@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/documents/syncSubmittedResult.js

@@ -1,119 +0,0 @@
-import { projectionVerificationOptions } from "../../data/documents/shared/types.js";
-import { verifyDocumentWriterProjectionAuthorization, } from "../../data/keyingProjectionVerification/index.js";
-import { isKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
-import { DocumentRawHistoryUnavailableError } from "./syncContentKeys.js";
-import { refreshSyncAttemptWriterProjection } from "./syncFailures.js";
-import { hasDeferredPendingUpdatesAfterSubmit, responseAcceptedRecoveryBaseline, } from "./syncPlanRequestBounds.js";
-import { syncRemoteDocumentResultFromResponse } from "./syncResponseResult.js";
-import { traceHealed } from "./syncTrace.js";
-/** @internal Applies post-verification heal effects under the sync generation. */
-export function applyAcceptedHealSideEffects(input) {
-    if (!input.materializedPlan.healedStaleContentKeyBundle ||
-        !responseAcceptedRecoveryBaseline(input.materializedPlan, input.response) ||
-        input.stillCurrent?.() === false) {
-        return;
-    }
-    input.evictWriterProjection?.(input.documentId);
-    if (input.stillCurrent?.() === false) {
-        return;
-    }
-    traceHealed(input.onSyncTrace, {
-        accepted: input.response.acceptedOutgoingUpdateIds.length,
-        documentId: input.materializedPlan.plan.documentId,
-        epoch: input.materializedPlan.plan.contentKeyEpoch,
-    });
-}
-async function submittedDocumentSyncResult(input) {
-    const result = await syncRemoteDocumentResultFromResponse({
-        ...projectionVerificationOptions(input.sync),
-        execSql: input.sync.execSql,
-        materializedPlan: input.materializedPlan,
-        onTerminalSubmitFailure: input.sync.onTerminalSubmitFailure,
-        recoveryPendingUpdatesById: input.recoveryPendingUpdatesById,
-        rekeyPendingUpdate: input.sync.rekeyPendingUpdate,
-        resolveWriterPublicKey: input.sync.resolveWriterPublicKey,
-        response: input.response,
-        stillCurrent: input.sync.stillCurrent,
-        targetSecretKey: input.sync.targetSecretKey,
-        validateIncomingUpdates: input.sync.validateIncomingUpdates,
-        writerProjection: input.writerProjection,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-    });
-    if ((input.materializedPlan.plan.request.containerRekeys?.length ?? 0) > 0 &&
-        input.sync.stillCurrent?.() !== false) {
-        input.sync.apiClient.clearWriterProjectionCaches?.();
-    }
-    applyAcceptedHealSideEffects({
-        documentId: input.sync.documentId,
-        evictWriterProjection: input.sync.apiClient.evictDocumentWriterProjection?.bind(input.sync.apiClient),
-        materializedPlan: input.materializedPlan,
-        onSyncTrace: input.sync.onSyncTrace,
-        response: input.response,
-        stillCurrent: input.sync.stillCurrent,
-    });
-    return {
-        ...result,
-        hasDeferredPendingUpdates: (input.materializedPlan.plan.request.pullCursor !== undefined &&
-            input.pendingUpdateIds.length > 0 &&
-            result.exhaustedPendingUpdateCount === 0) ||
-            hasDeferredPendingUpdatesAfterSubmit({
-                acceptedRecoveryBaseline: result.acceptedRecoveryBaseline,
-                exhaustedPendingUpdateCount: result.exhaustedPendingUpdateCount,
-                pendingUpdateIds: input.pendingUpdateIds,
-                rekeyedPendingUpdateIds: result.rekeyedPendingUpdateIds,
-                settledPendingUpdateIds: result.settledPendingUpdateIds,
-            }),
-        hasIncompletePull: !input.pullComplete,
-    };
-}
-async function retrySubmittedResponseWithFreshProjection(input, unavailableError, refreshAuthorization) {
-    const writerProjection = await refreshSyncAttemptWriterProjection({
-        apiClient: input.sync.apiClient,
-        documentId: input.sync.documentId,
-        onRemoteDocumentDeleted: input.sync.onRemoteDocumentDeleted,
-        onSyncAbandoned: input.sync.onSyncAbandoned,
-        onSyncTrace: input.sync.onSyncTrace,
-        onTerminalFailure: input.sync.onReadOnlyProjectionFailure,
-        stillCurrent: input.sync.stillCurrent,
-        unavailableError,
-    });
-    if (!writerProjection)
-        return null;
-    const materializedPlan = refreshAuthorization
-        ? {
-            ...input.materializedPlan,
-            plan: {
-                ...input.materializedPlan.plan,
-                documentWriterAuthorization: await verifyDocumentWriterProjectionAuthorization({
-                    execSql: input.sync.execSql,
-                    projection: writerProjection,
-                    resolveUserKey: input.resolveProjectionUserKey,
-                    stillCurrent: input.sync.stillCurrent,
-                    warmReferencedPrincipalPolicies: input.sync.warmReferencedPrincipalPolicies,
-                }),
-            },
-        }
-        : input.materializedPlan;
-    // Keep the submitted request, keys, and response frozen. Only refreshed,
-    // verified evidence may be added; this retry never resubmits outgoing edits.
-    return submittedDocumentSyncResult({
-        ...input,
-        materializedPlan,
-        writerProjection,
-    });
-}
-export async function resolveSubmittedDocumentSyncResult(input) {
-    try {
-        return await submittedDocumentSyncResult(input);
-    }
-    catch (error) {
-        const missingDependency = isKeyingVerificationError(error) && error.code === "missing_dependency";
-        if (!missingDependency &&
-            (input.sync.historyMode !== "raw" ||
-                !(error instanceof DocumentRawHistoryUnavailableError))) {
-            throw error;
-        }
-        return retrySubmittedResponseWithFreshProjection(input, error, missingDependency);
-    }
-}
-//# sourceMappingURL=syncSubmittedResult.js.map

