@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/createOrganization.d.ts

@@ -1,62 +0,0 @@
-import { type EncapsulationKeyPair, type SigningKeyPair } from "../../internal/crypto/index.js";
-import type { CreateOrganizationRequest } from "../../internal/validators/request/index.js";
-import type { CreateOrganizationResponse } from "../../internal/validators/response/index.js";
-import type { DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
-import type { ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
-import type { ProvisionedPrincipalHistoryPrimer } from "../registration/provisionedPrincipalHistory.js";
-import { type ProvisionedSystemContainerSpec } from "../registration/registerIdentity.js";
-import { removeNativeSubscriptionRestoreProvisioningAttempt } from "./organizationProvisioningAttempt.js";
-export { removeNativeSubscriptionRestoreProvisioningAttempt };
-export interface CreateOrganizationApi {
-    createOrganization(request: CreateOrganizationRequest): Promise<CreateOrganizationResponse | null>;
-}
-export interface CreateOrganizationInput {
-    apiClient: CreateOrganizationApi;
-    dbClient: ExecSqlClientLike;
-    documentProjectors?: DocumentProjectorRegistryInput | undefined;
-    encapsulationKeyPair: EncapsulationKeyPair;
-    /**
-     * Returns false once the identity that supplied the key pairs is no longer
-     * active. Checked before the remote create (so a stale request is never
-     * submitted) and again before local persistence: an identity switch closes
-     * or renews the captured database client, so persisting would write another
-     * identity's bootstrap — or throw — after the org already exists remotely.
-     * The caller discards the result.
-     */
-    isIdentityCurrent?: (() => boolean) | undefined;
-    /** @internal Forwarded to the bootstrap persist; test-only seam. */
-    onPersistQueued?: (() => void) | undefined;
-    log?: ((message: string) => void) | undefined;
-    logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
-    /** Overrides the seeded organization profile name; see registration. */
-    organizationProfileName?: string | undefined;
-    /** Seeds verified recovery progress for the founding policy heads. */
-    primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;
-    /**
-     * App-owned system containers to provision atomically with the new
-     * organization (e.g. a trash bin). See registration.
-     */
-    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
-    /** Purged organization whose personal-org generation this replaces. */
-    replacesOrganizationId?: string | undefined;
-    /** Marks and durably replays a fresh native-subscription restore target. */
-    nativeSubscriptionRestore?: boolean | undefined;
-    /** Overrides the seeded self roster-profile nickname; see registration. */
-    rosterProfileNickname?: string | undefined;
-    signingKeyPair: SigningKeyPair;
-    /**
-     * The already-registered user creating the organization; they become its
-     * founding admin. The server independently requires this to match the
-     * authenticated session.
-     */
-    userId: string;
-}
-/**
- * Provisions an additional organization for an already-registered user, reusing
- * the exact artifact-build and local-persistence path as registration
- * ({@link buildOrganizationProvisioningArtifacts} /
- * {@link persistOrganizationProvisioningState}). Unlike registration it mints a
- * fresh root container id, signs with the caller's existing identity, and needs
- * no auth challenge — the user is already authenticated.
- */
-export declare function createOrganization(input: CreateOrganizationInput): Promise<CreateOrganizationResponse | null>;

