@tearleads/client-sdk 0.1.16 → 0.1.18

package/internal/crypto/keying/principalPolicyCurrentPredecessorReferences.js

@@ -0,0 +1,46 @@
+import { issueVerifiedPrincipalPolicyCurrent, ownVerifiedPrincipalPolicyCurrent, } from "./principalPolicyCurrentEvidence.js";
+import { normalizePrincipalHistoryInput } from "./principalPolicyHistoryChecks.js";
+import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
+import { ok, throwVerification, toVerificationResult } from "./shared.js";
+/** Carry selected authenticated citations across one privately verified successor. */
+export function selectPrincipalPolicyCurrentPredecessorReferences(input) {
+    try {
+        const current = ownVerifiedPrincipalPolicyCurrent(input.current);
+        const predecessor = ownVerifiedPrincipalPolicyCurrent(input.predecessor);
+        const { references } = normalizePrincipalHistoryInput({
+            principalId: current.policy.principalId,
+            principalType: current.policy.principalType,
+            retainedReferences: input.references,
+        });
+        if (predecessor.policy.principalType !== current.policy.principalType ||
+            predecessor.policy.principalId !== current.policy.principalId ||
+            predecessor.policy.version + 1 !== current.policy.version ||
+            predecessor.policy.stateHash !== current.policy.state.prevStateHash)
+            throwVerification("stale_predecessor", "Selected history must belong to the exact verified predecessor");
+        const retained = new Map();
+        for (const policy of [predecessor.policy, current.policy])
+            retained.set(policy.version, {
+                state: policy.state,
+                projection: policy.projection,
+                grants: policy.grants,
+            });
+        for (const reference of references) {
+            const entry = [
+                ...current.policy.retainedHistory,
+                ...predecessor.policy.retainedHistory,
+            ].find(({ state }) => principalPolicyStateMatchesReference(state, reference));
+            if (!entry)
+                throwVerification("missing_dependency", "Requested predecessor citation was not privately verified");
+            retained.set(entry.state.version, entry);
+        }
+        // At most the history reference budget plus the predecessor/successor pair.
+        return ok(issueVerifiedPrincipalPolicyCurrent({
+            ...current.policy,
+            retainedHistory: [...retained.values()].sort((left, right) => left.state.version - right.state.version),
+        }, current.latestAuthority));
+    }
+    catch (error) {
+        return toVerificationResult(error);
+    }
+}
+//# sourceMappingURL=principalPolicyCurrentPredecessorReferences.js.map

package/internal/crypto/keying/principalPolicyCurrentPredecessorReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCurrentPredecessorReferences.js","sourceRoot":"","sources":["principalPolicyCurrentPredecessorReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAElF,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAOvE,sFAAsF;AACtF,MAAM,UAAU,iDAAiD,CAAC,KAIjE;IACC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,iCAAiC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,GAAG,8BAA8B,CAAC;YACpD,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;YACvC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;YAC3C,kBAAkB,EAAE,KAAK,CAAC,UAAU;SACrC,CAAC,CAAC;QACH,IACE,WAAW,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,aAAa;YACjE,WAAW,CAAC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW;YAC7D,WAAW,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO;YACzD,WAAW,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;YAEnE,iBAAiB,CACf,mBAAmB,EACnB,gEAAgE,CACjE,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;QACJ,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG;gBACZ,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe;gBACjC,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe;aACtC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACnB,oCAAoC,CAAC,KAAK,EAAE,SAAS,CAAC,CACvD,CAAC;YACF,IAAI,CAAC,KAAK;gBACR,iBAAiB,CACf,oBAAoB,EACpB,2DAA2D,CAC5D,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,4EAA4E;QAC5E,OAAO,EAAE,CACP,mCAAmC,CACjC;YACE,GAAG,OAAO,CAAC,MAAM;YACjB,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC","sourcesContent":["import {\n  issueVerifiedPrincipalPolicyCurrent,\n  ownVerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrentEvidence\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport type { VerifiedPrincipalPolicyCurrent } from \"./principalPolicyTypes\";\nimport { ok, throwVerification, toVerificationResult } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  NormalizedPrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n} from \"./types\";\n\n/** Carry selected authenticated citations across one privately verified successor. */\nexport function selectPrincipalPolicyCurrentPredecessorReferences(input: {\n  readonly current: VerifiedPrincipalPolicyCurrent;\n  readonly predecessor: VerifiedPrincipalPolicyCurrent;\n  readonly references: readonly ReferencedPrincipalHead[];\n}): KeyingVerificationResult<VerifiedPrincipalPolicyCurrent> {\n  try {\n    const current = ownVerifiedPrincipalPolicyCurrent(input.current);\n    const predecessor = ownVerifiedPrincipalPolicyCurrent(input.predecessor);\n    const { references } = normalizePrincipalHistoryInput({\n      principalId: current.policy.principalId,\n      principalType: current.policy.principalType,\n      retainedReferences: input.references,\n    });\n    if (\n      predecessor.policy.principalType !== current.policy.principalType ||\n      predecessor.policy.principalId !== current.policy.principalId ||\n      predecessor.policy.version + 1 !== current.policy.version ||\n      predecessor.policy.stateHash !== current.policy.state.prevStateHash\n    )\n      throwVerification(\n        \"stale_predecessor\",\n        \"Selected history must belong to the exact verified predecessor\",\n      );\n    const retained = new Map<\n      number,\n      NormalizedPrincipalPolicyStateChainEntry\n    >();\n    for (const policy of [predecessor.policy, current.policy])\n      retained.set(policy.version, {\n        state: policy.state,\n        projection: policy.projection,\n        grants: policy.grants,\n      });\n    for (const reference of references) {\n      const entry = [\n        ...current.policy.retainedHistory,\n        ...predecessor.policy.retainedHistory,\n      ].find(({ state }) =>\n        principalPolicyStateMatchesReference(state, reference),\n      );\n      if (!entry)\n        throwVerification(\n          \"missing_dependency\",\n          \"Requested predecessor citation was not privately verified\",\n        );\n      retained.set(entry.state.version, entry);\n    }\n    // At most the history reference budget plus the predecessor/successor pair.\n    return ok(\n      issueVerifiedPrincipalPolicyCurrent(\n        {\n          ...current.policy,\n          retainedHistory: [...retained.values()].sort(\n            (left, right) => left.state.version - right.state.version,\n          ),\n        },\n        current.latestAuthority,\n      ),\n    );\n  } catch (error) {\n    return toVerificationResult(error);\n  }\n}\n"]}

