@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/principalPolicy/principalPolicyRequest.js

@@ -0,0 +1,176 @@
+import { buildPrincipalStateSigningInput, encodeBuiltinGroupMetadata, encryptGroupMetadata, generateKemSeedAndKeyPair, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, readGroupMetadata, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+export function userProjectionMember(userId, role) {
+    return { userId: userId, role };
+}
+function projectionToStateMembers(projection) {
+    return projection.map((member) => ({ userId: member.userId }));
+}
+/**
+ * Code points that must never appear in a group name: control and format
+ * characters (bidi overrides, zero-width joiners, newlines), lone surrogates
+ * (re-encoded as U+FFFD when signed, so the signed name would no longer match
+ * the one sent to the server), and every other default-ignorable code point
+ * (Hangul fillers, variation selectors), which render as nothing and would
+ * let one name pass for another. A group name is an identifier here, so this
+ * deliberately refuses ZWJ emoji sequences as well. One predicate serves the
+ * signing-time and the share-time refusal so the two cannot drift.
+ */
+function hasForbiddenGroupNameCharacter(name) {
+    return /[\p{Cc}\p{Cf}\p{Cs}\p{Default_Ignorable_Code_Point}]/u.test(name);
+}
+/**
+ * The comparison key for a group display name: width- and compatibility-
+ * normalized, stripped of control, format, and default-ignorable characters,
+ * whitespace-collapsed, and case-folded. Two names that a user cannot tell
+ * apart in a picker must compare equal, or a look-alike name would slip past
+ * the share-time binding. Cross-script homoglyphs (Latin "A" against Greek
+ * "Α") are not folded: that needs the UTS #39 confusables table, and both
+ * names would still have to be signed groups the organization's own admins
+ * created.
+ */
+export function canonicalGroupNameKey(name) {
+    return (name
+        .normalize("NFKC")
+        .replace(/[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/gu, "")
+        .replace(/\s+/gu, " ")
+        .trim()
+        .toLocaleLowerCase("en-US")
+        // Case folding can leave the string un-normalized (U+0130 lowercases to
+        // "i" plus a combining dot), so normalize once more after it.
+        .normalize("NFKC"));
+}
+/** Read only after the policy and its organization-directory binding verify. */
+export async function readGroupPolicyPayloadName(bundle, readEncryptedName) {
+    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
+    if ("role" in metadata)
+        return metadata.role === "admins" ? "Admins" : "Members";
+    if (!readEncryptedName)
+        throw new Error("Group metadata decryption context is unavailable");
+    return readEncryptedName(bundle);
+}
+/** One binding predicate for every operation selected by a read-model label. */
+export async function groupPolicyNameMismatch(bundle, expectedGroupName, readEncryptedName) {
+    if (hasForbiddenGroupNameCharacter(expectedGroupName)) {
+        return "forbidden_characters";
+    }
+    const signedName = await readGroupPolicyPayloadName(bundle, readEncryptedName);
+    if (hasForbiddenGroupNameCharacter(signedName))
+        return "forbidden_characters";
+    return canonicalGroupNameKey(signedName) ===
+        canonicalGroupNameKey(expectedGroupName)
+        ? null
+        : "name_mismatch";
+}
+export async function signedGroupPolicyRequest(input) {
+    const projection = normalizePrincipalProjectionMembers(input.projection);
+    const grants = normalizePrincipalContainerGrants(input.grants);
+    const payloadCiphertext = input.payloadCiphertext;
+    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
+        principalType: "group",
+        principalId: input.principalId,
+        version: input.currentPolicy
+            ? input.currentPolicy.currentState.version + 1
+            : 1,
+        prevStateHash: input.currentPolicy?.currentState.stateHash ?? null,
+        keyEpoch: input.keyEpoch,
+        encapsulationPublicKey: input.encapsulationPublicKey,
+        keyFingerprint: input.keyFingerprint,
+        members: projectionToStateMembers(projection),
+        memberEnvelopes: [...input.memberEnvelopes],
+        projection,
+        grants,
+        payloadCiphertext,
+        externalAuthority: input.externalAuthority,
+        signedAt: input.signedAt,
+        signerUserId: input.signerUserId,
+        signerUserKeyFingerprint: input.signingFingerprint,
+    }), input.signingKeyPair.signingPrivateKey);
+    return {
+        state,
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm",
+            ciphertext: payloadCiphertext,
+            ciphertextHash: state.payloadCiphertextHash,
+        },
+        projection,
+        grants,
+        memberEnvelopes: [...input.memberEnvelopes],
+    };
+}
+export async function buildInitialGroupPolicyRequest(input) {
+    const groupKem = generateKemSeedAndKeyPair();
+    const withSigner = input.includeSignerAsAdmin ?? true;
+    const projection = withSigner
+        ? [userProjectionMember(input.signerUserId, "admin")]
+        : [];
+    const memberEnvelopes = [];
+    if (withSigner) {
+        const creatorFingerprint = await toFingerprint(input.creatorEncapsulationKeyPair.publicKey);
+        const [creatorEnvelope] = await wrapDekForRecipients(groupKem.secretKey, [
+            input.creatorEncapsulationKeyPair.publicKey,
+        ]);
+        if (!creatorEnvelope) {
+            throw new Error("Failed to wrap group key for creator");
+        }
+        memberEnvelopes.push({
+            userId: input.signerUserId,
+            memberKeyFingerprint: creatorFingerprint,
+            kemCipherText: bytesToBase64(creatorEnvelope.kemCipherText),
+            wrappedKey: bytesToBase64(creatorEnvelope.wrappedKey),
+        });
+    }
+    const name = input.name.trim();
+    // A name is compared by canonical key but displayed raw, so an invisible
+    // code point would let one signed name render as another. Refuse them
+    // where the name is signed.
