@tearleads/client-sdk 0.1.79 → 0.1.81

package/workflows/registration/provisioningBootstrapBuilders.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioningBootstrapBuilders.js","sourceRoot":"","sources":["provisioningBootstrapBuilders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,0CAA0C,EAAE,MAAM,0DAA0D,CAAC;AACtH,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,4CAA4C,GAC7C,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAqE1G;;;;;;GAMG;AACH,KAAK,UAAU,kCAAkC,CAAC,KAmBjD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAqC;QACtD,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACnC,CAAC,CAAC,CACE,MAAM,4BAA4B,CAAC;gBACjC,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,+BAA+B,EAAE,aAAa,CAC5C,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,kBAAkB;qBAC1D,KAAK,CAAC,sBAAsB,CAChC;aACF,CAAC,CACH,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,KAAK,CAAC,qBAAqB;oBAC7B,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;KACP,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,yBAAyB;QACzD,CAAC,CAAC,2CAA2C,CAAC,aAAa,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,4CAA4C,CAAC;YAC3C,gBAAgB,EAAE,aAAa;YAC/B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;SAChD,CAAC,CAAC;IACP,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,mCAAmC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,kBAAkB;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,aAAa;QACb,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,8BAA8B,EAAE,aAAa;QAC7C,aAAa;QACb,mBAAmB;QACnB,gBAAgB,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,mBAAmB;YACnB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO;SACzD;QACD,kBAAkB;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,0CAA0C;QAChD,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,kDAAkD,CAAC;YACnE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,qBAAqB;QACtC,4BAA4B,EAAE,OAAO,CAAC,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,OAAO;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAgC;IACvE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,sBAAsB,CACtC,+BAA+B,CAAC;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CACH;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,qBAAqB;QAC3C,QAAQ,EAAE,KAAK,CAAC,qBAAqB;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,yBAAyB,CAAC;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;YACrC,SAAS,EAAE,KAAK,CAAC,iBAAiB;SACnC,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB;IACzD,OAAO,sBAAsB,CAC3B,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,MAAM,2BAA2B,GAAG,MAAM,mCAAmC,CAC3E;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,2BAA2B,CAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,oBAAoB,EAAE,2BAA2B;QACjD,IAAI,EAAE,KAAK,CAAC,uBAAuB;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI;QACV,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,IAAI,EAAE,oCAAoC;QAC1C,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YACnC,8CAA8C,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,8CAA8C,CAAC,KAAK,CAAC,kBAAkB,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,6CAA6C,CAAC;YAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,GAC5C,MAAM,+BAA+B,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACL,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,2BAA2B;QAC3B,kCAAkC,EAAE,OAAO,CAAC,OAAO;QACnD,2BAA2B,EAAE,OAAO,CAAC,QAAQ;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,eAAe;QAClC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QACtD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,2CAA2C,CACzE,aAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,uBAAuB;QAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,oBAAoB;QACpB,2BAA2B,EAAE;YAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO;YACpC,WAAW,EAAE,MAAM,+BAA+B,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mBAAmB,EAAE,uBAAuB;gBAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC5C,oBAAoB,EAAE,oBAAoB;aAC3C,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { deriveStableDocumentId } from \"../../data/documents/shared/stableDocumentId\";\nimport { createInitializedContainerMetadataDocument } from \"../container-contents/metadata/containerMetadataDocument\";\nimport {\n  type ContainerSystemSlotDefinition,\n  deriveContainerSystemSlot,\n} from \"../container-contents/systemSlot\";\nimport {\n  buildContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n} from \"../containers/child/create\";\nimport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"../containers/root/create\";\nimport type { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { buildMaterializedDocumentCreatePlan } from \"../documents/create\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/sync/initialSync\";\nimport { getOrganizationProfileDocumentLocalId } from \"../organizations/organizationProfile\";\nimport {\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n} from \"../organizations/rosterProfileContainer\";\nimport type {\n  InitialOrganizationMetadataBootstrap,\n  InitialRootContainerCreatePlan,\n  InitialRosterProfileBootstrap,\n  InitialSystemContainerBootstrap,\n  InitialSystemContainerCreatePlan,\n} from \"./organizationProvisioningArtifacts\";\nimport {\n  buildProvisionedOrganizationProfile,\n  buildProvisionedRosterProfile,\n} from \"./provisionedProfileDocument\";\nimport { verifiedPrincipalPolicyFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\ntype InitialRootContainerProjection = ReturnType<\n  typeof rootContainerWriterProjectionFromCreatePlan\n>;\n\n/**\n * An app-owned system container to provision atomically with a new organization\n * (e.g. a trash bin). The client-sdk is agnostic to what these are:\n * the caller (the app, which owns the mini-app slot namespaces) declares each\n * one, and the provisioning path derives its per-user system slot, builds a\n * signed Admins-scoped child of root, and links it into the same transaction as\n * the rest of the organization bootstrap. The behavioral rules that govern a\n * system container are resolved client-side by slot, so provisioning needs only\n * the slot definition, display name, and icon — no rules travel to the server.\n */\nexport interface ProvisionedSystemContainerSpec {\n  readonly slotDefinition: ContainerSystemSlotDefinition;\n  readonly name: string;\n  readonly icon: string | null;\n}\n\ninterface InitialOrganizationMetadataBootstrapInput {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId: string;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  organizationProfileName?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}\n\ninterface InitialRosterProfileInput {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  encapsulationPublicKey: Uint8Array;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  rosterProfileNickname?: string | undefined;\n  targetSecretKey: Uint8Array;\n}\n\ninterface ProvisionedChildContainerCore {\n  containerId: string;\n  containerMetadataDocument: Awaited<\n    ReturnType<typeof buildMaterializedDocumentCreatePlan>\n  >;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  containerRequest: {\n    systemSlot: ContainerSystemSlot;\n    container: InitialSystemContainerCreatePlan[\"plan\"][\"request\"];\n    initialMetadataSync: Awaited<\n      ReturnType<typeof buildInitialDocumentSyncRequest>\n    >;\n    metadataDocument: Awaited<\n      ReturnType<typeof buildMaterializedDocumentCreatePlan>\n    >[\"plan\"][\"request\"];\n  };\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  systemSlot: ContainerSystemSlot;\n}\n\n/**\n * The shared spine of every provisioned system child container: mint the\n * container and its metadata document under root, project the writer view,\n * and assemble the create request. Callers differ only in slot derivation,\n * display metadata, authorizing policies, an optional managed read grant, and\n * what they attach afterwards (roster/org profile documents).\n */\nasync function buildProvisionedChildContainerCore(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId?: string | undefined;\n  icon: string | null;\n  managedPrincipalGrant?: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"managedPrincipalGrant\"];\n  name: string;\n  principalPolicies: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"principalPolicies\"];\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  systemSlot: ContainerSystemSlot;\n  targetSecretKey: Uint8Array;\n  independentMetadataGroups?: {\n    adminGroup: CreateOrganizationGroupRequest;\n    memberGroup: CreateOrganizationGroupRequest;\n  };\n}): Promise<ProvisionedChildContainerCore> {\n  const containerId = input.containerId ?? crypto.randomUUID();\n  const { initialUpdate } = await createInitializedContainerMetadataDocument(\n    containerId,\n    {\n      icon: input.icon,\n      name: input.name,\n    },\n  );\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerPlan: InitialSystemContainerCreatePlan = {\n    containerKey,\n    plan: input.independentMetadataGroups\n      ? (\n          await buildRootContainerCreatePlan({\n            ...input.independentMetadataGroups,\n            author: input.author,\n            containerId,\n            containerKey,\n            metadataDocumentId: containerId,\n            systemSlot: input.systemSlot,\n            recipientEncapsulationPublicKey: base64ToBytes(\n              input.independentMetadataGroups.adminGroup.initialGroupPolicy\n                .state.encapsulationPublicKey,\n            ),\n          })\n        ).plan\n      : await buildContainerCreatePlan({\n          author: input.author,\n          containerId,\n          containerKey,\n          ...(input.managedPrincipalGrant\n            ? { managedPrincipalGrant: input.managedPrincipalGrant }\n            : {}),\n          metadataDocumentId: containerId,\n          systemSlot: input.systemSlot,\n          parentProjection: input.rootContainerProjection,\n          principalPolicies: input.principalPolicies,\n        }),\n  };\n  const containerProjection = input.independentMetadataGroups\n    ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)\n    : childContainerWriterProjectionFromCreatePlan({\n        materializedPlan: containerPlan,\n        parentProjection: input.rootContainerProjection,\n      });\n  const knownContainerKeks = new Map([\n    [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n  ]);\n  const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection,\n    documentId: containerPlan.plan.metadataDocumentId,\n    knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const initialMetadataSync = await buildInitialDocumentSyncRequest({\n    author: input.author,\n    containerProjection,\n    initialUpdate,\n    materializedDocument: containerMetadataDocument,\n  });\n  return {\n    containerId,\n    containerMetadataDocument,\n    containerMetadataInitialUpdate: initialUpdate,\n    containerPlan,\n    containerProjection,\n    containerRequest: {\n      systemSlot: input.systemSlot,\n      container: containerPlan.plan.request,\n      initialMetadataSync,\n      metadataDocument: containerMetadataDocument.plan.request,\n    },\n    knownContainerKeks,\n    systemSlot: input.systemSlot,\n  };\n}\n\nexport async function buildInitialRosterProfileBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  encapsulationPublicKey: Uint8Array;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rosterProfileNickname?