@tearleads/client-sdk 0.1.16 → 0.1.17

package/client/organizations/principalMutations.js

@@ -1,7 +1,12 @@
 import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
 import { addOrganizationGroupUser, createOrganizationGroup, deleteOrganizationGroup, removeOrganizationGroupUser, revokeOrganizationContainerGrant, rotateOrganizationGroupForAccessSetShrink, } from "../../workflows/organizations/index.js";
+import { createCurrentOrganizationGroup } from "../../workflows/organizations/createCurrentOrganizationGroup.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/currentGroupMetadataAuthority.js";
+import { deleteCurrentOrganizationGroup } from "../../workflows/organizations/deleteCurrentOrganizationGroup.js";
 import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
+import { createRuntimeCurrentOrganizationMutation } from "../../workflows/organizations/runtimeCurrentOrganizationMutation.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
+import { createCurrentPrincipalMutation } from "./currentPrincipalMutations.js";
 import { syncOrganizationMetadataProfile } from "./organizationMetadataProfileSync.js";
 import { preparePrincipalContainerMutations } from "./principalContainerMutations.js";
 function requireSigningContext(runtime) {
@@ -33,30 +38,44 @@ export async function addUserToOrganizationGroup(input) {
         organizationId: signingContext.organizationId,
     }, async () => {
         let memberGroupId = null;
-        const bundle = await addOrganizationGroupUser({
-            apiClient: input.runtime.apiClient,
-            beforePolicyCommit: (_head, authority) => {
-                memberGroupId = authority.memberGroupId;
-            },
-            currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)
-                .secretKey,
-            execSql: input.runtime.infra.execSql,
-            expectedGroupName: input.expectedGroupName,
-            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
-            groupId: input.groupId,
-            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                currentPolicy,
-                groupId: input.groupId,
-                nextPolicy,
-                organizationId: signingContext.organizationId,
-                runtime: input.runtime,
-                stillCurrent: input.stillCurrent,
-            }),
-            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-            targetUserId: input.targetUserId,
+        const mutateCurrent = createCurrentPrincipalMutation({
             ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
         });
+        const current = mutateCurrent
+            ? await mutateCurrent(input.groupId, {
+                kind: "add",
+                expectedGroupName: input.expectedGroupName,
+                targetUserId: input.targetUserId,
+            })
+            : undefined;
+        memberGroupId = current?.memberGroupId ?? null;
+        const bundle = current?.response ??
+            (await addOrganizationGroupUser({
+                apiClient: input.runtime.apiClient,
+                beforePolicyCommit: (_head, authority) => {
+                    memberGroupId = authority.memberGroupId;
+                },
+                currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)
+                    .secretKey,
+                execSql: input.runtime.infra.execSql,
+                expectedGroupName: input.expectedGroupName,
+                readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+                groupId: input.groupId,
+                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                    currentPolicy,
+                    groupId: input.groupId,
+                    nextPolicy,
+                    organizationId: signingContext.organizationId,
+                    runtime: input.runtime,
+                    stillCurrent: input.stillCurrent,
+                }),
+                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                targetUserId: input.targetUserId,
+                ...signingContext,
+            }));
         if (input.groupId === memberGroupId) {
             await syncOrganizationMetadataProfile({
                 containerContents: input.containerContents,
@@ -75,16 +94,37 @@ export function createGroupForOrganization(input) {
         objectKind: "principal",
         operation: "group.create",
         organizationId: signingContext.organizationId,
-    }, () => createOrganizationGroup({
-        apiClient: input.runtime.apiClient,
-        creatorEncapsulationKeyPair: requireEncapsulationKeyPair(input.runtime),
-        execSql: input.runtime.infra.execSql,
-        name: input.name,
-        metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId),
-        reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-        ...signingContext,
-    }));
+    }, () => {
+        const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);
+        const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);
+        if (mutate)
+            return mutate({ ...signingContext, stillCurrent: input.stillCurrent }, (context) => createCurrentOrganizationGroup({
+                ...signingContext,
+                context,
+                apiClient: input.runtime.apiClient,
+                creatorEncapsulationKeyPair,
+                execSql: input.runtime.infra.execSql,
+                name: input.name,
+                metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, context.stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
+                    authority: context,
+                    organizationId: signingContext.organizationId,
+                    stillCurrent: context.stillCurrent,
+                })),
+                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            }));
+        return createOrganizationGroup({
+            stillCurrent: input.stillCurrent,
+            apiClient: input.runtime.apiClient,
+            creatorEncapsulationKeyPair,
+            execSql: input.runtime.infra.execSql,
+            name: input.name,
+            metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent),
+            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            ...signingContext,
+        });
+    });
 }
 export function deleteGroupForOrganization(input) {
     const signingContext = requireSigningContext(input.runtime);
@@ -93,13 +133,25 @@ export function deleteGroupForOrganization(input) {
         objectKind: "principal",
         operation: "group.delete",
         organizationId: signingContext.organizationId,
-    }, () => deleteOrganizationGroup({
-        apiClient: input.runtime.apiClient,
-        execSql: input.runtime.infra.execSql,
-        groupId: input.groupId,
-        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-        ...signingContext,
-    }));
+    }, () => {
+        const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);
+        if (mutate)
+            return mutate({ ...signingContext, stillCurrent: input.stillCurrent }, (context) => deleteCurrentOrganizationGroup({
+                ...signingContext,
+                context,
+                groupId: input.groupId,
+                apiClient: input.runtime.apiClient,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            }));
+        return deleteOrganizationGroup({
+            stillCurrent: input.stillCurrent,
+            apiClient: input.runtime.apiClient,
+            execSql: input.runtime.infra.execSql,
+            groupId: input.groupId,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            ...signingContext,
+        });
+    });
 }
 export async function removeUserFromOrganizationGroup(input) {
     const signingContext = requireSigningContext(input.runtime);
@@ -110,27 +162,41 @@ export async function removeUserFromOrganizationGroup(input) {
         organizationId: signingContext.organizationId,
     }, async () => {
         let memberGroupId = null;
-        const bundle = await removeOrganizationGroupUser({
-            apiClient: input.runtime.apiClient,
-            beforePolicyCommit: (_head, authority) => {
-                memberGroupId = authority.memberGroupId;
-            },
-            execSql: input.runtime.infra.execSql,
-            expectedGroupName: input.expectedGroupName,
-            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
-            groupId: input.groupId,
-            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                currentPolicy,
-                groupId: input.groupId,
-                nextPolicy,
-                organizationId: signingContext.organizationId,
-                runtime: input.runtime,
-                stillCurrent: input.stillCurrent,
-            }),
-            removedUserId: input.removedUserId,
-            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        const mutateCurrent = createCurrentPrincipalMutation({
             ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
         });
+        const current = mutateCurrent
+            ? await mutateCurrent(input.groupId, {
+                kind: "remove",
+                expectedGroupName: input.expectedGroupName,
+                removedUserId: input.removedUserId,
+            })
+            : undefined;
+        memberGroupId = current?.memberGroupId ?? null;
+        const bundle = current?.response ??
