@tearleads/client-sdk 0.1.16 → 0.1.18

package/client/organizations/principalMutations.js

@@ -1,7 +1,12 @@
 import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
 import { addOrganizationGroupUser, createOrganizationGroup, deleteOrganizationGroup, removeOrganizationGroupUser, revokeOrganizationContainerGrant, rotateOrganizationGroupForAccessSetShrink, } from "../../workflows/organizations/index.js";
+import { createCurrentOrganizationGroup } from "../../workflows/organizations/createCurrentOrganizationGroup.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/currentGroupMetadataAuthority.js";
+import { deleteCurrentOrganizationGroup } from "../../workflows/organizations/deleteCurrentOrganizationGroup.js";
 import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
+import { createRuntimeCurrentOrganizationMutation } from "../../workflows/organizations/runtimeCurrentOrganizationMutation.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
+import { createCurrentPrincipalMutation } from "./currentPrincipalMutations.js";
 import { syncOrganizationMetadataProfile } from "./organizationMetadataProfileSync.js";
 import { preparePrincipalContainerMutations } from "./principalContainerMutations.js";
 function requireSigningContext(runtime) {
@@ -33,30 +38,44 @@ export async function addUserToOrganizationGroup(input) {
         organizationId: signingContext.organizationId,
     }, async () => {
         let memberGroupId = null;
-        const bundle = await addOrganizationGroupUser({
-            apiClient: input.runtime.apiClient,
-            beforePolicyCommit: (_head, authority) => {
-                memberGroupId = authority.memberGroupId;
-            },
-            currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)
-                .secretKey,
-            execSql: input.runtime.infra.execSql,
-            expectedGroupName: input.expectedGroupName,
-            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
-            groupId: input.groupId,
-            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                currentPolicy,
-                groupId: input.groupId,
-                nextPolicy,
-                organizationId: signingContext.organizationId,
-                runtime: input.runtime,
-                stillCurrent: input.stillCurrent,
-            }),
-            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-            targetUserId: input.targetUserId,
+        const mutateCurrent = createCurrentPrincipalMutation({
             ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
         });
+        const current = mutateCurrent
+            ? await mutateCurrent(input.groupId, {
+                kind: "add",
+                expectedGroupName: input.expectedGroupName,
+                targetUserId: input.targetUserId,
+            })
+            : undefined;
+        memberGroupId = current?.memberGroupId ?? null;
+        const bundle = current?.response ??
+            (await addOrganizationGroupUser({
+                apiClient: input.runtime.apiClient,
+                beforePolicyCommit: (_head, authority) => {
+                    memberGroupId = authority.memberGroupId;
+                },
+                currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)
+                    .secretKey,
+                execSql: input.runtime.infra.execSql,
+                expectedGroupName: input.expectedGroupName,
+                readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+                groupId: input.groupId,
+                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                    currentPolicy,
+                    groupId: input.groupId,
+                    nextPolicy,
+                    organizationId: signingContext.organizationId,
+                    runtime: input.runtime,
+                    stillCurrent: input.stillCurrent,
+                }),
+                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                targetUserId: input.targetUserId,
+                ...signingContext,
+            }));
         if (input.groupId === memberGroupId) {
             await syncOrganizationMetadataProfile({
                 containerContents: input.containerContents,
@@ -75,16 +94,37 @@ export function createGroupForOrganization(input) {
         objectKind: "principal",
         operation: "group.create",
         organizationId: signingContext.organizationId,
-    }, () => createOrganizationGroup({
-        apiClient: input.runtime.apiClient,
-        creatorEncapsulationKeyPair: requireEncapsulationKeyPair(input.runtime),
-        execSql: input.runtime.infra.execSql,
-        name: input.name,
-        metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId),
-        reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-        ...signingContext,
-    }));
+    }, () => {
+        const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);
+        const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);
+        if (mutate)
+            return mutate({ ...signingContext, stillCurrent: input.stillCurrent }, (context) => createCurrentOrganizationGroup({
+                ...signingContext,
+                context,
+                apiClient: input.runtime.apiClient,
+                creatorEncapsulationKeyPair,
+                execSql: input.runtime.infra.execSql,
+                name: input.name,
+                metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, context.stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
+                    authority: context,
+                    organizationId: signingContext.organizationId,
+                    stillCurrent: context.stillCurrent,
+                })),
+                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            }));
+        return createOrganizationGroup({
+            stillCurrent: input.stillCurrent,
+            apiClient: input.runtime.apiClient,
+            creatorEncapsulationKeyPair,
+            execSql: input.runtime.infra.execSql,
+            name: input.name,
+            metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent),
+            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            ...signingContext,
+        });
+    });
 }
 export function deleteGroupForOrganization(input) {
     const signingContext = requireSigningContext(input.runtime);
@@ -93,13 +133,25 @@ export function deleteGroupForOrganization(input) {
         objectKind: "principal",
         operation: "group.delete",
         organizationId: signingContext.organizationId,
-    }, () => deleteOrganizationGroup({
-        apiClient: input.runtime.apiClient,
-        execSql: input.runtime.infra.execSql,
-        groupId: input.groupId,
-        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-        ...signingContext,
-    }));
+    }, () => {
+        const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);
+        if (mutate)
+            return mutate({ ...signingContext, stillCurrent: input.stillCurrent }, (context) => deleteCurrentOrganizationGroup({
+                ...signingContext,
+                context,
+                groupId: input.groupId,
+                apiClient: input.runtime.apiClient,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            }));
+        return deleteOrganizationGroup({
+            stillCurrent: input.stillCurrent,
+            apiClient: input.runtime.apiClient,
+            execSql: input.runtime.infra.execSql,
+            groupId: input.groupId,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            ...signingContext,
+        });
+    });
 }
 export async function removeUserFromOrganizationGroup(input) {
     const signingContext = requireSigningContext(input.runtime);
@@ -110,27 +162,41 @@ export async function removeUserFromOrganizationGroup(input) {
         organizationId: signingContext.organizationId,
     }, async () => {
         let memberGroupId = null;
-        const bundle = await removeOrganizationGroupUser({
-            apiClient: input.runtime.apiClient,
-            beforePolicyCommit: (_head, authority) => {
-                memberGroupId = authority.memberGroupId;
-            },
-            execSql: input.runtime.infra.execSql,
-            expectedGroupName: input.expectedGroupName,
-            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
-            groupId: input.groupId,
-            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                currentPolicy,
-                groupId: input.groupId,
-                nextPolicy,
-                organizationId: signingContext.organizationId,
-                runtime: input.runtime,
-                stillCurrent: input.stillCurrent,
-            }),
-            removedUserId: input.removedUserId,
-            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        const mutateCurrent = createCurrentPrincipalMutation({
             ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
         });
+        const current = mutateCurrent
+            ? await mutateCurrent(input.groupId, {
+                kind: "remove",
+                expectedGroupName: input.expectedGroupName,
+                removedUserId: input.removedUserId,
+            })
+            : undefined;
+        memberGroupId = current?.memberGroupId ?? null;
+        const bundle = current?.response ??
