@tearleads/client-sdk 0.1.14 → 0.1.16

package/workflows/organizations/groupPolicyMutationEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyMutationEvidence.js","sourceRoot":"","sources":["groupPolicyMutationEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EAML,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,uDAAuD,CAAC;AAC3G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA6B9D,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAG7C,KAAQ,EACR,IAAsD;IAEtD,KAAK,GAAG;QACN,GAAG,KAAK;QACR,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QACnD,GAAG,CAAC,+BAA+B,IAAI,KAAK;YAC1C,CAAC,CAAC;gBACE,6BAA6B,EAAE,eAAe,CAC5C,KAAK,CAAC,6BAA6B,CACpC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sBAAsB,EAAE,eAAe,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACrE,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3D,qBAAqB,EAAE,eAAe,CAAC,KAAK,CAAC,qBAAqB,CAAC;QACnE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;KACtD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,CAAC,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9D,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,uBAAuB,IAAI,KAAK,EAAE,CAAC;YACrC,MAAM,kCAAkC,CAAC;gBACvC,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;aACpC,CAAC,CAAC;YACH,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,oCAAoC,CAAC;gBAC1D,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;gBACnC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;YACvC,+BAA+B,CAAC;gBAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;gBACrC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;gBAClC,eAAe,EAAE,KAAK,CAAC,qBAAqB;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,CAAC;gBACtB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB;oBACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;gBAC1D,gBAAgB,EAAE,KAAK,CAAC,6BAA6B;aACtD,CAAC,CAAC;QACL,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type SigningKeyPair,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrentMutation,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"../../data/persistence/verifiedPrincipalPolicyCurrent\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport { verifyGroupPolicy } from \"./groupPolicyVerification\";\n\ninterface GroupMembershipSigningInput {\n  readonly currentOrgAdminUserIds?: readonly string[] | undefined;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly isOrganizationAdminsGroup?: boolean | undefined;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}\n\nexport interface FullGroupMembershipMutationInput\n  extends GroupMembershipSigningInput {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}\n\ninterface CurrentGroupMembershipMutationInput\n  extends GroupMembershipSigningInput {\n  readonly currentPolicy: PrincipalPolicyPageCurrent;\n  readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;\n  readonly stillCurrent: () => boolean;\n}\n\nexport type BuildGroupMembershipMutationInput =\n  | FullGroupMembershipMutationInput\n  | CurrentGroupMembershipMutationInput;\n\n/** Current artifacts require their verified evidence; omitted history is never a bundle. */\nexport async function withVerifiedGroupMutation<\n  T extends BuildGroupMembershipMutationInput,\n>(\n  input: T,\n  work: (owned: T) => Promise<PutPrincipalPolicyRequest>,\n): Promise<PutPrincipalPolicyRequest> {\n  input = {\n    ...input,\n    currentPolicy: structuredClone(input.currentPolicy),\n    ...(\"currentPolicySignerPublicKeys\" in input\n      ? {\n          currentPolicySignerPublicKeys: structuredClone(\n            input.currentPolicySignerPublicKeys,\n          ),\n        }\n      : {}),\n    currentOrgAdminUserIds: structuredClone(input.currentOrgAdminUserIds),\n    externalAuthority: structuredClone(input.externalAuthority),\n    localPolicyCheckpoint: structuredClone(input.localPolicyCheckpoint),\n    signingKeyPair: structuredClone(input.signingKeyPair),\n  };\n  try {\n    const current = () =>\n      !(\"verifiedCurrentPolicy\" in input) || input.stillCurrent();\n    assertProjectionVerificationCurrent(current);\n    if (\"verifiedCurrentPolicy\" in input) {\n      await assertCurrentMatchesVerifiedPolicy({\n        current: input.currentPolicy,\n        policy: input.verifiedCurrentPolicy,\n      });\n      requireSignerCanManageGroup(\n        input.currentPolicy,\n        input.currentOrgAdminUserIds ?? [],\n        input.signerUserId,\n      );\n      const verified = await verifyPrincipalPolicyCurrentMutation({\n        current: input.currentPolicy,\n        policy: input.verifiedCurrentPolicy,\n        signerUserId: input.signerUserId,\n        externalAuthority: input.externalAuthority,\n      });\n      if (!verified.ok) throw verified.error;\n      verifyPrincipalPolicyCheckpoint({\n        chain: verified.value.retainedHistory,\n        currentState: verified.value.state,\n        localCheckpoint: input.localPolicyCheckpoint,\n      });\n    } else {\n      await verifyGroupPolicy({\n        currentPolicy: input.currentPolicy,\n        ...(input.externalAuthority\n          ? { externalAuthority: input.externalAuthority }\n          : {}),\n        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n        signerPublicKeys: input.currentPolicySignerPublicKeys,\n      });\n    }\n    assertProjectionVerificationCurrent(current);\n    requireSignerCanManageGroup(\n      input.currentPolicy,\n      input.currentOrgAdminUserIds ?? [],\n      input.signerUserId,\n    );\n    const result = await work(input);\n    assertProjectionVerificationCurrent(current);\n    return result;\n  } finally {\n    input.signingKeyPair.signingPrivateKey.fill(0);\n  }\n}\n"]}

package/workflows/organizations/groupPolicyMutationHead.js.map

@@ -1 +1 @@
-{"version":3,"file":"groupPolicyMutationHead.js","sourceRoot":"","sources":["groupPolicyMutationHead.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC;AAI3B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAAoD,EACpD,IAA6B;IAE7B,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC9B,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAChC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAClC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,KAAoD,EACpD,IAA6B;IAE7B,IAAI,CAAC,sCAAsC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n  computePrincipalStateHash,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport async function groupPolicyMutationHead(\n  request: PutPrincipalPolicyRequest,\n): Promise<ReferencedPrincipalHead> {\n  const state = request.state;\n  return {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: await computePrincipalStateHash(state),\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nfunction principalPolicyCurrentStateMatchesHead(\n  state: PrincipalPolicyBundleResponse[\"currentState\"],\n  head: ReferencedPrincipalHead,\n): boolean {\n  return (\n    state.principalType === head.principalType &&\n    state.principalId === head.principalId &&\n    state.version === head.version &&\n    state.keyEpoch === head.keyEpoch &&\n    state.stateHash === head.stateHash &&\n    state.keyFingerprint === head.keyFingerprint\n  );\n}\n\nexport function assertPrincipalPolicyCurrentStateMatchesHead(\n  state: PrincipalPolicyBundleResponse[\"currentState\"],\n  head: ReferencedPrincipalHead,\n): void {\n  if (!principalPolicyCurrentStateMatchesHead(state, head)) {\n    throw new Error(\"Updated group policy advanced during root re-wrap\");\n  }\n}\n"]}
+{"version":3,"file":"groupPolicyMutationHead.js","sourceRoot":"","sources":["groupPolicyMutationHead.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAA8B,EAC9B,IAA6B;IAE7B,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC9B,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAChC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAClC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,KAA8B,EAC9B,IAA6B;IAE7B,IAAI,CAAC,sCAAsC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n  computePrincipalStateHash,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\n\nexport async function groupPolicyMutationHead(\n  request: PutPrincipalPolicyRequest,\n): Promise<ReferencedPrincipalHead> {\n  const state = request.state;\n  return {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: await computePrincipalStateHash(state),\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nfunction principalPolicyCurrentStateMatchesHead(\n  state: ReferencedPrincipalHead,\n  head: ReferencedPrincipalHead,\n): boolean {\n  return (\n    state.principalType === head.principalType &&\n    state.principalId === head.principalId &&\n    state.version === head.version &&\n    state.keyEpoch === head.keyEpoch &&\n    state.stateHash === head.stateHash &&\n    state.keyFingerprint === head.keyFingerprint\n  );\n}\n\nexport function assertPrincipalPolicyCurrentStateMatchesHead(\n  state: ReferencedPrincipalHead,\n  head: ReferencedPrincipalHead,\n): void {\n  if (!principalPolicyCurrentStateMatchesHead(state, head)) {\n    throw new Error(\"Updated group policy advanced during root re-wrap\");\n  }\n}\n"]}

