@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/policyHistory/organizationPolicyHistoryVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationPolicyHistoryVerification.js","sourceRoot":"","sources":["organizationPolicyHistoryVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,EAC1C,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAGlE,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,gCAAgC,OAAO,EAAE,CAC1C,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpE,IACE,IAAI,CAAC,aAAa,KAAK,cAAc;QACrC,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,WAAW;QAC5C,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACrC,QAAQ,CAAC,aAAa,KAAK,aAAa;QACxC,QAAQ,CAAC,iBAAiB,KAAK,IAAI,CAAC,iBAAiB;QACrD,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY;QAC/B,CAAC,6BAA6B,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;QAEzE,MAAM,CAAC,yDAAyD,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW;QAC9B,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAClE,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2C,CAAC;IACvE,MAAM,UAAU,GAA8B,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,KAAK,MAAM,CACT,KAAK,EACL,IAAI,EACL,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IACE,CAAC,KAAK;YACN,CAAC,6BAA6B,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC;YACtD,OAAO,CAAC,aAAa,KAAK,cAAc;YACxC,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YACxC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;YACzC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;YAEpC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,0CAA0C,CAC3D,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IACE,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,qBAAqB;YAC1C,IAAI,KAAK,OAAO,CAAC,cAAc;YAE/B,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,oCAAoC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,cAAc,KAAK,IAAI,CAAC,WAAW;YAChD,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACtD,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACjD,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO;gBAC/C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA2C,EAC3C,MAA4C;IAE5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI;QACjD,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,IACE,CAAC,QAAQ;YACT,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YACjC,CAAC,6BAA6B,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YAErD,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;AACH,CAAC","sourcesContent":["import {\n  computePrincipalStatePayloadCiphertextHash,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { OrganizationPolicyHistoryResponse } from \"@tearleads/validators/response\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { RecoveredPrincipalHistoryPage } from \"../../principals/historyRecovery/loadRecoveredPrincipalHistoryPage\";\n\nfunction reject(message: string): never {\n  throw new KeyingVerificationError(\n    \"hash_mismatch\",\n    `Organization policy history: ${message}`,\n  );\n}\n\n/** Bind every display payload and public source to the privately verified page. */\nexport async function verifyOrganizationPolicyHistory(input: {\n  readonly head: ReferencedPrincipalHead;\n  readonly page: RecoveredPrincipalHistoryPage;\n  readonly evidence: OrganizationPolicyHistoryResponse;\n}) {\n  const { head, page, evidence } = input;\n  const beforeVersion = (page.entries.at(-1)?.state.version ?? 0) + 1;\n  if (\n    head.principalType !== \"organization\" ||\n    evidence.organizationId !== head.principalId ||\n    evidence.stateHash !== head.stateHash ||\n    evidence.beforeVersion !== beforeVersion ||\n    evidence.nextBeforeVersion !== page.nextBeforeVersion ||\n    !evidence.evidence.organization ||\n    !principalHeadMatchesReference(evidence.evidence.organization.head, head)\n  )\n    reject(\"response does not match the requested organization page\");\n  const entries = page.predecessor\n    ? [page.predecessor, ...page.entries]\n    : page.entries;\n  if (evidence.evidence.organizationPayloads.length !== entries.length)\n    reject(\"directory page is incomplete\");\n  const descriptors = new Map<string, OrganizationAuthorityDescriptor>();\n  const references: ReferencedPrincipalHead[] = [head];\n  const groups = new Map<string, ReferencedPrincipalHead>();\n  for (const [\n    index,\n    item,\n  ] of evidence.evidence.organizationPayloads.entries()) {\n    const { reference, payload } = item;\n    const entry = entries[index];\n    if (\n      !entry ||\n      !principalHeadMatchesReference(entry.state, reference) ||\n      payload.principalType !== \"organization\" ||\n      payload.principalId !== head.principalId ||\n      payload.stateHash !== reference.stateHash ||\n      descriptors.has(reference.stateHash)\n    )\n      reject(\"directory payload scope or order is invalid\");\n    const hash = await computePrincipalStatePayloadCiphertextHash(\n      payload.ciphertext,\n    );\n    if (\n      hash !== entry.state.payloadCiphertextHash ||\n      hash !== payload.ciphertextHash\n    )\n      reject(\"directory payload does not match its signed hash\");\n    const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);\n    if (descriptor.organizationId !== head.principalId)\n      reject(\"directory belongs to another organization\");\n    descriptors.set(reference.stateHash, descriptor);\n    references.push(reference, ...descriptor.groupHeads);\n    for (const group of descriptor.groupHeads) {\n      const previous = groups.get(group.principalId);\n      if (!previous || group.version > previous.version)\n        groups.set(group.principalId, group);\n    }\n  }\n  verifyGroupSources(evidence, groups);\n  return { descriptors, references };\n}\n\nfunction verifyGroupSources(\n  evidence: OrganizationPolicyHistoryResponse,\n  groups: Map<string, ReferencedPrincipalHead>,\n) {\n  if (evidence.evidence.groups.length !== groups.size)\n    reject(\"unexpected group source\");\n  const seen = new Set<string>();\n  for (const source of evidence.evidence.groups) {\n    const expected = groups.get(source.head.principalId);\n    if (\n      !expected ||\n      seen.has(source.head.principalId) ||\n      !principalHeadMatchesReference(source.head, expected)\n    )\n      reject(\"group source extends beyond the page's signed directory\");\n    seen.add(source.head.principalId);\n  }\n}\n"]}

package/workflows/organizations/policyHistory/policyHistoryAccessDenial.js

@@ -0,0 +1,19 @@
+import { purgeOrganizationAccessProjection } from "../../../data/persistence/organizations/organizationAccessRevocationPersistence.js";
+import { recordOrganizationPresentationDenials } from "../../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
+import { denyOrganizationPresentationAccess, runOrganizationPresentationMutation, } from "../readModel/organizationPresentationAccessState.js";
+export async function denyPolicyHistoryAccess(input) {
+    denyOrganizationPresentationAccess(input, ["readModel", "usage"]);
+    try {
+        await runOrganizationPresentationMutation(input.execSql, () => recordOrganizationPresentationDenials(input, ["readModel", "usage"]));
+    }
+    catch (error) {
+        input.logError("Failed to record denied organization policy history", error);
+    }
+    try {
+        await runOrganizationPresentationMutation(input.execSql, () => purgeOrganizationAccessProjection(input));
+    }
+    catch (error) {
+        input.logError("Failed to purge denied organization policy history", error);
+    }
+}
+//# sourceMappingURL=policyHistoryAccessDenial.js.map

