@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/organizations/groupPolicy/groupPolicyVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyVerification.js","sourceRoot":"","sources":["groupPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,yDAAyD,EAAE,MAAM,sDAAsD,CAAC;AAGjI,OAAO,EACL,sCAAsC,GAEvC,MAAM,qCAAqC,CAAC;AAE7C,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,8CAA8C,CAAC;QACxD,KAAK,WAAW;YACd,OAAO,6CAA6C,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IAEH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAKrE;IACC,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IAIC,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC;IACjE,MAAM,qBAAqB,GAAG,MAAM,6BAA6B,CAC/D,KAAK,CAAC,OAAO,EACb,OAAO,EACP,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;YACtE,MAAM,EAAE,KAAK,CAAC,aAAa;YAC3B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,qBAAqB;KACtB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../principals/policyVerification\";\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"Group policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"Group policy signer key could not be loaded\";\n  }\n}\n\nfunction groupPolicyReference(\n  bundle: PrincipalPolicyBundleResponse,\n): ReferencedPrincipalHead {\n  const state = bundle.currentState;\n  return {\n    principalType: \"group\",\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nexport async function collectGroupPolicySignerPublicKeys(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: input.bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  return signerPublicKeys.signerPublicKeys;\n}\n\nexport async function verifyGroupPolicy(input: {\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.currentPolicy,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    expectedReference: groupPolicyReference(input.currentPolicy),\n    localCheckpoint: input.localPolicyCheckpoint,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Group policy verification failed\",\n    );\n  }\n\n  return verified.value;\n}\n\nexport async function verifyGroupPolicyWithExternalOrganizationAdmins(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n  const verified: KeyingVerificationResult<VerifiedPrincipalPolicy> =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle: input.currentPolicy,\n      expectedReference: groupPolicyReference(input.currentPolicy),\n      loadExternalAuthority: input.loadExternalAuthority,\n      localCheckpoint: input.localPolicyCheckpoint,\n      signerPublicKeys: input.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Group policy verification failed\",\n    );\n  }\n  return verified.value;\n}\n\nexport async function prepareGroupPolicyVerification(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<{\n  readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n}> {\n  const principalId = input.currentPolicy.currentState.principalId;\n  const localPolicyCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    principalId,\n  );\n\n  return {\n    currentPolicySignerPublicKeys: await collectGroupPolicySignerPublicKeys({\n      bundle: input.currentPolicy,\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    }),\n    localPolicyCheckpoint,\n  };\n}\n"]}

package/workflows/organizations/groupPolicy/submitGroupPolicyCommit.d.ts

@@ -0,0 +1,22 @@
+import type { ContainerMutationRequest, PutPrincipalPolicyRequest } from "../../../internal/validators/request/index.js";
+import { type CommitOrganizationGroupPolicyResponse } from "../../../internal/validators/response/index.js";
+import type { PrincipalPolicyReadWriteApi } from "../principalPolicy/principalPolicyApi.js";
+/**
+ * Commit, answering one refusal: a rematerialized rekey or revoke that would
+ * strand a level above a directly granted container is refused with the
+ * descendant rekeys it must carry. The refused attempt rolled back whole, so
+ * the served heads still stand; the batch is signed again with the named
+ * levels woven in, replaces the container mutations, and the commit is retried
+ * once. A second refusal means the tree moved underneath, and the caller's own
+ * retry starts from a fresh policy.
+ */
+export declare function submitGroupPolicyCommit(input: {
+    readonly apiClient: PrincipalPolicyReadWriteApi;
+    readonly carryDescendantRekeys?: ((requiredContainerIds: readonly string[]) => Promise<readonly ContainerMutationRequest[]>) | undefined;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly organizationRequest: PutPrincipalPolicyRequest;
+    readonly memberRequest?: PutPrincipalPolicyRequest | undefined;
+    readonly request: PutPrincipalPolicyRequest;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<CommitOrganizationGroupPolicyResponse | null>;