package/workflows/documents/syncSubmittedResult.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncSubmittedResult.js","sourceRoot":"","sources":["syncSubmittedResult.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAEL,2CAA2C,GAC5C,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAG1F,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa1C,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAAC,KAO5C;IACC,IACE,CAAC,KAAK,CAAC,gBAAgB,CAAC,2BAA2B;QACnD,CAAC,gCAAgC,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC;QACzE,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAChC,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,MAAM;QACzD,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU;QAClD,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe;KACnD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAuC;IAEvC,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC;QACxD,GAAG,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;QAC3B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB;QAC3D,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB;QACjD,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB;QACzD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;QAC3C,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB;QAC3D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,CAAC,CAAC;IACH,IACE,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EACrC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,4BAA4B,CAAC;QAC3B,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,qBAAqB,EACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CACtD,KAAK,CAAC,IAAI,CAAC,SAAS,CACrB;QACH,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;KACtC,CAAC,CAAC;IACH,OAAO;QACL,GAAG,MAAM;QACT,yBAAyB,EACvB,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YAC3D,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;YACjC,MAAM,CAAC,2BAA2B,KAAK,CAAC,CAAC;YAC3C,oCAAoC,CAAC;gBACnC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;gBACzD,2BAA2B,EAAE,MAAM,CAAC,2BAA2B;gBAC/D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;gBACvD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;aACxD,CAAC;QACJ,iBAAiB,EAAE,CAAC,KAAK,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAuC,EACvC,gBAAyB,EACzB,oBAA6B;IAE7B,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB;QAC3D,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;QAC3C,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B;QACzD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,gBAAgB,GAAG,oBAAoB;QAC3C,CAAC,CAAC;YACE,GAAG,KAAK,CAAC,gBAAgB;YACzB,IAAI,EAAE;gBACJ,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI;gBAC9B,2BAA2B,EACzB,MAAM,2CAA2C,CAAC;oBAChD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;oBAC3B,UAAU,EAAE,gBAAgB;oBAC5B,cAAc,EAAE,KAAK,CAAC,wBAAwB;oBAC9C,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;oBACrC,+BAA+B,EAC7B,KAAK,CAAC,IAAI,CAAC,+BAA+B;iBAC7C,CAAC;aACL;SACF;QACH,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC3B,yEAAyE;IACzE,6EAA6E;IAC7E,OAAO,2BAA2B,CAAC;QACjC,GAAG,KAAK;QACR,gBAAgB;QAChB,gBAAgB;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAuC;IAEvC,IAAI,CAAC;QACH,OAAO,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,GACrB,yBAAyB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC;QAC1E,IACE,CAAC,iBAAiB;YAClB,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK;gBAC/B,CAAC,CAAC,KAAK,YAAY,kCAAkC,CAAC,CAAC,EACzD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,yCAAyC,CAC9C,KAAK,EACL,KAAK,EACL,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  DocumentSyncResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  MaterializedDocumentSyncPlan,\n  SyncRemoteDocumentResult,\n} from \"../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../data/documents/shared/types\";\nimport {\n  type ProjectionUserKeyResolver,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"../../data/keyingProjectionVerification\";\nimport { isKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport type { PendingUpdateRecord } from \"../../data/sqlite/documentPersistence\";\nimport type { SyncRemoteDocumentInput } from \"./readOnlySync\";\nimport { DocumentRawHistoryUnavailableError } from \"./syncContentKeys\";\nimport { refreshSyncAttemptWriterProjection } from \"./syncFailures\";\nimport {\n  hasDeferredPendingUpdatesAfterSubmit,\n  responseAcceptedRecoveryBaseline,\n} from \"./syncPlanRequestBounds\";\nimport { syncRemoteDocumentResultFromResponse } from \"./syncResponseResult\";\nimport { traceHealed } from \"./syncTrace\";\n\ntype SubmittedDocumentSyncResultInput = {\n  materializedPlan: MaterializedDocumentSyncPlan;\n  pendingUpdateIds: readonly string[];\n  pullComplete: boolean;\n  recoveryPendingUpdatesById: ReadonlyMap<string, PendingUpdateRecord>;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  response: DocumentSyncResponse;\n  sync: SyncRemoteDocumentInput;\n  writerProjection: DocumentWriterProjectionResponse;\n};\n\n/** @internal Applies post-verification heal effects under the sync generation. */\nexport function applyAcceptedHealSideEffects(input: {\n  documentId: string;\n  evictWriterProjection?: ((documentId: string) => void) | undefined;\n  materializedPlan: MaterializedDocumentSyncPlan;\n  onSyncTrace: SyncRemoteDocumentInput[\"onSyncTrace\"];\n  response: DocumentSyncResponse;\n  stillCurrent: SyncRemoteDocumentInput[\"stillCurrent\"];\n}): void {\n  if (\n    !input.materializedPlan.healedStaleContentKeyBundle ||\n    !responseAcceptedRecoveryBaseline(input.materializedPlan, input.response) ||\n    input.stillCurrent?.() === false\n  ) {\n    return;\n  }\n  input.evictWriterProjection?.(input.documentId);\n  if (input.stillCurrent?.() === false) {\n    return;\n  }\n  traceHealed(input.onSyncTrace, {\n    accepted: input.response.acceptedOutgoingUpdateIds.length,\n    documentId: input.materializedPlan.plan.documentId,\n    epoch: input.materializedPlan.plan.contentKeyEpoch,\n  });\n}\n\nasync function submittedDocumentSyncResult(\n  input: SubmittedDocumentSyncResultInput,\n): Promise<SyncRemoteDocumentResult> {\n  const result = await syncRemoteDocumentResultFromResponse({\n    ...projectionVerificationOptions(input.sync),\n    execSql: input.sync.execSql,\n    materializedPlan: input.materializedPlan,\n    onTerminalSubmitFailure: input.sync.onTerminalSubmitFailure,\n    recoveryPendingUpdatesById: input.recoveryPendingUpdatesById,\n    rekeyPendingUpdate: input.sync.rekeyPendingUpdate,\n    resolveWriterPublicKey: input.sync.resolveWriterPublicKey,\n    response: input.response,\n    stillCurrent: input.sync.stillCurrent,\n    targetSecretKey: input.sync.targetSecretKey,\n    validateIncomingUpdates: input.sync.validateIncomingUpdates,\n    writerProjection: input.writerProjection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n  });\n  if (\n    (input.materializedPlan.plan.request.containerRekeys?.length ?? 0) > 0 &&\n    input.sync.stillCurrent?.() !== false\n  ) {\n    input.sync.apiClient.clearWriterProjectionCaches?.();\n  }\n  applyAcceptedHealSideEffects({\n    documentId: input.sync.documentId,\n    evictWriterProjection:\n      input.sync.apiClient.evictDocumentWriterProjection?.bind(\n        input.sync.apiClient,\n      ),\n    materializedPlan: input.materializedPlan,\n    onSyncTrace: input.sync.onSyncTrace,\n    response: input.response,\n    stillCurrent: input.sync.stillCurrent,\n  });\n  return {\n    ...result,\n    hasDeferredPendingUpdates:\n      (input.materializedPlan.plan.request.pullCursor !== undefined &&\n        input.pendingUpdateIds.length > 0 &&\n        result.exhaustedPendingUpdateCount === 0) ||\n      hasDeferredPendingUpdatesAfterSubmit({\n        acceptedRecoveryBaseline: result.acceptedRecoveryBaseline,\n        exhaustedPendingUpdateCount: result.exhaustedPendingUpdateCount,\n        pendingUpdateIds: input.pendingUpdateIds,\n        rekeyedPendingUpdateIds: result.rekeyedPendingUpdateIds,\n        settledPendingUpdateIds: result.settledPendingUpdateIds,\n      }),\n    hasIncompletePull: !input.pullComplete,\n  };\n}\n\nasync function retrySubmittedResponseWithFreshProjection(\n  input: SubmittedDocumentSyncResultInput,\n  unavailableError: unknown,\n  refreshAuthorization: boolean,\n): Promise<SyncRemoteDocumentResult | null> {\n  const writerProjection = await refreshSyncAttemptWriterProjection({\n    apiClient: input.sync.apiClient,\n    documentId: input.sync.documentId,\n    onRemoteDocumentDeleted: input.sync.onRemoteDocumentDeleted,\n    onSyncAbandoned: input.sync.onSyncAbandoned,\n    onSyncTrace: input.sync.onSyncTrace,\n    onTerminalFailure: input.sync.onReadOnlyProjectionFailure,\n    stillCurrent: input.sync.stillCurrent,\n    unavailableError,\n  });\n  if (!writerProjection) return null;\n  const materializedPlan = refreshAuthorization\n    ? {\n        ...input.materializedPlan,\n        plan: {\n          ...input.materializedPlan.plan,\n          documentWriterAuthorization:\n            await verifyDocumentWriterProjectionAuthorization({\n              execSql: input.sync.execSql,\n              projection: writerProjection,\n              resolveUserKey: input.resolveProjectionUserKey,\n              stillCurrent: input.sync.stillCurrent,\n              warmReferencedPrincipalPolicies:\n                input.sync.warmReferencedPrincipalPolicies,\n            }),\n        },\n      }\n    : input.materializedPlan;\n  // Keep the submitted request, keys, and response frozen. Only refreshed,\n  // verified evidence may be added; this retry never resubmits outgoing edits.\n  return submittedDocumentSyncResult({\n    ...input,\n    materializedPlan,\n    writerProjection,\n  });\n}\n\nexport async function resolveSubmittedDocumentSyncResult(\n  input: SubmittedDocumentSyncResultInput,\n): Promise<SyncRemoteDocumentResult | null> {\n  try {\n    return await submittedDocumentSyncResult(input);\n  } catch (error) {\n    const missingDependency =\n      isKeyingVerificationError(error) && error.code === \"missing_dependency\";\n    if (\n      !missingDependency &&\n      (input.sync.historyMode !== \"raw\" ||\n        !(error instanceof DocumentRawHistoryUnavailableError))\n    ) {\n      throw error;\n    }\n    return retrySubmittedResponseWithFreshProjection(\n      input,\n      error,\n      missingDependency,\n    );\n  }\n}\n"]}