+            (await removeOrganizationGroupUser({
+                apiClient: input.runtime.apiClient,
+                beforePolicyCommit: (_head, authority) => {
+                    memberGroupId = authority.memberGroupId;
+                },
+                execSql: input.runtime.infra.execSql,
+                expectedGroupName: input.expectedGroupName,
+                readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+                groupId: input.groupId,
+                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                    currentPolicy,
+                    groupId: input.groupId,
+                    nextPolicy,
+                    organizationId: signingContext.organizationId,
+                    runtime: input.runtime,
+                    stillCurrent: input.stillCurrent,
+                }),
+                removedUserId: input.removedUserId,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                ...signingContext,
+            }));
         if (input.groupId === memberGroupId) {
             await syncOrganizationMetadataProfile({
                 containerContents: input.containerContents,
@@ -154,39 +220,51 @@ export async function revokeOrganizationGrant(input) {
         operation: "principal.grant.revoke",
         organizationId: signingContext.organizationId,
     }, async () => {
-        const response = input.subjectType === "group"
-            ? await rotateOrganizationGroupForAccessSetShrink({
-                apiClient: input.runtime.apiClient,
-                execSql: input.runtime.infra.execSql,
-                groupId: input.subjectId,
+        const mutateCurrent = createCurrentPrincipalMutation({
+            ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+        });
+        const current = input.subjectType === "group" && mutateCurrent
+            ? await mutateCurrent(input.subjectId, {
+                kind: "revoke",
                 revokedContainerId: input.containerId,
-                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                    currentPolicy,
+            })
+            : undefined;
+        const response = current?.response ??
+            (input.subjectType === "group"
+                ? await rotateOrganizationGroupForAccessSetShrink({
+                    apiClient: input.runtime.apiClient,
+                    execSql: input.runtime.infra.execSql,
                     groupId: input.subjectId,
-                    nextPolicy,
-                    organizationId: signingContext.organizationId,
                     revokedContainerId: input.containerId,
-                    runtime: input.runtime,
+                    prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                        currentPolicy,
+                        groupId: input.subjectId,
+                        nextPolicy,
+                        organizationId: signingContext.organizationId,
+                        revokedContainerId: input.containerId,
+                        runtime: input.runtime,
+                        stillCurrent: input.stillCurrent,
+                    }),
+                    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                    ...signingContext,
+                })
+                : await revokeOrganizationContainerGrant({
                     stillCurrent: input.stillCurrent,
-                }),
-                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-                ...signingContext,
-            })
-            : await revokeOrganizationContainerGrant({
-                stillCurrent: input.stillCurrent,
-                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-                apiClient: input.runtime.apiClient,
-                containerId: input.containerId,
-                encapsulationKeyPair,
-                execSql: input.runtime.infra.execSql,
-                revokedSubject: {
-                    subjectId: input.subjectId,
-                    subjectType: input.subjectType,
-                },
-                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-                warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
-                ...signingContext,
-            });
+                    reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                    apiClient: input.runtime.apiClient,
+                    containerId: input.containerId,
+                    encapsulationKeyPair,
+                    execSql: input.runtime.infra.execSql,
+                    revokedSubject: {
+                        subjectId: input.subjectId,
+                        subjectType: input.subjectType,
+                    },
+                    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+                    ...signingContext,
+                }));
         await input.readModelCoordinator.reconcileAfterMutation(signingContext.organizationId);
         return response;
     });

package/client/organizations/principalMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,gCAAgC,EAChC,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAgCnF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;YAC1C,CAAC;YACD,oBAAoB,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC7D,SAAS;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;gBACjC,aAAa;gBACb,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE,CACH,uBAAuB,CAAC;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,2BAA2B,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,CAC9B;QACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,GAAG,cAAc;KAClB,CAAC,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE,CACH,uBAAuB,CAAC;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,GAAG,cAAc;KAClB,CAAC,CACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;YAC/C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;gBACjC,aAAa;gBACb,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GACZ,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,MAAM,yCAAyC,CAAC;gBAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,kBAAkB,EAAE,KAAK,CAAC,WAAW;gBACrC,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,SAAS;oBACxB,UAAU;oBACV,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,kBAAkB,EAAE,KAAK,CAAC,WAAW;oBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;gBACJ,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBAC1C,GAAG,cAAc;aAClB,CAAC;YACJ,CAAC,CAAC,MAAM,gCAAgC,CAAC;gBACrC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,oBAAoB;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,cAAc,EAAE;oBACd,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;gBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBAC1C,+BAA+B,EAC7B,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC;gBACnD,GAAG,cAAc;aAClB,CAAC,CAAC;QACT,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  addOrganizationGroupUser,\n  createOrganizationGroup,\n  deleteOrganizationGroup,\n  removeOrganizationGroupUser,\n  revokeOrganizationContainerGrant,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"../../workflows/organizations\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\nexport interface OrganizationGrantRef {\n  containerId: string;\n  subjectId: string;\n  subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n  groupId: string;\n  expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n  organizationId: string;\n  signerUserId: string;\n  signingFingerprint: string;\n  signingKeyPair: NonNullable<\n    InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n  >;\n}\n\nfunction requireSigningContext(\n  runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.auth.userId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair\n  ) {\n    throw new Error(\"Organization signing context is unavailable\");\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerUserId: runtime.auth.userId,\n    signingFingerprint: runtime.crypto.signingFingerprint,\n    signingKeyPair: runtime.crypto.signingKeyPair,\n  };\n}\n\nfunction requireEncapsulationKeyPair(\n  runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n  if (!runtime.crypto.encapsulationKeyPair) {\n    throw new Error(\"Organization encryption context is unavailable\");\n  }\n\n  return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n  readonly stillCurrent: () => boolean;\n  readonly containerContents: ContainerContents;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n  input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.add\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const bundle = await addOrganizationGroupUser({\n        apiClient: input.runtime.apiClient,\n        beforePolicyCommit: (_head, authority) => {\n          memberGroupId = authority.memberGroupId;\n        },\n        currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)\n          .secretKey,\n        execSql: input.runtime.infra.execSql,\n        