package/workflows/organizations/groupPolicy/submitGroupPolicyCommit.js

@@ -0,0 +1,71 @@
+import { CONTAINER_MUTATION_ERROR_CODES, } from "../../../internal/validators/response/index.js";
+/**
+ * Commit, answering one refusal: a rematerialized rekey or revoke that would
+ * strand a level above a directly granted container is refused with the
+ * descendant rekeys it must carry. The refused attempt rolled back whole, so
+ * the served heads still stand; the batch is signed again with the named
+ * levels woven in, replaces the container mutations, and the commit is retried
+ * once. A second refusal means the tree moved underneath, and the caller's own
+ * retry starts from a fresh policy.
+ */
+export async function submitGroupPolicyCommit(input) {
+    const body = () => ({
+        groupPolicy: input.request,
+        ...(input.memberRequest ? { memberPolicy: input.memberRequest } : {}),
+        organizationPolicy: input.organizationRequest,
+    });
+    const { commitOrganizationGroupPolicyResult } = input.apiClient;
+    if (!commitOrganizationGroupPolicyResult) {
+        return input.apiClient.commitOrganizationGroupPolicy(input.organizationId, input.groupId, body());
+    }
+    const first = await commitOrganizationGroupPolicyResult.call(input.apiClient, input.organizationId, input.groupId, body(), { reportErrors: false });
+    if (first.ok)
+        return first.data;
+    if (first.kind === "cancelled")
+        return null;
+    if (first.kind === "outcome-unknown")
+        throw new Error(first.message ??
+            "Policy request may have committed; refresh before retrying");
+    if (input.memberRequest &&
+        first.code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired) {
+        throw new Error("Repair the affected container keys before retrying enrollment; no memberships were changed");
+    }
+    if (!input.carryDescendantRekeys ||
+        first.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||
+        !first.requiredContainerIds?.length) {
+        first.report?.();
+        return null;
+    }
+    let carried;
+    try {
+        carried = await input.carryDescendantRekeys(first.requiredContainerIds);
+    }
+    catch (error) {
+        // The refusal was answerable, and the answer failed: surface both. Once
+        // the generation that owned the attempt is gone, only the failure is
+        // surfaced; a superseded refusal is not an error.
+        if (input.stillCurrent?.() !== false)
+            first.report?.();
+        throw error;
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    // Nothing signed means the same refusal again; report the one already had.
+    if (carried.length === 0) {
+        first.report?.();
+        return null;
+    }
+    input.request.containerMutations = [...carried];
+    const second = await commitOrganizationGroupPolicyResult.call(input.apiClient, input.organizationId, input.groupId, body(), { reportErrors: false });
+    if (!second.ok) {
+        if (second.kind === "cancelled")
+            return null;
+        if (second.kind === "outcome-unknown")
+            throw new Error(second.message ??
+                "Policy request may have committed; refresh before retrying");
+        second.report?.();
+        return null;
+    }
+    return second.data;
+}
+//# sourceMappingURL=submitGroupPolicyCommit.js.map