+            (await removeOrganizationGroupUser({
+                apiClient: input.runtime.apiClient,
+                beforePolicyCommit: (_head, authority) => {
+                    memberGroupId = authority.memberGroupId;
+                },
+                execSql: input.runtime.infra.execSql,
+                expectedGroupName: input.expectedGroupName,
+                readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+                groupId: input.groupId,
+                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                    currentPolicy,
+                    groupId: input.groupId,
+                    nextPolicy,
+                    organizationId: signingContext.organizationId,
+                    runtime: input.runtime,
+                    stillCurrent: input.stillCurrent,
+                }),
+                removedUserId: input.removedUserId,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                ...signingContext,
+            }));
         if (input.groupId === memberGroupId) {
             await syncOrganizationMetadataProfile({
                 containerContents: input.containerContents,
@@ -154,39 +220,51 @@ export async function revokeOrganizationGrant(input) {
         operation: "principal.grant.revoke",
         organizationId: signingContext.organizationId,
     }, async () => {
-        const response = input.subjectType === "group"
-            ? await rotateOrganizationGroupForAccessSetShrink({
-                apiClient: input.runtime.apiClient,
-                execSql: input.runtime.infra.execSql,
-                groupId: input.subjectId,
+        const mutateCurrent = createCurrentPrincipalMutation({
+            ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+        });
+        const current = input.subjectType === "group" && mutateCurrent
+            ? await mutateCurrent(input.subjectId, {
+                kind: "revoke",
                 revokedContainerId: input.containerId,
-                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                    currentPolicy,
+            })
+            : undefined;
+        const response = current?.response ??
+            (input.subjectType === "group"
+                ? await rotateOrganizationGroupForAccessSetShrink({
+                    apiClient: input.runtime.apiClient,
+                    execSql: input.runtime.infra.execSql,
                     groupId: input.subjectId,
-                    nextPolicy,
-                    organizationId: signingContext.organizationId,
                     revokedContainerId: input.containerId,
-                    runtime: input.runtime,
+                    prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                        currentPolicy,
+                        groupId: input.subjectId,
+                        nextPolicy,
+                        organizationId: signingContext.organizationId,
+                        revokedContainerId: input.containerId,
+                        runtime: input.runtime,
+                        stillCurrent: input.stillCurrent,
+                    }),
+                    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                    ...signingContext,
+                })
+                : await revokeOrganizationContainerGrant({
                     stillCurrent: input.stillCurrent,
-                }),
-                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-                ...signingContext,
-            })
-            : await revokeOrganizationContainerGrant({
-                stillCurrent: input.stillCurrent,
-                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-                apiClient: input.runtime.apiClient,
-                containerId: input.containerId,
-                encapsulationKeyPair,
-                execSql: input.runtime.infra.execSql,
-                revokedSubject: {
-                    subjectId: input.subjectId,
-                    subjectType: input.subjectType,
-                },
-                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-                warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
-                ...signingContext,
-            });
+                    reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                    apiClient: input.runtime.apiClient,
+                    containerId: input.containerId,
+                    encapsulationKeyPair,
+                    execSql: input.runtime.infra.execSql,
+                    revokedSubject: {
+                        subjectId: input.subjectId,
+                        subjectType: input.subjectType,
+                    },
+                    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+                    ...signingContext,
+                }));
         await input.readModelCoordinator.reconcileAfterMutation(signingContext.organizationId);
         return response;
     });

package/client/organizations/principalMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,gCAAgC,EAChC,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAgCnF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;YAC1C,CAAC;YACD,oBAAoB,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC7D,SAAS;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;gBACjC,aAAa;gBACb,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE,CACH,uBAAuB,CAAC;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,2BAA2B,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,CAC9B;QACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,GAAG,cAAc;KAClB,CAAC,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE,CACH,uBAAuB,CAAC;QACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,GAAG,cAAc;KAClB,CAAC,CACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;YAC/C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;gBACjC,aAAa;gBACb,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GACZ,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,MAAM,yCAAyC,CAAC;gBAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,kBAAkB,EAAE,KAAK,CAAC,WAAW;gBACrC,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,SAAS;oBACxB,UAAU;oBACV,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,kBAAkB,EAAE,KAAK,CAAC,WAAW;oBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;gBACJ,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBAC1C,GAAG,cAAc;aAClB,CAAC;YACJ,CAAC,CAAC,MAAM,gCAAgC,CAAC;gBACrC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,oBAAoB;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,cAAc,EAAE;oBACd,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;gBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBAC1C,+BAA+B,EAC7B,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC;gBACnD,GAAG,cAAc;aAClB,CAAC,CAAC;QACT,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  addOrganizationGroupUser,\n  createOrganizationGroup,\n  deleteOrganizationGroup,\n  removeOrganizationGroupUser,\n  revokeOrganizationContainerGrant,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"../../workflows/organizations\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\nexport interface OrganizationGrantRef {\n  containerId: string;\n  subjectId: string;\n  subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n  groupId: string;\n  expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n  organizationId: string;\n  signerUserId: string;\n  signingFingerprint: string;\n  signingKeyPair: NonNullable<\n    InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n  >;\n}\n\nfunction requireSigningContext(\n  runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.auth.userId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair\n  ) {\n    throw new Error(\"Organization signing context is unavailable\");\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerUserId: runtime.auth.userId,\n    signingFingerprint: runtime.crypto.signingFingerprint,\n    signingKeyPair: runtime.crypto.signingKeyPair,\n  };\n}\n\nfunction requireEncapsulationKeyPair(\n  runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n  if (!runtime.crypto.encapsulationKeyPair) {\n    throw new Error(\"Organization encryption context is unavailable\");\n  }\n\n  return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n  readonly stillCurrent: () => boolean;\n  readonly containerContents: ContainerContents;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n  input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.add\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const bundle = await addOrganizationGroupUser({\n        apiClient: input.runtime.apiClient,\n        beforePolicyCommit: (_head, authority) => {\n          memberGroupId = authority.memberGroupId;\n        },\n        currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)\n          .secretKey,\n        execSql: input.runtime.infra.execSql,\n        