,UAAU,EAC3B,0BAA0B,EAC1B,eAAe,CAChB,CAAC;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../../principals/policyVerification\";\nimport { GroupMetadataUnreadableError } from \"../groupMetadata/groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport {\n  canonicalGroupNameKey,\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"../principalPolicy/principalPolicyRequest\";\n\nexport interface DirectoryGroupWalkInput {\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly apiClient: CurrentPrincipalPolicyReader;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly execSql: ExecSql;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\ntype DirectoryGroupHead = OrganizationAuthorityDescriptor[\"groupHeads\"][number];\n\ninterface VerifiedDirectoryGroup {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  /** Null when the signed name does not decrypt for any member. */\n  readonly name: string | null;\n  readonly nameKey: string | null;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\n/**\n * Loads one directory group at its committed head: from the local retained\n * bundles when they already hold that head, and from the API otherwise.\n */\nasync function loadDirectoryGroupBundle(\n  input: DirectoryGroupWalkInput,\n  head: DirectoryGroupHead,\n) {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    head.principalId,\n  );\n  const cached = await loadPrincipalPolicyBundleForReference(\n    input.execSql,\n    head,\n    localCheckpoint,\n  );\n  const bundle =\n    cached ??\n    (await input.apiClient.getCurrentPrincipalPolicy(\n      \"group\",\n      head.principalId,\n    ));\n  if (!bundle) {\n    throw new Error(\n      `Organization directory group ${head.principalId} could not be loaded`,\n    );\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      head,\n    )\n  ) {\n    // Head drift is reachable by a concurrent admin mutation, so it is a\n    // plain error to retry on, not an incident (as in the share path). The\n    // typed errors stay for signature and projection failures.\n    throw new Error(\n      \"Organization directory group policy does not match the signed organization directory\",\n    );\n  }\n  return { bundle, localCheckpoint };\n}\n\n/**\n * A bundle served from local retention was verified when it was retained, and\n * is verified again here on purpose: the re-check costs local CPU only, and it\n * keeps the name a group vouches for independent of what any earlier caller\n * trusted at retention time.\n */\nexport async function verifyDirectoryGroup(\n  input: DirectoryGroupWalkInput,\n  head: DirectoryGroupHead,\n): Promise<VerifiedDirectoryGroup> {\n  const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(\n    input,\n    head,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(\n      `Organization directory group signer key could not be loaded (${signerPublicKeys.error})`,\n    );\n  }\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: head,\n      loadExternalAuthority: async () => input.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Organization directory group verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, input.descriptor);\n  const name = await readDirectoryGroupName(input, bundle);\n  return {\n    bundle,\n    name,\n    nameKey: name === null ? null : canonicalGroupNameKey(name),\n    policy: verified.value,\n  };\n}\n\n/**\n * A verified group whose name no member can open has no name to select by. The\n * walk isolates it rather than failing every name in the organization, but it\n * still records the incident: only a dishonest admin signs such a name.\n */\nexport async function readDirectoryGroupName(\n  input: Pick<\n    DirectoryGroupWalkInput,\n    \"readEncryptedName\" | \"reportSecurityIncident\" | \"organizationId\"\n  >,\n  bundle: Parameters<typeof readGroupPolicyPayloadName>[0],\n): Promise<string | null> {\n  try {\n    return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: bundle.currentState.stateHash },\n        objectId: bundle.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n\n/**\n * Signed group names are the only authenticated label a member can choose a\n * group by, and the API does not make them unique within an organization. So\n * uniqueness is enforced here, where a name enters: before an admin signs a\n * new group, every group committed in the signed organization directory\n * (the reserved Admins and Members groups included) is loaded, verified\n * against its directory head, and its committed name compared by canonical\n * key. A share then needs only the target's verified name. A compromised\n * server cannot mint a signed group, so it cannot create the duplicate this\n * check refuses.