expectedGroupName: input.expectedGroupName,\n        readEncryptedName: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ).readName,\n        groupId: input.groupId,\n        prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n          preparePrincipalContainerMutations({\n            currentPolicy,\n            groupId: input.groupId,\n            nextPolicy,\n            organizationId: signingContext.organizationId,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          }),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        targetUserId: input.targetUserId,\n        ...signingContext,\n      });\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport function createGroupForOrganization(input: {\n  readonly name: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: signingContext.organizationId,\n      objectKind: \"principal\",\n      operation: \"group.create\",\n      organizationId: signingContext.organizationId,\n    },\n    () =>\n      createOrganizationGroup({\n        apiClient: input.runtime.apiClient,\n        creatorEncapsulationKeyPair: requireEncapsulationKeyPair(input.runtime),\n        execSql: input.runtime.infra.execSql,\n        name: input.name,\n        metadataAccess: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n        ),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      }),\n  );\n}\n\nexport function deleteGroupForOrganization(input: {\n  readonly groupId: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.delete\",\n      organizationId: signingContext.organizationId,\n    },\n    () =>\n      deleteOrganizationGroup({\n        apiClient: input.runtime.apiClient,\n        execSql: input.runtime.infra.execSql,\n        groupId: input.groupId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      }),\n  );\n}\n\nexport async function removeUserFromOrganizationGroup(\n  input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.remove\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const bundle = await removeOrganizationGroupUser({\n        apiClient: input.runtime.apiClient,\n        beforePolicyCommit: (_head, authority) => {\n          memberGroupId = authority.memberGroupId;\n        },\n        execSql: input.runtime.infra.execSql,\n        expectedGroupName: input.expectedGroupName,\n        readEncryptedName: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ).readName,\n        groupId: input.groupId,\n        prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n          preparePrincipalContainerMutations({\n            currentPolicy,\n            groupId: input.groupId,\n            nextPolicy,\n            organizationId: signingContext.organizationId,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          }),\n        removedUserId: input.removedUserId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      });\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport async function revokeOrganizationGrant(\n  input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n  if (input.runtime.infra.dbStatus !== \"ready\") {\n    throw new Error(\"Organization local database is unavailable\");\n  }\n\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.subjectId,\n      objectKind: \"principal\",\n      operation: \"principal.grant.revoke\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const response =\n        input.subjectType === \"group\"\n          ? await rotateOrganizationGroupForAccessSetShrink({\n              apiClient: input.runtime.apiClient,\n              execSql: input.runtime.infra.execSql,\n              groupId: input.subjectId,\n              revokedContainerId: input.containerId,\n              prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n                preparePrincipalContainerMutations({\n                  currentPolicy,\n                  groupId: input.subjectId,\n                  nextPolicy,\n                  organizationId: signingContext.organizationId,\n                  revokedContainerId: input.containerId,\n                  runtime: input.runtime,\n                  stillCurrent: input.stillCurrent,\n                }),\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              ...signingContext,\n            })\n          : await revokeOrganizationContainerGrant({\n              stillCurrent: input.stillCurrent,\n              reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n              apiClient: input.runtime.apiClient,\n              containerId: input.containerId,\n              encapsulationKeyPair,\n              execSql: input.runtime.infra.execSql,\n              revokedSubject: {\n                subjectId: input.subjectId,\n                subjectType: input.subjectType,\n              },\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              warmReferencedPrincipalPolicies:\n                createRuntimePrincipalPolicyWarmer(input.runtime),\n              ...signingContext,\n            });\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return response;\n    },\n  );\n}\n"]}
+{"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,gCAAgC,EAChC,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAgCnF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,aAAa;YAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;gBACjC,IAAI,EAAE,KAAK;gBACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;QAC/C,MAAM,MAAM,GACV,OAAO,EAAE,QAAQ;YACjB,CAAC,MAAM,wBAAwB,CAAC;gBAC9B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;oBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;gBAC1C,CAAC;gBACD,oBAAoB,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;qBAC7D,SAAS;gBACZ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU;oBACV,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;gBACJ,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBACpE,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,GAAG,cAAc;aAClB,CAAC,CAAC,CAAC;QACN,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM;YACR,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;gBAC7B,GAAG,cAAc;gBACjB,OAAO;gBACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,2BAA2B;gBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;oBAClD,SAAS,EAAE,OAAO;oBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;iBACnC,CAAC,CACH;gBACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;aAC3C,CAAC,CACL,CAAC;QACJ,OAAO,uBAAuB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,GAAG,cAAc;SAClB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM;YACR,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;gBAC7B,GAAG,cAAc;gBACjB,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;aAC3C,CAAC,CACL,CAAC;QACJ,OAAO,uBAAuB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,GAAG,cAAc;SAClB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,aAAa;YAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;gBACjC,IAAI,EAAE,QAAQ;gBACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;QAC/C,MAAM,MAAM,GACV,OAAO,EAAE,QAAQ;YACjB,CAAC,MAAM,2BAA2B,CAAC;gBACjC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;oBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;gBAC1C,CAAC;gBACD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU;oBACV,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;gBACJ,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBACpE,GAAG,cAAc;aAClB,CAAC,CAAC,CAAC;QACN,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,GACX,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,aAAa;YAC5C,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;gBACnC,IAAI,EAAE,QAAQ;gBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;aACtC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GACZ,OAAO,EAAE,QAAQ;YACjB,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;gBAC5B,CAAC,CAAC,MAAM,yCAAyC,CAAC;oBAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,OAAO,EAAE,KAAK,CAAC,SAAS;oBACxB,kBAAkB,EAAE,KAAK,CAAC,WAAW;oBACrC,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;wBACjC,aAAa;wBACb,OAAO,EAAE,KAAK,CAAC,SAAS;wBACxB,UAAU;wBACV,cAAc,EAAE,cAAc,CAAC,cAAc;wBAC7C,kBAAkB,EAAE,KAAK,CAAC,WAAW;wBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;qBACjC,CAAC;oBACJ,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,GAAG,cAAc;iBAClB,CAAC;gBACJ,CAAC,CAAC,MAAM,gCAAgC,CAAC;oBACrC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAC7B,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC;oBACnD,GAAG,cAAc;iBAClB,CAAC,CAAC,CAAC;QACV,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  addOrganizationGroupUser,\n  createOrganizationGroup,\n  deleteOrganizationGroup,\n  removeOrganizationGroupUser,\n  revokeOrganizationContainerGrant,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"../../workflows/organizations\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/createCurrentOrganizationGroup\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/deleteCurrentOrganizationGroup\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\nexport