expectedGroupName: input.expectedGroupName,\n        readEncryptedName: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ).readName,\n        groupId: input.groupId,\n        prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n          preparePrincipalContainerMutations({\n            currentPolicy,\n            groupId: input.groupId,\n            nextPolicy,\n            organizationId: signingContext.organizationId,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          }),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        targetUserId: input.targetUserId,\n        ...signingContext,\n      });\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport function createGroupForOrganization(input: {\n  readonly name: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: signingContext.organizationId,\n      objectKind: \"principal\",\n      operation: \"group.create\",\n      organizationId: signingContext.organizationId,\n    },\n    () =>\n      createOrganizationGroup({\n        apiClient: input.runtime.apiClient,\n        creatorEncapsulationKeyPair: requireEncapsulationKeyPair(input.runtime),\n        execSql: input.runtime.infra.execSql,\n        name: input.name,\n        metadataAccess: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n        ),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      }),\n  );\n}\n\nexport function deleteGroupForOrganization(input: {\n  readonly groupId: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.delete\",\n      organizationId: signingContext.organizationId,\n    },\n    () =>\n      deleteOrganizationGroup({\n        apiClient: input.runtime.apiClient,\n        execSql: input.runtime.infra.execSql,\n        groupId: input.groupId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      }),\n  );\n}\n\nexport async function removeUserFromOrganizationGroup(\n  input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.remove\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const bundle = await removeOrganizationGroupUser({\n        apiClient: input.runtime.apiClient,\n        beforePolicyCommit: (_head, authority) => {\n          memberGroupId = authority.memberGroupId;\n        },\n        execSql: input.runtime.infra.execSql,\n        expectedGroupName: input.expectedGroupName,\n        readEncryptedName: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ).readName,\n        groupId: input.groupId,\n        prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n          preparePrincipalContainerMutations({\n            currentPolicy,\n            groupId: input.groupId,\n            nextPolicy,\n            organizationId: signingContext.organizationId,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          }),\n        removedUserId: input.removedUserId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      });\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport async function revokeOrganizationGrant(\n  input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n  if (input.runtime.infra.dbStatus !== \"ready\") {\n    throw new Error(\"Organization local database is unavailable\");\n  }\n\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.subjectId,\n      objectKind: \"principal\",\n      operation: \"principal.grant.revoke\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const response =\n        input.subjectType === \"group\"\n          ? await rotateOrganizationGroupForAccessSetShrink({\n              apiClient: input.runtime.apiClient,\n              execSql: input.runtime.infra.execSql,\n              groupId: input.subjectId,\n              revokedContainerId: input.containerId,\n              prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n                preparePrincipalContainerMutations({\n                  currentPolicy,\n                  groupId: input.subjectId,\n                  nextPolicy,\n                  organizationId: signingContext.organizationId,\n                  revokedContainerId: input.containerId,\n                  runtime: input.runtime,\n                  stillCurrent: input.stillCurrent,\n                }),\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              ...signingContext,\n            })\n          : await revokeOrganizationContainerGrant({\n              stillCurrent: input.stillCurrent,\n              reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n              apiClient: input.runtime.apiClient,\n              containerId: input.containerId,\n              encapsulationKeyPair,\n              execSql: input.runtime.infra.execSql,\n              revokedSubject: {\n                subjectId: input.subjectId,\n                subjectType: input.subjectType,\n              },\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              warmReferencedPrincipalPolicies:\n                createRuntimePrincipalPolicyWarmer(input.runtime),\n              ...signingContext,\n            });\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return response;\n    },\n  );\n}\n"]}
+{"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,gCAAgC,EAChC,yCAAyC,GAC1C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAgCnF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,aAAa;YAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;gBACjC,IAAI,EAAE,KAAK;gBACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;QAC/C,MAAM,MAAM,GACV,OAAO,EAAE,QAAQ;YACjB,CAAC,MAAM,wBAAwB,CAAC;gBAC9B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;oBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;gBAC1C,CAAC;gBACD,oBAAoB,EAAE,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC;qBAC7D,SAAS;gBACZ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU;oBACV,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;gBACJ,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBACpE,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,GAAG,cAAc;aAClB,CAAC,CAAC,CAAC;QACN,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM;YACR,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;gBAC7B,GAAG,cAAc;gBACjB,OAAO;gBACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,2BAA2B;gBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;oBAClD,SAAS,EAAE,OAAO;oBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;iBACnC,CAAC,CACH;gBACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;aAC3C,CAAC,CACL,CAAC;QACJ,OAAO,uBAAuB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,GAAG,cAAc;SAClB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM;YACR,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;gBAC7B,GAAG,cAAc;gBACjB,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;aAC3C,CAAC,CACL,CAAC;QACJ,OAAO,uBAAuB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,GAAG,cAAc;SAClB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,aAAa;YAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;gBACjC,IAAI,EAAE,QAAQ;gBACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;QAC/C,MAAM,MAAM,GACV,OAAO,EAAE,QAAQ;YACjB,CAAC,MAAM,2BAA2B,CAAC;gBACjC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;oBACvC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;gBAC1C,CAAC;gBACD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,iBAAiB,EAAE,gCAAgC,CACjD,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU;oBACV,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;gBACJ,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBACpE,GAAG,cAAc;aAClB,CAAC,CAAC,CAAC;QACN,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,GACX,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,aAAa;YAC5C,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;gBACnC,IAAI,EAAE,QAAQ;gBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;aACtC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GACZ,OAAO,EAAE,QAAQ;YACjB,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;gBAC5B,CAAC,CAAC,MAAM,yCAAyC,CAAC;oBAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,OAAO,EAAE,KAAK,CAAC,SAAS;oBACxB,kBAAkB,EAAE,KAAK,CAAC,WAAW;oBACrC,yBAAyB,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC3D,kCAAkC,CAAC;wBACjC,aAAa;wBACb,OAAO,EAAE,KAAK,CAAC,SAAS;wBACxB,UAAU;wBACV,cAAc,EAAE,cAAc,CAAC,cAAc;wBAC7C,kBAAkB,EAAE,KAAK,CAAC,WAAW;wBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;qBACjC,CAAC;oBACJ,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,GAAG,cAAc;iBAClB,CAAC;gBACJ,CAAC,CAAC,MAAM,gCAAgC,CAAC;oBACrC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAC7B,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC;oBACnD,GAAG,cAAc;iBAClB,CAAC,CAAC,CAAC;QACV,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  addOrganizationGroupUser,\n  createOrganizationGroup,\n  deleteOrganizationGroup,\n  removeOrganizationGroupUser,\n  revokeOrganizationContainerGrant,\n  rotateOrganizationGroupForAccessSetShrink,\n} from \"../../workflows/organizations\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/createCurrentOrganizationGroup\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/deleteCurrentOrganizationGroup\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\nexport