+    if (name.length === 0 || hasForbiddenGroupNameCharacter(name)) {
+        throw new Error("Group names must be non-empty and contain no control, format, or surrogate characters");
+    }
+    const payloadCiphertext = input.builtinRole
+        ? encodeBuiltinGroupMetadata(input.builtinRole)
+        : input.metadataKey
+            ? await encryptGroupMetadata({
+                key: input.metadataKey,
+                groupId: input.groupId,
+                name,
+            })
+            : (() => {
+                throw new Error("Group metadata encryption context is unavailable");
+            })();
+    const policyRequest = await signedGroupPolicyRequest({
+        encapsulationPublicKey: bytesToBase64(groupKem.publicKey),
+        externalAuthority: input.externalAuthority ?? null,
+        keyEpoch: 1,
+        keyFingerprint: await toFingerprint(groupKem.publicKey),
+        grants: input.grants ?? [],
+        memberEnvelopes,
+        payloadCiphertext,
+        principalId: input.groupId,
+        projection,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    return {
+        groupId: input.groupId,
+        initialGroupPolicy: policyRequest,
+    };
+}
+/**
+ * Members at bootstrap holds the registering user alone.
+ *
+ * It used to also contain the Admins group as a nested member, so that admins
+ * were implicitly members. Principals contain only users now, so an admin is an
+ * ordinary Members entry — and bootstrap has exactly one user, who is that
+ * admin.
+ */
+export async function buildInitialMemberGroupPolicyRequest(input) {
+    return buildInitialGroupPolicyRequest({
+        ...input,
+        name: "Members",
+        builtinRole: "members",
+    });
+}
+//# sourceMappingURL=principalPolicyRequest.js.map

package/workflows/organizations/provisioning/createOrganization.d.ts

@@ -0,0 +1,62 @@
+import { type EncapsulationKeyPair, type SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { CreateOrganizationRequest } from "../../../internal/validators/request/index.js";
+import type { CreateOrganizationResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentProjectorRegistryInput } from "../../../data/documents/documentKinds.js";
+import type { ExecSqlClientLike } from "../../../data/sqlite/sqlSchema.js";
+import type { ProvisionedPrincipalHistoryPrimer } from "../../registration/provisionedPrincipalHistory.js";
+import { type ProvisionedSystemContainerSpec } from "../../registration/registerIdentity.js";
+import { removeNativeSubscriptionRestoreProvisioningAttempt } from "./organizationProvisioningAttempt.js";
+export { removeNativeSubscriptionRestoreProvisioningAttempt };
+export interface CreateOrganizationApi {
+    createOrganization(request: CreateOrganizationRequest): Promise<CreateOrganizationResponse | null>;
+}
+export interface CreateOrganizationInput {
+    apiClient: CreateOrganizationApi;
+    dbClient: ExecSqlClientLike;
+    documentProjectors?: DocumentProjectorRegistryInput | undefined;
+    encapsulationKeyPair: EncapsulationKeyPair;
+    /**
+     * Returns false once the identity that supplied the key pairs is no longer
+     * active. Checked before the remote create (so a stale request is never
+     * submitted) and again before local persistence: an identity switch closes
+     * or renews the captured database client, so persisting would write another
+     * identity's bootstrap — or throw — after the org already exists remotely.
+     * The caller discards the result.
+     */
+    isIdentityCurrent?: (() => boolean) | undefined;
+    /** @internal Forwarded to the bootstrap persist; test-only seam. */
+    onPersistQueued?: (() => void) | undefined;
+    log?: ((message: string) => void) | undefined;
+    logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
+    /** Overrides the seeded organization profile name; see registration. */
+    organizationProfileName?: string | undefined;
+    /** Seeds verified recovery progress for the founding policy heads. */
+    primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;
+    /**
+     * App-owned system containers to provision atomically with the new
+     * organization (e.g. a trash bin). See registration.