package/internal/validators/operation/organizations.d.ts

@@ -9008,12 +9008,20 @@ export declare const createOrganizationGroupOperation: Omit<{
         }>>;
         readonly 503: z.ZodType<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, z.core.$ZodTypeInternals<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }>>;
     };
     readonly failureStatuses: readonly [400, 401, 402, 403, 404, 409, 500, 503];
@@ -9023,7 +9031,15 @@ export declare const createOrganizationGroupOperation: Omit<{
         organizationId: z.ZodCustom<string, string>;
     }, z.core.$strict>;
     readonly path: "/organizations/{organizationId}/groups";
+    readonly responseDescriptions: {
+        readonly 202: "The attempted operation rolled back. Retry the identical request to continue verification preparation.";
+    };
     readonly responses: {
+        readonly 202: z.ZodObject<{
+            code: z.ZodLiteral<"principal_history_preparation_pending">;
+            committed: z.ZodLiteral<false>;
+            progressToken: z.ZodCustom<string, string>;
+        }, z.core.$strict>;
         readonly 200: z.ZodType<{
             group: {
                 createdAt: string;
@@ -9573,6 +9589,9 @@ export declare const createOrganizationGroupOperation: Omit<{
     readonly runtimeRefinements: readonly [{
         readonly description: "a container response keyring is null exactly for container key epoch 1";
         readonly id: "response.organization-provisioning-container-keyring";
+    }, {
+        readonly id: "response.principal-history-preparation-rollback";
+        readonly description: "A 503 with code principal_history_preparation_unavailable requires committed:false; other 503 responses do not guarantee rollback.";
     }];
 }, "failureResponses" | "failureStatuses"> & {
     readonly failureResponses: {
@@ -9653,12 +9672,20 @@ export declare const createOrganizationGroupOperation: Omit<{
         }>>;
         readonly 503: z.ZodType<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, z.core.$ZodTypeInternals<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }>>;
     } & {
         readonly 503: typeof ErrorResponseSchema;
@@ -10122,12 +10149,20 @@ export declare const deleteOrganizationGroupOperation: Omit<{
         }>>;
         readonly 503: z.ZodType<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, z.core.$ZodTypeInternals<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }>>;
     };
     readonly failureStatuses: readonly [400, 401, 402, 403, 404, 409, 500, 503];
@@ -10138,7 +10173,15 @@ export declare const deleteOrganizationGroupOperation: Omit<{
         groupId: z.ZodCustom<string, string>;
     }, z.core.$strict>;
     readonly path: "/organizations/{organizationId}/groups/{groupId}";
+    readonly responseDescriptions: {
+        readonly 202: "The attempted operation rolled back. Retry the identical request to continue verification preparation.";
+    };
     readonly responses: {
+        readonly 202: z.ZodObject<{
+            code: z.ZodLiteral<"principal_history_preparation_pending">;
+            committed: z.ZodLiteral<false>;
+            progressToken: z.ZodCustom<string, string>;
+        }, z.core.$strict>;
         readonly 200: z.ZodType<{
             deleted: true;
             groupId: string;
@@ -10648,6 +10691,9 @@ export declare const deleteOrganizationGroupOperation: Omit<{
     readonly runtimeRefinements: readonly [{
         readonly description: "a container response keyring is null exactly for container key epoch 1";
         readonly id: "response.organization-provisioning-container-keyring";
+    }, {
+        readonly id: "response.principal-history-preparation-rollback";
+        readonly description: "A 503 with code principal_history_preparation_unavailable requires committed:false; other 503 responses do not guarantee rollback.";
     }];
 }, "failureResponses" | "failureStatuses"> & {
     readonly failureResponses: {
@@ -10728,12 +10774,20 @@ export declare const deleteOrganizationGroupOperation: Omit<{
         }>>;
         readonly 503: z.ZodType<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, z.core.$ZodTypeInternals<{
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }, {
             error: string;
+            code?: "billing_checkout_no_active_members" | "billing_roster_over_capacity" | "principal_history_preparation_unavailable" | undefined;
+            committed?: boolean | undefined;
         }>>;
     } & {
         readonly 503: typeof ErrorResponseSchema;

package/internal/validators/operation/organizations.js

@@ -5,6 +5,7 @@ import { organizationProvisioningContainerKeyringRefinement, organizationProvisi
 import { organizationReadModelResponseRuntimeRefinements } from "../organizationReadModelRefinements.js";
 import { CreateOrganizationGroupWithPolicyRequestSchema, CreateOrganizationRequestSchema, DeleteOrganizationGroupRequestSchema, isCreateOrganizationGroupWithPolicyRequest, isCreateOrganizationRequest, isUpdateOrganizationProfileRequest, isUpdateOrganizationRosterEntryRequest, OrganizationReadModelQuerySchema, UpdateOrganizationProfileRequestSchema, UpdateOrganizationRosterEntryRequestSchema, } from "../request/index.js";
 import { CreateOrganizationGroupResponseSchema, CreateOrganizationResponseSchema, DeleteOrganizationGroupResponseSchema, ErrorResponseSchema, isCreateOrganizationGroupResponse, isCreateOrganizationResponse, isDeleteOrganizationGroupResponse, isOrganizationDataUsageResponse, isOrganizationDirectoryUserResponse, isOrganizationGroupMembersResponse, isOrganizationProfileResponse, isOrganizationReadModelResponse, OrganizationDataUsageResponseSchema, OrganizationDirectoryUserResponseSchema, OrganizationGroupMembersResponseSchema, OrganizationPresentationFailureResponseSchema, OrganizationProfileResponseSchema, OrganizationReadModelFailureResponseSchema, OrganizationReadModelResponseSchema, PaymentRequiredErrorResponseSchema, SessionFailureResponseSchema, } from "../response/index.js";
+import { PrincipalHistoryPreparationFailureResponseSchema, PrincipalHistoryPreparationResponseSchema, principalHistoryRollbackRefinement, } from "../response/principalHistoryPreparation.js";
 import { uuidV4StringSchema } from "../schema.js";
 import { defineJsonOperation } from "./definition.js";
 const CreateOrganizationPathParamsSchema = z.strictObject({});
@@ -95,17 +96,24 @@ export const createOrganizationGroupOperation = defineJsonOperation({
         404: ErrorResponseSchema,
         409: ErrorResponseSchema,
         500: ErrorResponseSchema,
-        503: ErrorResponseSchema,
+        503: PrincipalHistoryPreparationFailureResponseSchema,
     },
     failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],
     id: "organizations.groups.create",
     method: "POST",
     params: OrganizationPathParamsSchema,
     path: "/organizations/{organizationId}/groups",
+    responseDescriptions: {
+        202: "The attempted operation rolled back. Retry the identical request to continue verification preparation.",
+    },
     responses: {
+        202: PrincipalHistoryPreparationResponseSchema,
         200: CreateOrganizationGroupResponseSchema,
     },
-    runtimeRefinements: [organizationProvisioningContainerKeyringRefinement],
+    runtimeRefinements: [
+        organizationProvisioningContainerKeyringRefinement,
+        principalHistoryRollbackRefinement,
+    ],
 });
 export const deleteOrganizationGroupOperation = defineJsonOperation({
     auth: "session",
@@ -118,17 +126,24 @@ export const deleteOrganizationGroupOperation = defineJsonOperation({
         404: ErrorResponseSchema,
         409: ErrorResponseSchema,
         500: ErrorResponseSchema,
-        503: ErrorResponseSchema,
+        503: PrincipalHistoryPreparationFailureResponseSchema,
     },
     failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],
     id: "organizations.groups.delete",
     method: "DELETE",
     params: OrganizationGroupPathParamsSchema,
     path: "/organizations/{organizationId}/groups/{groupId}",
+    responseDescriptions: {
+        202: "The attempted operation rolled back. Retry the identical request to continue verification preparation.",
+    },
     responses: {
+        202: PrincipalHistoryPreparationResponseSchema,
         200: DeleteOrganizationGroupResponseSchema,
     },
-    runtimeRefinements: [organizationProvisioningContainerKeyringRefinement],
+    runtimeRefinements: [
+        organizationProvisioningContainerKeyringRefinement,
+        principalHistoryRollbackRefinement,
+    ],
 });
 export const listOrganizationGroupMembersOperation = defineJsonOperation({
     auth: "session",