interface OrganizationGrantRef {\n  containerId: string;\n  subjectId: string;\n  subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n  groupId: string;\n  expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n  organizationId: string;\n  signerUserId: string;\n  signingFingerprint: string;\n  signingKeyPair: NonNullable<\n    InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n  >;\n}\n\nfunction requireSigningContext(\n  runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.auth.userId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair\n  ) {\n    throw new Error(\"Organization signing context is unavailable\");\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerUserId: runtime.auth.userId,\n    signingFingerprint: runtime.crypto.signingFingerprint,\n    signingKeyPair: runtime.crypto.signingKeyPair,\n  };\n}\n\nfunction requireEncapsulationKeyPair(\n  runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n  if (!runtime.crypto.encapsulationKeyPair) {\n    throw new Error(\"Organization encryption context is unavailable\");\n  }\n\n  return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n  readonly stillCurrent: () => boolean;\n  readonly containerContents: ContainerContents;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n  input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.add\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      const current = mutateCurrent\n        ? await mutateCurrent(input.groupId, {\n            kind: \"add\",\n            expectedGroupName: input.expectedGroupName,\n            targetUserId: input.targetUserId,\n          })\n        : undefined;\n      memberGroupId = current?.memberGroupId ?? null;\n      const bundle =\n        current?.response ??\n        (await addOrganizationGroupUser({\n          apiClient: input.runtime.apiClient,\n          beforePolicyCommit: (_head, authority) => {\n            memberGroupId = authority.memberGroupId;\n          },\n          currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)\n            .secretKey,\n          execSql: input.runtime.infra.execSql,\n          expectedGroupName: input.expectedGroupName,\n          readEncryptedName: createRuntimeGroupMetadataAccess(\n            input.runtime,\n            signingContext.organizationId,\n            input.stillCurrent,\n          ).readName,\n          groupId: input.groupId,\n          prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n            preparePrincipalContainerMutations({\n              currentPolicy,\n              groupId: input.groupId,\n              nextPolicy,\n              organizationId: signingContext.organizationId,\n              runtime: input.runtime,\n              stillCurrent: input.stillCurrent,\n            }),\n          reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n          targetUserId: input.targetUserId,\n          ...signingContext,\n        }));\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport function createGroupForOrganization(input: {\n  readonly name: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: signingContext.organizationId,\n      objectKind: \"principal\",\n      operation: \"group.create\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n        input.runtime,\n      );\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (mutate)\n        return mutate(\n          { ...signingContext, stillCurrent: input.stillCurrent },\n          (context) =>\n            createCurrentOrganizationGroup({\n              ...signingContext,\n              context,\n              apiClient: input.runtime.apiClient,\n              creatorEncapsulationKeyPair,\n              execSql: input.runtime.infra.execSql,\n              name: input.name,\n              metadataAccess: createRuntimeGroupMetadataAccess(\n                input.runtime,\n                signingContext.organizationId,\n                context.stillCurrent,\n                createSelectedCurrentGroupMetadataContainerVerifier({\n                  authority: context,\n                  organizationId: signingContext.organizationId,\n                  stillCurrent: context.stillCurrent,\n                }),\n              ),\n              reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n            }),\n        );\n      return createOrganizationGroup({\n        stillCurrent: input.stillCurrent,\n        apiClient: input.runtime.apiClient,\n        creatorEncapsulationKeyPair,\n        execSql: input.runtime.infra.execSql,\n        name: input.name,\n        metadataAccess: createRuntimeGroupMetadataAccess(\n          input.runtime,\n          signingContext.organizationId,\n          input.stillCurrent,\n        ),\n        reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      });\n    },\n  );\n}\n\nexport function deleteGroupForOrganization(input: {\n  readonly groupId: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.delete\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (mutate)\n        return mutate(\n          { ...signingContext, stillCurrent: input.stillCurrent },\n          (context) =>\n            deleteCurrentOrganizationGroup({\n              ...signingContext,\n              context,\n              groupId: input.groupId,\n              apiClient: input.runtime.apiClient,\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n            }),\n        );\n      return deleteOrganizationGroup({\n        stillCurrent: input.stillCurrent,\n        apiClient: input.runtime.apiClient,\n        execSql: input.runtime.infra.execSql,\n        groupId: input.groupId,\n        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        ...signingContext,\n      });\n    },\n  );\n}\n\nexport async function removeUserFromOrganizationGroup(\n  input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.remove\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      let memberGroupId: string | null = null;\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      const current = mutateCurrent\n        ? await mutateCurrent(input.groupId, {\n            kind: \"remove\",\n            expectedGroupName: input.expectedGroupName,\n            removedUserId: input.removedUserId,\n          })\n        : undefined;\n      memberGroupId = current?.memberGroupId ?? null;\n      const bundle =\n        current?.response ??\n        (await removeOrganizationGroupUser({\n          apiClient: input.runtime.apiClient,\n          beforePolicyCommit: (_head, authority) => {\n            memberGroupId = authority.memberGroupId;\n          },\n          execSql: input.runtime.infra.execSql,\n          expectedGroupName: input.expectedGroupName,\n          readEncryptedName: createRuntimeGroupMetadataAccess(\n            input.runtime,\n            signingContext.organizationId,\n            input.stillCurrent,\n          ).readName,\n          groupId: input.groupId,\n          prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n            preparePrincipalContainerMutations({\n              currentPolicy,\n              groupId: input.groupId,\n              nextPolicy,\n              organizationId: signingContext.organizationId,\n              runtime: input.runtime,\n              stillCurrent: input.stillCurrent,\n            }),\n          removedUserId: input.removedUserId,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n          ...signingContext,\n        }));\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport async function revokeOrganizationGrant(\n  input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n  if (input.runtime.infra.dbStatus !== \"ready\") {\n    throw new Error(\"Organization local database is unavailable\");\n  }\n\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.subjectId,\n      objectKind: \"principal\",\n      operation: \"principal.grant.revoke\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      const current =\n        input.subjectType === \"group\" && mutateCurrent\n          ? await mutateCurrent(input.subjectId, {\n              kind: \"revoke\",\n              revokedContainerId: input.containerId,\n            })\n          : undefined;\n      const response =\n        current?.response ??\n        (input.subjectType === \"group\"\n          ? await rotateOrganizationGroupForAccessSetShrink({\n              apiClient: input.runtime.apiClient,\n              execSql: input.runtime.infra.execSql,\n              groupId: input.subjectId,\n              revokedContainerId: input.containerId,\n              prepareContainerMutations: ({ currentPolicy, nextPolicy }) =>\n                preparePrincipalContainerMutations({\n                  currentPolicy,\n                  groupId: input.subjectId,\n                  nextPolicy,\n                  organizationId: signingContext.organizationId,\n                  revokedContainerId: input.containerId,\n                  runtime: input.runtime,\n                  stillCurrent: input.stillCurrent,\n                }),\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              ...signingContext,\n            })\n          : await revokeOrganizationContainerGrant({\n              stillCurrent: input.stillCurrent,\n              reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n              apiClient: input.runtime.apiClient,\n              containerId: input.containerId,\n              encapsulationKeyPair,\n              execSql: input.runtime.infra.execSql,\n              revokedSubject: {\n                subjectId: input.subjectId,\n                subjectType: input.subjectType,\n              },\n              resolveTrustedUserIdentity:\n                input.runtime.resolveTrustedUserIdentity,\n              warmReferencedPrincipalPolicies:\n                createRuntimePrincipalPolicyWarmer(input.runtime),\n              ...signingContext,\n            }));\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return response;\n    },\n  );\n}\n"]}