+     */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+    /** Purged organization whose personal-org generation this replaces. */
+    replacesOrganizationId?: string | undefined;
+    /** Marks and durably replays a fresh native-subscription restore target. */
+    nativeSubscriptionRestore?: boolean | undefined;
+    /** Overrides the seeded self roster-profile nickname; see registration. */
+    rosterProfileNickname?: string | undefined;
+    signingKeyPair: SigningKeyPair;
+    /**
+     * The already-registered user creating the organization; they become its
+     * founding admin. The server independently requires this to match the
+     * authenticated session.
+     */
+    userId: string;
+}
+/**
+ * Provisions an additional organization for an already-registered user, reusing
+ * the exact artifact-build and local-persistence path as registration
+ * ({@link buildOrganizationProvisioningArtifacts} /
+ * {@link persistOrganizationProvisioningState}). Unlike registration it mints a
+ * fresh root container id, signs with the caller's existing identity, and needs
+ * no auth challenge — the user is already authenticated.
+ */
+export declare function createOrganization(input: CreateOrganizationInput): Promise<CreateOrganizationResponse | null>;

package/workflows/organizations/provisioning/createOrganization.js

@@ -0,0 +1,128 @@
+import { signOrganizationReplacementAuthorization, } from "../../../internal/crypto/index.js";
+import { createExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { buildOrganizationProvisioningArtifacts, persistOrganizationProvisioningState, } from "../../registration/registerIdentity.js";
+import { makeOrganizationProvisioningAttemptDurable, removeNativeSubscriptionRestoreProvisioningAttempt, } from "./organizationProvisioningAttempt.js";
+import { pinOrganizationReplacementResponse } from "./organizationReplacementVerification.js";
+export { removeNativeSubscriptionRestoreProvisioningAttempt };
+function isAdoptedReplacementResponse(input) {
+    if (input.response.organizationId === input.request.organizationId &&
+        input.response.rootContainerId === input.request.rootContainerId) {
+        return false;
+    }
+    if (!input.creation.replacesOrganizationId ||
+        input.response.userId !== input.creation.userId) {
+        throw new Error("Organization provisioning returned an unexpected organization");
+    }
+    input.creation.log?.(`Organization replacement adopted (${input.response.organizationId})`);
+    return true;
+}
+async function buildOrganizationCandidate(input, rootContainerId) {
+    const artifactsInput = {
+        encapsulationKeyPair: input.encapsulationKeyPair,
+        organizationProfileName: input.organizationProfileName,
+        provisionedSystemContainers: input.provisionedSystemContainers,
+        rootContainerId,
+        rosterProfileNickname: input.rosterProfileNickname,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    };
+    const artifacts = await buildOrganizationProvisioningArtifacts(artifactsInput);
+    if (input.replacesOrganizationId) {
+        artifacts.replacementAuthorization =
+            await signOrganizationReplacementAuthorization({
+                ...artifacts,
+                replacesOrganizationId: input.replacesOrganizationId,
+                rootContainerId,
+                userId: input.userId,
+            }, input.signingKeyPair);
+    }
+    if (input.replacesOrganizationId &&
+        input.isIdentityCurrent &&
+        !input.isIdentityCurrent()) {
+        input.log?.("Organization creation aborted: identity changed while building artifacts");
+        return null;
+    }
+    return artifacts;
+}
+/**
+ * Provisions an additional organization for an already-registered user, reusing
+ * the exact artifact-build and local-persistence path as registration
+ * ({@link buildOrganizationProvisioningArtifacts} /
+ * {@link persistOrganizationProvisioningState}). Unlike registration it mints a
+ * fresh root container id, signs with the caller's existing identity, and needs
+ * no auth challenge — the user is already authenticated.