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialRosterProfileBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: null,\n    name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { profile, rosterProfileDocument } = await buildInitialRosterProfile({\n    author: input.author,\n    containerProjection: core.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    knownContainerKeks: core.knownContainerKeks,\n    rosterProfileNickname: input.rosterProfileNickname,\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    profileDocument: rosterProfileDocument,\n    profileDocumentInitialUpdate: profile.initialUpdate,\n    profileDocumentRequest: profile.request,\n    systemSlot: core.systemSlot,\n  };\n}\n\nasync function buildInitialRosterProfile(input: InitialRosterProfileInput) {\n  const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    documentId: await deriveStableDocumentId(\n      getRosterProfileDocumentLocalId({\n        organizationId: input.author.organizationId,\n        userId: input.author.signerUserId,\n      }),\n    ),\n    knownContainerKeks: input.knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const profile = await buildProvisionedRosterProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    materializedDocument: rosterProfileDocument,\n    nickname: input.rosterProfileNickname,\n  });\n  return { profile, rosterProfileDocument };\n}\n\nexport async function buildInitialSystemContainerBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  signingPrivateKey: Uint8Array;\n  spec: ProvisionedSystemContainerSpec;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialSystemContainerBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveContainerSystemSlot({\n      definition: input.spec.slotDefinition,\n      secretKey: input.signingPrivateKey,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    systemSlot: core.systemSlot,\n  };\n}\n\nfunction stableOrganizationProfileId(organizationId: string): Promise<string> {\n  return deriveStableDocumentId(\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n}\n\nasync function buildInitialOrganizationProfile(input: {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  organizationProfileName?: string | undefined;\n  targetSecretKey: Uint8Array;\n}) {\n  const organizationProfileDocument = await buildMaterializedDocumentCreatePlan(\n    {\n      author: input.author,\n      containerProjection: input.containerProjection,\n      documentId: await stableOrganizationProfileId(\n        input.author.organizationId,\n      ),\n      knownContainerKeks: input.knownContainerKeks,\n      targetSecretKey: input.targetSecretKey,\n      trustedLocalProjection: true,\n    },\n  );\n  const profile = await buildProvisionedOrganizationProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    materializedDocument: organizationProfileDocument,\n    name: input.organizationProfileName,\n  });\n  return { organizationProfileDocument, profile };\n}\n\n/**\n * Organization labels use an independent system root with Admins/admin and\n * Members/read grants. Personal root shares and rotations cannot expose or\n * strand organization metadata; Members changes still rotate its own KEK.\n */\nexport async function buildInitialOrganizationMetadataBootstrap(\n  input: InitialOrganizationMetadataBootstrapInput,\n): Promise<InitialOrganizationMetadataBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    containerId: input.containerId,\n    icon: null,\n    independentMetadataGroups: {\n      adminGroup: input.initialAdminGroup,\n      memberGroup: input.initialMemberGroup,\n    },\n    name: ORGANIZATION_METADATA_CONTAINER_NAME,\n    // Both reserved groups receive explicit grants on the independent root.\n    principalPolicies: await Promise.all([\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),\n    ]),\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationMetadataContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { organizationProfileDocument, profile } =\n    await buildInitialOrganizationProfile({\n      author: input.author,\n      containerProjection: core.containerProjection,\n      knownContainerKeks: core.knownContainerKeks,\n      organizationProfileName: input.organizationProfileName,\n      targetSecretKey: input.targetSecretKey,\n    });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    organizationProfileDocument,\n    organizationProfileDocumentRequest: profile.request,\n    organizationProfileSnapshot: profile.snapshot,\n    systemSlot: core.systemSlot,\n  };\n}\n\nexport async function buildInitialRootProvisioning(input: {\n  adminGroup: CreateOrganizationGroupRequest;\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n  recipientEncapsulationPublicKey: Uint8Array;\n  rootContainerId: string;\n  targetSecretKey: Uint8Array;\n}) {\n  const rootContainer = await buildRootContainerCreatePlan({\n    adminGroup: input.adminGroup,\n    author: input.author,\n    containerId: input.rootContainerId,\n    metadataDocumentId: input.bootstrap.metadataDocumentId,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n  });\n  const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(\n    rootContainer.plan,\n  );\n  const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: rootContainerProjection,\n    documentId: input.bootstrap.metadataDocumentId,\n    knownContainerKeks: new Map([\n      [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],\n    ]),\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  return {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest: {\n      ...rootMetadataDocument.plan.request,\n      initialSync: await buildInitialDocumentSyncRequest({\n        author: input.author,\n        containerProjection: rootContainerProjection,\n        initialUpdate: input.bootstrap.initialUpdate,\n        materializedDocument: rootMetadataDocument,\n      }),\n    },\n  };\n}\n"]}
+{"version":3,"file":"provisioningBootstrapBuilders.js","sourceRoot":"","sources":["provisioningBootstrapBuilders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0CAA0C,EAAE,MAAM,0DAA0D,CAAC;AACtH,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,4CAA4C,EAC5C,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0CAA0C,CAAC;AAqE1G;;;;;;GAMG;AACH,KAAK,UAAU,kCAAkC,CAAC,KAmBjD;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,0CAA0C,CACxE,WAAW,EACX;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAqC;QACtD,YAAY;QACZ,IAAI,EAAE,KAAK,CAAC,yBAAyB;YACnC,CAAC,CAAC,CACE,MAAM,4BAA4B,CAAC;gBACjC,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,+BAA+B,EAAE,aAAa,CAC5C,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,kBAAkB;qBAC1D,KAAK,CAAC,sBAAsB,CAChC;aACF,CAAC,CACH,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,KAAK,CAAC,qBAAqB;oBAC7B,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,kBAAkB,EAAE,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;KACP,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,yBAAyB;QACzD,CAAC,CAAC,2CAA2C,CAAC,aAAa,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,4CAA4C,CAAC;YAC3C,gBAAgB,EAAE,aAAa;YAC/B,gBAAgB,EAAE,KAAK,CAAC,uBAAuB;SAChD,CAAC,CAAC;IACP,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,mCAAmC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,kBAAkB;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,aAAa;QACb,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,8BAA8B,EAAE,aAAa;QAC7C,aAAa;QACb,mBAAmB;QACnB,gBAAgB,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,mBAAmB;YACnB,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO;SACzD;QACD,kBAAkB;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,0CAA0C;QAChD,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,kDAAkD,CAAC;YACnE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,yBAAyB,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,qBAAqB;QACtC,4BAA4B,EAAE,OAAO,CAAC,aAAa;QACnD,sBAAsB,EAAE,OAAO,CAAC,OAAO;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAgC;IACvE,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CAAC;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,sBAAsB,CACtC,+BAA+B,CAAC;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SAClC,CAAC,CACH;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,qBAAqB;QAC3C,QAAQ,EAAE,KAAK,CAAC,qBAAqB;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,iBAAiB,EAAE;YACjB,MAAM,8CAA8C,CAClD,KAAK,CAAC,iBAAiB,CACxB;SACF;QACD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,yBAAyB,CAAC;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;YACrC,SAAS,EAAE,KAAK,CAAC,iBAAiB;SACnC,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB;IACzD,OAAO,sBAAsB,CAC3B,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAQ9C;IACC,MAAM,2BAA2B,GAAG,MAAM,mCAAmC,CAC3E;QACE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,MAAM,2BAA2B,CAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,oBAAoB,EAAE,2BAA2B;QACjD,IAAI,EAAE,KAAK,CAAC,uBAAuB;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,IAAI;QACV,yBAAyB,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,iBAAiB;YACnC,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,IAAI,EAAE,oCAAoC;QAC1C,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YACnC,8CAA8C,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,8CAA8C,CAAC,KAAK,CAAC,kBAAkB,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,UAAU,EAAE,MAAM,6CAA6C,CAAC;YAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC5C,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,GAC5C,MAAM,+BAA+B,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACL,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;QACnE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,2BAA2B;QAC3B,kCAAkC,EAAE,OAAO,CAAC,OAAO;QACnD,2BAA2B,EAAE,OAAO,CAAC,QAAQ;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,eAAe;QAClC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QACtD,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,2CAA2C,CACzE,aAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,uBAAuB;QAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,uBAAuB;QACvB,oBAAoB;QACpB,2BAA2B,EAAE;YAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO;YACpC,WAAW,EAAE,MAAM,+BAA+B,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mBAAmB,EAAE,uBAAuB;gBAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC5C,oBAAoB,EAAE,oBAAoB;aAC3C,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { CreateOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport { deriveStableDocumentId } from \"../../data/documents/shared/stableDocumentId\";\nimport {\n  type ContainerSystemSlotDefinition,\n  deriveContainerSystemSlot,\n} from \"../container-contents\";\nimport { createInitializedContainerMetadataDocument } from \"../container-contents/metadata/containerMetadataDocument\";\nimport {\n  buildContainerCreatePlan,\n  buildRootContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"../containers\";\nimport type { resolveDocumentCreateAuthor } from \"../documents\";\nimport { buildMaterializedDocumentCreatePlan } from \"../documents\";\nimport { buildInitialDocumentSyncRequest } from \"../documents/sync/initialSync\";\nimport { getOrganizationProfileDocumentLocalId } from \"../organizations/organizationProfile\";\nimport {\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n} from \"../organizations/rosterProfileContainer\";\nimport type {\n  InitialOrganizationMetadataBootstrap,\n  InitialRootContainerCreatePlan,\n  InitialRosterProfileBootstrap,\n  InitialSystemContainerBootstrap,\n  InitialSystemContainerCreatePlan,\n} from \"./organizationProvisioningArtifacts\";\nimport {\n  buildProvisionedOrganizationProfile,\n  buildProvisionedRosterProfile,\n} from \"./provisionedProfileDocument\";\nimport { verifiedPrincipalPolicyFromInitialGroupRequest } from \"./registrationPrincipalPolicyPersistence\";\nimport type { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\ntype InitialRootContainerProjection = ReturnType<\n  typeof rootContainerWriterProjectionFromCreatePlan\n>;\n\n/**\n * An app-owned system container to provision atomically with a new organization\n * (e.g. a trash bin). The client-sdk is agnostic to what these are:\n * the caller (the app, which owns the mini-app slot namespaces) declares each\n * one, and the provisioning path derives its per-user system slot, builds a\n * signed Admins-scoped child of root, and links it into the same transaction as\n * the rest of the organization bootstrap. The behavioral rules that govern a\n * system container are resolved client-side by slot, so provisioning needs only\n * the slot definition, display name, and icon — no rules travel to the server.\n */\nexport interface ProvisionedSystemContainerSpec {\n  readonly slotDefinition: ContainerSystemSlotDefinition;\n  readonly name: string;\n  readonly icon: string | null;\n}\n\ninterface InitialOrganizationMetadataBootstrapInput {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId: string;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  organizationProfileName?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}\n\ninterface InitialRosterProfileInput {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  encapsulationPublicKey: Uint8Array;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  rosterProfileNickname?: string | undefined;\n  targetSecretKey: Uint8Array;\n}\n\ninterface ProvisionedChildContainerCore {\n  containerId: string;\n  containerMetadataDocument: Awaited<\n    ReturnType<typeof buildMaterializedDocumentCreatePlan>\n  >;\n  containerMetadataInitialUpdate: Uint8Array;\n  containerPlan: InitialSystemContainerCreatePlan;\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  containerRequest: {\n    systemSlot: ContainerSystemSlot;\n    container: InitialSystemContainerCreatePlan[\"plan\"][\"request\"];\n    initialMetadataSync: Awaited<\n      ReturnType<typeof buildInitialDocumentSyncRequest>\n    >;\n    metadataDocument: Awaited<\n      ReturnType<typeof buildMaterializedDocumentCreatePlan>\n    >[\"plan\"][\"request\"];\n  };\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  systemSlot: ContainerSystemSlot;\n}\n\n/**\n * The shared spine of every provisioned system child container: mint the\n * container and its metadata document under root, project the writer view,\n * and assemble the create request. Callers differ only in slot derivation,\n * display metadata, authorizing policies, an optional managed read grant, and\n * what they attach afterwards (roster/org profile documents).\n */\nasync function buildProvisionedChildContainerCore(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  containerId?: string | undefined;\n  icon: string | null;\n  managedPrincipalGrant?: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"managedPrincipalGrant\"];\n  name: string;\n  principalPolicies: Parameters<\n    typeof buildContainerCreatePlan\n  >[0][\"principalPolicies\"];\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  systemSlot: ContainerSystemSlot;\n  targetSecretKey: Uint8Array;\n  independentMetadataGroups?: {\n    adminGroup: CreateOrganizationGroupRequest;\n    memberGroup: CreateOrganizationGroupRequest;\n  };\n}): Promise<ProvisionedChildContainerCore> {\n  const containerId = input.containerId ?? crypto.randomUUID();\n  const { initialUpdate } = await createInitializedContainerMetadataDocument(\n    containerId,\n    {\n      icon: input.icon,\n      name: input.name,\n    },\n  );\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerPlan: InitialSystemContainerCreatePlan = {\n    containerKey,\n    plan: input.independentMetadataGroups\n      ? (\n          await buildRootContainerCreatePlan({\n            ...input.independentMetadataGroups,\n            author: input.author,\n            containerId,\n            containerKey,\n            metadataDocumentId: containerId,\n            systemSlot: input.systemSlot,\n            recipientEncapsulationPublicKey: base64ToBytes(\n              input.independentMetadataGroups.adminGroup.initialGroupPolicy\n                .state.encapsulationPublicKey,\n            ),\n          })\n        ).plan\n      : await buildContainerCreatePlan({\n          author: input.author,\n          containerId,\n          containerKey,\n          ...(input.managedPrincipalGrant\n            ? { managedPrincipalGrant: input.managedPrincipalGrant }\n            : {}),\n          metadataDocumentId: containerId,\n          systemSlot: input.systemSlot,\n          parentProjection: input.rootContainerProjection,\n          principalPolicies: input.principalPolicies,\n        }),\n  };\n  const containerProjection = input.independentMetadataGroups\n    ? rootContainerWriterProjectionFromCreatePlan(containerPlan.plan)\n    : childContainerWriterProjectionFromCreatePlan({\n        materializedPlan: containerPlan,\n        parentProjection: input.rootContainerProjection,\n      });\n  const knownContainerKeks = new Map([\n    [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n  ]);\n  const containerMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection,\n    documentId: containerPlan.plan.metadataDocumentId,\n    knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const initialMetadataSync = await buildInitialDocumentSyncRequest({\n    author: input.author,\n    containerProjection,\n    initialUpdate,\n    materializedDocument: containerMetadataDocument,\n  });\n  return {\n    containerId,\n    containerMetadataDocument,\n    containerMetadataInitialUpdate: initialUpdate,\n    containerPlan,\n    containerProjection,\n    containerRequest: {\n      systemSlot: input.systemSlot,\n      container: containerPlan.plan.request,\n      initialMetadataSync,\n      metadataDocument: containerMetadataDocument.plan.request,\n    },\n    knownContainerKeks,\n    systemSlot: input.systemSlot,\n  };\n}\n\nexport async function buildInitialRosterProfileBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  encapsulationPublicKey: Uint8Array;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rosterProfileNickname?: string | undefined;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialRosterProfileBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: null,\n    name: ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationRosterProfileContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { profile, rosterProfileDocument } = await buildInitialRosterProfile({\n    author: input.author,\n    containerProjection: core.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    knownContainerKeks: core.knownContainerKeks,\n    rosterProfileNickname: input.rosterProfileNickname,\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    profileDocument: rosterProfileDocument,\n    profileDocumentInitialUpdate: profile.initialUpdate,\n    profileDocumentRequest: profile.request,\n    systemSlot: core.systemSlot,\n  };\n}\n\nasync function buildInitialRosterProfile(input: InitialRosterProfileInput) {\n  const rosterProfileDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    documentId: await deriveStableDocumentId(\n      getRosterProfileDocumentLocalId({\n        organizationId: input.author.organizationId,\n        userId: input.author.signerUserId,\n      }),\n    ),\n    knownContainerKeks: input.knownContainerKeks,\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  const profile = await buildProvisionedRosterProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    encapsulationPublicKey: input.encapsulationPublicKey,\n    materializedDocument: rosterProfileDocument,\n    nickname: input.rosterProfileNickname,\n  });\n  return { profile, rosterProfileDocument };\n}\n\nexport async function buildInitialSystemContainerBootstrap(input: {\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  rootContainer: InitialRootContainerCreatePlan;\n  rootContainerProjection: InitialRootContainerProjection;\n  signingPrivateKey: Uint8Array;\n  spec: ProvisionedSystemContainerSpec;\n  targetSecretKey: Uint8Array;\n}): Promise<InitialSystemContainerBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    principalPolicies: [\n      await verifiedPrincipalPolicyFromInitialGroupRequest(\n        input.initialAdminGroup,\n      ),\n    ],\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveContainerSystemSlot({\n      definition: input.spec.slotDefinition,\n      secretKey: input.signingPrivateKey,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    icon: input.spec.icon,\n    name: input.spec.name,\n    systemSlot: core.systemSlot,\n  };\n}\n\nfunction stableOrganizationProfileId(organizationId: string): Promise<string> {\n  return deriveStableDocumentId(\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n}\n\nasync function buildInitialOrganizationProfile(input: {\n  author: InitialOrganizationMetadataBootstrapInput[\"author\"];\n  containerProjection: ReturnType<\n    typeof childContainerWriterProjectionFromCreatePlan\n  >;\n  knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n  organizationProfileName?: string | undefined;\n  targetSecretKey: Uint8Array;\n}) {\n  const organizationProfileDocument = await buildMaterializedDocumentCreatePlan(\n    {\n      author: input.author,\n      containerProjection: input.containerProjection,\n      documentId: await stableOrganizationProfileId(\n        input.author.organizationId,\n      ),\n      knownContainerKeks: input.knownContainerKeks,\n      targetSecretKey: input.targetSecretKey,\n      trustedLocalProjection: true,\n    },\n  );\n  const profile = await buildProvisionedOrganizationProfile({\n    author: input.author,\n    containerProjection: input.containerProjection,\n    materializedDocument: organizationProfileDocument,\n    name: input.organizationProfileName,\n  });\n  return { organizationProfileDocument, profile };\n}\n\n/**\n * Organization labels use an independent system root with Admins/admin and\n * Members/read grants. Personal root shares and rotations cannot expose or\n * strand organization metadata; Members changes still rotate its own KEK.