package/workflows/organizations/groupPolicy/submitGroupPolicyCommit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitGroupPolicyCommit.js","sourceRoot":"","sources":["submitGroupPolicyCommit.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,8BAA8B,GAE/B,MAAM,gCAAgC,CAAC;AAGxC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAa7C;IACC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAClB,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,kBAAkB,EAAE,KAAK,CAAC,mBAAmB;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,mCAAmC,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IAChE,IAAI,CAAC,mCAAmC,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,CACP,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC,IAAI,CAC1D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,EACN,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAClC,MAAM,IAAI,KAAK,CACb,KAAK,CAAC,OAAO;YACX,4DAA4D,CAC/D,CAAC;IACJ,IACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,qBAAqB;QAC5B,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;QACtE,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,EACnC,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,qEAAqE;QACrE,kDAAkD;QAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACvD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,2EAA2E;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,IAAI,CAC3D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,EACN,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;YACnC,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,OAAO;gBACZ,4DAA4D,CAC/D,CAAC;QACJ,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC","sourcesContent":["import type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport {\n  CONTAINER_MUTATION_ERROR_CODES,\n  type CommitOrganizationGroupPolicyResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyReadWriteApi } from \"../principalPolicy/principalPolicyApi\";\n\n/**\n * Commit, answering one refusal: a rematerialized rekey or revoke that would\n * strand a level above a directly granted container is refused with the\n * descendant rekeys it must carry. The refused attempt rolled back whole, so\n * the served heads still stand; the batch is signed again with the named\n * levels woven in, replaces the container mutations, and the commit is retried\n * once. A second refusal means the tree moved underneath, and the caller's own\n * retry starts from a fresh policy.\n */\nexport async function submitGroupPolicyCommit(input: {\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly carryDescendantRekeys?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  readonly memberRequest?: PutPrincipalPolicyRequest | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<CommitOrganizationGroupPolicyResponse | null> {\n  const body = () => ({\n    groupPolicy: input.request,\n    ...(input.memberRequest ? { memberPolicy: input.memberRequest } : {}),\n    organizationPolicy: input.organizationRequest,\n  });\n  const { commitOrganizationGroupPolicyResult } = input.apiClient;\n  if (!commitOrganizationGroupPolicyResult) {\n    return input.apiClient.commitOrganizationGroupPolicy(\n      input.organizationId,\n      input.groupId,\n      body(),\n    );\n  }\n  const first = await commitOrganizationGroupPolicyResult.call(\n    input.apiClient,\n    input.organizationId,\n    input.groupId,\n    body(),\n    { reportErrors: false },\n  );\n  if (first.ok) return first.data;\n  if (first.kind === \"cancelled\") return null;\n  if (first.kind === \"outcome-unknown\")\n    throw new Error(\n      first.message ??\n        \"Policy request may have committed; refresh before retrying\",\n    );\n  if (\n    input.memberRequest &&\n    first.code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired\n  ) {\n    throw new Error(\n      \"Repair the affected container keys before retrying enrollment; no memberships were changed\",\n    );\n  }\n  if (\n    !input.carryDescendantRekeys ||\n    first.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||\n    !first.requiredContainerIds?.length\n  ) {\n    first.report?.();\n    return null;\n  }\n  let carried: readonly ContainerMutationRequest[];\n  try {\n    carried = await input.carryDescendantRekeys(first.requiredContainerIds);\n  } catch (error) {\n    // The refusal was answerable, and the answer failed: surface both. Once\n    // the generation that owned the attempt is gone, only the failure is\n    // surfaced; a superseded refusal is not an error.\n    if (input.stillCurrent?.() !== false) first.report?.();\n    throw error;\n  }\n  if (input.stillCurrent?.() === false) return null;\n  // Nothing signed means the same refusal again; report the one already had.\n  if (carried.length === 0) {\n    first.report?.();\n    return null;\n  }\n  input.request.containerMutations = [...carried];\n  const second = await commitOrganizationGroupPolicyResult.call(\n    input.apiClient,\n    input.organizationId,\n    input.groupId,\n    body(),\n    { reportErrors: false },\n  );\n  if (!second.ok) {\n    if (second.kind === \"cancelled\") return null;\n    if (second.kind === \"outcome-unknown\")\n      throw new Error(\n        second.message ??\n          \"Policy request may have committed; refresh before retrying\",\n      );\n    second.report?.();\n    return null;\n  }\n  return second.data;\n}\n"]}