package/workflows/organizations/policyHistory/policyHistoryAccessDenial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyHistoryAccessDenial.js","sourceRoot":"","sources":["policyHistoryAccessDenial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,iFAAiF,CAAC;AACpI,OAAO,EAAE,qCAAqC,EAAE,MAAM,mFAAmF,CAAC;AAE1I,OAAO,EACL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,kDAAkD,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAK7C;IACC,kCAAkC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,qCAAqC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CACrE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,QAAQ,CACZ,qDAAqD,EACrD,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,iCAAiC,CAAC,KAAK,CAAC,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,QAAQ,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC","sourcesContent":["import { purgeOrganizationAccessProjection } from \"../../../data/persistence/organizations/organizationAccessRevocationPersistence\";\nimport { recordOrganizationPresentationDenials } from \"../../../data/persistence/organizations/organizationPresentationDenialPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  denyOrganizationPresentationAccess,\n  runOrganizationPresentationMutation,\n} from \"../readModel/organizationPresentationAccessState\";\n\nexport async function denyPolicyHistoryAccess(input: {\n  execSql: ExecSql;\n  organizationId: string;\n  requesterUserId: string;\n  logError: (message: string | Error, cause?: unknown) => void;\n}): Promise<void> {\n  denyOrganizationPresentationAccess(input, [\"readModel\", \"usage\"]);\n  try {\n    await runOrganizationPresentationMutation(input.execSql, () =>\n      recordOrganizationPresentationDenials(input, [\"readModel\", \"usage\"]),\n    );\n  } catch (error) {\n    input.logError(\n      \"Failed to record denied organization policy history\",\n      error,\n    );\n  }\n  try {\n    await runOrganizationPresentationMutation(input.execSql, () =>\n      purgeOrganizationAccessProjection(input),\n    );\n  } catch (error) {\n    input.logError(\"Failed to purge denied organization policy history\", error);\n  }\n}\n"]}

package/workflows/organizations/policyHistory/policyHistoryCache.js

@@ -0,0 +1,42 @@
+import { isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, organizationAccessScopeKey, } from "../readModel/organizationPresentationAccessState.js";
+// Only one verified page per account/org is retained. Names and wire
+// evidence never enter this cache, and nothing here is written to a database.
+const histories = new WeakMap();
+export function loadCachedPolicyHistory(input) {
+    const byKey = histories.get(input.domainScope);
+    const key = organizationAccessScopeKey(input.access.organizationId, input.access.requesterUserId);
+    const cached = byKey?.get(key);
+    if (!cached)
+        return null;
+    if (cached.access.execSql !== input.access.execSql ||
+        cached.stateHash !== input.stateHash ||
+        cached.beforeVersion !== input.beforeVersion ||
+        !isOrganizationPresentationAccessAttemptCurrent(input.access, cached.attempt) ||
+        !isOrganizationPresentationAccessReadable(input.access, "readModel")) {
+        byKey?.delete(key);
+        return null;
+    }
+    return structuredClone(cached.history);
+}
+export function cachePolicyHistory(input) {
+    if (!isOrganizationPresentationAccessAttemptCurrent(input.access, input.attempt) ||
+        !isOrganizationPresentationAccessReadable(input.access, "readModel"))
+        return;
+    let byKey = histories.get(input.domainScope);
+    if (!byKey) {
+        byKey = new Map();
+        histories.set(input.domainScope, byKey);
+    }
+    byKey.set(organizationAccessScopeKey(input.access.organizationId, input.access.requesterUserId), {
+        access: {
+            execSql: input.access.execSql,
+            organizationId: input.access.organizationId,
+            requesterUserId: input.access.requesterUserId,
+        },
+        attempt: input.attempt,
+        history: structuredClone(input.history),
+        stateHash: input.stateHash,
+        beforeVersion: input.beforeVersion,
+    });
+}
+//# sourceMappingURL=policyHistoryCache.js.map

package/workflows/organizations/policyHistory/policyHistoryCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyHistoryCache.js","sourceRoot":"","sources":["policyHistoryCache.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8CAA8C,EAC9C,wCAAwC,EAGxC,0BAA0B,GAC3B,MAAM,kDAAkD,CAAC;AAW1D,qEAAqE;AACrE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,OAAO,EAA2C,CAAC;AAEzE,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,0BAA0B,CACpC,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,KAAK,CAAC,MAAM,CAAC,eAAe,CAC7B,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;QAC9C,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACpC,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAC5C,CAAC,8CAA8C,CAC7C,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,OAAO,CACf;QACD,CAAC,wCAAwC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,EACpE,CAAC;QACD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAOlC;IACC,IACE,CAAC,8CAA8C,CAC7C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,OAAO,CACd;QACD,CAAC,wCAAwC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC;QAEpE,OAAO;IACT,IAAI,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,CAAC,GAAG,CACP,0BAA0B,CACxB,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,KAAK,CAAC,MAAM,CAAC,eAAe,CAC7B,EACD;QACE,MAAM,EAAE;YACN,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;SAC9C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../../data/shared/domainScope\";\nimport {\n  isOrganizationPresentationAccessAttemptCurrent,\n  isOrganizationPresentationAccessReadable,\n  type OrganizationPresentationAccessAttempt,\n  type OrganizationPresentationAccessInput,\n  organizationAccessScopeKey,\n} from \"../readModel/organizationPresentationAccessState\";\nimport type { OrganizationPolicyHistory } from \"./policyHistoryTypes\";\n\ninterface CachedHistory {\n  readonly access: OrganizationPresentationAccessInput;\n  readonly attempt: OrganizationPresentationAccessAttempt;\n  readonly history: OrganizationPolicyHistory;\n  readonly stateHash: string;\n  readonly beforeVersion: number;\n}\n\n// Only one verified page per account/org is retained. Names and wire\n// evidence never enter this cache, and nothing here is written to a database.\nconst histories = new WeakMap<DomainScope, Map<string, CachedHistory>>();\n\nexport function loadCachedPolicyHistory(input: {\n  domainScope: DomainScope;\n  access: OrganizationPresentationAccessInput;\n  stateHash: string;\n  beforeVersion: number;\n}): OrganizationPolicyHistory | null {\n  const byKey = histories.get(input.domainScope);\n  const key = organizationAccessScopeKey(\n    input.access.organizationId,\n    input.access.requesterUserId,\n  );\n  const cached = byKey?.get(key);\n  if (!cached) return null;\n  if (\n    cached.access.execSql !== input.access.execSql ||\n    cached.stateHash !== input.stateHash ||\n    cached.beforeVersion !== input.beforeVersion ||\n    !isOrganizationPresentationAccessAttemptCurrent(\n      input.access,\n      cached.attempt,\n    ) ||\n    !isOrganizationPresentationAccessReadable(input.access, \"readModel\")\n  ) {\n    byKey?.delete(key);\n    return null;\n  }\n  return structuredClone(cached.history);\n}\n\nexport function cachePolicyHistory(input: {\n  domainScope: DomainScope;\n  access: OrganizationPresentationAccessInput;\n  attempt: OrganizationPresentationAccessAttempt;\n  history: OrganizationPolicyHistory;\n  stateHash: string;\n  beforeVersion: number;\n}): void {\n  if (\n    !isOrganizationPresentationAccessAttemptCurrent(\n      input.access,\n      input.attempt,\n    ) ||\n    !isOrganizationPresentationAccessReadable(input.access, \"readModel\")\n  )\n    return;\n  let byKey = histories.get(input.domainScope);\n  if (!byKey) {\n    byKey = new Map();\n    histories.set(input.domainScope, byKey);\n  }\n  byKey.set(\n    organizationAccessScopeKey(\n      input.access.organizationId,\n      input.access.requesterUserId,\n    ),\n    {\n      access: {\n        execSql: input.access.execSql,\n        organizationId: input.access.organizationId,\n        requesterUserId: input.access.requesterUserId,\n      },\n      attempt: input.attempt,\n      history: structuredClone(input.history),\n      stateHash: input.stateHash,\n      beforeVersion: input.beforeVersion,\n    },\n  );\n}\n"]}