\n */\nexport async function buildInitialOrganizationMetadataBootstrap(\n  input: InitialOrganizationMetadataBootstrapInput,\n): Promise<InitialOrganizationMetadataBootstrap> {\n  const core = await buildProvisionedChildContainerCore({\n    author: input.author,\n    containerId: input.containerId,\n    icon: null,\n    independentMetadataGroups: {\n      adminGroup: input.initialAdminGroup,\n      memberGroup: input.initialMemberGroup,\n    },\n    name: ORGANIZATION_METADATA_CONTAINER_NAME,\n    // Both reserved groups receive explicit grants on the independent root.\n    principalPolicies: await Promise.all([\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialAdminGroup),\n      verifiedPrincipalPolicyFromInitialGroupRequest(input.initialMemberGroup),\n    ]),\n    rootContainer: input.rootContainer,\n    rootContainerProjection: input.rootContainerProjection,\n    systemSlot: await deriveOrganizationMetadataContainerSystemSlot({\n      organizationId: input.author.organizationId,\n    }),\n    targetSecretKey: input.targetSecretKey,\n  });\n  const { organizationProfileDocument, profile } =\n    await buildInitialOrganizationProfile({\n      author: input.author,\n      containerProjection: core.containerProjection,\n      knownContainerKeks: core.knownContainerKeks,\n      organizationProfileName: input.organizationProfileName,\n      targetSecretKey: input.targetSecretKey,\n    });\n  return {\n    containerId: core.containerId,\n    containerMetadataDocument: core.containerMetadataDocument,\n    containerMetadataInitialUpdate: core.containerMetadataInitialUpdate,\n    containerPlan: core.containerPlan,\n    containerRequest: core.containerRequest,\n    organizationProfileDocument,\n    organizationProfileDocumentRequest: profile.request,\n    organizationProfileSnapshot: profile.snapshot,\n    systemSlot: core.systemSlot,\n  };\n}\n\nexport async function buildInitialRootProvisioning(input: {\n  adminGroup: CreateOrganizationGroupRequest;\n  author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  bootstrap: Awaited<ReturnType<typeof createInitialRootMetadataBootstrap>>;\n  recipientEncapsulationPublicKey: Uint8Array;\n  rootContainerId: string;\n  targetSecretKey: Uint8Array;\n}) {\n  const rootContainer = await buildRootContainerCreatePlan({\n    adminGroup: input.adminGroup,\n    author: input.author,\n    containerId: input.rootContainerId,\n    metadataDocumentId: input.bootstrap.metadataDocumentId,\n    recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n  });\n  const rootContainerProjection = rootContainerWriterProjectionFromCreatePlan(\n    rootContainer.plan,\n  );\n  const rootMetadataDocument = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: rootContainerProjection,\n    documentId: input.bootstrap.metadataDocumentId,\n    knownContainerKeks: new Map([\n      [rootContainer.plan.containerKeyEpochId, rootContainer.containerKey],\n    ]),\n    targetSecretKey: input.targetSecretKey,\n    trustedLocalProjection: true,\n  });\n  return {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest: {\n      ...rootMetadataDocument.plan.request,\n      initialSync: await buildInitialDocumentSyncRequest({\n        author: input.author,\n        containerProjection: rootContainerProjection,\n        initialUpdate: input.bootstrap.initialUpdate,\n        materializedDocument: rootMetadataDocument,\n      }),\n    },\n  };\n}\n"]}

package/workflows/registration/registerIdentity.d.ts

@@ -1,16 +1,11 @@
-import { type EncapsulationKeyPair, type ReferencedPrincipalHead, type SigningKeyPair } from "../../internal/crypto/index.js";
+import { type EncapsulationKeyPair, type SigningKeyPair } from "../../internal/crypto/index.js";
 import type { ProvisionedDocumentRequest, ProvisionedSystemContainerRequest, RegistrationRequest } from "../../internal/validators/request/index.js";
 import type { RegistrationResponse } from "../../internal/validators/response/index.js";
 import type { DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
 import type { ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
 import type { LocalUserIdentityCandidate } from "../../data/trustedUserIdentity/index.js";
-import type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
-import { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
 import type { ProvisionedPrincipalHistoryPrimer } from "./provisionedPrincipalHistory.js";
-import { type ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
-export type { OrganizationProvisioningArtifacts } from "./organizationProvisioningArtifacts.js";
-export type { ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
-export { persistOrganizationProvisioningState };
+import type { ProvisionedSystemContainerSpec } from "./provisioningBootstrapBuilders.js";
 export interface RegistrationApi {
     registerUser(userId: string, organizationId: string, rootContainerId: string, signingPublicKey: Uint8Array, encapsulationPublicKey: Uint8Array, initialAdminGroup: RegistrationRequest["initialAdminGroup"], initialMemberGroup: RegistrationRequest["initialMemberGroup"], initialOrganizationPolicy: RegistrationRequest["initialOrganizationPolicy"], initialRootContainer: RegistrationRequest["initialRootContainer"], initialRootMetadataDocument: ProvisionedDocumentRequest, initialRosterProfileContainer: RegistrationRequest["initialRosterProfileContainer"], initialRosterProfileDocument: ProvisionedDocumentRequest | undefined, initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest, initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined, initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined): Promise<RegistrationResponse | null>;
 }
@@ -51,36 +46,4 @@ export interface RegisterIdentityInput {
     signingKeyFingerprint?: string | null | undefined;
     signingKeyPair: SigningKeyPair;
 }
-/**
- * The freshly built provisioning artifacts, shared by registration and
- * additional-organization creation. `registerIdentity` generates a new
- * `userId`; creating an additional organization reuses the caller's existing
- * one. Everything here is derived purely from the caller's key material, so it
- * is identical for both flows.
- */
-export interface OrganizationProvisioningArtifactsInput {
-    encapsulationKeyPair: EncapsulationKeyPair;
-    organizationProfileName?: string | undefined;
-    /**
-     * App-owned system containers to provision atomically with the organization
-     * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and
-     * organization-metadata system containers.
-     */
-    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
-    rootContainerId: string;
-    rosterProfileNickname?: string | undefined;
-    signingKeyPair: SigningKeyPair;
-    userId: string;
-}
-export declare function buildInitialOrganizationPolicyRequest(input: {
-    adminGroupId: string;
-    groupHeads: readonly ReferencedPrincipalHead[];
-    encapsulationPublicKey: Uint8Array;
-    memberGroupId: string;
-    organizationId: string;
-    signingKeyPair: SigningKeyPair;
-    userId: string;
-}): Promise<RegistrationRequest["initialOrganizationPolicy"]>;
-/** Builds the signed artifacts shared by registration and org creation. */
-export declare function buildOrganizationProvisioningArtifacts(input: OrganizationProvisioningArtifactsInput): Promise<OrganizationProvisioningArtifacts>;
 export declare function registerIdentity(input: RegisterIdentityInput): Promise<RegistrationResponse | null>;

package/workflows/registration/registerIdentity.js

@@ -1,212 +1,7 @@
-import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, KeyingVerificationError, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { encodeOrganizationAuthorityDescriptor } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { KeyingVerificationError, } from "../../internal/crypto/index.js";
 import { validateUserIdentityKeys } from "../../data/trustedUserIdentity/index.js";
-import { resolveDocumentCreateAuthor } from "../documents/author.js";
-import { groupPolicyMutationHead } from "../organizations/groupPolicy/groupPolicyMutationHead.js";
-import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "../organizations/principalPolicy/index.js";
+import { buildOrganizationProvisioningArtifacts } from "./organizationProvisioning.js";
 import { persistOrganizationProvisioningState } from "./organizationProvisioningPersistence.js";
-import { buildInitialOrganizationMetadataBootstrap, buildInitialRootProvisioning, buildInitialRosterProfileBootstrap, buildInitialSystemContainerBootstrap, } from "./provisioningBootstrapBuilders.js";
-import { createInitialRootMetadataBootstrap } from "./rootMetadataBootstrap.js";
-export { persistOrganizationProvisioningState };
-export async function buildInitialOrganizationPolicyRequest(input) {
-    const organizationKem = generateKemSeedAndKeyPair();
-    const signerUserKeyFingerprint = await toFingerprint(input.signingKeyPair.signingPublicKey);
-    const userEncapsulationKeyFingerprint = await toFingerprint(input.encapsulationPublicKey);
-    const projection = [
-        {
-            userId: input.userId,
-            role: "admin",
-        },
-    ];
-    const payloadCiphertext = encodeOrganizationAuthorityDescriptor({
-        version: 2,
-        organizationId: input.organizationId,
-        adminGroupId: input.adminGroupId,
-        memberGroupId: input.memberGroupId,
-        groupHeads: input.groupHeads.map((head) => {
-            if (head.principalType !== "group") {
-                throw new Error("Organization directory can contain only group heads");
-            }
-            return { ...head, principalType: "group" };
-        }),
-    });
-    const [memberEnvelope] = await wrapDekForRecipients(organizationKem.secretKey, [input.encapsulationPublicKey]);
-    if (!memberEnvelope) {
-        throw new Error("Failed to wrap organization key for registering user");
-    }
-    const memberEnvelopes = [
-        {
-            userId: input.userId,
-            memberKeyFingerprint: userEncapsulationKeyFingerprint,
-            kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),
-            wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),
-        },
-    ];
-    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
-        principalType: "organization",
-        principalId: input.organizationId,
-        version: 1,
-        prevStateHash: null,
-        keyEpoch: 1,
-        encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),
-        keyFingerprint: await toFingerprint(organizationKem.publicKey),
-        members: [{ userId: input.userId }],
-        memberEnvelopes,
-        projection,
-        grants: [],
-        payloadCiphertext,
-        externalAuthority: null,
-        signedAt: new Date().toISOString(),
-        signerUserId: input.userId,
-        signerUserKeyFingerprint,
-    }), input.signingKeyPair.signingPrivateKey);
-    return {
-        state,
-        encryptedPayload: {
-            cipherSuite: "aes-256-gcm",
-            ciphertext: payloadCiphertext,