package/workflows/organizations/groups/createCurrentOrganizationGroup.js

@@ -0,0 +1,85 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "../groupMetadata/groupMetadataBinding.js";
+import { readDirectoryGroupName } from "../groupNames/groupNameUniqueness.js";
+import { acknowledgeInitialGroupPolicy } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { buildInitialGroupPolicyRequest, canonicalGroupNameKey, } from "../principalPolicy/principalPolicyRequest.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+/** Create from bounded current evidence and publish its genuine genesis with the directory. */
+export async function createCurrentOrganizationGroup(input) {
+    const { context } = input;
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const nameKey = canonicalGroupNameKey(input.name);
+    // Each current recovery is queued by organization. Retain verified heads one
+    // at a time so the walk stays bounded without collecting full group histories.
+    for (const head of context.descriptor.groupHeads) {
+        const group = await context.readGroup(head.principalId);
+        const stillCurrent = () => context.stillCurrent() && group.stillCurrent();
+        assertProjectionVerificationCurrent(stillCurrent);
+        assertGroupMetadataBinding(group.current, context.descriptor);
+        const name = await readDirectoryGroupName({ ...input, readEncryptedName: input.metadataAccess.readName }, group.current);
+        // Remember independently verified heads even if uniqueness or dispatch
+        // later fails; these are observed policies, never speculative successors.
+        await advanceKeyingCheckpointsAtomically({
+            execSql: input.execSql,
+            organizationId: input.organizationId,
+            access: [],
+            policies: [...group.dependencies, group.policy],
+            stillCurrent,
+        });
+        if (name !== null && canonicalGroupNameKey(name) === nameKey)
+            throw new Error("Another signed group in this organization already carries this name");
+    }
+    const request = await buildInitialGroupPolicyRequest({
+        ...input,
+        groupId: crypto.randomUUID(),
+        includeSignerAsAdmin: false,
+        externalAuthority: {
+            ...principalPolicyReferenceFromBundle(context.admins.current),
+            principalType: "group",
+        },
+        metadataKey: await input.metadataAccess.loadEncryptionKey(),
+    });
+    const head = await groupPolicyMutationHead(request.initialGroupPolicy);
+    const adminProjection = context.admins.policy.projection;
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        ...input,
+        currentPolicy: context.directory.current,
+        descriptor: context.descriptor,
+        groupHeads: replaceOrganizationGroupHead({
+            descriptor: context.descriptor,
+            nextHead: head,
+        }),
+        adminProjection,
+        adminUsers: await resolveRequiredUserIdentities({
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+            userIds: projectionUserIds(adminProjection),
+        }),
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const stored = await input.apiClient.createOrganizationGroup(input.organizationId, { ...request, organizationPolicy: organizationRequest });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    if (!stored)
+        throw new Error("Group could not be created");
+    // Genesis really has one signed state. Reconstruct only the exact authored
+    // artifacts whose commitments match the summary, then verify them privately.
+    const { bundle } = await acknowledgeInitialGroupPolicy({
+        organizationId: input.organizationId,
+        request,
+        response: stored.group,
+        stateHash: head.stateHash,
+    });
+    const { previousStates: _previousStates, ...current } = bundle;
+    await context.retainCreatedGroup({
+        request: request.initialGroupPolicy,
+        response: { ...current, containerMutations: [] },
+        organizationRequest,
+        organizationResponse: stored.organizationPolicy,
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    return { ...stored.group, name: input.name.trim(), nameUnreadable: false };
+}
+//# sourceMappingURL=createCurrentOrganizationGroup.js.map