+ */
+export async function createOrganization(input) {
+    input.log?.("Creating organization...");
+    const rootContainerId = crypto.randomUUID();
+    const candidateArtifacts = await buildOrganizationCandidate(input, rootContainerId);
+    if (!candidateArtifacts)
+        return null;
+    const durableAttempt = await makeOrganizationProvisioningAttemptDurable({
+        artifacts: candidateArtifacts,
+        canStartDurableMutation: input.isIdentityCurrent,
+        dbClient: input.dbClient,
+        nativeSubscriptionRestore: input.nativeSubscriptionRestore,
+        replacesOrganizationId: input.replacesOrganizationId,
+        rootContainerId,
+        userId: input.userId,
+    });
+    if (!durableAttempt) {
+        input.log?.("Organization creation aborted: identity changed before saving artifacts");
+        return null;
+    }
+    const { artifacts, request, rootContainerId: durableRootContainerId, } = durableAttempt;
+    if (input.isIdentityCurrent && !input.isIdentityCurrent()) {
+        input.log?.("Organization creation aborted: identity changed before provisioning");
+        return null;
+    }
+    const response = await input.apiClient.createOrganization(request);
+    if (!response) {
+        return null;
+    }
+    if (input.isIdentityCurrent && !input.isIdentityCurrent()) {
+        input.log?.("Organization creation discarded: identity changed while provisioning");
+        return null;
+    }
+    if (input.replacesOrganizationId &&
+        !(await pinOrganizationReplacementResponse({
+            replacesOrganizationId: input.replacesOrganizationId,
+            response,
+            signingPublicKey: input.signingKeyPair.signingPublicKey,
+            userId: input.userId,
+            execSql: createExecSql(input.dbClient),
+            stillCurrent: input.isIdentityCurrent,
+        })))
+        return null;
+    if (isAdoptedReplacementResponse({ creation: input, request, response })) {
+        // Another device authorized this winning genesis with the same identity.
+        // Its encrypted bootstrap will hydrate normally; persisting
+        // this device's losing candidate would instead create an unrelated local
+        // root. The session reset rebinds retained local data to the winning ids.
+        return response;
+    }
+    input.log?.(`Organization created (${response.organizationId})`);
+    await persistOrganizationProvisioningState({
+        bootstrap: artifacts.bootstrap,
+        canStartDurableMutation: input.isIdentityCurrent,
+        onPersistQueued: input.onPersistQueued,
+        containerId: durableRootContainerId,
+        dbClient: input.dbClient,
+        documentProjectors: input.documentProjectors,
+        initialAdminGroup: artifacts.initialAdminGroup,
+        initialMemberGroup: artifacts.initialMemberGroup,
+        initialOrganizationPolicy: artifacts.initialOrganizationPolicy,
+        log: input.log,
+        logError: input.logError,
+        organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,
+        primePrincipalHistory: input.primePrincipalHistory,
+        response,
+        rootContainer: artifacts.rootContainer,
+        rootMetadataDocument: artifacts.rootMetadataDocument,
+        rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,
+        rosterProfileBootstrap: artifacts.rosterProfileBootstrap,
+        systemContainerBootstraps: artifacts.systemContainerBootstraps,
+    });
+    return response;
+}
+//# sourceMappingURL=createOrganization.js.map

package/workflows/organizations/provisioning/createOrganization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOrganization.js","sourceRoot":"","sources":["createOrganization.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,OAAO,EACL,sCAAsC,EAItC,oCAAoC,GACrC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0CAA0C,EAC1C,kDAAkD,GACnD,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,uCAAuC,CAAC;AAE3F,OAAO,EAAE,kDAAkD,EAAE,CAAC;AAoD9D,SAAS,4BAA4B,CAAC,KAIrC;IACC,IACE,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QAC9D,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO,CAAC,eAAe,EAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QACtC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAClB,qCAAqC,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,CACtE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA8B,EAC9B,eAAuB;IAEvB,MAAM,cAAc,GAA2C;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe;QACf,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,SAAS,GACb,MAAM,sCAAsC,CAAC,cAAc,CAAC,CAAC;IAE/D,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,wBAAwB;YAChC,MAAM,wCAAwC,CAC5C;gBACE,GAAG,SAAS;gBACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,eAAe;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,EACD,KAAK,CAAC,cAAc,CACrB,CAAC;IACN,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAC1B,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CACT,0EAA0E,CAC3E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,KAAK,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,CAAC;IAExC,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAG,MAAM,0BAA0B,CACzD,KAAK,EACL,eAAe,CAChB,CAAC;IAEF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,SAAS,EAAE,kBAAkB;QAC7B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,KAAK,CAAC,GAAG,EAAE,CACT,yEAAyE,CAC1E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EACJ,SAAS,EACT,OAAO,EACP,eAAe,EAAE,sBAAsB,GACxC,GAAG,cAAc,CAAC;IAEnB,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,qEAAqE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,sEAAsE,CACvE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,QAAQ;YACR,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtC,YAAY,EAAE,KAAK,CAAC,iBAAiB;SACtC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IAEd,IAAI,4BAA4B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;IACjE,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,sBAAsB;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  type EncapsulationKeyPair,\n  type SigningKeyPair,\n  signOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport type { CreateOrganizationRequest } from \"@tearleads/validators/request\";\nimport type { CreateOrganizationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../../data/documents/documentKinds\";\nimport type { ExecSqlClientLike } from \"../../../data/sqlite/sqlSchema\";\nimport { createExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"../../registration/provisionedPrincipalHistory\";\nimport {\n  buildOrganizationProvisioningArtifacts,\n  type OrganizationProvisioningArtifacts,\n  type OrganizationProvisioningArtifactsInput,\n  type ProvisionedSystemContainerSpec,\n  persistOrganizationProvisioningState,\n} from \"../../registration/registerIdentity\";\nimport {\n  makeOrganizationProvisioningAttemptDurable,\n  removeNativeSubscriptionRestoreProvisioningAttempt,\n} from \"./organizationProvisioningAttempt\";\nimport { pinOrganizationReplacementResponse } from \"./organizationReplacementVerification\";\n\nexport { removeNativeSubscriptionRestoreProvisioningAttempt };\n\nexport interface CreateOrganizationApi {\n  createOrganization(\n    request: CreateOrganizationRequest,\n  ): Promise<CreateOrganizationResponse | null>;\n}\n\nexport interface CreateOrganizationInput {\n  apiClient: CreateOrganizationApi;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  /**\n   * Returns false once the identity that supplied the key pairs is no longer\n   * active. Checked before the remote create (so a stale request is never\n   * submitted) and again before local persistence: an identity switch closes\n   * or renews the captured database client, so persisting would write another\n   * identity's bootstrap — or throw — after the org already exists remotely.\n   * The caller discards the result.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /** Overrides the seeded organization profile name; see registration. */\n  organizationProfileName?: string | undefined;\n  /** Seeds verified recovery progress for the founding policy heads. */\n  primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n  /**\n   * App-owned system containers to provision atomically with the new\n   * organization (e.g. a trash bin). See registration.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /** Purged organization whose personal-org generation this replaces. */\n  replacesOrganizationId?: string | undefined;\n  /** Marks and durably replays a fresh native-subscription restore target. */\n  nativeSubscriptionRestore?: boolean | undefined;\n  /** Overrides the seeded self roster-profile nickname; see registration. */\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  /**\n   * The already-registered user creating the organization; they become its\n   * founding admin. The server independently requires this to match the\n   * authenticated session.\n   */\n  userId: string;\n}\n\nfunction isAdoptedReplacementResponse(input: {\n  creation: CreateOrganizationInput;\n  request: CreateOrganizationRequest;\n  response: CreateOrganizationResponse;\n}): boolean {\n  if (\n    input.response.organizationId === input.request.organizationId &&\n    input.response.rootContainerId === input.request.rootContainerId\n  ) {\n    return false;\n  }\n  if (\n    !input.creation.replacesOrganizationId ||\n    input.response.userId !== input.creation.userId\n  ) {\n    throw new Error(\n      \"Organization provisioning returned an unexpected organization\",\n    );\n  }\n  input.creation.log?.(\n    `Organization replacement adopted (${input.response.organizationId})`,\n  );\n  return true;\n}\n\nasync function buildOrganizationCandidate(\n  input: CreateOrganizationInput,\n  rootContainerId: string,\n): Promise<OrganizationProvisioningArtifacts | null> {\n  const artifactsInput: OrganizationProvisioningArtifactsInput = {\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  };\n  const artifacts: OrganizationProvisioningArtifacts =\n    await buildOrganizationProvisioningArtifacts(artifactsInput);\n\n  if (input.replacesOrganizationId) {\n    artifacts.replacementAuthorization =\n      await signOrganizationReplacementAuthorization(\n        {\n          ...artifacts,\n          replacesOrganizationId: input.replacesOrganizationId,\n          rootContainerId,\n          userId: input.userId,\n        },\n        input.signingKeyPair,\n      );\n  }\n\n  if (\n    input.replacesOrganizationId &&\n    input.isIdentityCurrent &&\n    !input.isIdentityCurrent()\n  ) {\n    input.log?.