@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/registration/provisionedPrincipalHistory.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisionedPrincipalHistory.js","sourceRoot":"","sources":["provisionedPrincipalHistory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAMzG,OAAO,EAAE,mCAAmC,EAAE,MAAM,6CAA6C,CAAC;AA0BlG;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,QAAsC;IAEtC,MAAM,OAAO,GAAG;QACd,QAAQ,CAAC,YAAY;QACrB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,WAAW;KACrB,CAAC;IACF,OAAO;QACL,KAAK,CAAC,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YACrE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CACnB,YAAY,CAAC,aAAa,KAAK,aAAa;gBAC5C,YAAY,CAAC,WAAW,KAAK,WAAW,CAC3C,CAAC;YACF,IACE,CAAC,MAAM;gBACP,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;gBACjC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;oBAC9B,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;gBAEtD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,MAAM;gBACJ,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE;oBACJ,GAAG,eAAe,CAAC,MAAM,CAAC;oBAC1B,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE;iBACzD;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAO/C;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,mCAAmC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;IACF,wEAAwE;IACxE,+DAA+D;IAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzE,MAAM,OAAO,CAAC;YACZ,GAAG,OAAO;YACV,SAAS,EAAE,kCAAkC,CAAC,KAAK,CAAC;SACrD,CAAC,CAAC;AACP,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,OAA2C;IAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,QAAQ,CACd,wEAAwE,EACxE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAA2C,EAC3C,KAAuD;IAEvD,sEAAsE;IACtE,MAAM,kBAAkB,GACtB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,wBAAwB,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,OAAO,KAAK,IAAI;QAChB,KAAK,CAAC,SAAS,EAAE;QACjB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO;QAC9C,OAAO,CAAC,kBAAkB,EAAE,KAAK,kBAAkB,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO;IAC/B,MAAM,0BAA0B,GAAgC,KAAK,EACnE,YAAY,EACZ,EAAE;QACF,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/C,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,QAAQ,EAAE,qBAAqB,KAAK,kBAAkB;YAC3D,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,MAAM,qCAAqC,CAAC,OAAO,CAAC,CAAC,aAAa,CAChE,KAAK,CAAC,cAAc,EACpB,GAAG,EAAE,CACH,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE,CACrC,gCAAgC,CAAC;QAC/B,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU;QACV,0BAA0B;QAC1B,wDAAwD;QACxD,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,YAAY,EAAE;KACrD,CAAC,CACH,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../data/principals/principalPolicyCoordinator\";\nimport type { ExecSql, ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type {\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport { createPrincipalCurrentRecoveryBatch } from \"../principals/principalCurrentRecoveryBatch\";\nimport type { PrincipalPolicyPageReader } from \"../principals/principalPolicyHistoryReader\";\n\n/** The version-1 policies a provisioning request signed and its response acknowledged. */\ninterface ProvisionedPrincipalPolicies {\n  readonly adminGroup: PrincipalPolicyBundleResponse;\n  readonly memberGroup: PrincipalPolicyBundleResponse;\n  readonly organization: PrincipalPolicyBundleResponse;\n}\n\n/**\n * Records verified recovery progress for an organization's founding policy\n * heads, so the device's first scoped recovery of them needs no history read.\n * It is bound to the provisioning scope: the database the bootstrap committed\n * to and the identity that signed it. Failure leaves the online path.\n */\nexport type ProvisionedPrincipalHistoryPrimer = (input: {\n  /** The database client the provisioning bootstrap committed to. */\n  readonly database: ExecSqlClientLike;\n  /** Whether the identity that provisioned is still the active one. */\n  readonly isCurrent: () => boolean;\n  readonly organizationId: string;\n  readonly policies: ProvisionedPrincipalPolicies;\n  readonly userId: string;\n}) => Promise<void>;\n\n/**\n * Serves only the acknowledged initial heads, each complete in one page. The\n * ordinary verifier still checks every signature, the directory binding and\n * strict Admins rules before any progress is saved.\n */\nfunction provisionedPolicyPages(\n  policies: ProvisionedPrincipalPolicies,\n): PrincipalPolicyPageReader {\n  const bundles = [\n    policies.organization,\n    policies.adminGroup,\n    policies.memberGroup,\n  ];\n  return {\n    async *getPrincipalPolicyPages(principalType, principalId, options = {}) {\n      const bundle = bundles.find(\n        ({ currentState }) =>\n          currentState.principalType === principalType &&\n          currentState.principalId === principalId,\n      );\n      if (\n        !bundle ||\n        options.resume !== undefined ||\n        (options.afterVersion ?? 0) !== 0 ||\n        (options.stateHash !== undefined &&\n          options.stateHash !== bundle.currentState.stateHash)\n      )\n        throw new Error(\n          \"Provisioned principal history holds only the acknowledged initial heads\",\n        );\n      yield {\n        ok: true,\n        data: {\n          ...structuredClone(bundle),\n          historyPage: { afterVersion: 0, nextAfterVersion: null },\n        },\n      };\n    },\n  };\n}\n\nasync function primeProvisionedPrincipalHistory(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly policies: ProvisionedPrincipalPolicies;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const { recover } = createPrincipalCurrentRecoveryBatch();\n  const options = {\n    historyReader: provisionedPolicyPages(input.policies),\n    execSql: input.execSql,\n    offline: false,\n    organizationId: input.organizationId,\n    protection: input.protection,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  };\n  // Scoped recovery of each group also completes the directory and strict\n  // Admins stages; Members reuses them through the shared batch.\n  for (const group of [input.policies.adminGroup, input.policies.memberGroup])\n    await recover({\n      ...options,\n      reference: principalPolicyReferenceFromBundle(group),\n    });\n}\n\n/** The runtime seams priming reads; none of them writes durable state. */\ninterface ProvisionedPrincipalHistoryRuntime {\n  readonly bindLease: () => PrincipalHistoryProtectionLease | undefined;\n  /** The runtime executor, only while `database` is its ready database. */\n  readonly execSqlFor: (database: ExecSqlClientLike) => ExecSql | null;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  /** Read-only: the identity the trust store already pins for a user. */\n  readonly loadPinnedIdentity: (\n    execSql: ExecSql,\n    userId: string,\n  ) => Promise<TrustedUserIdentity | null>;\n  readonly signingFingerprint: () => string | null;\n}\n\n/**\n * Binds priming to the exact provisioning scope, captured before any await:\n * the bootstrap's database and runtime executor, the identity whose key signed\n * the founding states, and a protection lease for that identity. Every later\n * step, and every progress write inside its transaction, rechecks that scope,\n * so a switched identity or database aborts priming without a durable write.\n * Priming never writes a trust pin; it only reads the founder's existing one.\n */\nexport function createProvisionedPrincipalHistoryPrimer(\n  runtime: ProvisionedPrincipalHistoryRuntime,\n): ProvisionedPrincipalHistoryPrimer {\n  return async (input) => {\n    try {\n      await primeInProvisioningScope(runtime, input);\n    } catch (error) {\n      runtime.logError(\n        \"Provisioned principal history was not primed; recovery reads it online\",\n        error,\n      );\n    }\n  };\n}\n\nasync function primeInProvisioningScope(\n  runtime: ProvisionedPrincipalHistoryRuntime,\n  input: Parameters<ProvisionedPrincipalHistoryPrimer>[0],\n): Promise<void> {\n  // Everything below is captured synchronously, before the first await.\n  const founderFingerprint =\n    input.policies.organization.currentState.signerUserKeyFingerprint;\n  const execSql = runtime.execSqlFor(input.database);\n  const scopeCurrent = () =>\n    execSql !== null &&\n    input.isCurrent() &&\n    runtime.execSqlFor(input.database) === execSql &&\n    runtime.signingFingerprint() === founderFingerprint;\n  const lease = scopeCurrent() ? runtime.bindLease() : undefined;\n  if (!execSql || !lease) return;\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = async (\n    signerUserId,\n  ) => {\n    if (signerUserId !== input.userId) return null;\n    assertProjectionVerificationCurrent(scopeCurrent);\n    const identity = await runtime.loadPinnedIdentity(execSql, input.userId);\n    assertProjectionVerificationCurrent(scopeCurrent);\n    return identity?.signingKeyFingerprint === founderFingerprint\n      ? identity\n      : null;\n  };\n  await getOrCreatePrincipalPolicyCoordinator(execSql).queueRecovery(\n    input.organizationId,\n    () =>\n      lease(({ protection, stillCurrent }) =>\n        primeProvisionedPrincipalHistory({\n          execSql,\n          organizationId: input.organizationId,\n          policies: input.policies,\n          protection,\n          resolveTrustedUserIdentity,\n          // Progress writes check this inside their transactions.\n          stillCurrent: () => stillCurrent() && scopeCurrent(),\n        }),\n      ),\n  );\n}\n"]}
+{"version":3,"file":"provisionedPrincipalHistory.js","sourceRoot":"","sources":["provisionedPrincipalHistory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAOzG,OAAO,EAAE,mCAAmC,EAAE,MAAM,+DAA+D,CAAC;AAyBpH;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,QAAsC;IAEtC,MAAM,OAAO,GAAG;QACd,QAAQ,CAAC,YAAY;QACrB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,WAAW;KACrB,CAAC;IACF,OAAO;QACL,KAAK,CAAC,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YACrE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CACnB,YAAY,CAAC,aAAa,KAAK,aAAa;gBAC5C,YAAY,CAAC,WAAW,KAAK,WAAW,CAC3C,CAAC;YACF,IACE,CAAC,MAAM;gBACP,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;gBACjC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;oBAC9B,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;gBAEtD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,MAAM;gBACJ,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE;oBACJ,GAAG,eAAe,CAAC,MAAM,CAAC;oBAC1B,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE;iBACzD;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAO/C;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,mCAAmC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;IACF,wEAAwE;IACxE,+DAA+D;IAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzE,MAAM,OAAO,CAAC;YACZ,GAAG,OAAO;YACV,SAAS,EAAE,kCAAkC,CAAC,KAAK,CAAC;SACrD,CAAC,CAAC;AACP,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,OAA2C;IAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,QAAQ,CACd,wEAAwE,EACxE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAA2C,EAC3C,KAAuD;IAEvD,sEAAsE;IACtE,MAAM,kBAAkB,GACtB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,wBAAwB,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,OAAO,KAAK,IAAI;QAChB,KAAK,CAAC,SAAS,EAAE;QACjB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO;QAC9C,OAAO,CAAC,kBAAkB,EAAE,KAAK,kBAAkB,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO;IAC/B,MAAM,0BAA0B,GAAgC,KAAK,EACnE,YAAY,EACZ,EAAE;QACF,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/C,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,QAAQ,EAAE,qBAAqB,KAAK,kBAAkB;YAC3D,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,MAAM,qCAAqC,CAAC,OAAO,CAAC,CAAC,aAAa,CAChE,KAAK,CAAC,cAAc,EACpB,GAAG,EAAE,CACH,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE,CACrC,gCAAgC,CAAC;QAC/B,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU;QACV,0BAA0B;QAC1B,wDAAwD;QACxD,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,YAAY,EAAE;KACrD,CAAC,CACH,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../data/principals/principalPolicyCoordinator\";\nimport type { ExecSql, ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type {\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport type { PrincipalPolicyPageReader } from \"../principals/principalPolicyHistoryReader\";\nimport { createPrincipalCurrentRecoveryBatch } from \"../principals/recoveryOperation/principalCurrentRecoveryBatch\";\n\n/** The version-1 policies a provisioning request signed and its response acknowledged. */\ninterface ProvisionedPrincipalPolicies {\n  readonly adminGroup: PrincipalPolicyBundleResponse;\n  readonly memberGroup: PrincipalPolicyBundleResponse;\n  readonly organization: PrincipalPolicyBundleResponse;\n}\n\n/**\n * Records verified recovery progress for an organization's founding policy\n * heads, so the device's first scoped recovery of them needs no history read.\n * It is bound to the provisioning scope: the database the bootstrap committed\n * to and the identity that signed it. Failure leaves the online path.\n */\nexport type ProvisionedPrincipalHistoryPrimer = (input: {\n  /** The database client the provisioning bootstrap committed to. */\n  readonly database: ExecSqlClientLike;\n  /** Whether the identity that provisioned is still the active one. */\n  readonly isCurrent: () => boolean;\n  readonly organizationId: string;\n  readonly policies: ProvisionedPrincipalPolicies;\n  readonly userId: string;\n}) => Promise<void>;\n\n/**\n * Serves only the acknowledged initial heads, each complete in one page. The\n * ordinary verifier still checks every signature, the directory binding and\n * strict Admins rules before any progress is saved.\n */\nfunction provisionedPolicyPages(\n  policies: ProvisionedPrincipalPolicies,\n): PrincipalPolicyPageReader {\n  const bundles = [\n    policies.organization,\n    policies.adminGroup,\n    policies.memberGroup,\n  ];\n  return {\n    async *getPrincipalPolicyPages(principalType, principalId, options = {}) {\n      const bundle = bundles.find(\n        ({ currentState }) =>\n          currentState.principalType === principalType &&\n          currentState.principalId === principalId,\n      );\n      if (\n        !bundle ||\n        options.resume !== undefined ||\n        (options.afterVersion ?? 0) !== 0 ||\n        (options.stateHash !== undefined &&\n          options.stateHash !== bundle.currentState.stateHash)\n      )\n        throw new Error(\n          \"Provisioned principal history holds only the acknowledged initial heads\",\n        );\n      yield {\n        ok: true,\n        data: {\n          ...structuredClone(bundle),\n          historyPage: { afterVersion: 0, nextAfterVersion: null },\n        },\n      };\n    },\n  };\n}\n\nasync function primeProvisionedPrincipalHistory(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly policies: ProvisionedPrincipalPolicies;\n  readonly protection: PrincipalPolicyHistoryProgressOptions;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const { recover } = createPrincipalCurrentRecoveryBatch();\n  const options = {\n    historyReader: provisionedPolicyPages(input.policies),\n    execSql: input.execSql,\n    offline: false,\n    organizationId: input.organizationId,\n    protection: input.protection,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  };\n  // Scoped recovery of each group also completes the directory and strict\n  // Admins stages; Members reuses them through the shared batch.\n  for (const group of [input.policies.adminGroup, input.policies.memberGroup])\n    await recover({\n      ...options,\n      reference: principalPolicyReferenceFromBundle(group),\n    });\n}\n\n/** The runtime seams priming reads; none of them writes durable state. */\ninterface ProvisionedPrincipalHistoryRuntime {\n  readonly bindLease: () => PrincipalHistoryProtectionLease | undefined;\n  /** The runtime executor, only while `database` is its ready database. */\n  readonly execSqlFor: (database: ExecSqlClientLike) => ExecSql | null;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  /** Read-only: the identity the trust store already pins for a user. */\n  readonly loadPinnedIdentity: (\n    execSql: ExecSql,\n    userId: string,\n  ) => Promise<TrustedUserIdentity | null>;\n  readonly signingFingerprint: () => string | null;\n}\n\n/**\n * Binds priming to the exact provisioning scope, captured before any await:\n * the bootstrap's database and runtime executor, the identity whose key signed\n * the founding states, and a protection lease for that identity. Every later\n * step, and every progress write inside its transaction, rechecks that scope,\n * so a switched identity or database aborts priming without a durable write.\n * Priming never writes a trust pin; it only reads the founder's existing one.\n */\nexport function createProvisionedPrincipalHistoryPrimer(\n  runtime: ProvisionedPrincipalHistoryRuntime,\n): ProvisionedPrincipalHistoryPrimer {\n  return async (input) => {\n    try {\n      await primeInProvisioningScope(runtime, input);\n    } catch (error) {\n      runtime.logError(\n        \"Provisioned principal history was not primed; recovery reads it online\",\n        error,\n      );\n    }\n  };\n}\n\nasync function primeInProvisioningScope(\n  runtime: ProvisionedPrincipalHistoryRuntime,\n  input: Parameters<ProvisionedPrincipalHistoryPrimer>[0],\n): Promise<void> {\n  // Everything below is captured synchronously, before the first await.\n  const founderFingerprint =\n    input.policies.organization.currentState.signerUserKeyFingerprint;\n  const execSql = runtime.execSqlFor(input.database);\n  const scopeCurrent = () =>\n    execSql !== null &&\n    input.isCurrent() &&\n    runtime.execSqlFor(input.database) === execSql &&\n    runtime.signingFingerprint() === founderFingerprint;\n  const lease = scopeCurrent() ? runtime.bindLease() : undefined;\n  if (!execSql || !lease) return;\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = async (\n    signerUserId,\n  ) => {\n    if (signerUserId !== input.userId) return null;\n    assertProjectionVerificationCurrent(scopeCurrent);\n    const identity = await runtime.loadPinnedIdentity(execSql, input.userId);\n    assertProjectionVerificationCurrent(scopeCurrent);\n    return identity?.signingKeyFingerprint === founderFingerprint\n      ? identity\n      : null;\n  };\n  await getOrCreatePrincipalPolicyCoordinator(execSql).queueRecovery(\n    input.organizationId,\n    () =>\n      lease(({ protection, stillCurrent }) =>\n        primeProvisionedPrincipalHistory({\n          execSql,\n          organizationId: input.organizationId,\n          policies: input.policies,\n          protection,\n          resolveTrustedUserIdentity,\n          // Progress writes check this inside their transactions.\n          stillCurrent: () => stillCurrent() && scopeCurrent(),\n        }),\n      ),\n  );\n}\n"]}