\n *\n * The walk is fail-closed: one group that cannot be loaded or verified blocks\n * the creation, since an unverifiable group could carry any name. A verified\n * group whose name does not decrypt is skipped: no member can open that name,\n * so it cannot collide with one. It runs the\n * loads in parallel and retains every verified bundle, so a later creation\n * finds unchanged groups locally and fetches only those whose head moved.\n */\nconst DIRECTORY_WALK_CONCURRENCY = 4;\n\n/** Runs `work` over `items` with at most `limit` in flight, keeping order. */\nasync function mapWithConcurrency<T, R>(\n  items: ReadonlyArray<T>,\n  limit: number,\n  work: (item: T) => Promise<R>,\n): Promise<R[]> {\n  const results: R[] = [];\n  let next = 0;\n  const worker = async () => {\n    for (;;) {\n      const index = next++;\n      const item = items[index];\n      if (index >= items.length || item === undefined) return;\n      results[index] = await work(item);\n    }\n  };\n  await Promise.all(\n    Array.from({ length: Math.min(limit, items.length) }, worker),\n  );\n  return results;\n}\n\nexport async function assertGroupNameUniqueInDirectory(\n  input: DirectoryGroupWalkInput & { readonly name: string },\n): Promise<void> {\n  const nameKey = canonicalGroupNameKey(input.name);\n  // Each verified bundle is retained as soon as it verifies, so a failure\n  // later in the walk (or a taken name) still leaves the cache warm for the\n  // retry. Retention runs in a transaction on the shared connection, so the\n  // writes are chained one after another while the loads stay concurrent.\n  const retainedAt = new Date().toISOString();\n  let retention: Promise<void> = Promise.resolve();\n  const verifyAndRetain = async (\n    head: DirectoryGroupHead,\n  ): Promise<VerifiedDirectoryGroup> => {\n    const group = await verifyDirectoryGroup(input, head);\n    retention = retention.then(() =>\n      retainVerifiedPrincipalPolicyBundle({\n        bundle: group.bundle,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        policy: group.policy,\n        updatedAt: retainedAt,\n      }),\n    );\n    await retention;\n    return group;\n  };\n  const groups = await mapWithConcurrency(\n    input.descriptor.groupHeads,\n    DIRECTORY_WALK_CONCURRENCY,\n    verifyAndRetain,\n  );\n  // A taken name is user input to correct, not evidence of tampering, so this\n  // is a plain error: group creation runs under security-incident reporting,\n  // which records every KeyingVerificationError.\n  if (groups.some((group) => group.nameKey === nameKey)) {\n    throw new Error(\n      \"Another signed group in this organization already carries this name\",\n    );\n  }\n}\n"]}

package/workflows/organizations/groupNames/organizationGroupNamePolicies.js

@@ -0,0 +1,48 @@
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../data/persistence/principalPolicyReferencePersistence.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { loadOrganizationExternalAdminPolicy } from "../../principals/externalAdminPolicy.js";
+/** Cached directory policies are reusable only at the exact projected head. */
+export async function loadGroupNameDirectoryAuthority(input) {
+    const load = async (reference) => {
+        const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, reference.principalType, reference.principalId);
+        const bundle = (await loadPrincipalPolicyBundleForReference(input.execSql, reference, checkpoint)) ??
+            (await input.apiClient.getCurrentPrincipalPolicy(reference.principalType, reference.principalId));
+        if (bundle &&
+            !principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), reference))
+            throw new Error("Group name authority does not match the projected directory head");
+        return bundle;
+    };
+    const organization = input.organizationPolicyReference
+        ? await load(input.organizationPolicyReference)
+        : await input.apiClient.getCurrentPrincipalPolicy("organization", input.organizationId);
+    if (!organization)
+        return null;
+    return loadOrganizationExternalAdminPolicy({
+        ...input,
+        currentPolicyReader: directoryPinnedPolicyReader({
+            load,
+            organization,
+            organizationId: input.organizationId,
+        }),
+    });
+}
+/**
+ * Serves the organization bundle already read and each directory group at the
+ * head that organization's directory pins, so the authority check reads the
+ * heads the projection cited rather than whatever the server holds now.