package/client/principalMutationApi.d.ts

@@ -17,7 +17,7 @@ interface PrincipalMutationApiCustodyInput {
     readonly readScope: () => PrincipalMutationRuntimeScope | null;
     readonly principalMutationTimeoutMs?: number | undefined;
 }
-/** Keep API methods bound to their real receiver and journal only policy writes. */
+/** Keep API methods bound to their real receiver and journal principal policy and group lifecycle writes. */
 export declare function createPrincipalMutationApiCustody(input: PrincipalMutationApiCustodyInput): {
     bind(): PrincipalMutationApi;
 };

package/client/principalMutationApi.js

@@ -1,6 +1,7 @@
 import { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "../workflows/organizations/principalMutationJournalManagement.js";
-import { recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "../workflows/organizations/principalMutationJournalSession.js";
+import { recoverJournaledPrincipalMutation } from "../workflows/organizations/principalMutationJournalSession.js";
 import { createPrincipalMutationDispatcher } from "./principalMutationDeadline.js";
+import { createJournaledPrincipalMutations, dispatchAuthoredPrincipalMutation, } from "./principalMutationDispatch.js";
 function sameScope(current, bound) {
     if (!current || !bound)
         return current === bound;
@@ -27,7 +28,7 @@ function mutationContext(input, scope, organizationId) {
         stillCurrent: () => sameScope(input.readScope(), scope),
     };
 }
-/** Keep API methods bound to their real receiver and journal only policy writes. */
+/** Keep API methods bound to their real receiver and journal principal policy and group lifecycle writes. */
 export function createPrincipalMutationApiCustody(input) {
     const dispatch = createPrincipalMutationDispatcher(input.principalMutationTimeoutMs);
     let cached = null;
@@ -37,11 +38,6 @@ export function createPrincipalMutationApiCustody(input) {
             if (cached && sameScope(scope, cached.scope))
                 return cached.api;
             const context = (organizationId) => mutationContext(input, scope, organizationId);
-            const commit = async (organizationId, groupId, request, options) => submitJournaledPrincipalMutation({
-                ...context(organizationId),
-                mutation: { groupId, request },
-                submit: (mutation) => dispatch(options, (dispatchOptions) => input.api.commitOrganizationGroupPolicyResult(organizationId, mutation.groupId, mutation.request, dispatchOptions)),
-            });
             const read = async (organizationId) => scope
                 ? readJournaledPrincipalMutation(context(organizationId))
                 : null;
@@ -51,6 +47,7 @@ export function createPrincipalMutationApiCustody(input) {
                 acknowledgeUnknownOutcome,
             });
             const methods = {
+                ...createJournaledPrincipalMutations(input.api, context, dispatch),
                 discardUnreadablePrincipalMutation: async (organizationId, recordId, acknowledgeUnknownOutcome) => discardUnreadableJournaledPrincipalMutation({
                     ...context(organizationId),
                     recordId,
@@ -58,15 +55,10 @@ export function createPrincipalMutationApiCustody(input) {
                 }),
                 readPendingPrincipalMutation: read,
                 abandonPendingPrincipalMutation: abandon,
-                commitOrganizationGroupPolicyResult: commit,
-                commitOrganizationGroupPolicy: async (...args) => {
-                    const result = await commit(...args);
-                    return result.ok ? result.data : null;
-                },
                 recoverPendingPrincipalMutation: async (organizationId) => {
                     await recoverJournaledPrincipalMutation({
                         ...context(organizationId),
-                        submit: (mutation) => dispatch({ reportErrors: false }, (dispatchOptions) => input.api.commitOrganizationGroupPolicyResult(organizationId, mutation.groupId, mutation.request, dispatchOptions)),
+                        submit: (mutation) => dispatch({ reportErrors: false }, (dispatchOptions) => dispatchAuthoredPrincipalMutation(input.api, organizationId, mutation, dispatchOptions)),
                     });
                 },
             };

package/client/principalMutationApi.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutationApi.js","sourceRoot":"","sources":["principalMutationApi.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAE3C,8BAA8B,GAC/B,MAAM,+DAA+D,CAAC;AACvE,OAAO,EACL,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAYhF,SAAS,SAAS,CAChB,OAA6C,EAC7C,KAA2C;IAE3C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,KAAK,KAAK,CAAC;IACjD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACnC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACjC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACzD,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;QACvD,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC/C,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAeD,SAAS,eAAe,CACtB,KAAuC,EACvC,KAA2C,EAC3C,cAAsB;IAEtB,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE;YACL,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,cAAc;YACd,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iCAAiC,CAC/C,KAAuC;IAEvC,MAAM,QAAQ,GAAG,iCAAiC,CAChD,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,OAAO;QACL,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CACzC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,MAAM,GAAqD,KAAK,EACpE,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,gCAAgC,CAAC;gBAC/B,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC1B,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;gBAC9B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,EAAE,CACpC,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAC3C,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,eAAe,CAChB,CACF;aACJ,CAAC,CAAC;YACL,MAAM,IAAI,GACR,KAAK,EAAE,cAAc,EAAE,EAAE,CACvB,KAAK;gBACH,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;YACb,MAAM,OAAO,GACX,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EAAE,CAC5D,iCAAiC,CAAC;gBAChC,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC1B,QAAQ;gBACR,yBAAyB;aAC1B,CAAC,CAAC;YACP,MAAM,OAAO,GAAG;gBACd,kCAAkC,EAAE,KAAK,EACvC,cAAc,EACd,QAAQ,EACR,yBAAyB,EACzB,EAAE,CACF,2CAA2C,CAAC;oBAC1C,GAAG,OAAO,CAAC,cAAc,CAAC;oBAC1B,QAAQ;oBACR,yBAAyB;iBAC1B,CAAC;gBACJ,4BAA4B,EAAE,IAAI;gBAClC,+BAA+B,EAAE,OAAO;gBACxC,mCAAmC,EAAE,MAAM;gBAC3C,6BAA6B,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;oBAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;oBACrC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxC,CAAC;gBACD,+BAA+B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;oBACxD,MAAM,iCAAiC,CAAC;wBACtC,GAAG,OAAO,CAAC,cAAc,CAAC;wBAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CACpD,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAC3C,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,eAAe,CAChB,CACF;qBACJ,CAAC,CAAC;gBACL,CAAC;aAC0B,CAAC;YAC9B,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAc,EACd,OAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAGzB,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAClC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;IACH,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAc;IACxC,OAAO,CACL,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,KAAK,UAAU;QACtE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oCAAoC,CAAC,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../data/sqlite/sqlSchema\";\nimport {\n  abandonJournaledPrincipalMutation,\n  discardUnreadableJournaledPrincipalMutation,\n  type PrincipalMutationRecoveryApi,\n  