package/internal/validators/operation/organizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.js","sourceRoot":"","sources":["organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,+CAA+C,EAAE,MAAM,qCAAqC,CAAC;AACtG,OAAO,EACL,kDAAkD,EAClD,iDAAiD,EACjD,kDAAkD,GACnD,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,+CAA+C,EAAE,MAAM,qCAAqC,CAAC;AACtG,OAAO,EACL,8CAA8C,EAC9C,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,2BAA2B,EAC3B,kCAAkC,EAClC,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,0CAA0C,GAC3C,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qCAAqC,EACrC,gCAAgC,EAChC,qCAAqC,EACrC,mBAAmB,EACnB,iCAAiC,EACjC,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,uCAAuC,EACvC,sCAAsC,EACtC,6CAA6C,EAC7C,iCAAiC,EACjC,0CAA0C,EAC1C,mCAAmC,EACnC,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,cAAc,EAAE,kBAAkB;CACnC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,cAAc,EAAE,kBAAkB;IAClC,MAAM,EAAE,kBAAkB;CAC3B,CAAC,CAAC;AAYH,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IAC7D,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,+BAA+B;IACrC,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACpD,EAAE,EAAE,sBAAsB;IAC1B,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,kCAAkC;IAC1C,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE;QACT,GAAG,EAAE,gCAAgC;KACtC;IACD,kBAAkB,EAAE;QAClB,GAAG,qCAAqC;QACxC,GAAG,iDAAiD;QACpD,GAAG,kDAAkD;KACtD;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;IACnE,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,4CAA4C;IAClD,SAAS,EAAE;QACT,GAAG,EAAE,mCAAmC;KACzC;IACD,kBAAkB,EAAE,+CAA+C;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;IACnE,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,0CAA0C;QAC/C,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,4CAA4C;IAClD,KAAK,EAAE,gCAAgC;IACvC,SAAS,EAAE;QACT,GAAG,EAAE,mCAAmC;KACzC;IACD,kBAAkB,EAAE,+CAA+C;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;IAClE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,8CAA8C;IACpD,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,wCAAwC;IAC9C,SAAS,EAAE;QACT,GAAG,EAAE,qCAAqC;KAC3C;IACD,kBAAkB,EAAE,CAAC,kDAAkD,CAAC;CACzE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;IAClE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,oCAAoC;IAC1C,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,iCAAiC;IACzC,IAAI,EAAE,kDAAkD;IACxD,SAAS,EAAE;QACT,GAAG,EAAE,qCAAqC;KAC3C;IACD,kBAAkB,EAAE,CAAC,kDAAkD,CAAC;CACzE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;IACvE,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,mCAAmC;IACvC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,iCAAiC;IACzC,IAAI,EAAE,0DAA0D;IAChE,SAAS,EAAE;QACT,GAAG,EAAE,sCAAsC;KAC5C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,mBAAmB,CAAC;IACpE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,sCAAsC;IAC5C,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC/C,EAAE,EAAE,8BAA8B;IAClC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,yCAAyC;IAC/C,SAAS,EAAE;QACT,GAAG,EAAE,iCAAiC;KACvC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sCAAsC,GAAG,mBAAmB,CAAC;IACxE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,0CAA0C;IAChD,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC/C,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,kCAAkC;IAC1C,IAAI,EAAE,iDAAiD;IACvD,SAAS,EAAE;QACT,GAAG,EAAE,uCAAuC;KAC7C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GACpD,0CAA0C,CAAC;AAC7C,MAAM,CAAC,MAAM,0CAA0C,GACrD,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,oCAAoC,GAAG,2BAA2B,CAAC;AAChF,MAAM,CAAC,MAAM,qCAAqC,GAChD,4BAA4B,CAAC;AAC/B,MAAM,CAAC,MAAM,0CAA0C,GACrD,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,2CAA2C,GACtD,+BAA+B,CAAC;AAClC,MAAM,CAAC,MAAM,2CAA2C,GACtD,+BAA+B,CAAC;AAClC,MAAM,CAAC,MAAM,+CAA+C,GAC1D,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,2CAA2C,GACtD,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,4CAA4C,GACvD,6BAA6B,CAAC;AAChC,MAAM,CAAC,MAAM,+CAA+C,GAC1D,sCAAsC,CAAC;AACzC,MAAM,CAAC,MAAM,gDAAgD,GAC3D,mCAAmC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { documentSyncRequestRuntimeRefinements } from \"../documentSyncRefinements\";\nimport { organizationDataUsageResponseRuntimeRefinements } from \"../organizationDataUsageRefinements\";\nimport {\n  organizationProvisioningContainerKeyringRefinement,\n  organizationProvisioningRequestRuntimeRefinements,\n  organizationProvisioningResponseRuntimeRefinements,\n} from \"../organizationProvisioningRefinements\";\nimport { organizationReadModelResponseRuntimeRefinements } from \"../organizationReadModelRefinements\";\nimport {\n  CreateOrganizationGroupWithPolicyRequestSchema,\n  CreateOrganizationRequestSchema,\n  DeleteOrganizationGroupRequestSchema,\n  isCreateOrganizationGroupWithPolicyRequest,\n  isCreateOrganizationRequest,\n  isUpdateOrganizationProfileRequest,\n  isUpdateOrganizationRosterEntryRequest,\n  OrganizationReadModelQuerySchema,\n  UpdateOrganizationProfileRequestSchema,\n  UpdateOrganizationRosterEntryRequestSchema,\n} from \"../request\";\nimport {\n  CreateOrganizationGroupResponseSchema,\n  CreateOrganizationResponseSchema,\n  DeleteOrganizationGroupResponseSchema,\n  ErrorResponseSchema,\n  isCreateOrganizationGroupResponse,\n  isCreateOrganizationResponse,\n  isDeleteOrganizationGroupResponse,\n  isOrganizationDataUsageResponse,\n  isOrganizationDirectoryUserResponse,\n  isOrganizationGroupMembersResponse,\n  isOrganizationProfileResponse,\n  isOrganizationReadModelResponse,\n  OrganizationDataUsageResponseSchema,\n  OrganizationDirectoryUserResponseSchema,\n  OrganizationGroupMembersResponseSchema,\n  OrganizationPresentationFailureResponseSchema,\n  OrganizationProfileResponseSchema,\n  OrganizationReadModelFailureResponseSchema,\n  OrganizationReadModelResponseSchema,\n  PaymentRequiredErrorResponseSchema,\n  SessionFailureResponseSchema,\n} from \"../response\";\nimport { uuidV4StringSchema } from \"../schema\";\nimport { defineJsonOperation } from \"./definition\";\n\nconst CreateOrganizationPathParamsSchema = z.strictObject({});\nexport const OrganizationPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n});\nexport const OrganizationGroupPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n  groupId: uuidV4StringSchema,\n});\nexport const OrganizationRosterPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n  userId: uuidV4StringSchema,\n});\n\nexport type OrganizationPathParams = z.infer<\n  typeof OrganizationPathParamsSchema\n>;\nexport type OrganizationGroupPathParams = z.infer<\n  typeof OrganizationGroupPathParamsSchema\n>;\nexport type OrganizationRosterPathParams = z.infer<\n  typeof OrganizationRosterPathParamsSchema\n>;\n\nexport const createOrganizationOperation = defineJsonOperation({\n  auth: \"session\",\n  body: CreateOrganizationRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 409, 500, 503],\n  id: \"organizations.create\",\n  method: \"POST\",\n  params: CreateOrganizationPathParamsSchema,\n  path: \"/organizations\",\n  responses: {\n    200: CreateOrganizationResponseSchema,\n  },\n  runtimeRefinements: [\n    ...documentSyncRequestRuntimeRefinements,\n    ...organizationProvisioningRequestRuntimeRefinements,\n    ...organizationProvisioningResponseRuntimeRefinements,\n  ],\n});\n\nexport const getOrganizationDataUsageOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: OrganizationPresentationFailureResponseSchema,\n    404: OrganizationPresentationFailureResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 500],\n  id: \"organizations.dataUsage.get\",\n  method: \"GET\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/data-usage\",\n  responses: {\n    200: OrganizationDataUsageResponseSchema,\n  },\n  runtimeRefinements: organizationDataUsageResponseRuntimeRefinements,\n});\n\nexport const getOrganizationReadModelOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: OrganizationReadModelFailureResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: OrganizationPresentationFailureResponseSchema,\n    404: OrganizationPresentationFailureResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 500],\n  id: \"organizations.readModel.get\",\n  method: \"GET\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/read-model\",\n  query: OrganizationReadModelQuerySchema,\n  responses: {\n    200: OrganizationReadModelResponseSchema,\n  },\n  runtimeRefinements: organizationReadModelResponseRuntimeRefinements,\n});\n\nexport const createOrganizationGroupOperation = defineJsonOperation({\n  auth: \"session\",\n  body: CreateOrganizationGroupWithPolicyRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"organizations.groups.create\",\n  method: \"POST\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups\",\n  responses: {\n    200: CreateOrganizationGroupResponseSchema,\n  },\n  runtimeRefinements: [organizationProvisioningContainerKeyringRefinement],\n});\n\nexport const deleteOrganizationGroupOperation = defineJsonOperation({\n  auth: \"session\",\n  body: DeleteOrganizationGroupRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"organizations.groups.delete\",\n  method: \"DELETE\",\n  params: OrganizationGroupPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups/{groupId}\",\n  responses: {\n    200: DeleteOrganizationGroupResponseSchema,\n  },\n  runtimeRefinements: [organizationProvisioningContainerKeyringRefinement],\n});\n\nexport const listOrganizationGroupMembersOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 500],\n  id: \"organizations.groups.members.list\",\n  method: \"GET\",\n  params: OrganizationGroupPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups/{groupId}/members\",\n  responses: {\n    200: OrganizationGroupMembersResponseSchema,\n  },\n});\n\nexport const updateOrganizationProfileOperation = defineJsonOperation({\n  auth: \"session\",\n  body: UpdateOrganizationProfileRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 500],\n  id: \"organizations.profile.update\",\n  method: \"PUT\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/profile\",\n  responses: {\n    200: OrganizationProfileResponseSchema,\n  },\n});\n\nexport const updateOrganizationRosterEntryOperation = defineJsonOperation({\n  auth: \"session\",\n  body: UpdateOrganizationRosterEntryRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 500],\n  id: \"organizations.roster.update\",\n  method: \"PUT\",\n  params: OrganizationRosterPathParamsSchema,\n  path: \"/organizations/{organizationId}/roster/{userId}\",\n  responses: {\n    200: OrganizationDirectoryUserResponseSchema,\n  },\n});\n\nexport const isCreateOrganizationGroupOperationRequest =\n  isCreateOrganizationGroupWithPolicyRequest;\nexport const isCreateOrganizationGroupOperationResponse =\n  isCreateOrganizationGroupResponse;\nexport const isCreateOrganizationOperationRequest = isCreateOrganizationRequest;\nexport const isCreateOrganizationOperationResponse =\n  isCreateOrganizationResponse;\nexport const isDeleteOrganizationGroupOperationResponse =\n  isDeleteOrganizationGroupResponse;\nexport const isGetOrganizationDataUsageOperationResponse =\n  isOrganizationDataUsageResponse;\nexport const isGetOrganizationReadModelOperationResponse =\n  isOrganizationReadModelResponse;\nexport const isListOrganizationGroupMembersOperationResponse =\n  isOrganizationGroupMembersResponse;\nexport const isUpdateOrganizationProfileOperationRequest =\n  isUpdateOrganizationProfileRequest;\nexport const isUpdateOrganizationProfileOperationResponse =\n  isOrganizationProfileResponse;\nexport const isUpdateOrganizationRosterEntryOperationRequest =\n  isUpdateOrganizationRosterEntryRequest;\nexport const isUpdateOrganizationRosterEntryOperationResponse =\n  isOrganizationDirectoryUserResponse;\n"]}
