@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/groupPolicyRequests.js

@@ -1,181 +0,0 @@
-import { generateKemSeedAndKeyPair, KeyingVerificationError, toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { principalSecretKeyMatchesState } from "../../data/principals/principalKeyValidation.js";
-import { isDirectGroupAdmin } from "./groupMutationAuthorization.js";
-import { withVerifiedGroupMutation, } from "./groupPolicyMutationEvidence.js";
-import { rewrapProjectionMemberEnvelopes, toRecipientEntries, } from "./principalPolicyRecipients.js";
-import { signedGroupPolicyRequest, userProjectionMember, } from "./principalPolicyRequest.js";
-/**
- * The signed policy commits both the group's public key and the member
- * envelopes that are supposed to wrap its secret. An envelope that unwraps to
- * a different secret means a prior admin (or the server) published a policy
- * whose envelopes do not match its signed key. Rotating repairs the group, but
- * the mismatch is evidence and is recorded before the repair proceeds.
- */
-async function reportPrincipalEnvelopeMismatch(input) {
-    const state = input.currentPolicy.currentState;
-    await input.reportSecurityIncident?.(new KeyingVerificationError("object_mismatch", "Group member envelope does not unwrap the signed principal key"), {
-        evidenceHashes: {
-            principalKeyFingerprint: state.keyFingerprint,
-            principalStateHash: state.stateHash,
-        },
-        objectId: state.principalId,
-        objectKind: "principal",
-        operation: "group.policy.envelope_mismatch",
-    });
-}
-function hasAdmin(projection) {
-    return projection.some((member) => member.role === "admin");
-}
-function requireExternalAuthority(authority) {
-    if (!authority) {
-        throw new Error("External principal authority could not be verified");
-    }
-    return authority;
-}
-async function buildRotatedKeyGroupPolicyRequest(input, projection, users, grants = input.currentPolicy.currentGrants) {
-    const groupKem = generateKemSeedAndKeyPair();
-    const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
-        projection,
-        secretKey: groupKem.secretKey,
-        users,
-    });
-    return signedGroupPolicyRequest({
-        currentPolicy: input.currentPolicy,
-        encapsulationPublicKey: bytesToBase64(groupKem.publicKey),
-        externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
-            ? null
-            : requireExternalAuthority(input.externalAuthority).currentHead,
-        keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,
-        keyFingerprint: await toFingerprint(groupKem.publicKey),
-        grants,
-        memberEnvelopes,
-        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
-        principalId: input.currentPolicy.currentState.principalId,
-        projection,
-        signedAt: new Date().toISOString(),
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-}
-async function buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey) {
-    const groupSecretKey = await unwrapDek(toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes), input.currentUserSecretKey);
-    if (!(await principalSecretKeyMatchesState(groupSecretKey, input.currentPolicy.currentState))) {
-        await reportPrincipalEnvelopeMismatch(input);
-        return buildRotatedKeyGroupPolicyRequest(input, projection, [
-            ...input.currentUsers,
-            input.targetUser,
-        ]);
-    }
-    const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [
-        input.targetUser.encapsulationPublicKey,
-    ]);
-    if (!targetEnvelope) {
-        throw new Error("Failed to wrap group key for target user");
-    }
-    const memberEnvelopes = [
-        ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter((envelope) => envelope.userId !== targetKey),
-        {
-            userId: input.targetUser.userId,
-            memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,
-            kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),
-            wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),
-        },
-    ];
-    return signedGroupPolicyRequest({
-        currentPolicy: input.currentPolicy,
-        encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
-        externalAuthority: null,
-        keyEpoch: input.currentPolicy.currentState.keyEpoch,
-        keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
-        grants: input.currentPolicy.currentGrants,
-        memberEnvelopes,
-        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
-        principalId: input.currentPolicy.currentState.principalId,
-        projection,
-        signedAt: new Date().toISOString(),
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-}
-export async function buildAddGroupUserPolicyRequest(input) {
-    input = {
-        ...input,
-        currentUsers: structuredClone(input.currentUsers),
-        currentUserSecretKey: input.currentUserSecretKey.slice(),
-        targetUser: structuredClone(input.targetUser),
-    };
-    try {
-        return await withVerifiedGroupMutation(input, async (input) => {
-            const targetKey = input.targetUser.userId;
-            const currentProjection = input.currentPolicy.currentProjection;
-            if (currentProjection.some((member) => member.userId === targetKey)) {
-                throw new Error("User is already a group member");
-            }
-            const projection = [
-                ...currentProjection,
-                userProjectionMember(input.targetUser.userId, input.isOrganizationAdminsGroup ? "admin" : "member"),
-            ];
-            return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
-                ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)
-                : buildRotatedKeyGroupPolicyRequest(input, projection, [
-                    ...input.currentUsers,
-                    input.targetUser,
-                ]);
-        });
-    }
-    finally {
-        input.currentUserSecretKey.fill(0);
-    }
-}
-export async function buildRemoveGroupUserPolicyRequest(input) {
-    input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };
-    return withVerifiedGroupMutation(input, async (input) => {
-        const key = input.removedUserId;
-        const projection = input.currentPolicy.currentProjection.filter((member) => member.userId !== key);
-        if (projection.length === input.currentPolicy.currentProjection.length) {
-            throw new Error("User is not a group member");
-        }
-        if (hasAdmin(input.currentPolicy.currentProjection) &&
-            !hasAdmin(projection)) {
-            throw new Error("Cannot remove the last group admin");
-        }
-        return buildRotatedKeyGroupPolicyRequest(input, projection, input.remainingUsers);
-    });
-}
-export async function buildGroupAccessSetShrinkPolicyRequest(input) {
-    input = { ...input, currentUsers: structuredClone(input.currentUsers) };
-    return withVerifiedGroupMutation(input, async (input) => {
-        return buildRotatedKeyGroupPolicyRequest(input, [...input.currentPolicy.currentProjection], input.currentUsers, input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.revokedContainerId));
-    });
-}
-/** Signs a complete successor grant projection without rotating group key material. */
-export async function buildSetGroupContainerGrantPolicyRequest(input) {
-    return withVerifiedGroupMutation(input, async (input) => {
-        const grants = [
-            ...input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.containerId),
-            { accessLevel: input.accessLevel, containerId: input.containerId },
-        ];
-        return signedGroupPolicyRequest({
-            currentPolicy: input.currentPolicy,
-            encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
-            externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
-                ? null
-                : requireExternalAuthority(input.externalAuthority).currentHead,
-            keyEpoch: input.currentPolicy.currentState.keyEpoch,
-            keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
-            grants,
-            memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,
-            payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
-            principalId: input.currentPolicy.currentState.principalId,
-            projection: input.currentPolicy.currentProjection,
-            signedAt: new Date().toISOString(),
-            signerUserId: input.signerUserId,
-            signingFingerprint: input.signingFingerprint,
-            signingKeyPair: input.signingKeyPair,
-        });
-    });
-}
-//# sourceMappingURL=groupPolicyRequests.js.map