(\n      \"Organization creation aborted: identity changed while building artifacts\",\n    );\n    return null;\n  }\n\n  return artifacts;\n}\n\n/**\n * Provisions an additional organization for an already-registered user, reusing\n * the exact artifact-build and local-persistence path as registration\n * ({@link buildOrganizationProvisioningArtifacts} /\n * {@link persistOrganizationProvisioningState}). Unlike registration it mints a\n * fresh root container id, signs with the caller's existing identity, and needs\n * no auth challenge — the user is already authenticated.\n */\nexport async function createOrganization(\n  input: CreateOrganizationInput,\n): Promise<CreateOrganizationResponse | null> {\n  input.log?.(\"Creating organization...\");\n\n  const rootContainerId = crypto.randomUUID();\n  const candidateArtifacts = await buildOrganizationCandidate(\n    input,\n    rootContainerId,\n  );\n\n  if (!candidateArtifacts) return null;\n\n  const durableAttempt = await makeOrganizationProvisioningAttemptDurable({\n    artifacts: candidateArtifacts,\n    canStartDurableMutation: input.isIdentityCurrent,\n    dbClient: input.dbClient,\n    nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n    replacesOrganizationId: input.replacesOrganizationId,\n    rootContainerId,\n    userId: input.userId,\n  });\n  if (!durableAttempt) {\n    input.log?.(\n      \"Organization creation aborted: identity changed before saving artifacts\",\n    );\n    return null;\n  }\n  const {\n    artifacts,\n    request,\n    rootContainerId: durableRootContainerId,\n  } = durableAttempt;\n\n  if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n    input.log?.(\n      \"Organization creation aborted: identity changed before provisioning\",\n    );\n    return null;\n  }\n\n  const response = await input.apiClient.createOrganization(request);\n  if (!response) {\n    return null;\n  }\n\n  if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n    input.log?.(\n      \"Organization creation discarded: identity changed while provisioning\",\n    );\n    return null;\n  }\n\n  if (\n    input.replacesOrganizationId &&\n    !(await pinOrganizationReplacementResponse({\n      replacesOrganizationId: input.replacesOrganizationId,\n      response,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n      userId: input.userId,\n      execSql: createExecSql(input.dbClient),\n      stillCurrent: input.isIdentityCurrent,\n    }))\n  )\n    return null;\n\n  if (isAdoptedReplacementResponse({ creation: input, request, response })) {\n    // Another device authorized this winning genesis with the same identity.\n    // Its encrypted bootstrap will hydrate normally; persisting\n    // this device's losing candidate would instead create an unrelated local\n    // root. The session reset rebinds retained local data to the winning ids.\n    return response;\n  }\n\n  input.log?.(`Organization created (${response.organizationId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: durableRootContainerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    primePrincipalHistory: input.primePrincipalHistory,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}

package/workflows/organizations/provisioning/organizationProvisioningAttempt.d.ts

@@ -0,0 +1,36 @@
+import { type CreateOrganizationRequest } from "../../../internal/validators/request/index.js";
+import type { ExecSql, ExecSqlClientLike } from "../../../data/sqlite/sqlSchema.js";
+import type { OrganizationProvisioningArtifacts } from "../../registration/registerIdentity.js";
+interface DurableOrganizationProvisioningAttempt {
+    readonly artifacts: OrganizationProvisioningArtifacts;
+    readonly request: CreateOrganizationRequest;
+    readonly rootContainerId: string;
+}
+export declare function loadOrganizationReplacementFinalizationRequest(input: {
+    execSql: ExecSql;
+    replacedOrganizationId: string;
+    userId: string;
+}): Promise<CreateOrganizationRequest>;
+export declare function makeOrganizationProvisioningAttemptDurable(input: {
+    artifacts: OrganizationProvisioningArtifacts;
+    canStartDurableMutation?: (() => boolean) | undefined;
+    dbClient: ExecSqlClientLike;
+    nativeSubscriptionRestore?: boolean | undefined;
+    replacesOrganizationId?: string | undefined;
+    rootContainerId: string;
+    userId: string;
+}): Promise<DurableOrganizationProvisioningAttempt | null>;
+export declare function removeNativeSubscriptionRestoreProvisioningAttempt(input: {
+    canCommit?: (() => boolean) | undefined;
+    dbClient: ExecSqlClientLike;
+    organizationId: string;
+    userId: string;
+}): Promise<boolean>;
+export declare function removeOrganizationProvisioningAttempt(input: {
+    canCommit?: (() => boolean) | undefined;
+    execSql: ExecSql;
+    organizationId?: string | undefined;
