@tearleads/client-sdk 0.1.79 → 0.1.81

package/workflows/organizations/readModel/listLocalOrganizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"listLocalOrganizations.js","sourceRoot":"","sources":["listLocalOrganizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,6EAA6E,CAAC;AACjI,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EACL,qCAAqC,EACrC,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6CAA6C,EAAE,MAAM,2BAA2B,CAAC;AAoB1F,2EAA2E;AAC3E,wEAAwE;AACxE,gFAAgF;AAChF,sDAAsD;AACtD,KAAK,UAAU,gCAAgC,CAC7C,OAAgB,EAChB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC;YAC7C,OAAO;YACP,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,uBAAuB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,2BAA2B,CAChC,uBAAuB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,yBAAyB,CACtC,OAAgB,EAChB,cAAsB,EACtB,sBAAkE,EAClE,iBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,gCAAgC,CACtD,OAAO,EACP,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,EACP,kBAAkB,EAClB,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,MAAM,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GACtB,MAAM,6CAA6C,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,kBAAkB,CAC3D,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,MAAM,uBAAuB,CAAC,iCAAiC,CAC7D,OAAO,EACP,iBAAiB,CAAC,EAAE,CACrB,CAAC;IACJ,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,gCAAgC,CACjD,OAAO,EACP,eAAe,CAChB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,cAAc,CACrE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,kCAAkC,GACtC,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAC3D,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAChC,CAAC;IAEJ,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAGvC,CAAC;IACJ,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAgC;YACzC,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;SACzC,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IACE,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,SAAS,CAAC,UAAU;YACpB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,aAAa,CACjD,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CACrC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CACzC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/B;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CACtD,CAAC;IAEF,gFAAgF;IAChF,2EAA2E;IAC3E,2BAA2B;IAC3B,OAAO,OAAO,CAAC,GAAG,CAChB,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,MAAM,yBAAyB,CACnC,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,cAAc,EACxB,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,EAC9D,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;YAC9D,IAAI,CACP;QACD,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,SAAS,CAAC,EAAE;KAC9B,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import { readStoredDocumentState } from \"../../../data/documents/documentKinds\";\nimport { sqlContainerContentsPersistence } from \"../../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n  DOCUMENTS_APP_KIND,\n  sqlDocumentsPersistence,\n} from \"../../../data/persistence/documents/documentsPersistence\";\nimport { loadOrganizationProfileDocumentIds } from \"../../../data/persistence/organizations/organizationProfileDocumentPointers\";\nimport { findLocalIdByDocumentId } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { loadPersistedDocumentContent } from \"../../documents/historyContent\";\nimport {\n  getOrganizationProfileDocumentLocalId,\n  readOrganizationProfileName,\n} from \"../organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../rosterProfileContainer\";\n\n// Just the container fields this module needs to locate an org's metadata\n// container among the locally-persisted containers.\ninterface LocalContainerForNameLookup {\n  id: string;\n  systemSlot: string | null;\n}\n\n/**\n * A locally-known organization the user belongs to, derived from its persisted\n * root container. `name` is the decrypted organization-profile display name when\n * one is stored locally, or null when it has not synced yet.\n */\nexport interface LocalOrganizationSummary {\n  name: string | null;\n  organizationId: string;\n  rootContainerId: string;\n}\n\n// Reads and decrypts the `name` field of the organization_profile document\n// persisted under `documentLocalId`, or null if it is absent, empty, or\n// unparseable. A single corrupt profile must not break the whole list, so every\n// failure collapses to a null (unnamed) organization.\nasync function readOrganizationNameFromDocument(\n  execSql: ExecSql,\n  documentLocalId: string,\n): Promise<string | null> {\n  try {\n    const doc = await loadPersistedDocumentContent({\n      execSql,\n      localId: documentLocalId,\n      persistence: sqlDocumentsPersistence,\n    });\n    if (!doc) {\n      return null;\n    }\n\n    return readOrganizationProfileName(\n      readStoredDocumentState(doc).structuredFields,\n    );\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolves an organization's decrypted display name from local state.\n *\n * The same organization_profile document is addressed by several different\n * local-id conventions depending on how it arrived, so one lookup by id is not\n * enough:\n *\n *  - The org's own **provisioner** (and any admin who later edits the name)\n *    writes the document under the deterministic alias\n *    `org-profile:<organizationId>` — resolved by the fast path below.\n *  - A **device that only synced it** — a member of another org, or this same\n *    user's freshly re-hydrated device after an identity restore — never runs\n *    that write. The sync ingest keys the document under the server documentId\n *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),\n *    so the alias lookup misses.\n *\n * Two fallbacks cover the synced case, in order of authority:\n *\n *  1. The **organization read model** records the org's `profileDocumentId`.\n *     That pointer is container-independent, so it resolves the name wherever\n *     the document happens to be linked — including a profile document created\n *     by an admin through the org-manager editor rather than by provisioning.\n *  2. Failing that, locate the org's metadata container by its deterministic\n *     system slot and read whichever profile document is linked there. Keying on\n *     the system slot (rather than the document kind) keeps it correct even\n *     before the projected document kind has been rebuilt from a freshly-synced\n *     snapshot, and it still works before the read model has been projected.\n */\nasync function readLocalOrganizationName(\n  execSql: ExecSql,\n  organizationId: string,\n  organizationContainers: ReadonlyArray<LocalContainerForNameLookup>,\n  profileDocumentId: string | null,\n): Promise<string | null> {\n  const aliasName = await readOrganizationNameFromDocument(\n    execSql,\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n  if (aliasName !== null) {\n    return aliasName;\n  }\n\n  if (profileDocumentId) {\n    // Reach the row wherever it landed: a device that only synced the document\n    // keys it under the server documentId rather than any local alias.\n    const syncedLocalId = await findLocalIdByDocumentId(\n      execSql,\n      DOCUMENTS_APP_KIND,\n      profileDocumentId,\n    );\n    const syncedName = syncedLocalId\n      ? await readOrganizationNameFromDocument(execSql, syncedLocalId)\n      : null;\n    if (syncedName !== null) {\n      return syncedName;\n    }\n  }\n\n  const metadataSystemSlot =\n    await deriveOrganizationMetadataContainerSystemSlot({ organizationId });\n  const metadataContainer = organizationContainers.find(\n    (container) => container.systemSlot === metadataSystemSlot,\n  );\n  if (!metadataContainer) {\n    return null;\n  }\n\n  const documentLocalIds =\n    await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(\n      execSql,\n      metadataContainer.id,\n    );\n  for (const documentLocalId of documentLocalIds) {\n    const name = await readOrganizationNameFromDocument(\n      execSql,\n      documentLocalId,\n    );\n    if (name !== null) {\n      return name;\n    }\n  }\n  return null;\n}\n\n/**\n * Enumerates the organizations the user can manage from local state: one per\n * persisted root container. This is intentionally offline — the Explorer already\n * resolves files across organizations by effective permission, so listing the\n * organizations to manage needs no server round-trip.\n */\nexport async function listLocalOrganizations(input: {\n  execSql: ExecSql;\n}): Promise<LocalOrganizationSummary[]> {\n  const containers = await sqlContainerContentsPersistence.loadContainers(\n    input.execSql,\n  );\n  // A projected read model is not a precondition for listing organizations, so\n  // an unreadable one degrades to the container-derived lookups below.\n  const profileDocumentIdsByOrganizationId =\n    await loadOrganizationProfileDocumentIds(input.execSql).catch(\n      () => new Map<string, string>(),\n    );\n\n  // Group every persisted container by org so name resolution can locate an\n  // org's independent metadata root without a second DB scan.\n  const containersByOrganizationId = new Map<\n    string,\n    LocalContainerForNameLookup[]\n  >();\n  for (const { container } of containers) {\n    const entry: LocalContainerForNameLookup = {\n      id: container.id,\n      systemSlot: container.systemSlot ?? null,\n    };\n    const group = containersByOrganizationId.get(container.organizationId);\n    if (group) {\n      group.push(entry);\n    } else {\n      containersByOrganizationId.set(container.organizationId, [entry]);\n    }\n  }\n\n  const seen = new Set<string>();\n  const rootContainers = containers.filter(({ container }) => {\n    if (\n      container.parentId !== null ||\n      container.systemSlot ||\n      seen.has(container.organizationId)\n    ) {\n      return false;\n    }\n    seen.add(container.organizationId);\n    return true;\n  });\n  rootContainers.sort(\n    (left, right) =>\n      (left.container.localCreatedAt ?? \"\").localeCompare(\n        right.container.localCreatedAt ?? \"\",\n      ) ||\n      left.container.organizationId.localeCompare(\n        right.container.organizationId,\n      ) ||\n      left.container.id.localeCompare(right.container.id),\n  );\n\n  // Read each organization's profile name concurrently; readLocalOrganizationName\n  // already falls back to null per organization, so a single corrupt profile\n  // cannot reject the batch.\n  return Promise.all(\n    rootContainers.map(async ({ container }) => ({\n      name: await readLocalOrganizationName(\n        input.execSql,\n        container.organizationId,\n        containersByOrganizationId.get(container.organizationId) ?? [],\n        profileDocumentIdsByOrganizationId.get(container.organizationId) ??\n          null,\n      ),\n      organizationId: container.organizationId,\n      rootContainerId: container.id,\n    })),\n  );\n}\n"]}