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,+CAA+C,EAAE,MAAM,qCAAqC,CAAC;AACtG,OAAO,EACL,kDAAkD,EAClD,iDAAiD,EACjD,kDAAkD,GACnD,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,+CAA+C,EAAE,MAAM,qCAAqC,CAAC;AACtG,OAAO,EACL,8CAA8C,EAC9C,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,2BAA2B,EAC3B,kCAAkC,EAClC,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,0CAA0C,GAC3C,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qCAAqC,EACrC,gCAAgC,EAChC,qCAAqC,EACrC,mBAAmB,EACnB,iCAAiC,EACjC,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,uCAAuC,EACvC,sCAAsC,EACtC,6CAA6C,EAC7C,iCAAiC,EACjC,0CAA0C,EAC1C,mCAAmC,EACnC,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gDAAgD,EAChD,yCAAyC,EACzC,kCAAkC,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,cAAc,EAAE,kBAAkB;CACnC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,cAAc,EAAE,kBAAkB;IAClC,MAAM,EAAE,kBAAkB;CAC3B,CAAC,CAAC;AAYH,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IAC7D,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,+BAA+B;IACrC,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACpD,EAAE,EAAE,sBAAsB;IAC1B,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,kCAAkC;IAC1C,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE;QACT,GAAG,EAAE,gCAAgC;KACtC;IACD,kBAAkB,EAAE;QAClB,GAAG,qCAAqC;QACxC,GAAG,iDAAiD;QACpD,GAAG,kDAAkD;KACtD;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;IACnE,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,4CAA4C;IAClD,SAAS,EAAE;QACT,GAAG,EAAE,mCAAmC;KACzC;IACD,kBAAkB,EAAE,+CAA+C;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;IACnE,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,0CAA0C;QAC/C,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,4CAA4C;IAClD,KAAK,EAAE,gCAAgC;IACvC,SAAS,EAAE;QACT,GAAG,EAAE,mCAAmC;KACzC;IACD,kBAAkB,EAAE,+CAA+C;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;IAClE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,8CAA8C;IACpD,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,gDAAgD;KACtD;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,wCAAwC;IAC9C,oBAAoB,EAAE;QACpB,GAAG,EAAE,wGAAwG;KAC9G;IACD,SAAS,EAAE;QACT,GAAG,EAAE,yCAAyC;QAC9C,GAAG,EAAE,qCAAqC;KAC3C;IACD,kBAAkB,EAAE;QAClB,kDAAkD;QAClD,kCAAkC;KACnC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;IAClE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,oCAAoC;IAC1C,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,gDAAgD;KACtD;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IACzD,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,iCAAiC;IACzC,IAAI,EAAE,kDAAkD;IACxD,oBAAoB,EAAE;QACpB,GAAG,EAAE,wGAAwG;KAC9G;IACD,SAAS,EAAE;QACT,GAAG,EAAE,yCAAyC;QAC9C,GAAG,EAAE,qCAAqC;KAC3C;IACD,kBAAkB,EAAE;QAClB,kDAAkD;QAClD,kCAAkC;KACnC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;IACvE,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,EAAE,EAAE,mCAAmC;IACvC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,iCAAiC;IACzC,IAAI,EAAE,0DAA0D;IAChE,SAAS,EAAE;QACT,GAAG,EAAE,sCAAsC;KAC5C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,mBAAmB,CAAC;IACpE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,sCAAsC;IAC5C,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC/C,EAAE,EAAE,8BAA8B;IAClC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,4BAA4B;IACpC,IAAI,EAAE,yCAAyC;IAC/C,SAAS,EAAE;QACT,GAAG,EAAE,iCAAiC;KACvC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sCAAsC,GAAG,mBAAmB,CAAC;IACxE,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,0CAA0C;IAChD,gBAAgB,EAAE;QAChB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,4BAA4B;QACjC,GAAG,EAAE,kCAAkC;QACvC,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,mBAAmB;KACzB;IACD,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC/C,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,kCAAkC;IAC1C,IAAI,EAAE,iDAAiD;IACvD,SAAS,EAAE;QACT,GAAG,EAAE,uCAAuC;KAC7C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GACpD,0CAA0C,CAAC;AAC7C,MAAM,CAAC,MAAM,0CAA0C,GACrD,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,oCAAoC,GAAG,2BAA2B,CAAC;AAChF,MAAM,CAAC,MAAM,qCAAqC,GAChD,4BAA4B,CAAC;AAC/B,MAAM,CAAC,MAAM,0CAA0C,GACrD,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,2CAA2C,GACtD,+BAA+B,CAAC;AAClC,MAAM,CAAC,MAAM,2CAA2C,GACtD,+BAA+B,CAAC;AAClC,MAAM,CAAC,MAAM,+CAA+C,GAC1D,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,2CAA2C,GACtD,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,4CAA4C,GACvD,6BAA6B,CAAC;AAChC,MAAM,CAAC,MAAM,+CAA+C,GAC1D,sCAAsC,CAAC;AACzC,MAAM,CAAC,MAAM,gDAAgD,GAC3D,mCAAmC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { documentSyncRequestRuntimeRefinements } from \"../documentSyncRefinements\";\nimport { organizationDataUsageResponseRuntimeRefinements } from \"../organizationDataUsageRefinements\";\nimport {\n  organizationProvisioningContainerKeyringRefinement,\n  organizationProvisioningRequestRuntimeRefinements,\n  organizationProvisioningResponseRuntimeRefinements,\n} from \"../organizationProvisioningRefinements\";\nimport { organizationReadModelResponseRuntimeRefinements } from \"../organizationReadModelRefinements\";\nimport {\n  CreateOrganizationGroupWithPolicyRequestSchema,\n  CreateOrganizationRequestSchema,\n  DeleteOrganizationGroupRequestSchema,\n  isCreateOrganizationGroupWithPolicyRequest,\n  isCreateOrganizationRequest,\n  isUpdateOrganizationProfileRequest,\n  isUpdateOrganizationRosterEntryRequest,\n  OrganizationReadModelQuerySchema,\n  UpdateOrganizationProfileRequestSchema,\n  UpdateOrganizationRosterEntryRequestSchema,\n} from \"../request\";\nimport {\n  CreateOrganizationGroupResponseSchema,\n  CreateOrganizationResponseSchema,\n  DeleteOrganizationGroupResponseSchema,\n  ErrorResponseSchema,\n  isCreateOrganizationGroupResponse,\n  isCreateOrganizationResponse,\n  isDeleteOrganizationGroupResponse,\n  isOrganizationDataUsageResponse,\n  isOrganizationDirectoryUserResponse,\n  isOrganizationGroupMembersResponse,\n  isOrganizationProfileResponse,\n  isOrganizationReadModelResponse,\n  OrganizationDataUsageResponseSchema,\n  OrganizationDirectoryUserResponseSchema,\n  OrganizationGroupMembersResponseSchema,\n  OrganizationPresentationFailureResponseSchema,\n  OrganizationProfileResponseSchema,\n  OrganizationReadModelFailureResponseSchema,\n  OrganizationReadModelResponseSchema,\n  PaymentRequiredErrorResponseSchema,\n  SessionFailureResponseSchema,\n} from \"../response\";\nimport {\n  PrincipalHistoryPreparationFailureResponseSchema,\n  PrincipalHistoryPreparationResponseSchema,\n  principalHistoryRollbackRefinement,\n} from \"../response/principalHistoryPreparation\";\nimport { uuidV4StringSchema } from \"../schema\";\nimport { defineJsonOperation } from \"./definition\";\n\nconst CreateOrganizationPathParamsSchema = z.strictObject({});\nexport const OrganizationPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n});\nexport const OrganizationGroupPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n  groupId: uuidV4StringSchema,\n});\nexport const OrganizationRosterPathParamsSchema = z.strictObject({\n  organizationId: uuidV4StringSchema,\n  userId: uuidV4StringSchema,\n});\n\nexport type OrganizationPathParams = z.infer<\n  typeof OrganizationPathParamsSchema\n>;\nexport type OrganizationGroupPathParams = z.infer<\n  typeof OrganizationGroupPathParamsSchema\n>;\nexport type OrganizationRosterPathParams = z.infer<\n  typeof OrganizationRosterPathParamsSchema\n>;\n\nexport const createOrganizationOperation = defineJsonOperation({\n  auth: \"session\",\n  body: CreateOrganizationRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 409, 500, 503],\n  id: \"organizations.create\",\n  method: \"POST\",\n  params: CreateOrganizationPathParamsSchema,\n  path: \"/organizations\",\n  responses: {\n    200: CreateOrganizationResponseSchema,\n  },\n  runtimeRefinements: [\n    ...documentSyncRequestRuntimeRefinements,\n    ...organizationProvisioningRequestRuntimeRefinements,\n    ...organizationProvisioningResponseRuntimeRefinements,\n  ],\n});\n\nexport const getOrganizationDataUsageOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: OrganizationPresentationFailureResponseSchema,\n    404: OrganizationPresentationFailureResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 500],\n  id: \"organizations.dataUsage.get\",\n  method: \"GET\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/data-usage\",\n  responses: {\n    200: OrganizationDataUsageResponseSchema,\n  },\n  runtimeRefinements: organizationDataUsageResponseRuntimeRefinements,\n});\n\nexport const getOrganizationReadModelOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: OrganizationReadModelFailureResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: OrganizationPresentationFailureResponseSchema,\n    404: OrganizationPresentationFailureResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 500],\n  id: \"organizations.readModel.get\",\n  method: \"GET\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/read-model\",\n  query: OrganizationReadModelQuerySchema,\n  responses: {\n    200: OrganizationReadModelResponseSchema,\n  },\n  runtimeRefinements: organizationReadModelResponseRuntimeRefinements,\n});\n\nexport const createOrganizationGroupOperation = defineJsonOperation({\n  auth: \"session\",\n  body: CreateOrganizationGroupWithPolicyRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: PrincipalHistoryPreparationFailureResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"organizations.groups.create\",\n  method: \"POST\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups\",\n  responseDescriptions: {\n    202: \"The attempted operation rolled back. Retry the identical request to continue verification preparation.\",\n  },\n  responses: {\n    202: PrincipalHistoryPreparationResponseSchema,\n    200: CreateOrganizationGroupResponseSchema,\n  },\n  runtimeRefinements: [\n    organizationProvisioningContainerKeyringRefinement,\n    principalHistoryRollbackRefinement,\n  ],\n});\n\nexport const deleteOrganizationGroupOperation = defineJsonOperation({\n  auth: \"session\",\n  body: DeleteOrganizationGroupRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    409: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n    503: PrincipalHistoryPreparationFailureResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 409, 500, 503],\n  id: \"organizations.groups.delete\",\n  method: \"DELETE\",\n  params: OrganizationGroupPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups/{groupId}\",\n  responseDescriptions: {\n    202: \"The attempted operation rolled back. Retry the identical request to continue verification preparation.\",\n  },\n  responses: {\n    202: PrincipalHistoryPreparationResponseSchema,\n    200: DeleteOrganizationGroupResponseSchema,\n  },\n  runtimeRefinements: [\n    organizationProvisioningContainerKeyringRefinement,\n    principalHistoryRollbackRefinement,\n  ],\n});\n\nexport const listOrganizationGroupMembersOperation = defineJsonOperation({\n  auth: \"session\",\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 403, 404, 500],\n  id: \"organizations.groups.members.list\",\n  method: \"GET\",\n  params: OrganizationGroupPathParamsSchema,\n  path: \"/organizations/{organizationId}/groups/{groupId}/members\",\n  responses: {\n    200: OrganizationGroupMembersResponseSchema,\n  },\n});\n\nexport const updateOrganizationProfileOperation = defineJsonOperation({\n  auth: \"session\",\n  body: UpdateOrganizationProfileRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 500],\n  id: \"organizations.profile.update\",\n  method: \"PUT\",\n  params: OrganizationPathParamsSchema,\n  path: \"/organizations/{organizationId}/profile\",\n  responses: {\n    200: OrganizationProfileResponseSchema,\n  },\n});\n\nexport const updateOrganizationRosterEntryOperation = defineJsonOperation({\n  auth: \"session\",\n  body: UpdateOrganizationRosterEntryRequestSchema,\n  failureResponses: {\n    400: ErrorResponseSchema,\n    401: SessionFailureResponseSchema,\n    402: PaymentRequiredErrorResponseSchema,\n    403: ErrorResponseSchema,\n    404: ErrorResponseSchema,\n    500: ErrorResponseSchema,\n  },\n  failureStatuses: [400, 401, 402, 403, 404, 500],\n  id: \"organizations.roster.update\",\n  method: \"PUT\",\n  params: OrganizationRosterPathParamsSchema,\n  path: \"/organizations/{organizationId}/roster/{userId}\",\n  responses: {\n    200: OrganizationDirectoryUserResponseSchema,\n  },\n});\n\nexport const isCreateOrganizationGroupOperationRequest =\n  isCreateOrganizationGroupWithPolicyRequest;\nexport const isCreateOrganizationGroupOperationResponse =\n  isCreateOrganizationGroupResponse;\nexport const isCreateOrganizationOperationRequest = isCreateOrganizationRequest;\nexport const isCreateOrganizationOperationResponse =\n  isCreateOrganizationResponse;\nexport const isDeleteOrganizationGroupOperationResponse =\n  isDeleteOrganizationGroupResponse;\nexport const isGetOrganizationDataUsageOperationResponse =\n  isOrganizationDataUsageResponse;\nexport const isGetOrganizationReadModelOperationResponse =\n  isOrganizationReadModelResponse;\nexport const isListOrganizationGroupMembersOperationResponse =\n  isOrganizationGroupMembersResponse;\nexport const isUpdateOrganizationProfileOperationRequest =\n  isUpdateOrganizationProfileRequest;\nexport const isUpdateOrganizationProfileOperationResponse =\n  isOrganizationProfileResponse;\nexport const isUpdateOrganizationRosterEntryOperationRequest =\n  isUpdateOrganizationRosterEntryRequest;\nexport const isUpdateOrganizationRosterEntryOperationResponse =\n  isOrganizationDirectoryUserResponse;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/containers/child/carriedDescendantRekeys.js