package/workflows/organizations/groups/createCurrentOrganizationGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCurrentOrganizationGroup.js","sourceRoot":"","sources":["createCurrentOrganizationGroup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAK1G,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAElG,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAgBpD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACvC,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,EAC9D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/C,YAAY;SACb,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,OAAO;YAC1D,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,iBAAiB,EAAE;YACjB,GAAG,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7D,aAAa,EAAE,OAAO;SACvB;QACD,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACzD,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,GAAG,KAAK;QACR,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,eAAe;QACf,UAAU,EAAE,MAAM,6BAA6B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;SAC5C,CAAC;KACH,CAAC,CAAC;IACL,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CACxD,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;IAC/D,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,kBAAkB;QACnC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAChD,mBAAmB;QACnB,oBAAoB,EAAE,MAAM,CAAC,kBAAkB;KAChD,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { createGroupMetadataAccess } from \"../groupMetadata/groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport { readDirectoryGroupName } from \"../groupNames/groupNameUniqueness\";\nimport { acknowledgeInitialGroupPolicy } from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport type { CurrentOrganizationMutationContext } from \"../principalMutations/runtimeCurrentOrganizationMutation\";\nimport {\n  buildInitialGroupPolicyRequest,\n  canonicalGroupNameKey,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"../readModel\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\n/** Create from bounded current evidence and publish its genuine genesis with the directory. */\nexport async function createCurrentOrganizationGroup(input: {\n  readonly apiClient: Pick<\n    OrganizationPrincipalPolicyApi,\n    \"createOrganizationGroup\"\n  >;\n  readonly context: CurrentOrganizationMutationContext;\n  readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n  readonly execSql: ExecSql;\n  readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n  readonly name: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<OrganizationGroupSummary> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const nameKey = canonicalGroupNameKey(input.name);\n  // Each current recovery is queued by organization. Retain verified heads one\n  // at a time so the walk stays bounded without collecting full group histories.\n  for (const head of context.descriptor.groupHeads) {\n    const group = await context.readGroup(head.principalId);\n    const stillCurrent = () => context.stillCurrent() && group.stillCurrent();\n    assertProjectionVerificationCurrent(stillCurrent);\n    assertGroupMetadataBinding(group.current, context.descriptor);\n    const name = await readDirectoryGroupName(\n      { ...input, readEncryptedName: input.metadataAccess.readName },\n      group.current,\n    );\n    // Remember independently verified heads even if uniqueness or dispatch\n    // later fails; these are observed policies, never speculative successors.\n    await advanceKeyingCheckpointsAtomically({\n      execSql: input.execSql,\n      organizationId: input.organizationId,\n      access: [],\n      policies: [...group.dependencies, group.policy],\n      stillCurrent,\n    });\n    if (name !== null && canonicalGroupNameKey(name) === nameKey)\n      throw new Error(\n        \"Another signed group in this organization already carries this name\",\n      );\n  }\n  const request = await buildInitialGroupPolicyRequest({\n    ...input,\n    groupId: crypto.randomUUID(),\n    includeSignerAsAdmin: false,\n    externalAuthority: {\n      ...principalPolicyReferenceFromBundle(context.admins.current),\n      principalType: \"group\",\n    },\n    metadataKey: await input.metadataAccess.loadEncryptionKey(),\n  });\n  const head = await groupPolicyMutationHead(request.initialGroupPolicy);\n  const adminProjection = context.admins.policy.projection;\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      ...input,\n      currentPolicy: context.directory.current,\n      descriptor: context.descriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: context.descriptor,\n        nextHead: head,\n      }),\n      adminProjection,\n      adminUsers: await resolveRequiredUserIdentities({\n        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n        userIds: projectionUserIds(adminProjection),\n      }),\n    });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const stored = await input.apiClient.createOrganizationGroup(\n    input.organizationId,\n    { ...request, organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  if (!stored) throw new Error(\"Group could not be created\");\n  // Genesis really has one signed state. Reconstruct only the exact authored\n  // artifacts whose commitments match the summary, then verify them privately.\n  const { bundle } = await acknowledgeInitialGroupPolicy({\n    organizationId: input.organizationId,\n    request,\n    response: stored.group,\n    stateHash: head.stateHash,\n  });\n  const { previousStates: _previousStates, ...current } = bundle;\n  await context.retainCreatedGroup({\n    request: request.initialGroupPolicy,\n    response: { ...current, containerMutations: [] },\n    organizationRequest,\n    organizationResponse: stored.organizationPolicy,\n  });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return { ...stored.group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}

package/workflows/organizations/groups/deleteCurrentOrganizationGroup.js

@@ -0,0 +1,35 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, removeOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+/** Delete against a verified directory without loading the removed group's history. */
+export async function deleteCurrentOrganizationGroup(input) {
+    const { context } = input;
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const adminProjection = context.admins.policy.projection;
+    const request = await buildOrganizationGroupDirectoryPolicyRequest({
+        ...input,
+        adminProjection,
+        adminUsers: await resolveRequiredUserIdentities({
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+            userIds: projectionUserIds(adminProjection),
+        }),
+        currentPolicy: context.directory.current,
+        descriptor: context.descriptor,
+        groupHeads: removeOrganizationGroupHead({
+            descriptor: context.descriptor,
+            groupId: input.groupId,
+        }),
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const stored = await input.apiClient.deleteOrganizationGroup(input.organizationId, input.groupId, { organizationPolicy: request });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    if (!stored)
+        throw new Error("Group could not be deleted");
+    if (stored.organizationId !== input.organizationId ||
+        stored.groupId !== input.groupId)
+        throw new Error("Group deletion response target mismatch");
+    await context.retainDirectory(request, stored.organizationPolicy);
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    return stored;
+}
+//# sourceMappingURL=deleteCurrentOrganizationGroup.js.map