package/workflows/organizations/groupPolicyRequests.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE;QACxD,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG;gBACjB,GAAG,iBAAiB;gBACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;aACF,CAAC;YAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;gBAChE,CAAC,CAAC,yCAAyC,CACvC,KAAK,EACL,UAAU,EACV,SAAS,CACV;gBACH,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;oBACnD,GAAG,KAAK,CAAC,YAAY;oBACrB,KAAK,CAAC,UAAU;iBACjB,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;IAC5E,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IACxE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG;YACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;YACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SACnE,CAAC;QACF,OAAO,wBAAwB,CAAC;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;YACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;gBACC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;YACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;YACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;YAC/D,MAAM;YACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;YACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;YAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;YACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  toFingerprint,\n  unwrapDek,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalContainerGrantRequest,\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\nimport { isDirectGroupAdmin } from \"./groupMutationAuthorization\";\nimport {\n  type BuildGroupMembershipMutationInput,\n  withVerifiedGroupMutation,\n} from \"./groupPolicyMutationEvidence\";\nimport {\n  rewrapProjectionMemberEnvelopes,\n  toRecipientEntries,\n} from \"./principalPolicyRecipients\";\nimport {\n  signedGroupPolicyRequest,\n  userProjectionMember,\n} from \"./principalPolicyRequest\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n  readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly targetUser: TrustedUserIdentity;\n};\n\n/**\n * The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n */\nasync function reportPrincipalEnvelopeMismatch(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n  const state = input.currentPolicy.currentState;\n  await input.reportSecurityIncident?.(\n    new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Group member envelope does not unwrap the signed principal key\",\n    ),\n    {\n      evidenceHashes: {\n        principalKeyFingerprint: state.keyFingerprint,\n        principalStateHash: state.stateHash,\n      },\n      objectId: state.principalId,\n      objectKind: \"principal\",\n      operation: \"group.policy.envelope_mismatch\",\n    },\n  );\n}\n\nfunction hasAdmin(\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n  return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n  authority: PrincipalPolicyExternalAuthority | undefined,\n): PrincipalPolicyExternalAuthority {\n  if (!authority) {\n    throw new Error(\"External principal authority could not be verified\");\n  }\n  return authority;\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n  input: BuildGroupMembershipMutationInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  users: ReadonlyArray<TrustedUserIdentity>,\n  grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: groupKem.secretKey,\n    users,\n  });\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n    externalAuthority: isDirectGroupAdmin(\n      input.currentPolicy,\n      input.signerUserId,\n    )\n      ? null\n      : requireExternalAuthority(input.externalAuthority).currentHead,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n    keyFingerprint: await toFingerprint(groupKem.publicKey),\n    grants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupSecretKey = await unwrapDek(\n    toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n    input.currentUserSecretKey,\n  );\n  if (\n    !(await principalSecretKeyMatchesState(\n      groupSecretKey,\n      input.currentPolicy.currentState,\n    ))\n  ) {\n    await reportPrincipalEnvelopeMismatch(input);\n    return buildRotatedKeyGroupPolicyRequest(input, projection, [\n      ...input.currentUsers,\n      input.targetUser,\n    ]);\n  }\n  const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n    input.targetUser.encapsulationPublicKey,\n  ]);\n\n  if (!targetEnvelope) {\n    throw new Error(\"Failed to wrap group key for target user\");\n  }\n\n  const memberEnvelopes = [\n    ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n      (envelope) => envelope.userId !== targetKey,\n    ),\n    {\n      userId: input.targetUser.userId,\n      memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n    },\n  ];\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey:\n      input.currentPolicy.currentState.encapsulationPublicKey,\n    externalAuthority: null,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch,\n    keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n    grants: input.currentPolicy.currentGrants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n  input = {\n    ...input,\n    currentUsers: structuredClone(input.currentUsers),\n    currentUserSecretKey: input.currentUserSecretKey.slice(),\n    targetUser: structuredClone(input.targetUser),\n  };\n  try {\n    return await withVerifiedGroupMutation(input, async (input) => {\n      const targetKey = input.targetUser.userId;\n      const currentProjection = input.currentPolicy.currentProjection;\n      if (currentProjection.some((member) => member.userId === targetKey)) {\n        throw new Error(\"User is already a group member\");\n      }\n\n      const projection = [\n        ...currentProjection,\n        userProjectionMember(\n          input.targetUser.userId,\n          input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n        ),\n      ];\n\n      return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n        ? buildDirectAdminAddGroupUserPolicyRequest(\n            input,\n            projection,\n            targetKey,\n          )\n        : buildRotatedKeyGroupPolicyRequest(input, projection, [\n            ...input.currentUsers,\n            input.targetUser,\n          ]);\n    });\n  } finally {\n    input.currentUserSecretKey.fill(0);\n  }\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly removedUserId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };\n  return withVerifiedGroupMutation(input, async (input) => {\n    const key = input.removedUserId;\n    const projection = input.currentPolicy.currentProjection.filter(\n      (member) => member.userId !== key,\n    );\n\n    if (projection.length === input.currentPolicy.currentProjection.length) {\n      throw new Error(\"User is not a group member\");\n    }\n\n    if (\n      hasAdmin(input.currentPolicy.currentProjection) &&\n      !hasAdmin(projection)\n    ) {\n      throw new Error(\"Cannot remove the last group admin\");\n    }\n\n    return buildRotatedKeyGroupPolicyRequest(\n      input,\n      projection,\n      input.remainingUsers,\n    );\n  });\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly revokedContainerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  input = { ...input, currentUsers: structuredClone(input.currentUsers) };\n  return withVerifiedGroupMutation(input, async (input) => {\n    return buildRotatedKeyGroupPolicyRequest(\n      input,\n      [...input.currentPolicy.currentProjection],\n      input.currentUsers,\n      input.currentPolicy.currentGrants.filter(\n        (grant) => grant.containerId !== input.revokedContainerId,\n      ),\n    );\n  });\n}\n\n/** Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n    readonly containerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  return withVerifiedGroupMutation(input, async (input) => {\n    const grants = [\n      ...input.currentPolicy.currentGrants.filter(\n        (grant) => grant.containerId !== input.containerId,\n      ),\n      { accessLevel: input.accessLevel, containerId: input.containerId },\n    ];\n    return signedGroupPolicyRequest({\n      currentPolicy: input.currentPolicy,\n      encapsulationPublicKey:\n        input.currentPolicy.currentState.encapsulationPublicKey,\n      externalAuthority: isDirectGroupAdmin(\n        input.currentPolicy,\n        input.signerUserId,\n      )\n        ? null\n        : requireExternalAuthority(input.externalAuthority).currentHead,\n      keyEpoch: input.currentPolicy.currentState.keyEpoch,\n      keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n      grants,\n      memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n      payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n      principalId: input.currentPolicy.currentState.principalId,\n      projection: input.currentPolicy.currentProjection,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  });\n}\n"]}