package/workflows/organizations/groupPolicyRequests.js

@@ -1,8 +1,8 @@
 import { generateKemSeedAndKeyPair, KeyingVerificationError, toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../internal/crypto/index.js";
 import { bytesToBase64 } from "../../internal/encoding/index.js";
 import { principalSecretKeyMatchesState } from "../../data/principals/principalKeyValidation.js";
-import { isDirectGroupAdmin, requireSignerCanManageGroup, } from "./groupMutationAuthorization.js";
-import { verifyGroupPolicy } from "./groupPolicyVerification.js";
+import { isDirectGroupAdmin } from "./groupMutationAuthorization.js";
+import { withVerifiedGroupMutation, } from "./groupPolicyMutationEvidence.js";
 import { rewrapProjectionMemberEnvelopes, toRecipientEntries, } from "./principalPolicyRecipients.js";
 import { signedGroupPolicyRequest, userProjectionMember, } from "./principalPolicyRequest.js";
 /**
@@ -33,17 +33,6 @@ function requireExternalAuthority(authority) {
     }
     return authority;
 }
-async function verifyAndAuthorizeGroupMutation(input) {
-    await verifyGroupPolicy({
-        currentPolicy: input.currentPolicy,
-        ...(input.externalAuthority
-            ? { externalAuthority: input.externalAuthority }
-            : {}),
-        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
-        signerPublicKeys: input.currentPolicySignerPublicKeys,
-    });
-    requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
-}
 async function buildRotatedKeyGroupPolicyRequest(input, projection, users, grants = input.currentPolicy.currentGrants) {
     const groupKem = generateKemSeedAndKeyPair();
     const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
@@ -112,64 +101,81 @@ async function buildDirectAdminAddGroupUserPolicyRequest(input, projection, targ
     });
 }
 export async function buildAddGroupUserPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    const targetKey = input.targetUser.userId;
-    const currentProjection = input.currentPolicy.currentProjection;
-    if (currentProjection.some((member) => member.userId === targetKey)) {
-        throw new Error("User is already a group member");
+    input = {
+        ...input,
+        currentUsers: structuredClone(input.currentUsers),
+        currentUserSecretKey: input.currentUserSecretKey.slice(),
+        targetUser: structuredClone(input.targetUser),
+    };
+    try {
+        return await withVerifiedGroupMutation(input, async (input) => {
+            const targetKey = input.targetUser.userId;
+            const currentProjection = input.currentPolicy.currentProjection;
+            if (currentProjection.some((member) => member.userId === targetKey)) {
+                throw new Error("User is already a group member");
+            }
+            const projection = [
+                ...currentProjection,
+                userProjectionMember(input.targetUser.userId, input.isOrganizationAdminsGroup ? "admin" : "member"),
+            ];
+            return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+                ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)
+                : buildRotatedKeyGroupPolicyRequest(input, projection, [
+                    ...input.currentUsers,
+                    input.targetUser,
+                ]);
+        });
+    }
+    finally {
+        input.currentUserSecretKey.fill(0);
     }
-    const projection = [
-        ...currentProjection,
-        userProjectionMember(input.targetUser.userId, input.isOrganizationAdminsGroup ? "admin" : "member"),
-    ];
-    return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
-        ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)
-        : buildRotatedKeyGroupPolicyRequest(input, projection, [
-            ...input.currentUsers,
-            input.targetUser,
-        ]);
 }
 export async function buildRemoveGroupUserPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    const key = input.removedUserId;
-    const projection = input.currentPolicy.currentProjection.filter((member) => member.userId !== key);
-    if (projection.length === input.currentPolicy.currentProjection.length) {
-        throw new Error("User is not a group member");
-    }
-    if (hasAdmin(input.currentPolicy.currentProjection) &&
-        !hasAdmin(projection)) {
-        throw new Error("Cannot remove the last group admin");
-    }
-    return buildRotatedKeyGroupPolicyRequest(input, projection, input.remainingUsers);
+    input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };
+    return withVerifiedGroupMutation(input, async (input) => {
+        const key = input.removedUserId;
+        const projection = input.currentPolicy.currentProjection.filter((member) => member.userId !== key);
+        if (projection.length === input.currentPolicy.currentProjection.length) {
+            throw new Error("User is not a group member");
+        }
+        if (hasAdmin(input.currentPolicy.currentProjection) &&
+            !hasAdmin(projection)) {
+            throw new Error("Cannot remove the last group admin");
+        }
+        return buildRotatedKeyGroupPolicyRequest(input, projection, input.remainingUsers);
+    });
 }
 export async function buildGroupAccessSetShrinkPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    return buildRotatedKeyGroupPolicyRequest(input, [...input.currentPolicy.currentProjection], input.currentUsers, input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.revokedContainerId));
+    input = { ...input, currentUsers: structuredClone(input.currentUsers) };
+    return withVerifiedGroupMutation(input, async (input) => {
+        return buildRotatedKeyGroupPolicyRequest(input, [...input.currentPolicy.currentProjection], input.currentUsers, input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.revokedContainerId));
+    });
 }
 /** Signs a complete successor grant projection without rotating group key material. */
 export async function buildSetGroupContainerGrantPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    const grants = [
-        ...input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.containerId),
-        { accessLevel: input.accessLevel, containerId: input.containerId },
-    ];
-    return signedGroupPolicyRequest({
-        currentPolicy: input.currentPolicy,
-        encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
-        externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
-            ? null
-            : requireExternalAuthority(input.externalAuthority).currentHead,
-        keyEpoch: input.currentPolicy.currentState.keyEpoch,
-        keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
-        grants,
-        memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,
-        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
-        principalId: input.currentPolicy.currentState.principalId,
-        projection: input.currentPolicy.currentProjection,
-        signedAt: new Date().toISOString(),
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
+    return withVerifiedGroupMutation(input, async (input) => {
+        const grants = [
+            ...input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.containerId),
+            { accessLevel: input.accessLevel, containerId: input.containerId },
+        ];
+        return signedGroupPolicyRequest({
+            currentPolicy: input.currentPolicy,
+            encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
+            externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+                ? null
+                : requireExternalAuthority(input.externalAuthority).currentHead,
+            keyEpoch: input.currentPolicy.currentState.keyEpoch,
+            keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
+            grants,
+            memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,
+            payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+            principalId: input.currentPolicy.currentState.principalId,
+            projection: input.currentPolicy.currentProjection,
+            signedAt: new Date().toISOString(),
+            signerUserId: input.signerUserId,
+            signingFingerprint: input.signingFingerprint,
+            signingKeyPair: input.signingKeyPair,
+        });
     });
 }
 //# sourceMappingURL=groupPolicyRequests.js.map