-            ciphertextHash: state.payloadCiphertextHash,
-        },
-        projection,
-        grants: [],
-        memberEnvelopes,
-    };
-}
-async function createOrganizationPrincipalPolicies(input) {
-    const organizationId = crypto.randomUUID();
-    const signingFingerprint = await toFingerprint(input.signingKeyPair.signingPublicKey);
-    const initialAdminGroup = await buildInitialGroupPolicyRequest({
-        creatorEncapsulationKeyPair: input.encapsulationKeyPair,
-        groupId: crypto.randomUUID(),
-        grants: [
-            { containerId: input.rootContainerId, accessLevel: "admin" },
-            {
-                containerId: input.organizationMetadataContainerId,
-                accessLevel: "admin",
-            },
-        ],
-        name: "Admins",
-        builtinRole: "admins",
-        signerUserId: input.userId,
-        signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-    const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({
-        creatorEncapsulationKeyPair: input.encapsulationKeyPair,
-        groupId: crypto.randomUUID(),
-        grants: [
-            {
-                containerId: input.organizationMetadataContainerId,
-                accessLevel: "read",
-            },
-        ],
-        signerUserId: input.userId,
-        signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-    const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest({
-        adminGroupId: initialAdminGroup.groupId,
-        encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
-        groupHeads: await Promise.all([
-            groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),
-            groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),
-        ]),
-        memberGroupId: initialMemberGroup.groupId,
-        organizationId,
-        signingKeyPair: input.signingKeyPair,
-        userId: input.userId,
-    });
-    return {
-        initialAdminGroup,
-        initialMemberGroup,
-        initialOrganizationPolicy,
-        organizationId,
-        signingFingerprint,
-    };
-}
-function requireOrganizationProvisioningAuthor(input) {
-    const author = resolveDocumentCreateAuthor({
-        auth: { organizationId: input.organizationId, userId: input.userId },
-        crypto: {
-            signingFingerprint: input.signingFingerprint,
-            signingKeyPair: input.signingKeyPair,
-        },
-    });
-    if (!author) {
-        throw new Error(`Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`);
-    }
-    return author;
-}
-/** Builds the signed artifacts shared by registration and org creation. */
-export async function buildOrganizationProvisioningArtifacts(input) {
-    const bootstrap = await createInitialRootMetadataBootstrap(input.rootContainerId);
-    const organizationMetadataContainerId = crypto.randomUUID();
-    const { initialAdminGroup, initialMemberGroup, initialOrganizationPolicy, organizationId, signingFingerprint, } = await createOrganizationPrincipalPolicies({
-        encapsulationKeyPair: input.encapsulationKeyPair,
-        organizationMetadataContainerId,
-        rootContainerId: input.rootContainerId,
-        signingKeyPair: input.signingKeyPair,
-        userId: input.userId,
-    });
-    const author = requireOrganizationProvisioningAuthor({
-        organizationId,
-        signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-        userId: input.userId,
-    });
-    const { rootContainer, rootContainerProjection, rootMetadataDocument, rootMetadataDocumentRequest, } = await buildInitialRootProvisioning({
-        adminGroup: initialAdminGroup,
-        author,
-        bootstrap,
-        recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,
-        rootContainerId: input.rootContainerId,
-        targetSecretKey: input.encapsulationKeyPair.secretKey,
-    });
-    const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({
-        author,
-        encapsulationPublicKey: input.encapsulationKeyPair.publicKey,
-        initialAdminGroup,
-        rosterProfileNickname: input.rosterProfileNickname,
-        rootContainer,
-        rootContainerProjection,
-        targetSecretKey: input.encapsulationKeyPair.secretKey,
-    });
-    const organizationMetadataBootstrap = await buildInitialOrganizationMetadataBootstrap({
-        author,
-        containerId: organizationMetadataContainerId,
-        initialAdminGroup,
-        initialMemberGroup,
-        organizationProfileName: input.organizationProfileName,
-        rootContainer,
-        rootContainerProjection,
-        targetSecretKey: input.encapsulationKeyPair.secretKey,
-    });
-    const systemContainerBootstraps = await Promise.all((input.provisionedSystemContainers ?? []).map((spec) => buildInitialSystemContainerBootstrap({
-        author,
-        initialAdminGroup,
-        rootContainer,
-        rootContainerProjection,
-        signingPrivateKey: input.signingKeyPair.signingPrivateKey,
-        spec,
-        targetSecretKey: input.encapsulationKeyPair.secretKey,
-    })));
-    return {
-        replacementAuthorization: null,
-        bootstrap,
-        initialAdminGroup,
-        initialMemberGroup,
-        initialOrganizationPolicy,
-        initialRootContainer: rootContainer.plan.request,
-        organizationId,
-        organizationMetadataBootstrap,
-        rootContainer,
-        rootMetadataDocument,
-        rootMetadataDocumentRequest,
-        rosterProfileBootstrap,
-        systemContainerBootstraps,
-    };
-}
 export async function registerIdentity(input) {
     input.log?.("Registering identity...");
     await validateUserIdentityKeys({

package/workflows/registration/registerIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"registerIdentity.js","sourceRoot":"","sources":["registerIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,yBAAyB,EACzB,uBAAuB,EAGvB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAG9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAE7F,OAAO,EACL,yCAAyC,EACzC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAI7E,OAAO,EAAE,oCAAoC,EAAE,CAAC;AAiGhD,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAQ3D;IACC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,wBAAwB,GAAG,MAAM,aAAa,CAClD,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,aAAa,CACzD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,MAAM,UAAU,GAAG;QACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,OAAgB;SACvB;KACF,CAAC;IACF,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CACjD,eAAe,CAAC,SAAS,EACzB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAC/B,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG;QACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,+BAA+B;YACrD,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,CAAC;QACX,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,wBAAwB;KACzB,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM,EAAE,EAAE;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAMlD;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;QAC7D,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE;YAC5D;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,OAAO;aACrB;SACF;QACD,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,oCAAoC,CAAC;QACpE,2BAA2B,EAAE,KAAK,CAAC,oBAAoB;QACvD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,MAAM,EAAE;YACN;gBACE,WAAW,EAAE,KAAK,CAAC,+BAA+B;gBAClD,WAAW,EAAE,MAAM;aACpB;SACF;QACD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,MAAM,qCAAqC,CAC3E;QACE,YAAY,EAAE,iBAAiB,CAAC,OAAO;QACvC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC7D,uBAAuB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;SAC/D,CAAC;QACF,aAAa,EAAE,kBAAkB,CAAC,OAAO;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACpE,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,MAAM,+BAA+B,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5D,MAAM,EACJ,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,GACnB,GAAG,MAAM,mCAAmC,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,+BAA+B;QAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC;QACnD,cAAc;QACd,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,MAAM,EACJ,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,GAAG,MAAM,4BAA4B,CAAC;QACrC,UAAU,EAAE,iBAAiB;QAC7B,MAAM;QACN,SAAS;QACT,+BAA+B,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QACrE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,kCAAkC,CAAC;QACtE,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;QAC5D,iBAAiB;QACjB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,6BAA6B,GACjC,MAAM,yCAAyC,CAAC;QAC9C,MAAM;QACN,WAAW,EAAE,+BAA+B;QAC5C,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa;QACb,uBAAuB;QACvB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CAAC;IACL,MAAM,yBAAyB,GAAG,MAAM,OAAO,CAAC,GAAG,CACjD,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,oCAAoC,CAAC;QACnC,MAAM;QACN,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;QACzD,IAAI;QACJ,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;KACtD,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,SAAS;QACT,iBAAiB;QACjB,kBAAkB;QAClB,yBAAyB;QACzB,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;QAChD,cAAc;QACd,6BAA6B;QAC7B,aAAa;QACb,oBAAoB;QACpB,2BAA2B;QAC3B,sBAAsB;QACtB,yBAAyB;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE;YACT,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CACjD,SAAS,EACT,SAAS,CAAC,cAAc,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,cAAc,CAAC,gBAAgB,EACrC,KAAK,CAAC,oBAAoB,CAAC,SAAS,EACpC,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,SAAS,CAAC,yBAAyB,EACnC,SAAS,CAAC,oBAAoB,EAC9B,SAAS,CAAC,2BAA2B,EACrC,SAAS,CAAC,sBAAsB,CAAC,gBAAgB,EACjD,SAAS,CAAC,sBAAsB,CAAC,sBAAsB,EACvD,SAAS,CAAC,6BAA6B,CAAC,gBAAgB,EACxD,SAAS,CAAC,6BAA6B,CAAC,kCAAkC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,GAAG,CACrC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE;YAC1C,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { RegistrationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport { encodeOrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type { LocalUserIdentityCandidate } from \"../../data/trustedUserIdentity\";\nimport { validateUserIdentityKeys } from \"../../data/trustedUserIdentity\";\nimport { resolveDocumentCreateAuthor } from \"../documents/author\";\nimport { groupPolicyMutationHead } from \"../organizations/groupPolicy/groupPolicyMutationHead\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"../organizations/principalPolicy\";\nimport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nimport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"./provisionedPrincipalHistory\";\nimport {\n  buildInitialOrganizationMetadataBootstrap,\n  buildInitialRootProvisioning,\n  buildInitialRosterProfileBootstrap,\n  buildInitialSystemContainerBootstrap,\n  type ProvisionedSystemContainerSpec,\n} from \"./provisioningBootstrapBuilders\";\nimport { createInitialRootMetadataBootstrap } from \"./rootMetadataBootstrap\";\n\nexport type { OrganizationProvisioningArtifacts } from \"./organizationProvisioningArtifacts\";\nexport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\nexport { persistOrganizationProvisioningState };\n\nexport interface RegistrationApi {\n  registerUser(\n    userId: string,\n    organizationId: string,\n    rootContainerId: string,\n    signingPublicKey: Uint8Array,\n    encapsulationPublicKey: Uint8Array,\n    initialAdminGroup: RegistrationRequest[\"initialAdminGroup\"],\n    initialMemberGroup: RegistrationRequest[\"initialMemberGroup\"],\n    initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"],\n    initialRootContainer: RegistrationRequest[\"initialRootContainer\"],\n    initialRootMetadataDocument: ProvisionedDocumentRequest,\n    initialRosterProfileContainer: RegistrationRequest[\"initialRosterProfileContainer\"],\n    initialRosterProfileDocument: ProvisionedDocumentRequest | undefined,\n    initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest,\n    initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined,\n    initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined,\n  ): Promise<RegistrationResponse | null>;\n}\n\ninterface OrganizationProvisioningPrincipalPolicies {\n  initialAdminGroup: CreateOrganizationGroupRequest;\n  initialMemberGroup: CreateOrganizationGroupRequest;\n  initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"];\n  organizationId: string;\n  signingFingerprint: string;\n}\n\nexport interface RegisterIdentityInput {\n  apiClient: RegistrationApi;\n  containerId: string;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  /**\n   * Reports whether the identity that started this registration is still\n   * current. Forwarded to the bootstrap persist's in-mutex currency check,\n   * so an identity replaced while the persist waits for the mutation queue\n   * cannot write its bootstrap through a client the replacement owns.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /**\n   * Overrides the seeded personal-org profile name; defaults to \"Personal Org\".\n   */\n  organizationProfileName?: string | undefined;\n  pinLocalUserIdentity: (\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ) => Promise<void>;\n  /** Seeds verified recovery progress for the founding policy heads. */\n  primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n  /**\n   * App-owned system containers to provision atomically with the personal\n   * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname; defaults to \"You\". The\n   * demo host passes each pane's peer-labeled self name (\"Peer 1 (You)\").\n   */\n  rosterProfileNickname?: string | undefined;\n  signingKeyFingerprint?: string | null | undefined;\n  signingKeyPair: SigningKeyPair;\n}\n\n/**\n * The freshly built provisioning artifacts, shared by registration and\n * additional-organization creation. `registerIdentity` generates a new\n * `userId`; creating an additional organization reuses the caller's existing\n * one. Everything here is derived purely from the caller's key material, so it\n * is identical for both flows.\n */\nexport interface OrganizationProvisioningArtifactsInput {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationProfileName?: string | undefined;\n  /**\n   * App-owned system containers to provision atomically with the organization\n   * (e.g. a trash bin). Omitted/empty leaves the org with only the roster and\n   * organization-metadata system containers.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  rootContainerId: string;\n  rosterProfileNickname?: string | undefined;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}\n\nexport async function buildInitialOrganizationPolicyRequest(input: {\n  adminGroupId: string;\n  groupHeads: readonly ReferencedPrincipalHead[];\n  encapsulationPublicKey: Uint8Array;\n  memberGroupId: string;\n  organizationId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<RegistrationRequest[\"initialOrganizationPolicy\"]> {\n  const organizationKem = generateKemSeedAndKeyPair();\n  const signerUserKeyFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const userEncapsulationKeyFingerprint = await toFingerprint(\n    input.encapsulationPublicKey,\n  );\n  const projection = [\n    {\n      userId: input.userId,\n      role: \"admin\" as const,\n    },\n  ];\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    version: 2,\n    organizationId: input.organizationId,\n    adminGroupId: input.adminGroupId,\n    memberGroupId: input.memberGroupId,\n    groupHeads: input.groupHeads.map((head) => {\n      if (head.principalType !== \"group\") {\n        throw new Error(\"Organization directory can contain only group heads\");\n      }\n      return { ...head, principalType: \"group\" };\n    }),\n  });\n  const [memberEnvelope] = await wrapDekForRecipients(\n    organizationKem.secretKey,\n    [input.encapsulationPublicKey],\n  );\n\n  if (!memberEnvelope) {\n    throw new Error(\"Failed to wrap organization key for registering user\");\n  }\n  const memberEnvelopes = [\n    {\n      userId: input.userId,\n      memberKeyFingerprint: userEncapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(memberEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(memberEnvelope.wrappedKey),\n    },\n  ];\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.organizationId,\n      version: 1,\n      prevStateHash: null,\n      keyEpoch: 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: [{ userId: input.userId }],\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.userId,\n      signerUserKeyFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants: [],\n    memberEnvelopes,\n  };\n}\n\nasync function createOrganizationPrincipalPolicies(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  organizationMetadataContainerId: string;\n  rootContainerId: string;\n  signingKeyPair: SigningKeyPair;\n  userId: string;\n}): Promise<OrganizationProvisioningPrincipalPolicies> {\n  const organizationId = crypto.randomUUID();\n  const signingFingerprint = await toFingerprint(\n    input.signingKeyPair.signingPublicKey,\n  );\n  const initialAdminGroup = await buildInitialGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      { containerId: input.rootContainerId, accessLevel: \"admin\" },\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"admin\",\n      },\n    ],\n    name: \"Admins\",\n    builtinRole: \"admins\",\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialMemberGroup = await buildInitialMemberGroupPolicyRequest({\n    creatorEncapsulationKeyPair: input.encapsulationKeyPair,\n    groupId: crypto.randomUUID(),\n    grants: [\n      {\n        containerId: input.organizationMetadataContainerId,\n        accessLevel: \"read\",\n      },\n    ],\n    signerUserId: input.userId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const initialOrganizationPolicy = await buildInitialOrganizationPolicyRequest(\n    {\n      adminGroupId: initialAdminGroup.groupId,\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      groupHeads: await Promise.all([\n        groupPolicyMutationHead(initialAdminGroup.initialGroupPolicy),\n        groupPolicyMutationHead(initialMemberGroup.initialGroupPolicy),\n      ]),\n      memberGroupId: initialMemberGroup.groupId,\n      organizationId,\n      signingKeyPair: input.signingKeyPair,\n      userId: input.userId,\n    },\n  );\n\n  return {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  };\n}\n\nfunction requireOrganizationProvisioningAuthor(input: {\n  readonly organizationId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}) {\n  const author = resolveDocumentCreateAuthor({\n    auth: { organizationId: input.organizationId, userId: input.userId },\n    crypto: {\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    },\n  });\n  if (!author) {\n    throw new Error(\n      `Organization provisioning document author context is unavailable for user ${input.userId} in organization ${input.organizationId}.`,\n    );\n  }\n  return author;\n}\n\n/** Builds the signed artifacts shared by registration and org creation. */\nexport async function buildOrganizationProvisioningArtifacts(\n  input: OrganizationProvisioningArtifactsInput,\n): Promise<OrganizationProvisioningArtifacts> {\n  const bootstrap = await createInitialRootMetadataBootstrap(\n    input.rootContainerId,\n  );\n  const organizationMetadataContainerId = crypto.randomUUID();\n  const {\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    organizationId,\n    signingFingerprint,\n  } = await createOrganizationPrincipalPolicies({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationMetadataContainerId,\n    rootContainerId: input.rootContainerId,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n  const author = requireOrganizationProvisioningAuthor({\n    organizationId,\n    signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n    userId: input.userId,\n  });\n\n  const {\n    rootContainer,\n    rootContainerProjection,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n  } = await buildInitialRootProvisioning({\n    adminGroup: initialAdminGroup,\n    author,\n    bootstrap,\n    recipientEncapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    rootContainerId: input.rootContainerId,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const rosterProfileBootstrap = await buildInitialRosterProfileBootstrap({\n    author,\n    encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n    initialAdminGroup,\n    rosterProfileNickname: input.rosterProfileNickname,\n    rootContainer,\n    rootContainerProjection,\n    targetSecretKey: input.encapsulationKeyPair.secretKey,\n  });\n  const organizationMetadataBootstrap =\n    await buildInitialOrganizationMetadataBootstrap({\n      author,\n      containerId: organizationMetadataContainerId,\n      initialAdminGroup,\n      initialMemberGroup,\n      organizationProfileName: input.organizationProfileName,\n      rootContainer,\n      rootContainerProjection,\n      targetSecretKey: input.encapsulationKeyPair.secretKey,\n    });\n  const systemContainerBootstraps = await Promise.all(\n    (input.provisionedSystemContainers ?? []).map((spec) =>\n      buildInitialSystemContainerBootstrap({\n        author,\n        initialAdminGroup,\n        rootContainer,\n        rootContainerProjection,\n        signingPrivateKey: input.signingKeyPair.signingPrivateKey,\n        spec,\n        targetSecretKey: input.encapsulationKeyPair.secretKey,\n      }),\n    ),\n  );\n\n  return {\n    replacementAuthorization: null,\n    bootstrap,\n    initialAdminGroup,\n    initialMemberGroup,\n    initialOrganizationPolicy,\n    initialRootContainer: rootContainer.plan.request,\n    organizationId,\n    organizationMetadataBootstrap,\n    rootContainer,\n    rootMetadataDocument,\n    rootMetadataDocumentRequest,\n    rosterProfileBootstrap,\n    systemContainerBootstraps,\n  };\n}\n\nexport async function registerIdentity(\n  input: RegisterIdentityInput,\n): Promise<RegistrationResponse | null> {\n  input.log?.(\"Registering identity...