package/workflows/organizations/groupPolicyVerification.js

@@ -1,74 +0,0 @@
-import { verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
-import { throwKeyingVerificationErrorWithContext } from "../../data/keyingProjectionVerification/error.js";
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from "../../data/principals/principalPolicyAdminSigners.js";
-import { collectPrincipalPolicySignerPublicKeys, } from "../principals/policyVerification.js";
-function signerPublicKeyLoadErrorMessage(code) {
-    switch (code) {
-        case "fingerprint-mismatch":
-            return "Group policy signer key fingerprint mismatch";
-        case "not-found":
-            return "Group policy signer key could not be loaded";
-    }
-}
-function groupPolicyReference(bundle) {
-    const state = bundle.currentState;
-    return {
-        principalType: "group",
-        principalId: state.principalId,
-        version: state.version,
-        keyEpoch: state.keyEpoch,
-        stateHash: state.stateHash,
-        keyFingerprint: state.keyFingerprint,
-    };
-}
-export async function collectGroupPolicySignerPublicKeys(input) {
-    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
-        bundle: input.bundle,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-    if ("error" in signerPublicKeys) {
-        throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));
-    }
-    return signerPublicKeys.signerPublicKeys;
-}
-export async function verifyGroupPolicy(input) {
-    const verified = await verifyPrincipalPolicyBundle({
-        bundle: input.currentPolicy,
-        ...(input.externalAuthority
-            ? { externalAuthority: input.externalAuthority }
-            : {}),
-        expectedReference: groupPolicyReference(input.currentPolicy),
-        localCheckpoint: input.localPolicyCheckpoint,
-        signerPublicKeys: input.signerPublicKeys,
-    });
-    if (!verified.ok) {
-        throwKeyingVerificationErrorWithContext(verified.error, "Group policy verification failed");
-    }
-    return verified.value;
-}
-export async function verifyGroupPolicyWithExternalOrganizationAdmins(input) {
-    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
-        bundle: input.currentPolicy,
-        expectedReference: groupPolicyReference(input.currentPolicy),
-        loadExternalAuthority: input.loadExternalAuthority,
-        localCheckpoint: input.localPolicyCheckpoint,
-        signerPublicKeys: input.signerPublicKeys,
-    });
-    if (!verified.ok) {
-        throwKeyingVerificationErrorWithContext(verified.error, "Group policy verification failed");
-    }
-    return verified.value;
-}
-export async function prepareGroupPolicyVerification(input) {
-    const principalId = input.currentPolicy.currentState.principalId;
-    const localPolicyCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", principalId);
-    return {
-        currentPolicySignerPublicKeys: await collectGroupPolicySignerPublicKeys({
-            bundle: input.currentPolicy,
-            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        }),
-        localPolicyCheckpoint,
-    };
-}
-//# sourceMappingURL=groupPolicyVerification.js.map