package/workflows/organizations/createOrganization.js

@@ -1,128 +0,0 @@
-import { signOrganizationReplacementAuthorization, } from "../../internal/crypto/index.js";
-import { createExecSql } from "../../data/sqlite/sqlSchema.js";
-import { buildOrganizationProvisioningArtifacts, persistOrganizationProvisioningState, } from "../registration/registerIdentity.js";
-import { makeOrganizationProvisioningAttemptDurable, removeNativeSubscriptionRestoreProvisioningAttempt, } from "./organizationProvisioningAttempt.js";
-import { pinOrganizationReplacementResponse } from "./organizationReplacementVerification.js";
-export { removeNativeSubscriptionRestoreProvisioningAttempt };
-function isAdoptedReplacementResponse(input) {
-    if (input.response.organizationId === input.request.organizationId &&
-        input.response.rootContainerId === input.request.rootContainerId) {
-        return false;
-    }
-    if (!input.creation.replacesOrganizationId ||
-        input.response.userId !== input.creation.userId) {
-        throw new Error("Organization provisioning returned an unexpected organization");
-    }
-    input.creation.log?.(`Organization replacement adopted (${input.response.organizationId})`);
-    return true;
-}
-async function buildOrganizationCandidate(input, rootContainerId) {
-    const artifactsInput = {
-        encapsulationKeyPair: input.encapsulationKeyPair,
-        organizationProfileName: input.organizationProfileName,
-        provisionedSystemContainers: input.provisionedSystemContainers,
-        rootContainerId,
-        rosterProfileNickname: input.rosterProfileNickname,
-        signingKeyPair: input.signingKeyPair,
-        userId: input.userId,
-    };
-    const artifacts = await buildOrganizationProvisioningArtifacts(artifactsInput);
-    if (input.replacesOrganizationId) {
-        artifacts.replacementAuthorization =
-            await signOrganizationReplacementAuthorization({
-                ...artifacts,
-                replacesOrganizationId: input.replacesOrganizationId,
-                rootContainerId,
-                userId: input.userId,
-            }, input.signingKeyPair);
-    }
-    if (input.replacesOrganizationId &&
-        input.isIdentityCurrent &&
-        !input.isIdentityCurrent()) {
-        input.log?.("Organization creation aborted: identity changed while building artifacts");
-        return null;
-    }
-    return artifacts;
-}
-/**
- * Provisions an additional organization for an already-registered user, reusing
- * the exact artifact-build and local-persistence path as registration
- * ({@link buildOrganizationProvisioningArtifacts} /
- * {@link persistOrganizationProvisioningState}). Unlike registration it mints a
- * fresh root container id, signs with the caller's existing identity, and needs
- * no auth challenge — the user is already authenticated.
- */
-export async function createOrganization(input) {
-    input.log?.("Creating organization...");
-    const rootContainerId = crypto.randomUUID();
-    const candidateArtifacts = await buildOrganizationCandidate(input, rootContainerId);
-    if (!candidateArtifacts)
-        return null;
-    const durableAttempt = await makeOrganizationProvisioningAttemptDurable({
-        artifacts: candidateArtifacts,
-        canStartDurableMutation: input.isIdentityCurrent,
-        dbClient: input.dbClient,
-        nativeSubscriptionRestore: input.nativeSubscriptionRestore,
-        replacesOrganizationId: input.replacesOrganizationId,
-        rootContainerId,
-        userId: input.userId,
-    });
-    if (!durableAttempt) {
-        input.log?.("Organization creation aborted: identity changed before saving artifacts");
-        return null;
-    }
-    const { artifacts, request, rootContainerId: durableRootContainerId, } = durableAttempt;
-    if (input.isIdentityCurrent && !input.isIdentityCurrent()) {
-        input.log?.("Organization creation aborted: identity changed before provisioning");
-        return null;
-    }
-    const response = await input.apiClient.createOrganization(request);
-    if (!response) {
-        return null;
-    }
-    if (input.isIdentityCurrent && !input.isIdentityCurrent()) {
-        input.log?.("Organization creation discarded: identity changed while provisioning");
-        return null;
-    }
-    if (input.replacesOrganizationId &&
-        !(await pinOrganizationReplacementResponse({
-            replacesOrganizationId: input.replacesOrganizationId,
-            response,
-            signingPublicKey: input.signingKeyPair.signingPublicKey,
-            userId: input.userId,
-            execSql: createExecSql(input.dbClient),
-            stillCurrent: input.isIdentityCurrent,
-        })))
-        return null;
-    if (isAdoptedReplacementResponse({ creation: input, request, response })) {
-        // Another device authorized this winning genesis with the same identity.
-        // Its encrypted bootstrap will hydrate normally; persisting
-        // this device's losing candidate would instead create an unrelated local
-        // root. The session reset rebinds retained local data to the winning ids.
-        return response;
-    }
-    input.log?.(`Organization created (${response.organizationId})`);
-    await persistOrganizationProvisioningState({
-        bootstrap: artifacts.bootstrap,
-        canStartDurableMutation: input.isIdentityCurrent,
-        onPersistQueued: input.onPersistQueued,
-        containerId: durableRootContainerId,
-        dbClient: input.dbClient,
-        documentProjectors: input.documentProjectors,
-        initialAdminGroup: artifacts.initialAdminGroup,
-        initialMemberGroup: artifacts.initialMemberGroup,
-        initialOrganizationPolicy: artifacts.initialOrganizationPolicy,
-        log: input.log,
-        logError: input.logError,
-        organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,
-        primePrincipalHistory: input.primePrincipalHistory,
-        response,
-        rootContainer: artifacts.rootContainer,
-        rootMetadataDocument: artifacts.rootMetadataDocument,
-        rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,
-        rosterProfileBootstrap: artifacts.rosterProfileBootstrap,
-        systemContainerBootstraps: artifacts.systemContainerBootstraps,
-    });
-    return response;
-}
-//# sourceMappingURL=createOrganization.js.map