interface OrganizationGrantRef {\n  containerId: string;\n  subjectId: string;\n  subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n  groupId: string;\n  expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n  organizationId: string;\n  signerUserId: string;\n  signingFingerprint: string;\n  signingKeyPair: NonNullable<\n    InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n  >;\n}\n\nfunction requireSigningContext(\n  runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.auth.userId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair\n  ) {\n    throw new Error(\"Organization signing context is unavailable\");\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerUserId: runtime.auth.userId,\n    signingFingerprint: runtime.crypto.signingFingerprint,\n    signingKeyPair: runtime.crypto.signingKeyPair,\n  };\n}\n\nfunction requireEncapsulationKeyPair(\n  runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n  if (!runtime.crypto.encapsulationKeyPair) {\n    throw new Error(\"Organization encryption context is unavailable\");\n  }\n\n  return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n  readonly stillCurrent: () => boolean;\n  readonly containerContents: ContainerContents;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n  input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.add\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      const current = mutateCurrent\n        ? await mutateCurrent(input.groupId, {\n            kind: \"add\",\n            expectedGroupName: input.expectedGroupName,\n            targetUserId: input.targetUserId,\n          })\n        : undefined;\n      memberGroupId = current?.memberGroupId ?? null;\n      const bundle =\n        current?.response ??\n        (await addOrganizationGroupUser({\n          apiClient: input.runtime.apiClient,\n          beforePolicyCommit: (_head, authority) => {\n            memberGroupId = authority.memberGroupId;\n          },\n          currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)\n            .secretKey,\n          execSql: input.runtime.infra.execSql,\n          expectedGroupName: input.expectedGroupName,\n          readEncryptedName: createRuntimeGroupMetadataAccess(\n            input.runtime,\n            signingContext.organizationId,\n            input.stillCurrent,\n          ).readName,\n          groupId: input.groupId,\n          prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n            preparePrincipalContainerMutations({\n              currentPolicy,\n              groupId: input.groupId,\n              nextPolicy,\n              organizationId: signingContext.organizationId,\n              runtime: input.runtime,\n              stillCurrent: input.stillCurrent,\n            }),\n          reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n          targetUserId: input.targetUserId,\n          ...signingContext,\n        }));\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport function createGroupForOrganization(input: {\n  readonly name: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: signingContext.organizationId,\n      objectKind: \"principal\",\n      operation: \"group.create\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n        input.runtime,\n      );\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (mutate)\n        return mutate(\n          { ...signingContext, stillCurrent: input.stillCurrent },\n          (context) =>\n            createCurrentOrganizationGroup({\n              ...signingContext,\n              context,\n              apiClient: input.runtime.apiClient,\n              creatorEncapsulationKeyPair,\n              execSql: input.runtime.infra.execSql,\n              name: input.name,\n              metadataAccess: createRuntimeGroupMetadataAccess(\n                input.runtime,\n                signingContext.organizationId,\n                context.stillCurrent,\n                createSelectedCurrentGroupMetadataContainerVerifier({\n                  authority: context,\n                  organizationId: signingContext.organizationId,\n                  stillCurrent: context.stillCurrent,\n                }),\n              ),\n              reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n            }),\n        );\n      return createOrganizationGroup({\n        stillCurrent: input.stillCurrent,\n        apiClient: input.runtime.apiClient,\n        creatorEncapsulationKeyPair,\n        execSql: input.runtime.infra.execSql,\n        name: input.name,\n        metadataAccess: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      });\n    },\n  );\n}\n\nexport function deleteGroupForOrganization(input: {\n  readonly groupId: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.delete\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (mutate)\n        return mutate(\n          { ...signingContext, stillCurrent: input.stillCurrent },\n          (context) =>\n            deleteCurrentOrganizationGroup({\n              ...signingContext,\n              context,\n              groupId: input.groupId,\n              apiClient: input.runtime.apiClient,\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n            }),\n        );\n      return deleteOrganizationGroup({\n        stillCurrent: input.stillCurrent,\n        apiClient: input.runtime.apiClient,\n        execSql: input.runtime.infra.execSql,\n        groupId: input.groupId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      });\n    },\n  );\n}\n\nexport async function removeUserFromOrganizationGroup(\n  input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.remove\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      const current = mutateCurrent\n        ? await mutateCurrent(input.groupId, {\n            kind: \"remove\",\n            expectedGroupName: input.expectedGroupName,\n            removedUserId: input.removedUserId,\n          })\n        : undefined;\n      memberGroupId = current?.memberGroupId ?? null;\n      const bundle =\n        current?.response ??\n        (await removeOrganizationGroupUser({\n          apiClient: input.runtime.apiClient,\n          beforePolicyCommit: (_head, authority) => {\n            memberGroupId = authority.memberGroupId;\n          },\n          execSql: input.runtime.infra.execSql,\n          expectedGroupName: input.expectedGroupName,\n          readEncryptedName: createRuntimeGroupMetadataAccess(\n            input.runtime,\n            signingContext.organizationId,\n            input.stillCurrent,\n          ).readName,\n          groupId: input.groupId,\n          prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n            preparePrincipalContainerMutations({\n              currentPolicy,\n              groupId: input.groupId,\n              nextPolicy,\n              organizationId: signingContext.organizationId,\n              runtime: input.runtime,\n              stillCurrent: input.stillCurrent,\n            }),\n          removedUserId: input.removedUserId,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n          ...signingContext,\n        }));\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport async function revokeOrganizationGrant(\n  input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n  if (input.runtime.infra.dbStatus !== \"ready\") {\n    throw new Error(\"Organization local database is unavailable\");\n  }\n\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.subjectId,\n      objectKind: \"principal\",\n      operation: \"principal.grant.revoke\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      const current =\n        input.subjectType === \"group\" && mutateCurrent\n          ? await mutateCurrent(input.subjectId, {\n              kind: \"revoke\",\n              revokedContainerId: input.containerId,\n            })\n          : undefined;\n      const response =\n        current?.response ??\n        (input.subjectType === \"group\"\n          ? await rotateOrganizationGroupForAccessSetShrink({\n              apiClient: input.runtime.apiClient,\n              execSql: input.runtime.infra.execSql,\n              groupId: input.subjectId,\n              revokedContainerId: input.containerId,\n              prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n                preparePrincipalContainerMutations({\n                  currentPolicy,\n                  groupId: input.subjectId,\n                  nextPolicy,\n                  organizationId: signingContext.organizationId,\n                  revokedContainerId: input.containerId,\n                  runtime: input.runtime,\n                  stillCurrent: input.stillCurrent,\n                }),\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              ...signingContext,\n            })\n          : await revokeOrganizationContainerGrant({\n              stillCurrent: input.stillCurrent,\n              reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n              apiClient: input.runtime.apiClient,\n              containerId: input.containerId,\n              encapsulationKeyPair,\n              execSql: input.runtime.infra.execSql,\n              revokedSubject: {\n                subjectId: input.subjectId,\n                subjectType: input.subjectType,\n              },\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              warmReferencedPrincipalPolicies:\n                createRuntimePrincipalPolicyWarmer(input.runtime),\n              ...signingContext,\n            }));\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return response;\n    },\n  );\n}\n"]}