+{"version":3,"file":"listLocalOrganizations.js","sourceRoot":"","sources":["listLocalOrganizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,6EAA6E,CAAC;AACjI,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,qCAAqC,EACrC,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6CAA6C,EAAE,MAAM,2BAA2B,CAAC;AAoB1F,2EAA2E;AAC3E,wEAAwE;AACxE,gFAAgF;AAChF,sDAAsD;AACtD,KAAK,UAAU,gCAAgC,CAC7C,OAAgB,EAChB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC;YAC7C,OAAO;YACP,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,uBAAuB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,2BAA2B,CAChC,uBAAuB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,yBAAyB,CACtC,OAAgB,EAChB,cAAsB,EACtB,sBAAkE,EAClE,iBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,gCAAgC,CACtD,OAAO,EACP,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,EACP,kBAAkB,EAClB,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,MAAM,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GACtB,MAAM,6CAA6C,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,kBAAkB,CAC3D,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,MAAM,uBAAuB,CAAC,iCAAiC,CAC7D,OAAO,EACP,iBAAiB,CAAC,EAAE,CACrB,CAAC;IACJ,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,gCAAgC,CACjD,OAAO,EACP,eAAe,CAChB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,cAAc,CACrE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,kCAAkC,GACtC,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAC3D,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAChC,CAAC;IAEJ,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAGvC,CAAC;IACJ,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAgC;YACzC,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;SACzC,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IACE,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,SAAS,CAAC,UAAU;YACpB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,aAAa,CACjD,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CACrC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CACzC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/B;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CACtD,CAAC;IAEF,gFAAgF;IAChF,2EAA2E;IAC3E,2BAA2B;IAC3B,OAAO,OAAO,CAAC,GAAG,CAChB,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,MAAM,yBAAyB,CACnC,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,cAAc,EACxB,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,EAC9D,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;YAC9D,IAAI,CACP;QACD,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,SAAS,CAAC,EAAE;KAC9B,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import { readStoredDocumentState } from \"../../../data/documents/documentKinds\";\nimport { sqlContainerContentsPersistence } from \"../../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n  DOCUMENTS_APP_KIND,\n  sqlDocumentsPersistence,\n} from \"../../../data/persistence/documents/documentsPersistence\";\nimport { loadOrganizationProfileDocumentIds } from \"../../../data/persistence/organizations/organizationProfileDocumentPointers\";\nimport { findLocalIdByDocumentId } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { loadPersistedDocumentContent } from \"../../documents\";\nimport {\n  getOrganizationProfileDocumentLocalId,\n  readOrganizationProfileName,\n} from \"../organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../rosterProfileContainer\";\n\n// Just the container fields this module needs to locate an org's metadata\n// container among the locally-persisted containers.\ninterface LocalContainerForNameLookup {\n  id: string;\n  systemSlot: string | null;\n}\n\n/**\n * A locally-known organization the user belongs to, derived from its persisted\n * root container. `name` is the decrypted organization-profile display name when\n * one is stored locally, or null when it has not synced yet.\n */\nexport interface LocalOrganizationSummary {\n  name: string | null;\n  organizationId: string;\n  rootContainerId: string;\n}\n\n// Reads and decrypts the `name` field of the organization_profile document\n// persisted under `documentLocalId`, or null if it is absent, empty, or\n// unparseable. A single corrupt profile must not break the whole list, so every\n// failure collapses to a null (unnamed) organization.\nasync function readOrganizationNameFromDocument(\n  execSql: ExecSql,\n  documentLocalId: string,\n): Promise<string | null> {\n  try {\n    const doc = await loadPersistedDocumentContent({\n      execSql,\n      localId: documentLocalId,\n      persistence: sqlDocumentsPersistence,\n    });\n    if (!doc) {\n      return null;\n    }\n\n    return readOrganizationProfileName(\n      readStoredDocumentState(doc).structuredFields,\n    );\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolves an organization's decrypted display name from local state.\n *\n * The same organization_profile document is addressed by several different\n * local-id conventions depending on how it arrived, so one lookup by id is not\n * enough:\n *\n *  - The org's own **provisioner** (and any admin who later edits the name)\n *    writes the document under the deterministic alias\n *    `org-profile:<organizationId>` — resolved by the fast path below.\n *  - A **device that only synced it** — a member of another org, or this same\n *    user's freshly re-hydrated device after an identity restore — never runs\n *    that write. The sync ingest keys the document under the server documentId\n *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),\n *    so the alias lookup misses.\n *\n * Two fallbacks cover the synced case, in order of authority:\n *\n *  1. The **organization read model** records the org's `profileDocumentId`.\n *     That pointer is container-independent, so it resolves the name wherever\n *     the document happens to be linked — including a profile document created\n *     by an admin through the org-manager editor rather than by provisioning.\n *  2. Failing that, locate the org's metadata container by its deterministic\n *     system slot and read whichever profile document is linked there. Keying on\n *     the system slot (rather than the document kind) keeps it correct even\n *     before the projected document kind has been rebuilt from a freshly-synced\n *     snapshot, and it still works before the read model has been projected.\n */\nasync function readLocalOrganizationName(\n  execSql: ExecSql,\n  organizationId: string,\n  organizationContainers: ReadonlyArray<LocalContainerForNameLookup>,\n  profileDocumentId: string | null,\n): Promise<string | null> {\n  const aliasName = await readOrganizationNameFromDocument(\n    execSql,\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n  if (aliasName !== null) {\n    return aliasName;\n  }\n\n  if (profileDocumentId) {\n    // Reach the row wherever it landed: a device that only synced the document\n    // keys it under the server documentId rather than any local alias.\n    const syncedLocalId = await findLocalIdByDocumentId(\n      execSql,\n      DOCUMENTS_APP_KIND,\n      profileDocumentId,\n    );\n    const syncedName = syncedLocalId\n      ? await readOrganizationNameFromDocument(execSql, syncedLocalId)\n      : null;\n    if (syncedName !== null) {\n      return syncedName;\n    }\n  }\n\n  const metadataSystemSlot =\n    await deriveOrganizationMetadataContainerSystemSlot({ organizationId });\n  const metadataContainer = organizationContainers.find(\n    (container) => container.systemSlot === metadataSystemSlot,\n  );\n  if (!metadataContainer) {\n    return null;\n  }\n\n  const documentLocalIds =\n    await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(\n      execSql,\n      metadataContainer.id,\n    );\n  for (const documentLocalId of documentLocalIds) {\n    const name = await readOrganizationNameFromDocument(\n      execSql,\n      documentLocalId,\n    );\n    if (name !== null) {\n      return name;\n    }\n  }\n  return null;\n}\n\n/**\n * Enumerates the organizations the user can manage from local state: one per\n * persisted root container. This is intentionally offline — the Explorer already\n * resolves files across organizations by effective permission, so listing the\n * organizations to manage needs no server round-trip.\n */\nexport async function listLocalOrganizations(input: {\n  execSql: ExecSql;\n}): Promise<LocalOrganizationSummary[]> {\n  const containers = await sqlContainerContentsPersistence.loadContainers(\n    input.execSql,\n  );\n  // A projected read model is not a precondition for listing organizations, so\n  // an unreadable one degrades to the container-derived lookups below.\n  const profileDocumentIdsByOrganizationId =\n    await loadOrganizationProfileDocumentIds(input.execSql).catch(\n      () => new Map<string, string>(),\n    );\n\n  // Group every persisted container by org so name resolution can locate an\n  // org's independent metadata root without a second DB scan.\n  const containersByOrganizationId = new Map<\n    string,\n    LocalContainerForNameLookup[]\n  >();\n  for (const { container } of containers) {\n    const entry: LocalContainerForNameLookup = {\n      id: container.id,\n      systemSlot: container.systemSlot ?? null,\n    };\n    const group = containersByOrganizationId.get(container.organizationId);\n    if (group) {\n      group.push(entry);\n    } else {\n      containersByOrganizationId.set(container.organizationId, [entry]);\n    }\n  }\n\n  const seen = new Set<string>();\n  const rootContainers = containers.filter(({ container }) => {\n    if (\n      container.parentId !== null ||\n      container.systemSlot ||\n      seen.has(container.organizationId)\n    ) {\n      return false;\n    }\n    seen.add(container.organizationId);\n    return true;\n  });\n  rootContainers.sort(\n    (left, right) =>\n      (left.container.localCreatedAt ?? \"\").localeCompare(\n        right.container.localCreatedAt ?? \"\",\n      ) ||\n      left.container.organizationId.localeCompare(\n        right.container.organizationId,\n      ) ||\n      left.container.id.localeCompare(right.container.id),\n  );\n\n  // Read each organization's profile name concurrently; readLocalOrganizationName\n  // already falls back to null per organization, so a single corrupt profile\n  // cannot reject the batch.\n  return Promise.all(\n    rootContainers.map(async ({ container }) => ({\n      name: await readLocalOrganizationName(\n        input.execSql,\n        container.organizationId,\n        containersByOrganizationId.get(container.organizationId) ?? [],\n        profileDocumentIdsByOrganizationId.get(container.organizationId) ??\n          null,\n      ),\n      organizationId: container.organizationId,\n      rootContainerId: container.id,\n    })),\n  );\n}\n"]}