package/workflows/organizations/groupPolicyRequests.js.map

@@ -1 +1 @@
-{"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAG9F,OAAO,EACL,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,KAAwC;IAExC,MAAM,iBAAiB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB,EAAE,KAAK,CAAC,6BAA6B;KACtD,CAAC,CAAC;IACH,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;IAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,GAAG,iBAAiB;QACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;KACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,yCAAyC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC;QACzE,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YACnD,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;QAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;QACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;KACnE,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM;QACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;QACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;QACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  toFingerprint,\n  unwrapDek,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalContainerGrantRequest,\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\nimport {\n  isDirectGroupAdmin,\n  requireSignerCanManageGroup,\n} from \"./groupMutationAuthorization\";\nimport type { BuildGroupMembershipMutationInput } from \"./groupPolicyMutationContext\";\nimport { verifyGroupPolicy } from \"./groupPolicyVerification\";\nimport {\n  rewrapProjectionMemberEnvelopes,\n  toRecipientEntries,\n} from \"./principalPolicyRecipients\";\nimport {\n  signedGroupPolicyRequest,\n  userProjectionMember,\n} from \"./principalPolicyRequest\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n  readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly targetUser: TrustedUserIdentity;\n};\n\n/**\n * The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n */\nasync function reportPrincipalEnvelopeMismatch(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n  const state = input.currentPolicy.currentState;\n  await input.reportSecurityIncident?.(\n    new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Group member envelope does not unwrap the signed principal key\",\n    ),\n    {\n      evidenceHashes: {\n        principalKeyFingerprint: state.keyFingerprint,\n        principalStateHash: state.stateHash,\n      },\n      objectId: state.principalId,\n      objectKind: \"principal\",\n      operation: \"group.policy.envelope_mismatch\",\n    },\n  );\n}\n\nfunction hasAdmin(\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n  return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n  authority: PrincipalPolicyExternalAuthority | undefined,\n): PrincipalPolicyExternalAuthority {\n  if (!authority) {\n    throw new Error(\"External principal authority could not be verified\");\n  }\n  return authority;\n}\n\nasync function verifyAndAuthorizeGroupMutation(\n  input: BuildGroupMembershipMutationInput,\n): Promise<void> {\n  await verifyGroupPolicy({\n    currentPolicy: input.currentPolicy,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n    signerPublicKeys: input.currentPolicySignerPublicKeys,\n  });\n  requireSignerCanManageGroup(\n    input.currentPolicy,\n    input.currentOrgAdminUserIds ?? [],\n    input.signerUserId,\n  );\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n  input: BuildGroupMembershipMutationInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  users: ReadonlyArray<TrustedUserIdentity>,\n  grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: groupKem.secretKey,\n    users,\n  });\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n    externalAuthority: isDirectGroupAdmin(\n      input.currentPolicy,\n      input.signerUserId,\n    )\n      ? null\n      : requireExternalAuthority(input.externalAuthority).currentHead,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n    keyFingerprint: await toFingerprint(groupKem.publicKey),\n    grants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupSecretKey = await unwrapDek(\n    toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n    input.currentUserSecretKey,\n  );\n  if (\n    !(await principalSecretKeyMatchesState(\n      groupSecretKey,\n      input.currentPolicy.currentState,\n    ))\n  ) {\n    await reportPrincipalEnvelopeMismatch(input);\n    return buildRotatedKeyGroupPolicyRequest(input, projection, [\n      ...input.currentUsers,\n      input.targetUser,\n    ]);\n  }\n  const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n    input.targetUser.encapsulationPublicKey,\n  ]);\n\n  if (!targetEnvelope) {\n    throw new Error(\"Failed to wrap group key for target user\");\n  }\n\n  const memberEnvelopes = [\n    ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n      (envelope) => envelope.userId !== targetKey,\n    ),\n    {\n      userId: input.targetUser.userId,\n      memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n    },\n  ];\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey:\n      input.currentPolicy.currentState.encapsulationPublicKey,\n    externalAuthority: null,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch,\n    keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n    grants: input.currentPolicy.currentGrants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n\n  const targetKey = input.targetUser.userId;\n  const currentProjection = input.currentPolicy.currentProjection;\n  if (currentProjection.some((member) => member.userId === targetKey)) {\n    throw new Error(\"User is already a group member\");\n  }\n\n  const projection = [\n    ...currentProjection,\n    userProjectionMember(\n      input.targetUser.userId,\n      input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n    ),\n  ];\n\n  return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n    ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)\n    : buildRotatedKeyGroupPolicyRequest(input, projection, [\n        ...input.currentUsers,\n        input.targetUser,\n      ]);\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly removedUserId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n\n  const key = input.removedUserId;\n  const projection = input.currentPolicy.currentProjection.filter(\n    (member) => member.userId !== key,\n  );\n\n  if (projection.length === input.currentPolicy.currentProjection.length) {\n    throw new Error(\"User is not a group member\");\n  }\n\n  if (\n    hasAdmin(input.currentPolicy.currentProjection) &&\n    !hasAdmin(projection)\n  ) {\n    throw new Error(\"Cannot remove the last group admin\");\n  }\n\n  return buildRotatedKeyGroupPolicyRequest(\n    input,\n    projection,\n    input.remainingUsers,\n  );\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly revokedContainerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n\n  return buildRotatedKeyGroupPolicyRequest(\n    input,\n    [...input.currentPolicy.currentProjection],\n    input.currentUsers,\n    input.currentPolicy.currentGrants.filter(\n      (grant) => grant.containerId !== input.revokedContainerId,\n    ),\n  );\n}\n\n/** Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n    readonly containerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  await verifyAndAuthorizeGroupMutation(input);\n  const grants = [\n    ...input.currentPolicy.currentGrants.filter(\n      (grant) => grant.containerId !== input.containerId,\n    ),\n    { accessLevel: input.accessLevel, containerId: input.containerId },\n  ];\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey:\n      input.currentPolicy.currentState.encapsulationPublicKey,\n    externalAuthority: isDirectGroupAdmin(\n      input.currentPolicy,\n      input.signerUserId,\n    )\n      ? null\n      : requireExternalAuthority(input.externalAuthority).currentHead,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch,\n    keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n    grants,\n    memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection: input.currentPolicy.currentProjection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n"]}