package/workflows/organizations/groups/deleteCurrentOrganizationGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteCurrentOrganizationGroup.js","sourceRoot":"","sources":["deleteCurrentOrganizationGroup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAGvG,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAYpD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,4CAA4C,CAAC;QACjE,GAAG,KAAK;QACR,eAAe;QACf,UAAU,EAAE,MAAM,6BAA6B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;SAC5C,CAAC;QACF,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAChC,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAEhC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAClE,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { CurrentOrganizationMutationContext } from \"../principalMutations/runtimeCurrentOrganizationMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport type { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\n/** Delete against a verified directory without loading the removed group's history. */\nexport async function deleteCurrentOrganizationGroup(input: {\n  readonly apiClient: Pick<\n    Parameters<typeof deleteOrganizationGroup>[0][\"apiClient\"],\n    \"deleteOrganizationGroup\"\n  >;\n  readonly context: CurrentOrganizationMutationContext;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}) {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const adminProjection = context.admins.policy.projection;\n  const request = await buildOrganizationGroupDirectoryPolicyRequest({\n    ...input,\n    adminProjection,\n    adminUsers: await resolveRequiredUserIdentities({\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n      userIds: projectionUserIds(adminProjection),\n    }),\n    currentPolicy: context.directory.current,\n    descriptor: context.descriptor,\n    groupHeads: removeOrganizationGroupHead({\n      descriptor: context.descriptor,\n      groupId: input.groupId,\n    }),\n  });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const stored = await input.apiClient.deleteOrganizationGroup(\n    input.organizationId,\n    input.groupId,\n    { organizationPolicy: request },\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  if (!stored) throw new Error(\"Group could not be deleted\");\n  if (\n    stored.organizationId !== input.organizationId ||\n    stored.groupId !== input.groupId\n  )\n    throw new Error(\"Group deletion response target mismatch\");\n  await context.retainDirectory(request, stored.organizationPolicy);\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return stored;\n}\n"]}

package/workflows/organizations/groups/deleteOrganizationGroup.d.ts

@@ -0,0 +1,19 @@
+import type { SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { DeleteOrganizationGroupRequest } from "../../../internal/validators/request/index.js";
+import type { DeleteOrganizationGroupResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { PrincipalPolicyReadApi } from "../groupPolicy/groupPolicyMutationContext.js";
+export declare function deleteOrganizationGroup(input: {
+    readonly apiClient: PrincipalPolicyReadApi & {
+        deleteOrganizationGroup: (organizationId: string, groupId: string, request: DeleteOrganizationGroupRequest) => Promise<DeleteOrganizationGroupResponse | null>;
+    };
+    readonly execSql: ExecSql;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<DeleteOrganizationGroupResponse>;