package/workflows/organizations/groupPolicyVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupPolicyVerification.js","sourceRoot":"","sources":["groupPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,yDAAyD,EAAE,MAAM,mDAAmD,CAAC;AAG9H,OAAO,EACL,sCAAsC,GAEvC,MAAM,kCAAkC,CAAC;AAE1C,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,8CAA8C,CAAC;QACxD,KAAK,WAAW;YACd,OAAO,6CAA6C,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IAEH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAKrE;IACC,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IAIC,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC;IACjE,MAAM,qBAAqB,GAAG,MAAM,6BAA6B,CAC/D,KAAK,CAAC,OAAO,EACb,OAAO,EACP,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;YACtE,MAAM,EAAE,KAAK,CAAC,aAAa;YAC3B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,qBAAqB;KACtB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../principals/policyVerification\";\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"Group policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"Group policy signer key could not be loaded\";\n  }\n}\n\nfunction groupPolicyReference(\n  bundle: PrincipalPolicyBundleResponse,\n): ReferencedPrincipalHead {\n  const state = bundle.currentState;\n  return {\n    principalType: \"group\",\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nexport async function collectGroupPolicySignerPublicKeys(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: input.bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  return signerPublicKeys.signerPublicKeys;\n}\n\nexport async function verifyGroupPolicy(input: {\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.currentPolicy,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    expectedReference: groupPolicyReference(input.currentPolicy),\n    localCheckpoint: input.localPolicyCheckpoint,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Group policy verification failed\",\n    );\n  }\n\n  return verified.value;\n}\n\nexport async function verifyGroupPolicyWithExternalOrganizationAdmins(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n  const verified: KeyingVerificationResult<VerifiedPrincipalPolicy> =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle: input.currentPolicy,\n      expectedReference: groupPolicyReference(input.currentPolicy),\n      loadExternalAuthority: input.loadExternalAuthority,\n      localCheckpoint: input.localPolicyCheckpoint,\n      signerPublicKeys: input.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Group policy verification failed\",\n    );\n  }\n  return verified.value;\n}\n\nexport async function prepareGroupPolicyVerification(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<{\n  readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n}> {\n  const principalId = input.currentPolicy.currentState.principalId;\n  const localPolicyCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    principalId,\n  );\n\n  return {\n    currentPolicySignerPublicKeys: await collectGroupPolicySignerPublicKeys({\n      bundle: input.currentPolicy,\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    localPolicyCheckpoint,\n  };\n}\n"]}

package/workflows/organizations/listLocalOrganizations.d.ts

@@ -1,20 +0,0 @@
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-/**
- * A locally-known organization the user belongs to, derived from its persisted
- * root container. `name` is the decrypted organization-profile display name when
- * one is stored locally, or null when it has not synced yet.
- */
-export interface LocalOrganizationSummary {
-    name: string | null;
-    organizationId: string;
-    rootContainerId: string;
-}
-/**
- * Enumerates the organizations the user can manage from local state: one per
- * persisted root container. This is intentionally offline — the Explorer already
- * resolves files across organizations by effective permission, so listing the
- * organizations to manage needs no server round-trip.
- */
-export declare function listLocalOrganizations(input: {
-    execSql: ExecSql;
-}): Promise<LocalOrganizationSummary[]>;