package/workflows/registration/provisionedProfileDocument.js

@@ -1,5 +1,5 @@
 import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { buildInitialDocumentSyncRequest } from "../documents/initialSync.js";
+import { buildInitialDocumentSyncRequest } from "../documents/sync/initialSync.js";
 import { createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, } from "../organizations/organizationProfile.js";
 import { createInitializedRosterProfileDocument, DEFAULT_ROSTER_PROFILE_SELF_NICKNAME, } from "../organizations/rosterProfileContainer.js";
 async function buildProvisionedDocumentRequest(input) {

package/workflows/registration/provisionedProfileDocument.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisionedProfileDocument.js","sourceRoot":"","sources":["provisionedProfileDocument.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EACL,4CAA4C,EAC5C,0CAA0C,GAC3C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,yCAAyC,CAAC;AAQjD,KAAK,UAAU,+BAA+B,CAC5C,KAA8D;IAE9D,OAAO;QACL,GAAG,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO;QAC1C,WAAW,EAAE,MAAM,+BAA+B,CAAC,KAAK,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA8D;IAE9D,MAAM,WAAW,GAAG,MAAM,4CAA4C,CAAC;QACrE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,0CAA0C;KAC/D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,GAAG,KAAK;QACR,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAGC;IAED,MAAM,WAAW,GAAG,MAAM,sCAAsC,CAAC;QAC/D,sBAAsB,EAAE,aAAa,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACnE,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,oCAAoC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,GAAG,KAAK;QACR,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { ProvisionedDocumentRequest } from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type {\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n} from \"../../data/documents/shared/types\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/initialSync\";\nimport {\n  createInitializedOrganizationProfileDocument,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n} from \"../organizations/organizationProfile\";\nimport {\n  createInitializedRosterProfileDocument,\n  DEFAULT_ROSTER_PROFILE_SELF_NICKNAME,\n} from \"../organizations/rosterProfileContainer\";\n\ninterface ProvisionedProfileInput {\n  author: DocumentCreateAuthor;\n  containerProjection: ContainerWriterProjectionResponse;\n  materializedDocument: MaterializedDocumentCreatePlan;\n}\n\nasync function buildProvisionedDocumentRequest(\n  input: ProvisionedProfileInput & { initialUpdate: Uint8Array },\n): Promise<ProvisionedDocumentRequest> {\n  return {\n    ...input.materializedDocument.plan.request,\n    initialSync: await buildInitialDocumentSyncRequest(input),\n  };\n}\n\nexport async function buildProvisionedOrganizationProfile(\n  input: ProvisionedProfileInput & { name?: string | undefined },\n) {\n  const initialized = await createInitializedOrganizationProfileDocument({\n    name: input.name ?? DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  });\n  const request = await buildProvisionedDocumentRequest({\n    ...input,\n    initialUpdate: initialized.initialUpdate,\n  });\n  return { ...initialized, request };\n}\n\nexport async function buildProvisionedRosterProfile(\n  input: ProvisionedProfileInput & {\n    encapsulationPublicKey: Uint8Array;\n    nickname?: string | undefined;\n  },\n) {\n  const initialized = await createInitializedRosterProfileDocument({\n    encapsulationPublicKey: bytesToBase64(input.encapsulationPublicKey),\n    isSelf: true,\n    nickname: input.nickname ?? DEFAULT_ROSTER_PROFILE_SELF_NICKNAME,\n    userId: input.author.signerUserId,\n  });\n  const request = await buildProvisionedDocumentRequest({\n    ...input,\n    initialUpdate: initialized.initialUpdate,\n  });\n  return { ...initialized, request };\n}\n"]}
+{"version":3,"file":"provisionedProfileDocument.js","sourceRoot":"","sources":["provisionedProfileDocument.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EACL,4CAA4C,EAC5C,0CAA0C,GAC3C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,yCAAyC,CAAC;AAQjD,KAAK,UAAU,+BAA+B,CAC5C,KAA8D;IAE9D,OAAO;QACL,GAAG,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO;QAC1C,WAAW,EAAE,MAAM,+BAA+B,CAAC,KAAK,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA8D;IAE9D,MAAM,WAAW,GAAG,MAAM,4CAA4C,CAAC;QACrE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,0CAA0C;KAC/D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,GAAG,KAAK;QACR,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAGC;IAED,MAAM,WAAW,GAAG,MAAM,sCAAsC,CAAC;QAC/D,sBAAsB,EAAE,aAAa,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACnE,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,oCAAoC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,GAAG,KAAK;QACR,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport type { ProvisionedDocumentRequest } from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type {\n  DocumentCreateAuthor,\n  MaterializedDocumentCreatePlan,\n} from \"../../data/documents/shared/types\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/sync/initialSync\";\nimport {\n  createInitializedOrganizationProfileDocument,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n} from \"../organizations/organizationProfile\";\nimport {\n  createInitializedRosterProfileDocument,\n  DEFAULT_ROSTER_PROFILE_SELF_NICKNAME,\n} from \"../organizations/rosterProfileContainer\";\n\ninterface ProvisionedProfileInput {\n  author: DocumentCreateAuthor;\n  containerProjection: ContainerWriterProjectionResponse;\n  materializedDocument: MaterializedDocumentCreatePlan;\n}\n\nasync function buildProvisionedDocumentRequest(\n  input: ProvisionedProfileInput & { initialUpdate: Uint8Array },\n): Promise<ProvisionedDocumentRequest> {\n  return {\n    ...input.materializedDocument.plan.request,\n    initialSync: await buildInitialDocumentSyncRequest(input),\n  };\n}\n\nexport async function buildProvisionedOrganizationProfile(\n  input: ProvisionedProfileInput & { name?: string | undefined },\n) {\n  const initialized = await createInitializedOrganizationProfileDocument({\n    name: input.name ?? DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  });\n  const request = await buildProvisionedDocumentRequest({\n    ...input,\n    initialUpdate: initialized.initialUpdate,\n  });\n  return { ...initialized, request };\n}\n\nexport async function buildProvisionedRosterProfile(\n  input: ProvisionedProfileInput & {\n    encapsulationPublicKey: Uint8Array;\n    nickname?: string | undefined;\n  },\n) {\n  const initialized = await createInitializedRosterProfileDocument({\n    encapsulationPublicKey: bytesToBase64(input.encapsulationPublicKey),\n    isSelf: true,\n    nickname: input.nickname ?? DEFAULT_ROSTER_PROFILE_SELF_NICKNAME,\n    userId: input.author.signerUserId,\n  });\n  const request = await buildProvisionedDocumentRequest({\n    ...input,\n    initialUpdate: initialized.initialUpdate,\n  });\n  return { ...initialized, request };\n}\n"]}

package/workflows/registration/provisioningBootstrapBuilders.js

@@ -4,8 +4,8 @@ import { deriveStableDocumentId } from "../../data/documents/shared/stableDocume
 import { deriveContainerSystemSlot, } from "../container-contents/systemSlot.js";
 import { buildContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, } from "../containers/child/create.js";
 import { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "../containers/root/create.js";
-import { buildMaterializedDocumentCreatePlan } from "../documents/create.js";
-import { buildInitialDocumentSyncRequest } from "../documents/initialSync.js";
+import { buildMaterializedDocumentCreatePlan } from "../documents/create/index.js";
+import { buildInitialDocumentSyncRequest } from "../documents/sync/initialSync.js";
 import { getOrganizationProfileDocumentLocalId } from "../organizations/organizationProfile.js";
 import { deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, } from "../organizations/rosterProfileContainer.js";
 import { buildProvisionedOrganizationProfile, buildProvisionedRosterProfile, } from "./provisionedProfileDocument.js";