package/workflows/documents/syncTrace.js

@@ -1,148 +0,0 @@
-/**
- * Production-safe trace lines for the document sync workflow.
- *
- * Every line is assembled here from a CLOSED vocabulary — strict document
- * UUIDs, integers, and enumerated reason/action/code values that appear as
- * literal alternatives in the pattern below. No decrypted content, names,
- * key material, or free-form error text can enter a line, and because the
- * System Monitor validates LINES (it cannot know their emitter), the pattern
- * itself rejects any token outside that vocabulary rather than trusting
- * emitter-side sanitization. The format tests assert emitter output and
- * pattern stay in lockstep, including that leaks fail closed.
- */
-import { DOCUMENT_NOT_FOUND_ERROR_CODE, DOCUMENT_PROJECTION_ERROR_CODES, DOCUMENT_SYNC_ERROR_CODES, } from "../../internal/validators/response/index.js";
-/**
- * Enumerated, clipboard-safe reasons an ancestor repair abandons a pass. The
- * emitter maps to these rather than passing the error's prose through, so the
- * line stays inside the closed vocabulary the System Monitor validates.
- */
-export const ANCESTOR_REPAIR_ABANDON_REASONS = [
-    "blocked",
-    "depth-budget",
-    "inaccessible",
-    "peer-rotation",
-    "refused",
-    "unrefreshable",
-];
-/** Fixed thrown messages mapped to enumerated, clipboard-safe reasons. */
-const HEAL_BLOCKED_REASONS = [
-    [
-        "Document content-key bundle is stale and no rotation snapshot is available",
-        "snapshot-unavailable",
-    ],
-    [
-        "Document stale-bundle recovery requires a full-history rotation snapshot",
-        "snapshot-not-full-history",
-    ],
-    ["Document stale-bundle recovery snapshot is empty", "snapshot-empty"],
-    [
-        "Document stale-bundle recovery snapshot does not cover a queued rotation checkpoint",
-        "checkpoint-uncovered",
-    ],
-    ["Document content-key re-wrap KEK is unavailable", "rewrap-kek-unavailable"],
-    [
-        "Document stale bundle manifest is missing from the projection history",
-        "stale-manifest-missing",
-    ],
-    ["Document content key could not be unwrapped", "content-key-unwrap-failed"],
-];
-/**
- * Only the protocol's own coded values are copied; any other server-provided
- * string — even one that happens to look like a code — is collapsed to
- * "other" so a hostile or buggy server can never smuggle text into a report.
- */
-const SAFE_FAILURE_CODES = new Set([
-    ...Object.values(DOCUMENT_SYNC_ERROR_CODES),
-    ...Object.values(DOCUMENT_PROJECTION_ERROR_CODES),
-    DOCUMENT_NOT_FOUND_ERROR_CODE,
-]);
-const TRACE_ACTIONS = [
-    "recover-update-ids",
-    "regenerate-checkpoints",
-    "retry",
-    "stop",
-];
-// Every vocabulary below is enumerated into the pattern as literals; the only
-// open-ended slots are a strict UUID and decimal counts.
-const UUID_FRAGMENT = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
-const REASON_FRAGMENT = HEAL_BLOCKED_REASONS.map(([, reason]) => reason).join("|");
-const ABANDON_REASON_FRAGMENT = ANCESTOR_REPAIR_ABANDON_REASONS.join("|");
-const ACTION_FRAGMENT = TRACE_ACTIONS.join("|");
-const CODE_FRAGMENT = [...SAFE_FAILURE_CODES, "none", "other"].join("|");
-/**
- * Unanchored alternatives for composition into a larger allowlist (the
- * System Monitor wraps this in its own prefix/suffix anchors). Use
- * DOCUMENT_SYNC_TRACE_PATTERN to validate a complete line.
- */
-export const DOCUMENT_SYNC_TRACE_FRAGMENT = [
-    `document sync blocked document=${UUID_FRAGMENT}`,
-    `document sync stale bundle document=${UUID_FRAGMENT} epoch=\\d+ pending=\\d+`,
-    `document sync heal planned document=${UUID_FRAGMENT} fromEpoch=\\d+ toEpoch=\\d+ updates=\\d+ heldBack=\\d+`,
-    `document sync stale read document=${UUID_FRAGMENT} epoch=\\d+`,
-    `document sync checkpoint regeneration document=${UUID_FRAGMENT} checkpoints=\\d+ updates=\\d+`,
-    `document sync heal blocked document=${UUID_FRAGMENT} reason=(?:${REASON_FRAGMENT})`,
-    `document sync submit failed document=${UUID_FRAGMENT} status=(?:\\d+|none) code=(?:${CODE_FRAGMENT}) action=(?:${ACTION_FRAGMENT})`,
-    `document sync projection failed document=${UUID_FRAGMENT} status=(?:\\d+|none) code=(?:${CODE_FRAGMENT})`,
-    `document sync ancestor repair abandoned document=${UUID_FRAGMENT} reason=(?:${ABANDON_REASON_FRAGMENT})`,
-    `document sync healed document=${UUID_FRAGMENT} epoch=\\d+ accepted=\\d+`,
-]
-    .map((alternative) => `(?:${alternative})`)
-    .join("|");
-/** Anchored validator: a string is a trace line in full, or not at all. */
-export const DOCUMENT_SYNC_TRACE_PATTERN = new RegExp(`^(?:${DOCUMENT_SYNC_TRACE_FRAGMENT})$`, "u");
-/**
- * Classifies a plan-build failure into an enumerated reason, or null when the
- * message is not one of the fixed protocol strings — unknown errors fail
- * closed and emit nothing rather than leaking free text.
- */
-function classifyHealBlockedReason(error) {
-    const message = error instanceof Error ? error.message : "";
-    for (const [prefix, reason] of HEAL_BLOCKED_REASONS) {
-        if (message.startsWith(prefix)) {
-            return reason;
-        }
-    }
-    return null;
-}
-function safeCode(code) {
-    if (code === undefined) {
-        return "none";
-    }
-    return SAFE_FAILURE_CODES.has(code) ? code : "other";
-}
-function safeStatus(status) {
-    return status !== null && Number.isInteger(status) && status >= 0