package/workflows/organizations/createOrganization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createOrganization.js","sourceRoot":"","sources":["createOrganization.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EACL,sCAAsC,EAItC,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0CAA0C,EAC1C,kDAAkD,GACnD,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,uCAAuC,CAAC;AAE3F,OAAO,EAAE,kDAAkD,EAAE,CAAC;AAoD9D,SAAS,4BAA4B,CAAC,KAIrC;IACC,IACE,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QAC9D,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO,CAAC,eAAe,EAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QACtC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAClB,qCAAqC,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,CACtE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA8B,EAC9B,eAAuB;IAEvB,MAAM,cAAc,GAA2C;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe;QACf,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,SAAS,GACb,MAAM,sCAAsC,CAAC,cAAc,CAAC,CAAC;IAE/D,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,wBAAwB;YAChC,MAAM,wCAAwC,CAC5C;gBACE,GAAG,SAAS;gBACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,eAAe;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,EACD,KAAK,CAAC,cAAc,CACrB,CAAC;IACN,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAC1B,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CACT,0EAA0E,CAC3E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,KAAK,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,CAAC;IAExC,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAG,MAAM,0BAA0B,CACzD,KAAK,EACL,eAAe,CAChB,CAAC;IAEF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,SAAS,EAAE,kBAAkB;QAC7B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,KAAK,CAAC,GAAG,EAAE,CACT,yEAAyE,CAC1E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EACJ,SAAS,EACT,OAAO,EACP,eAAe,EAAE,sBAAsB,GACxC,GAAG,cAAc,CAAC;IAEnB,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,qEAAqE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,sEAAsE,CACvE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,QAAQ;YACR,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtC,YAAY,EAAE,KAAK,CAAC,iBAAiB;SACtC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IAEd,IAAI,4BAA4B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;IACjE,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,sBAAsB;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  type EncapsulationKeyPair,\n  type SigningKeyPair,\n  signOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport type { CreateOrganizationRequest } from \"@tearleads/validators/request\";\nimport type { CreateOrganizationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport { createExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"../registration/provisionedPrincipalHistory\";\nimport {\n  buildOrganizationProvisioningArtifacts,\n  type OrganizationProvisioningArtifacts,\n  type OrganizationProvisioningArtifactsInput,\n  type ProvisionedSystemContainerSpec,\n  persistOrganizationProvisioningState,\n} from \"../registration/registerIdentity\";\nimport {\n  makeOrganizationProvisioningAttemptDurable,\n  removeNativeSubscriptionRestoreProvisioningAttempt,\n} from \"./organizationProvisioningAttempt\";\nimport { pinOrganizationReplacementResponse } from \"./organizationReplacementVerification\";\n\nexport { removeNativeSubscriptionRestoreProvisioningAttempt };\n\nexport interface CreateOrganizationApi {\n  createOrganization(\n    request: CreateOrganizationRequest,\n  ): Promise<CreateOrganizationResponse | null>;\n}\n\nexport interface CreateOrganizationInput {\n  apiClient: CreateOrganizationApi;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  /**\n   * Returns false once the identity that supplied the key pairs is no longer\n   * active. Checked before the remote create (so a stale request is never\n   * submitted) and again before local persistence: an identity switch closes\n   * or renews the captured database client, so persisting would write another\n   * identity's bootstrap — or throw — after the org already exists remotely.\n   * The caller discards the result.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /** Overrides the seeded organization profile name; see registration. */\n  organizationProfileName?: string | undefined;\n  /** Seeds verified recovery progress for the founding policy heads. */\n  primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n  /**\n   * App-owned system containers to provision atomically with the new\n   * organization (e.g. a trash bin). See registration.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /** Purged organization whose personal-org generation this replaces. */\n  replacesOrganizationId?: string | undefined;\n  /** Marks and durably replays a fresh native-subscription restore target. */\n  nativeSubscriptionRestore?: boolean | undefined;\n  /** Overrides the seeded self roster-profile nickname; see registration. */\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  /**\n   * The already-registered user creating the organization; they become its\n   * founding admin. The server independently requires this to match the\n   * authenticated session.\n   */\n  userId: string;\n}\n\nfunction isAdoptedReplacementResponse(input: {\n  creation: CreateOrganizationInput;\n  request: CreateOrganizationRequest;\n  response: CreateOrganizationResponse;\n}): boolean {\n  if (\n    input.response.organizationId === input.request.organizationId &&\n    input.response.rootContainerId === input.request.rootContainerId\n  ) {\n    return false;\n  }\n  if (\n    !input.creation.replacesOrganizationId ||\n    input.response.userId !== input.creation.userId\n  ) {\n    throw new Error(\n      \"Organization provisioning returned an unexpected organization\",\n    );\n  }\n  input.creation.log?.(\n    `Organization replacement adopted (${input.response.organizationId})`,\n  );\n  return true;\n}\n\nasync function buildOrganizationCandidate(\n  input: CreateOrganizationInput,\n  rootContainerId: string,\n): Promise<OrganizationProvisioningArtifacts | null> {\n  const artifactsInput: OrganizationProvisioningArtifactsInput = {\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  };\n  const artifacts: OrganizationProvisioningArtifacts =\n    await buildOrganizationProvisioningArtifacts(artifactsInput);\n\n  if (input.replacesOrganizationId) {\n    artifacts.replacementAuthorization =\n      await signOrganizationReplacementAuthorization(\n        {\n          ...artifacts,\n          replacesOrganizationId: input.replacesOrganizationId,\n          rootContainerId,\n          userId: input.userId,\n        },\n        input.signingKeyPair,\n      );\n  }\n\n  if (\n    input.replacesOrganizationId &&\n    input.isIdentityCurrent &&\n    !input.isIdentityCurrent()\n  ) {\n    input.log?.(\n      \"Organization creation aborted: identity changed while building artifacts\",\n    );\n    return null;\n  }\n\n  return artifacts;\n}\n\n/**\n * Provisions an additional organization for an already-registered user, reusing\n * the exact artifact-build and local-persistence path as registration\n * ({@link buildOrganizationProvisioningArtifacts} /\n * {@link persistOrganizationProvisioningState}). Unlike registration it mints a\n * fresh root container id, signs with the caller's existing identity, and needs\n * no auth challenge — the user is already authenticated.\n */\nexport async function createOrganization(\n  input: CreateOrganizationInput,\n): Promise<CreateOrganizationResponse | null> {\n  input.log?.(\"Creating organization...\");\n\n  const rootContainerId = crypto.randomUUID();\n  const candidateArtifacts = await buildOrganizationCandidate(\n    input,\n    rootContainerId,\n  );\n\n  if (!candidateArtifacts) return null;\n\n  const durableAttempt = await makeOrganizationProvisioningAttemptDurable({\n    artifacts: candidateArtifacts,\n    canStartDurableMutation: input.isIdentityCurrent,\n    dbClient: input.dbClient,\n    nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n    replacesOrganizationId: input.replacesOrganizationId,\n    rootContainerId,\n    userId: input.userId,\n  });\n  if (!durableAttempt) {\n    input.log?.(\n      \"Organization creation aborted: identity changed before saving artifacts\",\n    );\n    return null;\n  }\n  const {\n    artifacts,\n    request,\n    rootContainerId: durableRootContainerId,\n  } = durableAttempt;\n\n  if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n    input.log?.(\n      \"Organization creation aborted: identity changed before provisioning\",\n    );\n    return null;\n  }\n\n  const response = await input.apiClient.createOrganization(request);\n  if (!response) {\n    return null;\n  }\n\n  if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n    input.log?.(\n      \"Organization creation discarded: identity changed while provisioning\",\n    );\n    return null;\n  }\n\n  if (\n    input.replacesOrganizationId &&\n    !(await pinOrganizationReplacementResponse({\n      replacesOrganizationId: input.replacesOrganizationId,\n      response,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n      userId: input.userId,\n      execSql: createExecSql(input.dbClient),\n      stillCurrent: input.isIdentityCurrent,\n    }))\n  )\n    return null;\n\n  if (isAdoptedReplacementResponse({ creation: input, request, response })) {\n    // Another device authorized this winning genesis with the same identity.\n    // Its encrypted bootstrap will hydrate normally; persisting\n    // this device's losing candidate would instead create an unrelated local\n    // root. The session reset rebinds retained local data to the winning ids.\n    return response;\n  }\n\n  input.log?.(`Organization created (${response.organizationId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: durableRootContainerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    primePrincipalHistory: input.primePrincipalHistory,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}