+{"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE;QACxD,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG;gBACjB,GAAG,iBAAiB;gBACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;aACF,CAAC;YAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;gBAChE,CAAC,CAAC,yCAAyC,CACvC,KAAK,EACL,UAAU,EACV,SAAS,CACV;gBACH,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;oBACnD,GAAG,KAAK,CAAC,YAAY;oBACrB,KAAK,CAAC,UAAU;iBACjB,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;IAC5E,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IACxE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG;YACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;YACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SACnE,CAAC;QACF,OAAO,wBAAwB,CAAC;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;YACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;gBACC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;YACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;YACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;YAC/D,MAAM;YACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;YACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;YAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;YACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  toFingerprint,\n  unwrapDek,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalContainerGrantRequest,\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\nimport { isDirectGroupAdmin } from \"./groupMutationAuthorization\";\nimport {\n  type BuildGroupMembershipMutationInput,\n  withVerifiedGroupMutation,\n} from \"./groupPolicyMutationEvidence\";\nimport {\n  rewrapProjectionMemberEnvelopes,\n  toRecipientEntries,\n} from \"./principalPolicyRecipients\";\nimport {\n  signedGroupPolicyRequest,\n  userProjectionMember,\n} from \"./principalPolicyRequest\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n  readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly targetUser: TrustedUserIdentity;\n};\n\n/**\n * The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n */\nasync function reportPrincipalEnvelopeMismatch(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n  const state = input.currentPolicy.currentState;\n  await input.reportSecurityIncident?.(\n    new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Group member envelope does not unwrap the signed principal key\",\n    ),\n    {\n      evidenceHashes: {\n        principalKeyFingerprint: state.keyFingerprint,\n        principalStateHash: state.stateHash,\n      },\n      objectId: state.principalId,\n      objectKind: \"principal\",\n      operation: \"group.policy.envelope_mismatch\",\n    },\n  );\n}\n\nfunction hasAdmin(\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n  return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n  authority: PrincipalPolicyExternalAuthority | undefined,\n): PrincipalPolicyExternalAuthority {\n  if (!authority) {\n    throw new Error(\"External principal authority could not be verified\");\n  }\n  return authority;\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n  input: BuildGroupMembershipMutationInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  users: ReadonlyArray<TrustedUserIdentity>,\n  grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: groupKem.secretKey,\n    users,\n  });\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n    externalAuthority: isDirectGroupAdmin(\n      input.currentPolicy,\n      input.signerUserId,\n    )\n      ? null\n      : requireExternalAuthority(input.externalAuthority).currentHead,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n    keyFingerprint: await toFingerprint(groupKem.publicKey),\n    grants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupSecretKey = await unwrapDek(\n    toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n    input.currentUserSecretKey,\n  );\n  if (\n    !(await principalSecretKeyMatchesState(\n      groupSecretKey,\n      input.currentPolicy.currentState,\n    ))\n  ) {\n    await reportPrincipalEnvelopeMismatch(input);\n    return buildRotatedKeyGroupPolicyRequest(input, projection, [\n      ...input.currentUsers,\n      input.targetUser,\n    ]);\n  }\n  const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n    input.targetUser.encapsulationPublicKey,\n  ]);\n\n  if (!targetEnvelope) {\n    throw new Error(\"Failed to wrap group key for target user\");\n  }\n\n  const memberEnvelopes = [\n    ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n      (envelope) => envelope.userId !== targetKey,\n    ),\n    {\n      userId: input.targetUser.userId,\n      memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n    },\n  ];\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey:\n      input.currentPolicy.currentState.encapsulationPublicKey,\n    externalAuthority: null,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch,\n    keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n    grants: input.currentPolicy.currentGrants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n  input = {\n    ...input,\n    currentUsers: structuredClone(input.currentUsers),\n    currentUserSecretKey: input.currentUserSecretKey.slice(),\n    targetUser: structuredClone(input.targetUser),\n  };\n  try {\n    return await withVerifiedGroupMutation(input, async (input) => {\n      const targetKey = input.targetUser.userId;\n      const currentProjection = input.currentPolicy.currentProjection;\n      if (currentProjection.some((member) => member.userId === targetKey)) {\n        throw new Error(\"User is already a group member\");\n      }\n\n      const projection = [\n        ...currentProjection,\n        userProjectionMember(\n          input.targetUser.userId,\n          input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n        ),\n      ];\n\n      return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n        ? buildDirectAdminAddGroupUserPolicyRequest(\n            input,\n            projection,\n            targetKey,\n          )\n        : buildRotatedKeyGroupPolicyRequest(input, projection, [\n            ...input.currentUsers,\n            input.targetUser,\n          ]);\n    });\n  } finally {\n    input.currentUserSecretKey.fill(0);\n  }\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly removedUserId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };\n  return withVerifiedGroupMutation(input, async (input) => {\n    const key = input.removedUserId;\n    const projection = input.currentPolicy.currentProjection.filter(\n      (member) => member.userId !== key,\n    );\n\n    if (projection.length === input.currentPolicy.currentProjection.length) {\n      throw new Error(\"User is not a group member\");\n    }\n\n    if (\n      hasAdmin(input.currentPolicy.currentProjection) &&\n      !hasAdmin(projection)\n    ) {\n      throw new Error(\"Cannot remove the last group admin\");\n    }\n\n    return buildRotatedKeyGroupPolicyRequest(\n      input,\n      projection,\n      input.remainingUsers,\n    );\n  });\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly revokedContainerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  input = { ...input, currentUsers: structuredClone(input.currentUsers) };\n  return withVerifiedGroupMutation(input, async (input) => {\n    return buildRotatedKeyGroupPolicyRequest(\n      input,\n      [...input.currentPolicy.currentProjection],\n      input.currentUsers,\n      input.currentPolicy.currentGrants.filter(\n        (grant) => grant.containerId !== input.revokedContainerId,\n      ),\n    );\n  });\n}\n\n/** Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n    readonly containerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  return withVerifiedGroupMutation(input, async (input) => {\n    const grants = [\n      ...input.currentPolicy.currentGrants.filter(\n        (grant) => grant.containerId !== input.containerId,\n      ),\n      { accessLevel: input.accessLevel, containerId: input.containerId },\n    ];\n    return signedGroupPolicyRequest({\n      currentPolicy: input.currentPolicy,\n      encapsulationPublicKey:\n        input.currentPolicy.currentState.encapsulationPublicKey,\n      externalAuthority: isDirectGroupAdmin(\n        input.currentPolicy,\n        input.signerUserId,\n      )\n        ? null\n        : requireExternalAuthority(input.externalAuthority).currentHead,\n      keyEpoch: input.currentPolicy.currentState.keyEpoch,\n      keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n      grants,\n      memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n      payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n      principalId: input.currentPolicy.currentState.principalId,\n      projection: input.currentPolicy.currentProjection,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  });\n}\n"]}