+ */
+function directoryPinnedPolicyReader(input) {
+    return {
+        getCurrentPrincipalPolicy: async (type, id) => {
+            if (type === "organization")
+                return id === input.organizationId ? input.organization : null;
+            // Reached only after the organization signature and scope checks.
+            const descriptor = parseOrganizationAuthorityDescriptor(input.organization.currentPayload.ciphertext);
+            const head = descriptor.groupHeads.find((head) => head.principalId === id);
+            return head ? input.load(head) : null;
+        },
+    };
+}
+//# sourceMappingURL=organizationGroupNamePolicies.js.map

package/workflows/organizations/groupNames/organizationGroupNamePolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationGroupNamePolicies.js","sourceRoot":"","sources":["organizationGroupNamePolicies.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+DAA+D,CAAC;AACtH,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAE1G,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAW3F,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAAY;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,SAAkC,EAAE,EAAE;QACxD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,MAAM,GACV,CAAC,MAAM,qCAAqC,CAC1C,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;YACF,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC,CAAC;QACL,IACE,MAAM;YACN,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,SAAS,CACV;YAED,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,2BAA2B;QACpD,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC;QAC/C,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC7C,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACN,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,mCAAmC,CAAC;QACzC,GAAG,KAAK;QACR,mBAAmB,EAAE,2BAA2B,CAAC;YAC/C,IAAI;YACJ,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,KAMpC;IACC,OAAO;QACL,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC5C,IAAI,IAAI,KAAK,cAAc;gBACzB,OAAO,EAAE,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,kEAAkE;YAClE,MAAM,UAAU,GAAG,oCAAoC,CACrD,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,UAAU,CAC7C,CAAC;YACF,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAClC,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../data/persistence/principalPolicyReferencePersistence\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\nimport { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport type { DirectoryGroupWalkInput } from \"./groupNameUniqueness\";\n\ntype Input = Pick<\n  DirectoryGroupWalkInput,\n  \"apiClient\" | \"execSql\" | \"organizationId\" | \"resolveTrustedUserIdentity\"\n> & {\n  readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n  readonly stillCurrent: () => boolean;\n};\n\n/** Cached directory policies are reusable only at the exact projected head. */\nexport async function loadGroupNameDirectoryAuthority(input: Input) {\n  const load = async (reference: ReferencedPrincipalHead) => {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      input.execSql,\n      reference.principalType,\n      reference.principalId,\n    );\n    const bundle =\n      (await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      )) ??\n      (await input.apiClient.getCurrentPrincipalPolicy(\n        reference.principalType,\n        reference.principalId,\n      ));\n    if (\n      bundle &&\n      !principalHeadMatchesReference(\n        principalPolicyReferenceFromBundle(bundle),\n        reference,\n      )\n    )\n      throw new Error(\n        \"Group name authority does not match the projected directory head\",\n      );\n    return bundle;\n  };\n  const organization = input.organizationPolicyReference\n    ? await load(input.organizationPolicyReference)\n    : await input.apiClient.getCurrentPrincipalPolicy(\n        \"organization\",\n        input.organizationId,\n      );\n  if (!organization) return null;\n  return loadOrganizationExternalAdminPolicy({\n    ...input,\n    currentPolicyReader: directoryPinnedPolicyReader({\n      load,\n      organization,\n      organizationId: input.organizationId,\n    }),\n  });\n}\n\n/**\n * Serves the organization bundle already read and each directory group at the\n * head that organization's directory pins, so the authority check reads the\n * heads the projection cited rather than whatever the server holds now.\n */\nfunction directoryPinnedPolicyReader(input: {\n  readonly load: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<PrincipalPolicyBundleResponse | null>;\n  readonly organization: PrincipalPolicyBundleResponse;\n  readonly organizationId: string;\n}): CurrentPrincipalPolicyReader {\n  return {\n    getCurrentPrincipalPolicy: async (type, id) => {\n      if (type === \"organization\")\n        return id === input.organizationId ? input.organization : null;\n      // Reached only after the organization signature and scope checks.\n      const descriptor = parseOrganizationAuthorityDescriptor(\n        input.organization.currentPayload.ciphertext,\n      );\n      const head = descriptor.groupHeads.find(\n        (head) => head.principalId === id,\n      );\n      return head ? input.load(head) : null;\n    },\n  };\n}\n"]}