-        ? String(status)
-        : "none";
-}
-export function traceStaleBundle(emit, input) {
-    emit?.(`document sync stale bundle document=${input.documentId} epoch=${input.epoch} pending=${input.pending}`);
-}
-export function traceHealPlanned(emit, input) {
-    emit?.(`document sync heal planned document=${input.documentId} fromEpoch=${input.fromEpoch} toEpoch=${input.toEpoch} updates=${input.updates} heldBack=${input.heldBack}`);
-}
-export function traceStaleRead(emit, input) {
-    emit?.(`document sync stale read document=${input.documentId} epoch=${input.epoch}`);
-}
-export function traceCheckpointRegeneration(emit, input) {
-    emit?.(`document sync checkpoint regeneration document=${input.documentId} checkpoints=${input.checkpoints} updates=${input.updates}`);
-}
-export function traceHealBlocked(emit, input) {
-    const reason = classifyHealBlockedReason(input.error);
-    if (reason !== null) {
-        emit?.(`document sync heal blocked document=${input.documentId} reason=${reason}`);
-    }
-}
-export function traceSubmitFailed(emit, input) {
-    emit?.(`document sync submit failed document=${input.documentId} status=${safeStatus(input.status)} code=${safeCode(input.code)} action=${input.action}`);
-}
-export function traceAncestorRepairAbandoned(emit, input) {
-    emit?.(`document sync ancestor repair abandoned document=${input.documentId} reason=${input.reason}`);
-}
-export function traceProjectionFailed(emit, input) {
-    emit?.(`document sync projection failed document=${input.documentId} status=${safeStatus(input.status)} code=${safeCode(input.code)}`);
-}
-export function traceHealed(emit, input) {
-    emit?.(`document sync healed document=${input.documentId} epoch=${input.epoch} accepted=${input.accepted}`);
-}
-//# sourceMappingURL=syncTrace.js.map

package/workflows/organizations/acknowledgedDirectoryBindings.js

@@ -1,18 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
-/** Couple supplied group receipts to the directory acknowledged in the same batch. */
-export function assertAcknowledgedDirectoryBindings(organizationId, receipts) {
-    const directories = receipts.filter((receipt) => receipt.currentState.principalType === "organization");
-    if (directories.length === 0 &&
-        receipts.some((receipt) => receipt.currentState.principalType === "group"))
-        throw new KeyingVerificationError("missing_dependency", "Acknowledged groups require their organization directory");
-    for (const directory of directories) {
-        const descriptor = parseOrganizationAuthorityDescriptor(directory.currentPayload.ciphertext);
-        if (directory.currentState.principalId !== organizationId ||
-            descriptor.organizationId !== organizationId ||
-            receipts.some(({ currentState }) => currentState.principalType === "group" &&
-                !descriptor.groupHeads.some((head) => principalHeadMatchesReference(head, currentState))))
-            throw new KeyingVerificationError("object_mismatch", "Acknowledged organization does not bind its group receipt");
-    }
-}
-//# sourceMappingURL=acknowledgedDirectoryBindings.js.map

package/workflows/organizations/acknowledgedDirectoryBindings.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"acknowledgedDirectoryBindings.js","sourceRoot":"","sources":["acknowledgedDirectoryBindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAE/D,sFAAsF;AACtF,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,QAAoD;IAEpD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc,CACnE,CAAC;IACF,IACE,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO,CAAC;QAE1E,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,0DAA0D,CAC3D,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,oCAAoC,CACrD,SAAS,CAAC,cAAc,CAAC,UAAU,CACpC,CAAC;QACF,IACE,SAAS,CAAC,YAAY,CAAC,WAAW,KAAK,cAAc;YACrD,UAAU,CAAC,cAAc,KAAK,cAAc;YAC5C,QAAQ,CAAC,IAAI,CACX,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CACnB,YAAY,CAAC,aAAa,KAAK,OAAO;gBACtC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,6BAA6B,CAAC,IAAI,EAAE,YAAY,CAAC,CAClD,CACJ;YAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACN,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\n\n/** Couple supplied group receipts to the directory acknowledged in the same batch. */\nexport function assertAcknowledgedDirectoryBindings(\n  organizationId: string,\n  receipts: readonly PrincipalPolicyMutationResponse[],\n) {\n  const directories = receipts.filter(\n    (receipt) => receipt.currentState.principalType === \"organization\",\n  );\n  if (\n    directories.length === 0 &&\n    receipts.some((receipt) => receipt.currentState.principalType === \"group\")\n  )\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Acknowledged groups require their organization directory\",\n    );\n  for (const directory of directories) {\n    const descriptor = parseOrganizationAuthorityDescriptor(\n      directory.currentPayload.ciphertext,\n    );\n    if (\n      directory.currentState.principalId !== organizationId ||\n      descriptor.organizationId !== organizationId ||\n      receipts.some(\n        ({ currentState }) =>\n          currentState.principalType === \"group\" &&\n          !descriptor.groupHeads.some((head) =>\n            principalHeadMatchesReference(head, currentState),\n          ),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Acknowledged organization does not bind its group receipt\",\n      );\n  }\n}\n"]}