package/workflows/organizations/index.d.ts

@@ -1,4 +1,7 @@
 export { type OrganizationReadModelInvalidationListener, subscribeOrganizationReadModelInvalidation, } from "../../data/persistence/organizations/organizationReadModelInvalidation.js";
+export { PendingPrincipalMutationError } from "../../data/persistence/principalMutationJournalPersistence.js";
+export type { AuthoredPrincipalMutation, PrincipalMutationJournalScope, } from "../../data/principals/principalMutationJournal.js";
+export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, type OrganizationBilling, type OrganizationBillingHistory, type OrganizationBillingHistoryEntry, type OrganizationBillingManagementUrl, type OrganizationBillingView, type OrganizationNativePurchaseEligibility, resolveOrganizationBillingView, type StripeCheckoutIntent, type StripeCheckoutOptions, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
 export { type CreateOrganizationApi, type CreateOrganizationInput, createOrganization, } from "./createOrganization.js";
@@ -9,7 +12,10 @@ export { type LocalOrganizationSummary, listLocalOrganizations, } from "./listLo
 export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { type ImportedOrganizationUser, importOrganizationUser, } from "./organizationUserImport.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
+export { type PrincipalMutationJournalContext, PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
 export { buildOrganizationGroupPolicyHistory, type OrganizationContainerGrant, type OrganizationContainerGrants, type OrganizationDirectory, type OrganizationDirectoryAndGroups, type OrganizationDirectoryUser, type OrganizationGroupContainer, type OrganizationGroupContainers, type OrganizationGroupDetails, type OrganizationGroupMember, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationGroupPolicyHistoryEntry, type OrganizationGroupSummary, type OrganizationPolicyGrantChange, type OrganizationPolicyGroupChange, type OrganizationPolicyHistory, type OrganizationPolicyHistoryEntry, type OrganizationPrincipalMemberChange, type OrganizationPrincipalMemberChangeType, type OrganizationPrincipalPolicyHistory, type OrganizationPrincipalPolicyHistoryEntry, type OrganizationProfile, type OrganizationUserDetail, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
 export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, type ReconcileOrganizationDirectoryAndGroupsInput, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
+export { type AcknowledgedPrincipalCurrentInput, type AcknowledgedPrincipalCurrentRetirement, retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";

package/workflows/organizations/index.js

@@ -1,4 +1,6 @@
 export { subscribeOrganizationReadModelInvalidation, } from "../../data/persistence/organizations/organizationReadModelInvalidation.js";
+export { PendingPrincipalMutationError } from "../../data/persistence/principalMutationJournalPersistence.js";
+export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, resolveOrganizationBillingView, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
 export { createOrganization, } from "./createOrganization.js";
@@ -9,8 +11,11 @@ export { listLocalOrganizations, } from "./listLocalOrganizations.js";
 export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { importOrganizationUser, } from "./organizationUserImport.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
+export { PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
 export { buildOrganizationGroupPolicyHistory, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
 export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
+export { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";
 //# sourceMappingURL=index.js.map

package/workflows/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAGL,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EAEjC,uCAAuC,GACxC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n  type OrganizationReadModelInvalidationListener,\n  subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  type OrganizationBilling,\n  type OrganizationBillingHistory,\n  type OrganizationBillingHistoryEntry,\n  type OrganizationBillingManagementUrl,\n  type OrganizationBillingView,\n  type OrganizationNativePurchaseEligibility,\n  resolveOrganizationBillingView,\n  type StripeCheckoutIntent,\n  type StripeCheckoutOptions,\n  startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport {\n  type CreateOrganizationApi,\n  type CreateOrganizationInput,\n  createOrganization,\n} from \"./createOrganization\";\nexport {\n  loadLocalOrganizationDataUsage,\n  type OrganizationDataUsage,\n  type ReconcileOrganizationDataUsageInput,\n  reconcileOrganizationDataUsage,\n} from \"./dataUsageReadModel\";\nexport { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nexport { GroupMembershipNameMismatchError } from \"./groupMembershipName\";\nexport {\n  type LocalOrganizationSummary,\n  listLocalOrganizations,\n} from \"./listLocalOrganizations\";\nexport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupPolicyHistory,\n  loadLocalOrganizationPolicyHistory,\n  loadLocalOrganizationPolicyReference,\n  loadLocalOrganizationUserDetail,\n} from \"./localReadModelDetails\";\nexport {\n  buildOrganizationProfileDocumentPatch,\n  createInitializedOrganizationProfileDocument,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  getOrganizationProfileDocumentLocalId,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n  type ImportedOrganizationUser,\n  importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  createOrganizationGroup,\n  removeOrganizationGroupUser,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n  buildOrganizationGroupPolicyHistory,\n  type OrganizationContainerGrant,\n  type OrganizationContainerGrants,\n  type OrganizationDirectory,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationDirectoryUser,\n  type OrganizationGroupContainer,\n  type OrganizationGroupContainers,\n  type OrganizationGroupDetails,\n  type OrganizationGroupMember,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationGroupPolicyHistoryEntry,\n  type OrganizationGroupSummary,\n  type OrganizationPolicyGrantChange,\n  type OrganizationPolicyGroupChange,\n  type OrganizationPolicyHistory,\n  type OrganizationPolicyHistoryEntry,\n  type OrganizationPrincipalMemberChange,\n  type OrganizationPrincipalMemberChangeType,\n  type OrganizationPrincipalPolicyHistory,\n  type OrganizationPrincipalPolicyHistoryEntry,\n  type OrganizationProfile,\n  type OrganizationUserDetail,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupMembers,\n  type ReconcileOrganizationDirectoryAndGroupsInput,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"./readModelProjection\";\nexport {\n  buildRosterProfileDocumentPatch,\n  createInitializedRosterProfileDocument,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAGL,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAC3C,8BAA8B,GAC/B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,EACpC,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EAEjC,uCAAuC,GACxC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n  type OrganizationReadModelInvalidationListener,\n  subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport { PendingPrincipalMutationError } from \"../../data/persistence/principalMutationJournalPersistence\";\nexport type {\n  AuthoredPrincipalMutation,\n  PrincipalMutationJournalScope,\n} from \"../../data/principals/principalMutationJournal\";\nexport { UnreadablePrincipalMutationError } from \"../../data/principals/principalMutationJournalRecord\";\nexport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  type OrganizationBilling,\n  type OrganizationBillingHistory,\n  type OrganizationBillingHistoryEntry,\n  type OrganizationBillingManagementUrl,\n  type OrganizationBillingView,\n  type OrganizationNativePurchaseEligibility,\n  resolveOrganizationBillingView,\n  type StripeCheckoutIntent,\n  type StripeCheckoutOptions,\n  startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport {\n  type CreateOrganizationApi,\n  type CreateOrganizationInput,\n  createOrganization,\n} from \"./createOrganization\";\nexport {\n  loadLocalOrganizationDataUsage,\n  type OrganizationDataUsage,\n  type ReconcileOrganizationDataUsageInput,\n  reconcileOrganizationDataUsage,\n} from \"./dataUsageReadModel\";\nexport { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nexport { GroupMembershipNameMismatchError } from \"./groupMembershipName\";\nexport {\n  type LocalOrganizationSummary,\n  listLocalOrganizations,\n} from \"./listLocalOrganizations\";\nexport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupPolicyHistory,\n  loadLocalOrganizationPolicyHistory,\n  loadLocalOrganizationPolicyReference,\n  loadLocalOrganizationUserDetail,\n} from \"./localReadModelDetails\";\nexport {\n  buildOrganizationProfileDocumentPatch,\n  createInitializedOrganizationProfileDocument,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  getOrganizationProfileDocumentLocalId,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n  type ImportedOrganizationUser,\n  importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n  abandonJournaledPrincipalMutation,\n  discardUnreadableJournaledPrincipalMutation,\n  readJournaledPrincipalMutation,\n} from \"./principalMutationJournalManagement\";\nexport {\n  type PrincipalMutationJournalContext,\n  PrincipalMutationOutcomeUnknownError,\n  recoverJournaledPrincipalMutation,\n  submitJournaledPrincipalMutation,\n} from \"./principalMutationJournalSession\";\nexport {\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  createOrganizationGroup,\n  removeOrganizationGroupUser,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n  buildOrganizationGroupPolicyHistory,\n  type OrganizationContainerGrant,\n  type OrganizationContainerGrants,\n  type OrganizationDirectory,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationDirectoryUser,\n  type OrganizationGroupContainer,\n  type OrganizationGroupContainers,\n  type OrganizationGroupDetails,\n  type OrganizationGroupMember,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationGroupPolicyHistoryEntry,\n  type OrganizationGroupSummary,\n  type OrganizationPolicyGrantChange,\n  type OrganizationPolicyGroupChange,\n  type OrganizationPolicyHistory,\n  type OrganizationPolicyHistoryEntry,\n  type OrganizationPrincipalMemberChange,\n  type OrganizationPrincipalMemberChangeType,\n  type OrganizationPrincipalPolicyHistory,\n  type OrganizationPrincipalPolicyHistoryEntry,\n  type OrganizationProfile,\n  type OrganizationUserDetail,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupMembers,\n  type ReconcileOrganizationDirectoryAndGroupsInput,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"./readModelProjection\";\nexport {\n  type AcknowledgedPrincipalCurrentInput,\n  type AcknowledgedPrincipalCurrentRetirement,\n  retainAcknowledgedPrincipalCurrents,\n} from \"./retainAcknowledgedPrincipalCurrents\";\nexport {\n  buildRosterProfileDocumentPatch,\n  createInitializedRosterProfileDocument,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  getRosterProfileDocumentLocalId,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}