package/workflows/organizations/listLocalOrganizations.js

@@ -1,137 +0,0 @@
-import { readStoredDocumentState } from "../../data/documents/documentKinds.js";
-import { sqlContainerContentsPersistence } from "../../data/persistence/container-contents/containerContentsPersistence.js";
-import { DOCUMENTS_APP_KIND, sqlDocumentsPersistence, } from "../../data/persistence/documents/documentsPersistence.js";
-import { loadOrganizationProfileDocumentIds } from "../../data/persistence/organizations/organizationProfileDocumentPointers.js";
-import { findLocalIdByDocumentId } from "../../data/sqlite/documentPersistence.js";
-import { loadPersistedDocumentContent } from "../documents/historyContent.js";
-import { getOrganizationProfileDocumentLocalId, readOrganizationProfileName, } from "./organizationProfile.js";
-import { deriveOrganizationMetadataContainerSystemSlot } from "./rosterProfileContainer.js";
-// Reads and decrypts the `name` field of the organization_profile document
-// persisted under `documentLocalId`, or null if it is absent, empty, or
-// unparseable. A single corrupt profile must not break the whole list, so every
-// failure collapses to a null (unnamed) organization.
-async function readOrganizationNameFromDocument(execSql, documentLocalId) {
-    try {
-        const doc = await loadPersistedDocumentContent({
-            execSql,
-            localId: documentLocalId,
-            persistence: sqlDocumentsPersistence,
-        });
-        if (!doc) {
-            return null;
-        }
-        return readOrganizationProfileName(readStoredDocumentState(doc).structuredFields);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Resolves an organization's decrypted display name from local state.
- *
- * The same organization_profile document is addressed by several different
- * local-id conventions depending on how it arrived, so one lookup by id is not
- * enough:
- *
- *  - The org's own **provisioner** (and any admin who later edits the name)
- *    writes the document under the deterministic alias
- *    `org-profile:<organizationId>` — resolved by the fast path below.
- *  - A **device that only synced it** — a member of another org, or this same
- *    user's freshly re-hydrated device after an identity restore — never runs
- *    that write. The sync ingest keys the document under the server documentId
- *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),
- *    so the alias lookup misses.
- *
- * Two fallbacks cover the synced case, in order of authority:
- *
- *  1. The **organization read model** records the org's `profileDocumentId`.
- *     That pointer is container-independent, so it resolves the name wherever
- *     the document happens to be linked — including a profile document created
- *     by an admin through the org-manager editor rather than by provisioning.
- *  2. Failing that, locate the org's metadata container by its deterministic
- *     system slot and read whichever profile document is linked there. Keying on
- *     the system slot (rather than the document kind) keeps it correct even
- *     before the projected document kind has been rebuilt from a freshly-synced
- *     snapshot, and it still works before the read model has been projected.
- */
-async function readLocalOrganizationName(execSql, organizationId, organizationContainers, profileDocumentId) {
-    const aliasName = await readOrganizationNameFromDocument(execSql, getOrganizationProfileDocumentLocalId({ organizationId }));
-    if (aliasName !== null) {
-        return aliasName;
-    }
-    if (profileDocumentId) {
-        // Reach the row wherever it landed: a device that only synced the document
-        // keys it under the server documentId rather than any local alias.
-        const syncedLocalId = await findLocalIdByDocumentId(execSql, DOCUMENTS_APP_KIND, profileDocumentId);
-        const syncedName = syncedLocalId
-            ? await readOrganizationNameFromDocument(execSql, syncedLocalId)
-            : null;
-        if (syncedName !== null) {
-            return syncedName;
-        }
-    }
-    const metadataSystemSlot = await deriveOrganizationMetadataContainerSystemSlot({ organizationId });
-    const metadataContainer = organizationContainers.find((container) => container.systemSlot === metadataSystemSlot);
-    if (!metadataContainer) {
-        return null;
-    }
-    const documentLocalIds = await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(execSql, metadataContainer.id);
-    for (const documentLocalId of documentLocalIds) {
-        const name = await readOrganizationNameFromDocument(execSql, documentLocalId);
-        if (name !== null) {
-            return name;
-        }
-    }
-    return null;
-}
-/**
- * Enumerates the organizations the user can manage from local state: one per
- * persisted root container. This is intentionally offline — the Explorer already
- * resolves files across organizations by effective permission, so listing the
- * organizations to manage needs no server round-trip.
- */
-export async function listLocalOrganizations(input) {
-    const containers = await sqlContainerContentsPersistence.loadContainers(input.execSql);
-    // A projected read model is not a precondition for listing organizations, so
-    // an unreadable one degrades to the container-derived lookups below.
-    const profileDocumentIdsByOrganizationId = await loadOrganizationProfileDocumentIds(input.execSql).catch(() => new Map());
-    // Group every persisted container by org so name resolution can locate an
-    // org's independent metadata root without a second DB scan.
-    const containersByOrganizationId = new Map();
-    for (const { container } of containers) {
-        const entry = {
-            id: container.id,
-            systemSlot: container.systemSlot ?? null,
-        };
-        const group = containersByOrganizationId.get(container.organizationId);
-        if (group) {
-            group.push(entry);
-        }
-        else {
-            containersByOrganizationId.set(container.organizationId, [entry]);
-        }
-    }
-    const seen = new Set();
-    const rootContainers = containers.filter(({ container }) => {
-        if (container.parentId !== null ||
-            container.systemSlot ||
-            seen.has(container.organizationId)) {
-            return false;
-        }
-        seen.add(container.organizationId);
-        return true;
-    });
-    rootContainers.sort((left, right) => (left.container.localCreatedAt ?? "").localeCompare(right.container.localCreatedAt ?? "") ||
-        left.container.organizationId.localeCompare(right.container.organizationId) ||
-        left.container.id.localeCompare(right.container.id));
-    // Read each organization's profile name concurrently; readLocalOrganizationName
-    // already falls back to null per organization, so a single corrupt profile
-    // cannot reject the batch.
-    return Promise.all(rootContainers.map(async ({ container }) => ({
-        name: await readLocalOrganizationName(input.execSql, container.organizationId, containersByOrganizationId.get(container.organizationId) ?? [], profileDocumentIdsByOrganizationId.get(container.organizationId) ??
-            null),
-        organizationId: container.organizationId,
-        rootContainerId: container.id,
-    })));
-}
-//# sourceMappingURL=listLocalOrganizations.js.map