package/workflows/organizations/authoredPrincipalPolicyWarmer.js

@@ -1,25 +0,0 @@
-import { assertProjectionVerificationCurrent, } from "../../data/keyingProjectionVerification/types.js";
-import { principalStateMatchesReference } from "../../data/principals/principalPolicyStates.js";
-/** Only exact, locally authored successors may resolve before their transaction commits. */
-export function withAuthoredPrincipalPolicies(warmer, authored) {
-    if (!warmer?.resolveReference || authored.length === 0)
-        return warmer;
-    const resolve = warmer.resolveReference;
-    const find = (organizationId, reference) => authored.find((entry) => entry.organizationId === organizationId &&
-        principalStateMatchesReference(entry.policy.state, reference));
-    return Object.assign((input) => warmer({
-        ...input,
-        references: input.references.filter((reference) => !find(input.organizationId, reference)),
-    }), {
-        ...warmer,
-        resolveReference: async (input) => {
-            const evidence = find(input.organizationId, input.reference);
-            if (!evidence)
-                return resolve(input);
-            assertProjectionVerificationCurrent(input.stillCurrent);
-            assertProjectionVerificationCurrent(evidence.stillCurrent);
-            return evidence;
-        },
-    });
-}
-//# sourceMappingURL=authoredPrincipalPolicyWarmer.js.map

package/workflows/organizations/authoredPrincipalPolicyWarmer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authoredPrincipalPolicyWarmer.js","sourceRoot":"","sources":["authoredPrincipalPolicyWarmer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,GAGpC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAE7F,4FAA4F;AAC5F,MAAM,UAAU,6BAA6B,CAC3C,MAAmD,EACnD,QAAoD;IAEpD,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACxC,MAAM,IAAI,GAAG,CACX,cAAsB,EACtB,SAAqD,EACrD,EAAE,CACF,QAAQ,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,cAAc,KAAK,cAAc;QACvC,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAChE,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAqD,EAAE,EAAE,CACxD,MAAM,CAAC;QACL,GAAG,KAAK;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CACjC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CACtD;KACF,CAAC,EACJ;QACE,GAAG,MAAM;QACT,gBAAgB,EAAE,KAAK,EAAE,KAAoC,EAAE,EAAE;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  assertProjectionVerificationCurrent,\n  type ReferencedPrincipalPolicyWarmer,\n  type ResolvedPrincipalPolicyEvidence,\n} from \"../../data/keyingProjectionVerification/types\";\nimport { principalStateMatchesReference } from \"../../data/principals/principalPolicyStates\";\n\n/** Only exact, locally authored successors may resolve before their transaction commits. */\nexport function withAuthoredPrincipalPolicies(\n  warmer: ReferencedPrincipalPolicyWarmer | undefined,\n  authored: readonly ResolvedPrincipalPolicyEvidence[],\n): ReferencedPrincipalPolicyWarmer | undefined {\n  if (!warmer?.resolveReference || authored.length === 0) return warmer;\n  const resolve = warmer.resolveReference;\n  const find = (\n    organizationId: string,\n    reference: Parameters<typeof resolve>[0][\"reference\"],\n  ) =>\n    authored.find(\n      (entry) =>\n        entry.organizationId === organizationId &&\n        principalStateMatchesReference(entry.policy.state, reference),\n    );\n  return Object.assign(\n    (input: Parameters<ReferencedPrincipalPolicyWarmer>[0]) =>\n      warmer({\n        ...input,\n        references: input.references.filter(\n          (reference) => !find(input.organizationId, reference),\n        ),\n      }),\n    {\n      ...warmer,\n      resolveReference: async (input: Parameters<typeof resolve>[0]) => {\n        const evidence = find(input.organizationId, input.reference);\n        if (!evidence) return resolve(input);\n        assertProjectionVerificationCurrent(input.stillCurrent);\n        assertProjectionVerificationCurrent(evidence.stillCurrent);\n        return evidence;\n      },\n    },\n  );\n}\n"]}