package/workflows/organizations/organizationGroupNames.js

@@ -1,9 +1,16 @@
 import { saveOrganizationGroupDisplayNames } from "../../data/persistence/organizations/organizationGroupNamePersistence.js";
 import { retainVerifiedPrincipalPolicyBundle } from "../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { hydrateCurrentOrganizationGroupNames } from "./currentOrganizationGroupNames.js";
 import { verifyDirectoryGroup, } from "./groupNameUniqueness.js";
 import { loadGroupNameDirectoryAuthority } from "./organizationGroupNamePolicies.js";
 /** Verify names against the signed directory before projecting decrypted labels. */
 export async function hydrateOrganizationGroupNames(input) {
+    if (input.resolveCurrentPolicy)
+        return hydrateCurrentOrganizationGroupNames({
+            ...input,
+            organizationReference: input.organizationPolicyReference,
+            resolveCurrentPolicy: input.resolveCurrentPolicy,
+        });
     const authority = await loadGroupNameDirectoryAuthority(input);
     if (!authority)
         throw new Error("Group directory authority is unavailable");

package/workflows/organizations/organizationGroupNames.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationGroupNames.js","sourceRoot":"","sources":["organizationGroupNames.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAEL,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAGlF,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAIC;IAED,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC5E,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,EACD,IAAI,CACL,CAAC;QACF,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,mCAAmC,CAAC;YACxC,GAAG,KAAK;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7E,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { saveOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  type DirectoryGroupWalkInput,\n  verifyDirectoryGroup,\n} from \"./groupNameUniqueness\";\nimport { loadGroupNameDirectoryAuthority } from \"./organizationGroupNamePolicies\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\n/** Verify names against the signed directory before projecting decrypted labels. */\nexport async function hydrateOrganizationGroupNames(\n  input: Omit<DirectoryGroupWalkInput, \"descriptor\" | \"externalAuthority\"> & {\n    readonly directory: OrganizationDirectoryAndGroups;\n    readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n    readonly stillCurrent: () => boolean;\n  },\n): Promise<OrganizationDirectoryAndGroups> {\n  const authority = await loadGroupNameDirectoryAuthority(input);\n  if (!authority) throw new Error(\"Group directory authority is unavailable\");\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadableGroupIds = new Set<string>();\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await verifyDirectoryGroup(\n      {\n        ...input,\n        descriptor: authority.descriptor,\n        externalAuthority: authority.externalAuthority,\n      },\n      head,\n    );\n    // An undecryptable name stays blank for its group alone, and is flagged so\n    // the group is never offered for selection by name.\n    if (verified.name === null) {\n      unreadableGroupIds.add(group.groupId);\n    } else {\n      names.push({\n        groupId: group.groupId,\n        name: verified.name,\n        stateHash: head.stateHash,\n      });\n    }\n    await retainVerifiedPrincipalPolicyBundle({\n      ...input,\n      bundle: verified.bundle,\n      policy: verified.policy,\n      updatedAt: new Date().toISOString(),\n    });\n  }\n  if (!input.stillCurrent()) throw new Error(\"Group directory access changed\");\n  await saveOrganizationGroupDisplayNames({ ...input, names });\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadableGroupIds.has(group.groupId),\n    })),\n  };\n}\n"]}
+{"version":3,"file":"organizationGroupNames.js","sourceRoot":"","sources":["organizationGroupNames.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAEL,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAGlF,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAUC;IAED,IAAI,KAAK,CAAC,oBAAoB;QAC5B,OAAO,oCAAoC,CAAC;YAC1C,GAAG,KAAK;YACR,qBAAqB,EAAE,KAAK,CAAC,2BAA2B;YACxD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC5E,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY,EAAE,SAAS;YAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,EACD,IAAI,CACL,CAAC;QACF,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,mCAAmC,CAAC;YACxC,GAAG,KAAK;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7E,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK,CAAC,SAAS;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,KAAK;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACnC,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { saveOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport { hydrateCurrentOrganizationGroupNames } from \"./currentOrganizationGroupNames\";\nimport {\n  type DirectoryGroupWalkInput,\n  verifyDirectoryGroup,\n} from \"./groupNameUniqueness\";\nimport { loadGroupNameDirectoryAuthority } from \"./organizationGroupNamePolicies\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\n/** Verify names against the signed directory before projecting decrypted labels. */\nexport async function hydrateOrganizationGroupNames(\n  input: Omit<DirectoryGroupWalkInput, \"descriptor\" | \"externalAuthority\"> & {\n    readonly directory: OrganizationDirectoryAndGroups;\n    readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n    readonly recoveryBatch?: object | undefined;\n    readonly stillCurrent: () => boolean;\n    readonly resolveCurrentPolicy?:\n      | Parameters<\n          typeof hydrateCurrentOrganizationGroupNames\n        >[0][\"resolveCurrentPolicy\"]\n      | undefined;\n  },\n): Promise<OrganizationDirectoryAndGroups> {\n  if (input.resolveCurrentPolicy)\n    return hydrateCurrentOrganizationGroupNames({\n      ...input,\n      organizationReference: input.organizationPolicyReference,\n      resolveCurrentPolicy: input.resolveCurrentPolicy,\n    });\n  const authority = await loadGroupNameDirectoryAuthority(input);\n  if (!authority) throw new Error(\"Group directory authority is unavailable\");\n  const names: { groupId: string; name: string; stateHash: string }[] = [];\n  const unreadableGroupIds = new Set<string>();\n  for (const group of input.directory.groups) {\n    const head = authority.descriptor.groupHeads.find(\n      (head) => head.principalId === group.groupId,\n    );\n    if (!head || head.stateHash !== group.currentState?.stateHash)\n      throw new Error(\"Group listing does not match the signed directory\");\n    const verified = await verifyDirectoryGroup(\n      {\n        ...input,\n        descriptor: authority.descriptor,\n        externalAuthority: authority.externalAuthority,\n      },\n      head,\n    );\n    // An undecryptable name stays blank for its group alone, and is flagged so\n    // the group is never offered for selection by name.\n    if (verified.name === null) {\n      unreadableGroupIds.add(group.groupId);\n    } else {\n      names.push({\n        groupId: group.groupId,\n        name: verified.name,\n        stateHash: head.stateHash,\n      });\n    }\n    await retainVerifiedPrincipalPolicyBundle({\n      ...input,\n      bundle: verified.bundle,\n      policy: verified.policy,\n      updatedAt: new Date().toISOString(),\n    });\n  }\n  if (!input.stillCurrent()) throw new Error(\"Group directory access changed\");\n  await saveOrganizationGroupDisplayNames({ ...input, names });\n  const byId = new Map(names.map((entry) => [entry.groupId, entry.name]));\n  return {\n    ...input.directory,\n    groups: input.directory.groups.map((group) => ({\n      ...group,\n      name: byId.get(group.groupId) ?? \"\",\n      nameUnreadable: unreadableGroupIds.has(group.groupId),\n    })),\n  };\n}\n"]}