package/workflows/principals/externalAdminPolicy.js

@@ -1,6 +1,6 @@
 import { KeyingVerificationError, verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
-import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
 import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
+import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence.js";
 import { parseOrganizationAuthorityDescriptor, previousStatesIncludeHead, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
 import { organizationAdminExternalAuthority, organizationAdminSignerUserIds, principalPolicyReferenceFromBundle, verifyOrganizationAdminPolicy, } from "../../data/principals/principalPolicyAdminSigners.js";
 import { collectPrincipalPolicySignerPublicKeys, } from "./policyVerification.js";

package/workflows/principals/externalAdminPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"externalAdminPolicy.js","sourceRoot":"","sources":["externalAdminPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,+CAA+C,EAAE,MAAM,6EAA6E,CAAC;AAC9I,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EAEL,oCAAoC,EACpC,yBAAyB,EACzB,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,kCAAkC,EAClC,6BAA6B,GAC9B,MAAM,mDAAmD,CAAC;AAI3D,OAAO,EACL,sCAAsC,GAEvC,MAAM,sBAAsB,CAAC;AAc9B,MAAM,UAAU,qCAAqC,CACnD,SAAsC;IAKtC,OAAO;QACL,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QACtD,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,IACE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAkD;IAElD,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAKvC;IACC,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAqC,EACrC,cAAsB;IAEtB,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,oCAAoC,CAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAmB,SAAQ,KAAK;CAAG;AAEzC,KAAK,UAAU,wBAAwB,CAAC,KAOvC;IAIC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,CACtE,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,IACE,KAAK,CAAC,mBAAmB;YACzB,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;QACxC,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,EACjD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAUD,KAAK,UAAU,2BAA2B,CACxC,KAA+B,EAC/B,cAAsB,EACtB,mBAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,CACtE,cAAc,EACd,cAAc,CACf,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,8BAA8B,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC;QAC3C,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,mBAAmB;QACnB,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAgC;QAC5C,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,MAAM;QACN,UAAU;QACV,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,MAAM;QACN,aAAa,EAAE,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC;KAC5D,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,qCAAqC,CAAC,QAAQ,CAAC;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA+B;IAE/B,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IACjC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,2BAA2B,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,OAAO,MAAM,2BAA2B,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  previousStatesIncludeHead,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  organizationAdminSignerUserIds,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n} from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"./currentPrincipalPolicyReader\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"./policyVerification\";\n\nexport interface VerifiedExternalAdminPolicy {\n  readonly adminBundle: PrincipalPolicyBundleResponse;\n  readonly adminGroupId: string;\n  readonly adminPolicy: VerifiedPrincipalPolicy;\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly memberGroupId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority;\n  readonly signerUserIds: readonly string[];\n}\n\nexport function externalAdminPolicyPersistenceEntries(\n  authority: VerifiedExternalAdminPolicy,\n): ReadonlyArray<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}> {\n  return [\n    { bundle: authority.bundle, policy: authority.policy },\n    { bundle: authority.adminBundle, policy: authority.adminPolicy },\n  ];\n}\n\nfunction assertAdminsPolicyShape(policy: VerifiedPrincipalPolicy): void {\n  if (\n    (policy.history ?? [{ projection: policy.projection }]).some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\n/**\n * A signer the caller cannot resolve is a cache miss, but a resolved signer\n * whose trusted key differs from the one the policy signed with is a\n * verification failure, as on every other policy path (#2365 finding 23).\n */\nfunction signerKeyLoadFailure(\n  error: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): null {\n  if (error === \"fingerprint-mismatch\") {\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"external admin policy signer key fingerprint mismatch\",\n    );\n  }\n  return null;\n}\n\nasync function verifyOrganizationPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<VerifiedPrincipalPolicy | null> {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: input.bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    return signerKeyLoadFailure(signerPublicKeys.error);\n  }\n  const verified = await verifyOrganizationAdminPolicy({\n    bundle: input.bundle,\n    localCheckpoint,\n    organizationId: input.organizationId,\n    signerPublicKeys: signerPublicKeys.signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  return verified.value;\n}\n\nfunction parseScopedAuthorityDescriptor(\n  bundle: PrincipalPolicyBundleResponse,\n  organizationId: string,\n): OrganizationAuthorityDescriptor {\n  let descriptor: OrganizationAuthorityDescriptor;\n  try {\n    descriptor = parseOrganizationAuthorityDescriptor(\n      bundle.currentPayload.ciphertext,\n    );\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"organization authority descriptor is invalid\",\n    );\n  }\n  if (descriptor.organizationId !== organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"organization authority descriptor scope does not match\",\n    );\n  }\n  return descriptor;\n}\n\n/**\n * The organization and its Admins group are separate reads, so an honest\n * Admins commit between them serves a chain that extends the head the\n * directory cites: a stale directory, not tampering (#2365 finding 22). The\n * claim is checked before any signer is trusted, so it is unverified and buys\n * only one organization refetch; a disagreement after that is an incident.\n */\nclass AdminsHeadAdvanced extends Error {}\n\nasync function loadVerifiedAdminsPolicy(input: {\n  readonly adminGroupId: string;\n  readonly expectedHead: ReturnType<typeof requireOrganizationGroupHead>;\n  readonly mayRefetchDirectory: boolean;\n  readonly execSql: ExecSql;\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n} | null> {\n  const bundle = await input.currentPolicyReader.getCurrentPrincipalPolicy(\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!bundle) {\n    return null;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedHead,\n    )\n  ) {\n    if (\n      input.mayRefetchDirectory &&\n      previousStatesIncludeHead(bundle, input.expectedHead)\n    ) {\n      throw new AdminsHeadAdvanced();\n    }\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"reserved Admins policy does not match the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    return signerKeyLoadFailure(signerPublicKeys.error);\n  }\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint,\n    signerPublicKeys: signerPublicKeys.signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (\n    verified.value.principalType !== \"group\" ||\n    verified.value.principalId !== input.adminGroupId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"reserved Admins policy target does not match\",\n    );\n  }\n  assertAdminsPolicyShape(verified.value);\n  return { bundle, policy: verified.value };\n}\n\ninterface ExternalAdminPolicyInput {\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly execSql: ExecSql;\n  readonly organizationId: string | null | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nasync function loadExternalAdminPolicyOnce(\n  input: ExternalAdminPolicyInput,\n  organizationId: string,\n  mayRefetchDirectory: boolean,\n): Promise<VerifiedExternalAdminPolicy | null> {\n  const bundle = await input.currentPolicyReader.getCurrentPrincipalPolicy(\n    \"organization\",\n    organizationId,\n  );\n  if (!bundle) {\n    return null;\n  }\n  const policy = await verifyOrganizationPolicy({\n    bundle,\n    execSql: input.execSql,\n    organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!policy) {\n    return null;\n  }\n  const descriptor = parseScopedAuthorityDescriptor(bundle, organizationId);\n  const admin = await loadVerifiedAdminsPolicy({\n    adminGroupId: descriptor.adminGroupId,\n    mayRefetchDirectory,\n    expectedHead: requireOrganizationGroupHead(\n      descriptor,\n      descriptor.adminGroupId,\n    ),\n    execSql: input.execSql,\n    currentPolicyReader: input.currentPolicyReader,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!admin) {\n    return null;\n  }\n\n  const verified: VerifiedExternalAdminPolicy = {\n    adminBundle: admin.bundle,\n    adminGroupId: descriptor.adminGroupId,\n    adminPolicy: admin.policy,\n    bundle,\n    descriptor,\n    externalAuthority: organizationAdminExternalAuthority(admin.policy),\n    memberGroupId: descriptor.memberGroupId,\n    policy,\n    signerUserIds: organizationAdminSignerUserIds(admin.policy),\n  };\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: externalAdminPolicyPersistenceEntries(verified),\n    execSql: input.execSql,\n    organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return verified;\n}\n\nexport async function loadOrganizationExternalAdminPolicy(\n  input: ExternalAdminPolicyInput,\n): Promise<VerifiedExternalAdminPolicy | null> {\n  const { organizationId } = input;\n  if (!organizationId) {\n    return null;\n  }\n  try {\n    try {\n      return await loadExternalAdminPolicyOnce(input, organizationId, true);\n    } catch (error) {\n      if (!(error instanceof AdminsHeadAdvanced)) throw error;\n      return await loadExternalAdminPolicyOnce(input, organizationId, false);\n    }\n  } catch (error) {\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n"]}
+{"version":3,"file":"externalAdminPolicy.js","sourceRoot":"","sources":["externalAdminPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EAAE,+CAA+C,EAAE,MAAM,iFAAiF,CAAC;AAClJ,OAAO,EAEL,oCAAoC,EACpC,yBAAyB,EACzB,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,kCAAkC,EAClC,6BAA6B,GAC9B,MAAM,mDAAmD,CAAC;AAI3D,OAAO,EACL,sCAAsC,GAEvC,MAAM,sBAAsB,CAAC;AAc9B,MAAM,UAAU,qCAAqC,CACnD,SAAsC;IAKtC,OAAO;QACL,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QACtD,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,IACE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAC7D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAkD;IAElD,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAKvC;IACC,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAqC,EACrC,cAAsB;IAEtB,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,oCAAoC,CAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAmB,SAAQ,KAAK;CAAG;AAEzC,KAAK,UAAU,wBAAwB,CAAC,KAOvC;IAIC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,CACtE,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,YAAY,CACnB,EACD,CAAC;QACD,IACE,KAAK,CAAC,mBAAmB;YACzB,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM;QACN,iBAAiB,EAAE,KAAK,CAAC,YAAY;QACrC,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;QACxC,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,EACjD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAUD,KAAK,UAAU,2BAA2B,CACxC,KAA+B,EAC/B,cAAsB,EACtB,mBAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,CACtE,cAAc,EACd,cAAc,CACf,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,8BAA8B,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC;QAC3C,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,mBAAmB;QACnB,YAAY,EAAE,4BAA4B,CACxC,UAAU,EACV,UAAU,CAAC,YAAY,CACxB;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAgC;QAC5C,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,MAAM;QACN,UAAU;QACV,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,MAAM;QACN,aAAa,EAAE,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC;KAC5D,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,qCAAqC,CAAC,QAAQ,CAAC;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA+B;IAE/B,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IACjC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,2BAA2B,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,OAAO,MAAM,2BAA2B,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  previousStatesIncludeHead,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  organizationAdminExternalAuthority,\n  organizationAdminSignerUserIds,\n  principalPolicyReferenceFromBundle,\n  verifyOrganizationAdminPolicy,\n} from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"./currentPrincipalPolicyReader\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"./policyVerification\";\n\nexport interface VerifiedExternalAdminPolicy {\n  readonly adminBundle: PrincipalPolicyBundleResponse;\n  readonly adminGroupId: string;\n  readonly adminPolicy: VerifiedPrincipalPolicy;\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly memberGroupId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority;\n  readonly signerUserIds: readonly string[];\n}\n\nexport function externalAdminPolicyPersistenceEntries(\n  authority: VerifiedExternalAdminPolicy,\n): ReadonlyArray<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}> {\n  return [\n    { bundle: authority.bundle, policy: authority.policy },\n    { bundle: authority.adminBundle, policy: authority.adminPolicy },\n  ];\n}\n\nfunction assertAdminsPolicyShape(policy: VerifiedPrincipalPolicy): void {\n  if (\n    (policy.history ?? [{ projection: policy.projection }]).some(\n      (entry) =>\n        entry.projection.length === 0 ||\n        entry.projection.some((member) => member.role !== \"admin\"),\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"reserved Admins policy must contain only direct admin users\",\n    );\n  }\n}\n\n/**\n * A signer the caller cannot resolve is a cache miss, but a resolved signer\n * whose trusted key differs from the one the policy signed with is a\n * verification failure, as on every other policy path (#2365 finding 23).\n */\nfunction signerKeyLoadFailure(\n  error: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): null {\n  if (error === \"fingerprint-mismatch\") {\n    throw new KeyingVerificationError(\n      \"signer_mismatch\",\n      \"external admin policy signer key fingerprint mismatch\",\n    );\n  }\n  return null;\n}\n\nasync function verifyOrganizationPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<VerifiedPrincipalPolicy | null> {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: input.bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    return signerKeyLoadFailure(signerPublicKeys.error);\n  }\n  const verified = await verifyOrganizationAdminPolicy({\n    bundle: input.bundle,\n    localCheckpoint,\n    organizationId: input.organizationId,\n    signerPublicKeys: signerPublicKeys.signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  return verified.value;\n}\n\nfunction parseScopedAuthorityDescriptor(\n  bundle: PrincipalPolicyBundleResponse,\n  organizationId: string,\n): OrganizationAuthorityDescriptor {\n  let descriptor: OrganizationAuthorityDescriptor;\n  try {\n    descriptor = parseOrganizationAuthorityDescriptor(\n      bundle.currentPayload.ciphertext,\n    );\n  } catch {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"organization authority descriptor is invalid\",\n    );\n  }\n  if (descriptor.organizationId !== organizationId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"organization authority descriptor scope does not match\",\n    );\n  }\n  return descriptor;\n}\n\n/**\n * The organization and its Admins group are separate reads, so an honest\n * Admins commit between them serves a chain that extends the head the\n * directory cites: a stale directory, not tampering (#2365 finding 22). The\n * claim is checked before any signer is trusted, so it is unverified and buys\n * only one organization refetch; a disagreement after that is an incident.\n */\nclass AdminsHeadAdvanced extends Error {}\n\nasync function loadVerifiedAdminsPolicy(input: {\n  readonly adminGroupId: string;\n  readonly expectedHead: ReturnType<typeof requireOrganizationGroupHead>;\n  readonly mayRefetchDirectory: boolean;\n  readonly execSql: ExecSql;\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n} | null> {\n  const bundle = await input.currentPolicyReader.getCurrentPrincipalPolicy(\n    \"group\",\n    input.adminGroupId,\n  );\n  if (!bundle) {\n    return null;\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedHead,\n    )\n  ) {\n    if (\n      input.mayRefetchDirectory &&\n      previousStatesIncludeHead(bundle, input.expectedHead)\n    ) {\n      throw new AdminsHeadAdvanced();\n    }\n    throw new KeyingVerificationError(\n      \"hash_mismatch\",\n      \"reserved Admins policy does not match the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.adminGroupId,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    return signerKeyLoadFailure(signerPublicKeys.error);\n  }\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle,\n    expectedReference: input.expectedHead,\n    localCheckpoint,\n    signerPublicKeys: signerPublicKeys.signerPublicKeys,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  if (\n    verified.value.principalType !== \"group\" ||\n    verified.value.principalId !== input.adminGroupId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"reserved Admins policy target does not match\",\n    );\n  }\n  assertAdminsPolicyShape(verified.value);\n  return { bundle, policy: verified.value };\n}\n\ninterface ExternalAdminPolicyInput {\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly execSql: ExecSql;\n  readonly organizationId: string | null | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nasync function loadExternalAdminPolicyOnce(\n  input: ExternalAdminPolicyInput,\n  organizationId: string,\n  mayRefetchDirectory: boolean,\n): Promise<VerifiedExternalAdminPolicy | null> {\n  const bundle = await input.currentPolicyReader.getCurrentPrincipalPolicy(\n    \"organization\",\n    organizationId,\n  );\n  if (!bundle) {\n    return null;\n  }\n  const policy = await verifyOrganizationPolicy({\n    bundle,\n    execSql: input.execSql,\n    organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!policy) {\n    return null;\n  }\n  const descriptor = parseScopedAuthorityDescriptor(bundle, organizationId);\n  const admin = await loadVerifiedAdminsPolicy({\n    adminGroupId: descriptor.adminGroupId,\n    mayRefetchDirectory,\n    expectedHead: requireOrganizationGroupHead(\n      descriptor,\n      descriptor.adminGroupId,\n    ),\n    execSql: input.execSql,\n    currentPolicyReader: input.currentPolicyReader,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!admin) {\n    return null;\n  }\n\n  const verified: VerifiedExternalAdminPolicy = {\n    adminBundle: admin.bundle,\n    adminGroupId: descriptor.adminGroupId,\n    adminPolicy: admin.policy,\n    bundle,\n    descriptor,\n    externalAuthority: organizationAdminExternalAuthority(admin.policy),\n    memberGroupId: descriptor.memberGroupId,\n    policy,\n    signerUserIds: organizationAdminSignerUserIds(admin.policy),\n  };\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: externalAdminPolicyPersistenceEntries(verified),\n    execSql: input.execSql,\n    organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return verified;\n}\n\nexport async function loadOrganizationExternalAdminPolicy(\n  input: ExternalAdminPolicyInput,\n): Promise<VerifiedExternalAdminPolicy | null> {\n  const { organizationId } = input;\n  if (!organizationId) {\n    return null;\n  }\n  try {\n    try {\n      return await loadExternalAdminPolicyOnce(input, organizationId, true);\n    } catch (error) {\n      if (!(error instanceof AdminsHeadAdvanced)) throw error;\n      return await loadExternalAdminPolicyOnce(input, organizationId, false);\n    }\n  } catch (error) {\n    if (error instanceof KeyingVerificationError) {\n      throw error;\n    }\n    return null;\n  }\n}\n"]}