readJournaledPrincipalMutation,\n} from \"../workflows/organizations/principalMutationJournalManagement\";\nimport {\n  recoverJournaledPrincipalMutation,\n  submitJournaledPrincipalMutation,\n} from \"../workflows/organizations/principalMutationJournalSession\";\nimport { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\n\nexport interface PrincipalMutationRuntimeScope {\n  readonly database: object;\n  readonly execSql: ExecSql;\n  readonly generation: number;\n  readonly identityTrustDomain: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}\n\nfunction sameScope(\n  current: PrincipalMutationRuntimeScope | null,\n  bound: PrincipalMutationRuntimeScope | null,\n): boolean {\n  if (!current || !bound) return current === bound;\n  return (\n    current.database === bound.database &&\n    current.execSql === bound.execSql &&\n    current.generation === bound.generation &&\n    current.identityTrustDomain === bound.identityTrustDomain &&\n    current.signingFingerprint === bound.signingFingerprint &&\n    current.signingKeyPair === bound.signingKeyPair &&\n    current.userId === bound.userId\n  );\n}\n\nexport type PrincipalMutationApi = ApiClient & PrincipalMutationRecoveryApi;\ntype MutationOverrides = Pick<\n  ApiClient,\n  \"commitOrganizationGroupPolicy\" | \"commitOrganizationGroupPolicyResult\"\n> &\n  PrincipalMutationRecoveryApi;\n\ninterface PrincipalMutationApiCustodyInput {\n  readonly api: ApiClient;\n  readonly readScope: () => PrincipalMutationRuntimeScope | null;\n  readonly principalMutationTimeoutMs?: number | undefined;\n}\n\nfunction mutationContext(\n  input: PrincipalMutationApiCustodyInput,\n  scope: PrincipalMutationRuntimeScope | null,\n  organizationId: string,\n) {\n  if (!scope)\n    throw new Error(\n      \"Principal mutations require an authenticated signing identity, a trusted API origin and durable local storage\",\n    );\n  return {\n    execSql: scope.execSql,\n    signingKeyPair: scope.signingKeyPair,\n    scope: {\n      identityTrustDomain: scope.identityTrustDomain,\n      organizationId,\n      signingFingerprint: scope.signingFingerprint,\n      userId: scope.userId,\n    },\n    stillCurrent: () => sameScope(input.readScope(), scope),\n  };\n}\n\n/** Keep API methods bound to their real receiver and journal only policy writes. */\nexport function createPrincipalMutationApiCustody(\n  input: PrincipalMutationApiCustodyInput,\n) {\n  const dispatch = createPrincipalMutationDispatcher(\n    input.principalMutationTimeoutMs,\n  );\n  let cached: {\n    scope: PrincipalMutationRuntimeScope | null;\n    api: PrincipalMutationApi;\n  } | null = null;\n  return {\n    bind(): PrincipalMutationApi {\n      const scope = input.readScope();\n      if (cached && sameScope(scope, cached.scope)) return cached.api;\n      const context = (organizationId: string) =>\n        mutationContext(input, scope, organizationId);\n      const commit: ApiClient[\"commitOrganizationGroupPolicyResult\"] = async (\n        organizationId,\n        groupId,\n        request,\n        options,\n      ) =>\n        submitJournaledPrincipalMutation({\n          ...context(organizationId),\n          mutation: { groupId, request },\n          submit: (mutation) =>\n            dispatch(options, (dispatchOptions) =>\n              input.api.commitOrganizationGroupPolicyResult(\n                organizationId,\n                mutation.groupId,\n                mutation.request,\n                dispatchOptions,\n              ),\n            ),\n        });\n      const read: PrincipalMutationRecoveryApi[\"readPendingPrincipalMutation\"] =\n        async (organizationId) =>\n          scope\n            ? readJournaledPrincipalMutation(context(organizationId))\n            : null;\n      const abandon: PrincipalMutationRecoveryApi[\"abandonPendingPrincipalMutation\"] =\n        async (organizationId, mutation, acknowledgeUnknownOutcome) =>\n          abandonJournaledPrincipalMutation({\n            ...context(organizationId),\n            mutation,\n            acknowledgeUnknownOutcome,\n          });\n      const methods = {\n        discardUnreadablePrincipalMutation: async (\n          organizationId,\n          recordId,\n          acknowledgeUnknownOutcome,\n        ) =>\n          discardUnreadableJournaledPrincipalMutation({\n            ...context(organizationId),\n            recordId,\n            acknowledgeUnknownOutcome,\n          }),\n        readPendingPrincipalMutation: read,\n        abandonPendingPrincipalMutation: abandon,\n        commitOrganizationGroupPolicyResult: commit,\n        commitOrganizationGroupPolicy: async (...args) => {\n          const result = await commit(...args);\n          return result.ok ? result.data : null;\n        },\n        recoverPendingPrincipalMutation: async (organizationId) => {\n          await recoverJournaledPrincipalMutation({\n            ...context(organizationId),\n            submit: (mutation) =>\n              dispatch({ reportErrors: false }, (dispatchOptions) =>\n                input.api.commitOrganizationGroupPolicyResult(\n                  organizationId,\n                  mutation.groupId,\n                  mutation.request,\n                  dispatchOptions,\n                ),\n              ),\n          });\n        },\n      } satisfies MutationOverrides;\n      const api = bindMutationMethods(input.api, methods);\n      cached = { scope, api };\n      return api;\n    },\n  };\n}\n\nfunction bindMutationMethods(\n  api: ApiClient,\n  methods: MutationOverrides,\n): PrincipalMutationApi {\n  const boundMethods = new Map<\n    PropertyKey,\n    { source: unknown; bound: unknown }\n  >();\n  const bound = new Proxy(api, {\n    get(target, property) {\n      if (Object.hasOwn(methods, property))\n        return Reflect.get(methods, property);\n      const value: unknown = Reflect.get(target, property, target);\n      if (typeof value !== \"function\") return value;\n      const previous = boundMethods.get(property);\n      if (previous?.source === value) return previous.bound;\n      const bound = value.bind(target);\n      boundMethods.set(property, { source: value, bound });\n      return bound;\n    },\n  });\n  // The checked overrides supply the signatures; verify their presence through\n  // the reflective boundary before exposing the extended API to callers.\n  if (!hasRecoveryMethods(bound))\n    throw new Error(\"Principal mutation recovery methods are unavailable\");\n  return bound;\n}\n\nfunction hasRecoveryMethods(api: ApiClient): api is PrincipalMutationApi {\n  return (\n    typeof Reflect.get(api, \"readPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"recoverPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"abandonPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"discardUnreadablePrincipalMutation\") === \"function\"\n  );\n}\n"]}
+{"version":3,"file":"principalMutationApi.js","sourceRoot":"","sources":["principalMutationApi.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAE3C,8BAA8B,GAC/B,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,iCAAiC,EAAE,MAAM,4DAA4D,CAAC;AAC/G,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAElC,MAAM,6BAA6B,CAAC;AAYrC,SAAS,SAAS,CAChB,OAA6C,EAC7C,KAA2C;IAE3C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,KAAK,KAAK,CAAC;IACjD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACnC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACjC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACzD,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;QACvD,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC/C,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAYD,SAAS,eAAe,CACtB,KAAuC,EACvC,KAA2C,EAC3C,cAAsB;IAEtB,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE;YACL,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,cAAc;YACd,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,iCAAiC,CAC/C,KAAuC;IAEvC,MAAM,QAAQ,GAAG,iCAAiC,CAChD,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,OAAO;QACL,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CACzC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,IAAI,GACR,KAAK,EAAE,cAAc,EAAE,EAAE,CACvB,KAAK;gBACH,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;YACb,MAAM,OAAO,GACX,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EAAE,CAC5D,iCAAiC,CAAC;gBAChC,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC1B,QAAQ;gBACR,yBAAyB;aAC1B,CAAC,CAAC;YACP,MAAM,OAAO,GAAG;gBACd,GAAG,iCAAiC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAClE,kCAAkC,EAAE,KAAK,EACvC,cAAc,EACd,QAAQ,EACR,yBAAyB,EACzB,EAAE,CACF,2CAA2C,CAAC;oBAC1C,GAAG,OAAO,CAAC,cAAc,CAAC;oBAC1B,QAAQ;oBACR,yBAAyB;iBAC1B,CAAC;gBACJ,4BAA4B,EAAE,IAAI;gBAClC,+BAA+B,EAAE,OAAO;gBACxC,+BAA+B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;oBACxD,MAAM,iCAAiC,CAAC;wBACtC,GAAG,OAAO,CAAC,cAAc,CAAC;wBAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CACpD,iCAAiC,CAC/B,KAAK,CAAC,GAAG,EACT,cAAc,EACd,QAAQ,EACR,eAAe,CAChB,CACF;qBACJ,CAAC,CAAC;gBACL,CAAC;aAC0B,CAAC;YAC9B,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAc,EACd,OAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAGzB,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAClC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;IACH,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAc;IACxC,OAAO,CACL,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,KAAK,UAAU;QACtE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oCAAoC,CAAC,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../data/sqlite/sqlSchema\";\nimport {\n  abandonJournaledPrincipalMutation,\n  discardUnreadableJournaledPrincipalMutation,\n  type PrincipalMutationRecoveryApi,\n  readJournaledPrincipalMutation,\n} from \"../workflows/organizations/principalMutationJournalManagement\";\nimport { recoverJournaledPrincipalMutation } from \"../workflows/organizations/principalMutationJournalSession\";\nimport { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\nimport {\n  createJournaledPrincipalMutations,\n  dispatchAuthoredPrincipalMutation,\n  type JournaledPrincipalMutationMethods,\n} from \"./principalMutationDispatch\";\n\nexport interface PrincipalMutationRuntimeScope {\n  readonly database: object;\n  readonly execSql: ExecSql;\n  readonly generation: number;\n  readonly identityTrustDomain: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly userId: string;\n}\n\nfunction sameScope(\n  current: PrincipalMutationRuntimeScope | null,\n  bound: PrincipalMutationRuntimeScope | null,\n): boolean {\n  if (!current || !bound) return current === bound;\n  return (\n    current.database === bound.database &&\n    current.execSql === bound.execSql &&\n    current.generation === bound.generation &&\n    current.identityTrustDomain === bound.identityTrustDomain &&\n    current.signingFingerprint === bound.signingFingerprint &&\n    current.signingKeyPair === bound.signingKeyPair &&\n    current.userId === bound.userId\n  );\n}\n\nexport type PrincipalMutationApi = ApiClient & PrincipalMutationRecoveryApi;\ntype MutationOverrides = JournaledPrincipalMutationMethods &\n  PrincipalMutationRecoveryApi;\n\ninterface PrincipalMutationApiCustodyInput {\n  readonly api: ApiClient;\n  readonly readScope: () => PrincipalMutationRuntimeScope | null;\n  readonly principalMutationTimeoutMs?: number | undefined;\n}\n\nfunction mutationContext(\n  input: PrincipalMutationApiCustodyInput,\n  scope: PrincipalMutationRuntimeScope | null,\n  organizationId: string,\n) {\n  if (!scope)\n    throw new Error(\n      \"Principal mutations require an authenticated signing identity, a trusted API origin and durable local storage\",\n    );\n  return {\n    execSql: scope.execSql,\n    signingKeyPair: scope.signingKeyPair,\n    scope: {\n      identityTrustDomain: scope.identityTrustDomain,\n      organizationId,\n      signingFingerprint: scope.signingFingerprint,\n      userId: scope.userId,\n    },\n    stillCurrent: () => sameScope(input.readScope(), scope),\n  };\n}\n\n/** Keep API methods bound to their real receiver and journal principal policy and group lifecycle writes. */\nexport function createPrincipalMutationApiCustody(\n  input: PrincipalMutationApiCustodyInput,\n) {\n  const dispatch = createPrincipalMutationDispatcher(\n    input.principalMutationTimeoutMs,\n  );\n  let cached: {\n    scope: PrincipalMutationRuntimeScope | null;\n    api: PrincipalMutationApi;\n  } | null = null;\n  return {\n    bind(): PrincipalMutationApi {\n      const scope = input.readScope();\n      if (cached && sameScope(scope, cached.scope)) return cached.api;\n      const context = (organizationId: string) =>\n        mutationContext(input, scope, organizationId);\n      const read: PrincipalMutationRecoveryApi[\"readPendingPrincipalMutation\"] =\n        async (organizationId) =>\n          scope\n            ? readJournaledPrincipalMutation(context(organizationId))\n            : null;\n      const abandon: PrincipalMutationRecoveryApi[\"abandonPendingPrincipalMutation\"] =\n        async (organizationId, mutation, acknowledgeUnknownOutcome) =>\n          abandonJournaledPrincipalMutation({\n            ...context(organizationId),\n            mutation,\n            acknowledgeUnknownOutcome,\n          });\n      const methods = {\n        ...createJournaledPrincipalMutations(input.api, context, dispatch),\n        discardUnreadablePrincipalMutation: async (\n          organizationId,\n          recordId,\n          acknowledgeUnknownOutcome,\n        ) =>\n          discardUnreadableJournaledPrincipalMutation({\n            ...context(organizationId),\n            recordId,\n            acknowledgeUnknownOutcome,\n          }),\n        readPendingPrincipalMutation: read,\n        abandonPendingPrincipalMutation: abandon,\n        recoverPendingPrincipalMutation: async (organizationId) => {\n          await recoverJournaledPrincipalMutation({\n            ...context(organizationId),\n            submit: (mutation) =>\n              dispatch({ reportErrors: false }, (dispatchOptions) =>\n                dispatchAuthoredPrincipalMutation(\n                  input.api,\n                  organizationId,\n                  mutation,\n                  dispatchOptions,\n                ),\n              ),\n          });\n        },\n      } satisfies MutationOverrides;\n      const api = bindMutationMethods(input.api, methods);\n      cached = { scope, api };\n      return api;\n    },\n  };\n}\n\nfunction bindMutationMethods(\n  api: ApiClient,\n  methods: MutationOverrides,\n): PrincipalMutationApi {\n  const boundMethods = new Map<\n    PropertyKey,\n    { source: unknown; bound: unknown }\n  >();\n  const bound = new Proxy(api, {\n    get(target, property) {\n      if (Object.hasOwn(methods, property))\n        return Reflect.get(methods, property);\n      const value: unknown = Reflect.get(target, property, target);\n      if (typeof value !== \"function\") return value;\n      const previous = boundMethods.get(property);\n      if (previous?.source === value) return previous.bound;\n      const bound = value.bind(target);\n      boundMethods.set(property, { source: value, bound });\n      return bound;\n    },\n  });\n  // The checked overrides supply the signatures; verify their presence through\n  // the reflective boundary before exposing the extended API to callers.\n  if (!hasRecoveryMethods(bound))\n    throw new Error(\"Principal mutation recovery methods are unavailable\");\n  return bound;\n}\n\nfunction hasRecoveryMethods(api: ApiClient): api is PrincipalMutationApi {\n  return (\n    typeof Reflect.get(api, \"readPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"recoverPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"abandonPendingPrincipalMutation\") === \"function\" &&\n    typeof Reflect.get(api, \"discardUnreadablePrincipalMutation\") === \"function\"\n  );\n}\n"]}

package/client/principalMutationDispatch.js

@@ -0,0 +1,54 @@
+import { isCommitOrganizationGroupPolicyResponse, isCreateOrganizationGroupResponse, isDeleteOrganizationGroupResponse, isPrincipalPolicyMutationResponse, } from "../internal/validators/response/index.js";
+import { submitJournaledPrincipalMutation, } from "../workflows/organizations/principalMutationJournalSession.js";
+/** Dispatch the authenticated operation, with no application planning callback. */
+export function dispatchAuthoredPrincipalMutation(api, organizationId, mutation, options = {}) {
+    switch (mutation.kind) {
+        case "organization":
+            return api.putPrincipalPolicyResult("organization", organizationId, mutation.request, options);
+        case "group-create":
+            return api.createOrganizationGroupResult(organizationId, mutation.request, options);
+        case "group-delete":
+            return api.deleteOrganizationGroupResult(organizationId, mutation.groupId, mutation.request, options);
+        case undefined:
+            return api.commitOrganizationGroupPolicyResult(organizationId, mutation.groupId, mutation.request, options);
+        default:
+            return unsupportedMutation(mutation);
+    }
+}
+function unsupportedMutation(_mutation) {
+    throw new Error("Unsupported principal mutation operation");
+}
+export function createJournaledPrincipalMutations(api, context, dispatch) {
+    async function submit(organizationId, mutation, validator, options = {}) {
+        const result = await submitJournaledPrincipalMutation({
+            ...context(organizationId),
+            mutation,
+            submit: (saved) => dispatch(options, (dispatchOptions) => dispatchAuthoredPrincipalMutation(api, organizationId, saved, dispatchOptions)),
+        });
+        if (!result.ok)
+            return result;
+        // The session already verified this operation before clearing its row.
+        // This check narrows the union for each existing public API signature.