@@ -2,6 +2,7 @@ import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../internal/validators/util
 import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification.js";
 import { buildMaterializedContainerRekeyPlan } from "./rekey.js";
 import { rebaseContainerWriterProjection } from "./rekeyProjection.js";
+import { selectReplacementPrincipalPolicyReferences } from "./replacementPrincipalPolicyReferences.js";
 /**
  * Re-root a served projection on the deepest not-yet-accepted proper ancestor
  * among `speculativePaths`. Each carried plan's own path was built the same
@@ -67,7 +68,14 @@ export async function planCarriedDescendantRekey(input) {
         persistVerificationCheckpoints: false,
         previousProjection: rebased.projection,
         principalPolicyCache: input.principalPolicyCache,
-        replacementPrincipalPolicy: input.replacementPrincipalPolicy,
+        replacementPrincipalPolicy: input.replacementPrincipalPolicy
+            ? await selectReplacementPrincipalPolicyReferences({
+                policy: input.replacementPrincipalPolicy,
+                projection: rebased.projection,
+                principalPolicyCache: input.principalPolicyCache,
+                resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,
+            })
+            : undefined,
         resolveProjectionUserKey: input.resolveProjectionUserKey,
         stillCurrent: input.stillCurrent,
         targetSecretKey: input.targetSecretKey,