package/workflows/principals/policyCache/principalPolicyCacheAdvance.js

@@ -1,5 +1,5 @@
 import { KeyingVerificationError } from "../../../internal/crypto/index.js";
-import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
+import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../../data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence.js";
 class PolicyCacheAdvanceRace extends Error {
     verificationError;
     constructor(verificationError) {

package/workflows/principals/policyCache/principalPolicyCacheAdvance.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyCacheAdvance.js","sourceRoot":"","sources":["principalPolicyCacheAdvance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,+CAA+C,EAAE,MAAM,gFAAgF,CAAC;AAEjJ,MAAM,sBAAuB,SAAQ,KAAK;IACnB;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;IAE/D,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA4E;IAE5E,IAAI,CAAC;QACH,MAAM,+CAA+C,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YACvE,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,SAA8C;IAE9C,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,YAAY,sBAAsB;YAC3C,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\n\nclass PolicyCacheAdvanceRace extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n  }\n}\n\n/** Only a fully verified candidate losing the atomic commit race can retry. */\nexport async function persistPrincipalPolicyCacheEntries(\n  input: Parameters<typeof persistVerifiedPrincipalPolicyBundlesAtomically>[0],\n): Promise<void> {\n  try {\n    await persistVerifiedPrincipalPolicyBundlesAtomically(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError && error.code === \"rollback\")\n      throw new PolicyCacheAdvanceRace(error);\n    throw error;\n  }\n}\n\n/** Discard stale snapshots once; the replacement must pass every normal check. */\nexport async function retryPrincipalPolicyCacheAdvance<Result>(\n  operation: (fresh: boolean) => Promise<Result>,\n): Promise<Result> {\n  try {\n    return await operation(false);\n  } catch (error) {\n    if (!(error instanceof PolicyCacheAdvanceRace)) throw error;\n  }\n  try {\n    return await operation(true);\n  } catch (error) {\n    throw error instanceof PolicyCacheAdvanceRace\n      ? error.verificationError\n      : error;\n  }\n}\n"]}
+{"version":3,"file":"principalPolicyCacheAdvance.js","sourceRoot":"","sources":["principalPolicyCacheAdvance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,+CAA+C,EAAE,MAAM,oFAAoF,CAAC;AAErJ,MAAM,sBAAuB,SAAQ,KAAK;IACnB;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;IAE/D,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA4E;IAE5E,IAAI,CAAC;QACH,MAAM,+CAA+C,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YACvE,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,SAA8C;IAE9C,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,YAAY,sBAAsB;YAC3C,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../../data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence\";\n\nclass PolicyCacheAdvanceRace extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n  }\n}\n\n/** Only a fully verified candidate losing the atomic commit race can retry. */\nexport async function persistPrincipalPolicyCacheEntries(\n  input: Parameters<typeof persistVerifiedPrincipalPolicyBundlesAtomically>[0],\n): Promise<void> {\n  try {\n    await persistVerifiedPrincipalPolicyBundlesAtomically(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError && error.code === \"rollback\")\n      throw new PolicyCacheAdvanceRace(error);\n    throw error;\n  }\n}\n\n/** Discard stale snapshots once; the replacement must pass every normal check. */\nexport async function retryPrincipalPolicyCacheAdvance<Result>(\n  operation: (fresh: boolean) => Promise<Result>,\n): Promise<Result> {\n  try {\n    return await operation(false);\n  } catch (error) {\n    if (!(error instanceof PolicyCacheAdvanceRace)) throw error;\n  }\n  try {\n    return await operation(true);\n  } catch (error) {\n    throw error instanceof PolicyCacheAdvanceRace\n      ? error.verificationError\n      : error;\n  }\n}\n"]}