package/workflows/organizations/groupNames/organizationGroupNames.js

@@ -0,0 +1,13 @@
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { hydrateCurrentOrganizationGroupNames } from "./currentOrganizationGroupNames.js";
+/** Verify names against the signed directory before projecting decrypted labels. */
+export async function hydrateOrganizationGroupNames(input) {
+    if (!input.resolveCurrentPolicy)
+        throw new ProjectionDependencyUnavailableError("Group names require private paged recovery");
+    return hydrateCurrentOrganizationGroupNames({
+        ...input,
+        organizationReference: input.organizationPolicyReference,
+        resolveCurrentPolicy: input.resolveCurrentPolicy,
+    });
+}
+//# sourceMappingURL=organizationGroupNames.js.map

package/workflows/organizations/groupNames/organizationGroupNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationGroupNames.js","sourceRoot":"","sources":["organizationGroupNames.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AAExH,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AAGvF,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAaC;IAED,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAC7B,MAAM,IAAI,oCAAoC,CAC5C,4CAA4C,CAC7C,CAAC;IACJ,OAAO,oCAAoC,CAAC;QAC1C,GAAG,KAAK;QACR,qBAAqB,EAAE,KAAK,CAAC,2BAA2B;QACxD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport type { OrganizationDirectoryAndGroups } from \"../readModel\";\nimport { hydrateCurrentOrganizationGroupNames } from \"./currentOrganizationGroupNames\";\nimport type { DirectoryGroupWalkInput } from \"./groupNameUniqueness\";\n\n/** Verify names against the signed directory before projecting decrypted labels. */\nexport async function hydrateOrganizationGroupNames(\n  input: Omit<DirectoryGroupWalkInput, \"descriptor\" | \"externalAuthority\"> & {\n    readonly directory: OrganizationDirectoryAndGroups;\n    readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n    readonly recoveryBatch?: object | undefined;\n    readonly stillCurrent: () => boolean;\n    readonly createCurrentNameReader?: Parameters<\n      typeof hydrateCurrentOrganizationGroupNames\n    >[0][\"createCurrentNameReader\"];\n    readonly resolveCurrentPolicy?:\n      | Parameters<\n          typeof hydrateCurrentOrganizationGroupNames\n        >[0][\"resolveCurrentPolicy\"]\n      | undefined;\n  },\n): Promise<OrganizationDirectoryAndGroups> {\n  if (!input.resolveCurrentPolicy)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group names require private paged recovery\",\n    );\n  return hydrateCurrentOrganizationGroupNames({\n    ...input,\n    organizationReference: input.organizationPolicyReference,\n    resolveCurrentPolicy: input.resolveCurrentPolicy,\n  });\n}\n"]}

package/workflows/organizations/groupPolicy/commitCurrentGroupPolicyMutation.js

@@ -0,0 +1,139 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "../groups/organizationGroupDirectory.js";
+import { assertAuthoredPrincipalMutationReceipt } from "../principalMutations/principalMutationReceipt.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
+import { prepareAuthoredGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
+import { submitGroupPolicyCommit, } from "./groupPolicyMutationContext.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+/** Commit and retain the group, optional roster enrollment and directory together. */
+export async function commitCurrentGroupPolicyMutation(input) {
+    const { context } = input;
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const [signer] = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: [input.signerUserId],
+    });
+    if (!signer)
+        throw new Error("Group policy signer is unavailable");
+    const member = input.member
+        ? await prepareChange(input.member, signer)
+        : null;
+    const { expectedHead, prepared } = await prepareChange(input, signer, member?.preceding);
+    const organizationRequest = await prepareDirectory(input, expectedHead, member?.expectedHead);
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const response = await submitGroupPolicyCommit({
+        apiClient: input.apiClient,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        request: input.request,
+        organizationRequest,
+        memberRequest: input.member?.request,
+        // A compound retry must rebuild both batches' shared speculative heads.