package/workflows/organizations/policyHistory/policyHistoryReadModel.d.ts

@@ -0,0 +1,9 @@
+import type { PrincipalPolicyBundleResponse, PrincipalProjectionMemberResponse } from "../../../internal/validators/response/index.js";
+import type { OrganizationGroupPolicyHistory, OrganizationPolicyHistory, OrganizationPrincipalMemberChange } from "./policyHistoryTypes.js";
+export type { OrganizationGroupPolicyHistory, OrganizationGroupPolicyHistoryEntry, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, } from "./policyHistoryTypes.js";
+export declare function diffPrincipalProjectionMembers(input: {
+    readonly current: ReadonlyArray<PrincipalProjectionMemberResponse>;
+    readonly previous: ReadonlyArray<PrincipalProjectionMemberResponse>;
+}): OrganizationPrincipalMemberChange[];
+export declare function buildOrganizationGroupPolicyHistory(bundle: PrincipalPolicyBundleResponse, organizationId: string): OrganizationGroupPolicyHistory;
+export declare function buildOrganizationPolicyHistory(bundle: PrincipalPolicyBundleResponse): OrganizationPolicyHistory;

package/workflows/organizations/policyHistory/policyHistoryTypes.d.ts

@@ -0,0 +1,58 @@
+import type { PrincipalContainerGrantResponse, PrincipalProjectionMemberResponse, PrincipalStateResponse } from "../../../internal/validators/response/index.js";
+export type OrganizationPrincipalMemberChangeType = "added" | "removed" | "role_changed";
+export interface OrganizationPrincipalMemberChange {
+    readonly changeType: OrganizationPrincipalMemberChangeType;
+    readonly userId: string;
+    readonly nextRole: PrincipalProjectionMemberResponse["role"] | null;
+    readonly previousRole: PrincipalProjectionMemberResponse["role"] | null;
+}
+export interface OrganizationPrincipalPolicyHistoryEntry {
+    readonly changes: OrganizationPrincipalMemberChange[];
+    readonly createdAt: string;
+    readonly keyEpoch: number;
+    readonly memberCount: number;
+    readonly signedAt: string;
+    readonly signerUserId: string;
+    readonly signerUserKeyFingerprint: string;
+    readonly stateHash: string;
+    readonly version: number;
+}
+export type OrganizationGroupPolicyHistoryEntry = OrganizationPrincipalPolicyHistoryEntry;
+export interface OrganizationPrincipalPolicyHistory {
+    readonly entries: OrganizationPrincipalPolicyHistoryEntry[];
+    readonly principalId: string;
+    readonly principalType: PrincipalStateResponse["principalType"];
+}
+export interface OrganizationGroupPolicyHistory extends OrganizationPrincipalPolicyHistory {
+    /** Exclusive cursor for older entries; null once the oldest is loaded. */
+    readonly nextBeforeVersion: number | null;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly principalType: "group";
+}
+export interface OrganizationPolicyHistory extends OrganizationPrincipalPolicyHistory {
+    /** Exclusive cursor for older entries; null once the oldest is loaded. */
+    readonly nextBeforeVersion: number | null;
+    readonly entries: OrganizationPolicyHistoryEntry[];
+    readonly organizationId: string;
+    readonly principalType: "organization";
+}
+export interface OrganizationPolicyHistoryEntry extends OrganizationPrincipalPolicyHistoryEntry {
+    /** Null when the additional signed evidence has not been loaded. */
+    readonly groupChanges: OrganizationPolicyGroupChange[] | null;
+}
+export interface OrganizationPolicyGrantChange {
+    readonly containerId: string;
+    readonly previousAccess: PrincipalContainerGrantResponse["accessLevel"] | null;
+    readonly nextAccess: PrincipalContainerGrantResponse["accessLevel"] | null;
+}
+export interface OrganizationPolicyGroupChange {
+    readonly groupId: string;
+    readonly changeType: "created" | "updated" | "deleted";
+    readonly previousVersion: number | null;
+    readonly version: number;
+    readonly previousKeyEpoch: number | null;
+    readonly keyEpoch: number;
+    readonly changes: OrganizationPrincipalMemberChange[];
+    readonly grantChanges: OrganizationPolicyGrantChange[];
+}

package/workflows/organizations/principalMutations/acknowledgedDirectoryBindings.js

@@ -0,0 +1,18 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+/** Couple supplied group receipts to the directory acknowledged in the same batch. */
+export function assertAcknowledgedDirectoryBindings(organizationId, receipts) {
+    const directories = receipts.filter((receipt) => receipt.currentState.principalType === "organization");
+    if (directories.length === 0 &&
+        receipts.some((receipt) => receipt.currentState.principalType === "group"))
+        throw new KeyingVerificationError("missing_dependency", "Acknowledged groups require their organization directory");
+    for (const directory of directories) {
+        const descriptor = parseOrganizationAuthorityDescriptor(directory.currentPayload.ciphertext);
+        if (directory.currentState.principalId !== organizationId ||
+            descriptor.organizationId !== organizationId ||
+            receipts.some(({ currentState }) => currentState.principalType === "group" &&
+                !descriptor.groupHeads.some((head) => principalHeadMatchesReference(head, currentState))))
+            throw new KeyingVerificationError("object_mismatch", "Acknowledged organization does not bind its group receipt");
+    }
+}
+//# sourceMappingURL=acknowledgedDirectoryBindings.js.map