package/workflows/organizations/currentGroupMetadataAuthority.js

@@ -1,53 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
-import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
-/** Authenticate metadata-root grants with current policies and only its cited predecessors. */
-export function createCurrentGroupMetadataContainerVerifier(input) {
-    return async (state, organizationReference) => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const authority = await loadCurrentOrganizationAuthority({
-            ...input,
-            organizationReference,
-        });
-        await createSelectedCurrentGroupMetadataContainerVerifier({
-            authority,
-            organizationId: input.organizationId,
-            stillCurrent: input.stillCurrent,
-        })(state, organizationReference);
-    };
-}
-/** Reuse one mutation's verified authority without broadening its lease or scope. */
-export function createSelectedCurrentGroupMetadataContainerVerifier(input) {
-    return async (state, organizationReference) => {
-        const { authority } = input;
-        const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();
-        assertProjectionVerificationCurrent(stillCurrent);
-        if (organizationReference) {
-            if (organizationReference.principalType !== "organization" ||
-                organizationReference.principalId !== input.organizationId)
-                throw new KeyingVerificationError("object_mismatch", "Current policy reference is outside its scope");
-            if (!principalHeadMatchesReference(authority.directory.policy.state, organizationReference))
-                throw new ProjectionDependencyUnavailableError("Metadata root belongs to a changed organization directory");
-        }
-        const { adminGroupId, memberGroupId } = authority.descriptor;
-        const citation = (groupId) => state.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === groupId);
-        const admins = await authority.readGroup(adminGroupId, citation(adminGroupId));
-        const members = await authority.readGroup(memberGroupId, citation(memberGroupId));
-        assertMetadataRootBinding({
-            organizationId: input.organizationId,
-            authority: {
-                descriptor: authority.descriptor,
-                adminGroupId,
-                memberGroupId,
-                adminPolicy: admins.policy,
-            },
-            members,
-            state,
-        });
-        assertProjectionVerificationCurrent(() => stillCurrent() && admins.stillCurrent() && members.stillCurrent());
-    };
-}
-//# sourceMappingURL=currentGroupMetadataAuthority.js.map

package/workflows/organizations/currentGroupMetadataAuthority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"currentGroupMetadataAuthority.js","sourceRoot":"","sources":["currentGroupMetadataAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,+FAA+F;AAC/F,MAAM,UAAU,2CAA2C,CACzD,KAGC;IAED,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;YACvD,GAAG,KAAK;YACR,qBAAqB;SACtB,CAAC,CAAC;QACH,MAAM,mDAAmD,CAAC;YACxD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mDAAmD,CAAC,KAMnE;IACC,OAAO,KAAK,EACV,KAAmC,EACnC,qBAA+C,EAChC,EAAE;QACjB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAC5B,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IACE,qBAAqB,CAAC,aAAa,KAAK,cAAc;gBACtD,qBAAqB,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc;gBAE1D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;YACJ,IACE,CAAC,6BAA6B,CAC5B,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAChC,qBAAqB,CACtB;gBAED,MAAM,IAAI,oCAAoC,CAC5C,2DAA2D,CAC5D,CAAC;QACN,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACjE,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CACtC,YAAY,EACZ,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CACvC,aAAa,EACb,QAAQ,CAAC,aAAa,CAAC,CACxB,CAAC;QACF,yBAAyB,CAAC;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE;gBACT,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,YAAY;gBACZ,aAAa;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;YACD,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,YAAY,EAAE,CACxE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\n\n/** Authenticate metadata-root grants with current policies and only its cited predecessors. */\nexport function createCurrentGroupMetadataContainerVerifier(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  >,\n) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const authority = await loadCurrentOrganizationAuthority({\n      ...input,\n      organizationReference,\n    });\n    await createSelectedCurrentGroupMetadataContainerVerifier({\n      authority,\n      organizationId: input.organizationId,\n      stillCurrent: input.stillCurrent,\n    })(state, organizationReference);\n  };\n}\n\n/** Reuse one mutation's verified authority without broadening its lease or scope. */\nexport function createSelectedCurrentGroupMetadataContainerVerifier(input: {\n  readonly authority: Awaited<\n    ReturnType<typeof loadCurrentOrganizationAuthority>\n  >;\n  readonly organizationId: string;\n  readonly stillCurrent: () => boolean;\n}) {\n  return async (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead,\n  ): Promise<void> => {\n    const { authority } = input;\n    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent();\n    assertProjectionVerificationCurrent(stillCurrent);\n    if (organizationReference) {\n      if (\n        organizationReference.principalType !== \"organization\" ||\n        organizationReference.principalId !== input.organizationId\n      )\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Current policy reference is outside its scope\",\n        );\n      if (\n        !principalHeadMatchesReference(\n          authority.directory.policy.state,\n          organizationReference,\n        )\n      )\n        throw new ProjectionDependencyUnavailableError(\n          \"Metadata root belongs to a changed organization directory\",\n        );\n    }\n    const { adminGroupId, memberGroupId } = authority.descriptor;\n    const citation = (groupId: string) =>\n      state.referencedPrincipalHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === groupId,\n      );\n    const admins = await authority.readGroup(\n      adminGroupId,\n      citation(adminGroupId),\n    );\n    const members = await authority.readGroup(\n      memberGroupId,\n      citation(memberGroupId),\n    );\n    assertMetadataRootBinding({\n      organizationId: input.organizationId,\n      authority: {\n        descriptor: authority.descriptor,\n        adminGroupId,\n        memberGroupId,\n        adminPolicy: admins.policy,\n      },\n      members,\n      state,\n    });\n    assertProjectionVerificationCurrent(\n      () => stillCurrent() && admins.stillCurrent() && members.stillCurrent(),\n    );\n  };\n}\n"]}