+        // Refuse the whole transaction if a damaged-key repair needs extra rekeys;
+        // ordinary adds preserve key epochs and need no descendant carry retry.
+        carryDescendantRekeys: member ? undefined : prepared.carry,
+        stillCurrent: context.stillCurrent,
+    });
+    if (!response)
+        throw new Error("Group policy update failed");
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    await assertAuthoredPrincipalMutationReceipt({
+        groupPolicy: input.request,
+        organizationPolicy: organizationRequest,
+        ...(input.member ? { memberPolicy: input.member.request } : {}),
+    }, response);
+    await context.retainAcknowledged({
+        additionalGroups: input.member && response.memberPolicy
+            ? [
+                {
+                    ...input.member.context.groupRetention,
+                    request: input.member.request,
+                    response: response.memberPolicy,
+                    retiredContainerIds: member?.prepared.retiredContainerIds,
+                },
+            ]
+            : [],
+        request: input.request,
+        organizationRequest,
+        response,
+        retiredContainerIds: prepared.retiredContainerIds,
+    });
+    if (member && response.memberPolicy) {
+        await member.prepared.acknowledge(response.memberPolicy.containerMutations, context.stillCurrent);
+    }
+    await prepared.acknowledge(response.groupPolicy.containerMutations, context.stillCurrent);
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    return response.groupPolicy;
+}
+async function prepareChange(change, signer, preceding) {
+    const expectedHead = await groupPolicyMutationHead(change.request);
+    const nextPolicy = await prepareAuthoredGroupPolicy({
+        verifiedCurrentPolicy: change.context.verifiedCurrentPolicy,
+        expectedHead,
+        request: change.request,
+        signerPublicKeys: [signer],
+        externalAuthority: change.context.externalAuthority,
+        localPolicyCheckpoint: change.context.localPolicyCheckpoint,
+        stillCurrent: change.context.stillCurrent,
+    });
+    const prepared = await change.prepareContainerMutations(nextPolicy, preceding);
+    change.request.containerMutations = [...prepared.requests];
+    return {
+        expectedHead,
+        prepared,
+        preceding: prepared.preceding
+            ? {
+                ...prepared.preceding,
+                authored: [
+                    ...(preceding?.authored ?? []),
+                    {
+                        organizationId: change.context.organizationDescriptor.organizationId,
+                        policy: nextPolicy,
+                        dependencies: [
+                            change.context.organizationCurrent.policy,
+                            change.context.adminCurrent.policy,
+                        ],
+                        stillCurrent: change.context.stillCurrent,
+                    },
+                ],
+            }
+            : undefined,
+    };
+}
+async function prepareDirectory(input, expectedHead, memberHead) {
+    const { context } = input;
+    if (input.member &&
+        (input.member.context.currentPolicy.currentState.principalId !==
+            context.memberGroupId ||
+            input.member.context.organizationCurrent.current.currentState
+                .stateHash !==
+                context.organizationCurrent.current.currentState.stateHash))
+        throw new Error("Roster and group changes must share the same organization policy");
+    let groupHeads = replaceOrganizationGroupHead({
+        descriptor: context.organizationDescriptor,
+        nextHead: expectedHead,
+    });
+    if (memberHead)
+        groupHeads = replaceOrganizationGroupHead({
+            descriptor: { ...context.organizationDescriptor, groupHeads },
+            nextHead: memberHead,
+        });
+    const adminProjection = context.isOrganizationAdminsGroup
+        ? input.request.projection
+        : context.adminCurrent.current.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(adminProjection),
+    });
+    return buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection,
+        adminUsers,
+        currentPolicy: context.organizationCurrent.current,
+        descriptor: context.organizationDescriptor,
+        groupHeads,
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+}
+//# sourceMappingURL=commitCurrentGroupPolicyMutation.js.map