package/workflows/organizations/principalMutations/acknowledgedDirectoryBindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acknowledgedDirectoryBindings.js","sourceRoot":"","sources":["acknowledgedDirectoryBindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAElE,sFAAsF;AACtF,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,QAAoD;IAEpD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc,CACnE,CAAC;IACF,IACE,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO,CAAC;QAE1E,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,0DAA0D,CAC3D,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,oCAAoC,CACrD,SAAS,CAAC,cAAc,CAAC,UAAU,CACpC,CAAC;QACF,IACE,SAAS,CAAC,YAAY,CAAC,WAAW,KAAK,cAAc;YACrD,UAAU,CAAC,cAAc,KAAK,cAAc;YAC5C,QAAQ,CAAC,IAAI,CACX,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CACnB,YAAY,CAAC,aAAa,KAAK,OAAO;gBACtC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,6BAA6B,CAAC,IAAI,EAAE,YAAY,CAAC,CAClD,CACJ;YAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACN,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\n\n/** Couple supplied group receipts to the directory acknowledged in the same batch. */\nexport function assertAcknowledgedDirectoryBindings(\n  organizationId: string,\n  receipts: readonly PrincipalPolicyMutationResponse[],\n) {\n  const directories = receipts.filter(\n    (receipt) => receipt.currentState.principalType === \"organization\",\n  );\n  if (\n    directories.length === 0 &&\n    receipts.some((receipt) => receipt.currentState.principalType === \"group\")\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Acknowledged groups require their organization directory\",\n    );\n  for (const directory of directories) {\n    const descriptor = parseOrganizationAuthorityDescriptor(\n      directory.currentPayload.ciphertext,\n    );\n    if (\n      directory.currentState.principalId !== organizationId ||\n      descriptor.organizationId !== organizationId ||\n      receipts.some(\n        ({ currentState }) =>\n          currentState.principalType === \"group\" &&\n          !descriptor.groupHeads.some((head) =>\n            principalHeadMatchesReference(head, currentState),\n          ),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Acknowledged organization does not bind its group receipt\",\n      );\n  }\n}\n"]}

package/workflows/organizations/principalMutations/currentGroupMutationReferences.js

@@ -0,0 +1,35 @@
+import { selectPrincipalPolicyCurrentPredecessorReferences, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+/** Select only this path's old citations, preserving the authored membership. */
+export async function resolveCurrentGroupMutationReferences(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const references = structuredClone(input.references);
+    const select = (current, predecessor, selected) => selectPrincipalPolicyCurrentPredecessorReferences({
+        current,
+        predecessor,
+        references: selected,
+    });
+    // Normalize and bound the entire request before any per-reference I/O.
+    const initial = select(input.current, input.predecessor, references);
+    if (initial.ok)
+        return initial.value;
+    if (initial.error.code !== "missing_dependency")
+        throw initial.error;
+    let current = input.current;
+    const selected = [];
+    for (const reference of references) {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        selected.push(reference);
+        let result = select(current, input.predecessor, selected);
+        if (!result.ok && result.error.code === "missing_dependency") {
+            const predecessor = await input.readPredecessorReference(reference);
+            assertProjectionVerificationCurrent(input.stillCurrent);
+            result = select(current, predecessor, selected);
+        }
+        if (!result.ok)
+            throw result.error;
+        current = result.value;
+    }
+    return current;
+}
+//# sourceMappingURL=currentGroupMutationReferences.js.map

package/workflows/organizations/principalMutations/currentGroupMutationReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupMutationReferences.js","sourceRoot":"","sources":["currentGroupMutationReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iDAAiD,GAElD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAEvG,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CACb,OAAuC,EACvC,WAA2C,EAC3C,QAA4C,EAC5C,EAAE,CACF,iDAAiD,CAAC;QAChD,OAAO;QACP,WAAW;QACX,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;IACL,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrE,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import {\n  type ReferencedPrincipalHead,\n  selectPrincipalPolicyCurrentPredecessorReferences,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\n\n/** Select only this path's old citations, preserving the authored membership. */\nexport async function resolveCurrentGroupMutationReferences(input: {\n  readonly current: VerifiedPrincipalPolicyCurrent;\n  readonly predecessor: VerifiedPrincipalPolicyCurrent;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly readPredecessorReference: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<VerifiedPrincipalPolicyCurrent>;\n  readonly stillCurrent: () => boolean;\n}): Promise<VerifiedPrincipalPolicyCurrent> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const references = structuredClone(input.references);\n  const select = (\n    current: VerifiedPrincipalPolicyCurrent,\n    predecessor: VerifiedPrincipalPolicyCurrent,\n    selected: readonly ReferencedPrincipalHead[],\n  ) =>\n    selectPrincipalPolicyCurrentPredecessorReferences({\n      current,\n      predecessor,\n      references: selected,\n    });\n  // Normalize and bound the entire request before any per-reference I/O.\n  const initial = select(input.current, input.predecessor, references);\n  if (initial.ok) return initial.value;\n  if (initial.error.code !== \"missing_dependency\") throw initial.error;\n  let current = input.current;\n  const selected: ReferencedPrincipalHead[] = [];\n  for (const reference of references) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    selected.push(reference);\n    let result = select(current, input.predecessor, selected);\n    if (!result.ok && result.error.code === \"missing_dependency\") {\n      const predecessor = await input.readPredecessorReference(reference);\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      result = select(current, predecessor, selected);\n    }\n    if (!result.ok) throw result.error;\n    current = result.value;\n  }\n  return current;\n}\n"]}

package/workflows/organizations/principalMutations/currentOrganizationMutationAuthority.js

@@ -0,0 +1,16 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { organizationAdminSignerUserIds } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { loadCurrentOrganizationAuthority } from "../currentOrganizationAuthority.js";
+/** Resolve uncertain work and verify the signing administrator before any mutation pins. */
+export async function loadCurrentOrganizationMutationAuthority(input) {
+    const owned = { ...input };
+    assertProjectionVerificationCurrent(owned.stillCurrent);
+    await owned.recoverPendingPrincipalMutation(owned.organizationId);
+    assertProjectionVerificationCurrent(owned.stillCurrent);
+    const authority = await loadCurrentOrganizationAuthority(owned);
+    const currentOrgAdminUserIds = organizationAdminSignerUserIds(authority.admins.policy);
+    if (!currentOrgAdminUserIds.includes(owned.signerUserId))
+        throw new Error("Organization admin authority is required");
+    return { authority, currentOrgAdminUserIds };
+}
+//# sourceMappingURL=currentOrganizationMutationAuthority.js.map

package/workflows/organizations/principalMutations/currentOrganizationMutationAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationMutationAuthority.js","sourceRoot":"","sources":["currentOrganizationMutationAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEnF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAQC;IAED,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3B,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,+BAA+B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,sBAAsB,GAAG,8BAA8B,CAC3D,SAAS,CAAC,MAAM,CAAC,MAAM,CACxB,CAAC;IACF,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { organizationAdminSignerUserIds } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport { loadCurrentOrganizationAuthority } from \"../currentOrganizationAuthority\";\n\n/** Resolve uncertain work and verify the signing administrator before any mutation pins. */\nexport async function loadCurrentOrganizationMutationAuthority(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  > & {\n    readonly signerUserId: string;\n    readonly recoverPendingPrincipalMutation: (\n      organizationId: string,\n    ) => Promise<void>;\n  },\n) {\n  const owned = { ...input };\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  await owned.recoverPendingPrincipalMutation(owned.organizationId);\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  const authority = await loadCurrentOrganizationAuthority(owned);\n  const currentOrgAdminUserIds = organizationAdminSignerUserIds(\n    authority.admins.policy,\n  );\n  if (!currentOrgAdminUserIds.includes(owned.signerUserId))\n    throw new Error(\"Organization admin authority is required\");\n  return { authority, currentOrgAdminUserIds };\n}\n"]}

package/workflows/organizations/principalMutations/currentOrganizationMutationRetention.js