package/workflows/organizations/commitCurrentGroupPolicyMutation.js

@@ -1,139 +0,0 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { prepareAuthoredGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
-import { submitGroupPolicyCommit, } from "./groupPolicyMutationContext.js";
-import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
-import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
-import { assertAuthoredPrincipalMutationReceipt } from "./principalMutationReceipt.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
-/** Commit and retain the group, optional roster enrollment and directory together. */
-export async function commitCurrentGroupPolicyMutation(input) {
-    const { context } = input;
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    const [signer] = await resolveRequiredUserIdentities({
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        userIds: [input.signerUserId],
-    });
-    if (!signer)
-        throw new Error("Group policy signer is unavailable");
-    const member = input.member
-        ? await prepareChange(input.member, signer)
-        : null;
-    const { expectedHead, prepared } = await prepareChange(input, signer, member?.preceding);
-    const organizationRequest = await prepareDirectory(input, expectedHead, member?.expectedHead);
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    const response = await submitGroupPolicyCommit({
-        apiClient: input.apiClient,
-        groupId: input.groupId,
-        organizationId: input.organizationId,
-        request: input.request,
-        organizationRequest,
-        memberRequest: input.member?.request,
-        // A compound retry must rebuild both batches' shared speculative heads.
-        // Refuse the whole transaction if a damaged-key repair needs extra rekeys;
-        // ordinary adds preserve key epochs and need no descendant carry retry.
-        carryDescendantRekeys: member ? undefined : prepared.carry,
-        stillCurrent: context.stillCurrent,
-    });
-    if (!response)
-        throw new Error("Group policy update failed");
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    await assertAuthoredPrincipalMutationReceipt({
-        groupPolicy: input.request,
-        organizationPolicy: organizationRequest,
-        ...(input.member ? { memberPolicy: input.member.request } : {}),
-    }, response);
-    await context.retainAcknowledged({
-        additionalGroups: input.member && response.memberPolicy
-            ? [
-                {
-                    ...input.member.context.groupRetention,
-                    request: input.member.request,
-                    response: response.memberPolicy,
-                    retiredContainerIds: member?.prepared.retiredContainerIds,
-                },
-            ]
-            : [],
-        request: input.request,
-        organizationRequest,
-        response,
-        retiredContainerIds: prepared.retiredContainerIds,
-    });
-    if (member && response.memberPolicy) {
-        await member.prepared.acknowledge(response.memberPolicy.containerMutations, context.stillCurrent);
-    }
-    await prepared.acknowledge(response.groupPolicy.containerMutations, context.stillCurrent);
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    return response.groupPolicy;
-}
-async function prepareChange(change, signer, preceding) {
-    const expectedHead = await groupPolicyMutationHead(change.request);
-    const nextPolicy = await prepareAuthoredGroupPolicy({
-        verifiedCurrentPolicy: change.context.verifiedCurrentPolicy,
-        expectedHead,
-        request: change.request,
-        signerPublicKeys: [signer],
-        externalAuthority: change.context.externalAuthority,
-        localPolicyCheckpoint: change.context.localPolicyCheckpoint,
-        stillCurrent: change.context.stillCurrent,
-    });
-    const prepared = await change.prepareContainerMutations(nextPolicy, preceding);
-    change.request.containerMutations = [...prepared.requests];
-    return {
-        expectedHead,
-        prepared,
-        preceding: prepared.preceding
-            ? {
-                ...prepared.preceding,
-                authored: [
-                    ...(preceding?.authored ?? []),
-                    {
-                        organizationId: change.context.organizationDescriptor.organizationId,
-                        policy: nextPolicy,
-                        dependencies: [
-                            change.context.organizationCurrent.policy,
-                            change.context.adminCurrent.policy,
-                        ],
-                        stillCurrent: change.context.stillCurrent,
-                    },
-                ],
-            }
-            : undefined,
-    };
-}
-async function prepareDirectory(input, expectedHead, memberHead) {
-    const { context } = input;
-    if (input.member &&
-        (input.member.context.currentPolicy.currentState.principalId !==
-            context.memberGroupId ||
-            input.member.context.organizationCurrent.current.currentState
-                .stateHash !==
-                context.organizationCurrent.current.currentState.stateHash))
-        throw new Error("Roster and group changes must share the same organization policy");
-    let groupHeads = replaceOrganizationGroupHead({
-        descriptor: context.organizationDescriptor,
-        nextHead: expectedHead,
-    });
-    if (memberHead)
-        groupHeads = replaceOrganizationGroupHead({
-            descriptor: { ...context.organizationDescriptor, groupHeads },
-            nextHead: memberHead,
-        });
-    const adminProjection = context.isOrganizationAdminsGroup
-        ? input.request.projection
-        : context.adminCurrent.current.currentProjection;
-    const adminUsers = await resolveRequiredUserIdentities({
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        userIds: projectionUserIds(adminProjection),
-    });
-    return buildOrganizationGroupDirectoryPolicyRequest({
-        adminProjection,
-        adminUsers,
-        currentPolicy: context.organizationCurrent.current,
-        descriptor: context.organizationDescriptor,
-        groupHeads,
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-}
-//# sourceMappingURL=commitCurrentGroupPolicyMutation.js.map