\");\n  await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingKeyFingerprint: input.signingKeyFingerprint,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    },\n  });\n\n  const newUserId = crypto.randomUUID();\n  const artifacts = await buildOrganizationProvisioningArtifacts({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId: input.containerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: newUserId,\n  });\n\n  const response = await input.apiClient.registerUser(\n    newUserId,\n    artifacts.organizationId,\n    input.containerId,\n    input.signingKeyPair.signingPublicKey,\n    input.encapsulationKeyPair.publicKey,\n    artifacts.initialAdminGroup,\n    artifacts.initialMemberGroup,\n    artifacts.initialOrganizationPolicy,\n    artifacts.initialRootContainer,\n    artifacts.rootMetadataDocumentRequest,\n    artifacts.rosterProfileBootstrap.containerRequest,\n    artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    artifacts.organizationMetadataBootstrap.containerRequest,\n    artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest,\n    artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n  );\n  if (!response) {\n    return null;\n  }\n  if (response.userId !== newUserId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Registration response user does not match the requested identity\",\n    );\n  }\n  // Pinned only once the server has confirmed this user, and before anything\n  // is persisted under it. The trust store binds each signing key to one user,\n  // so a pin for an id the server never accepted — a retry after a lost\n  // response, or a restored key that is already registered — would later\n  // refuse the key's real user at login. Like the persistence below, it is a\n  // durable write, so it is skipped once the registering identity has been\n  // replaced: the caller discards this result.\n  if (input.isIdentityCurrent?.() ?? true) {\n    await input.pinLocalUserIdentity(newUserId, {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  }\n\n  input.log?.(`Key registered (${response.userId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: input.containerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    primePrincipalHistory: input.primePrincipalHistory,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}
+{"version":3,"file":"registerIdentity.js","sourceRoot":"","sources":["registerIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,uCAAuC,CAAC;AAmE7F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC;QAC7B,SAAS,EAAE;YACT,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CACjD,SAAS,EACT,SAAS,CAAC,cAAc,EACxB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,cAAc,CAAC,gBAAgB,EACrC,KAAK,CAAC,oBAAoB,CAAC,SAAS,EACpC,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,SAAS,CAAC,yBAAyB,EACnC,SAAS,CAAC,oBAAoB,EAC9B,SAAS,CAAC,2BAA2B,EACrC,SAAS,CAAC,sBAAsB,CAAC,gBAAgB,EACjD,SAAS,CAAC,sBAAsB,CAAC,sBAAsB,EACvD,SAAS,CAAC,6BAA6B,CAAC,gBAAgB,EACxD,SAAS,CAAC,6BAA6B,CAAC,kCAAkC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,GAAG,CACrC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE;YAC1C,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,SAAS;YAC5D,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  type EncapsulationKeyPair,\n  KeyingVerificationError,\n  type SigningKeyPair,\n} from \"@tearleads/crypto\";\nimport type {\n  ProvisionedDocumentRequest,\n  ProvisionedSystemContainerRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { RegistrationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../data/documents/documentKinds\";\nimport type { ExecSqlClientLike } from \"../../data/sqlite/sqlSchema\";\nimport type { LocalUserIdentityCandidate } from \"../../data/trustedUserIdentity\";\nimport { validateUserIdentityKeys } from \"../../data/trustedUserIdentity\";\nimport { buildOrganizationProvisioningArtifacts } from \"./organizationProvisioning\";\nimport { persistOrganizationProvisioningState } from \"./organizationProvisioningPersistence\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"./provisionedPrincipalHistory\";\nimport type { ProvisionedSystemContainerSpec } from \"./provisioningBootstrapBuilders\";\n\nexport interface RegistrationApi {\n  registerUser(\n    userId: string,\n    organizationId: string,\n    rootContainerId: string,\n    signingPublicKey: Uint8Array,\n    encapsulationPublicKey: Uint8Array,\n    initialAdminGroup: RegistrationRequest[\"initialAdminGroup\"],\n    initialMemberGroup: RegistrationRequest[\"initialMemberGroup\"],\n    initialOrganizationPolicy: RegistrationRequest[\"initialOrganizationPolicy\"],\n    initialRootContainer: RegistrationRequest[\"initialRootContainer\"],\n    initialRootMetadataDocument: ProvisionedDocumentRequest,\n    initialRosterProfileContainer: RegistrationRequest[\"initialRosterProfileContainer\"],\n    initialRosterProfileDocument: ProvisionedDocumentRequest | undefined,\n    initialOrganizationMetadataContainer: ProvisionedSystemContainerRequest,\n    initialOrganizationProfileDocument?: ProvisionedDocumentRequest | undefined,\n    initialSystemContainers?: ProvisionedSystemContainerRequest[] | undefined,\n  ): Promise<RegistrationResponse | null>;\n}\n\nexport interface RegisterIdentityInput {\n  apiClient: RegistrationApi;\n  containerId: string;\n  dbClient: ExecSqlClientLike;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  /**\n   * Reports whether the identity that started this registration is still\n   * current. Forwarded to the bootstrap persist's in-mutex currency check,\n   * so an identity replaced while the persist waits for the mutation queue\n   * cannot write its bootstrap through a client the replacement owns.\n   */\n  isIdentityCurrent?: (() => boolean) | undefined;\n  /** @internal Forwarded to the bootstrap persist; test-only seam. */\n  onPersistQueued?: (() => void) | undefined;\n  encapsulationKeyPair: EncapsulationKeyPair;\n  log?: ((message: string) => void) | undefined;\n  logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n  /**\n   * Overrides the seeded personal-org profile name; defaults to \"Personal Org\".\n   */\n  organizationProfileName?: string | undefined;\n  pinLocalUserIdentity: (\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ) => Promise<void>;\n  /** Seeds verified recovery progress for the founding policy heads. */\n  primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n  /**\n   * App-owned system containers to provision atomically with the personal\n   * organization (e.g. a trash bin). See {@link ProvisionedSystemContainerSpec}.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n  /**\n   * Overrides the seeded self roster-profile nickname; defaults to \"You\". The\n   * demo host passes each pane's peer-labeled self name (\"Peer 1 (You)\").\n   */\n  rosterProfileNickname?: string | undefined;\n  signingKeyFingerprint?: string | null | undefined;\n  signingKeyPair: SigningKeyPair;\n}\n\nexport async function registerIdentity(\n  input: RegisterIdentityInput,\n): Promise<RegistrationResponse | null> {\n  input.log?.(\"Registering identity...\");\n  await validateUserIdentityKeys({\n    candidate: {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingKeyFingerprint: input.signingKeyFingerprint,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    },\n  });\n\n  const newUserId = crypto.randomUUID();\n  const artifacts = await buildOrganizationProvisioningArtifacts({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    organizationProfileName: input.organizationProfileName,\n    provisionedSystemContainers: input.provisionedSystemContainers,\n    rootContainerId: input.containerId,\n    rosterProfileNickname: input.rosterProfileNickname,\n    signingKeyPair: input.signingKeyPair,\n    userId: newUserId,\n  });\n\n  const response = await input.apiClient.registerUser(\n    newUserId,\n    artifacts.organizationId,\n    input.containerId,\n    input.signingKeyPair.signingPublicKey,\n    input.encapsulationKeyPair.publicKey,\n    artifacts.initialAdminGroup,\n    artifacts.initialMemberGroup,\n    artifacts.initialOrganizationPolicy,\n    artifacts.initialRootContainer,\n    artifacts.rootMetadataDocumentRequest,\n    artifacts.rosterProfileBootstrap.containerRequest,\n    artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    artifacts.organizationMetadataBootstrap.containerRequest,\n    artifacts.organizationMetadataBootstrap.organizationProfileDocumentRequest,\n    artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n  );\n  if (!response) {\n    return null;\n  }\n  if (response.userId !== newUserId) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Registration response user does not match the requested identity\",\n    );\n  }\n  // Pinned only once the server has confirmed this user, and before anything\n  // is persisted under it. The trust store binds each signing key to one user,\n  // so a pin for an id the server never accepted — a retry after a lost\n  // response, or a restored key that is already registered — would later\n  // refuse the key's real user at login. Like the persistence below, it is a\n  // durable write, so it is skipped once the registering identity has been\n  // replaced: the caller discards this result.\n  if (input.isIdentityCurrent?.() ?? true) {\n    await input.pinLocalUserIdentity(newUserId, {\n      encapsulationPublicKey: input.encapsulationKeyPair.publicKey,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  }\n\n  input.log?.(`Key registered (${response.userId})`);\n  await persistOrganizationProvisioningState({\n    bootstrap: artifacts.bootstrap,\n    canStartDurableMutation: input.isIdentityCurrent,\n    onPersistQueued: input.onPersistQueued,\n    containerId: input.containerId,\n    dbClient: input.dbClient,\n    documentProjectors: input.documentProjectors,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    log: input.log,\n    logError: input.logError,\n    organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n    primePrincipalHistory: input.primePrincipalHistory,\n    response,\n    rootContainer: artifacts.rootContainer,\n    rootMetadataDocument: artifacts.rootMetadataDocument,\n    rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n    rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n    systemContainerBootstraps: artifacts.systemContainerBootstraps,\n  });\n\n  return response;\n}\n"]}

package/workflows/registration/registrationPrincipalPolicyPersistence.js

@@ -1,5 +1,5 @@
 import { computePrincipalStateHash, makeVerifiedPrincipalPolicy, } from "../../internal/crypto/index.js";
-import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence.js";
 async function principalPolicyBundleFromInitialRequest(principalType, principalId, policy) {
     const createdAt = new Date().toISOString();
     const stateHash = await computePrincipalStateHash(policy.state);