package/workflows/containers/child/carriedDescendantRekeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"carriedDescendantRekeys.js","sourceRoot":"","sources":["carriedDescendantRekeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAM3E,OAAO,EAIL,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAkCpE;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyC,EACzC,gBAA4C;IAK5C,IAAI,OAAO,GAA2B,IAAI,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,MAAM,WAAW,IAAI,gBAAgB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAClE,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,WAAW,CACzC,CAAC;QACF,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,OAAO,GAAG,WAAW,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,+BAA+B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAGC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc;SAChD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mEAAmE;QACnE,8BAA8B,EAAE,KAAK;QACrC,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAIC;IAED,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAsB,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B;YAAE,MAAM;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS;QACvC,MAAM,MAAM,GACV,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;YAC5C,GAAG,KAAK;YACR,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildMaterializedContainerRekeyPlan } from \"./rekey\";\nimport { rebaseContainerWriterProjection } from \"./rekeyProjection\";\n\n/** What a rotation needs in hand to sign the descendant rekeys it must carry. */\nexport interface CarriedRekeyPlanningInput {\n  readonly apiClient: Pick<ContainerRekeyApi, \"getContainerWriterProjection\">;\n  readonly author: ContainerMutationAuthor;\n  readonly execSql: ExecSql;\n  /**\n   * Keys the batch minted and has yet to commit, by epoch id. A rotation's\n   * successor is wrapped to recipients at heads the batch itself commits, so\n   * no wrap on a re-rooted path opens it for the signer before then; the key\n   * the signer just minted does, and its keyring then opens what sits below.\n   */\n  readonly knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /**\n   * Verified policies the batch itself commits, which the rebased paths cite\n   * before any store holds them; and the one each carried rekey cites anew.\n   */\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly targetSecretKey: Uint8Array;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/** A rotated container's own path once its batch is accepted. */\nexport type SpeculativePath = Pick<\n  ContainerWriterProjectionResponse,\n  \"containerKeks\" | \"organizationId\" | \"path\" | \"policyEvidence\"\n>;\n\n/**\n * Re-root a served projection on the deepest not-yet-accepted proper ancestor\n * among `speculativePaths`. Each carried plan's own path was built the same\n * way, so the deepest one already holds every speculative level above it. The\n * container's own path, when the batch rotates it too, is not an ancestor: the\n * caller is re-planning that rotation, and it extends what sits above.\n */\nexport function rebaseOnDeepestAncestor(\n  served: ContainerWriterProjectionResponse,\n  speculativePaths: readonly SpeculativePath[],\n): {\n  ancestor: SpeculativePath;\n  projection: ContainerWriterProjectionResponse;\n} | null {\n  let deepest: SpeculativePath | null = null;\n  let deepestIndex = -1;\n  for (const speculative of speculativePaths) {\n    const containerId = speculative.containerKeks.at(-1)?.containerId;\n    if (containerId === served.containerId) continue;\n    const index = served.containerKeks.findIndex(\n      (kek) => kek.containerId === containerId,\n    );\n    if (index > deepestIndex) {\n      deepest = speculative;\n      deepestIndex = index;\n    }\n  }\n  if (!deepest) return null;\n  const projection = rebaseContainerWriterProjection(served, deepest);\n  return projection ? { ancestor: deepest, projection } : null;\n}\n\n/**\n * Sign one carried rekey against the path its batch will leave behind. The\n * served projection is fetched by the caller; here it is verified, must sit\n * below one of the rotated containers and in that container's organization,\n * and is signed only if this signer holds its key and write access — which a\n * member able to rotate the ancestor always does, since both inherit downward.\n */\nexport async function planCarriedDescendantRekey(\n  input: CarriedRekeyPlanningInput & {\n    readonly rotated: readonly SpeculativePath[];\n    readonly served: ContainerWriterProjectionResponse;\n  },\n): Promise<MaterializedContainerRekeyPlan> {\n  // Pin the served head before signing beyond it. The batch is acknowledged\n  // against the latest durable pin, and a carried rekey is always past epoch\n  // 1, so a device that never pinned this container would otherwise reject\n  // its own batch after the server had committed it.\n  await verifyContainerWriterProjection({\n    execSql: input.execSql,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.served,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const rebased = rebaseOnDeepestAncestor(input.served, input.rotated);\n  if (!rebased) {\n    throw new Error(\n      \"Carried descendant rekey is not below the rotated container\",\n    );\n  }\n  // A batch locks whatever organizations it names, so the server holds each\n  // to the rule on its own; a carried rekey belongs to the rotation it rides.\n  if (input.served.organizationId !== rebased.ancestor.organizationId) {\n    throw new Error(\n      \"Carried descendant rekey is outside the rotated container's organization\",\n    );\n  }\n  return buildMaterializedContainerRekeyPlan({\n    author: {\n      ...input.author,\n      organizationId: rebased.ancestor.organizationId,\n    },\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    // Nothing here is acknowledged yet: pins move only with the batch.\n    persistVerificationCheckpoints: false,\n    previousProjection: rebased.projection,\n    principalPolicyCache: input.principalPolicyCache,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n\n/**\n * Sign the descendant rekeys a rotation must commit with (#2340). The server\n * refuses a rotation that would leave a level above a directly granted\n * container pinned to a retired epoch, because the grantee could never re-key\n * that level itself and its writes would wait on another device. It names the\n * levels; this signs them, parent-first, each against the path the batch will\n * leave behind rather than the one currently served.\n *\n * `requiredContainerIds` is a hint, never an authority: each container is\n * fetched and verified here, and refused unless it sits below a rotation.\n */\nexport async function planCarriedDescendantRekeys(\n  input: CarriedRekeyPlanningInput & {\n    readonly requiredContainerIds: readonly string[];\n    /** Each rotated container's own path once the batch is accepted. */\n    readonly rotated: readonly SpeculativePath[];\n  },\n): Promise<MaterializedContainerRekeyPlan[]> {\n  const plans: MaterializedContainerRekeyPlan[] = [];\n  const speculativePaths: SpeculativePath[] = [...input.rotated];\n  const knownContainerKeks = new Map(input.knownContainerKeks);\n  const planned = new Set<string>();\n  for (const containerId of input.requiredContainerIds) {\n    if (plans.length >= MAX_ROTATION_CONTAINER_REKEYS) break;\n    if (planned.has(containerId)) continue;\n    const served =\n      await input.apiClient.getContainerWriterProjection(containerId);\n    if (!served) {\n      throw new Error(\"Carried descendant rekey projection is unavailable\");\n    }\n    if (served.containerId !== containerId) {\n      throw new Error(\"Carried descendant rekey targets another container\");\n    }\n    const plan = await planCarriedDescendantRekey({\n      ...input,\n      knownContainerKeks,\n      rotated: speculativePaths,\n      served,\n    });\n    planned.add(containerId);\n    plans.push(plan);\n    speculativePaths.push(plan.writerProjection);\n    knownContainerKeks.set(plan.plan.containerKeyEpochId, plan.containerKey);\n  }\n  return plans;\n}\n"]}
+{"version":3,"file":"carriedDescendantRekeys.js","sourceRoot":"","sources":["carriedDescendantRekeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAM3E,OAAO,EAIL,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAuCpG;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyC,EACzC,gBAA4C;IAK5C,IAAI,OAAO,GAA2B,IAAI,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,MAAM,WAAW,IAAI,gBAAgB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAClE,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,WAAW,CACzC,CAAC;QACF,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,OAAO,GAAG,WAAW,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,+BAA+B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAGC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc;SAChD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mEAAmE;QACnE,8BAA8B,EAAE,KAAK;QACrC,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC1D,CAAC,CAAC,MAAM,0CAA0C,CAAC;gBAC/C,MAAM,EAAE,KAAK,CAAC,0BAA0B;gBACxC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;aACxC,CAAC;YACJ,CAAC,CAAC,SAAS;QACb,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAIC;IAED,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAsB,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B;YAAE,MAAM;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS;QACvC,MAAM,MAAM,GACV,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;YAC5C,GAAG,KAAK;YACR,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  verifyContainerWriterProjection,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildMaterializedContainerRekeyPlan } from \"./rekey\";\nimport { rebaseContainerWriterProjection } from \"./rekeyProjection\";\nimport { selectReplacementPrincipalPolicyReferences } from \"./replacementPrincipalPolicyReferences\";\n\n/** What a rotation needs in hand to sign the descendant rekeys it must carry. */\nexport interface CarriedRekeyPlanningInput {\n  readonly apiClient: Pick<ContainerRekeyApi, \"getContainerWriterProjection\">;\n  readonly author: ContainerMutationAuthor;\n  readonly execSql: ExecSql;\n  /**\n   * Keys the batch minted and has yet to commit, by epoch id. A rotation's\n   * successor is wrapped to recipients at heads the batch itself commits, so\n   * no wrap on a re-rooted path opens it for the signer before then; the key\n   * the signer just minted does, and its keyring then opens what sits below.\n   */\n  readonly knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /**\n   * Verified policies the batch itself commits, which the rebased paths cite\n   * before any store holds them; and the one each carried rekey cites anew.\n   */\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly targetSecretKey: Uint8Array;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/** A rotated container's own path once its batch is accepted. */\nexport type SpeculativePath = Pick<\n  ContainerWriterProjectionResponse,\n  \"containerKeks\" | \"organizationId\" | \"path\" | \"policyEvidence\"\n>;\n\n/**\n * Re-root a served projection on the deepest not-yet-accepted proper ancestor\n * among `speculativePaths`. Each carried plan's own path was built the same\n * way, so the deepest one already holds every speculative level above it. The\n * container's own path, when the batch rotates it too, is not an ancestor: the\n * caller is re-planning that rotation, and it extends what sits above.\n */\nexport function rebaseOnDeepestAncestor(\n  served: ContainerWriterProjectionResponse,\n  speculativePaths: readonly SpeculativePath[],\n): {\n  ancestor: SpeculativePath;\n  projection: ContainerWriterProjectionResponse;\n} | null {\n  let deepest: SpeculativePath | null = null;\n  let deepestIndex = -1;\n  for (const speculative of speculativePaths) {\n    const containerId = speculative.containerKeks.at(-1)?.containerId;\n    if (containerId === served.containerId) continue;\n    const index = served.containerKeks.findIndex(\n      (kek) => kek.containerId === containerId,\n    );\n    if (index > deepestIndex) {\n      deepest = speculative;\n      deepestIndex = index;\n    }\n  }\n  if (!deepest) return null;\n  const projection = rebaseContainerWriterProjection(served, deepest);\n  return projection ? { ancestor: deepest, projection } : null;\n}\n\n/**\n * Sign one carried rekey against the path its batch will leave behind. The\n * served projection is fetched by the caller; here it is verified, must sit\n * below one of the rotated containers and in that container's organization,\n * and is signed only if this signer holds its key and write access — which a\n * member able to rotate the ancestor always does, since both inherit downward.\n */\nexport async function planCarriedDescendantRekey(\n  input: CarriedRekeyPlanningInput & {\n    readonly rotated: readonly SpeculativePath[];\n    readonly served: ContainerWriterProjectionResponse;\n  },\n): Promise<MaterializedContainerRekeyPlan> {\n  // Pin the served head before signing beyond it. The batch is acknowledged\n  // against the latest durable pin, and a carried rekey is always past epoch\n  // 1, so a device that never pinned this container would otherwise reject\n  // its own batch after the server had committed it.\n  await verifyContainerWriterProjection({\n    execSql: input.execSql,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.served,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const rebased = rebaseOnDeepestAncestor(input.served, input.rotated);\n  if (!rebased) {\n    throw new Error(\n      \"Carried descendant rekey is not below the rotated container\",\n    );\n  }\n  // A batch locks whatever organizations it names, so the server holds each\n  // to the rule on its own; a carried rekey belongs to the rotation it rides.\n  if (input.served.organizationId !== rebased.ancestor.organizationId) {\n    throw new Error(\n      \"Carried descendant rekey is outside the rotated container's organization\",\n    );\n  }\n  return buildMaterializedContainerRekeyPlan({\n    author: {\n      ...input.author,\n      organizationId: rebased.ancestor.organizationId,\n    },\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    // Nothing here is acknowledged yet: pins move only with the batch.\n    persistVerificationCheckpoints: false,\n    previousProjection: rebased.projection,\n    principalPolicyCache: input.principalPolicyCache,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy\n      ? await selectReplacementPrincipalPolicyReferences({\n          policy: input.replacementPrincipalPolicy,\n          projection: rebased.projection,\n          principalPolicyCache: input.principalPolicyCache,\n          resolveAuthoredPolicyReferences:\n            input.resolveAuthoredPolicyReferences,\n        })\n      : undefined,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n\n/**\n * Sign the descendant rekeys a rotation must commit with (#2340). The server\n * refuses a rotation that would leave a level above a directly granted\n * container pinned to a retired epoch, because the grantee could never re-key\n * that level itself and its writes would wait on another device. It names the\n * levels; this signs them, parent-first, each against the path the batch will\n * leave behind rather than the one currently served.\n *\n * `requiredContainerIds` is a hint, never an authority: each container is\n * fetched and verified here, and refused unless it sits below a rotation.\n */\nexport async function planCarriedDescendantRekeys(\n  input: CarriedRekeyPlanningInput & {\n    readonly requiredContainerIds: readonly string[];\n    /** Each rotated container's own path once the batch is accepted. */\n    readonly rotated: readonly SpeculativePath[];\n  },\n): Promise<MaterializedContainerRekeyPlan[]> {\n  const plans: MaterializedContainerRekeyPlan[] = [];\n  const speculativePaths: SpeculativePath[] = [...input.rotated];\n  const knownContainerKeks = new Map(input.knownContainerKeks);\n  const planned = new Set<string>();\n  for (const containerId of input.requiredContainerIds) {\n    if (plans.length >= MAX_ROTATION_CONTAINER_REKEYS) break;\n    if (planned.has(containerId)) continue;\n    const served =\n      await input.apiClient.getContainerWriterProjection(containerId);\n    if (!served) {\n      throw new Error(\"Carried descendant rekey projection is unavailable\");\n    }\n    if (served.containerId !== containerId) {\n      throw new Error(\"Carried descendant rekey targets another container\");\n    }\n    const plan = await planCarriedDescendantRekey({\n      ...input,\n      knownContainerKeks,\n      rotated: speculativePaths,\n      served,\n    });\n    planned.add(containerId);\n    plans.push(plan);\n    speculativePaths.push(plan.writerProjection);\n    knownContainerKeks.set(plan.plan.containerKeyEpochId, plan.containerKey);\n  }\n  return plans;\n}\n"]}