package/workflows/organizations/currentGroupMutationReferences.js

@@ -1,35 +0,0 @@
-import { selectPrincipalPolicyCurrentPredecessorReferences, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-/** Select only this path's old citations, preserving the authored membership. */
-export async function resolveCurrentGroupMutationReferences(input) {
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    const references = structuredClone(input.references);
-    const select = (current, predecessor, selected) => selectPrincipalPolicyCurrentPredecessorReferences({
-        current,
-        predecessor,
-        references: selected,
-    });
-    // Normalize and bound the entire request before any per-reference I/O.
-    const initial = select(input.current, input.predecessor, references);
-    if (initial.ok)
-        return initial.value;
-    if (initial.error.code !== "missing_dependency")
-        throw initial.error;
-    let current = input.current;
-    const selected = [];
-    for (const reference of references) {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        selected.push(reference);
-        let result = select(current, input.predecessor, selected);
-        if (!result.ok && result.error.code === "missing_dependency") {
-            const predecessor = await input.readPredecessorReference(reference);
-            assertProjectionVerificationCurrent(input.stillCurrent);
-            result = select(current, predecessor, selected);
-        }
-        if (!result.ok)
-            throw result.error;
-        current = result.value;
-    }
-    return current;
-}
-//# sourceMappingURL=currentGroupMutationReferences.js.map

package/workflows/organizations/currentGroupMutationReferences.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"currentGroupMutationReferences.js","sourceRoot":"","sources":["currentGroupMutationReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iDAAiD,GAElD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CACb,OAAuC,EACvC,WAA2C,EAC3C,QAA4C,EAC5C,EAAE,CACF,iDAAiD,CAAC;QAChD,OAAO;QACP,WAAW;QACX,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;IACL,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrE,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import {\n  type ReferencedPrincipalHead,\n  selectPrincipalPolicyCurrentPredecessorReferences,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\n\n/** Select only this path's old citations, preserving the authored membership. */\nexport async function resolveCurrentGroupMutationReferences(input: {\n  readonly current: VerifiedPrincipalPolicyCurrent;\n  readonly predecessor: VerifiedPrincipalPolicyCurrent;\n  readonly references: readonly ReferencedPrincipalHead[];\n  readonly readPredecessorReference: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<VerifiedPrincipalPolicyCurrent>;\n  readonly stillCurrent: () => boolean;\n}): Promise<VerifiedPrincipalPolicyCurrent> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const references = structuredClone(input.references);\n  const select = (\n    current: VerifiedPrincipalPolicyCurrent,\n    predecessor: VerifiedPrincipalPolicyCurrent,\n    selected: readonly ReferencedPrincipalHead[],\n  ) =>\n    selectPrincipalPolicyCurrentPredecessorReferences({\n      current,\n      predecessor,\n      references: selected,\n    });\n  // Normalize and bound the entire request before any per-reference I/O.\n  const initial = select(input.current, input.predecessor, references);\n  if (initial.ok) return initial.value;\n  if (initial.error.code !== \"missing_dependency\") throw initial.error;\n  let current = input.current;\n  const selected: ReferencedPrincipalHead[] = [];\n  for (const reference of references) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    selected.push(reference);\n    let result = select(current, input.predecessor, selected);\n    if (!result.ok && result.error.code === \"missing_dependency\") {\n      const predecessor = await input.readPredecessorReference(reference);\n      assertProjectionVerificationCurrent(input.stillCurrent);\n      result = select(current, predecessor, selected);\n    }\n    if (!result.ok) throw result.error;\n    current = result.value;\n  }\n  return current;\n}\n"]}