package/workflows/principals/policyCache/principalPolicyOrganizationScope.js

@@ -1,6 +1,6 @@
 import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { principalPolicyHeadMeetsCheckpoint } from "../../../data/keyingProjectionVerification/index.js";
 import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
-import { principalPolicyHeadMeetsCheckpoint } from "../../../data/persistence/principalPolicy/principalPolicyCheckpointSelection.js";
 import { loadPrincipalPolicyBundle } from "../../../data/persistence/principalPolicy/principalPolicyPersistence.js";
 import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../../data/principals/organizationAuthorityDescriptor.js";
 import { verifyOrganizationAdminPolicy } from "../../../data/principals/principalPolicyAdminSigners.js";

package/workflows/principals/policyCache/principalPolicyOrganizationScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyOrganizationScope.js","sourceRoot":"","sources":["principalPolicyOrganizationScope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,yEAAyE,CAAC;AACxH,OAAO,EAAE,kCAAkC,EAAE,MAAM,8EAA8E,CAAC;AAClI,OAAO,EAAE,yBAAyB,EAAE,MAAM,sEAAsE,CAAC;AACjH,OAAO,EAEL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAIrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,uBAAuB,CAAC;AAY/E,MAAM,UAAU,4BAA4B,CAC1C,SAAyC,EACzC,MAA+B,EAC/B,SAAkC;IAElC,MAAM,IAAI,GAAG,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CACrD,CAAC;IACF,sEAAsE;IACtE,2EAA2E;IAC3E,OAAO,CACL,CAAC,CAAC,IAAI;QACN,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO;QACjC,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/B,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CACtD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAK3C;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoD,CAAC;IACzE,MAAM,IAAI,GAAG,KAAK,EAChB,MAAe,EAC0B,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,MAAM,GAAG,MAAM;YACjB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACN,IACE,MAAM;YACN,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;YAEpE,MAAM,GAAG,IAAI,CAAC;QAChB,MAAM,KAAK,MAAM,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,CAClE,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,KAAK,KAAK,sBAAsB;gBAC1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM;YACN,eAAe,EAAE,UAAU;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,IAAI,UAA2C,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,GAAG,oCAAoC,CAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { principalPolicyHeadMeetsCheckpoint } from \"../../../data/persistence/principalPolicy/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { verifyOrganizationAdminPolicy } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"../currentPrincipalPolicyReader\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../policyVerification\";\n\nexport interface VerifiedPolicyDirectory {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n}\n\nexport type PolicyDirectoryLoader = (\n  remote: boolean,\n) => Promise<VerifiedPolicyDirectory | null>;\n\nexport function directoryBindsGroupReference(\n  directory: VerifiedPolicyDirectory | null,\n  policy: VerifiedPrincipalPolicy,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const head = directory?.descriptor.groupHeads.find(\n    (head) => head.principalId === reference.principalId,\n  );\n  // A newer directory head authenticates its verified predecessors too.\n  // Requiring equality with a historical manifest citation bricks old reads.\n  return (\n    !!head &&\n    head.version >= reference.version &&\n    head.version === policy.version &&\n    [policy.state, ...(policy.history ?? []).map((entry) => entry.state)].some(\n      (state) => principalHeadMatchesReference(state, head),\n    )\n  );\n}\n\nexport function createPolicyDirectoryLoader(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): PolicyDirectoryLoader {\n  const memo = new Map<boolean, Promise<VerifiedPolicyDirectory | null>>();\n  const load = async (\n    remote: boolean,\n  ): Promise<VerifiedPolicyDirectory | null> => {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      input.execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    let bundle = remote\n      ? null\n      : await loadPrincipalPolicyBundle(\n          input.execSql,\n          \"organization\",\n          input.organizationId,\n        );\n    if (\n      bundle &&\n      !principalPolicyHeadMeetsCheckpoint(bundle.currentState, checkpoint)\n    )\n      bundle = null;\n    bundle ??= await input.currentPolicyReader.getCurrentPrincipalPolicy(\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) return null;\n    const signers = await collectPrincipalPolicySignerPublicKeys({\n      bundle,\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    });\n    if (\"error\" in signers) {\n      if (signers.error === \"fingerprint-mismatch\")\n        throw new KeyingVerificationError(\n          \"signer_mismatch\",\n          \"organization directory signer fingerprint does not match\",\n        );\n      return null;\n    }\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle,\n      localCheckpoint: checkpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys: signers.signerPublicKeys,\n    });\n    if (!verified.ok) throw verified.error;\n    let descriptor: OrganizationAuthorityDescriptor;\n    try {\n      descriptor = parseOrganizationAuthorityDescriptor(\n        bundle.currentPayload.ciphertext,\n      );\n    } catch {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"organization directory payload is invalid\",\n      );\n    }\n    if (descriptor.organizationId !== input.organizationId)\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization directory scope does not match\",\n      );\n    return { bundle, policy: verified.value, descriptor };\n  };\n  return (remote) => {\n    let pending = memo.get(remote);\n    if (!pending) {\n      pending = load(remote);\n      memo.set(remote, pending);\n    }\n    return pending;\n  };\n}\n"]}
+{"version":3,"file":"principalPolicyOrganizationScope.js","sourceRoot":"","sources":["principalPolicyOrganizationScope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,4CAA4C,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,yEAAyE,CAAC;AACxH,OAAO,EAAE,yBAAyB,EAAE,MAAM,sEAAsE,CAAC;AACjH,OAAO,EAEL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAIrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,uBAAuB,CAAC;AAY/E,MAAM,UAAU,4BAA4B,CAC1C,SAAyC,EACzC,MAA+B,EAC/B,SAAkC;IAElC,MAAM,IAAI,GAAG,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CACrD,CAAC;IACF,sEAAsE;IACtE,2EAA2E;IAC3E,OAAO,CACL,CAAC,CAAC,IAAI;QACN,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO;QACjC,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/B,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CACtD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAK3C;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoD,CAAC;IACzE,MAAM,IAAI,GAAG,KAAK,EAChB,MAAe,EAC0B,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,MAAM,GAAG,MAAM;YACjB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACN,IACE,MAAM;YACN,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;YAEpE,MAAM,GAAG,IAAI,CAAC;QAChB,MAAM,KAAK,MAAM,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,CAClE,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,KAAK,KAAK,sBAAsB;gBAC1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM;YACN,eAAe,EAAE,UAAU;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,IAAI,UAA2C,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,GAAG,oCAAoC,CAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { principalPolicyHeadMeetsCheckpoint } from \"../../../data/keyingProjectionVerification\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { verifyOrganizationAdminPolicy } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"../currentPrincipalPolicyReader\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../policyVerification\";\n\nexport interface VerifiedPolicyDirectory {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n}\n\nexport type PolicyDirectoryLoader = (\n  remote: boolean,\n) => Promise<VerifiedPolicyDirectory | null>;\n\nexport function directoryBindsGroupReference(\n  directory: VerifiedPolicyDirectory | null,\n  policy: VerifiedPrincipalPolicy,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const head = directory?.descriptor.groupHeads.find(\n    (head) => head.principalId === reference.principalId,\n  );\n  // A newer directory head authenticates its verified predecessors too.\n  // Requiring equality with a historical manifest citation bricks old reads.\n  return (\n    !!head &&\n    head.version >= reference.version &&\n    head.version === policy.version &&\n    [policy.state, ...(policy.history ?? []).map((entry) => entry.state)].some(\n      (state) => principalHeadMatchesReference(state, head),\n    )\n  );\n}\n\nexport function createPolicyDirectoryLoader(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): PolicyDirectoryLoader {\n  const memo = new Map<boolean, Promise<VerifiedPolicyDirectory | null>>();\n  const load = async (\n    remote: boolean,\n  ): Promise<VerifiedPolicyDirectory | null> => {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      input.execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    let bundle = remote\n      ? null\n      : await loadPrincipalPolicyBundle(\n          input.execSql,\n          \"organization\",\n          input.organizationId,\n        );\n    if (\n      bundle &&\n      !principalPolicyHeadMeetsCheckpoint(bundle.currentState, checkpoint)\n    )\n      bundle = null;\n    bundle ??= await input.currentPolicyReader.getCurrentPrincipalPolicy(\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) return null;\n    const signers = await collectPrincipalPolicySignerPublicKeys({\n      bundle,\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    });\n    if (\"error\" in signers) {\n      if (signers.error === \"fingerprint-mismatch\")\n        throw new KeyingVerificationError(\n          \"signer_mismatch\",\n          \"organization directory signer fingerprint does not match\",\n        );\n      return null;\n    }\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle,\n      localCheckpoint: checkpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys: signers.signerPublicKeys,\n    });\n    if (!verified.ok) throw verified.error;\n    let descriptor: OrganizationAuthorityDescriptor;\n    try {\n      descriptor = parseOrganizationAuthorityDescriptor(\n        bundle.currentPayload.ciphertext,\n      );\n    } catch {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"organization directory payload is invalid\",\n      );\n    }\n    if (descriptor.organizationId !== input.organizationId)\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization directory scope does not match\",\n      );\n    return { bundle, policy: verified.value, descriptor };\n  };\n  return (remote) => {\n    let pending = memo.get(remote);\n    if (!pending) {\n      pending = load(remote);\n      memo.set(remote, pending);\n    }\n    return pending;\n  };\n}\n"]}