package/data/persistence/principalCurrentAcknowledgementPersistence.d.ts

@@ -7,9 +7,9 @@ import type { PrincipalHistoryStage } from "./principalHistoryStagePersistence.j
 export interface AcknowledgedPrincipalCurrentPublication {
     readonly policy: VerifiedPrincipalPolicyCurrent;
     readonly prefix: PrincipalHistoryPrefix;
-    readonly previousPrefixProgress: string;
+    readonly previousPrefixProgress: string | null;
     readonly stage: PrincipalHistoryStage;
-    readonly predecessorStage: PrincipalHistoryStage;
+    readonly predecessorStage: PrincipalHistoryStage | null;
     readonly evidence: PrincipalHistoryEvidencePage;
 }
 export interface AcknowledgedPrincipalCurrentRetirement {

package/data/persistence/principalCurrentAcknowledgementPersistence.js

@@ -18,9 +18,14 @@ function assertPublicationScope(entries, organizationId) {
         seen.add(key);
         if (entry.prefix.organizationId !== organizationId ||
             entry.stage.organizationId !== organizationId ||
-            entry.predecessorStage.organizationId !== organizationId ||
-            !entry.predecessorStage.complete ||
-            entry.predecessorStage.afterVersion !== entry.policy.version - 2 ||
+            (entry.predecessorStage
+                ? entry.predecessorStage.organizationId !== organizationId ||
+                    !entry.predecessorStage.complete ||
+                    entry.predecessorStage.afterVersion !== entry.policy.version - 2
+                : entry.policy.principalType !== "group" ||
+                    entry.policy.version !== 1 ||
+                    entry.policy.state.prevStateHash !== null ||
+                    entry.previousPrefixProgress !== null) ||
             entry.evidence.organizationId !== organizationId ||
             entry.prefix.scopeId !== entry.evidence.scopeId ||
             entry.prefix.version !== entry.policy.version ||
@@ -37,14 +42,15 @@ async function validatePublication(tx, entry) {
         currentState: entry.policy.state,
         localCheckpoint: checkpoint,
     });
-    if (!checkpoint || entry.policy.version > checkpoint.version + 1)
+    if ((!checkpoint && entry.policy.version !== 1) ||
+        (checkpoint && entry.policy.version > checkpoint.version + 1))
         throw new KeyingVerificationError("stale_predecessor", "Acknowledged current policy must directly extend its durable checkpoint");
     const [prefix] = await tx
         .select()
         .from(principalHistoryPrefixes)
         .where(eq(principalHistoryPrefixes.scopeId, entry.prefix.scopeId))
         .limit(1);
-    if (prefix?.progress !== entry.previousPrefixProgress)
+    if ((prefix?.progress ?? null) !== entry.previousPrefixProgress)
         throw new KeyingVerificationError("stale_predecessor", "Authenticated principal prefix changed before acknowledgement");
 }
 /** Store current artifacts and resumable progress in the same transaction as their pins. */
@@ -74,15 +80,16 @@ export async function persistAcknowledgedPrincipalCurrents(input) {
             await writePrincipalHistoryEvidencePage(tx, entry.evidence);
             // A prefix-only predecessor must keep its encrypted key envelopes
             // before its reusable slot is replaced by the acknowledged successor.
-            await tx
-                .insert(principalHistoryStages)
-                .values(entry.predecessorStage)
-                .onConflictDoUpdate({
-                target: principalHistoryStages.id,
-                set: entry.predecessorStage,
-                setWhere: eq(principalHistoryStages.complete, false),
-            })
-                .run();
+            if (entry.predecessorStage)
+                await tx
+                    .insert(principalHistoryStages)
+                    .values(entry.predecessorStage)
+                    .onConflictDoUpdate({
+                    target: principalHistoryStages.id,
+                    set: entry.predecessorStage,
+                    setWhere: eq(principalHistoryStages.complete, false),
+                })
+                    .run();
             // A fully authenticated publication supersedes an in-flight stage for
             // this exact head. Its other writer fails its progress CAS and resumes.
             await tx

package/data/persistence/principalCurrentAcknowledgementPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalCurrentAcknowledgementPersistence.js","sourceRoot":"","sources":["principalCurrentAcknowledgementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,mCAAmC,EACnC,kBAAkB,EAClB,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAoB/C,SAAS,sBAAsB,CAC7B,OAA2D,EAC3D,cAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IACE,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc;YAC9C,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;YAC7C,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,cAAc;YACxD,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ;YAChC,KAAK,CAAC,gBAAgB,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;YAChE,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,cAAc;YAChD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/C,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7C,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;YACrD,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;YACrB,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;YAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,KAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,EAAE,EACF,KAAK,CAAC,MAAM,CACb,CAAC;IACF,+BAA+B,CAAC;QAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QACnC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAChC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;QAC9D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,yEAAyE,CAC1E,CAAC;IACJ,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACjE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,MAAM,EAAE,QAAQ,KAAK,KAAK,CAAC,sBAAsB;QACnD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,+DAA+D,CAChE,CAAC;AACN,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,sBAAsB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW;gBACnD,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,CAC1D,EAAE,MAAM,CAAC;YACV,IAAI,CAAC,MAAM;gBACT,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;YACJ,MAAM,8BAA8B,CAClC,EAAE,EACF,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,EACzC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EACpC,cAAc,CACf,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,iCAAiC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5D,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,EAAE;iBACL,MAAM,CAAC,sBAAsB,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;iBAC9B,kBAAkB,CAAC;gBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;gBACjC,GAAG,EAAE,KAAK,CAAC,gBAAgB;gBAC3B,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC;aACrD,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,EAAE;iBACL,MAAM,CAAC,sBAAsB,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;iBACnB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;gBACjC,GAAG,EAAE,KAAK,CAAC,KAAK;aACjB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,EAAE;iBACL,MAAM,CAAC,wBAAwB,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBACpB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;gBACxC,GAAG,EAAE,KAAK,CAAC,MAAM;aAClB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,4CAA4C,CAChD,EAAE,EACF,KAAK,CAAC,MAAM,CAAC,UAAU,EACvB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport { principalHistoryPrefixes } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { storePrincipalGrantRetirements } from \"./principalGrantRetirementPersistence\";\nimport {\n  type PrincipalHistoryEvidencePage,\n  writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\nimport type { PrincipalHistoryPrefix } from \"./principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"./principalHistoryStagePersistence\";\n\n/** Owned output of authenticated prefix extension and exact receipt verification. */\nexport interface AcknowledgedPrincipalCurrentPublication {\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly previousPrefixProgress: string;\n  readonly stage: PrincipalHistoryStage;\n  readonly predecessorStage: PrincipalHistoryStage;\n  readonly evidence: PrincipalHistoryEvidencePage;\n}\n\nexport interface AcknowledgedPrincipalCurrentRetirement {\n  readonly principalId: string;\n  readonly principalType: VerifiedPrincipalPolicyCurrent[\"principalType\"];\n  readonly containerIds: readonly string[];\n}\n\nfunction assertPublicationScope(\n  entries: readonly AcknowledgedPrincipalCurrentPublication[],\n  organizationId: string,\n) {\n  const seen = new Set<string>();\n  for (const entry of entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key))\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        \"Acknowledged current batch repeats a principal\",\n      );\n    seen.add(key);\n    if (\n      entry.prefix.organizationId !