@@ -0,0 +1,64 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { scopedGroupHistoryProtection } from "../../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { captureAcknowledgedPrincipalPredecessor } from "../../principals/acknowledgements/acknowledgedPrincipalPredecessor.js";
+import { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+/** Couple directory acknowledgements to any newly created group under the same lease. */
+export async function createCurrentOrganizationMutationRetention(input) {
+    const predecessor = await captureAcknowledgedPrincipalPredecessor({
+        ...input.directoryRecovery,
+        execSql: input.runtime.infra.execSql,
+        organizationId: input.organizationId,
+        stillCurrent: input.stillCurrent,
+    });
+    const retain = async (entries) => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        await retainAcknowledgedPrincipalCurrents({
+            execSql: input.runtime.infra.execSql,
+            organizationId: input.organizationId,
+            entries,
+            stillCurrent: input.stillCurrent,
+        });
+    };
+    return {
+        retainDirectory: (request, response) => retain([
+            { predecessor, request, response, recovery: input.directoryRecovery },
+        ]),
+        retainCreatedGroup: (receipt) => {
+            const adminHead = {
+                ...principalPolicyReferenceFromBundle(input.authority.admins.current),
+                principalType: "group",
+            };
+            return retain([
+                {
+                    initialGroup: true,
+                    predecessor: null,
+                    request: receipt.request,
+                    response: receipt.response,
+                    recovery: {
+                        historyReader: input.historyReader,
+                        expectedHead: principalPolicyReferenceFromBundle(receipt.response),
+                        protection: scopedGroupHistoryProtection(input.protection, input.organizationId, input.authority.descriptor.adminGroupId),
+                        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                        loadExternalAuthority: async () => ({
+                            currentHead: adminHead,
+                            states: [
+                                {
+                                    head: adminHead,
+                                    projection: input.authority.admins.policy.projection,
+                                },
+                            ],
+                        }),
+                    },
+                },
+                {
+                    predecessor,
+                    request: receipt.organizationRequest,
+                    response: receipt.organizationResponse,
+                    recovery: input.directoryRecovery,
+                },
+            ]);
+        },
+    };
+}
+//# sourceMappingURL=currentOrganizationMutationRetention.js.map

package/workflows/organizations/principalMutations/currentOrganizationMutationRetention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentOrganizationMutationRetention.js","sourceRoot":"","sources":["currentOrganizationMutationRetention.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,oEAAoE,CAAC;AAI7H,OAAO,EAEL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAUhE;IACC,MAAM,WAAW,GAAG,MAAM,uCAAuC,CAAC;QAChE,GAAG,KAAK,CAAC,iBAAiB;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,EAClB,OAAqD,EACrD,EAAE;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,eAAe,EAAE,CACf,OAAkC,EAClC,QAAyC,EACzC,EAAE,CACF,MAAM,CAAC;YACL,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,iBAAiB,EAAE;SACtE,CAAC;QACJ,kBAAkB,EAAE,CAAC,OAKpB,EAAE,EAAE;YACH,MAAM,SAAS,GAAG;gBAChB,GAAG,kCAAkC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;gBACrE,aAAa,EAAE,OAAgB;aAChC,CAAC;YACF,OAAO,MAAM,CAAC;gBACZ;oBACE,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE;wBACR,aAAa,EAAE,KAAK,CAAC,aAAa;wBAClC,YAAY,EAAE,kCAAkC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAClE,UAAU,EAAE,4BAA4B,CACtC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CACxC;wBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;wBAC1C,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;4BAClC,WAAW,EAAE,SAAS;4BACtB,MAAM,EAAE;gCACN;oCACE,IAAI,EAAE,SAAS;oCACf,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;iCACrD;6BACF;yBACF,CAAC;qBACH;iBACF;gBACD;oBACE,WAAW;oBACX,OAAO,EAAE,OAAO,CAAC,mBAAmB;oBACpC,QAAQ,EAAE,OAAO,CAAC,oBAAoB;oBACtC,QAAQ,EAAE,KAAK,CAAC,iBAAiB;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { scopedGroupHistoryProtection } from \"../../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport { captureAcknowledgedPrincipalPredecessor } from \"../../principals/acknowledgements/acknowledgedPrincipalPredecessor\";\nimport type { PrincipalPolicyPageReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"../../principals/runtimePolicyRecovery\";\nimport type { loadCurrentOrganizationAuthority } from \"../currentOrganizationAuthority\";\nimport {\n  type AcknowledgedPrincipalCurrentInput,\n  retainAcknowledgedPrincipalCurrents,\n} from \"./retainAcknowledgedPrincipalCurrents\";\n\n/** Couple directory acknowledgements to any newly created group under the same lease. */\nexport async function createCurrentOrganizationMutationRetention(input: {\n  readonly runtime: PrincipalPolicyRecoveryRuntime;\n  readonly authority: Awaited<\n    ReturnType<typeof loadCurrentOrganizationAuthority>\n  >;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly historyReader: PrincipalPolicyPageReader;\n  readonly organizationId: string;\n  readonly directoryRecovery: AcknowledgedPrincipalCurrentInput[\"recovery\"];\n  readonly stillCurrent: () => boolean;\n}) {\n  const predecessor = await captureAcknowledgedPrincipalPredecessor({\n    ...input.directoryRecovery,\n    execSql: input.runtime.infra.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n  });\n  const retain = async (\n    entries: readonly AcknowledgedPrincipalCurrentInput[],\n  ) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    await retainAcknowledgedPrincipalCurrents({\n      execSql: input.runtime.infra.execSql,\n      organizationId: input.organizationId,\n      entries,\n      stillCurrent: input.stillCurrent,\n    });\n  };\n  return {\n    retainDirectory: (\n      request: PutPrincipalPolicyRequest,\n      response: PrincipalPolicyMutationResponse,\n    ) =>\n      retain([\n        { predecessor, request, response, recovery: input.directoryRecovery },\n      ]),\n    retainCreatedGroup: (receipt: {\n      readonly request: PutPrincipalPolicyRequest;\n      readonly response: PrincipalPolicyMutationResponse;\n      readonly organizationRequest: PutPrincipalPolicyRequest;\n      readonly organizationResponse: PrincipalPolicyMutationResponse;\n    }) => {\n      const adminHead = {\n        ...principalPolicyReferenceFromBundle(input.authority.admins.current),\n        principalType: \"group\" as const,\n      };\n      return retain([\n        {\n          initialGroup: true,\n          predecessor: null,\n          request: receipt.request,\n          response: receipt.response,\n          recovery: {\n            historyReader: input.historyReader,\n            expectedHead: principalPolicyReferenceFromBundle(receipt.response),\n            protection: scopedGroupHistoryProtection(\n              input.protection,\n              input.organizationId,\n              input.authority.descriptor.adminGroupId,\n            ),\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n            loadExternalAuthority: async () => ({\n              currentHead: adminHead,\n              states: [\n                {\n                  head: adminHead,\n                  projection: input.authority.admins.policy.projection,\n                },\n              ],\n            }),\n          },\n        },\n        {\n          predecessor,\n          request: receipt.organizationRequest,\n          response: receipt.organizationResponse,\n          recovery: input.directoryRecovery,\n        },\n      ]);\n    },\n  };\n}\n"]}