package/workflows/registration/index.d.ts

@@ -1,5 +1,6 @@
 export { bootstrapRootContainer } from "./bootstrapRootContainer.js";
+export { buildInitialOrganizationPolicyRequest, type ProvisionedSystemContainerSpec, } from "./organizationProvisioning.js";
 export { persistRegistrationBootstrap } from "./persistRegistrationBootstrap.js";
-export { buildInitialOrganizationPolicyRequest, type ProvisionedSystemContainerSpec, type RegisterIdentityInput, type RegistrationApi, registerIdentity, } from "./registerIdentity.js";
+export { type RegisterIdentityInput, type RegistrationApi, registerIdentity, } from "./registerIdentity.js";
 export { principalPolicyBundleFromInitialGroupRequest } from "./registrationPrincipalPolicyPersistence.js";
 export { createInitialRootMetadataBootstrap, type InitialRootMetadataBootstrap, } from "./rootMetadataBootstrap.js";

package/workflows/registration/index.js

@@ -1,6 +1,7 @@
 export { bootstrapRootContainer } from "./bootstrapRootContainer.js";
+export { buildInitialOrganizationPolicyRequest, } from "./organizationProvisioning.js";
 export { persistRegistrationBootstrap } from "./persistRegistrationBootstrap.js";
-export { buildInitialOrganizationPolicyRequest, registerIdentity, } from "./registerIdentity.js";
+export { registerIdentity, } from "./registerIdentity.js";
 export { principalPolicyBundleFromInitialGroupRequest } from "./registrationPrincipalPolicyPersistence.js";
 export { createInitialRootMetadataBootstrap, } from "./rootMetadataBootstrap.js";
 //# sourceMappingURL=index.js.map

package/workflows/registration/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EACL,qCAAqC,EAIrC,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EACL,kCAAkC,GAEnC,MAAM,yBAAyB,CAAC","sourcesContent":["export { bootstrapRootContainer } from \"./bootstrapRootContainer\";\nexport { persistRegistrationBootstrap } from \"./persistRegistrationBootstrap\";\nexport {\n  buildInitialOrganizationPolicyRequest,\n  type ProvisionedSystemContainerSpec,\n  type RegisterIdentityInput,\n  type RegistrationApi,\n  registerIdentity,\n} from \"./registerIdentity\";\nexport { principalPolicyBundleFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nexport {\n  createInitialRootMetadataBootstrap,\n  type InitialRootMetadataBootstrap,\n} from \"./rootMetadataBootstrap\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,qCAAqC,GAEtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAGL,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EACL,kCAAkC,GAEnC,MAAM,yBAAyB,CAAC","sourcesContent":["export { bootstrapRootContainer } from \"./bootstrapRootContainer\";\nexport {\n  buildInitialOrganizationPolicyRequest,\n  type ProvisionedSystemContainerSpec,\n} from \"./organizationProvisioning\";\nexport { persistRegistrationBootstrap } from \"./persistRegistrationBootstrap\";\nexport {\n  type RegisterIdentityInput,\n  type RegistrationApi,\n  registerIdentity,\n} from \"./registerIdentity\";\nexport { principalPolicyBundleFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nexport {\n  createInitialRootMetadataBootstrap,\n  type InitialRootMetadataBootstrap,\n} from \"./rootMetadataBootstrap\";\n"]}

package/workflows/registration/organizationProvisioning.d.ts

@@ -0,0 +1,39 @@
+import { type EncapsulationKeyPair, type ReferencedPrincipalHead, type SigningKeyPair } from "../../internal/crypto/index.js";
+import type { RegistrationRequest } from "../../internal/validators/request/index.js";
+import type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
+import { type ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
+export type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
+export { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
+export type { ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
+/**
+ * The freshly built provisioning artifacts, shared by registration and
+ * additional-organization creation. `registerIdentity` generates a new
+ * `userId`; creating an additional organization reuses the caller's existing
+ * one. Everything here is derived purely from the caller's key material, so it
+ * is identical for both flows.
+ */
+export interface OrganizationProvisioningArtifactsInput {
+    encapsulationKeyPair: EncapsulationKeyPair;
+    organizationProfileName?: string | undefined;
+    /**
+     * App-owned system containers to provision atomically with the organization
+     * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and
+     * organization-metadata system containers.
+     */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+    rootContainerId: string;
+    rosterProfileNickname?: string | undefined;
+    signingKeyPair: SigningKeyPair;
+    userId: string;
+}
+export declare function buildInitialOrganizationPolicyRequest(input: {
+    adminGroupId: string;
+    groupHeads: readonly ReferencedPrincipalHead[];
+    encapsulationPublicKey: Uint8Array;
+    memberGroupId: string;
+    organizationId: string;
+    signingKeyPair: SigningKeyPair;
+    userId: string;
+}): Promise<RegistrationRequest["initialOrganizationPolicy"]>;
+/** Builds the signed artifacts shared by registration and org creation. */
+export declare function buildOrganizationProvisioningArtifacts(input: OrganizationProvisioningArtifactsInput): Promise<OrganizationProvisioningArtifacts>;

package/workflows/registration/organizationProvisioning.js

@@ -0,0 +1,211 @@
+// Registration and additional-organization creation build and persist an
+// organization's founding policies, system containers, and profile documents
+// through this module.
+import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { encodeOrganizationAuthorityDescriptor } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { resolveDocumentCreateAuthor } from "../documents/index.js";
+import { groupPolicyMutationHead } from "../organizations/groupPolicy/groupPolicyMutationHead.js";
+import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "../organizations/principalPolicy/index.js";
+import { buildInitialOrganizationMetadataBootstrap, buildInitialRootProvisioning, buildInitialRosterProfileBootstrap, buildInitialSystemContainerBootstrap, } from "./provisioningBootstrapBuilders.js";
+import { createInitialRootMetadataBootstrap } from "./rootMetadataBootstrap.js";
+export { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
+export async function buildInitialOrganizationPolicyRequest(input) {
+    const organizationKem = generateKemSeedAndKeyPair();
+    const signerUserKeyFingerprint = await toFingerprint(input.signingKeyPair.signingPublicKey);
+    const userEncapsulationKeyFingerprint = await toFingerprint(input.encapsulationPublicKey);
+    const projection = [
+        {
+            userId: input.userId,
+            role: "admin",
+        },
+    ];
+    const payloadCiphertext = encodeOrganizationAuthorityDescriptor({
+        version: 2,
+        organizationId: input.organizationId,
+        adminGroupId: input.adminGroupId,
+        memberGroupId: input.memberGroupId,
+        groupHeads: input.groupHeads.map((head) => {
+            if (head.principalType !== "group") {
+                throw new Error("Organization directory can contain only group heads");
+            }
+            return { ...head, principalType: "group" };
+        }),
+    });
+    const [memberEnvelope] = await wrapDekForRecipients(organizationKem.secretKey, [input.encapsulationPublicKey]);
+    if (!memberEnvelope) {
+        throw new Error("Failed to wrap organization key for registering user");
+    }
+    const memberEnvelopes = [
+        {
+            userId: input.userId,
+            memberKeyFingerprint: userEncapsulationKeyFingerprint,
+            kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),
+            wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),
+        },
+    ];
+    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
+        principalType: "organization",
+        principalId: input.organizationId,
+        version: 1,
+        prevStateHash: null,
+        keyEpoch: 1,
+        encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),
+        keyFingerprint: await toFingerprint(organizationKem.publicKey),
+        members: [{ userId: input.userId }],
+        memberEnvelopes,
+        projection,
+        grants: [],
+        payloadCiphertext,
+        externalAuthority: null,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.userId,
+        signerUserKeyFingerprint,
+    }), input.signingKeyPair.signingPrivateKey);
+    return {
+        state,
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm",
+            ciphertext: payloadCiphertext,
+            ciphertextHash: state.payloadCiphertextHash,
+        },
+        projection,
+        grants: [],
+        memberEnvelopes,
+    };
+}
+async function createOrganizationPrincipalPolicies(input) {
+    const organizationId = crypto.randomUUID();
+    const signingFingerprint = await toFingerprint(input.signingKeyPair.signingPublicKey);
+    const initialAdminGroup = await buildInitialGroupPolicyRequest({
+        creatorEncapsulationKeyPair: input.encapsulationKeyPair,
+        groupId: crypto.randomUUID(),
+        grants: [
+            { containerId: input.rootContainerId, accessLevel: "admin" },
+            {
+                containerId: input.organizationMetadataContainerId,
+                accessLevel: "admin",
+            },
+        ],
+        name: "Admins",
+        builtinRole: "admins",
+        signerUserId: input.userId,
+        signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({
+        creatorEncapsulationKeyPair: input.encapsulationKeyPair,
+        groupId: crypto.randomUUID(),
+        grants: [
+            {
+                containerId: input.organizationMetadataContainerId,
+                accessLevel: "read",
+            },
+        ],
+        signerUserId: input.userId,
+        signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest({
+        adminGroupId: initialAdminGroup.groupId,
+        encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+        groupHeads: await Promise.all([
+            groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),
+            groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),
+        ]),
+        memberGroupId: initialMemberGroup.groupId,
+        organizationId,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    });
+    return {
+        initialAdminGroup,
+        initialMemberGroup,
+        initialOrganizationPolicy,
+        organizationId,
+        signingFingerprint,
+    };
+}
+function requireOrganizationProvisioningAuthor(input) {
+    const author = resolveDocumentCreateAuthor({
+        auth: { organizationId: input.organizationId, userId: input.userId },
+        crypto: {
+            signingFingerprint: input.signingFingerprint,
+            signingKeyPair: input.signingKeyPair,
+        },
+    });
+    if (!author) {
+        throw new Error(`Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`);
+    }
+    return author;
+}
+/** Builds the signed artifacts shared by registration and org creation. */
+export async function buildOrganizationProvisioningArtifacts(input) {
+    const bootstrap = await createInitialRootMetadataBootstrap(input.rootContainerId);
+    const organizationMetadataContainerId = crypto.randomUUID();
+    const { initialAdminGroup, initialMemberGroup, initialOrganizationPolicy, organizationId, signingFingerprint, } = await createOrganizationPrincipalPolicies({
+        encapsulationKeyPair: input.encapsulationKeyPair,
+        organizationMetadataContainerId,
+        rootContainerId: input.rootContainerId,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    });
+    const author = requireOrganizationProvisioningAuthor({
+        organizationId,
+        signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+        userId: input.userId,
+    });
+    const { rootContainer, rootContainerProjection, rootMetadataDocument, rootMetadataDocumentRequest, } = await buildInitialRootProvisioning({
+        adminGroup: initialAdminGroup,
+        author,
+        bootstrap,
+        recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+        rootContainerId: input.rootContainerId,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    });
+    const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({
+        author,
+        encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
+        initialAdminGroup,
+        rosterProfileNickname: input.rosterProfileNickname,
+        rootContainer,
+        rootContainerProjection,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    });
+    const organizationMetadataBootstrap = await buildInitialOrganizationMetadataBootstrap({
+        author,
+        containerId: organizationMetadataContainerId,
+        initialAdminGroup,
+        initialMemberGroup,
+        organizationProfileName: input.organizationProfileName,
+        rootContainer,
+        rootContainerProjection,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    });
+    const systemContainerBootstraps = await Promise.all((input.provisionedSystemContainers ?? []).map((spec) => buildInitialSystemContainerBootstrap({
+        author,
+        initialAdminGroup,
+        rootContainer,
+        rootContainerProjection,
+        signingPrivateKey: input.signingKeyPair.signingPrivateKey,
+        spec,
+        targetSecretKey: input.encapsulationKeyPair.secretKey,
+    })));
+    return {
+        replacementAuthorization: null,
+        bootstrap,
+        initialAdminGroup,
+        initialMemberGroup,
+        initialOrganizationPolicy,
+        initialRootContainer: rootContainer.plan.request,
+        organizationId,
+        organizationMetadataBootstrap,
+        rootContainer,
+        rootMetadataDocument,
+        rootMetadataDocumentRequest,
+        rosterProfileBootstrap,
+        systemContainerBootstraps,
+    };
+}
+//# sourceMappingURL=organizationProvisioning.js.map