== organizationId ||\n      entry.stage.organizationId !== organizationId ||\n      entry.predecessorStage.organizationId !== organizationId ||\n      !entry.predecessorStage.complete ||\n      entry.predecessorStage.afterVersion !== entry.policy.version - 2 ||\n      entry.evidence.organizationId !== organizationId ||\n      entry.prefix.scopeId !== entry.evidence.scopeId ||\n      entry.prefix.version !== entry.policy.version ||\n      entry.stage.afterVersion !== entry.policy.version - 1 ||\n      !entry.stage.complete ||\n      entry.stage.currentJson !== entry.prefix.currentJson\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Acknowledged current publication is outside its scope\",\n      );\n  }\n}\n\nasync function validatePublication(\n  tx: ClientSQLiteTransactionScope,\n  entry: AcknowledgedPrincipalCurrentPublication,\n) {\n  const checkpoint = await loadStoredPrincipalPolicyCheckpoint(\n    tx,\n    entry.policy,\n  );\n  verifyPrincipalPolicyCheckpoint({\n    chain: entry.policy.retainedHistory,\n    currentState: entry.policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (!checkpoint || entry.policy.version > checkpoint.version + 1)\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Acknowledged current policy must directly extend its durable checkpoint\",\n    );\n  const [prefix] = await tx\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, entry.prefix.scopeId))\n    .limit(1);\n  if (prefix?.progress !== entry.previousPrefixProgress)\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Authenticated principal prefix changed before acknowledgement\",\n    );\n}\n\n/** Store current artifacts and resumable progress in the same transaction as their pins. */\nexport async function persistAcknowledgedPrincipalCurrents(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly entries: readonly AcknowledgedPrincipalCurrentPublication[];\n  readonly retirements?:\n    | readonly AcknowledgedPrincipalCurrentRetirement[]\n    | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const entries = structuredClone(input.entries);\n  const retirements = structuredClone(input.retirements ?? []);\n  const organizationId = input.organizationId;\n  const stillCurrent = input.stillCurrent;\n  assertPublicationScope(entries, organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const stored = await runtime.guardedTransaction(\n    async (tx) => {\n      for (const entry of entries) await validatePublication(tx, entry);\n      for (const retirement of retirements) {\n        const policy = entries.find(\n          (entry) =>\n            entry.policy.principalId === retirement.principalId &&\n            entry.policy.principalType === retirement.principalType,\n        )?.policy;\n        if (!policy)\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Retirement must accompany its acknowledged principal\",\n          );\n        await storePrincipalGrantRetirements(\n          tx,\n          { ...retirement, policy, organizationId },\n          entries.map((entry) => entry.policy),\n          organizationId,\n        );\n      }\n      for (const entry of entries) {\n        await writePrincipalHistoryEvidencePage(tx, entry.evidence);\n        // A prefix-only predecessor must keep its encrypted key envelopes\n        // before its reusable slot is replaced by the acknowledged successor.\n        await tx\n          .insert(principalHistoryStages)\n          .values(entry.predecessorStage)\n          .onConflictDoUpdate({\n            target: principalHistoryStages.id,\n            set: entry.predecessorStage,\n            setWhere: eq(principalHistoryStages.complete, false),\n          })\n          .run();\n        // A fully authenticated publication supersedes an in-flight stage for\n        // this exact head. Its other writer fails its progress CAS and resumes.\n        await tx\n          .insert(principalHistoryStages)\n          .values(entry.stage)\n          .onConflictDoUpdate({\n            target: principalHistoryStages.id,\n            set: entry.stage,\n          })\n          .run();\n        await tx\n          .insert(principalHistoryPrefixes)\n          .values(entry.prefix)\n          .onConflictDoUpdate({\n            target: principalHistoryPrefixes.scopeId,\n            set: entry.prefix,\n          })\n          .run();\n        await upsertPrincipalPolicyCheckpointInTransaction(\n          tx,\n          entry.policy.checkpoint,\n          new Date().toISOString(),\n          organizationId,\n        );\n      }\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => stored.committed);\n}\n"]}
+{"version":3,"file":"principalCurrentAcknowledgementPersistence.js","sourceRoot":"","sources":["principalCurrentAcknowledgementPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,mCAAmC,EACnC,kBAAkB,EAClB,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAoB/C,SAAS,sBAAsB,CAC7B,OAA2D,EAC3D,cAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IACE,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc;YAC9C,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;YAC7C,CAAC,KAAK,CAAC,gBAAgB;gBACrB,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,cAAc;oBACxD,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ;oBAChC,KAAK,CAAC,gBAAgB,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;gBAClE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO;oBACtC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC;oBAC1B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI;oBACzC,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC;YAC1C,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,cAAc;YAChD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/C,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7C,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;YACrD,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;YACrB,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;YAEpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,KAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,EAAE,EACF,KAAK,CAAC,MAAM,CACb,CAAC;IACF,+BAA+B,CAAC;QAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QACnC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAChC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IACE,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC;QAC3C,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QAE7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,yEAAyE,CAC1E,CAAC;IACJ,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACjE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,sBAAsB;QAC7D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,+DAA+D,CAChE,CAAC;AACN,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAQ1D;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,sBAAsB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW;gBACnD,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,CAC1D,EAAE,MAAM,CAAC;YACV,IAAI,CAAC,MAAM;gBACT,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;YACJ,MAAM,8BAA8B,CAClC,EAAE,EACF,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,EACzC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EACpC,cAAc,CACf,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,iCAAiC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5D,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,KAAK,CAAC,gBAAgB;gBACxB,MAAM,EAAE;qBACL,MAAM,CAAC,sBAAsB,CAAC;qBAC9B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;qBAC9B,kBAAkB,CAAC;oBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;oBACjC,GAAG,EAAE,KAAK,CAAC,gBAAgB;oBAC3B,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC;iBACrD,CAAC;qBACD,GAAG,EAAE,CAAC;YACX,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,EAAE;iBACL,MAAM,CAAC,sBAAsB,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;iBACnB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,sBAAsB,CAAC,EAAE;gBACjC,GAAG,EAAE,KAAK,CAAC,KAAK;aACjB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,EAAE;iBACL,MAAM,CAAC,wBAAwB,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBACpB,kBAAkB,CAAC;gBAClB,MAAM,EAAE,wBAAwB,CAAC,OAAO;gBACxC,GAAG,EAAE,KAAK,CAAC,MAAM;aAClB,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,MAAM,4CAA4C,CAChD,EAAE,EACF,KAAK,CAAC,MAAM,CAAC,UAAU,EACvB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC,EACD,YAAY,EACZ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,mCAAmC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { assertProjectionVerificationCurrent } from \"../keyingProjectionVerification/types\";\nimport { principalHistoryPrefixes } from \"../sqlite/principalHistoryEvidenceSchema\";\nimport { principalHistoryStages } from \"../sqlite/principalHistoryStageSchema\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { storePrincipalGrantRetirements } from \"./principalGrantRetirementPersistence\";\nimport {\n  type PrincipalHistoryEvidencePage,\n  writePrincipalHistoryEvidencePage,\n} from \"./principalHistoryEvidencePersistence\";\nimport type { PrincipalHistoryPrefix } from \"./principalHistoryPrefixPersistence\";\nimport type { PrincipalHistoryStage } from \"./principalHistoryStagePersistence\";\n\n/** Owned output of authenticated prefix extension and exact receipt verification. */\nexport interface AcknowledgedPrincipalCurrentPublication {\n  readonly policy: VerifiedPrincipalPolicyCurrent;\n  readonly prefix: PrincipalHistoryPrefix;\n  readonly previousPrefixProgress: string | null;\n  readonly stage: PrincipalHistoryStage;\n  readonly predecessorStage: PrincipalHistoryStage | null;\n  readonly evidence: PrincipalHistoryEvidencePage;\n}\n\nexport interface AcknowledgedPrincipalCurrentRetirement {\n  readonly principalId: string;\n  readonly principalType: VerifiedPrincipalPolicyCurrent[\"principalType\"];\n  readonly containerIds: readonly string[];\n}\n\nfunction assertPublicationScope(\n  entries: readonly AcknowledgedPrincipalCurrentPublication[],\n  organizationId: string,\n) {\n  const seen = new Set<string>();\n  for (const entry of entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key))\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        \"Acknowledged current batch repeats a principal\",\n      );\n    seen.add(key);\n    if (\n      entry.prefix.organizationId !== organizationId ||\n      entry.stage.organizationId !== organizationId ||\n      (entry.predecessorStage\n        ? entry.predecessorStage.organizationId !== organizationId ||\n          !entry.predecessorStage.complete ||\n          entry.predecessorStage.afterVersion !== entry.policy.version - 2\n        : entry.policy.principalType !== \"group\" ||\n          entry.policy.version !== 1 ||\n          entry.policy.state.prevStateHash !== null ||\n          entry.previousPrefixProgress !== null) ||\n      entry.evidence.organizationId !== organizationId ||\n      entry.prefix.scopeId !== entry.evidence.scopeId ||\n      entry.prefix.version !== entry.policy.version ||\n      entry.stage.afterVersion !== entry.policy.version - 1 ||\n      !entry.stage.complete ||\n      entry.stage.currentJson !== entry.prefix.currentJson\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Acknowledged current publication is outside its scope\",\n      );\n  }\n}\n\nasync function validatePublication(\n  tx: ClientSQLiteTransactionScope,\n  entry: AcknowledgedPrincipalCurrentPublication,\n) {\n  const checkpoint = await loadStoredPrincipalPolicyCheckpoint(\n    tx,\n    entry.policy,\n  );\n  verifyPrincipalPolicyCheckpoint({\n    chain: entry.policy.retainedHistory,\n    currentState: entry.policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (\n    (!checkpoint && entry.policy.version !== 1) ||\n    (checkpoint && entry.policy.version > checkpoint.version + 1)\n  )\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Acknowledged current policy must directly extend its durable checkpoint\",\n    );\n  const [prefix] = await tx\n    .select()\n    .from(principalHistoryPrefixes)\n    .where(eq(principalHistoryPrefixes.scopeId, entry.prefix.scopeId))\n    .limit(1);\n  if ((prefix?.progress ?? null) !== entry.previousPrefixProgress)\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"Authenticated principal prefix changed before acknowledgement\",\n    );\n}\n\n/** Store current artifacts and resumable progress in the same transaction as their pins. */\nexport async function persistAcknowledgedPrincipalCurrents(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly entries: readonly AcknowledgedPrincipalCurrentPublication[];\n  readonly retirements?:\n    | readonly AcknowledgedPrincipalCurrentRetirement[]\n    | undefined;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const entries = structuredClone(input.entries);\n  const retirements = structuredClone(input.retirements ?? []);\n  const organizationId = input.organizationId;\n  const stillCurrent = input.stillCurrent;\n  assertPublicationScope(entries, organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const stored = await runtime.guardedTransaction(\n    async (tx) => {\n      for (const entry of entries) await validatePublication(tx, entry);\n      for (const retirement of retirements) {\n        const policy = entries.find(\n          (entry) =>\n            entry.policy.principalId === retirement.principalId &&\n            entry.policy.principalType === retirement.principalType,\n        )?.policy;\n        if (!policy)\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Retirement must accompany its acknowledged principal\",\n          );\n        await storePrincipalGrantRetirements(\n          tx,\n          { ...retirement, policy, organizationId },\n          entries.map((entry) => entry.policy),\n          organizationId,\n        );\n      }\n      for (const entry of entries) {\n        await writePrincipalHistoryEvidencePage(tx, entry.evidence);\n        // A prefix-only predecessor must keep its encrypted key envelopes\n        // before its reusable slot is replaced by the acknowledged successor.\n        if (entry.predecessorStage)\n          await tx\n            .insert(principalHistoryStages)\n            .values(entry.predecessorStage)\n            .onConflictDoUpdate({\n              target: principalHistoryStages.id,\n              set: entry.predecessorStage,\n              setWhere: eq(principalHistoryStages.complete, false),\n            })\n            .run();\n        // A fully authenticated publication supersedes an in-flight stage for\n        // this exact head. Its other writer fails its progress CAS and resumes.\n        await tx\n          .insert(principalHistoryStages)\n          .values(entry.stage)\n          .onConflictDoUpdate({\n            target: principalHistoryStages.id,\n            set: entry.stage,\n          })\n          .run();\n        await tx\n          .insert(principalHistoryPrefixes)\n          .values(entry.prefix)\n          .onConflictDoUpdate({\n            target: principalHistoryPrefixes.scopeId,\n            set: entry.prefix,\n          })\n          .run();\n        await upsertPrincipalPolicyCheckpointInTransaction(\n          tx,\n          entry.policy.checkpoint,\n          new Date().toISOString(),\n          organizationId,\n        );\n      }\n    },\n    stillCurrent,\n    { behavior: \"immediate\" },\n  );\n  assertProjectionVerificationCurrent(() => stored.committed);\n}\n"]}

package/data/principals/currentPolicyReferenceResolver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=currentPolicyReferenceResolver.js.map

package/data/principals/currentPolicyReferenceResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentPolicyReferenceResolver.js","sourceRoot":"","sources":["currentPolicyReferenceResolver.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\n\n/** Privately authenticated historical citations selected for one authored head. */\nexport type CurrentPolicyReferenceResolver = (\n  current: VerifiedPrincipalPolicyCurrent,\n  references: readonly ReferencedPrincipalHead[],\n) => Promise<VerifiedPrincipalPolicyCurrent>;\n"]}

package/data/principals/principalHistoryScopeProtection.js

@@ -0,0 +1,23 @@
+import { serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+/** Stable authenticated scopes shared by paged recovery and acknowledged extension. */
+export function directoryHistoryProtection(protection) {
+    return {
+        localKey: protection.localKey,
+        context: serializeKeyingCanonicalJson([
+            "tearleads.sdk.principal-history.directory.v1",
+            protection.context,
+        ]),
+    };
+}
+export function scopedGroupHistoryProtection(protection, organizationId, adminGroupId) {
+    return {
+        localKey: protection.localKey,
+        context: serializeKeyingCanonicalJson([
+            "tearleads.sdk.principal-history.scoped-group.v1",
+            protection.context,
+            organizationId,
+            adminGroupId,
+        ]),
+    };
+}
+//# sourceMappingURL=principalHistoryScopeProtection.js.map