package/workflows/organizations/commitCurrentGroupPolicyMutation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"commitCurrentGroupPolicyMutation.js","sourceRoot":"","sources":["commitCurrentGroupPolicyMutation.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AAEpF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAsBpC,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,6BAA6B,CAAC;QACnD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CACpD,KAAK,EACL,MAAM,EACN,MAAM,EAAE,SAAS,CAClB,CAAC;IACF,MAAM,mBAAmB,GAAG,MAAM,gBAAgB,CAChD,KAAK,EACL,YAAY,EACZ,MAAM,EAAE,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;QACpC,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;QAC1D,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,sCAAsC,CAC1C;QACE,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,kBAAkB,EAAE,mBAAmB;QACvC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,gBAAgB,EACd,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY;YACnC,CAAC,CAAC;gBACE;oBACE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;oBACtC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;oBAC7B,QAAQ,EAAE,QAAQ,CAAC,YAAY;oBAC/B,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,mBAAmB;iBAC1D;aACF;YACH,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,QAAQ;QACR,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAC/B,QAAQ,CAAC,YAAY,CAAC,kBAAkB,EACxC,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,CAAC,WAAW,CACxB,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EACvC,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,MAAyE,EACzE,SAAiD;IAEjD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC;QAClD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB;QACnD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;KAC1C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,yBAAyB,CACrD,UAAU,EACV,SAAS,CACV,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC3B,CAAC,CAAC;gBACE,GAAG,QAAQ,CAAC,SAAS;gBACrB,QAAQ,EAAE;oBACR,GAAG,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;oBAC9B;wBACE,cAAc,EACZ,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc;wBACtD,MAAM,EAAE,UAAU;wBAClB,YAAY,EAAE;4BACZ,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM;4BACzC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM;yBACnC;wBACD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;qBAC1C;iBACF;aACF;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAkB,EAClB,YAAiE,EACjE,UAA2E;IAE3E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IACE,KAAK,CAAC,MAAM;QACZ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YAC1D,OAAO,CAAC,aAAa;YACrB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY;iBAC1D,SAAS;gBACV,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;QAE/D,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,IAAI,UAAU,GAAG,4BAA4B,CAAC;QAC5C,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,IAAI,UAAU;QACZ,UAAU,GAAG,4BAA4B,CAAC;YACxC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,sBAAsB,EAAE,UAAU,EAAE;YAC7D,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;IACL,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB;QACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,4CAA4C,CAAC;QAClD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,mBAAmB,CAAC,OAAO;QAClD,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  SigningKeyPair,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  type PrincipalPolicyReadWriteApi,\n  submitGroupPolicyCommit,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport type { PreparedPrincipalContainerRematerializationBatch } from \"./principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"./principalContainerRematerializationPlanning\";\nimport { assertAuthoredPrincipalMutationReceipt } from \"./principalMutationReceipt\";\nimport type { RuntimeCurrentGroupMutationContext } from \"./runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\ninterface GroupPolicyChange {\n  readonly context: RuntimeCurrentGroupMutationContext;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly prepareContainerMutations: (\n    nextPolicy: VerifiedPrincipalPolicyCurrent,\n    preceding?: PrincipalRematerializationPredecessor | undefined,\n  ) => Promise<PreparedPrincipalContainerRematerializationBatch>;\n}\n\ninterface CommitInput extends GroupPolicyChange {\n  readonly member?: GroupPolicyChange | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\n/** Commit and retain the group, optional roster enrollment and directory together. */\nexport async function commitCurrentGroupPolicyMutation(\n  input: CommitInput,\n): Promise<PrincipalPolicyMutationResponse> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const [signer] = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [input.signerUserId],\n  });\n  if (!signer) throw new Error(\"Group policy signer is unavailable\");\n  const member = input.member\n    ? await prepareChange(input.member, signer)\n    : null;\n  const { expectedHead, prepared } = await prepareChange(\n    input,\n    signer,\n    member?.preceding,\n  );\n  const organizationRequest = await prepareDirectory(\n    input,\n    expectedHead,\n    member?.expectedHead,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const response = await submitGroupPolicyCommit({\n    apiClient: input.apiClient,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    request: input.request,\n    organizationRequest,\n    memberRequest: input.member?.request,\n    // A compound retry must rebuild both batches' shared speculative heads.\n    // Refuse the whole transaction if a damaged-key repair needs extra rekeys;\n    // ordinary adds preserve key epochs and need no descendant carry retry.\n    carryDescendantRekeys: member ? undefined : prepared.carry,\n    stillCurrent: context.stillCurrent,\n  });\n  if (!response) throw new Error(\"Group policy update failed\");\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  await assertAuthoredPrincipalMutationReceipt(\n    {\n      groupPolicy: input.request,\n      organizationPolicy: organizationRequest,\n      ...(input.member ? { memberPolicy: input.member.request } : {}),\n    },\n    response,\n  );\n  await context.retainAcknowledged({\n    additionalGroups:\n      input.member && response.memberPolicy\n        ? [\n            {\n              ...input.member.context.groupRetention,\n              request: input.member.request,\n              response: response.memberPolicy,\n              retiredContainerIds: member?.prepared.retiredContainerIds,\n            },\n          ]\n        : [],\n    request: input.request,\n    organizationRequest,\n    response,\n    retiredContainerIds: prepared.retiredContainerIds,\n  });\n  if (member && response.memberPolicy) {\n    await member.prepared.acknowledge(\n      response.memberPolicy.containerMutations,\n      context.stillCurrent,\n    );\n  }\n  await prepared.acknowledge(\n    response.groupPolicy.containerMutations,\n    context.stillCurrent,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return response.groupPolicy;\n}\n\nasync function prepareChange(\n  change: GroupPolicyChange,\n  signer: Awaited<ReturnType<typeof resolveRequiredUserIdentities>>[number],\n  preceding?: PrincipalRematerializationPredecessor,\n) {\n  const expectedHead = await groupPolicyMutationHead(change.request);\n  const nextPolicy = await prepareAuthoredGroupPolicy({\n    verifiedCurrentPolicy: change.context.verifiedCurrentPolicy,\n    expectedHead,\n    request: change.request,\n    signerPublicKeys: [signer],\n    externalAuthority: change.context.externalAuthority,\n    localPolicyCheckpoint: change.context.localPolicyCheckpoint,\n    stillCurrent: change.context.stillCurrent,\n  });\n  const prepared = await change.prepareContainerMutations(\n    nextPolicy,\n    preceding,\n  );\n  change.request.containerMutations = [...prepared.requests];\n  return {\n    expectedHead,\n    prepared,\n    preceding: prepared.preceding\n      ? {\n          ...prepared.preceding,\n          authored: [\n            ...(preceding?.authored ?? []),\n            {\n              organizationId:\n                change.context.organizationDescriptor.organizationId,\n              policy: nextPolicy,\n              dependencies: [\n                change.context.organizationCurrent.policy,\n                change.context.adminCurrent.policy,\n              ],\n              stillCurrent: change.context.stillCurrent,\n            },\n          ],\n        }\n      : undefined,\n  };\n}\n\nasync function prepareDirectory(\n  input: CommitInput,\n  expectedHead: Awaited<ReturnType<typeof groupPolicyMutationHead>>,\n  memberHead: Awaited<ReturnType<typeof groupPolicyMutationHead>> | undefined,\n) {\n  const { context } = input;\n  if (\n    input.member &&\n    (input.member.context.currentPolicy.currentState.principalId !==\n      context.memberGroupId ||\n      input.member.context.organizationCurrent.current.currentState\n        .stateHash !==\n        context.organizationCurrent.current.currentState.stateHash)\n  )\n    throw new Error(\n      \"Roster and group changes must share the same organization policy\",\n    );\n  let groupHeads = replaceOrganizationGroupHead({\n    descriptor: context.organizationDescriptor,\n    nextHead: expectedHead,\n  });\n  if (memberHead)\n    groupHeads = replaceOrganizationGroupHead({\n      descriptor: { ...context.organizationDescriptor, groupHeads },\n      nextHead: memberHead,\n    });\n  const adminProjection = context.isOrganizationAdminsGroup\n    ? input.request.projection\n    : context.adminCurrent.current.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  return buildOrganizationGroupDirectoryPolicyRequest({\n    adminProjection,\n    adminUsers,\n    currentPolicy: context.organizationCurrent.current,\n    descriptor: context.organizationDescriptor,\n    groupHeads,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n"]}