package/workflows/registration/organizationProvisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationProvisioning.js","sourceRoot":"","sources":["organizationProvisioning.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,uBAAuB;AACvB,OAAO,EACL,+BAA+B,EAE/B,yBAAyB,EAGzB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,yCAAyC,EACzC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAG7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAmC7F,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,wBAAwB,GAAG,MAAM,aAAa,CAClD,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,aAAa,CACzD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,UAAU,GAAG;QACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,OAAgB;SACvB;KACF,CAAC;IACF,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CACjD,eAAe,CAAC,SAAS,EACzB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAC/B,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG;QACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,+BAA+B;YACrD,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,CAAC;QACX,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,wBAAwB;KACzB,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM,EAAE,EAAE;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;QAC7D,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE;YAC5D;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,OAAO;aACrB;SACF;QACD,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;QACpE,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,MAAM;aACpB;SACF;QACD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,qCAAqC,CAC3E;QACE,YAAY,EAAE,iBAAiB,CAAC,OAAO;QACvC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC7D,uBAAuB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;SAC/D,CAAC;QACF,aAAa,EAAE,kBAAkB,CAAC,OAAO;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACpE,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5D,MAAM,EACJ,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,GACnB,GAAG,MAAM,mCAAmC,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,+BAA+B;QAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC;QACnD,cAAc;QACd,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,MAAM,EACJ,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,GAAG,MAAM,4BAA4B,CAAC;QACrC,UAAU,EAAE,iBAAiB;QAC7B,MAAM;QACN,SAAS;QACT,+BAA+B,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,iBAAiB;QACjB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,6BAA6B,GACjC,MAAM,yCAAyC,CAAC;QAC9C,MAAM;QACN,WAAW,EAAE,+BAA+B;QAC5C,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACL,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,oCAAoC,CAAC;QACnC,MAAM;QACN,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;QACzD,IAAI;QACJ,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,SAAS;QACT,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;QAChD,cAAc;QACd,6BAA6B;QAC7B,aAAa;QACb,oBAAoB;QACpB,2BAA2B;QAC3B,sBAAsB;QACtB,yBAAyB;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["// Registration and additional-organization creation build and persist an\n// organization's founding policies, system containers, and profile documents\n// through this module.\nimport {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  generateKemSeedAndKeyPair,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport { encodeOrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { resolveDocumentCreateAuthor } from \"../documents\";\nimport { groupPolicyMutationHead } from \"../organizations/groupPolicy/groupPolicyMutationHead\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"../organizations/principalPolicy\";\nimport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nimport {\n  buildInitialOrganizationMetadataBootstrap,\n  buildInitialRootProvisioning,\n  buildInitialRosterProfileBootstrap,\n  buildInitialSystemContainerBootstrap,\n  type ProvisionedSystemContainerSpec,\n} from \"./provisioningBootstrapBuilders\";\nimport { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nexport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nexport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\n\ninterface OrganizationProvisioningPrincipalPolicies {\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  organizationId: string;\n  signingFingerprint: string;\n}\n\n/**\n * The freshly built provisioning artifacts, shared by registration and\n * additional-organization creation. `registerIdentity` generates a new\n * `userId`; creating an additional organization reuses the caller's existing\n * one. Everything here is derived purely from the caller's key material, so it\n * is identical for both flows.\n */\nexport interface OrganizationProvisioningArtifactsInput {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the organization\n   * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and\n   * organization-metadata system containers.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  rootContainerId: string;\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}\n\nexport async function buildInitialOrganizationPolicyRequest(input: {\n  adminGroupId: string;\n  groupHeads: readonly ReferencedPrincipalHead[];\n  encapsulationPublicKey: Uint8Array;\n  memberGroupId: string;\n  organizationId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<RegistrationRequest[\"initialOrganizationPolicy\"]> {\n  const organizationKem = generateKemSeedAndKeyPair();\n  const signerUserKeyFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const userEncapsulationKeyFingerprint = await toFingerprint(\n    input.encapsulationPublicKey,\n  );\n  const projection = [\n    {\n      userId: input.userId,\n      role: \"admin\" as const,\n    },\n  ];\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    version: 2,\n    organizationId: input.organizationId,\n    adminGroupId: input.adminGroupId,\n    memberGroupId: input.memberGroupId,\n    groupHeads: input.groupHeads.map((head) => {\n      if (head.principalType !== \"group\") {\n        throw new Error(\"Organization directory can contain only group heads\");\n      }\n      return { ...head, principalType: \"group\" };\n    }),\n  });\n  const [memberEnvelope] = await wrapDekForRecipients(\n    organizationKem.secretKey,\n    [input.encapsulationPublicKey],\n  );\n\n  if (!memberEnvelope) {\n    throw new Error(\"Failed to wrap organization key for registering user\");\n  }\n  const memberEnvelopes = [\n    {\n      userId: input.userId,\n      memberKeyFingerprint: userEncapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),\n    },\n  ];\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.organizationId,\n      version: 1,\n      prevStateHash: null,\n      keyEpoch: 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: [{ userId: input.userId }],\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.userId,\n      signerUserKeyFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants: [],\n    memberEnvelopes,\n  };\n}\n\nasync function createOrganizationPrincipalPolicies(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationMetadataContainerId: string;\n  rootContainerId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<OrganizationProvisioningPrincipalPolicies> {\n  const organizationId = crypto.randomUUID();\n  const signingFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const initialAdminGroup = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      { containerId: input.rootContainerId, accessLevel: \"admin\" },\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"admin\",\n      },\n    ],\n    name: \"Admins\",\n    builtinRole: \"admins\",\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"read\",\n      },\n    ],\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest(\n    {\n      adminGroupId: initialAdminGroup.groupId,\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      groupHeads: await Promise.all([\n        groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),\n        groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),\n      ]),\n      memberGroupId: initialMemberGroup.groupId,\n      organizationId,\n      signingKeyPair: input.signingKeyPair,\n      userId: input.userId,\n    },\n  );\n\n  return {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  };\n}\n\nfunction requireOrganizationProvisioningAuthor(input: {\n  readonly organizationId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}) {\n  const author = resolveDocumentCreateAuthor({\n    auth: { organizationId: input.organizationId, userId: input.userId },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\n      `Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`,\n    );\n  }\n  return author;\n}\n\n/** Builds the signed artifacts shared by registration and org creation. */\nexport async function buildOrganizationProvisioningArtifacts(\n  input: OrganizationProvisioningArtifactsInput,\n): Promise<OrganizationProvisioningArtifacts> {\n  const bootstrap = await createInitialRootMetadataBootstrap(\n    input.rootContainerId,\n  );\n  const organizationMetadataContainerId = crypto.randomUUID();\n  const {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  } = await createOrganizationPrincipalPolicies({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationMetadataContainerId,\n    rootContainerId: input.rootContainerId,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n  const author = requireOrganizationProvisioningAuthor({\n    organizationId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n\n  const {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n  } = await buildInitialRootProvisioning({\n    adminGroup: initialAdminGroup,\n    author,\n    bootstrap,\n    recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    rootContainerId: input.rootContainerId,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({\n    author,\n    encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    initialAdminGroup,\n    rosterProfileNickname: input.rosterProfileNickname,\n    rootContainer,\n    rootContainerProjection,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const organizationMetadataBootstrap =\n    await buildInitialOrganizationMetadataBootstrap({\n      author,\n      containerId: organizationMetadataContainerId,\n      initialAdminGroup,\n      initialMemberGroup,\n      organizationProfileName: input.organizationProfileName,\n      rootContainer,\n      rootContainerProjection,\n      targetSecretKey: input.encapsulationKeyPair.secretKey,\n    });\n  const systemContainerBootstraps = await Promise.all(\n    (input.provisionedSystemContainers ?? []).map((spec) =>\n      buildInitialSystemContainerBootstrap({\n        author,\n        initialAdminGroup,\n        rootContainer,\n        rootContainerProjection,\n        signingPrivateKey: input.signingKeyPair.signingPrivateKey,\n        spec,\n        targetSecretKey: input.encapsulationKeyPair.secretKey,\n      }),\n    ),\n  );\n\n  return {\n    replacementAuthorization: null,\n    bootstrap,\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    initialRootContainer: rootContainer.plan.request,\n    organizationId,\n    organizationMetadataBootstrap,\n    rootContainer,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n    rosterProfileBootstrap,\n    systemContainerBootstraps,\n  };\n}\n"]}