package/workflows/registration/provisioningBootstrapBuilders.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioningBootstrapBuilders.js","sourceRoot":"","sources":["provisioningBootstrapBuilders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,4CAA4C,GAC7C,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAqE1G;;;;;;GAMG;AACH,KAAK,UAAU,kCAAkC,CAAC,KAmBjD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAqC;QACtD,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACnC,CAAC,CAAC,CACE,MAAM,4BAA4B,CAAC;gBACjC,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,+BAA+B,EAAE,aAAa,CAC5C,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,kBAAkB;qBAC1D,KAAK,CAAC,sBAAsB,CAChC;aACF,CAAC,CACH,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,KAAK,CAAC,qBAAqB;oBAC7B,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;KACP,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,yBAAyB;QACzD,CAAC,CAAC,2CAA2C,CAAC,aAAa,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,4CAA4C,CAAC;YAC3C,gBAAgB,EAAE,aAAa;YAC/B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;SAChD,CAAC,CAAC;IACP,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,mCAAmC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,kBAAkB;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,aAAa;QACb,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,8BAA8B,EAAE,aAAa;QAC7C,aAAa;QACb,mBAAmB;QACnB,gBAAgB,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,mBAAmB;YACnB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO;SACzD;QACD,kBAAkB;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,0CAA0C;QAChD,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,kDAAkD,CAAC;YACnE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,qBAAqB;QACtC,4BAA4B,EAAE,OAAO,CAAC,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,OAAO;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAgC;IACvE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,sBAAsB,CACtC,+BAA+B,CAAC;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CACH;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,qBAAqB;QAC3C,QAAQ,EAAE,KAAK,CAAC,qBAAqB;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,yBAAyB,CAAC;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;YACrC,SAAS,EAAE,KAAK,CAAC,iBAAiB;SACnC,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB;IACzD,OAAO,sBAAsB,CAC3B,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,MAAM,2BAA2B,GAAG,MAAM,mCAAmC,CAC3E;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,2BAA2B,CAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,oBAAoB,EAAE,2BAA2B;QACjD,IAAI,EAAE,KAAK,CAAC,uBAAuB;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI;QACV,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,IAAI,EAAE,oCAAoC;QAC1C,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YACnC,8CAA8C,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,8CAA8C,CAAC,KAAK,CAAC,kBAAkB,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,6CAA6C,CAAC;YAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,GAC5C,MAAM,+BAA+B,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACL,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,2BAA2B;QAC3B,kCAAkC,EAAE,OAAO,CAAC,OAAO;QACnD,2BAA2B,EAAE,OAAO,CAAC,QAAQ;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,eAAe;QAClC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QACtD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,2CAA2C,CACzE,aAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,uBAAuB;QAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,oBAAoB;QACpB,2BAA2B,EAAE;YAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO;YACpC,WAAW,EAAE,MAAM,+BAA+B,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mBAAmB,EAAE,uBAAuB;gBAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC5C,oBAAoB,EAAE,oBAAoB;aAC3C,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { createInitializedContainerMetadataDocument } from \"../../data/containers/containerMetadataDocument\";\nimport { deriveStableDocumentId } from \"../../data/documents/shared/stableDocumentId\";\nimport {\n  type ContainerSystemSlotDefinition,\n  deriveContainerSystemSlot,\n} from \"../container-contents/systemSlot\";\nimport {\n  buildContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n} from \"../containers/child/create\";\nimport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"../containers/root/create\";\nimport type { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { buildMaterializedDocumentCreatePlan } from \"../documents/create\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/initialSync\";\nimport { getOrganizationProfileDocumentLocalId } from \"../organizations/organizationProfile\";\nimport {\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n} from \"../organizations/rosterProfileContainer\";\nimport type {\n  InitialOrganizationMetadataBootstrap,\n  InitialRootContainerCreatePlan,\n  InitialRosterProfileBootstrap,\n  InitialSystemContainerBootstrap,\n  InitialSystemContainerCreatePlan,\n} from \"./organizationProvisioningArtifacts\";\nimport {\n  buildProvisionedOrganizationProfile,\n  buildProvisionedRosterProfile,\n} from \"./provisionedProfileDocument\";\nimport { verifiedPrincipalPolicyFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\ntype InitialRootContainerProjection = ReturnType<\n  typeof rootContainerWriterProjectionFromCreatePlan\n>;\n\n/**\n * An app-owned system container to provision atomically with a new organization\n * (e.g. a trash bin). The client-sdk is agnostic to what these are:\n * the caller (the app, which owns the mini-app slot namespaces) declares each\n * one, and the provisioning path derives its per-user system slot, builds a\n * signed Admins-scoped child of root, and links it into the same transaction as\n * the rest of the organization bootstrap. The behavioral rules that govern a\n * system container are resolved client-side by slot, so provisioning needs only\n * the slot definition, display name, and icon — no rules travel to the server.\n */\nexport interface ProvisionedSystemContainerSpec {\n  readonly slotDefinition: ContainerSystemSlotDefinition;\n  readonly name: string;\n  readonly icon: string | null;\n}\n\ninterface InitialOrganizationMetadataBootstrapInput {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId: string;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  organizationProfileName?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}\n\ninterface InitialRosterProfileInput {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  encapsulationPublicKey: Uint8Array;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  rosterProfileNickname?: string | undefined;\n  targetSecretKey: Uint8Array;\n}\n\ninterface ProvisionedChildContainerCore {\n  containerId: string;\n  containerMetadataDocument: Awaited<\n    ReturnType<typeof buildMaterializedDocumentCreatePlan>\n  >;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  containerRequest: {\n    systemSlot: ContainerSystemSlot;\n    container: InitialSystemContainerCreatePlan[\"plan\"][\"request\"];\n    initialMetadataSync: Awaited<\n      ReturnType<typeof buildInitialDocumentSyncRequest>\n    >;\n    metadataDocument: Awaited<\n      ReturnType<typeof buildMaterializedDocumentCreatePlan>\n    >[\"plan\"][\"request\"];\n  };\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  systemSlot: ContainerSystemSlot;\n}\n\n/**\n * The shared spine of every provisioned system child container: mint the\n * container and its metadata document under root, project the writer view,\n * and assemble the create request. Callers differ only in slot derivation,\n * display metadata, authorizing policies, an optional managed read grant, and\n * what they attach afterwards (roster/org profile documents).\n */\nasync function buildProvisionedChildContainerCore(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId?: string | undefined;\n  icon: string | null;\n  managedPrincipalGrant?: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"managedPrincipalGrant\"];\n  name: string;\n  principalPolicies: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"principalPolicies\"];\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  systemSlot: ContainerSystemSlot;\n  targetSecretKey: Uint8Array;\n  independentMetadataGroups?: {\n    adminGroup: CreateOrganizationGroupRequest;\n    memberGroup: CreateOrganizationGroupRequest;\n  };\n}): Promise<ProvisionedChildContainerCore> {\n  const containerId = input.containerId ?? crypto.randomUUID();\n  const { initialUpdate } = await createInitializedContainerMetadataDocument(\n    containerId,\n    {\n      icon: input.icon,\n      name: input.name,\n    },\n  );\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerPlan: InitialSystemContainerCreatePlan = {\n    containerKey,\n    plan: input.independentMetadataGroups\n      ? (\n          await buildRootContainerCreatePlan({\n            ...input.independentMetadataGroups,\n            author: input.author,\n            containerId,\n            containerKey,\n            metadataDocumentId: containerId,\n            systemSlot: input.systemSlot,\n            recipientEncapsulationPublicKey: base64ToBytes(\n              input.independentMetadataGroups.adminGroup.initialGroupPolicy\n                .state.encapsulationPublicKey,\n            ),\n          })\n        ).plan\n      : await buildContainerCreatePlan({\n          author: input.author,\n          containerId,\n          containerKey,\n          ...(input.managedPrincipalGrant\n            ? { managedPrincipalGrant: input.managedPrincipalGrant }\n            : {}),\n          metadataDocumentId: containerId,\n          systemSlot: input.systemSlot,\n          parentProjection: input.rootContainerProjection,\n          principalPolicies: input.principalPolicies,\n        }),\n  };\n  const containerProjection = input.independentMetadataGroups\n    ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)\n    : childContainerWriterProjectionFromCreatePlan({\n        materializedPlan: containerPlan,\n        parentProjection: input.rootContainerProjection,\n      });\n  const knownContainerKeks = new Map([\n    [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n  ]);\n  const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection,\n    documentId: containerPlan.plan.metadataDocumentId,\n    knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const initialMetadataSync = await buildInitialDocumentSyncRequest({\n    author: input.author,\n    containerProjection,\n    initialUpdate,\n    materializedDocument: containerMetadataDocument,\n  });\n  return {\n    containerId,\n    containerMetadataDocument,\n    containerMetadataInitialUpdate: initialUpdate,\n    containerPlan,\n    containerProjection,\n    containerRequest: {\n      systemSlot: input.systemSlot,\n      container: containerPlan.plan.request,\n      initialMetadataSync,\n      metadataDocument: containerMetadataDocument.plan.request,\n    },\n    knownContainerKeks,\n    systemSlot: input.systemSlot,\n  };\n}\n\nexport async function buildInitialRosterProfileBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  encapsulationPublicKey: Uint8Array;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rosterProfileNickname?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialRosterProfileBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: null,\n    name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { profile, rosterProfileDocument } = await buildInitialRosterProfile({\n    author: input.author,\n    containerProjection: core.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    knownContainerKeks: core.knownContainerKeks,\n    rosterProfileNickname: input.rosterProfileNickname,\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    profileDocument: rosterProfileDocument,\n    profileDocumentInitialUpdate: profile.initialUpdate,\n    profileDocumentRequest: profile.request,\n    systemSlot: core.systemSlot,\n  };\n}\n\nasync function buildInitialRosterProfile(input: InitialRosterProfileInput) {\n  const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    documentId: await deriveStableDocumentId(\n      getRosterProfileDocumentLocalId({\n        organizationId: input.author.organizationId,\n        userId: input.author.signerUserId,\n      }),\n    ),\n    knownContainerKeks: input.knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const profile = await buildProvisionedRosterProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    materializedDocument: rosterProfileDocument,\n    nickname: input.rosterProfileNickname,\n  });\n  return { profile, rosterProfileDocument };\n}\n\nexport async function buildInitialSystemContainerBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  signingPrivateKey: Uint8Array;\n  spec: ProvisionedSystemContainerSpec;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialSystemContainerBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveContainerSystemSlot({\n      definition: input.spec.slotDefinition,\n      secretKey: input.signingPrivateKey,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    systemSlot: core.systemSlot,\n  };\n}\n\nfunction stableOrganizationProfileId(organizationId: string): Promise<string> {\n  return deriveStableDocumentId(\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n}\n\nasync function buildInitialOrganizationProfile(input: {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  organizationProfileName?: string | undefined;\n  targetSecretKey: Uint8Array;\n}) {\n  const organizationProfileDocument = await buildMaterializedDocumentCreatePlan(\n    {\n      author: input.author,\n      containerProjection: input.containerProjection,\n      documentId: await stableOrganizationProfileId(\n        input.author.organizationId,\n      ),\n      knownContainerKeks: input.knownContainerKeks,\n      targetSecretKey: input.targetSecretKey,\n      trustedLocalProjection: true,\n    },\n  );\n  const profile = await buildProvisionedOrganizationProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    materializedDocument: organizationProfileDocument,\n    name: input.organizationProfileName,\n  });\n  return { organizationProfileDocument, profile };\n}\n\n/**\n * Organization labels use an independent system root with Admins/admin and\n * Members/read grants. Personal root shares and rotations cannot expose or\n * strand organization metadata; Members changes still rotate its own KEK.\n */\nexport async function buildInitialOrganizationMetadataBootstrap(\n  input: InitialOrganizationMetadataBootstrapInput,\n): Promise<InitialOrganizationMetadataBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    containerId: input.containerId,\n    icon: null,\n    independentMetadataGroups: {\n      adminGroup: input.initialAdminGroup,\n      memberGroup: input.initialMemberGroup,\n    },\n    name: ORGANIZATION_METADATA_CONTAINER_NAME,\n    // Both reserved groups receive explicit grants on the independent root.\n    principalPolicies: await Promise.all([\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),\n    ]),\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationMetadataContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { organizationProfileDocument, profile } =\n    await buildInitialOrganizationProfile({\n      author: input.author,\n      containerProjection: core.containerProjection,\n      knownContainerKeks: core.knownContainerKeks,\n      organizationProfileName: input.organizationProfileName,\n      targetSecretKey: input.targetSecretKey,\n    });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    organizationProfileDocument,\n    organizationProfileDocumentRequest: profile.request,\n    organizationProfileSnapshot: profile.snapshot,\n    systemSlot: core.systemSlot,\n  };\n}\n\nexport async function buildInitialRootProvisioning(input: {\n  adminGroup: CreateOrganizationGroupRequest;\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n  recipientEncapsulationPublicKey: Uint8Array;\n  rootContainerId: string;\n  targetSecretKey: Uint8Array;\n}) {\n  const rootContainer = await buildRootContainerCreatePlan({\n    adminGroup: input.adminGroup,\n    author: input.author,\n    containerId: input.rootContainerId,\n    metadataDocumentId: input.bootstrap.metadataDocumentId,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n  });\n  const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(\n    rootContainer.plan,\n  );\n  const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: rootContainerProjection,\n    documentId: input.bootstrap.metadataDocumentId,\n    knownContainerKeks: new Map([\n      [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],\n    ]),\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  return {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest: {\n      ...rootMetadataDocument.plan.request,\n      initialSync: await buildInitialDocumentSyncRequest({\n        author: input.author,\n        containerProjection: rootContainerProjection,\n        initialUpdate: input.bootstrap.initialUpdate,\n        materializedDocument: rootMetadataDocument,\n      }),\n    },\n  };\n}\n"]}