package/workflows/organizations/createCurrentOrganizationGroup.js

@@ -1,85 +0,0 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
-import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
-import { readDirectoryGroupName } from "./groupNameUniqueness.js";
-import { acknowledgeInitialGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
-import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
-import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
-import { buildInitialGroupPolicyRequest, canonicalGroupNameKey, } from "./principalPolicyRequest.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
-/** Create from bounded current evidence and publish its genuine genesis with the directory. */
-export async function createCurrentOrganizationGroup(input) {
-    const { context } = input;
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    const nameKey = canonicalGroupNameKey(input.name);
-    // Each current recovery is queued by organization. Retain verified heads one
-    // at a time so the walk stays bounded without collecting full group histories.
-    for (const head of context.descriptor.groupHeads) {
-        const group = await context.readGroup(head.principalId);
-        const stillCurrent = () => context.stillCurrent() && group.stillCurrent();
-        assertProjectionVerificationCurrent(stillCurrent);
-        assertGroupMetadataBinding(group.current, context.descriptor);
-        const name = await readDirectoryGroupName({ ...input, readEncryptedName: input.metadataAccess.readName }, group.current);
-        // Remember independently verified heads even if uniqueness or dispatch
-        // later fails; these are observed policies, never speculative successors.
-        await advanceKeyingCheckpointsAtomically({
-            execSql: input.execSql,
-            organizationId: input.organizationId,
-            access: [],
-            policies: [...group.dependencies, group.policy],
-            stillCurrent,
-        });
-        if (name !== null && canonicalGroupNameKey(name) === nameKey)
-            throw new Error("Another signed group in this organization already carries this name");
-    }
-    const request = await buildInitialGroupPolicyRequest({
-        ...input,
-        groupId: crypto.randomUUID(),
-        includeSignerAsAdmin: false,
-        externalAuthority: {
-            ...principalPolicyReferenceFromBundle(context.admins.current),
-            principalType: "group",
-        },
-        metadataKey: await input.metadataAccess.loadEncryptionKey(),
-    });
-    const head = await groupPolicyMutationHead(request.initialGroupPolicy);
-    const adminProjection = context.admins.policy.projection;
-    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
-        ...input,
-        currentPolicy: context.directory.current,
-        descriptor: context.descriptor,
-        groupHeads: replaceOrganizationGroupHead({
-            descriptor: context.descriptor,
-            nextHead: head,
-        }),
-        adminProjection,
-        adminUsers: await resolveRequiredUserIdentities({
-            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-            userIds: projectionUserIds(adminProjection),
-        }),
-    });
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    const stored = await input.apiClient.createOrganizationGroup(input.organizationId, { ...request, organizationPolicy: organizationRequest });
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    if (!stored)
-        throw new Error("Group could not be created");
-    // Genesis really has one signed state. Reconstruct only the exact authored
-    // artifacts whose commitments match the summary, then verify them privately.
-    const { bundle } = await acknowledgeInitialGroupPolicy({
-        organizationId: input.organizationId,
-        request,
-        response: stored.group,
-        stateHash: head.stateHash,
-    });
-    const { previousStates: _previousStates, ...current } = bundle;
-    await context.retainCreatedGroup({
-        request: request.initialGroupPolicy,
-        response: { ...current, containerMutations: [] },
-        organizationRequest,
-        organizationResponse: stored.organizationPolicy,
-    });
-    assertProjectionVerificationCurrent(context.stillCurrent);
-    return { ...stored.group, name: input.name.trim(), nameUnreadable: false };
-}
-//# sourceMappingURL=createCurrentOrganizationGroup.js.map

package/workflows/organizations/createCurrentOrganizationGroup.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createCurrentOrganizationGroup.js","sourceRoot":"","sources":["createCurrentOrganizationGroup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAKvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAErF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAgBpD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACvC,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,EAC9D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/C,YAAY;SACb,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,OAAO;YAC1D,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,iBAAiB,EAAE;YACjB,GAAG,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7D,aAAa,EAAE,OAAO;SACvB;QACD,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACzD,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,GAAG,KAAK;QACR,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,eAAe;QACf,UAAU,EAAE,MAAM,6BAA6B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;SAC5C,CAAC;KACH,CAAC,CAAC;IACL,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CACxD,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;IAC/D,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,kBAAkB;QACnC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAChD,mBAAmB;QACnB,oBAAoB,EAAE,MAAM,CAAC,kBAAkB;KAChD,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { createGroupMetadataAccess } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport { readDirectoryGroupName } from \"./groupNameUniqueness\";\nimport { acknowledgeInitialGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport {\n  buildInitialGroupPolicyRequest,\n  canonicalGroupNameKey,\n} from \"./principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"./readModel\";\nimport type { CurrentOrganizationMutationContext } from \"./runtimeCurrentOrganizationMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\n/** Create from bounded current evidence and publish its genuine genesis with the directory. */\nexport async function createCurrentOrganizationGroup(input: {\n  readonly apiClient: Pick<\n    OrganizationPrincipalPolicyApi,\n    \"createOrganizationGroup\"\n  >;\n  readonly context: CurrentOrganizationMutationContext;\n  readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n  readonly execSql: ExecSql;\n  readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n  readonly name: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<OrganizationGroupSummary> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const nameKey = canonicalGroupNameKey(input.name);\n  // Each current recovery is queued by organization. Retain verified heads one\n  // at a time so the walk stays bounded without collecting full group histories.\n  for (const head of context.descriptor.groupHeads) {\n    const group = await context.readGroup(head.principalId);\n    const stillCurrent = () => context.stillCurrent() && group.stillCurrent();\n    assertProjectionVerificationCurrent(stillCurrent);\n    assertGroupMetadataBinding(group.current, context.descriptor);\n    const name = await readDirectoryGroupName(\n      { ...input, readEncryptedName: input.metadataAccess.readName },\n      group.current,\n    );\n    // Remember independently verified heads even if uniqueness or dispatch\n    // later fails; these are observed policies, never speculative successors.\n    await advanceKeyingCheckpointsAtomically({\n      execSql: input.execSql,\n      organizationId: input.organizationId,\n      access: [],\n      policies: [...group.dependencies, group.policy],\n      stillCurrent,\n    });\n    if (name !== null && canonicalGroupNameKey(name) === nameKey)\n      throw new Error(\n        \"Another signed group in this organization already carries this name\",\n      );\n  }\n  const request = await buildInitialGroupPolicyRequest({\n    ...input,\n    groupId: crypto.randomUUID(),\n    includeSignerAsAdmin: false,\n    externalAuthority: {\n      ...principalPolicyReferenceFromBundle(context.admins.current),\n      principalType: \"group\",\n    },\n    metadataKey: await input.metadataAccess.loadEncryptionKey(),\n  });\n  const head = await groupPolicyMutationHead(request.initialGroupPolicy);\n  const adminProjection = context.admins.policy.projection;\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      ...input,\n      currentPolicy: context.directory.current,\n      descriptor: context.descriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: context.descriptor,\n        nextHead: head,\n      }),\n      adminProjection,\n      adminUsers: await resolveRequiredUserIdentities({\n        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n        userIds: projectionUserIds(adminProjection),\n      }),\n    });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const stored = await input.apiClient.createOrganizationGroup(\n    input.organizationId,\n    { ...request, organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  if (!stored) throw new Error(\"Group could not be created\");\n  // Genesis really has one signed state. Reconstruct only the exact authored\n  // artifacts whose commitments match the summary, then verify them privately.\n  const { bundle } = await acknowledgeInitialGroupPolicy({\n    organizationId: input.organizationId,\n    request,\n    response: stored.group,\n    stateHash: head.stateHash,\n  });\n  const { previousStates: _previousStates, ...current } = bundle;\n  await context.retainCreatedGroup({\n    request: request.initialGroupPolicy,\n    response: { ...current, containerMutations: [] },\n    organizationRequest,\n    organizationResponse: stored.organizationPolicy,\n  });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return { ...stored.group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}