package/workflows/containers/child/replacementPrincipalPolicyReferences.js

@@ -0,0 +1,19 @@
+import { readContainerState } from "../../../data/containers/shared/projection.js";
+import { dedupeReferencedPrincipalStates, referencedPrincipalPolicyKey, } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
+/** Current membership with only the historical group citations this path uses. */
+export async function selectReplacementPrincipalPolicyReferences(input) {
+    if (!("retainedHistory" in input.policy) ||
+        !input.resolveAuthoredPolicyReferences)
+        return input.policy;
+    const references = dedupeReferencedPrincipalStates(input.projection.path
+        .flatMap((manifest) => readContainerState(manifest).referencedPrincipalHeads)
+        .filter((reference) => reference.principalType === input.policy.principalType &&
+        reference.principalId === input.policy.principalId));
+    const selected = await input.resolveAuthoredPolicyReferences(input.policy, references);
+    // Planning is sequential: each path selects its own citations before use.
+    // Only speculative successor citations use this cache entry. Served historical
+    // references still resolve to acknowledged policies and cannot pin our new head.
+    input.principalPolicyCache?.set(referencedPrincipalPolicyKey(selected.state), selected);
+    return selected;
+}
+//# sourceMappingURL=replacementPrincipalPolicyReferences.js.map