package/workflows/organizations/currentGroupPolicyMutationContext.js

@@ -1,79 +0,0 @@
-import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
-import { requireOrganizationGroupHead } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { createSelectedCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
-import { loadCurrentOrganizationMutationAuthority } from "./currentOrganizationMutationAuthority.js";
-import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
-import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
-/** Exact current directory, strict Admins and group evidence for one mutation. */
-export async function loadCurrentGroupPolicyMutationContext(input) {
-    input = { ...input };
-    const { authority, currentOrgAdminUserIds } = await loadCurrentOrganizationMutationAuthority(input);
-    const group = await authority.readGroup(input.groupId);
-    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();
-    assertProjectionVerificationCurrent(stillCurrent);
-    assertGroupMetadataBinding(group.current, authority.descriptor);
-    requireSignerCanManageGroup(group.current, currentOrgAdminUserIds, input.signerUserId);
-    await advanceKeyingCheckpointsAtomically({
-        access: [],
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        policies: [...group.dependencies, group.policy],
-        stillCurrent,
-    });
-    assertProjectionVerificationCurrent(stillCurrent);
-    const adminHead = requireOrganizationGroupHead(authority.descriptor, authority.descriptor.adminGroupId);
-    const externalAuthority = {
-        currentHead: adminHead,
-        states: [
-            { head: adminHead, projection: authority.admins.policy.projection },
-        ],
-    };
-    // A reused citation keeps the lifetime of the read that produced it.
-    const references = new Map();
-    return {
-        adminGroupId: authority.descriptor.adminGroupId,
-        adminCurrent: authority.admins,
-        currentPolicy: group.current,
-        verifiedCurrentPolicy: group.policy,
-        verifyMetadataContainer: createSelectedCurrentGroupMetadataContainerVerifier({
-            authority,
-            organizationId: input.organizationId,
-            stillCurrent,
-        }),
-        currentOrgAdminUserIds,
-        externalAuthority,
-        isOrganizationAdminsGroup: input.groupId === authority.descriptor.adminGroupId,
-        localPolicyCheckpoint: group.policy.checkpoint,
-        memberGroupId: authority.descriptor.memberGroupId,
-        organizationDescriptor: authority.descriptor,
-        organizationCurrent: authority.directory,
-        async readPredecessorReference(reference) {
-            assertProjectionVerificationCurrent(stillCurrent);
-            const owned = structuredClone(reference);
-            const key = serializeKeyingCanonicalJson({ ...owned });
-            let pending = references.get(key);
-            if (!pending) {
-                // Keep at most one bounded selection's citations, even across many paths.
-                if (references.size === 128) {
-                    const oldest = references.keys().next().value;
-                    if (oldest !== undefined)
-                        references.delete(oldest);
-                }
-                pending = authority.readGroup(input.groupId, owned);
-                references.set(key, pending);
-            }
-            const selected = await pending.catch((error) => {
-                if (references.get(key) === pending)
-                    references.delete(key);
-                throw error;
-            });
-            assertProjectionVerificationCurrent(stillCurrent);
-            assertProjectionVerificationCurrent(selected.stillCurrent);
-            return selected.policy;
-        },
-        stillCurrent,
-    };
-}
-//# sourceMappingURL=currentGroupPolicyMutationContext.js.map

package/workflows/organizations/currentGroupPolicyMutationContext.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"currentGroupPolicyMutationContext.js","sourceRoot":"","sources":["currentGroupPolicyMutationContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AAGrG,OAAO,EAAE,mDAAmD,EAAE,MAAM,iCAAiC,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAY3D;IACC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACrB,MAAM,EAAE,SAAS,EAAE,sBAAsB,EAAE,GACzC,MAAM,wCAAwC,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAChE,2BAA2B,CACzB,KAAK,CAAC,OAAO,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;QAC/C,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,4BAA4B,CAC5C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CAAC,YAAY,CAClC,CAAC;IACF,MAAM,iBAAiB,GAAqC;QAC1D,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;SACpE;KACF,CAAC;IACF,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAMvB,CAAC;IACJ,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY;QAC/C,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,aAAa,EAAE,KAAK,CAAC,OAAO;QAC5B,qBAAqB,EAAE,KAAK,CAAC,MAAM;QACnC,uBAAuB,EACrB,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC;QACJ,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB,EACvB,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,UAAU,CAAC,YAAY;QACrD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QAC9C,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,aAAa;QACjD,sBAAsB,EAAE,SAAS,CAAC,UAAU;QAC5C,mBAAmB,EAAE,SAAS,CAAC,SAAS;QACxC,KAAK,CAAC,wBAAwB,CAAC,SAAkC;YAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,IAAI,UAAU,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;oBAC9C,IAAI,MAAM,KAAK,SAAS;wBAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACpD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACtD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;oBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,YAAY;KACb,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyExternalAuthority,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { requireOrganizationGroupHead } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { createRuntimePrincipalPolicyCurrentResolver } from \"../principals/runtimePolicyRecovery\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\nimport { loadCurrentOrganizationMutationAuthority } from \"./currentOrganizationMutationAuthority\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\n\n/** Exact current directory, strict Admins and group evidence for one mutation. */\nexport async function loadCurrentGroupPolicyMutationContext(input: {\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly resolveCurrentPolicy: NonNullable<\n    ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>\n  >;\n  readonly recoverPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<void>;\n  readonly stillCurrent: () => boolean;\n}) {\n  input = { ...input };\n  const { authority, currentOrgAdminUserIds } =\n    await loadCurrentOrganizationMutationAuthority(input);\n  const group = await authority.readGroup(input.groupId);\n  const stillCurrent = () =>\n    input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();\n  assertProjectionVerificationCurrent(stillCurrent);\n  assertGroupMetadataBinding(group.current, authority.descriptor);\n  requireSignerCanManageGroup(\n    group.current,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [...group.dependencies, group.policy],\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const adminHead = requireOrganizationGroupHead(\n    authority.descriptor,\n    authority.descriptor.adminGroupId,\n  );\n  const externalAuthority: PrincipalPolicyExternalAuthority = {\n    currentHead: adminHead,\n    states: [\n      { head: adminHead, projection: authority.admins.policy.projection },\n    ],\n  };\n  // A reused citation keeps the lifetime of the read that produced it.\n  const references = new Map<\n    string,\n    Promise<{\n      readonly policy: VerifiedPrincipalPolicyCurrent;\n      readonly stillCurrent: () => boolean;\n    }>\n  >();\n  return {\n    adminGroupId: authority.descriptor.adminGroupId,\n    adminCurrent: authority.admins,\n    currentPolicy: group.current,\n    verifiedCurrentPolicy: group.policy,\n    verifyMetadataContainer:\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup:\n      input.groupId === authority.descriptor.adminGroupId,\n    localPolicyCheckpoint: group.policy.checkpoint,\n    memberGroupId: authority.descriptor.memberGroupId,\n    organizationDescriptor: authority.descriptor,\n    organizationCurrent: authority.directory,\n    async readPredecessorReference(reference: ReferencedPrincipalHead) {\n      assertProjectionVerificationCurrent(stillCurrent);\n      const owned = structuredClone(reference);\n      const key = serializeKeyingCanonicalJson({ ...owned });\n      let pending = references.get(key);\n      if (!pending) {\n        // Keep at most one bounded selection's citations, even across many paths.\n        if (references.size === 128) {\n          const oldest = references.keys().next().value;\n          if (oldest !== undefined) references.delete(oldest);\n        }\n        pending = authority.readGroup(input.groupId, owned);\n        references.set(key, pending);\n      }\n      const selected = await pending.catch((error: unknown) => {\n        if (references.get(key) === pending) references.delete(key);\n        throw error;\n      });\n      assertProjectionVerificationCurrent(stillCurrent);\n      assertProjectionVerificationCurrent(selected.stillCurrent);\n      return selected.policy;\n    },\n    stillCurrent,\n  };\n}\n"]}