package/workflows/organizations/listLocalOrganizations.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"listLocalOrganizations.js","sourceRoot":"","sources":["listLocalOrganizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wEAAwE,CAAC;AACzH,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,0EAA0E,CAAC;AAC9H,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EACL,qCAAqC,EACrC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,6CAA6C,EAAE,MAAM,0BAA0B,CAAC;AAoBzF,2EAA2E;AAC3E,wEAAwE;AACxE,gFAAgF;AAChF,sDAAsD;AACtD,KAAK,UAAU,gCAAgC,CAC7C,OAAgB,EAChB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC;YAC7C,OAAO;YACP,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,uBAAuB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,2BAA2B,CAChC,uBAAuB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,yBAAyB,CACtC,OAAgB,EAChB,cAAsB,EACtB,sBAAkE,EAClE,iBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,gCAAgC,CACtD,OAAO,EACP,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,EACP,kBAAkB,EAClB,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,MAAM,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GACtB,MAAM,6CAA6C,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,kBAAkB,CAC3D,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,MAAM,uBAAuB,CAAC,iCAAiC,CAC7D,OAAO,EACP,iBAAiB,CAAC,EAAE,CACrB,CAAC;IACJ,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,gCAAgC,CACjD,OAAO,EACP,eAAe,CAChB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,cAAc,CACrE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,kCAAkC,GACtC,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAC3D,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAChC,CAAC;IAEJ,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAGvC,CAAC;IACJ,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAgC;YACzC,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;SACzC,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IACE,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,SAAS,CAAC,UAAU;YACpB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,aAAa,CACjD,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CACrC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CACzC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/B;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CACtD,CAAC;IAEF,gFAAgF;IAChF,2EAA2E;IAC3E,2BAA2B;IAC3B,OAAO,OAAO,CAAC,GAAG,CAChB,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,MAAM,yBAAyB,CACnC,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,cAAc,EACxB,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,EAC9D,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;YAC9D,IAAI,CACP;QACD,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,SAAS,CAAC,EAAE;KAC9B,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import { readStoredDocumentState } from \"../../data/documents/documentKinds\";\nimport { sqlContainerContentsPersistence } from \"../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n  DOCUMENTS_APP_KIND,\n  sqlDocumentsPersistence,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport { loadOrganizationProfileDocumentIds } from \"../../data/persistence/organizations/organizationProfileDocumentPointers\";\nimport { findLocalIdByDocumentId } from \"../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { loadPersistedDocumentContent } from \"../documents/historyContent\";\nimport {\n  getOrganizationProfileDocumentLocalId,\n  readOrganizationProfileName,\n} from \"./organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"./rosterProfileContainer\";\n\n// Just the container fields this module needs to locate an org's metadata\n// container among the locally-persisted containers.\ninterface LocalContainerForNameLookup {\n  id: string;\n  systemSlot: string | null;\n}\n\n/**\n * A locally-known organization the user belongs to, derived from its persisted\n * root container. `name` is the decrypted organization-profile display name when\n * one is stored locally, or null when it has not synced yet.\n */\nexport interface LocalOrganizationSummary {\n  name: string | null;\n  organizationId: string;\n  rootContainerId: string;\n}\n\n// Reads and decrypts the `name` field of the organization_profile document\n// persisted under `documentLocalId`, or null if it is absent, empty, or\n// unparseable. A single corrupt profile must not break the whole list, so every\n// failure collapses to a null (unnamed) organization.\nasync function readOrganizationNameFromDocument(\n  execSql: ExecSql,\n  documentLocalId: string,\n): Promise<string | null> {\n  try {\n    const doc = await loadPersistedDocumentContent({\n      execSql,\n      localId: documentLocalId,\n      persistence: sqlDocumentsPersistence,\n    });\n    if (!doc) {\n      return null;\n    }\n\n    return readOrganizationProfileName(\n      readStoredDocumentState(doc).structuredFields,\n    );\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolves an organization's decrypted display name from local state.\n *\n * The same organization_profile document is addressed by several different\n * local-id conventions depending on how it arrived, so one lookup by id is not\n * enough:\n *\n *  - The org's own **provisioner** (and any admin who later edits the name)\n *    writes the document under the deterministic alias\n *    `org-profile:<organizationId>` — resolved by the fast path below.\n *  - A **device that only synced it** — a member of another org, or this same\n *    user's freshly re-hydrated device after an identity restore — never runs\n *    that write. The sync ingest keys the document under the server documentId\n *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),\n *    so the alias lookup misses.\n *\n * Two fallbacks cover the synced case, in order of authority:\n *\n *  1. The **organization read model** records the org's `profileDocumentId`.\n *     That pointer is container-independent, so it resolves the name wherever\n *     the document happens to be linked — including a profile document created\n *     by an admin through the org-manager editor rather than by provisioning.\n *  2. Failing that, locate the org's metadata container by its deterministic\n *     system slot and read whichever profile document is linked there. Keying on\n *     the system slot (rather than the document kind) keeps it correct even\n *     before the projected document kind has been rebuilt from a freshly-synced\n *     snapshot, and it still works before the read model has been projected.\n */\nasync function readLocalOrganizationName(\n  execSql: ExecSql,\n  organizationId: string,\n  organizationContainers: ReadonlyArray<LocalContainerForNameLookup>,\n  profileDocumentId: string | null,\n): Promise<string | null> {\n  const aliasName = await readOrganizationNameFromDocument(\n    execSql,\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n  if (aliasName !== null) {\n    return aliasName;\n  }\n\n  if (profileDocumentId) {\n    // Reach the row wherever it landed: a device that only synced the document\n    // keys it under the server documentId rather than any local alias.\n    const syncedLocalId = await findLocalIdByDocumentId(\n      execSql,\n      DOCUMENTS_APP_KIND,\n      profileDocumentId,\n    );\n    const syncedName = syncedLocalId\n      ? await readOrganizationNameFromDocument(execSql, syncedLocalId)\n      : null;\n    if (syncedName !== null) {\n      return syncedName;\n    }\n  }\n\n  const metadataSystemSlot =\n    await deriveOrganizationMetadataContainerSystemSlot({ organizationId });\n  const metadataContainer = organizationContainers.find(\n    (container) => container.systemSlot === metadataSystemSlot,\n  );\n  if (!metadataContainer) {\n    return null;\n  }\n\n  const documentLocalIds =\n    await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(\n      execSql,\n      metadataContainer.id,\n    );\n  for (const documentLocalId of documentLocalIds) {\n    const name = await readOrganizationNameFromDocument(\n      execSql,\n      documentLocalId,\n    );\n    if (name !== null) {\n      return name;\n    }\n  }\n  return null;\n}\n\n/**\n * Enumerates the organizations the user can manage from local state: one per\n * persisted root container. This is intentionally offline — the Explorer already\n * resolves files across organizations by effective permission, so listing the\n * organizations to manage needs no server round-trip.\n */\nexport async function listLocalOrganizations(input: {\n  execSql: ExecSql;\n}): Promise<LocalOrganizationSummary[]> {\n  const containers = await sqlContainerContentsPersistence.loadContainers(\n    input.execSql,\n  );\n  // A projected read model is not a precondition for listing organizations, so\n  // an unreadable one degrades to the container-derived lookups below.\n  const profileDocumentIdsByOrganizationId =\n    await loadOrganizationProfileDocumentIds(input.execSql).catch(\n      () => new Map<string, string>(),\n    );\n\n  // Group every persisted container by org so name resolution can locate an\n  // org's independent metadata root without a second DB scan.\n  const containersByOrganizationId = new Map<\n    string,\n    LocalContainerForNameLookup[]\n  >();\n  for (const { container } of containers) {\n    const entry: LocalContainerForNameLookup = {\n      id: container.id,\n      systemSlot: container.systemSlot ?? null,\n    };\n    const group = containersByOrganizationId.get(container.organizationId);\n    if (group) {\n      group.push(entry);\n    } else {\n      containersByOrganizationId.set(container.organizationId, [entry]);\n    }\n  }\n\n  const seen = new Set<string>();\n  const rootContainers = containers.filter(({ container }) => {\n    if (\n      container.parentId !== null ||\n      container.systemSlot ||\n      seen.has(container.organizationId)\n    ) {\n      return false;\n    }\n    seen.add(container.organizationId);\n    return true;\n  });\n  rootContainers.sort(\n    (left, right) =>\n      (left.container.localCreatedAt ?? \"\").localeCompare(\n        right.container.localCreatedAt ?? \"\",\n      ) ||\n      left.container.organizationId.localeCompare(\n        right.container.organizationId,\n      ) ||\n      left.container.id.localeCompare(right.container.id),\n  );\n\n  // Read each organization's profile name concurrently; readLocalOrganizationName\n  // already falls back to null per organization, so a single corrupt profile\n  // cannot reject the batch.\n  return Promise.all(\n    rootContainers.map(async ({ container }) => ({\n      name: await readLocalOrganizationName(\n        input.execSql,\n        container.organizationId,\n        containersByOrganizationId.get(container.organizationId) ?? [],\n        profileDocumentIdsByOrganizationId.get(container.organizationId) ??\n          null,\n      ),\n      organizationId: container.organizationId,\n      rootContainerId: container.id,\n    })),\n  );\n}\n"]}