package/workflows/organizations/principalMutations/currentPrincipalMutationLease.js

@@ -0,0 +1,39 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { readPrincipalHistoryProtection } from "../../../data/principals/principalHistoryRuntime.js";
+import { directoryHistoryProtection } from "../../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { apiPrincipalPolicyPageReader, } from "../../principals/principalPolicyHistoryReader.js";
+import { createRuntimePrincipalPolicyCurrentResolver, } from "../../principals/runtimePolicyRecovery.js";
+/** One lifetime fence and private custody boundary for every current-policy mutation. */
+export function createCurrentPrincipalMutationLease(runtime) {
+    const lease = readPrincipalHistoryProtection(runtime);
+    const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(runtime);
+    const historyReader = apiPrincipalPolicyPageReader(runtime.apiClient);
+    if (!lease || !resolveCurrentPolicy || !historyReader)
+        return undefined;
+    return async (callerCurrent, work) => lease(async ({ protection, stillCurrent: leaseCurrent }) => {
+        let active = true;
+        const stillCurrent = () => active && leaseCurrent() && callerCurrent();
+        try {
+            assertProjectionVerificationCurrent(stillCurrent);
+            const result = await work({
+                protection,
+                stillCurrent,
+                resolveCurrentPolicy,
+                historyReader,
+                directoryRecovery: (current) => ({
+                    historyReader,
+                    expectedHead: principalPolicyReferenceFromBundle(current),
+                    protection: directoryHistoryProtection(protection),
+                    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+                }),
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            return result;
+        }
+        finally {
+            active = false;
+        }
+    });
+}
+//# sourceMappingURL=currentPrincipalMutationLease.js.map

package/workflows/organizations/principalMutations/currentPrincipalMutationLease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentPrincipalMutationLease.js","sourceRoot":"","sources":["currentPrincipalMutationLease.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kDAAkD,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,0DAA0D,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EACL,4BAA4B,GAE7B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,2CAA2C,GAE5C,MAAM,wCAAwC,CAAC;AAoBhD,yFAAyF;AACzF,MAAM,UAAU,mCAAmC,CACjD,OAAuC;IAEvC,MAAM,KAAK,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,oBAAoB,GACxB,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,4BAA4B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,oBAAoB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,KAAK,EACV,aAA4B,EAC5B,IAAmE,EACvD,EAAE,CACd,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QACzD,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,MAAM,IAAI,YAAY,EAAE,IAAI,aAAa,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,UAAU;gBACV,YAAY;gBACZ,oBAAoB;gBACpB,aAAa;gBACb,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC/B,aAAa;oBACb,YAAY,EAAE,kCAAkC,CAAC,OAAO,CAAC;oBACzD,UAAU,EAAE,0BAA0B,CAAC,UAAU,CAAC;oBAClD,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;iBAC/D,CAAC;aACH,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { readPrincipalHistoryProtection } from \"../../../data/principals/principalHistoryRuntime\";\nimport { directoryHistoryProtection } from \"../../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport {\n  apiPrincipalPolicyPageReader,\n  type PrincipalPolicyPageReader,\n} from \"../../principals/principalPolicyHistoryReader\";\nimport {\n  createRuntimePrincipalPolicyCurrentResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"../../principals/runtimePolicyRecovery\";\nimport type { AcknowledgedPrincipalCurrentInput } from \"./retainAcknowledgedPrincipalCurrents\";\n\ninterface CurrentPrincipalMutationLeaseContext {\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly stillCurrent: () => boolean;\n  readonly resolveCurrentPolicy: NonNullable<\n    ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>\n  >;\n  readonly historyReader: PrincipalPolicyPageReader;\n  readonly directoryRecovery: (\n    current: PrincipalPolicyPageCurrent,\n  ) => AcknowledgedPrincipalCurrentInput[\"recovery\"];\n}\n\ntype CurrentPrincipalMutationLease = <T>(\n  callerCurrent: () => boolean,\n  work: (context: CurrentPrincipalMutationLeaseContext) => Promise<T>,\n) => Promise<T>;\n\n/** One lifetime fence and private custody boundary for every current-policy mutation. */\nexport function createCurrentPrincipalMutationLease(\n  runtime: PrincipalPolicyRecoveryRuntime,\n): CurrentPrincipalMutationLease | undefined {\n  const lease = readPrincipalHistoryProtection(runtime);\n  const resolveCurrentPolicy =\n    createRuntimePrincipalPolicyCurrentResolver(runtime);\n  const historyReader = apiPrincipalPolicyPageReader(runtime.apiClient);\n  if (!lease || !resolveCurrentPolicy || !historyReader) return undefined;\n  return async <T>(\n    callerCurrent: () => boolean,\n    work: (context: CurrentPrincipalMutationLeaseContext) => Promise<T>,\n  ): Promise<T> =>\n    lease(async ({ protection, stillCurrent: leaseCurrent }) => {\n      let active = true;\n      const stillCurrent = () => active && leaseCurrent() && callerCurrent();\n      try {\n        assertProjectionVerificationCurrent(stillCurrent);\n        const result = await work({\n          protection,\n          stillCurrent,\n          resolveCurrentPolicy,\n          historyReader,\n          directoryRecovery: (current) => ({\n            historyReader,\n            expectedHead: principalPolicyReferenceFromBundle(current),\n            protection: directoryHistoryProtection(protection),\n            resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n          }),\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        return result;\n      } finally {\n        active = false;\n      }\n    });\n}\n"]}

package/workflows/organizations/principalMutations/principalMutationJournalManagement.d.ts