package/data/principals/principalHistoryScopeProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryScopeProtection.js","sourceRoot":"","sources":["principalHistoryScopeProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,uFAAuF;AACvF,MAAM,UAAU,0BAA0B,CACxC,UAAiD;IAEjD,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,8CAA8C;YAC9C,UAAU,CAAC,OAAO;SACnB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,UAAiD,EACjD,cAAsB,EACtB,YAAoB;IAEpB,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,4BAA4B,CAAC;YACpC,iDAAiD;YACjD,UAAU,CAAC,OAAO;YAClB,cAAc;YACd,YAAY;SACb,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyHistoryProgressOptions,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\n\n/** Stable authenticated scopes shared by paged recovery and acknowledged extension. */\nexport function directoryHistoryProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n) {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson([\n      \"tearleads.sdk.principal-history.directory.v1\",\n      protection.context,\n    ]),\n  };\n}\n\nexport function scopedGroupHistoryProtection(\n  protection: PrincipalPolicyHistoryProgressOptions,\n  organizationId: string,\n  adminGroupId: string,\n) {\n  return {\n    localKey: protection.localKey,\n    context: serializeKeyingCanonicalJson([\n      \"tearleads.sdk.principal-history.scoped-group.v1\",\n      protection.context,\n      organizationId,\n      adminGroupId,\n    ]),\n  };\n}\n"]}

package/data/principals/principalPolicyAdminSigners.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyAdminSigners.js","sourceRoot":"","sources":["principalPolicyAdminSigners.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAOvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,kCAAkC,CAChD,MAAqC;IAErC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAA+B;IAE/B,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,UAAU;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;aAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAClC;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI;QAChC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE,CAAC,CAAC;QAC5D,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IACE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,8DAA8D,CAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,2BAA2B,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yDAAyD,CAAC,KAM/E;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function principalPolicyReferenceFromBundle(\n  bundle: PrincipalPolicyBundleResponse,\n): ReferencedPrincipalHead {\n  return {\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    keyFingerprint: bundle.currentState.keyFingerprint,\n  };\n}\n\nexport function organizationAdminSignerUserIds(\n  policy: VerifiedPrincipalPolicy,\n): string[] {\n  return [\n    ...new Set(\n      policy.projection\n        .filter((member) => member.role === \"admin\")\n        .map((member) => member.userId),\n    ),\n  ].sort();\n}\n\nexport function organizationAdminExternalAuthority(\n  policy: VerifiedPrincipalPolicy,\n): PrincipalPolicyExternalAuthority {\n  const history = policy.history ?? [\n    {\n      state: policy.state,\n      projection: policy.projection,\n      grants: policy.grants,\n    },\n  ];\n  const toHead = (state: (typeof history)[number][\"state\"]) => ({\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  });\n  return {\n    currentHead: toHead(policy.state),\n    states: history.map((entry) => ({\n      head: toHead(entry.state),\n      projection: entry.projection,\n    })),\n  };\n}\n\nexport async function verifyOrganizationAdminPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly organizationId: string;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  if (\n    input.bundle.currentState.principalType !== \"organization\" ||\n    input.bundle.currentState.principalId !== input.organizationId\n  ) {\n    return {\n      ok: false,\n      error: new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization policy does not match the expected organization\",\n      ),\n    };\n  }\n\n  return verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: principalPolicyReferenceFromBundle(input.bundle),\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n}\n\nexport async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly expectedReference: ReferencedPrincipalHead;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n  if (verified.ok || verified.error.code !== \"unauthorized\") {\n    return verified;\n  }\n\n  const externalAuthority = await input.loadExternalAuthority();\n  if (!externalAuthority) {\n    return verified;\n  }\n\n  const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    externalAuthority,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  return verifiedWithExternalAdmins;\n}\n"]}
+{"version":3,"file":"principalPolicyAdminSigners.js","sourceRoot":"","sources":["principalPolicyAdminSigners.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAOvB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,UAAU,kCAAkC,CAChD,MAA2D;IAE3D,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;QAC5C,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;QACxC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAmD;IAEnD,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,UAAU;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;aAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAClC;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI;QAChC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE,CAAC,CAAC;QAC5D,aAAa,EAAE,OAAgB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,IACE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,cAAc;QAC1D,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,8DAA8D,CAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,2BAA2B,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yDAAyD,CAAC,KAM/E;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type KeyingVerificationResult,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\nexport function principalPolicyReferenceFromBundle(\n  bundle: Pick<PrincipalPolicyBundleResponse, \"currentState\">,\n): ReferencedPrincipalHead {\n  return {\n    principalType: bundle.currentState.principalType,\n    principalId: bundle.currentState.principalId,\n    version: bundle.currentState.version,\n    keyEpoch: bundle.currentState.keyEpoch,\n    stateHash: bundle.currentState.stateHash,\n    keyFingerprint: bundle.currentState.keyFingerprint,\n  };\n}\n\nexport function organizationAdminSignerUserIds(\n  policy: Pick<VerifiedPrincipalPolicy, \"projection\">,\n): string[] {\n  return [\n    ...new Set(\n      policy.projection\n        .filter((member) => member.role === \"admin\")\n        .map((member) => member.userId),\n    ),\n  ].sort();\n}\n\nexport function organizationAdminExternalAuthority(\n  policy: VerifiedPrincipalPolicy,\n): PrincipalPolicyExternalAuthority {\n  const history = policy.history ?? [\n    {\n      state: policy.state,\n      projection: policy.projection,\n      grants: policy.grants,\n    },\n  ];\n  const toHead = (state: (typeof history)[number][\"state\"]) => ({\n    principalType: \"group\" as const,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  });\n  return {\n    currentHead: toHead(policy.state),\n    states: history.map((entry) => ({\n      head: toHead(entry.state),\n      projection: entry.projection,\n    })),\n  };\n}\n\nexport async function verifyOrganizationAdminPolicy(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly organizationId: string;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  if (\n    input.bundle.currentState.principalType !== \"organization\" ||\n    input.bundle.currentState.principalId !== input.organizationId\n  ) {\n    return {\n      ok: false,\n      error: new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization policy does not match the expected organization\",\n      ),\n    };\n  }\n\n  return verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: principalPolicyReferenceFromBundle(input.bundle),\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n}\n\nexport async function verifyPrincipalPolicyBundleWithExternalOrganizationAdmins(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly expectedReference: ReferencedPrincipalHead;\n  readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n  readonly localCheckpoint?: PrincipalPolicyCheckpoint | null | undefined;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicy>> {\n  const verified = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n  if (verified.ok || verified.error.code !== \"unauthorized\") {\n    return verified;\n  }\n\n  const externalAuthority = await input.loadExternalAuthority();\n  if (!externalAuthority) {\n    return verified;\n  }\n\n  const verifiedWithExternalAdmins = await verifyPrincipalPolicyBundle({\n    bundle: input.bundle,\n    externalAuthority,\n    expectedReference: input.expectedReference,\n    localCheckpoint: input.localCheckpoint ?? null,\n    signerPublicKeys: input.signerPublicKeys,\n  });\n\n  return verifiedWithExternalAdmins;\n}\n"]}