package/workflows/registration/registrationPrincipalPolicyPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"registrationPrincipalPolicyPersistence.js","sourceRoot":"","sources":["registrationPrincipalPolicyPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAE5B,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,gDAAgD,EAAE,MAAM,mFAAmF,CAAC;AAGrJ,KAAK,UAAU,uCAAuC,CACpD,aAAuC,EACvC,WAAmB,EACnB,MAAiC;IAEjC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhE,OAAO;QACL,YAAY,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;QACvD,cAAc,EAAE;YACd,aAAa;YACb,WAAW;YACX,SAAS;YACT,GAAG,MAAM,CAAC,gBAAgB;YAC1B,SAAS;SACV;QACD,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,iBAAiB,EAAE,MAAM,CAAC,UAAU;QACpC,sBAAsB,EAAE;YACtB,aAAa;YACb,WAAW;YACX,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;YAC5B,SAAS,EAAE,MAAM,CAAC,eAAe;SAClC;QACD,cAAc,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAAqC;IAErC,OAAO,uCAAuC,CAC5C,OAAO,EACP,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mDAAmD,CACvE,KAAuD;IAEvD,OAAO,uCAAuC,CAC5C,cAAc,EACd,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,KAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,KAAK,CAAC,CAAC;IAEzE,OAAO,iCAAiC,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,iCAAiC,CACxC,MAAqC;IAErC,OAAO,2BAA2B,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;QACpC,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,cAAc;YACxB;gBACE,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;gBACpC,MAAM,EAAE,MAAM,CAAC,aAAa;aAC7B;SACF;QACD,UAAU,EAAE;YACV,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;YAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;YACpC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CACpE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACX,MAAM;YACN,MAAM,EAAE,iCAAiC,CAAC,MAAM,CAAC;SAClD,CAAC,CACH;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW;QAC3D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  computePrincipalStateHash,\n  makeVerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  CreateOrganizationGroupRequest,\n  PutPrincipalPolicyRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nasync function principalPolicyBundleFromInitialRequest(\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  policy: PutPrincipalPolicyRequest,\n): Promise<PrincipalPolicyBundleResponse> {\n  const createdAt = new Date().toISOString();\n  const stateHash = await computePrincipalStateHash(policy.state);\n\n  return {\n    currentState: { ...policy.state, stateHash, createdAt },\n    currentPayload: {\n      principalType,\n      principalId,\n      stateHash,\n      ...policy.encryptedPayload,\n      createdAt,\n    },\n    currentGrants: policy.grants,\n    currentProjection: policy.projection,\n    currentMemberEnvelopes: {\n      principalType,\n      principalId,\n      stateHash,\n      epoch: policy.state.keyEpoch,\n      envelopes: policy.memberEnvelopes,\n    },\n    previousStates: [],\n  };\n}\n\nexport async function principalPolicyBundleFromInitialGroupRequest(\n  input: CreateOrganizationGroupRequest,\n): Promise<PrincipalPolicyBundleResponse> {\n  return principalPolicyBundleFromInitialRequest(\n    \"group\",\n    input.groupId,\n    input.initialGroupPolicy,\n  );\n}\n\nexport async function principalPolicyBundleFromInitialOrganizationRequest(\n  input: RegistrationRequest[\"initialOrganizationPolicy\"],\n): Promise<PrincipalPolicyBundleResponse> {\n  return principalPolicyBundleFromInitialRequest(\n    \"organization\",\n    input.state.principalId,\n    input,\n  );\n}\n\nexport async function verifiedPrincipalPolicyFromInitialGroupRequest(\n  input: CreateOrganizationGroupRequest,\n): Promise<VerifiedPrincipalPolicy> {\n  const bundle = await principalPolicyBundleFromInitialGroupRequest(input);\n\n  return verifiedPrincipalPolicyFromBundle(bundle);\n}\n\nfunction verifiedPrincipalPolicyFromBundle(\n  bundle: PrincipalPolicyBundleResponse,\n): VerifiedPrincipalPolicy {\n  return makeVerifiedPrincipalPolicy({\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    state: bundle.currentState,\n    projection: bundle.currentProjection,\n    grants: bundle.currentGrants,\n    history: [\n      ...bundle.previousStates,\n      {\n        state: bundle.currentState,\n        projection: bundle.currentProjection,\n        grants: bundle.currentGrants,\n      },\n    ],\n    checkpoint: {\n      principalType: bundle.currentState.principalType,\n      principalId: bundle.currentState.principalId,\n      version: bundle.currentState.version,\n      stateHash: bundle.currentState.stateHash,\n    },\n  });\n}\n\nexport async function persistRegistrationPrincipalPolicies(input: {\n  readonly adminGroup: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly memberGroup: PrincipalPolicyBundleResponse;\n  readonly organization: PrincipalPolicyBundleResponse;\n}): Promise<void> {\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [input.adminGroup, input.memberGroup, input.organization].map(\n      (bundle) => ({\n        bundle,\n        policy: verifiedPrincipalPolicyFromBundle(bundle),\n      }),\n    ),\n    execSql: input.execSql,\n    organizationId: input.organization.currentState.principalId,\n    updatedAt: new Date().toISOString(),\n  });\n}\n"]}
+{"version":3,"file":"registrationPrincipalPolicyPersistence.js","sourceRoot":"","sources":["registrationPrincipalPolicyPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAE5B,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,gDAAgD,EAAE,MAAM,sFAAsF,CAAC;AAGxJ,KAAK,UAAU,uCAAuC,CACpD,aAAuC,EACvC,WAAmB,EACnB,MAAiC;IAEjC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhE,OAAO;QACL,YAAY,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;QACvD,cAAc,EAAE;YACd,aAAa;YACb,WAAW;YACX,SAAS;YACT,GAAG,MAAM,CAAC,gBAAgB;YAC1B,SAAS;SACV;QACD,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,iBAAiB,EAAE,MAAM,CAAC,UAAU;QACpC,sBAAsB,EAAE;YACtB,aAAa;YACb,WAAW;YACX,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;YAC5B,SAAS,EAAE,MAAM,CAAC,eAAe;SAClC;QACD,cAAc,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,KAAqC;IAErC,OAAO,uCAAuC,CAC5C,OAAO,EACP,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mDAAmD,CACvE,KAAuD;IAEvD,OAAO,uCAAuC,CAC5C,cAAc,EACd,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,KAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,KAAK,CAAC,CAAC;IAEzE,OAAO,iCAAiC,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,iCAAiC,CACxC,MAAqC;IAErC,OAAO,2BAA2B,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;QACpC,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,cAAc;YACxB;gBACE,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;gBACpC,MAAM,EAAE,MAAM,CAAC,aAAa;aAC7B;SACF;QACD,UAAU,EAAE;YACV,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;YAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;YACpC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CACpE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACX,MAAM;YACN,MAAM,EAAE,iCAAiC,CAAC,MAAM,CAAC;SAClD,CAAC,CACH;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW;QAC3D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  computePrincipalStateHash,\n  makeVerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  CreateOrganizationGroupRequest,\n  PutPrincipalPolicyRequest,\n  RegistrationRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nasync function principalPolicyBundleFromInitialRequest(\n  principalType: \"group\" | \"organization\",\n  principalId: string,\n  policy: PutPrincipalPolicyRequest,\n): Promise<PrincipalPolicyBundleResponse> {\n  const createdAt = new Date().toISOString();\n  const stateHash = await computePrincipalStateHash(policy.state);\n\n  return {\n    currentState: { ...policy.state, stateHash, createdAt },\n    currentPayload: {\n      principalType,\n      principalId,\n      stateHash,\n      ...policy.encryptedPayload,\n      createdAt,\n    },\n    currentGrants: policy.grants,\n    currentProjection: policy.projection,\n    currentMemberEnvelopes: {\n      principalType,\n      principalId,\n      stateHash,\n      epoch: policy.state.keyEpoch,\n      envelopes: policy.memberEnvelopes,\n    },\n    previousStates: [],\n  };\n}\n\nexport async function principalPolicyBundleFromInitialGroupRequest(\n  input: CreateOrganizationGroupRequest,\n): Promise<PrincipalPolicyBundleResponse> {\n  return principalPolicyBundleFromInitialRequest(\n    \"group\",\n    input.groupId,\n    input.initialGroupPolicy,\n  );\n}\n\nexport async function principalPolicyBundleFromInitialOrganizationRequest(\n  input: RegistrationRequest[\"initialOrganizationPolicy\"],\n): Promise<PrincipalPolicyBundleResponse> {\n  return principalPolicyBundleFromInitialRequest(\n    \"organization\",\n    input.state.principalId,\n    input,\n  );\n}\n\nexport async function verifiedPrincipalPolicyFromInitialGroupRequest(\n  input: CreateOrganizationGroupRequest,\n): Promise<VerifiedPrincipalPolicy> {\n  const bundle = await principalPolicyBundleFromInitialGroupRequest(input);\n\n  return verifiedPrincipalPolicyFromBundle(bundle);\n}\n\nfunction verifiedPrincipalPolicyFromBundle(\n  bundle: PrincipalPolicyBundleResponse,\n): VerifiedPrincipalPolicy {\n  return makeVerifiedPrincipalPolicy({\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    state: bundle.currentState,\n    projection: bundle.currentProjection,\n    grants: bundle.currentGrants,\n    history: [\n      ...bundle.previousStates,\n      {\n        state: bundle.currentState,\n        projection: bundle.currentProjection,\n        grants: bundle.currentGrants,\n      },\n    ],\n    checkpoint: {\n      principalType: bundle.currentState.principalType,\n      principalId: bundle.currentState.principalId,\n      version: bundle.currentState.version,\n      stateHash: bundle.currentState.stateHash,\n    },\n  });\n}\n\nexport async function persistRegistrationPrincipalPolicies(input: {\n  readonly adminGroup: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly memberGroup: PrincipalPolicyBundleResponse;\n  readonly organization: PrincipalPolicyBundleResponse;\n}): Promise<void> {\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [input.adminGroup, input.memberGroup, input.organization].map(\n      (bundle) => ({\n        bundle,\n        policy: verifiedPrincipalPolicyFromBundle(bundle),\n      }),\n    ),\n    execSql: input.execSql,\n    organizationId: input.organization.currentState.principalId,\n    updatedAt: new Date().toISOString(),\n  });\n}\n"]}

package/workflows/sync/remoteResetPlans.js

@@ -1,10 +1,10 @@
 import { createDocument, exportAllUpdates } from "../../internal/loro/index.js";
 import { and, eq, ne, or, sql } from "drizzle-orm";
-import { getDocumentAttachments, } from "../../data/documents/documentContent.js";
+import { getDocumentAttachments, } from "../../data/documents/index.js";
 import { createPendingUpdateFields } from "../../data/documents/documentSync.js";
 import { DOCUMENTS_APP_KIND } from "../../data/persistence/documents/documentsPersistence.js";
 import { documentAttachmentBlobProjection, documentHistoryCheckpoints, documentHistoryUpdates, documentPendingAttachments, documents, } from "../../data/sqlite/schema/index.js";
-import { importDocumentHistoryTailUpdates } from "../documents/historyContent.js";
+import { importDocumentHistoryTailUpdates } from "../documents/index.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
 function historyScopeKey(appKind, localId) {
     return `${appKind} ${localId}`;