@@ -0,0 +1,26 @@
+import { type AuthoredPrincipalMutation } from "../../../data/principals/principalMutationJournal.js";
+import type { PrincipalMutationJournalContext } from "./principalMutationJournalSession.js";
+export interface PrincipalMutationRecoveryApi {
+    readonly readPendingPrincipalMutation: (organizationId: string) => Promise<AuthoredPrincipalMutation | null>;
+    readonly recoverPendingPrincipalMutation: (organizationId: string) => Promise<void>;
+    readonly abandonPendingPrincipalMutation: (organizationId: string, mutation: AuthoredPrincipalMutation, acknowledgeUnknownOutcome: true) => Promise<boolean>;
+    readonly discardUnreadablePrincipalMutation: (organizationId: string, recordId: string, acknowledgeUnknownOutcome: true) => Promise<boolean>;
+}
+type JournalIdentity = Pick<PrincipalMutationJournalContext, "execSql" | "scope" | "signingKeyPair" | "stillCurrent">;
+/** Discard only the inspected unreadable bytes; never parse them for submission. */
+export declare function discardUnreadableJournaledPrincipalMutation(input: JournalIdentity & {
+    readonly recordId: string;
+    readonly acknowledgeUnknownOutcome: true;
+}): Promise<boolean>;
+/** Inspect authenticated authored work without retrying it or changing checkpoints. */
+export declare function readJournaledPrincipalMutation(input: JournalIdentity): Promise<AuthoredPrincipalMutation | null>;
+/**
+ * An explicit host/user choice to stop retries, not a claim that the write failed.
+ * The exact inspected request must still own the lane; ordinary recovery never
+ * calls this. Future authoring must still verify the latest policy state.
+ */
+export declare function abandonJournaledPrincipalMutation(input: JournalIdentity & {
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly acknowledgeUnknownOutcome: true;
+}): Promise<boolean>;
+export {};

package/workflows/organizations/principalMutations/principalMutationJournalManagement.js

@@ -0,0 +1,104 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../../data/keying/canonicalJson.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { clearPrincipalMutationJournal, loadPrincipalMutationJournal, } from "../../../data/persistence/principalMutationJournalPersistence.js";
+import { openPrincipalMutation, principalMutationJournalScopeId, } from "../../../data/principals/principalMutationJournal.js";
+import { principalMutationJournalRecordId, UnreadablePrincipalMutationError, } from "../../../data/principals/principalMutationJournalRecord.js";
+import { getOrCreatePrincipalPolicyCoordinator } from "../../../data/principals/principalPolicyCoordinator.js";
+async function loadAuthenticatedMutation(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const row = await loadPrincipalMutationJournal(input.execSql, await principalMutationJournalScopeId(input.scope));
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    if (!row)
+        return null;
+    let mutation;
+    try {
+        mutation = await openPrincipalMutation({
+            scope: input.scope,
+            row,
+            signingPublicKey: input.signingKeyPair.signingPublicKey,
+        });
+    }
+    catch (error) {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        if (!(error instanceof KeyingVerificationError))
+            throw error;
+        const recordId = await principalMutationJournalRecordId(row);
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        throw new UnreadablePrincipalMutationError(recordId, error.code === "invalid_shape" ? "format" : "authentication");
+    }
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    return { row, mutation };
+}
+/** Discard only the inspected unreadable bytes; never parse them for submission. */
+export async function discardUnreadableJournaledPrincipalMutation(input) {
+    if (input.acknowledgeUnknownOutcome !== true)
+        throw new Error("Discarding unreadable work requires acknowledging its unknown outcome");
+    const expected = input.recordId;
+    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const row = await loadPrincipalMutationJournal(input.execSql, await principalMutationJournalScopeId(input.scope));
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        if (!row)
+            return false;
+        if ((await principalMutationJournalRecordId(row)) !== expected)
+            throw new Error("The unreadable principal mutation changed after inspection");
+        let unreadable = false;
+        try {
+            await openPrincipalMutation({
+                scope: input.scope,
+                row,
+                signingPublicKey: input.signingKeyPair.signingPublicKey,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof KeyingVerificationError))
+                throw error;
+            unreadable = true;
+        }
+        if (!unreadable)
+            throw new Error("Readable principal mutations require ordinary abandonment");
+        const removed = await clearPrincipalMutationJournal({
+            execSql: input.execSql,
+            row,
+            stillCurrent: input.stillCurrent,
+        });
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        if (!removed)
+            throw new Error("The unreadable principal mutation changed during discard");
+        return true;
+    });
+}
+/** Inspect authenticated authored work without retrying it or changing checkpoints. */
+export async function readJournaledPrincipalMutation(input) {
+    // Inspection may observe an owned dispatch; all mutations still use the lane.
+    return (await loadAuthenticatedMutation(input))?.mutation ?? null;
+}
+/**
+ * An explicit host/user choice to stop retries, not a claim that the write failed.
+ * The exact inspected request must still own the lane; ordinary recovery never
+ * calls this. Future authoring must still verify the latest policy state.
+ */
+export async function abandonJournaledPrincipalMutation(input) {
+    if (input.acknowledgeUnknownOutcome !== true)
+        throw new Error("Abandoning authored work requires acknowledging its unknown outcome");
+    const expected = canonicalKeyingJsonString(JSON.parse(JSON.stringify(input.mutation)), "inspected authored mutation");
+    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
+        const saved = await loadAuthenticatedMutation(input);
+        if (!saved)
+            return false;
+        if (canonicalKeyingJsonString(saved.mutation, "saved authored mutation") !==
+            expected)
+            throw new Error("The pending principal mutation changed after inspection");
+        const removed = await clearPrincipalMutationJournal({
+            execSql: input.execSql,
+            row: saved.row,
+            stillCurrent: input.stillCurrent,
+        });
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        if (!removed)
+            throw new Error("The pending principal mutation changed during abandonment");
+        return true;
+    });
+}
+//# sourceMappingURL=principalMutationJournalManagement.js.map