+{"version":3,"file":"provisioningBootstrapBuilders.js","sourceRoot":"","sources":["provisioningBootstrapBuilders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,4CAA4C,GAC7C,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAqE1G;;;;;;GAMG;AACH,KAAK,UAAU,kCAAkC,CAAC,KAmBjD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAqC;QACtD,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACnC,CAAC,CAAC,CACE,MAAM,4BAA4B,CAAC;gBACjC,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,+BAA+B,EAAE,aAAa,CAC5C,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,kBAAkB;qBAC1D,KAAK,CAAC,sBAAsB,CAChC;aACF,CAAC,CACH,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,KAAK,CAAC,qBAAqB;oBAC7B,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;KACP,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,yBAAyB;QACzD,CAAC,CAAC,2CAA2C,CAAC,aAAa,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,4CAA4C,CAAC;YAC3C,gBAAgB,EAAE,aAAa;YAC/B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;SAChD,CAAC,CAAC;IACP,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,mCAAmC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,kBAAkB;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,aAAa;QACb,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,8BAA8B,EAAE,aAAa;QAC7C,aAAa;QACb,mBAAmB;QACnB,gBAAgB,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,mBAAmB;YACnB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO;SACzD;QACD,kBAAkB;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,0CAA0C;QAChD,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,kDAAkD,CAAC;YACnE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,qBAAqB;QACtC,4BAA4B,EAAE,OAAO,CAAC,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,OAAO;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAgC;IACvE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,sBAAsB,CACtC,+BAA+B,CAAC;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CACH;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,qBAAqB;QAC3C,QAAQ,EAAE,KAAK,CAAC,qBAAqB;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,yBAAyB,CAAC;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;YACrC,SAAS,EAAE,KAAK,CAAC,iBAAiB;SACnC,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB;IACzD,OAAO,sBAAsB,CAC3B,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,MAAM,2BAA2B,GAAG,MAAM,mCAAmC,CAC3E;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,2BAA2B,CAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,oBAAoB,EAAE,2BAA2B;QACjD,IAAI,EAAE,KAAK,CAAC,uBAAuB;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI;QACV,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,IAAI,EAAE,oCAAoC;QAC1C,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YACnC,8CAA8C,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,8CAA8C,CAAC,KAAK,CAAC,kBAAkB,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,6CAA6C,CAAC;YAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,GAC5C,MAAM,+BAA+B,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACL,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,2BAA2B;QAC3B,kCAAkC,EAAE,OAAO,CAAC,OAAO;QACnD,2BAA2B,EAAE,OAAO,CAAC,QAAQ;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,eAAe;QAClC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QACtD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,2CAA2C,CACzE,aAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,uBAAuB;QAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,oBAAoB;QACpB,2BAA2B,EAAE;YAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO;YACpC,WAAW,EAAE,MAAM,+BAA+B,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mBAAmB,EAAE,uBAAuB;gBAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC5C,oBAAoB,EAAE,oBAAoB;aAC3C,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { createInitializedContainerMetadataDocument } from \"../../data/containers/containerMetadataDocument\";\nimport { deriveStableDocumentId } from \"../../data/documents/shared/stableDocumentId\";\nimport {\n  type ContainerSystemSlotDefinition,\n  deriveContainerSystemSlot,\n} from \"../container-contents/systemSlot\";\nimport {\n  buildContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n} from \"../containers/child/create\";\nimport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"../containers/root/create\";\nimport type { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { buildMaterializedDocumentCreatePlan } from \"../documents/create\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/sync/initialSync\";\nimport { getOrganizationProfileDocumentLocalId } from \"../organizations/organizationProfile\";\nimport {\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n} from \"../organizations/rosterProfileContainer\";\nimport type {\n  InitialOrganizationMetadataBootstrap,\n  InitialRootContainerCreatePlan,\n  InitialRosterProfileBootstrap,\n  InitialSystemContainerBootstrap,\n  InitialSystemContainerCreatePlan,\n} from \"./organizationProvisioningArtifacts\";\nimport {\n  buildProvisionedOrganizationProfile,\n  buildProvisionedRosterProfile,\n} from \"./provisionedProfileDocument\";\nimport { verifiedPrincipalPolicyFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\ntype InitialRootContainerProjection = ReturnType<\n  typeof rootContainerWriterProjectionFromCreatePlan\n>;\n\n/**\n * An app-owned system container to provision atomically with a new organization\n * (e.g. a trash bin). The client-sdk is agnostic to what these are:\n * the caller (the app, which owns the mini-app slot namespaces) declares each\n * one, and the provisioning path derives its per-user system slot, builds a\n * signed Admins-scoped child of root, and links it into the same transaction as\n * the rest of the organization bootstrap. The behavioral rules that govern a\n * system container are resolved client-side by slot, so provisioning needs only\n * the slot definition, display name, and icon — no rules travel to the server.\n */\nexport interface ProvisionedSystemContainerSpec {\n  readonly slotDefinition: ContainerSystemSlotDefinition;\n  readonly name: string;\n  readonly icon: string | null;\n}\n\ninterface InitialOrganizationMetadataBootstrapInput {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId: string;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  organizationProfileName?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}\n\ninterface InitialRosterProfileInput {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  encapsulationPublicKey: Uint8Array;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  rosterProfileNickname?: string | undefined;\n  targetSecretKey: Uint8Array;\n}\n\ninterface ProvisionedChildContainerCore {\n  containerId: string;\n  containerMetadataDocument: Awaited<\n    ReturnType<typeof buildMaterializedDocumentCreatePlan>\n  >;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  containerRequest: {\n    systemSlot: ContainerSystemSlot;\n    container: InitialSystemContainerCreatePlan[\"plan\"][\"request\"];\n    initialMetadataSync: Awaited<\n      ReturnType<typeof buildInitialDocumentSyncRequest>\n    >;\n    metadataDocument: Awaited<\n      ReturnType<typeof buildMaterializedDocumentCreatePlan>\n    >[\"plan\"][\"request\"];\n  };\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  systemSlot: ContainerSystemSlot;\n}\n\n/**\n * The shared spine of every provisioned system child container: mint the\n * container and its metadata document under root, project the writer view,\n * and assemble the create request. Callers differ only in slot derivation,\n * display metadata, authorizing policies, an optional managed read grant, and\n * what they attach afterwards (roster/org profile documents).\n */\nasync function buildProvisionedChildContainerCore(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId?: string | undefined;\n  icon: string | null;\n  managedPrincipalGrant?: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"managedPrincipalGrant\"];\n  name: string;\n  principalPolicies: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"principalPolicies\"];\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  systemSlot: ContainerSystemSlot;\n  targetSecretKey: Uint8Array;\n  independentMetadataGroups?: {\n    adminGroup: CreateOrganizationGroupRequest;\n    memberGroup: CreateOrganizationGroupRequest;\n  };\n}): Promise<ProvisionedChildContainerCore> {\n  const containerId = input.containerId ?? crypto.randomUUID();\n  const { initialUpdate } = await createInitializedContainerMetadataDocument(\n    containerId,\n    {\n      icon: input.icon,\n      name: input.name,\n    },\n  );\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerPlan: InitialSystemContainerCreatePlan = {\n    containerKey,\n    plan: input.independentMetadataGroups\n      ? (\n          await buildRootContainerCreatePlan({\n            ...input.independentMetadataGroups,\n            author: input.author,\n            containerId,\n            containerKey,\n            metadataDocumentId: containerId,\n            systemSlot: input.systemSlot,\n            recipientEncapsulationPublicKey: base64ToBytes(\n              input.independentMetadataGroups.adminGroup.initialGroupPolicy\n                .state.encapsulationPublicKey,\n            ),\n          })\n        ).plan\n      : await buildContainerCreatePlan({\n          author: input.author,\n          containerId,\n          containerKey,\n          ...(input.managedPrincipalGrant\n            ? { managedPrincipalGrant: input.managedPrincipalGrant }\n            : {}),\n          metadataDocumentId: containerId,\n          systemSlot: input.systemSlot,\n          parentProjection: input.rootContainerProjection,\n          principalPolicies: input.principalPolicies,\n        }),\n  };\n  const containerProjection = input.independentMetadataGroups\n    ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)\n    : childContainerWriterProjectionFromCreatePlan({\n        materializedPlan: containerPlan,\n        parentProjection: input.rootContainerProjection,\n      });\n  const knownContainerKeks = new Map([\n    [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n  ]);\n  const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection,\n    documentId: containerPlan.plan.metadataDocumentId,\n    knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const initialMetadataSync = await buildInitialDocumentSyncRequest({\n    author: input.author,\n    containerProjection,\n    initialUpdate,\n    materializedDocument: containerMetadataDocument,\n  });\n  return {\n    containerId,\n    containerMetadataDocument,\n    containerMetadataInitialUpdate: initialUpdate,\n    containerPlan,\n    containerProjection,\n    containerRequest: {\n      systemSlot: input.systemSlot,\n      container: containerPlan.plan.request,\n      initialMetadataSync,\n      metadataDocument: containerMetadataDocument.plan.request,\n    },\n    knownContainerKeks,\n    systemSlot: input.systemSlot,\n  };\n}\n\nexport async function buildInitialRosterProfileBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  encapsulationPublicKey: Uint8Array;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rosterProfileNickname?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialRosterProfileBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: null,\n    name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { profile, rosterProfileDocument } = await buildInitialRosterProfile({\n    author: input.author,\n    containerProjection: core.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    knownContainerKeks: core.knownContainerKeks,\n    rosterProfileNickname: input.rosterProfileNickname,\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    profileDocument: rosterProfileDocument,\n    profileDocumentInitialUpdate: profile.initialUpdate,\n    profileDocumentRequest: profile.request,\n    systemSlot: core.systemSlot,\n  };\n}\n\nasync function buildInitialRosterProfile(input: InitialRosterProfileInput) {\n  const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    documentId: await deriveStableDocumentId(\n      getRosterProfileDocumentLocalId({\n        organizationId: input.author.organizationId,\n        userId: input.author.signerUserId,\n      }),\n    ),\n    knownContainerKeks: input.knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const profile = await buildProvisionedRosterProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    materializedDocument: rosterProfileDocument,\n    nickname: input.rosterProfileNickname,\n  });\n  return { profile, rosterProfileDocument };\n}\n\nexport async function buildInitialSystemContainerBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  signingPrivateKey: Uint8Array;\n  spec: ProvisionedSystemContainerSpec;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialSystemContainerBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveContainerSystemSlot({\n      definition: input.spec.slotDefinition,\n      secretKey: input.signingPrivateKey,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    systemSlot: core.systemSlot,\n  };\n}\n\nfunction stableOrganizationProfileId(organizationId: string): Promise<string> {\n  return deriveStableDocumentId(\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n}\n\nasync function buildInitialOrganizationProfile(input: {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  organizationProfileName?: string | undefined;\n  targetSecretKey: Uint8Array;\n}) {\n  const organizationProfileDocument = await buildMaterializedDocumentCreatePlan(\n    {\n      author: input.author,\n      containerProjection: input.containerProjection,\n      documentId: await stableOrganizationProfileId(\n        input.author.organizationId,\n      ),\n      knownContainerKeks: input.knownContainerKeks,\n      targetSecretKey: input.targetSecretKey,\n      trustedLocalProjection: true,\n    },\n  );\n  const profile = await buildProvisionedOrganizationProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    materializedDocument: organizationProfileDocument,\n    name: input.organizationProfileName,\n  });\n  return { organizationProfileDocument, profile };\n}\n\n/**\n * Organization labels use an independent system root with Admins/admin and\n * Members/read grants. Personal root shares and rotations cannot expose or\n * strand organization metadata; Members changes still rotate its own KEK.\n */\nexport async function buildInitialOrganizationMetadataBootstrap(\n  input: InitialOrganizationMetadataBootstrapInput,\n): Promise<InitialOrganizationMetadataBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    containerId: input.containerId,\n    icon: null,\n    independentMetadataGroups: {\n      adminGroup: input.initialAdminGroup,\n      memberGroup: input.initialMemberGroup,\n    },\n    name: ORGANIZATION_METADATA_CONTAINER_NAME,\n    // Both reserved groups receive explicit grants on the independent root.\n    principalPolicies: await Promise.all([\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),\n    ]),\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationMetadataContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { organizationProfileDocument, profile } =\n    await buildInitialOrganizationProfile({\n      author: input.author,\n      containerProjection: core.containerProjection,\n      knownContainerKeks: core.knownContainerKeks,\n      organizationProfileName: input.organizationProfileName,\n      targetSecretKey: input.targetSecretKey,\n    });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    organizationProfileDocument,\n    organizationProfileDocumentRequest: profile.request,\n    organizationProfileSnapshot: profile.snapshot,\n    systemSlot: core.systemSlot,\n  };\n}\n\nexport async function buildInitialRootProvisioning(input: {\n  adminGroup: CreateOrganizationGroupRequest;\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n  recipientEncapsulationPublicKey: Uint8Array;\n  rootContainerId: string;\n  targetSecretKey: Uint8Array;\n}) {\n  const rootContainer = await buildRootContainerCreatePlan({\n    adminGroup: input.adminGroup,\n    author: input.author,\n    containerId: input.rootContainerId,\n    metadataDocumentId: input.bootstrap.metadataDocumentId,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n  });\n  const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(\n    rootContainer.plan,\n  );\n  const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: rootContainerProjection,\n    documentId: input.bootstrap.metadataDocumentId,\n    knownContainerKeks: new Map([\n      [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],\n    ]),\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  return {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest: {\n      ...rootMetadataDocument.plan.request,\n      initialSync: await buildInitialDocumentSyncRequest({\n        author: input.author,\n        containerProjection: rootContainerProjection,\n        initialUpdate: input.bootstrap.initialUpdate,\n        materializedDocument: rootMetadataDocument,\n      }),\n    },\n  };\n}\n"]}