+    replacedOrganizationId: string;
+    userId: string;
+}): Promise<boolean>;
+export {};

package/workflows/organizations/provisioning/organizationProvisioningAttempt.js

@@ -0,0 +1,205 @@
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
+import { isPlainObject } from "../../../internal/validators/isPlainObject.js";
+import { isCreateOrganizationRequest, } from "../../../internal/validators/request/index.js";
+import { isOrganizationReplacementAuthorization } from "../../../internal/validators/util/index.js";
+import { sqlOrganizationProvisioningAttemptPersistence } from "../../../data/persistence/organizations/organizationProvisioningAttemptPersistence.js";
+import { createExecSql } from "../../../data/sqlite/sqlSchema.js";
+const BYTE_MARKER = "__tearleadsProvisioningBytes";
+function buildCreateOrganizationRequest(input) {
+    const { artifacts } = input;
+    return {
+        userId: input.userId,
+        ...(artifacts.replacementAuthorization
+            ? { replacementAuthorization: artifacts.replacementAuthorization }
+            : {}),
+        organizationId: artifacts.organizationId,
+        rootContainerId: input.rootContainerId,
+        initialAdminGroup: artifacts.initialAdminGroup,
+        initialMemberGroup: artifacts.initialMemberGroup,
+        initialOrganizationPolicy: artifacts.initialOrganizationPolicy,
+        initialRootContainer: artifacts.initialRootContainer,
+        initialRootMetadataDocument: artifacts.rootMetadataDocumentRequest,
+        initialRosterProfileContainer: artifacts.rosterProfileBootstrap.containerRequest,
+        initialRosterProfileDocument: artifacts.rosterProfileBootstrap.profileDocumentRequest,
+        initialOrganizationMetadataContainer: artifacts.organizationMetadataBootstrap.containerRequest,
+        initialOrganizationProfileDocument: artifacts.organizationMetadataBootstrap
+            .organizationProfileDocumentRequest,
+        initialSystemContainers: artifacts.systemContainerBootstraps.map((systemContainer) => systemContainer.containerRequest),
+        ...(input.finalizeReplacement ? { finalizeReplacement: true } : {}),
+        ...(input.nativeSubscriptionRestore
+            ? { nativeSubscriptionRestore: true }
+            : {}),
+        ...(input.replacesOrganizationId
+            ? { replacesOrganizationId: input.replacesOrganizationId }
+            : {}),
+    };
+}
+export async function loadOrganizationReplacementFinalizationRequest(input) {
+    const stored = await sqlOrganizationProvisioningAttemptPersistence.load(input.execSql, input.replacedOrganizationId);
+    if (!stored) {
+        throw new Error("Organization replacement attempt is unavailable");
+    }
+    if (stored.userId !== input.userId) {
+        throw new Error("Stored organization provisioning attempt belongs to another user");
+    }
+    const artifacts = deserializeArtifacts(stored.serializedArtifacts);
+    const request = buildCreateOrganizationRequest({
+        artifacts,
+        finalizeReplacement: true,
+        replacesOrganizationId: input.replacedOrganizationId,
+        rootContainerId: stored.rootContainerId,
+        userId: stored.userId,
+    });
+    if (artifacts.organizationId !== stored.organizationId ||
+        request.organizationId !== stored.organizationId ||
+        request.rootContainerId !== stored.rootContainerId ||
+        !isCreateOrganizationRequest(request)) {
+        throw new Error("Stored organization provisioning attempt is inconsistent");
+    }
+    return request;
+}
+function serializeArtifacts(artifacts) {
+    return JSON.stringify(artifacts, (_key, value) => {
+        if (value instanceof Uint8Array) {
+            return { [BYTE_MARKER]: bytesToBase64(value) };
+        }
+        return value;
+    });
+}
+function hasRecord(value, key) {
+    return isPlainObject(Reflect.get(value, key));
+}
+function hasBytes(value, key) {
+    return Reflect.get(value, key) instanceof Uint8Array;
+}
+function isMaterializedDocument(value) {
+    return (isPlainObject(value) &&
+        hasBytes(value, "contentKey") &&
+        hasRecord(value, "plan"));
+}
+function isMaterializedContainer(value) {
+    return (isPlainObject(value) &&
+        hasBytes(value, "containerKey") &&
+        hasRecord(value, "plan"));
+}
+function hasContainerBootstrapCore(value) {
+    return (typeof Reflect.get(value, "containerId") === "string" &&
+        isMaterializedDocument(Reflect.get(value, "containerMetadataDocument")) &&
+        hasBytes(value, "containerMetadataInitialUpdate") &&
+        isMaterializedContainer(Reflect.get(value, "containerPlan")) &&
+        hasRecord(value, "containerRequest") &&
+        Reflect.get(value, "systemSlot") !== undefined);
+}
+function isOrganizationProvisioningArtifacts(value) {
+    if (!isPlainObject(value))
+        return false;
+    const bootstrap = Reflect.get(value, "bootstrap");
+    const roster = Reflect.get(value, "rosterProfileBootstrap");
+    const metadata = Reflect.get(value, "organizationMetadataBootstrap");
+    const systemContainers = Reflect.get(value, "systemContainerBootstraps");