package/workflows/containers/child/replacementPrincipalPolicyReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replacementPrincipalPolicyReferences.js","sourceRoot":"","sources":["replacementPrincipalPolicyReferences.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,iEAAiE,CAAC;AAIzE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAOhE;IACC,IACE,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM,CAAC;QACpC,CAAC,KAAK,CAAC,+BAA+B;QAEtC,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,+BAA+B,CAChD,KAAK,CAAC,UAAU,CAAC,IAAI;SAClB,OAAO,CACN,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,wBAAwB,CACpE;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,MAAM,CAAC,aAAa;QACtD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CACrD,CACJ,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+BAA+B,CAC1D,KAAK,CAAC,MAAM,EACZ,UAAU,CACX,CAAC;IACF,0EAA0E;IAC1E,+EAA+E;IAC/E,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAC7B,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5C,QAAQ,CACT,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { readContainerState } from \"../../../data/containers/shared/projection\";\nimport type { PrincipalPolicyCache } from \"../../../data/keyingProjectionVerification\";\nimport {\n  dedupeReferencedPrincipalStates,\n  referencedPrincipalPolicyKey,\n} from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\n/** Current membership with only the historical group citations this path uses. */\nexport async function selectReplacementPrincipalPolicyReferences(input: {\n  readonly policy: PrincipalPolicyCurrentEvidence;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n  if (\n    !(\"retainedHistory\" in input.policy) ||\n    !input.resolveAuthoredPolicyReferences\n  )\n    return input.policy;\n  const references = dedupeReferencedPrincipalStates(\n    input.projection.path\n      .flatMap(\n        (manifest) => readContainerState(manifest).referencedPrincipalHeads,\n      )\n      .filter(\n        (reference) =>\n          reference.principalType === input.policy.principalType &&\n          reference.principalId === input.policy.principalId,\n      ),\n  );\n  const selected = await input.resolveAuthoredPolicyReferences(\n    input.policy,\n    references,\n  );\n  // Planning is sequential: each path selects its own citations before use.\n  // Only speculative successor citations use this cache entry. Served historical\n  // references still resolve to acknowledged policies and cannot pin our new head.\n  input.principalPolicyCache?.set(\n    referencedPrincipalPolicyKey(selected.state),\n    selected,\n  );\n  return selected;\n}\n"]}

package/workflows/organizations/commitCurrentGroupPolicyMutation.js

@@ -0,0 +1,72 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { prepareAuthoredGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
+import { submitGroupPolicyCommit, } from "./groupPolicyMutationContext.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+/** Commit and retain one exact compound successor without rebuilding full history. */
+export async function commitCurrentGroupPolicyMutation(input) {
+    const { context } = input;
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const [signer] = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: [input.signerUserId],
+    });
+    if (!signer)
+        throw new Error("Group policy signer is unavailable");
+    const expectedHead = await groupPolicyMutationHead(input.request);
+    const nextPolicy = await prepareAuthoredGroupPolicy({
+        verifiedCurrentPolicy: context.verifiedCurrentPolicy,
+        expectedHead,
+        request: input.request,
+        signerPublicKeys: [signer],
+        externalAuthority: context.externalAuthority,
+        localPolicyCheckpoint: context.localPolicyCheckpoint,
+        stillCurrent: context.stillCurrent,
+    });
+    const prepared = await input.prepareContainerMutations(nextPolicy);
+    input.request.containerMutations = [...prepared.requests];
+    const adminProjection = context.isOrganizationAdminsGroup
+        ? input.request.projection
+        : context.adminCurrent.current.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(adminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection,
+        adminUsers,
+        currentPolicy: context.organizationCurrent.current,
+        descriptor: context.organizationDescriptor,
+        groupHeads: replaceOrganizationGroupHead({
+            descriptor: context.organizationDescriptor,
+            nextHead: expectedHead,
+        }),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const response = await submitGroupPolicyCommit({
+        apiClient: input.apiClient,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        request: input.request,
+        organizationRequest,
+        carryDescendantRekeys: prepared.carry,
+        stillCurrent: context.stillCurrent,
+    });
+    if (!response)
+        throw new Error("Group policy update failed");
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    await context.retainAcknowledged({
+        request: input.request,
+        organizationRequest,
+        response,
+        retiredContainerIds: prepared.retiredContainerIds,
+    });
+    await prepared.acknowledge(response.groupPolicy.containerMutations, context.stillCurrent);
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    return response.groupPolicy;
+}
+//# sourceMappingURL=commitCurrentGroupPolicyMutation.js.map

package/workflows/organizations/commitCurrentGroupPolicyMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitCurrentGroupPolicyMutation.js","sourceRoot":"","sources":["commitCurrentGroupPolicyMutation.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAatD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,6BAA6B,CAAC;QACnD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC;QAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACnE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB;QACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,mBAAmB,CAAC,OAAO;QAClD,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,sBAAsB;YAC1C,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,qBAAqB,EAAE,QAAQ,CAAC,KAAK;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,QAAQ;QACR,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,WAAW,CACxB,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EACvC,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC","sourcesContent":["import type {\n  SigningKeyPair,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  type PrincipalPolicyReadWriteApi,\n  submitGroupPolicyCommit,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport type { PreparedPrincipalContainerRematerializationBatch } from \"./principalContainerRematerialization\";\nimport type { RuntimeCurrentGroupMutationContext } from \"./runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\n/** Commit and retain one exact compound successor without rebuilding full history. */\nexport async function commitCurrentGroupPolicyMutation(input: {\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly context: RuntimeCurrentGroupMutationContext;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly prepareContainerMutations: (\n    nextPolicy: VerifiedPrincipalPolicyCurrent,\n  ) => Promise<PreparedPrincipalContainerRematerializationBatch>;\n}): Promise<PrincipalPolicyMutationResponse> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const [signer] = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [input.signerUserId],\n  });\n  if (!signer) throw new Error(\"Group policy signer is unavailable\");\n  const expectedHead = await groupPolicyMutationHead(input.request);\n  const nextPolicy = await prepareAuthoredGroupPolicy({\n    verifiedCurrentPolicy: context.verifiedCurrentPolicy,\n    expectedHead,\n    request: input.request,\n    signerPublicKeys: [signer],\n    externalAuthority: context.externalAuthority,\n    localPolicyCheckpoint: context.localPolicyCheckpoint,\n    stillCurrent: context.stillCurrent,\n  });\n  const prepared = await input.prepareContainerMutations(nextPolicy);\n  input.request.containerMutations = [...prepared.requests];\n  const adminProjection = context.isOrganizationAdminsGroup\n    ? input.request.projection\n    : context.adminCurrent.current.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: context.organizationCurrent.current,\n      descriptor: context.organizationDescriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: context.organizationDescriptor,\n        nextHead: expectedHead,\n      }),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const response = await submitGroupPolicyCommit({\n    apiClient: input.apiClient,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    request: input.request,\n    organizationRequest,\n    carryDescendantRekeys: prepared.carry,\n    stillCurrent: context.stillCurrent,\n  });\n  if (!response) throw new Error(\"Group policy update failed\");\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  await context.retainAcknowledged({\n    request: input.request,\n    organizationRequest,\n    response,\n    retiredContainerIds: prepared.retiredContainerIds,\n  });\n  await prepared.acknowledge(\n    response.groupPolicy.containerMutations,\n    context.stillCurrent,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return response.groupPolicy;\n}\n"]}