package/workflows/organizations/groups/deleteOrganizationGroup.js

@@ -0,0 +1,75 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { loadOrganizationExternalAdminPolicy } from "../../principals/externalAdminPolicy.js";
+import { acknowledgeGroupPolicyState, buildAcknowledgedGroupPolicyBundle, } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, removeOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+export async function deleteOrganizationGroup(input) {
+    const stillCurrent = input.stillCurrent;
+    assertProjectionVerificationCurrent(stillCurrent);
+    await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
+    assertProjectionVerificationCurrent(stillCurrent);
+    const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        currentPolicyReader: input.apiClient,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const adminProjection = externalAdminPolicy.adminBundle.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(adminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection,
+        adminUsers,
+        currentPolicy: externalAdminPolicy.bundle,
+        descriptor: externalAdminPolicy.descriptor,
+        groupHeads: removeOrganizationGroupHead({
+            descriptor: externalAdminPolicy.descriptor,
+            groupId: input.groupId,
+        }),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const stored = await input.apiClient.deleteOrganizationGroup(input.organizationId, input.groupId, { organizationPolicy: organizationRequest });
+    assertProjectionVerificationCurrent(stillCurrent);
+    if (!stored) {
+        throw new Error("Group could not be deleted");
+    }
+    if (stored.organizationId !== input.organizationId ||
+        stored.groupId !== input.groupId) {
+        throw new Error("Group deletion response target mismatch");
+    }
+    const organizationHead = await groupPolicyMutationHead(organizationRequest);
+    const organizationPolicy = await acknowledgeGroupPolicyState({
+        currentPolicy: externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy.currentState,
+    });
+    const organizationBundle = buildAcknowledgedGroupPolicyBundle({
+        currentPolicy: externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy,
+    });
+    await persistLocallyAcknowledgedPrincipalPolicyBundles({
+        entries: [{ bundle: organizationBundle, policy: organizationPolicy }],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        updatedAt: new Date().toISOString(),
+        stillCurrent,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    return stored;
+}
+//# sourceMappingURL=deleteOrganizationGroup.js.map

package/workflows/organizations/groups/deleteOrganizationGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteOrganizationGroup.js","sourceRoot":"","sources":["deleteOrganizationGroup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,oEAAoE,CAAC;AAGtI,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAgB7C;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,UAAU,EAAE,mBAAmB,CAAC,UAAU;QAC1C,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,mBAAmB,CAAC,UAAU;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC5C,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { DeleteOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport type { DeleteOrganizationGroupResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport {\n  acknowledgeGroupPolicyState,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { PrincipalPolicyReadApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\nexport async function deleteOrganizationGroup(input: {\n  readonly apiClient: PrincipalPolicyReadApi & {\n    deleteOrganizationGroup: (\n      organizationId: string,\n      groupId: string,\n      request: DeleteOrganizationGroupRequest,\n    ) => Promise<DeleteOrganizationGroupResponse | null>;\n  };\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<DeleteOrganizationGroupResponse> {\n  const stillCurrent = input.stillCurrent;\n  assertProjectionVerificationCurrent(stillCurrent);\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const adminProjection = externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: externalAdminPolicy.bundle,\n      descriptor: externalAdminPolicy.descriptor,\n      groupHeads: removeOrganizationGroupHead({\n        descriptor: externalAdminPolicy.descriptor,\n        groupId: input.groupId,\n      }),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const stored = await input.apiClient.deleteOrganizationGroup(\n    input.organizationId,\n    input.groupId,\n    { organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!stored) {\n    throw new Error(\"Group could not be deleted\");\n  }\n  if (\n    stored.organizationId !== input.organizationId ||\n    stored.groupId !== input.groupId\n  ) {\n    throw new Error(\"Group deletion response target mismatch\");\n  }\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [{ bundle: organizationBundle, policy: organizationPolicy }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return stored;\n}\n"]}

package/workflows/organizations/groups/groupCreation.d.ts

@@ -0,0 +1,21 @@
+import type { EncapsulationKeyPair, SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { createGroupMetadataAccess } from "../groupMetadata/groupMetadataAccess.js";
+import { type OrganizationPrincipalPolicyApi } from "../groupPolicy/groupPolicyMutationContext.js";
+import type { OrganizationGroupSummary } from "../readModel/index.js";
+export declare function createOrganizationGroup(input: {
+    readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;
+    readonly apiClient: OrganizationPrincipalPolicyApi;
+    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
+    readonly execSql: ExecSql;
+    readonly name: string;
+    readonly organizationId: string;
+    readonly reportSecurityIncident: SecurityIncidentReporter;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<OrganizationGroupSummary>;