package/workflows/organizations/principalMutations/principalMutationJournalManagement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalManagement.js","sourceRoot":"","sources":["principalMutationJournalManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAEL,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,qDAAqD,CAAC;AA2B5G,KAAK,UAAU,yBAAyB,CAAC,KAAsB;IAC7D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAC5C,KAAK,CAAC,OAAO,EACb,MAAM,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CACnD,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,QAAmC,CAAC;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,qBAAqB,CAAC;YACrC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG;YACH,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC7D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,IAAI,gCAAgC,CACxC,QAAQ,EACR,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAC7D,CAAC;IACJ,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,KAGC;IAED,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI;QAC1C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAC5C,KAAK,CAAC,OAAO,EACb,MAAM,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CACnD,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM,gCAAgC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ;YAC5D,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;gBACH,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;aACxD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC7D,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG;YACH,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAsB;IAEtB,8EAA8E;IAC9E,OAAO,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI;QAC1C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,MAAM,QAAQ,GAAG,yBAAyB,CACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC1C,6BAA6B,CAC9B,CAAC;IACF,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IACE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,yBAAyB,CAAC;YACpE,QAAQ;YAER,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { canonicalKeyingJsonString } from \"../../../data/keying/canonicalJson\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport {\n  clearPrincipalMutationJournal,\n  loadPrincipalMutationJournal,\n} from \"../../../data/persistence/principalMutationJournalPersistence\";\nimport {\n  type AuthoredPrincipalMutation,\n  openPrincipalMutation,\n  principalMutationJournalScopeId,\n} from \"../../../data/principals/principalMutationJournal\";\nimport {\n  principalMutationJournalRecordId,\n  UnreadablePrincipalMutationError,\n} from \"../../../data/principals/principalMutationJournalRecord\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../../data/principals/principalPolicyCoordinator\";\nimport type { PrincipalMutationJournalContext } from \"./principalMutationJournalSession\";\n\nexport interface PrincipalMutationRecoveryApi {\n  readonly readPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<AuthoredPrincipalMutation | null>;\n  readonly recoverPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<void>;\n  readonly abandonPendingPrincipalMutation: (\n    organizationId: string,\n    mutation: AuthoredPrincipalMutation,\n    acknowledgeUnknownOutcome: true,\n  ) => Promise<boolean>;\n  readonly discardUnreadablePrincipalMutation: (\n    organizationId: string,\n    recordId: string,\n    acknowledgeUnknownOutcome: true,\n  ) => Promise<boolean>;\n}\n\ntype JournalIdentity = Pick<\n  PrincipalMutationJournalContext,\n  \"execSql\" | \"scope\" | \"signingKeyPair\" | \"stillCurrent\"\n>;\n\nasync function loadAuthenticatedMutation(input: JournalIdentity) {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const row = await loadPrincipalMutationJournal(\n    input.execSql,\n    await principalMutationJournalScopeId(input.scope),\n  );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!row) return null;\n  let mutation: AuthoredPrincipalMutation;\n  try {\n    mutation = await openPrincipalMutation({\n      scope: input.scope,\n      row,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  } catch (error) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!(error instanceof KeyingVerificationError)) throw error;\n    const recordId = await principalMutationJournalRecordId(row);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    throw new UnreadablePrincipalMutationError(\n      recordId,\n      error.code === \"invalid_shape\" ? \"format\" : \"authentication\",\n    );\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { row, mutation };\n}\n\n/** Discard only the inspected unreadable bytes; never parse them for submission. */\nexport async function discardUnreadableJournaledPrincipalMutation(\n  input: JournalIdentity & {\n    readonly recordId: string;\n    readonly acknowledgeUnknownOutcome: true;\n  },\n): Promise<boolean> {\n  if (input.acknowledgeUnknownOutcome !== true)\n    throw new Error(\n      \"Discarding unreadable work requires acknowledging its unknown outcome\",\n    );\n  const expected = input.recordId;\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const row = await loadPrincipalMutationJournal(\n      input.execSql,\n      await principalMutationJournalScopeId(input.scope),\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!row) return false;\n    if ((await principalMutationJournalRecordId(row)) !== expected)\n      throw new Error(\n        \"The unreadable principal mutation changed after inspection\",\n      );\n    let unreadable = false;\n    try {\n      await openPrincipalMutation({\n        scope: input.scope,\n        row,\n        signingPublicKey: input.signingKeyPair.signingPublicKey,\n      });\n    } catch (error) {\n      if (!(error instanceof KeyingVerificationError)) throw error;\n      unreadable = true;\n    }\n    if (!unreadable)\n      throw new Error(\n        \"Readable principal mutations require ordinary abandonment\",\n      );\n    const removed = await clearPrincipalMutationJournal({\n      execSql: input.execSql,\n      row,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!removed)\n      throw new Error(\n        \"The unreadable principal mutation changed during discard\",\n      );\n    return true;\n  });\n}\n\n/** Inspect authenticated authored work without retrying it or changing checkpoints. */\nexport async function readJournaledPrincipalMutation(\n  input: JournalIdentity,\n): Promise<AuthoredPrincipalMutation | null> {\n  // Inspection may observe an owned dispatch; all mutations still use the lane.\n  return (await loadAuthenticatedMutation(input))?.mutation ?? null;\n}\n\n/**\n * An explicit host/user choice to stop retries, not a claim that the write failed.\n * The exact inspected request must still own the lane; ordinary recovery never\n * calls this. Future authoring must still verify the latest policy state.\n */\nexport async function abandonJournaledPrincipalMutation(\n  input: JournalIdentity & {\n    readonly mutation: AuthoredPrincipalMutation;\n    readonly acknowledgeUnknownOutcome: true;\n  },\n): Promise<boolean> {\n  if (input.acknowledgeUnknownOutcome !== true)\n    throw new Error(\n      \"Abandoning authored work requires acknowledging its unknown outcome\",\n    );\n  const expected = canonicalKeyingJsonString(\n    JSON.parse(JSON.stringify(input.mutation)),\n    \"inspected authored mutation\",\n  );\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    const saved = await loadAuthenticatedMutation(input);\n    if (!saved) return false;\n    if (\n      canonicalKeyingJsonString(saved.mutation, \"saved authored mutation\") !==\n      expected\n    )\n      throw new Error(\n        \"The pending principal mutation changed after inspection\",\n      );\n    const removed = await clearPrincipalMutationJournal({\n      execSql: input.execSql,\n      row: saved.row,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!removed)\n      throw new Error(\n        \"The pending principal mutation changed during abandonment\",\n      );\n    return true;\n  });\n}\n"]}

package/workflows/organizations/principalMutations/principalMutationJournalSession.d.ts

@@ -0,0 +1,26 @@
+import type { RequestResult } from "../../../internal/api-client/index.js";
+import type { SigningKeyPair } from "../../../internal/crypto/index.js";
+import { type AuthoredPrincipalMutation, type PrincipalMutationJournalScope } from "../../../data/principals/principalMutationJournal.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { type PrincipalMutationResponse } from "./principalOperationReceipt.js";
+type MutationResult = RequestResult<PrincipalMutationResponse>;
+export interface PrincipalMutationJournalContext {
+    readonly execSql: ExecSql;
+    readonly scope: PrincipalMutationJournalScope;
+    readonly signingKeyPair: SigningKeyPair;
+    readonly stillCurrent: () => boolean;
+    readonly submit: (mutation: AuthoredPrincipalMutation) => Promise<MutationResult>;
+}
+export declare class PrincipalMutationOutcomeUnknownError extends Error {
+    constructor(options?: ErrorOptions);
+}
+/** No HTTP begins until the exact authored request is durably claimed. */
+export declare function submitJournaledPrincipalMutation(input: PrincipalMutationJournalContext & {
+    readonly mutation: AuthoredPrincipalMutation;
+}): Promise<MutationResult>;
+/** Retry only authenticated saved bytes, never an application mutation callback. */
+export declare function recoverJournaledPrincipalMutation(input: PrincipalMutationJournalContext): Promise<{
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly response: PrincipalMutationResponse;
+} | null>;
+export {};