package/workflows/registration/organizationProvisioningArtifacts.d.ts

@@ -1,9 +1,8 @@
 import type { ContainerSystemSlot } from "../../internal/validators/containerSystemSlot.js";
 import type { CreateOrganizationGroupRequest, ProvisionedDocumentRequest, ProvisionedSystemContainerRequest, RegistrationRequest } from "../../internal/validators/request/index.js";
 import type { OrganizationReplacementAuthorization } from "../../internal/validators/util/index.js";
-import type { buildContainerCreatePlan } from "../containers/child/create/index.js";
-import type { buildRootContainerCreatePlan } from "../containers/root/create.js";
-import type { buildMaterializedDocumentCreatePlan } from "../documents/create/index.js";
+import type { buildContainerCreatePlan, buildRootContainerCreatePlan } from "../containers/index.js";
+import type { buildMaterializedDocumentCreatePlan } from "../documents/index.js";
 import type { createInitialRootMetadataBootstrap } from "./rootMetadataBootstrap.js";
 export type InitialRootMetadataDocument = Awaited<ReturnType<typeof buildMaterializedDocumentCreatePlan>>;
 export type InitialRootContainerCreatePlan = Awaited<ReturnType<typeof buildRootContainerCreatePlan>>;

package/workflows/registration/organizationProvisioningArtifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationProvisioningArtifacts.js","sourceRoot":"","sources":["organizationProvisioningArtifacts.ts"],"names":[],"mappings":"","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { OrganizationReplacementAuthorization } from \"@tearleads/validators/util\";\nimport type { buildContainerCreatePlan } from \"../containers/child/create\";\nimport type { buildRootContainerCreatePlan } from \"../containers/root/create\";\nimport type { buildMaterializedDocumentCreatePlan } from \"../documents/create\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type InitialRootMetadataDocument = Awaited<\n  ReturnType<typeof buildMaterializedDocumentCreatePlan>\n>;\n\nexport type InitialRootContainerCreatePlan = Awaited<\n  ReturnType<typeof buildRootContainerCreatePlan>\n>;\n\nexport interface InitialSystemContainerCreatePlan {\n  containerKey: Uint8Array;\n  plan: Awaited<ReturnType<typeof buildContainerCreatePlan>>;\n}\n\nexport interface InitialRosterProfileBootstrap {\n  containerId: string;\n  containerMetadataDocument: InitialRootMetadataDocument;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerRequest: ProvisionedSystemContainerRequest;\n  profileDocument: InitialRootMetadataDocument;\n  profileDocumentInitialUpdate: Uint8Array;\n  profileDocumentRequest: ProvisionedDocumentRequest;\n  systemSlot: ContainerSystemSlot;\n}\n\nexport interface InitialSystemContainerBootstrap {\n  containerId: string;\n  containerMetadataDocument: InitialRootMetadataDocument;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerRequest: ProvisionedSystemContainerRequest;\n  icon: string | null;\n  name: string;\n  systemSlot: ContainerSystemSlot;\n}\n\nexport interface InitialOrganizationMetadataBootstrap {\n  containerId: string;\n  containerMetadataDocument: InitialRootMetadataDocument;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerRequest: ProvisionedSystemContainerRequest;\n  organizationProfileDocument: InitialRootMetadataDocument;\n  organizationProfileDocumentRequest: ProvisionedDocumentRequest;\n  organizationProfileSnapshot: string;\n  systemSlot: ContainerSystemSlot;\n}\n\nexport interface OrganizationProvisioningArtifacts {\n  replacementAuthorization: OrganizationReplacementAuthorization | null;\n  bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  initialRootContainer: RegistrationRequest[\"initialRootContainer\"];\n  organizationId: string;\n  organizationMetadataBootstrap: InitialOrganizationMetadataBootstrap;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootMetadataDocument: InitialRootMetadataDocument;\n  rootMetadataDocumentRequest: ProvisionedDocumentRequest;\n  rosterProfileBootstrap: InitialRosterProfileBootstrap;\n  systemContainerBootstraps: InitialSystemContainerBootstrap[];\n}\n"]}
+{"version":3,"file":"organizationProvisioningArtifacts.js","sourceRoot":"","sources":["organizationProvisioningArtifacts.ts"],"names":[],"mappings":"","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { OrganizationReplacementAuthorization } from \"@tearleads/validators/util\";\nimport type {\n  buildContainerCreatePlan,\n  buildRootContainerCreatePlan,\n} from \"../containers\";\nimport type { buildMaterializedDocumentCreatePlan } from \"../documents\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type InitialRootMetadataDocument = Awaited<\n  ReturnType<typeof buildMaterializedDocumentCreatePlan>\n>;\n\nexport type InitialRootContainerCreatePlan = Awaited<\n  ReturnType<typeof buildRootContainerCreatePlan>\n>;\n\nexport interface InitialSystemContainerCreatePlan {\n  containerKey: Uint8Array;\n  plan: Awaited<ReturnType<typeof buildContainerCreatePlan>>;\n}\n\nexport interface InitialRosterProfileBootstrap {\n  containerId: string;\n  containerMetadataDocument: InitialRootMetadataDocument;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerRequest: ProvisionedSystemContainerRequest;\n  profileDocument: InitialRootMetadataDocument;\n  profileDocumentInitialUpdate: Uint8Array;\n  profileDocumentRequest: ProvisionedDocumentRequest;\n  systemSlot: ContainerSystemSlot;\n}\n\nexport interface InitialSystemContainerBootstrap {\n  containerId: string;\n  containerMetadataDocument: InitialRootMetadataDocument;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerRequest: ProvisionedSystemContainerRequest;\n  icon: string | null;\n  name: string;\n  systemSlot: ContainerSystemSlot;\n}\n\nexport interface InitialOrganizationMetadataBootstrap {\n  containerId: string;\n  containerMetadataDocument: InitialRootMetadataDocument;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerRequest: ProvisionedSystemContainerRequest;\n  organizationProfileDocument: InitialRootMetadataDocument;\n  organizationProfileDocumentRequest: ProvisionedDocumentRequest;\n  organizationProfileSnapshot: string;\n  systemSlot: ContainerSystemSlot;\n}\n\nexport interface OrganizationProvisioningArtifacts {\n  replacementAuthorization: OrganizationReplacementAuthorization | null;\n  bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  initialRootContainer: RegistrationRequest[\"initialRootContainer\"];\n  organizationId: string;\n  organizationMetadataBootstrap: InitialOrganizationMetadataBootstrap;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootMetadataDocument: InitialRootMetadataDocument;\n  rootMetadataDocumentRequest: ProvisionedDocumentRequest;\n  rosterProfileBootstrap: InitialRosterProfileBootstrap;\n  systemContainerBootstraps: InitialSystemContainerBootstrap[];\n}\n"]}

package/workflows/registration/provisioningBootstrapBuilders.d.ts

@@ -1,7 +1,7 @@
 import type { CreateOrganizationGroupRequest } from "../../internal/validators/request/index.js";
-import { type ContainerSystemSlotDefinition } from "../container-contents/systemSlot.js";
-import { rootContainerWriterProjectionFromCreatePlan } from "../containers/root/create.js";
-import type { resolveDocumentCreateAuthor } from "../documents/author.js";
+import { type ContainerSystemSlotDefinition } from "../container-contents/index.js";
+import { rootContainerWriterProjectionFromCreatePlan } from "../containers/index.js";
+import type { resolveDocumentCreateAuthor } from "../documents/index.js";
 import type { InitialOrganizationMetadataBootstrap, InitialRootContainerCreatePlan, InitialRosterProfileBootstrap, InitialSystemContainerBootstrap } from "./organizationProvisioningArtifacts.js";
 import type { createInitialRootMetadataBootstrap } from "./rootMetadataBootstrap.js";
 type InitialRootContainerProjection = ReturnType<typeof rootContainerWriterProjectionFromCreatePlan>;

package/workflows/registration/provisioningBootstrapBuilders.js

@@ -1,10 +1,9 @@
 import { base64ToBytes } from "../../internal/encoding/index.js";
 import { deriveStableDocumentId } from "../../data/documents/shared/stableDocumentId.js";
+import { deriveContainerSystemSlot, } from "../container-contents/index.js";
 import { createInitializedContainerMetadataDocument } from "../container-contents/metadata/containerMetadataDocument.js";
-import { deriveContainerSystemSlot, } from "../container-contents/systemSlot.js";
-import { buildContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, } from "../containers/child/create/index.js";
-import { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "../containers/root/create.js";
-import { buildMaterializedDocumentCreatePlan } from "../documents/create/index.js";
+import { buildContainerCreatePlan, buildRootContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "../containers/index.js";
+import { buildMaterializedDocumentCreatePlan } from "../documents/index.js";
 import { buildInitialDocumentSyncRequest } from "../documents/sync/initialSync.js";
 import { getOrganizationProfileDocumentLocalId } from "../organizations/organizationProfile.js";
 import { deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, } from "../organizations/rosterProfileContainer.js";