package/workflows/organizations/groups/groupCreation.js

@@ -0,0 +1,68 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadOrganizationExternalAdminPolicy } from "../../principals/externalAdminPolicy.js";
+import { cacheGroupPolicy, } from "../groupPolicy/groupPolicyMutationContext.js";
+import { buildInitialGroupPolicyRequest } from "../principalPolicy/principalPolicyRequest.js";
+import { commitCreatedGroupToDirectory } from "./organizationGroupDirectory.js";
+export async function createOrganizationGroup(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        currentPolicyReader: input.apiClient,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    if (!externalAdminPolicy) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    if (!externalAdminPolicy.signerUserIds.includes(input.signerUserId)) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const request = await buildInitialGroupPolicyRequest({
+        creatorEncapsulationKeyPair: input.creatorEncapsulationKeyPair,
+        externalAuthority: externalAdminPolicy.externalAuthority.currentHead,
+        groupId: crypto.randomUUID(),
+        includeSignerAsAdmin: false,
+        name: input.name,
+        metadataKey: await input.metadataAccess.loadEncryptionKey(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const { group, head: expectedHead } = await commitCreatedGroupToDirectory({
+        ...input,
+        externalAdminPolicy,
+        readEncryptedName: input.metadataAccess.readName,
+        request,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    await cacheGroupPolicy({
+        acknowledgedMemberEnvelopes: {
+            envelopes: request.initialGroupPolicy.memberEnvelopes,
+            epoch: request.initialGroupPolicy.state.keyEpoch,
+            principalId: request.groupId,
+            principalType: "group",
+            stateHash: expectedHead.stateHash,
+        },
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        expectedCurrentHead: expectedHead,
+        externalAuthority: externalAdminPolicy.externalAuthority,
+        groupId: group.groupId,
+        localPolicyCheckpoint: {
+            principalId: request.groupId,
+            principalType: "group",
+            stateHash: expectedHead.stateHash,
+            version: expectedHead.version,
+        },
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    return { ...group, name: input.name.trim(), nameUnreadable: false };
+}
+//# sourceMappingURL=groupCreation.js.map

package/workflows/organizations/groups/groupCreation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupCreation.js","sourceRoot":"","sources":["groupCreation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAIvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAE3F,OAAO,EACL,gBAAgB,GAEjB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAE3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAa7C;IACC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,WAAW;QACpE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;QAC3D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACxE,GAAG,KAAK;QACR,mBAAmB;QACnB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ;QAChD,OAAO;KACR,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,eAAe;YACrD,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ;YAChD,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport type { createGroupMetadataAccess } from \"../groupMetadata/groupMetadataAccess\";\nimport {\n  cacheGroupPolicy,\n  type OrganizationPrincipalPolicyApi,\n} from \"../groupPolicy/groupPolicyMutationContext\";\nimport { buildInitialGroupPolicyRequest } from \"../principalPolicy/principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"../readModel\";\nimport { commitCreatedGroupToDirectory } from \"./organizationGroupDirectory\";\n\nexport async function createOrganizationGroup(input: {\n  readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n  readonly apiClient: OrganizationPrincipalPolicyApi;\n  readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n  readonly execSql: ExecSql;\n  readonly name: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<OrganizationGroupSummary> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!externalAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  if (!externalAdminPolicy.signerUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const request = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.creatorEncapsulationKeyPair,\n    externalAuthority: externalAdminPolicy.externalAuthority.currentHead,\n    groupId: crypto.randomUUID(),\n    includeSignerAsAdmin: false,\n    name: input.name,\n    metadataKey: await input.metadataAccess.loadEncryptionKey(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const { group, head: expectedHead } = await commitCreatedGroupToDirectory({\n    ...input,\n    externalAdminPolicy,\n    readEncryptedName: input.metadataAccess.readName,\n    request,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  await cacheGroupPolicy({\n    acknowledgedMemberEnvelopes: {\n      envelopes: request.initialGroupPolicy.memberEnvelopes,\n      epoch: request.initialGroupPolicy.state.keyEpoch,\n      principalId: request.groupId,\n      principalType: \"group\",\n      stateHash: expectedHead.stateHash,\n    },\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedCurrentHead: expectedHead,\n    externalAuthority: externalAdminPolicy.externalAuthority,\n    groupId: group.groupId,\n    localPolicyCheckpoint: {\n      principalId: request.groupId,\n      principalType: \"group\",\n      stateHash: expectedHead.stateHash,\n      version: expectedHead.version,\n    },\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { ...group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}