+        if (!validator(result.data))
+            throw new Error("Unexpected principal receipt operation");
+        return { ok: true, data: result.data };
+    }
+    const commit = (organizationId, groupId, request, options) => submit(organizationId, { groupId, request }, isCommitOrganizationGroupPolicyResponse, options);
+    const create = (organizationId, request, options) => submit(organizationId, { kind: "group-create", groupId: request.groupId, request }, isCreateOrganizationGroupResponse, options);
+    const remove = (organizationId, groupId, request, options) => submit(organizationId, { kind: "group-delete", groupId, request }, isDeleteOrganizationGroupResponse, options);
+    const put = (_type, organizationId, request, options) => submit(organizationId, { kind: "organization", groupId: null, request }, isPrincipalPolicyMutationResponse, options);
+    return {
+        commitOrganizationGroupPolicyResult: commit,
+        commitOrganizationGroupPolicy: async (...args) => nullable(await commit(...args)),
+        createOrganizationGroupResult: create,
+        createOrganizationGroup: async (...args) => nullable(await create(...args)),
+        deleteOrganizationGroupResult: remove,
+        deleteOrganizationGroup: async (...args) => nullable(await remove(...args)),
+        putPrincipalPolicyResult: put,
+        putPrincipalPolicy: async (...args) => nullable(await put(...args)),
+    };
+}
+function nullable(result) {
+    return result.ok ? result.data : null;
+}
+//# sourceMappingURL=principalMutationDispatch.js.map

package/client/principalMutationDispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationDispatch.js","sourceRoot":"","sources":["principalMutationDispatch.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAEL,gCAAgC,GACjC,MAAM,4DAA4D,CAAC;AAiBpE,mFAAmF;AACnF,MAAM,UAAU,iCAAiC,CAC/C,GAAc,EACd,cAAsB,EACtB,QAAmC,EACnC,UAAgC,EAAE;IAElC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,wBAAwB,CACjC,cAAc,EACd,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,6BAA6B,CACtC,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,6BAA6B,CACtC,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,mCAAmC,CAC5C,cAAc,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;QACJ;YACE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAgB;IAC3C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAc,EACd,OAEoD,EACpD,QAA8D;IAE9D,KAAK,UAAU,MAAM,CACnB,cAAsB,EACtB,QAAmC,EACnC,SAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,GAAG,OAAO,CAAC,cAAc,CAAC;YAC1B,QAAQ;YACR,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,EAAE,CACpC,iCAAiC,CAC/B,GAAG,EACH,cAAc,EACd,KAAK,EACL,eAAe,CAChB,CACF;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAqD,CAC/D,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB,uCAAuC,EACvC,OAAO,CACR,CAAC;IACJ,MAAM,MAAM,GAA+C,CACzD,cAAc,EACd,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAC3D,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,MAAM,MAAM,GAA+C,CACzD,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1C,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,MAAM,GAAG,GAA0C,CACjD,KAAK,EACL,cAAc,EACd,OAAO,EACP,OAAO,EACP,EAAE,CACF,MAAM,CACJ,cAAc,EACd,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAChD,iCAAiC,EACjC,OAAO,CACR,CAAC;IACJ,OAAO;QACL,mCAAmC,EAAE,MAAM;QAC3C,6BAA6B,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAC/C,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACjC,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,6BAA6B,EAAE,MAAM;QACrC,uBAAuB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,wBAAwB,EAAE,GAAG;QAC7B,kBAAkB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAI,MAAwB;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC","sourcesContent":["import type {\n  ApiClient,\n  RequestResult,\n  RequestResultOptions,\n} from \"@tearleads/api-client\";\nimport {\n  isCommitOrganizationGroupPolicyResponse,\n  isCreateOrganizationGroupResponse,\n  isDeleteOrganizationGroupResponse,\n  isPrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { AuthoredPrincipalMutation } from \"../data/principals/principalMutationJournal\";\nimport {\n  type PrincipalMutationJournalContext,\n  submitJournaledPrincipalMutation,\n} from \"../workflows/organizations/principalMutationJournalSession\";\nimport type { PrincipalMutationResponse } from \"../workflows/organizations/principalOperationReceipt\";\n\nimport type { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\n\nexport type JournaledPrincipalMutationMethods = Pick<\n  ApiClient,\n  | \"commitOrganizationGroupPolicy\"\n  | \"commitOrganizationGroupPolicyResult\"\n  | \"createOrganizationGroup\"\n  | \"createOrganizationGroupResult\"\n  | \"deleteOrganizationGroup\"\n  | \"deleteOrganizationGroupResult\"\n  | \"putPrincipalPolicy\"\n  | \"putPrincipalPolicyResult\"\n>;\n\n/** Dispatch the authenticated operation, with no application planning callback. */\nexport function dispatchAuthoredPrincipalMutation(\n  api: ApiClient,\n  organizationId: string,\n  mutation: AuthoredPrincipalMutation,\n  options: RequestResultOptions = {},\n): Promise<RequestResult<PrincipalMutationResponse>> {\n  switch (mutation.kind) {\n    case \"organization\":\n      return api.putPrincipalPolicyResult(\n        \"organization\",\n        organizationId,\n        mutation.request,\n        options,\n      );\n    case \"group-create\":\n      return api.createOrganizationGroupResult(\n        organizationId,\n        mutation.request,\n        options,\n      );\n    case \"group-delete\":\n      return api.deleteOrganizationGroupResult(\n        organizationId,\n        mutation.groupId,\n        mutation.request,\n        options,\n      );\n    case undefined:\n      return api.commitOrganizationGroupPolicyResult(\n        organizationId,\n        mutation.groupId,\n        mutation.request,\n        options,\n      );\n    default:\n      return unsupportedMutation(mutation);\n  }\n}\n\nfunction unsupportedMutation(_mutation: never): never {\n  throw new Error(\"Unsupported principal mutation operation\");\n}\n\nexport function createJournaledPrincipalMutations(\n  api: ApiClient,\n  context: (\n    organizationId: string,\n  ) => Omit<PrincipalMutationJournalContext, \"submit\">,\n  dispatch: ReturnType<typeof createPrincipalMutationDispatcher>,\n): JournaledPrincipalMutationMethods {\n  async function submit<T extends PrincipalMutationResponse>(\n    organizationId: string,\n    mutation: AuthoredPrincipalMutation,\n    validator: (value: unknown) => value is T,\n    options: RequestResultOptions = {},\n  ): Promise<RequestResult<T>> {\n    const result = await submitJournaledPrincipalMutation({\n      ...context(organizationId),\n      mutation,\n      submit: (saved) =>\n        dispatch(options, (dispatchOptions) =>\n          dispatchAuthoredPrincipalMutation(\n            api,\n            organizationId,\n            saved,\n            dispatchOptions,\n          ),\n        ),\n    });\n    if (!result.ok) return result;\n    // The session already verified this operation before clearing its row.\n    // This check narrows the union for each existing public API signature.\n    if (!validator(result.data))\n      throw new Error(\"Unexpected principal receipt operation\");\n    return { ok: true, data: result.data };\n  }\n  const commit: ApiClient[\"commitOrganizationGroupPolicyResult\"] = (\n    organizationId,\n    groupId,\n    request,\n    options,\n  ) =>\n    submit(\n      organizationId,\n      { groupId, request },\n      isCommitOrganizationGroupPolicyResponse,\n      options,\n    );\n  const create: ApiClient[\"createOrganizationGroupResult\"] = (\n    organizationId,\n    request,\n    options,\n  ) =>\n    submit(\n      organizationId,\n      { kind: \"group-create\", groupId: request.groupId, request },\n      isCreateOrganizationGroupResponse,\n      options,\n    );\n  const remove: ApiClient[\"deleteOrganizationGroupResult\"] = (\n    organizationId,\n    groupId,\n    request,\n    options,\n  ) =>\n    submit(\n      organizationId,\n      { kind: \"group-delete\", groupId, request },\n      isDeleteOrganizationGroupResponse,\n      options,\n    );\n  const put: ApiClient[\"putPrincipalPolicyResult\"] = (\n    _type,\n    organizationId,\n    request,\n    options,\n  ) =>\n    submit(\n      organizationId,\n      { kind: \"organization\", groupId: null, request },\n      isPrincipalPolicyMutationResponse,\n      options,\n    );\n  return {\n    commitOrganizationGroupPolicyResult: commit,\n    commitOrganizationGroupPolicy: async (...args) =>\n      nullable(await commit(...args)),\n    createOrganizationGroupResult: create,\n    createOrganizationGroup: async (...args) => nullable(await create(...args)),\n    deleteOrganizationGroupResult: remove,\n    deleteOrganizationGroup: async (...args) => nullable(await remove(...args)),\n    putPrincipalPolicyResult: put,\n    putPrincipalPolicy: async (...args) => nullable(await put(...args)),\n  };\n}\n\nfunction nullable<T>(result: RequestResult<T>): T | null {\n  return result.ok ? result.data : null;\n}\n"]}

package/data/persistence/principalCurrentAcknowledgementPersistence.d.ts

@@ -7,9 +7,9 @@ import type { PrincipalHistoryStage } from "./principalHistoryStagePersistence.j
 export interface AcknowledgedPrincipalCurrentPublication {
     readonly policy: VerifiedPrincipalPolicyCurrent;
     readonly prefix: PrincipalHistoryPrefix;
-    readonly previousPrefixProgress: string;
+    readonly previousPrefixProgress: string | null;
     readonly stage: PrincipalHistoryStage;
-    readonly predecessorStage: PrincipalHistoryStage;
+    readonly predecessorStage: PrincipalHistoryStage | null;
     readonly evidence: PrincipalHistoryEvidencePage;
 }
 export interface AcknowledgedPrincipalCurrentRetirement {