package/workflows/registration/registerIdentity.js

@@ -3,8 +3,8 @@ import { bytesToBase64 } from "../../internal/encoding/index.js";
 import { encodeOrganizationAuthorityDescriptor } from "../../data/principals/organizationAuthorityDescriptor.js";
 import { validateUserIdentityKeys } from "../../data/trustedUserIdentity/index.js";
 import { resolveDocumentCreateAuthor } from "../documents/author.js";
-import { groupPolicyMutationHead } from "../organizations/groupPolicyMutationHead.js";
-import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "../organizations/principalPolicy.js";
+import { groupPolicyMutationHead } from "../organizations/groupPolicy/groupPolicyMutationHead.js";
+import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "../organizations/principalPolicy/index.js";
 import { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
 import { buildInitialOrganizationMetadataBootstrap, buildInitialRootProvisioning, buildInitialRosterProfileBootstrap, buildInitialSystemContainerBootstrap, } from "./provisioningBootstrapBuilders.js";
 import { createInitialRootMetadataBootstrap } from "./rootMetadataBootstrap.js";

package/workflows/registration/registerIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"registerIdentity.js","sourceRoot":"","sources":["registerIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,yBAAyB,EACzB,uBAAuB,EAGvB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAG9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAE7F,OAAO,EACL,yCAAyC,EACzC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAI7E,OAAO,EAAE,oCAAoC,EAAE,CAAC;AAiGhD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,wBAAwB,GAAG,MAAM,aAAa,CAClD,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,aAAa,CACzD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,UAAU,GAAG;QACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,OAAgB;SACvB;KACF,CAAC;IACF,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CACjD,eAAe,CAAC,SAAS,EACzB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAC/B,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG;QACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,+BAA+B;YACrD,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,CAAC;QACX,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,wBAAwB;KACzB,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM,EAAE,EAAE;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;QAC7D,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE;YAC5D;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,OAAO;aACrB;SACF;QACD,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;QACpE,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,MAAM;aACpB;SACF;QACD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,qCAAqC,CAC3E;QACE,YAAY,EAAE,iBAAiB,CAAC,OAAO;QACvC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC7D,uBAAuB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;SAC/D,CAAC;QACF,aAAa,EAAE,kBAAkB,CAAC,OAAO;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACpE,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5D,MAAM,EACJ,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,GACnB,GAAG,MAAM,mCAAmC,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,+BAA+B;QAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC;QACnD,cAAc;QACd,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,MAAM,EACJ,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,GAAG,MAAM,4BAA4B,CAAC;QACrC,UAAU,EAAE,iBAAiB;QAC7B,MAAM;QACN,SAAS;QACT,+BAA+B,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,iBAAiB;QACjB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,6BAA6B,GACjC,MAAM,yCAAyC,CAAC;QAC9C,MAAM;QACN,WAAW,EAAE,+BAA+B;QAC5C,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACL,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,oCAAoC,CAAC;QACnC,MAAM;QACN,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;QACzD,IAAI;QACJ,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,SAAS;QACT,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;QAChD,cAAc;QACd,6BAA6B;QAC7B,aAAa;QACb,oBAAoB;QACpB,2BAA2B;QAC3B,sBAAsB;QACtB,yBAAyB;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE;YACT,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CACjD,SAAS,EACT,SAAS,CAAC,cAAc,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,cAAc,CAAC,gBAAgB,EACrC,KAAK,CAAC,oBAAoB,CAAC,SAAS,EACpC,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,SAAS,CAAC,yBAAyB,EACnC,SAAS,CAAC,oBAAoB,EAC9B,SAAS,CAAC,2BAA2B,EACrC,SAAS,CAAC,sBAAsB,CAAC,gBAAgB,EACjD,SAAS,CAAC,sBAAsB,CAAC,sBAAsB,EACvD,SAAS,CAAC,6BAA6B,CAAC,gBAAgB,EACxD,SAAS,CAAC,6BAA6B,CAAC,kCAAkC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,GAAG,CACrC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE;YAC1C,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { RegistrationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { encodeOrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type { LocalUserIdentityCandidate } from \"../../data/trustedUserIdentity\";\nimport { validateUserIdentityKeys } from \"../../data/trustedUserIdentity\";\nimport { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { groupPolicyMutationHead } from \"../organizations/groupPolicyMutationHead\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"../organizations/principalPolicy\";\nimport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nimport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"./provisionedPrincipalHistory\";\nimport {\n  buildInitialOrganizationMetadataBootstrap,\n  buildInitialRootProvisioning,\n  buildInitialRosterProfileBootstrap,\n  buildInitialSystemContainerBootstrap,\n  type ProvisionedSystemContainerSpec,\n} from \"./provisioningBootstrapBuilders\";\nimport { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nexport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\nexport { persistOrganizationProvisioningState };\n\nexport interface RegistrationApi {\n  registerUser(\n    userId: string,\n    organizationId: string,\n    rootContainerId: string,\n    signingPublicKey: Uint8Array,\n    encapsulationPublicKey: Uint8Array,\n    initialAdminGroup: RegistrationRequest[\"initialAdminGroup\"],\n    initialMemberGroup: RegistrationRequest[\"initialMemberGroup\"],\n    initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"],\n    initialRootContainer: RegistrationRequest[\"initialRootContainer\"],\n    initialRootMetadataDocument: ProvisionedDocumentRequest,\n    initialRosterProfileContainer: RegistrationRequest[\"initialRosterProfileContainer\"],\n    initialRosterProfileDocument: ProvisionedDocumentRequest | undefined,\n    initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest,\n    initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined,\n    initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined,\n  ): Promise<RegistrationResponse | null>;\n}\n\ninterface OrganizationProvisioningPrincipalPolicies {\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  organizationId: string;\n  signingFingerprint: string;\n}\n\nexport interface RegisterIdentityInput {\n  apiClient: RegistrationApi;\n  containerId: string;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  /**\n   * Reports whether the identity that started this registration is still\n   * current. Forwarded to the bootstrap persist's in-mutex currency check,\n   * so an identity replaced while the persist waits for the mutation queue\n   * cannot write its bootstrap through a client the replacement owns.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /**\n   * Overrides the seeded personal-org profile name; defaults to \"Personal Org\".\n   */\n  organizationProfileName?: string | undefined;\n  pinLocalUserIdentity: (\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ) => Promise<void>;\n  /** Seeds verified recovery progress for the founding policy heads. */\n  primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n  /**\n   * App-owned system containers to provision atomically with the personal\n   * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname; defaults to \"You\". The\n   * demo host passes each pane's peer-labeled self name (\"Peer 1 (You)\").\n   */\n  rosterProfileNickname?: string | undefined;\n  signingKeyFingerprint?: string | null | undefined;\n  signingKeyPair: SigningKeyPair;\n}\n\n/**\n * The freshly built provisioning artifacts, shared by registration and\n * additional-organization creation. `registerIdentity` generates a new\n * `userId`; creating an additional organization reuses the caller's existing\n * one. Everything here is derived purely from the caller's key material, so it\n * is identical for both flows.\n */\nexport interface OrganizationProvisioningArtifactsInput {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the organization\n   * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and\n   * organization-metadata system containers.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  rootContainerId: string;\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}\n\nexport async function buildInitialOrganizationPolicyRequest(input: {\n  adminGroupId: string;\n  groupHeads: readonly ReferencedPrincipalHead[];\n  encapsulationPublicKey: Uint8Array;\n  memberGroupId: string;\n  organizationId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<RegistrationRequest[\"initialOrganizationPolicy\"]> {\n  const organizationKem = generateKemSeedAndKeyPair();\n  const signerUserKeyFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const userEncapsulationKeyFingerprint = await toFingerprint(\n    input.encapsulationPublicKey,\n  );\n  const projection = [\n    {\n      userId: input.userId,\n      role: \"admin\" as const,\n    },\n  ];\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    version: 2,\n    organizationId: input.organizationId,\n    adminGroupId: input.adminGroupId,\n    memberGroupId: input.memberGroupId,\n    groupHeads: input.groupHeads.map((head) => {\n      if (head.principalType !== \"group\") {\n        throw new Error(\"Organization directory can contain only group heads\");\n      }\n      return { ...head, principalType: \"group\" };\n    }),\n  });\n  const [memberEnvelope] = await wrapDekForRecipients(\n    organizationKem.secretKey,\n    [input.encapsulationPublicKey],\n  );\n\n  if (!memberEnvelope) {\n    throw new Error(\"Failed to wrap organization key for registering user\");\n  }\n  const memberEnvelopes = [\n    {\n      userId: input.userId,\n      memberKeyFingerprint: userEncapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),\n    },\n  ];\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.organizationId,\n      version: 1,\n      prevStateHash: null,\n      keyEpoch: 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: [{ userId: input.userId }],\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.userId,\n      signerUserKeyFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants: [],\n    memberEnvelopes,\n  };\n}\n\nasync function createOrganizationPrincipalPolicies(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationMetadataContainerId: string;\n  rootContainerId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<OrganizationProvisioningPrincipalPolicies> {\n  const organizationId = crypto.randomUUID();\n  const signingFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const initialAdminGroup = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      { containerId: input.rootContainerId, accessLevel: \"admin\" },\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"admin\",\n      },\n    ],\n    name: \"Admins\",\n    builtinRole: \"admins\",\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"read\",\n      },\n    ],\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest(\n    {\n      adminGroupId: initialAdminGroup.groupId,\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      groupHeads: await Promise.all([\n        groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),\n        groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),\n      ]),\n      memberGroupId: initialMemberGroup.groupId,\n      organizationId,\n      signingKeyPair: input.signingKeyPair,\n      userId: input.userId,\n    },\n  );\n\n  return {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  };\n}\n\nfunction requireOrganizationProvisioningAuthor(input: {\n  readonly organizationId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}) {\n  const author = resolveDocumentCreateAuthor({\n    auth: { organizationId: input.organizationId, userId: input.userId },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\n      `Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`,\n    );\n  }\n  return author;\n}\n\n/** Builds the signed artifacts shared by registration and org creation. */\nexport async function buildOrganizationProvisioningArtifacts(\n  input: OrganizationProvisioningArtifactsInput,\n): Promise<OrganizationProvisioningArtifacts> {\n  const bootstrap = await createInitialRootMetadataBootstrap(\n    input.rootContainerId,\n  );\n  const organizationMetadataContainerId = crypto.randomUUID();\n  const {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  } = await createOrganizationPrincipalPolicies({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationMetadataContainerId,\n    rootContainerId: input.rootContainerId,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n  const author = requireOrganizationProvisioningAuthor({\n    organizationId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n\n  const {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n  } = await buildInitialRootProvisioning({\n    adminGroup: initialAdminGroup,\n    author,\n    bootstrap,\n    recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    rootContainerId: input.rootContainerId,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({\n    author,\n    encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    initialAdminGroup,\n    rosterProfileNickname: input.rosterProfileNickname,\n    rootContainer,\n    rootContainerProjection,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const organizationMetadataBootstrap =\n    await buildInitialOrganizationMetadataBootstrap({\n      author,\n      containerId: organizationMetadataContainerId,\n      initialAdminGroup,\n      initialMemberGroup,\n      organizationProfileName: input.organizationProfileName,\n      rootContainer,\n      rootContainerProjection,\n      targetSecretKey: input.encapsulationKeyPair.secretKey,\n    });\n  const systemContainerBootstraps = await Promise.all(\n    (input.provisionedSystemContainers ?? []).map((spec) =>\n      buildInitialSystemContainerBootstrap({\n        author,\n        initialAdminGroup,\n        rootContainer,\n        rootContainerProjection,\n        signingPrivateKey: input.signingKeyPair.signingPrivateKey,\n        spec,\n        targetSecretKey: input.encapsulationKeyPair.secretKey,\n      }),\n    ),\n  );\n\n  return {\n    replacementAuthorization: null,\n    bootstrap,\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    initialRootContainer: rootContainer.plan.request,\n    organizationId,\n    organizationMetadataBootstrap,\n    rootContainer,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n    rosterProfileBootstrap,\n    systemContainerBootstraps,\n  };\n}\n\nexport async function registerIdentity(\n  input: RegisterIdentityInput,\n): Promise<RegistrationResponse | null> {\n  input.log?.(\"Registering identity...\");\n  await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingKeyFingerprint: input.signingKeyFingerprint,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    },\n  });\n\n  const newUserId = crypto.randomUUID();\n  const artifacts = await buildOrganizationProvisioningArtifacts({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId: input.containerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: newUserId,\n  });\n\n  const response = await input.apiClient.registerUser(\n    newUserId,\n    artifacts.organizationId,\n    input.containerId,\n    input.signingKeyPair.signingPublicKey,\n    input.encapsulationKeyPair.publicKey,\n    artifacts.initialAdminGroup,\n    artifacts.initialMemberGroup,\n    artifacts.initialOrganizationPolicy,\n    artifacts.initialRootContainer,\n    artifacts.rootMetadataDocumentRequest,\n    artifacts.rosterProfileBootstrap.containerRequest,\n    artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    artifacts.organizationMetadataBootstrap.containerRequest,\n    artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest,\n    artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n  );\n  if (!response) {\n    return null;\n  }\n  if (response.userId !== newUserId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Registration response user does not match the requested identity\",\n    );\n  }\n  // Pinned only once the server has confirmed this user, and before anything\n  // is persisted under it. The trust store binds each signing key to one user,\n  // so a pin for an id the server never accepted — a retry after a lost\n  // response, or a restored key that is already registered — would later\n  // refuse the key's real user at login. Like the persistence below, it is a\n  // durable write, so it is skipped once the registering identity has been\n  // replaced: the caller discards this result.\n  if (input.isIdentityCurrent?.() ?? true) {\n    await input.pinLocalUserIdentity(newUserId, {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  }\n\n  input.log?.(`Key registered (${response.userId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: input.containerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    primePrincipalHistory: input.primePrincipalHistory,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}