package/workflows/organizations/principalCurrentPublicationSeal.js

@@ -0,0 +1,51 @@
+import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { principalHistoryPrefixProtection } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { principalHistoryStageId, principalHistoryStageProtection, } from "../../data/principals/principalHistoryStageProtection.js";
+function exactHead(head) {
+    return {
+        principalType: head.principalType,
+        principalId: head.principalId,
+        version: head.version,
+        keyEpoch: head.keyEpoch,
+        stateHash: head.stateHash,
+        keyFingerprint: head.keyFingerprint,
+    };
+}
+export async function sealPrincipalCurrentStage(options, expectedHead, verifier, response) {
+    // Authentication uses the reference contract, never extra signed-state fields.
+    expectedHead = exactHead(expectedHead);
+    const currentJson = JSON.stringify({
+        currentState: response.currentState,
+        currentProjection: response.currentProjection,
+        currentGrants: response.currentGrants,
+        currentPayload: response.currentPayload,
+        currentMemberEnvelopes: response.currentMemberEnvelopes,
+    });
+    const stage = {
+        id: await principalHistoryStageId(options.organizationId, expectedHead, options.protection.context),
+        organizationId: options.organizationId,
+        afterVersion: expectedHead.version - 1,
+        complete: true,
+        currentJson,
+    };
+    const progress = await verifier.exportProgress(await principalHistoryStageProtection(options.protection, expectedHead, stage));
+    if (!progress.ok)
+        throw progress.error;
+    return { ...stage, progress: progress.value };
+}
+export async function sealPrincipalCurrentPublication(options, scopeId, expectedHead, verifier, response) {
+    expectedHead = exactHead(expectedHead);
+    const stage = await sealPrincipalCurrentStage(options, expectedHead, verifier, response);
+    const prefix = {
+        scopeId,
+        organizationId: options.organizationId,
+        version: expectedHead.version,
+        headJson: serializeKeyingCanonicalJson({ ...expectedHead }),
+        currentJson: stage.currentJson,
+    };
+    const progress = await verifier.exportProgress(await principalHistoryPrefixProtection(options.protection, prefix));
+    if (!progress.ok)
+        throw progress.error;
+    return { prefix: { ...prefix, progress: progress.value }, stage };
+}
+//# sourceMappingURL=principalCurrentPublicationSeal.js.map