package/workflows/organizations/loadPolicyHistoryDetails.js

@@ -1,78 +0,0 @@
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { reportKeyingVerificationErrorInCauseChain } from "../../data/keyingProjectionVerification/error.js";
-import { loadLocalOrganizationPolicyReference } from "./localReadModelDetails.js";
-import { buildDetailedOrganizationPolicyHistory } from "./organizationPolicyHistoryDetails.js";
-import { captureOrganizationPresentationAccessAttempt, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, } from "./organizationPresentationAccessState.js";
-import { isOrganizationPresentationAccessDeniedFailure } from "./organizationPresentationFailures.js";
-import { denyPolicyHistoryAccess } from "./policyHistoryAccessDenial.js";
-import { cachePolicyHistory, loadCachedPolicyHistory, } from "./policyHistoryCache.js";
-export async function loadPolicyHistoryDetails(input) {
-    const access = { ...input, requesterUserId: input.currentUserId };
-    const attempt = captureOrganizationPresentationAccessAttempt(access, "readModel");
-    const current = () => input.stillCurrent() &&
-        isOrganizationPresentationAccessAttemptCurrent(access, attempt) &&
-        isOrganizationPresentationAccessReadable(access, "readModel");
-    if (!current())
-        return null;
-    const beforeVersion = (input.page.entries.at(-1)?.state.version ?? 0) + 1;
-    const cache = {
-        domainScope: input.domainScope,
-        access,
-        stateHash: input.head.stateHash,
-        beforeVersion,
-    };
-    const retain = async (history) => {
-        const latest = await loadLocalOrganizationPolicyReference({
-            ...input,
-            principalType: "organization",
-            principalId: input.organizationId,
-        });
-        return current() && latest?.stateHash === input.head.stateHash
-            ? history
-            : null;
-    };
-    const cached = loadCachedPolicyHistory(cache);
-    if (cached)
-        return retain(cached);
-    if (!input.online)
-        return retain(input.history);
-    try {
-        const response = await input.apiClient.getOrganizationPolicyHistoryResult(input.organizationId, input.head.stateHash, { beforeVersion, reportErrors: false });
-        if (!input.stillCurrent())
-            return null;
-        if (!response.ok) {
-            if (isOrganizationPresentationAccessDeniedFailure(response)) {
-                await denyPolicyHistoryAccess(access);
-                return null;
-            }
-            response.report();
-            if (input.olderPage)
-                throw new Error(response.message);
-            return retain(input.history);
-        }
-        const history = await buildDetailedOrganizationPolicyHistory({
-            head: input.head,
-            page: input.page,
-            evidence: response.data,
-            resolveHistory: input.resolveHistory,
-            stillCurrent: current,
-        });
-        const retained = await retain(history);
-        if (retained === history)
-            cachePolicyHistory({ ...cache, attempt, history });
-        return retained;
-    }
-    catch (error) {
-        if (!input.olderPage &&
-            error instanceof ProjectionDependencyUnavailableError)
-            return retain(input.history);
-        await reportKeyingVerificationErrorInCauseChain(error, input.reportSecurityIncident, {
-            objectId: input.organizationId,
-            objectKind: "principal",
-            operation: "organization.policy_history.load",
-            organizationId: input.organizationId,
-        });
-        throw error;
-    }
-}
-//# sourceMappingURL=loadPolicyHistoryDetails.js.map