package/workflows/organizations/currentOrganizationGroupNames.js

@@ -1,72 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
-import { saveOrganizationGroupDisplayNames } from "../../data/persistence/organizations/organizationGroupNamePersistence.js";
-import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
-import { GroupMetadataUnreadableError } from "./groupMetadataAccess.js";
-import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
-import { readGroupPolicyPayloadName, } from "./principalPolicyRequest.js";
-/** Names consume verified current artifacts; paged recovery retains their separate evidence. */
-export async function hydrateCurrentOrganizationGroupNames(input) {
-    const authority = await loadCurrentOrganizationAuthority(input);
-    const nameInput = {
-        ...input,
-        readEncryptedName: input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,
-    };
-    const names = [];
-    const unreadable = new Set();
-    const lifetimes = [authority.stillCurrent];
-    for (const group of input.directory.groups) {
-        const head = authority.descriptor.groupHeads.find((head) => head.principalId === group.groupId);
-        if (!head || head.stateHash !== group.currentState?.stateHash)
-            throw new Error("Group listing does not match the signed directory");
-        const verified = await authority.readGroup(group.groupId);
-        lifetimes.push(verified.stillCurrent);
-        assertGroupMetadataBinding(verified.current, authority.descriptor);
-        const name = await readCurrentGroupName(nameInput, verified.current);
-        if (name === null)
-            unreadable.add(group.groupId);
-        else
-            names.push({ groupId: group.groupId, name, stateHash: head.stateHash });
-    }
-    const stillCurrent = () => input.stillCurrent() && lifetimes.every((current) => current());
-    assertProjectionVerificationCurrent(stillCurrent);
-    // Match the authority admission performed by the full-bundle path. Group
-    // name reads alone do not move group checkpoints.
-    await advanceKeyingCheckpointsAtomically({
-        access: [],
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        policies: [authority.directory.policy, authority.admins.policy],
-        stillCurrent,
-    });
-    await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });
-    assertProjectionVerificationCurrent(stillCurrent);
-    const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));
-    return {
-        ...input.directory,
-        groups: input.directory.groups.map((group) => ({
-            ...group,
-            name: byId.get(group.groupId) ?? "",
-            nameUnreadable: unreadable.has(group.groupId),
-        })),
-    };
-}
-async function readCurrentGroupName(input, current) {
-    try {
-        return await readGroupPolicyPayloadName(current, input.readEncryptedName);
-    }
-    catch (error) {
-        if (!(error instanceof GroupMetadataUnreadableError))
-            throw error;
-        await input.reportSecurityIncident(new KeyingVerificationError("invalid_shape", "Signed group name does not open under the cited metadata key"), {
-            evidenceHashes: { stateHash: current.currentState.stateHash },
-            objectId: current.currentState.principalId,
-            objectKind: "principal",
-            operation: "organization.groupName",
-            organizationId: input.organizationId,
-        });
-        return null;
-    }
-}
-//# sourceMappingURL=currentOrganizationGroupNames.js.map

package/workflows/organizations/currentOrganizationGroupNames.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"currentOrganizationGroupNames.js","sourceRoot":"","sources":["currentOrganizationGroupNames.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAE1H,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAEL,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAclC,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAY;IAEZ,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG;QAChB,GAAG,KAAK;QACR,iBAAiB,EACf,KAAK,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,iBAAiB;KACxE,CAAC;IACF,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAsB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;YAE/C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/D,YAAY;KACb,CAAC,CAAC;IACH,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAY,EACZ,OAA6C;IAE7C,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE;YAC7D,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW;YAC1C,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { saveOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\ntype Input = Parameters<typeof loadCurrentOrganizationAuthority>[0] & {\n  readonly directory: OrganizationDirectoryAndGroups;\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly createCurrentNameReader?:\n    | ((\n        authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>,\n      ) => GroupPolicyNameReader)\n    | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n};\n\n/** Names consume verified current artifacts; paged recovery retains their separate evidence. */\nexport async function hydrateCurrentOrganizationGroupNames(\n  input: Input,\n): Promise<OrganizationDirectoryAndGroups> {\n  const authority = await loadCurrentOrganizationAuthority(input);\n  const nameInput = {\n    ...input,\n    readEncryptedName:\n      input.createCurrentNameReader?.(authority) ?? input.readEncryptedName,\n  };\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadable = new Set<string>();\n  const lifetimes: (() => boolean)[] = [authority.stillCurrent];\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await authority.readGroup(group.groupId);\n    lifetimes.push(verified.stillCurrent);\n    assertGroupMetadataBinding(verified.current, authority.descriptor);\n    const name = await readCurrentGroupName(nameInput, verified.current);\n    if (name === null) unreadable.add(group.groupId);\n    else\n      names.push({ groupId: group.groupId, name, stateHash: head.stateHash });\n  }\n  const stillCurrent = () =>\n    input.stillCurrent() && lifetimes.every((current) => current());\n  assertProjectionVerificationCurrent(stillCurrent);\n  // Match the authority admission performed by the full-bundle path. Group\n  // name reads alone do not move group checkpoints.\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [authority.directory.policy, authority.admins.policy],\n    stillCurrent,\n  });\n  await saveOrganizationGroupDisplayNames({ ...input, names, stillCurrent });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadable.has(group.groupId),\n    })),\n  };\n}\n\nasync function readCurrentGroupName(\n  input: Input,\n  current: Parameters<GroupPolicyNameReader>[0],\n) {\n  try {\n    return await readGroupPolicyPayloadName(current, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: current.currentState.stateHash },\n        objectId: current.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n"]}