package/workflows/organizations/principalCurrentPublicationSeal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalCurrentPublicationSeal.js","sourceRoot":"","sources":["principalCurrentPublicationSeal.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uDAAuD,CAAC;AAG/D,SAAS,SAAS,CAAC,IAA6B;IAC9C,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA6C,EAC7C,YAAqC,EACrC,QAAwC,EACxC,QAAoC;IAEpC,+EAA+E;IAC/E,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;KACxD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,MAAM,uBAAuB,CAC/B,OAAO,CAAC,cAAc,EACtB,YAAY,EACZ,OAAO,CAAC,UAAU,CAAC,OAAO,CAC3B;QACD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC;QACtC,QAAQ,EAAE,IAAI;QACd,WAAW;KACZ,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC5C,MAAM,+BAA+B,CACnC,OAAO,CAAC,UAAU,EAClB,YAAY,EACZ,KAAK,CACN,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAA6C,EAC7C,OAAe,EACf,YAAqC,EACrC,QAAwC,EACxC,QAAoC;IAEpC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAC3C,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;IACF,MAAM,MAAM,GAAG;QACb,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,QAAQ,EAAE,4BAA4B,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC5C,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CACnE,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryVerifier,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { principalHistoryPrefixProtection } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport {\n  principalHistoryStageId,\n  principalHistoryStageProtection,\n} from \"../../data/principals/principalHistoryStageProtection\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"../principals/principalHistoryRecoveryTypes\";\n\nfunction exactHead(head: ReferencedPrincipalHead): ReferencedPrincipalHead {\n  return {\n    principalType: head.principalType,\n    principalId: head.principalId,\n    version: head.version,\n    keyEpoch: head.keyEpoch,\n    stateHash: head.stateHash,\n    keyFingerprint: head.keyFingerprint,\n  };\n}\n\nexport async function sealPrincipalCurrentStage(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  expectedHead: ReferencedPrincipalHead,\n  verifier: PrincipalPolicyHistoryVerifier,\n  response: PrincipalPolicyPageCurrent,\n) {\n  // Authentication uses the reference contract, never extra signed-state fields.\n  expectedHead = exactHead(expectedHead);\n  const currentJson = JSON.stringify({\n    currentState: response.currentState,\n    currentProjection: response.currentProjection,\n    currentGrants: response.currentGrants,\n    currentPayload: response.currentPayload,\n    currentMemberEnvelopes: response.currentMemberEnvelopes,\n  });\n  const stage = {\n    id: await principalHistoryStageId(\n      options.organizationId,\n      expectedHead,\n      options.protection.context,\n    ),\n    organizationId: options.organizationId,\n    afterVersion: expectedHead.version - 1,\n    complete: true,\n    currentJson,\n  };\n  const progress = await verifier.exportProgress(\n    await principalHistoryStageProtection(\n      options.protection,\n      expectedHead,\n      stage,\n    ),\n  );\n  if (!progress.ok) throw progress.error;\n  return { ...stage, progress: progress.value };\n}\n\nexport async function sealPrincipalCurrentPublication(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  scopeId: string,\n  expectedHead: ReferencedPrincipalHead,\n  verifier: PrincipalPolicyHistoryVerifier,\n  response: PrincipalPolicyPageCurrent,\n) {\n  expectedHead = exactHead(expectedHead);\n  const stage = await sealPrincipalCurrentStage(\n    options,\n    expectedHead,\n    verifier,\n    response,\n  );\n  const prefix = {\n    scopeId,\n    organizationId: options.organizationId,\n    version: expectedHead.version,\n    headJson: serializeKeyingCanonicalJson({ ...expectedHead }),\n    currentJson: stage.currentJson,\n  };\n  const progress = await verifier.exportProgress(\n    await principalHistoryPrefixProtection(options.protection, prefix),\n  );\n  if (!progress.ok) throw progress.error;\n  return { prefix: { ...prefix, progress: progress.value }, stage };\n}\n"]}

package/workflows/organizations/principalMutationJournalLane.js

@@ -0,0 +1,26 @@
+import { principalMutationJournalScopeId, } from "../../data/principals/principalMutationJournal.js";
+import { resolveCanonicalExecSql, } from "../../data/sqlite/sqlSchema.js";
+const lanes = new WeakMap();
+/** An owned dispatch finishes before another caller can recover or abandon it. */
+export async function runPrincipalMutationJournalOperation(execSql, scope, run) {
+    const executor = resolveCanonicalExecSql(execSql);
+    const scopeId = await principalMutationJournalScopeId(scope);
+    let active = lanes.get(executor);
+    if (!active) {
+        active = new Map();
+        lanes.set(executor, active);
+    }
+    const pending = (active.get(scopeId) ?? Promise.resolve()).then(run);
+    const settled = pending.then(() => { }, () => { });
+    active.set(scopeId, settled);
+    try {
+        return await pending;
+    }
+    finally {
+        if (active.get(scopeId) === settled)
+            active.delete(scopeId);
+        if (active.size === 0)
+            lanes.delete(executor);
+    }
+}
+//# sourceMappingURL=principalMutationJournalLane.js.map

package/workflows/organizations/principalMutationJournalLane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalLane.js","sourceRoot":"","sources":["principalMutationJournalLane.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,+BAA+B,GAChC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAEL,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,MAAM,KAAK,GAAG,IAAI,OAAO,EAAuC,CAAC;AAEjE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,OAAgB,EAChB,KAAoC,EACpC,GAAqB;IAErB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC1B,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;AACH,CAAC","sourcesContent":["import {\n  type PrincipalMutationJournalScope,\n  principalMutationJournalScopeId,\n} from \"../../data/principals/principalMutationJournal\";\nimport {\n  type ExecSql,\n  resolveCanonicalExecSql,\n} from \"../../data/sqlite/sqlSchema\";\n\nconst lanes = new WeakMap<ExecSql, Map<string, Promise<void>>>();\n\n/** An owned dispatch finishes before another caller can recover or abandon it. */\nexport async function runPrincipalMutationJournalOperation<T>(\n  execSql: ExecSql,\n  scope: PrincipalMutationJournalScope,\n  run: () => Promise<T>,\n): Promise<T> {\n  const executor = resolveCanonicalExecSql(execSql);\n  const scopeId = await principalMutationJournalScopeId(scope);\n  let active = lanes.get(executor);\n  if (!active) {\n    active = new Map();\n    lanes.set(executor, active);\n  }\n  const pending = (active.get(scopeId) ?? Promise.resolve()).then(run);\n  const settled = pending.then(\n    () => {},\n    () => {},\n  );\n  active.set(scopeId, settled);\n  try {\n    return await pending;\n  } finally {\n    if (active.get(scopeId) === settled) active.delete(scopeId);\n    if (active.size === 0) lanes.delete(executor);\n  }\n}\n"]}

package/workflows/organizations/principalMutationJournalManagement.d.ts

@@ -0,0 +1,26 @@
+import { type AuthoredPrincipalMutation } from "../../data/principals/principalMutationJournal.js";
+import type { PrincipalMutationJournalContext } from "./principalMutationJournalSession.js";
+export interface PrincipalMutationRecoveryApi {
+    readonly readPendingPrincipalMutation: (organizationId: string) => Promise<AuthoredPrincipalMutation | null>;
+    readonly recoverPendingPrincipalMutation: (organizationId: string) => Promise<void>;
+    readonly abandonPendingPrincipalMutation: (organizationId: string, mutation: AuthoredPrincipalMutation, acknowledgeUnknownOutcome: true) => Promise<boolean>;
+    readonly discardUnreadablePrincipalMutation: (organizationId: string, recordId: string, acknowledgeUnknownOutcome: true) => Promise<boolean>;
+}
+type JournalIdentity = Pick<PrincipalMutationJournalContext, "execSql" | "scope" | "signingKeyPair" | "stillCurrent">;
+/** Discard only the inspected unreadable bytes; never parse them for submission. */
+export declare function discardUnreadableJournaledPrincipalMutation(input: JournalIdentity & {
+    readonly recordId: string;
+    readonly acknowledgeUnknownOutcome: true;
+}): Promise<boolean>;
+/** Inspect authenticated authored work without retrying it or changing checkpoints. */
+export declare function readJournaledPrincipalMutation(input: JournalIdentity): Promise<AuthoredPrincipalMutation | null>;
+/**
+ * An explicit host/user choice to stop retries, not a claim that the write failed.
+ * The exact inspected request must still own the lane; ordinary recovery never
+ * calls this. Future authoring must still verify the latest policy state.
+ */
+export declare function abandonJournaledPrincipalMutation(input: JournalIdentity & {
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly acknowledgeUnknownOutcome: true;
+}): Promise<boolean>;
+export {};