+{"version":3,"file":"registerIdentity.js","sourceRoot":"","sources":["registerIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,yBAAyB,EACzB,uBAAuB,EAGvB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAG9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAE7F,OAAO,EACL,yCAAyC,EACzC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAI7E,OAAO,EAAE,oCAAoC,EAAE,CAAC;AAiGhD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,wBAAwB,GAAG,MAAM,aAAa,CAClD,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,aAAa,CACzD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,UAAU,GAAG;QACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,OAAgB;SACvB;KACF,CAAC;IACF,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CACjD,eAAe,CAAC,SAAS,EACzB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAC/B,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG;QACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,+BAA+B;YACrD,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,CAAC;QACX,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,wBAAwB;KACzB,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM,EAAE,EAAE;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;QAC7D,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE;YAC5D;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,OAAO;aACrB;SACF;QACD,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;QACpE,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,MAAM;aACpB;SACF;QACD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,qCAAqC,CAC3E;QACE,YAAY,EAAE,iBAAiB,CAAC,OAAO;QACvC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC7D,uBAAuB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;SAC/D,CAAC;QACF,aAAa,EAAE,kBAAkB,CAAC,OAAO;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACpE,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5D,MAAM,EACJ,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,GACnB,GAAG,MAAM,mCAAmC,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,+BAA+B;QAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC;QACnD,cAAc;QACd,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,MAAM,EACJ,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,GAAG,MAAM,4BAA4B,CAAC;QACrC,UAAU,EAAE,iBAAiB;QAC7B,MAAM;QACN,SAAS;QACT,+BAA+B,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,iBAAiB;QACjB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,6BAA6B,GACjC,MAAM,yCAAyC,CAAC;QAC9C,MAAM;QACN,WAAW,EAAE,+BAA+B;QAC5C,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACL,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,oCAAoC,CAAC;QACnC,MAAM;QACN,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;QACzD,IAAI;QACJ,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,SAAS;QACT,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;QAChD,cAAc;QACd,6BAA6B;QAC7B,aAAa;QACb,oBAAoB;QACpB,2BAA2B;QAC3B,sBAAsB;QACtB,yBAAyB;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE;YACT,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CACjD,SAAS,EACT,SAAS,CAAC,cAAc,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,cAAc,CAAC,gBAAgB,EACrC,KAAK,CAAC,oBAAoB,CAAC,SAAS,EACpC,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,SAAS,CAAC,yBAAyB,EACnC,SAAS,CAAC,oBAAoB,EAC9B,SAAS,CAAC,2BAA2B,EACrC,SAAS,CAAC,sBAAsB,CAAC,gBAAgB,EACjD,SAAS,CAAC,sBAAsB,CAAC,sBAAsB,EACvD,SAAS,CAAC,6BAA6B,CAAC,gBAAgB,EACxD,SAAS,CAAC,6BAA6B,CAAC,kCAAkC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,GAAG,CACrC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE;YAC1C,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { RegistrationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { encodeOrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type { LocalUserIdentityCandidate } from \"../../data/trustedUserIdentity\";\nimport { validateUserIdentityKeys } from \"../../data/trustedUserIdentity\";\nimport { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { groupPolicyMutationHead } from \"../organizations/groupPolicy/groupPolicyMutationHead\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"../organizations/principalPolicy\";\nimport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nimport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"./provisionedPrincipalHistory\";\nimport {\n  buildInitialOrganizationMetadataBootstrap,\n  buildInitialRootProvisioning,\n  buildInitialRosterProfileBootstrap,\n  buildInitialSystemContainerBootstrap,\n  type ProvisionedSystemContainerSpec,\n} from \"./provisioningBootstrapBuilders\";\nimport { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nexport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\nexport { persistOrganizationProvisioningState };\n\nexport interface RegistrationApi {\n  registerUser(\n    userId: string,\n    organizationId: string,\n    rootContainerId: string,\n    signingPublicKey: Uint8Array,\n    encapsulationPublicKey: Uint8Array,\n    initialAdminGroup: RegistrationRequest[\"initialAdminGroup\"],\n    initialMemberGroup: RegistrationRequest[\"initialMemberGroup\"],\n    initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"],\n    initialRootContainer: RegistrationRequest[\"initialRootContainer\"],\n    initialRootMetadataDocument: ProvisionedDocumentRequest,\n    initialRosterProfileContainer: RegistrationRequest[\"initialRosterProfileContainer\"],\n    initialRosterProfileDocument: ProvisionedDocumentRequest | undefined,\n    initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest,\n    initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined,\n    initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined,\n  ): Promise<RegistrationResponse | null>;\n}\n\ninterface OrganizationProvisioningPrincipalPolicies {\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  organizationId: string;\n  signingFingerprint: string;\n}\n\nexport interface RegisterIdentityInput {\n  apiClient: RegistrationApi;\n  containerId: string;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  /**\n   * Reports whether the identity that started this registration is still\n   * current. Forwarded to the bootstrap persist's in-mutex currency check,\n   * so an identity replaced while the persist waits for the mutation queue\n   * cannot write its bootstrap through a client the replacement owns.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /**\n   * Overrides the seeded personal-org profile name; defaults to \"Personal Org\".\n   */\n  organizationProfileName?: string | undefined;\n  pinLocalUserIdentity: (\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ) => Promise<void>;\n  /** Seeds verified recovery progress for the founding policy heads. */\n  primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n  /**\n   * App-owned system containers to provision atomically with the personal\n   * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname; defaults to \"You\". The\n   * demo host passes each pane's peer-labeled self name (\"Peer 1 (You)\").\n   */\n  rosterProfileNickname?: string | undefined;\n  signingKeyFingerprint?: string | null | undefined;\n  signingKeyPair: SigningKeyPair;\n}\n\n/**\n * The freshly built provisioning artifacts, shared by registration and\n * additional-organization creation. `registerIdentity` generates a new\n * `userId`; creating an additional organization reuses the caller's existing\n * one. Everything here is derived purely from the caller's key material, so it\n * is identical for both flows.\n */\nexport interface OrganizationProvisioningArtifactsInput {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the organization\n   * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and\n   * organization-metadata system containers.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  rootContainerId: string;\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}\n\nexport async function buildInitialOrganizationPolicyRequest(input: {\n  adminGroupId: string;\n  groupHeads: readonly ReferencedPrincipalHead[];\n  encapsulationPublicKey: Uint8Array;\n  memberGroupId: string;\n  organizationId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<RegistrationRequest[\"initialOrganizationPolicy\"]> {\n  const organizationKem = generateKemSeedAndKeyPair();\n  const signerUserKeyFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const userEncapsulationKeyFingerprint = await toFingerprint(\n    input.encapsulationPublicKey,\n  );\n  const projection = [\n    {\n      userId: input.userId,\n      role: \"admin\" as const,\n    },\n  ];\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    version: 2,\n    organizationId: input.organizationId,\n    adminGroupId: input.adminGroupId,\n    memberGroupId: input.memberGroupId,\n    groupHeads: input.groupHeads.map((head) => {\n      if (head.principalType !== \"group\") {\n        throw new Error(\"Organization directory can contain only group heads\");\n      }\n      return { ...head, principalType: \"group\" };\n    }),\n  });\n  const [memberEnvelope] = await wrapDekForRecipients(\n    organizationKem.secretKey,\n    [input.encapsulationPublicKey],\n  );\n\n  if (!memberEnvelope) {\n    throw new Error(\"Failed to wrap organization key for registering user\");\n  }\n  const memberEnvelopes = [\n    {\n      userId: input.userId,\n      memberKeyFingerprint: userEncapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),\n    },\n  ];\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.organizationId,\n      version: 1,\n      prevStateHash: null,\n      keyEpoch: 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: [{ userId: input.userId }],\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.userId,\n      signerUserKeyFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants: [],\n    memberEnvelopes,\n  };\n}\n\nasync function createOrganizationPrincipalPolicies(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationMetadataContainerId: string;\n  rootContainerId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<OrganizationProvisioningPrincipalPolicies> {\n  const organizationId = crypto.randomUUID();\n  const signingFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const initialAdminGroup = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      { containerId: input.rootContainerId, accessLevel: \"admin\" },\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"admin\",\n      },\n    ],\n    name: \"Admins\",\n    builtinRole: \"admins\",\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"read\",\n      },\n    ],\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest(\n    {\n      adminGroupId: initialAdminGroup.groupId,\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      groupHeads: await Promise.all([\n        groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),\n        groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),\n      ]),\n      memberGroupId: initialMemberGroup.groupId,\n      organizationId,\n      signingKeyPair: input.signingKeyPair,\n      userId: input.userId,\n    },\n  );\n\n  return {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  };\n}\n\nfunction requireOrganizationProvisioningAuthor(input: {\n  readonly organizationId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}) {\n  const author = resolveDocumentCreateAuthor({\n    auth: { organizationId: input.organizationId, userId: input.userId },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\n      `Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`,\n    );\n  }\n  return author;\n}\n\n/** Builds the signed artifacts shared by registration and org creation. */\nexport async function buildOrganizationProvisioningArtifacts(\n  input: OrganizationProvisioningArtifactsInput,\n): Promise<OrganizationProvisioningArtifacts> {\n  const bootstrap = await createInitialRootMetadataBootstrap(\n    input.rootContainerId,\n  );\n  const organizationMetadataContainerId = crypto.randomUUID();\n  const {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  } = await createOrganizationPrincipalPolicies({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationMetadataContainerId,\n    rootContainerId: input.rootContainerId,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n  const author = requireOrganizationProvisioningAuthor({\n    organizationId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n\n  const {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n  } = await buildInitialRootProvisioning({\n    adminGroup: initialAdminGroup,\n    author,\n    bootstrap,\n    recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    rootContainerId: input.rootContainerId,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({\n    author,\n    encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    initialAdminGroup,\n    rosterProfileNickname: input.rosterProfileNickname,\n    rootContainer,\n    rootContainerProjection,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const organizationMetadataBootstrap =\n    await buildInitialOrganizationMetadataBootstrap({\n      author,\n      containerId: organizationMetadataContainerId,\n      initialAdminGroup,\n      initialMemberGroup,\n      organizationProfileName: input.organizationProfileName,\n      rootContainer,\n      rootContainerProjection,\n      targetSecretKey: input.encapsulationKeyPair.secretKey,\n    });\n  const systemContainerBootstraps = await Promise.all(\n    (input.provisionedSystemContainers ?? []).map((spec) =>\n      buildInitialSystemContainerBootstrap({\n        author,\n        initialAdminGroup,\n        rootContainer,\n        rootContainerProjection,\n        signingPrivateKey: input.signingKeyPair.signingPrivateKey,\n        spec,\n        targetSecretKey: input.encapsulationKeyPair.secretKey,\n      }),\n    ),\n  );\n\n  return {\n    replacementAuthorization: null,\n    bootstrap,\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    initialRootContainer: rootContainer.plan.request,\n    organizationId,\n    organizationMetadataBootstrap,\n    rootContainer,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n    rosterProfileBootstrap,\n    systemContainerBootstraps,\n  };\n}\n\nexport async function registerIdentity(\n  input: RegisterIdentityInput,\n): Promise<RegistrationResponse | null> {\n  input.log?.(\"Registering identity...\");\n  await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingKeyFingerprint: input.signingKeyFingerprint,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    },\n  });\n\n  const newUserId = crypto.randomUUID();\n  const artifacts = await buildOrganizationProvisioningArtifacts({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId: input.containerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: newUserId,\n  });\n\n  const response = await input.apiClient.registerUser(\n    newUserId,\n    artifacts.organizationId,\n    input.containerId,\n    input.signingKeyPair.signingPublicKey,\n    input.encapsulationKeyPair.publicKey,\n    artifacts.initialAdminGroup,\n    artifacts.initialMemberGroup,\n    artifacts.initialOrganizationPolicy,\n    artifacts.initialRootContainer,\n    artifacts.rootMetadataDocumentRequest,\n    artifacts.rosterProfileBootstrap.containerRequest,\n    artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    artifacts.organizationMetadataBootstrap.containerRequest,\n    artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest,\n    artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n  );\n  if (!response) {\n    return null;\n  }\n  if (response.userId !== newUserId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Registration response user does not match the requested identity\",\n    );\n  }\n  // Pinned only once the server has confirmed this user, and before anything\n  // is persisted under it. The trust store binds each signing key to one user,\n  // so a pin for an id the server never accepted — a retry after a lost\n  // response, or a restored key that is already registered — would later\n  // refuse the key's real user at login. Like the persistence below, it is a\n  // durable write, so it is skipped once the registering identity has been\n  // replaced: the caller discards this result.\n  if (input.isIdentityCurrent?.() ?? true) {\n    await input.pinLocalUserIdentity(newUserId, {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  }\n\n  input.log?.(`Key registered (${response.userId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: input.containerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    primePrincipalHistory: input.primePrincipalHistory,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}