package/workflows/organizations/currentOrganizationMutationAuthority.js

@@ -1,16 +0,0 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { organizationAdminSignerUserIds } from "../../data/principals/principalPolicyAdminSigners.js";
-import { loadCurrentOrganizationAuthority } from "./currentOrganizationAuthority.js";
-/** Resolve uncertain work and verify the signing administrator before any mutation pins. */
-export async function loadCurrentOrganizationMutationAuthority(input) {
-    const owned = { ...input };
-    assertProjectionVerificationCurrent(owned.stillCurrent);
-    await owned.recoverPendingPrincipalMutation(owned.organizationId);
-    assertProjectionVerificationCurrent(owned.stillCurrent);
-    const authority = await loadCurrentOrganizationAuthority(owned);
-    const currentOrgAdminUserIds = organizationAdminSignerUserIds(authority.admins.policy);
-    if (!currentOrgAdminUserIds.includes(owned.signerUserId))
-        throw new Error("Organization admin authority is required");
-    return { authority, currentOrgAdminUserIds };
-}
-//# sourceMappingURL=currentOrganizationMutationAuthority.js.map

package/workflows/organizations/currentOrganizationMutationAuthority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"currentOrganizationMutationAuthority.js","sourceRoot":"","sources":["currentOrganizationMutationAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAQC;IAED,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3B,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,+BAA+B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,sBAAsB,GAAG,8BAA8B,CAC3D,SAAS,CAAC,MAAM,CAAC,MAAM,CACxB,CAAC;IACF,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { organizationAdminSignerUserIds } from \"../../data/principals/principalPolicyAdminSigners\";\nimport { loadCurrentOrganizationAuthority } from \"./currentOrganizationAuthority\";\n\n/** Resolve uncertain work and verify the signing administrator before any mutation pins. */\nexport async function loadCurrentOrganizationMutationAuthority(\n  input: Omit<\n    Parameters<typeof loadCurrentOrganizationAuthority>[0],\n    \"organizationReference\"\n  > & {\n    readonly signerUserId: string;\n    readonly recoverPendingPrincipalMutation: (\n      organizationId: string,\n    ) => Promise<void>;\n  },\n) {\n  const owned = { ...input };\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  await owned.recoverPendingPrincipalMutation(owned.organizationId);\n  assertProjectionVerificationCurrent(owned.stillCurrent);\n  const authority = await loadCurrentOrganizationAuthority(owned);\n  const currentOrgAdminUserIds = organizationAdminSignerUserIds(\n    authority.admins.policy,\n  );\n  if (!currentOrgAdminUserIds.includes(owned.signerUserId))\n    throw new Error(\"Organization admin authority is required\");\n  return { authority, currentOrgAdminUserIds };\n}\n"]}

package/workflows/organizations/currentOrganizationMutationRetention.js

@@ -1,64 +0,0 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { scopedGroupHistoryProtection } from "../../data/principals/principalHistoryScopeProtection.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
-import { captureAcknowledgedPrincipalPredecessor } from "../principals/acknowledgedPrincipalPredecessor.js";
-import { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
-/** Couple directory acknowledgements to any newly created group under the same lease. */
-export async function createCurrentOrganizationMutationRetention(input) {
-    const predecessor = await captureAcknowledgedPrincipalPredecessor({
-        ...input.directoryRecovery,
-        execSql: input.runtime.infra.execSql,
-        organizationId: input.organizationId,
-        stillCurrent: input.stillCurrent,
-    });
-    const retain = async (entries) => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        await retainAcknowledgedPrincipalCurrents({
-            execSql: input.runtime.infra.execSql,
-            organizationId: input.organizationId,
-            entries,
-            stillCurrent: input.stillCurrent,
-        });
-    };
-    return {
-        retainDirectory: (request, response) => retain([
-            { predecessor, request, response, recovery: input.directoryRecovery },
-        ]),
-        retainCreatedGroup: (receipt) => {
-            const adminHead = {
-                ...principalPolicyReferenceFromBundle(input.authority.admins.current),
-                principalType: "group",
-            };
-            return retain([
-                {
-                    initialGroup: true,
-                    predecessor: null,
-                    request: receipt.request,
-                    response: receipt.response,
-                    recovery: {
-                        historyReader: input.historyReader,
-                        expectedHead: principalPolicyReferenceFromBundle(receipt.response),
-                        protection: scopedGroupHistoryProtection(input.protection, input.organizationId, input.authority.descriptor.adminGroupId),
-                        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-                        loadExternalAuthority: async () => ({
-                            currentHead: adminHead,
-                            states: [
-                                {
-                                    head: adminHead,
-                                    projection: input.authority.admins.policy.projection,
-                                },
-                            ],
-                        }),
-                    },
-                },
-                {
-                    predecessor,
-                    request: receipt.organizationRequest,
-                    response: receipt.organizationResponse,
-                    recovery: input.directoryRecovery,
-                },
-            ]);
-        },
-    };
-}
-//# sourceMappingURL=currentOrganizationMutationRetention.js.map