+    return ((Reflect.get(value, "replacementAuthorization") === null ||
+        isOrganizationReplacementAuthorization(Reflect.get(value, "replacementAuthorization"))) &&
+        typeof Reflect.get(value, "organizationId") === "string" &&
+        isPlainObject(bootstrap) &&
+        hasBytes(bootstrap, "initialUpdate") &&
+        typeof Reflect.get(bootstrap, "metadataDocumentId") === "string" &&
+        hasRecord(value, "initialAdminGroup") &&
+        hasRecord(value, "initialMemberGroup") &&
+        hasRecord(value, "initialOrganizationPolicy") &&
+        hasRecord(value, "initialRootContainer") &&
+        isMaterializedContainer(Reflect.get(value, "rootContainer")) &&
+        isMaterializedDocument(Reflect.get(value, "rootMetadataDocument")) &&
+        hasRecord(value, "rootMetadataDocumentRequest") &&
+        isPlainObject(roster) &&
+        hasContainerBootstrapCore(roster) &&
+        isMaterializedDocument(Reflect.get(roster, "profileDocument")) &&
+        hasBytes(roster, "profileDocumentInitialUpdate") &&
+        hasRecord(roster, "profileDocumentRequest") &&
+        isPlainObject(metadata) &&
+        hasContainerBootstrapCore(metadata) &&
+        isMaterializedDocument(Reflect.get(metadata, "organizationProfileDocument")) &&
+        hasRecord(metadata, "organizationProfileDocumentRequest") &&
+        typeof Reflect.get(metadata, "organizationProfileSnapshot") === "string" &&
+        Array.isArray(systemContainers) &&
+        systemContainers.every((container) => isPlainObject(container) && hasContainerBootstrapCore(container)));
+}
+function deserializeArtifacts(value) {
+    const parsed = JSON.parse(value, (_key, candidate) => {
+        if (typeof candidate === "object" &&
+            candidate !== null &&
+            Object.keys(candidate).length === 1 &&
+            BYTE_MARKER in candidate) {
+            const encoded = Reflect.get(candidate, BYTE_MARKER);
+            if (typeof encoded === "string") {
+                return base64ToBytes(encoded);
+            }
+        }
+        return candidate;
+    });
+    if (!isOrganizationProvisioningArtifacts(parsed)) {
+        throw new Error("Stored organization provisioning attempt is invalid");
+    }
+    return parsed;
+}
+export async function makeOrganizationProvisioningAttemptDurable(input) {
+    const attemptKey = input.replacesOrganizationId ??
+        (input.nativeSubscriptionRestore
+            ? `native-subscription-restore:${input.userId}`
+            : null);
+    if (!attemptKey) {
+        return {
+            artifacts: input.artifacts,
+            request: buildCreateOrganizationRequest(input),
+            rootContainerId: input.rootContainerId,
+        };
+    }
+    const stored = await sqlOrganizationProvisioningAttemptPersistence.loadOrSave(createExecSql(input.dbClient), {
+        replacedOrganizationId: attemptKey,
+        userId: input.userId,
+        organizationId: input.artifacts.organizationId,
+        rootContainerId: input.rootContainerId,
+        serializedArtifacts: serializeArtifacts(input.artifacts),
+    }, input.canStartDurableMutation);
+    if (!stored)
+        return null;
+    if (stored.userId !== input.userId) {
+        throw new Error("Stored organization provisioning attempt belongs to another user");
+    }
+    const artifacts = deserializeArtifacts(stored.serializedArtifacts);
+    const request = buildCreateOrganizationRequest({
+        artifacts,
+        nativeSubscriptionRestore: input.nativeSubscriptionRestore,
+        replacesOrganizationId: input.replacesOrganizationId,
+        rootContainerId: stored.rootContainerId,
+        userId: stored.userId,
+    });
+    if (artifacts.organizationId !== stored.organizationId ||
+        request.organizationId !== stored.organizationId ||
+        request.rootContainerId !== stored.rootContainerId ||
+        !isCreateOrganizationRequest(request)) {
+        throw new Error("Stored organization provisioning attempt is inconsistent");
+    }
+    return { artifacts, request, rootContainerId: stored.rootContainerId };
+}
+export async function removeNativeSubscriptionRestoreProvisioningAttempt(input) {
+    const attemptKey = `native-subscription-restore:${input.userId}`;
+    const execSql = createExecSql(input.dbClient);
+    const stored = await sqlOrganizationProvisioningAttemptPersistence.load(execSql, attemptKey);
+    if (!stored)
+        return true;
+    if (stored.userId !== input.userId ||
+        stored.organizationId !== input.organizationId) {
+        throw new Error("Stored native restore organization provisioning attempt is inconsistent");
+    }
+    return removeOrganizationProvisioningAttempt({
+        canCommit: input.canCommit,
+        execSql,
+        organizationId: input.organizationId,
+        replacedOrganizationId: attemptKey,
+        userId: input.userId,
+    });
+}
+export async function removeOrganizationProvisioningAttempt(input) {
+    return sqlOrganizationProvisioningAttemptPersistence.remove(input.execSql, input, input.canCommit);
+}
+//# sourceMappingURL=organizationProvisioningAttempt.js.map