package/workflows/organizations/loadPolicyHistoryDetails.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"loadPolicyHistoryDetails.js","sourceRoot":"","sources":["loadPolicyHistoryDetails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,yCAAyC,EAAE,MAAM,+CAA+C,CAAC;AAM1G,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,EAC9C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,6CAA6C,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAkB9C;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,4CAA4C,CAC1D,MAAM,EACN,WAAW,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,KAAK,CAAC,YAAY,EAAE;QACpB,8CAA8C,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/D,wCAAwC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC/B,aAAa;KACd,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAkC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC;YACxD,GAAG,KAAK;YACR,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,EAAE,IAAI,MAAM,EAAE,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS;YAC5D,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACvE,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,IAAI,CAAC,SAAS,EACpB,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CACvC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,6CAA6C,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,OAAO;YACtB,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,KAAK,CAAC,SAAS;YAChB,KAAK,YAAY,oCAAoC;YAErD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,yCAAyC,CAC7C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;YACE,QAAQ,EAAE,KAAK,CAAC,cAAc;YAC9B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../data/keyingProjectionVerification/error\";\nimport type { ReferencedPrincipalPolicyWarmer } from \"../../data/keyingProjectionVerification/types\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { RecoveredPrincipalHistoryPage } from \"../principals/loadRecoveredPrincipalHistoryPage\";\nimport { loadLocalOrganizationPolicyReference } from \"./localReadModelDetails\";\nimport { buildDetailedOrganizationPolicyHistory } from \"./organizationPolicyHistoryDetails\";\nimport {\n  captureOrganizationPresentationAccessAttempt,\n  isOrganizationPresentationAccessAttemptCurrent,\n  isOrganizationPresentationAccessReadable,\n} from \"./organizationPresentationAccessState\";\nimport { isOrganizationPresentationAccessDeniedFailure } from \"./organizationPresentationFailures\";\nimport { denyPolicyHistoryAccess } from \"./policyHistoryAccessDenial\";\nimport {\n  cachePolicyHistory,\n  loadCachedPolicyHistory,\n} from \"./policyHistoryCache\";\nimport type { OrganizationPolicyHistory } from \"./policyHistoryTypes\";\n\nexport async function loadPolicyHistoryDetails(input: {\n  apiClient: Pick<ApiClient, \"getOrganizationPolicyHistoryResult\">;\n  currentUserId: string;\n  domainScope: DomainScope;\n  execSql: ExecSql;\n  organizationId: string;\n  head: ReferencedPrincipalHead;\n  page: RecoveredPrincipalHistoryPage;\n  history: OrganizationPolicyHistory;\n  resolveHistory: NonNullable<\n    ReferencedPrincipalPolicyWarmer[\"resolveProjectionHistory\"]\n  >;\n  stillCurrent: () => boolean;\n  online: boolean;\n  olderPage: boolean;\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  // Forwarded to denyPolicyHistoryAccess to report failed durable cleanup.\n  logError: (message: string | Error, cause?: unknown) => void;\n}): Promise<OrganizationPolicyHistory | null> {\n  const access = { ...input, requesterUserId: input.currentUserId };\n  const attempt = captureOrganizationPresentationAccessAttempt(\n    access,\n    \"readModel\",\n  );\n  const current = () =>\n    input.stillCurrent() &&\n    isOrganizationPresentationAccessAttemptCurrent(access, attempt) &&\n    isOrganizationPresentationAccessReadable(access, \"readModel\");\n  if (!current()) return null;\n  const beforeVersion = (input.page.entries.at(-1)?.state.version ?? 0) + 1;\n  const cache = {\n    domainScope: input.domainScope,\n    access,\n    stateHash: input.head.stateHash,\n    beforeVersion,\n  };\n  const retain = async (history: OrganizationPolicyHistory) => {\n    const latest = await loadLocalOrganizationPolicyReference({\n      ...input,\n      principalType: \"organization\",\n      principalId: input.organizationId,\n    });\n    return current() && latest?.stateHash === input.head.stateHash\n      ? history\n      : null;\n  };\n  const cached = loadCachedPolicyHistory(cache);\n  if (cached) return retain(cached);\n  if (!input.online) return retain(input.history);\n  try {\n    const response = await input.apiClient.getOrganizationPolicyHistoryResult(\n      input.organizationId,\n      input.head.stateHash,\n      { beforeVersion, reportErrors: false },\n    );\n    if (!input.stillCurrent()) return null;\n    if (!response.ok) {\n      if (isOrganizationPresentationAccessDeniedFailure(response)) {\n        await denyPolicyHistoryAccess(access);\n        return null;\n      }\n      response.report();\n      if (input.olderPage) throw new Error(response.message);\n      return retain(input.history);\n    }\n    const history = await buildDetailedOrganizationPolicyHistory({\n      head: input.head,\n      page: input.page,\n      evidence: response.data,\n      resolveHistory: input.resolveHistory,\n      stillCurrent: current,\n    });\n    const retained = await retain(history);\n    if (retained === history)\n      cachePolicyHistory({ ...cache, attempt, history });\n    return retained;\n  } catch (error) {\n    if (\n      !input.olderPage &&\n      error instanceof ProjectionDependencyUnavailableError\n    )\n      return retain(input.history);\n    await reportKeyingVerificationErrorInCauseChain(\n      error,\n      input.reportSecurityIncident,\n      {\n        objectId: input.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: input.organizationId,\n      },\n    );\n    throw error;\n  }\n}\n"]}

package/workflows/organizations/localReadModelDetails.d.ts

@@ -1,25 +0,0 @@
-import type { ReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { OrganizationContainerGrants, OrganizationGroupContainers, OrganizationGroupPolicyHistory, OrganizationPolicyHistory, OrganizationUserDetail } from "./readModel.js";
-interface LocalReadModelInput {
-    readonly currentUserId: string;
-    readonly execSql: ExecSql;
-    readonly organizationId: string;
-}
-type PolicyPrincipalType = ReferencedPrincipalStateResponse["principalType"];
-export declare function loadLocalOrganizationContainerGrants(input: LocalReadModelInput): Promise<OrganizationContainerGrants | null>;
-export declare function loadLocalOrganizationGroupContainers(input: LocalReadModelInput & {
-    readonly groupId: string;
-}): Promise<OrganizationGroupContainers | null>;
-export declare function loadLocalOrganizationGroupPolicyHistory(input: LocalReadModelInput & {
-    readonly groupId: string;
-}): Promise<OrganizationGroupPolicyHistory | null>;
-export declare function loadLocalOrganizationPolicyHistory(input: LocalReadModelInput): Promise<OrganizationPolicyHistory | null>;
-export declare function loadLocalOrganizationPolicyReference(input: LocalReadModelInput & {
-    readonly principalId: string;
-    readonly principalType: PolicyPrincipalType;
-}): Promise<ReferencedPrincipalStateResponse | null>;
-export declare function loadLocalOrganizationUserDetail(input: LocalReadModelInput & {
-    readonly userId: string;
-}): Promise<OrganizationUserDetail | null>;
-export {};