package/workflows/sync/remoteReset.js

@@ -11,7 +11,7 @@ import { clientSqlTables, containerHydrationTombstones, containers, documentAtta
 import { getClientSQLitePersistenceRuntime, } from "../../data/sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../data/sqlite/sqlTableSchema.js";
 import { verifiedAccessManifestBundles } from "../../data/sqlite/verifiedManifestBundleSchema.js";
-import { runOrganizationPresentationReset } from "../organizations/organizationPresentationAccessState.js";
+import { runOrganizationPresentationReset } from "../organizations/readModel/organizationPresentationAccessState.js";
 import { clearResetPendingAttachments } from "./remoteResetAttachments.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
 import { clearRemoteResetSyncCursors } from "./remoteResetCursorScope.js";

package/workflows/sync/remoteReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EACL,eAAe,EACf,kCAAkC,GACnC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,UAAU,EACV,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,mCAAmC;QACnC,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,sBAAsB,EAAE,EACxB,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAChD,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,gBAAgB,GAAG,GAAG,CAC1B,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EACvD,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAC5C,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,gBAAgB,CAAC,CAC3B,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,kCAAkC,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;QAC5B,6BAA6B;KACrB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,GAAG,6BAA6B;YAChC,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,eAAe,CAAC;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;SAC9B,CAAC,CACH,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,kBAAkB,CAAC,eAAe;YACxC,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport {\n  queuedUpdateRow,\n  unqueueDocumentScopesInTransaction,\n} from \"../../data/sqlite/documentPendingUpdatePersistence\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/documentPlacementIntentSchema\";\nimport { CLEARED_DOCUMENT_SYNC_FAILURE } from \"../../data/sqlite/documentSyncFailurePersistence\";\nimport { organizationDataUsageSnapshots } from \"../../data/sqlite/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/organizationReadModelSchema\";\nimport {\n  clientSqlTables,\n  containerHydrationTombstones,\n  containers,\n  documentAttachmentBlobProjection,\n  documentHistoryUpdates,\n  documentPendingAttachments,\n  documentProjection,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n  inContainerIntentLanes,\n  inLocalIntentLane,\n  LOCAL_INTENT_LANES,\n  localIntents,\n} from \"../../data/sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { verifiedAccessManifestBundles } from \"../../data/sqlite/verifiedManifestBundleSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(localIntents)\n      .where(\n        and(\n          inContainerIntentLanes(),\n          inArray(localIntents.subjectId, containerBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    const placementIntents = and(\n      inLocalIntentLane(LOCAL_INTENT_LANES.documentPlacement),\n      inArray(localIntents.localId, localIdBatch),\n    );\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: localIntents.id })\n            .from(localIntents)\n            .where(placementIntents),\n        ),\n      )\n      .run();\n    await tx.delete(localIntents).where(placementIntents).run();\n  }\n  // Sync failures clear with the document columns in resetRemoteColumns.\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await unqueueDocumentScopesInTransaction(tx, documentBatch);\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n    verifiedAccessManifestBundles,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        ...CLEARED_DOCUMENT_SYNC_FAILURE,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentHistoryUpdates)\n      .values(\n        updateBatch.map((update) =>\n          queuedUpdateRow({\n            createdAt: input.now,\n            origin: \"outbox\",\n            pendingUpdate: update,\n            scope: update,\n            updateId: crypto.randomUUID(),\n          }),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(localIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          lane: LOCAL_INTENT_LANES.containerCreate,\n          subjectId: row.id,\n          targetContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}
+{"version":3,"file":"remoteReset.js","sourceRoot":"","sources":["remoteReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,8CAA8C,EAAE,MAAM,uEAAuE,CAAC;AACvI,OAAO,EACL,yCAAyC,EACzC,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,2CAA2C,EAAE,MAAM,yDAAyD,CAAC;AACtH,OAAO,EACL,eAAe,EACf,kCAAkC,GACnC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,UAAU,EACV,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,SAAS,EACT,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAGL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAO5B,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAexD,KAAK,UAAU,iCAAiC,CAC9C,EAAgC,EAChC,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,oCAAoC;QACpC,iCAAiC;QACjC,mCAAmC;QACnC,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,+BAA+B;KACvB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AASD,KAAK,UAAU,wBAAwB,CACrC,KAA4B;IAE5B,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAC5B,EAAE,CAAC;QACF,MAAM,yCAAyC,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,sBAAsB,EAAE,EACxB,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAChD,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,4BAA4B,CAAC;aACpC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,wCAAwC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,4BAA4B,CAAC;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,EAAE;KACH,CAAC,CAAC;IACH,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,gBAAgB,GAAG,GAAG,CAC1B,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EACvD,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAC5C,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,KAAK,CACJ,OAAO,CACL,yBAAyB,CAAC,QAAQ,EAClC,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,gBAAgB,CAAC,CAC3B,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtE,MAAM,kCAAkC,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA4B;IAE5B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,iCAAiC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,4BAA4B;QAC5B,6BAA6B;KACrB,EAAE,CAAC;QACX,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,2CAA2C,CAAC,EAAE,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;KAC3C,CAAC,CAAC;IACH,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,2BAA2B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,EAAE;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAC5D,GAAG,6BAA6B;YAChC,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAClC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CACnC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,UAAU,EAAE,IAAI;YAChB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;SAC5D,CAAC;aACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;aACxD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,4CAA4C;IAC5C,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,WAAW;QAC1C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,8CAA8C,CAAC,EAAE,EAAE;YACvD,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE;aACL,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,kBAAkB,EAAE,IAAI;YACxB,cAAc,EACZ,KAAK,CAAC,WAAW,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc;YAC3D,QAAQ,EACN,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBACxC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;gBACnC,CAAC,CAAC,GAAG,CAAC,QAAQ;YAClB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,cAAc,EAAE,GAAG;SACpB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CACL,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,eAAe,CAAC;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;SAC9B,CAAC,CACH,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,IAAI,IAAI,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CACL,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,kBAAkB,CAAC,eAAe;YACxC,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,iBAAiB,EAAE,GAAG,CAAC,QAAQ;YAC/B,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,SAAkB;YAC9B,iBAAiB,EAAE,IAAI;YACvB,6BAA6B,EAAE,IAAI;YACnC,wBAAwB,EAAE,IAAI;YAC9B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAI1C;IACC,KAAK,MAAM,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CACL,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnC,GAAG,UAAU;YACb,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC,CACJ;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,gCAAgC,CAAC;aACxC,KAAK,CACJ,EAAE,CACA,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpC,GAAG,CACD,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAChE,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAC/D,CACF,CACF,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAKhD;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,qBAAqB,CAAC;QAC1B,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;QAC1C,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,yBAAyB,CAAC;QAC9B,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAG,MAAM,0BAA0B,CAAC;QAClE,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;QAChD,GAAG;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;IACH,OAAO;QACL,iCAAiC,EAC/B,QAAQ,CAAC,iCAAiC;QAC5C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;QACzE,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,2BAA2B,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;QACjE,0BAA0B;QAC1B,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM;QAC7D,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAClD,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAuB,EACvB,SAAuC;IAEvC,OAAO,gCAAgC,CACrC,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;YACpE,IAAI,SAAS,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,EACF,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/D,OAAO,iCAAiC,CAAC;gBACvC,KAAK;gBACL,KAAK;gBACL,QAAQ;gBACR,EAAE;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC9C,kBAAkB,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { and, eq, inArray, or } from \"drizzle-orm\";\nimport { recordSupersededContainerBindingsInTransaction } from \"../../data/persistence/container-contents/supersededContainerBindings\";\nimport {\n  deleteDocumentPlacementRowsByContainerIds,\n  deleteDocumentPlacementRowsByDocumentIds,\n} from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { clearDocumentDiscoveryEvidenceOnRemoteReset } from \"../../data/persistence/documents/documentDiscoveryReset\";\nimport {\n  queuedUpdateRow,\n  unqueueDocumentScopesInTransaction,\n} from \"../../data/sqlite/documentPendingUpdatePersistence\";\nimport { documentIntentLinkTargets } from \"../../data/sqlite/documentPlacementIntentSchema\";\nimport { CLEARED_DOCUMENT_SYNC_FAILURE } from \"../../data/sqlite/documentSyncFailurePersistence\";\nimport { organizationDataUsageSnapshots } from \"../../data/sqlite/organizationDataUsageSchema\";\nimport {\n  organizationPresentationDenials,\n  organizationReadModelContainerGrants,\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../data/sqlite/organizationReadModelSchema\";\nimport {\n  clientSqlTables,\n  containerHydrationTombstones,\n  containers,\n  documentAttachmentBlobProjection,\n  documentHistoryUpdates,\n  documentPendingAttachments,\n  documentProjection,\n  documents,\n  dormantContainerMetadata,\n  dormantMetadataSweepRequests,\n  inContainerIntentLanes,\n  inLocalIntentLane,\n  LOCAL_INTENT_LANES,\n  localIntents,\n} from \"../../data/sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { ensureSqlTables } from \"../../data/sqlite/sqlTableSchema\";\nimport { verifiedAccessManifestBundles } from \"../../data/sqlite/verifiedManifestBundleSchema\";\nimport { runOrganizationPresentationReset } from \"../organizations/readModel/organizationPresentationAccessState\";\nimport { clearResetPendingAttachments } from \"./remoteResetAttachments\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\nimport { clearRemoteResetSyncCursors } from \"./remoteResetCursorScope\";\nimport {\n  buildResetPlans,\n  type ResetAttachmentUpload,\n  type ResetDocumentUpdate,\n} from \"./remoteResetPlans\";\nimport { clearRemoteResetPrincipalRows } from \"./remoteResetPrincipalScope\";\nimport {\n  type RemoteResetInput,\n  type RemoteSyncStateSnapshot,\n  readRemoteSyncStateSnapshot,\n} from \"./remoteResetScope\";\n\nexport type {\n  RemoteResetInput,\n  RemoteResetReplacement,\n} from \"./remoteResetScope\";\n\nconst CONTAINER_CREATE_INTENT_TYPE = \"container.create\";\n\nexport interface ClearRemoteSyncStateResult {\n  readonly clearedContainerCreateIntentCount: number;\n  readonly clearedContainerMoveIntentCount: number;\n  readonly clearedDocumentMoveIntentCount: number;\n  readonly clearedPrincipalPolicyCount: number;\n  readonly clearedSyncCursorCount: number;\n  readonly queuedAttachmentUploadCount: number;\n  readonly queuedContainerCreateCount: number;\n  readonly queuedDocumentUpdateCount: number;\n  readonly resetContainerCount: number;\n  readonly resetDocumentCount: number;\n}\n\nasync function clearOrganizationPresentationRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<void> {\n  for (const table of [\n    organizationDataUsageSnapshots,\n    organizationReadModelContainerGrants,\n    organizationReadModelGroupMembers,\n    organizationReadModelDirectoryUsers,\n    organizationReadModelGroups,\n    organizationReadModelRequesters,\n    organizationReadModelState,\n    organizationPresentationDenials,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n}\n\ninterface ScopedRemoteRowsInput {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  organizationId: string;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearScopedContainerRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  for (const containerBatch of remoteResetBatches(\n    input.snapshot.containerIds,\n  )) {\n    await deleteDocumentPlacementRowsByContainerIds(input.tx, containerBatch);\n    await input.tx\n      .delete(localIntents)\n      .where(\n        and(\n          inContainerIntentLanes(),\n          inArray(localIntents.subjectId, containerBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .delete(containerHydrationTombstones)\n      .where(inArray(containerHydrationTombstones.containerId, containerBatch))\n      .run();\n  }\n}\n\nasync function clearScopedDocumentRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { snapshot, tx } = input;\n  for (const documentIdBatch of remoteResetBatches(snapshot.oldDocumentIds)) {\n    await deleteDocumentPlacementRowsByDocumentIds(tx, documentIdBatch);\n  }\n  await clearResetPendingAttachments({\n    attachmentUploads: input.attachmentUploads,\n    documentLocalIds: snapshot.documentLocalIds,\n    tx,\n  });\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    const placementIntents = and(\n      inLocalIntentLane(LOCAL_INTENT_LANES.documentPlacement),\n      inArray(localIntents.localId, localIdBatch),\n    );\n    await tx\n      .delete(documentIntentLinkTargets)\n      .where(\n        inArray(\n          documentIntentLinkTargets.intentId,\n          tx\n            .select({ id: localIntents.id })\n            .from(localIntents)\n            .where(placementIntents),\n        ),\n      )\n      .run();\n    await tx.delete(localIntents).where(placementIntents).run();\n  }\n  // Sync failures clear with the document columns in resetRemoteColumns.\n  for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {\n    await unqueueDocumentScopesInTransaction(tx, documentBatch);\n  }\n}\n\nasync function clearScopedRemoteRows(\n  input: ScopedRemoteRowsInput,\n): Promise<void> {\n  const { organizationId, tx } = input;\n  await clearOrganizationPresentationRows(tx, organizationId);\n  for (const table of [\n    dormantContainerMetadata,\n    dormantMetadataSweepRequests,\n    verifiedAccessManifestBundles,\n  ] as const) {\n    await tx\n      .delete(table)\n      .where(eq(table.organizationId, organizationId))\n      .run();\n  }\n  await clearDocumentDiscoveryEvidenceOnRemoteReset(tx, {\n    containerIds: input.snapshot.containerIds,\n    documentIds: input.snapshot.oldDocumentIds,\n  });\n  await clearRemoteResetPrincipalRows(input);\n  await clearScopedContainerRows(input);\n  await clearScopedDocumentRows(input);\n  await clearRemoteResetSyncCursors({\n    containerIds: input.snapshot.containerIds,\n    tx,\n  });\n}\n\nasync function resetRemoteColumns(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const { now, reset, snapshot, tx } = input;\n  for (const row of snapshot.documentRows) {\n    await tx\n      .update(documents)\n      .set({\n        accessEpoch: 1,\n        accessStateHash: null,\n        contentKeyBundle: null,\n        documentId: null,\n        documentKekTargets: null,\n        documentManifestBundle: null,\n        lastCommitLsn: null,\n        pullContinuation: null,\n        recoveryDocumentId: row.documentId ?? row.recoveryDocumentId,\n        ...CLEARED_DOCUMENT_SYNC_FAILURE,\n        updatedAt: now,\n      })\n      .where(\n        and(\n          eq(documents.appKind, row.appKind),\n          eq(documents.localId, row.localId),\n        ),\n      )\n      .run();\n  }\n  for (const localIdBatch of remoteResetBatches(snapshot.documentLocalIds)) {\n    await tx\n      .update(documentProjection)\n      .set({\n        documentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n      })\n      .where(inArray(documentProjection.localId, localIdBatch))\n      .run();\n  }\n  // Replacement re-homes folders under their ids; the purged organization\n  // can never bind them again on this device.\n  for (const containerIds of reset.replacement\n    ? remoteResetBatches(snapshot.containerIds)\n    : []) {\n    await recordSupersededContainerBindingsInTransaction(tx, {\n      containerIds,\n      organizationId: reset.organizationId,\n      supersededAt: now,\n    });\n  }\n  for (const row of snapshot.containerRows) {\n    await tx\n      .update(containers)\n      .set({\n        metadataDocumentId: null,\n        organizationId:\n          reset.replacement?.organizationId ?? reset.organizationId,\n        parentId:\n          reset.replacement && row.parentId === null\n            ? reset.replacement.rootContainerId\n            : row.parentId,\n        serverCreatedAt: null,\n        serverUpdatedAt: null,\n        ...(reset.replacement ? { systemSlot: null } : {}),\n        localUpdatedAt: now,\n      })\n      .where(eq(containers.id, row.id))\n      .run();\n  }\n}\n\nasync function queueResetDocumentUpdates(input: {\n  documentUpdates: readonly ResetDocumentUpdate[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const updateBatch of remoteResetBatches(input.documentUpdates)) {\n    await input.tx\n      .insert(documentHistoryUpdates)\n      .values(\n        updateBatch.map((update) =>\n          queuedUpdateRow({\n            createdAt: input.now,\n            origin: \"outbox\",\n            pendingUpdate: update,\n            scope: update,\n            updateId: crypto.randomUUID(),\n          }),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function queueResetContainerCreates(input: {\n  now: string;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<number> {\n  const rows = input.snapshot.containerRows.flatMap((row) => {\n    const parentId =\n      row.parentId ?? input.reset.replacement?.rootContainerId ?? null;\n    return parentId ? [{ id: row.id, parentId }] : [];\n  });\n  if (rows.length === 0) return 0;\n  for (const rowBatch of remoteResetBatches(rows)) {\n    await input.tx\n      .insert(localIntents)\n      .values(\n        rowBatch.map((row) => ({\n          id: crypto.randomUUID(),\n          lane: LOCAL_INTENT_LANES.containerCreate,\n          subjectId: row.id,\n          targetContainerId: row.parentId,\n          intentType: CONTAINER_CREATE_INTENT_TYPE,\n          syncStatus: \"pending\" as const,\n          remoteContainerId: null,\n          remoteMetadataAccessStateHash: null,\n          remoteMetadataDocumentId: null,\n          lastError: null,\n          createdAt: input.now,\n          updatedAt: input.now,\n        })),\n      )\n      .run();\n  }\n  return rows.length;\n}\n\nasync function queueResetAttachmentUploads(input: {\n  attachmentUploads: readonly ResetAttachmentUpload[];\n  now: string;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const attachmentBatch of remoteResetBatches(input.attachmentUploads)) {\n    await input.tx\n      .insert(documentPendingAttachments)\n      .values(\n        attachmentBatch.map((attachment) => ({\n          ...attachment,\n          createdAt: input.now,\n        })),\n      )\n      .run();\n    await input.tx\n      .delete(documentAttachmentBlobProjection)\n      .where(\n        or(\n          ...attachmentBatch.map((attachment) =>\n            and(\n              eq(documentAttachmentBlobProjection.localId, attachment.localId),\n              eq(documentAttachmentBlobProjection.slotId, attachment.slotId),\n            ),\n          ),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function clearRemoteSyncStateInTransaction(input: {\n  plans: Awaited<ReturnType<typeof buildResetPlans>>;\n  reset: RemoteResetInput;\n  snapshot: RemoteSyncStateSnapshot;\n  tx: ClientSQLiteTransactionScope;\n}): Promise<ClearRemoteSyncStateResult> {\n  const now = new Date().toISOString();\n  const { snapshot } = input;\n  await clearScopedRemoteRows({\n    attachmentUploads: input.plans.attachmentUploads,\n    organizationId: input.reset.organizationId,\n    snapshot,\n    tx: input.tx,\n  });\n  await resetRemoteColumns({ now, reset: input.reset, snapshot, tx: input.tx });\n  await queueResetDocumentUpdates({\n    documentUpdates: input.plans.documentUpdates,\n    now,\n    tx: input.tx,\n  });\n  const queuedContainerCreateCount = await queueResetContainerCreates({\n    now,\n    reset: input.reset,\n    snapshot,\n    tx: input.tx,\n  });\n  await queueResetAttachmentUploads({\n    attachmentUploads: input.plans.attachmentUploads,\n    now,\n    tx: input.tx,\n  });\n  return {\n    clearedContainerCreateIntentCount:\n      snapshot.clearedContainerCreateIntentCount,\n    clearedContainerMoveIntentCount: snapshot.clearedContainerMoveIntentCount,\n    clearedDocumentMoveIntentCount: snapshot.clearedDocumentMoveIntentCount,\n    clearedPrincipalPolicyCount: snapshot.clearedPrincipalPolicyCount,\n    clearedSyncCursorCount: snapshot.clearedSyncCursorCount,\n    queuedAttachmentUploadCount: input.plans.attachmentUploads.length,\n    queuedContainerCreateCount,\n    queuedDocumentUpdateCount: input.plans.documentUpdates.length,\n    resetContainerCount: snapshot.containerRows.length,\n    resetDocumentCount: snapshot.documentRows.length,\n  };\n}\n\nexport async function clearRemoteSyncState(\n  execSql: ExecSql,\n  reset: RemoteResetInput,\n  canCommit?: (() => boolean) | undefined,\n): Promise<ClearRemoteSyncStateResult> {\n  return runOrganizationPresentationReset(\n    execSql,\n    reset.organizationId,\n    async () => {\n      await ensureSqlTables(execSql, clientSqlTables);\n      const runtime = getClientSQLitePersistenceRuntime(execSql);\n      const resetInTransaction = async (tx: ClientSQLiteTransactionScope) => {\n        if (canCommit && !canCommit()) {\n          throw new Error(\n            \"Remote sync reset aborted: session identity changed\",\n          );\n        }\n        const snapshot = await readRemoteSyncStateSnapshot(\n          tx,\n          reset.organizationId,\n        );\n        const plans = await buildResetPlans(tx, snapshot.documentRows);\n        return clearRemoteSyncStateInTransaction({\n          plans,\n          reset,\n          snapshot,\n          tx,\n        });\n      };\n      if (!canCommit) {\n        return runtime.transaction(resetInTransaction);\n      }\n      const outcome = await runtime.guardedTransaction(\n        resetInTransaction,\n        canCommit,\n      );\n      if (!outcome.committed || !outcome.result) {\n        throw new Error(\"Remote sync reset aborted: session identity changed\");\n      }\n      return outcome.result;\n    },\n  );\n}\n"]}

package/workflows/blobs/attachmentBindingVerification.js

@@ -1,49 +0,0 @@
-import { KeyingVerificationError, verifyAttachmentBindingEvent, } from "../../internal/crypto/index.js";
-import { readCanonicalJson, readCanonicalRecord, } from "../../data/keying/canonicalJson.js";
-import { readAccessEvent, readRecordString, readRequiredRecordValue, resolveEventContainerPaths, } from "../../data/keyingProjectionVerification/index.js";
-export async function assertAttachmentBindingVerified(input) {
-    if (!input.authorization) {
-        throw new Error("Attachment binding lacks verified document authority");
-    }
-    if (!input.binding.bindingEvent ||
-        !input.binding.documentManifestHash ||
-        input.binding.previousBindingId === undefined) {
-        throw new Error("Attachment binding lacks signed verification material");
-    }
-    const eventBundle = readCanonicalRecord(input.binding.bindingEvent, "Attachment binding event bundle");
-    const event = readAccessEvent(readRequiredRecordValue(eventBundle, "event", "Attachment binding event bundle"), "Attachment binding event");
-    const signer = await input.resolveProjectionUserKey(event.signerUserId);
-    if (!signer) {
-        throw new Error("Attachment binding signer identity is unavailable");
-    }
-    const documentManifest = input.authorization.documentManifestByHash.get(input.binding.documentManifestHash);
-    if (!documentManifest) {
-        throw new Error("Attachment binding document manifest is unverified");
-    }
-    const { dependencyContainerPaths } = resolveEventContainerPaths({
-        containerPathByManifestHash: input.authorization.containerPathByManifestHash,
-        dependencyManifestHashes: event.dependencyManifestHashes.filter((hash) => hash !== input.binding.documentManifestHash),
-    });
-    const verified = await verifyAttachmentBindingEvent({
-        authorizationMembership: "referenced",
-        authorizingContainerPaths: dependencyContainerPaths,
-        body: readCanonicalJson(readRequiredRecordValue(eventBundle, "body", "Attachment binding event bundle"), "Attachment binding event body"),
-        documentManifest,
-        event,
-        expectedBindingId: input.binding.bindingId,
-        expectedBlobId: input.binding.blobId,
-        expectedDocumentId: input.expectedDocumentId,
-        expectedDocumentManifestHash: input.binding.documentManifestHash,
-        expectedPreviousBindingId: input.binding.previousBindingId,
-        principalPolicies: input.authorization.principalPolicies,
-        signerPublicKey: signer.signingPublicKey,
-    });
-    if (!verified.ok) {
-        throw verified.error;
-    }
-    if (verified.value.slotId !== input.expectedSlotId ||
-        readRecordString(eventBundle, "eventHash", "Attachment binding event bundle") !== verified.value.event.eventHash) {
-        throw new KeyingVerificationError("object_mismatch", "Attachment binding slot or event hash is inconsistent");
-    }
-}
-//# sourceMappingURL=attachmentBindingVerification.js.map

package/workflows/blobs/attachmentBindingVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"attachmentBindingVerification.js","sourceRoot":"","sources":["attachmentBindingVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAGL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,yCAAyC,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAarD;IACC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB;QACnC,KAAK,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,KAAK,CAAC,OAAO,CAAC,YAAY,EAC1B,iCAAiC,CAClC,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAC3B,uBAAuB,CACrB,WAAW,EACX,OAAO,EACP,iCAAiC,CAClC,EACD,0BAA0B,CAC3B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACrE,KAAK,CAAC,OAAO,CAAC,oBAAoB,CACnC,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,wBAAwB,EAAE,GAAG,0BAA0B,CAAC;QAC9D,2BAA2B,EACzB,KAAK,CAAC,aAAa,CAAC,2BAA2B;QACjD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,oBAAoB,CACtD;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;QAClD,uBAAuB,EAAE,YAAY;QACrC,yBAAyB,EAAE,wBAAwB;QACnD,IAAI,EAAE,iBAAiB,CACrB,uBAAuB,CACrB,WAAW,EACX,MAAM,EACN,iCAAiC,CAClC,EACD,+BAA+B,CAChC;QACD,gBAAgB;QAChB,KAAK;QACL,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAC1C,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB;QAChE,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAC1D,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;QACxD,eAAe,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;QAC9C,gBAAgB,CACd,WAAW,EACX,WAAW,EACX,iCAAiC,CAClC,KAAK,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EACpC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  verifyAttachmentBindingEvent,\n} from \"@tearleads/crypto\";\nimport type { DecryptDocumentAttachmentBlobInput } from \"../../data/documents/blob/shared/types\";\nimport {\n  readCanonicalJson,\n  readCanonicalRecord,\n} from \"../../data/keying/canonicalJson\";\nimport {\n  type DocumentWriterProjectionAuthorization,\n  type ProjectionUserKeyResolver,\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n  resolveEventContainerPaths,\n} from \"../../data/keyingProjectionVerification\";\n\nexport async function assertAttachmentBindingVerified(input: {\n  readonly authorization: DocumentWriterProjectionAuthorization | undefined;\n  readonly binding: Pick<\n    DecryptDocumentAttachmentBlobInput[\"binding\"],\n    | \"bindingEvent\"\n    | \"documentManifestHash\"\n    | \"previousBindingId\"\n    | \"bindingId\"\n    | \"blobId\"\n  >;\n  readonly expectedDocumentId: string;\n  readonly expectedSlotId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n}): Promise<void> {\n  if (!input.authorization) {\n    throw new Error(\"Attachment binding lacks verified document authority\");\n  }\n  if (\n    !input.binding.bindingEvent ||\n    !input.binding.documentManifestHash ||\n    input.binding.previousBindingId === undefined\n  ) {\n    throw new Error(\"Attachment binding lacks signed verification material\");\n  }\n  const eventBundle = readCanonicalRecord(\n    input.binding.bindingEvent,\n    \"Attachment binding event bundle\",\n  );\n  const event = readAccessEvent(\n    readRequiredRecordValue(\n      eventBundle,\n      \"event\",\n      \"Attachment binding event bundle\",\n    ),\n    \"Attachment binding event\",\n  );\n  const signer = await input.resolveProjectionUserKey(event.signerUserId);\n  if (!signer) {\n    throw new Error(\"Attachment binding signer identity is unavailable\");\n  }\n  const documentManifest = input.authorization.documentManifestByHash.get(\n    input.binding.documentManifestHash,\n  );\n  if (!documentManifest) {\n    throw new Error(\"Attachment binding document manifest is unverified\");\n  }\n  const { dependencyContainerPaths } = resolveEventContainerPaths({\n    containerPathByManifestHash:\n      input.authorization.containerPathByManifestHash,\n    dependencyManifestHashes: event.dependencyManifestHashes.filter(\n      (hash) => hash !== input.binding.documentManifestHash,\n    ),\n  });\n  const verified = await verifyAttachmentBindingEvent({\n    authorizationMembership: \"referenced\",\n    authorizingContainerPaths: dependencyContainerPaths,\n    body: readCanonicalJson(\n      readRequiredRecordValue(\n        eventBundle,\n        \"body\",\n        \"Attachment binding event bundle\",\n      ),\n      \"Attachment binding event body\",\n    ),\n    documentManifest,\n    event,\n    expectedBindingId: input.binding.bindingId,\n    expectedBlobId: input.binding.blobId,\n    expectedDocumentId: input.expectedDocumentId,\n    expectedDocumentManifestHash: input.binding.documentManifestHash,\n    expectedPreviousBindingId: input.binding.previousBindingId,\n    principalPolicies: input.authorization.principalPolicies,\n    signerPublicKey: signer.signingPublicKey,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (\n    verified.value.slotId !== input.expectedSlotId ||\n    readRecordString(\n      eventBundle,\n      \"eventHash\",\n      \"Attachment binding event bundle\",\n    ) !== verified.value.event.eventHash\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Attachment binding slot or event hash is inconsistent\",\n    );\n  }\n}\n"]}