@tearleads/client-sdk 0.1.48 → 0.1.50

package/client/organizations/currentPrincipalMutations.js

@@ -16,30 +16,49 @@ export function createCurrentPrincipalMutation(input) {
         signerUserId: input.signerUserId,
         stillCurrent: input.stillCurrent,
     }, async (context) => {
-        const request = await buildCurrentMutationRequest(input, context, mutation);
-        assertProjectionVerificationCurrent(context.stillCurrent);
-        const response = await commitCurrentGroupPolicyMutation({
-            ...input,
-            apiClient: input.runtime.apiClient,
-            groupId,
-            context,
-            request,
-            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-            prepareContainerMutations: (nextPolicy) => preparePrincipalContainerMutations({
-                currentPolicy: context.currentPolicy,
+        const prepareChange = async (selected, change) => ({
+            context: selected,
+            request: await buildCurrentMutationRequest(input, selected, change),
+            prepareContainerMutations: (nextPolicy, preceding) => preparePrincipalContainerMutations({
+                preceding,
+                currentPolicy: selected.currentPolicy,
                 nextPolicy,
-                groupId,
+                groupId: selected.currentPolicy.currentState.principalId,
                 organizationId: input.organizationId,
                 runtime: input.runtime,
-                stillCurrent: context.stillCurrent,
+                stillCurrent: selected.stillCurrent,
                 recitationStillCurrent: input.stillCurrent,
-                resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,
-                revokedContainerId: mutation.kind === "revoke"
-                    ? mutation.revokedContainerId
+                resolveAuthoredPolicyReferences: selected.resolveAuthoredPolicyReferences,
+                revokedContainerId: change.kind === "revoke"
+                    ? change.revokedContainerId
                     : undefined,
             }),
         });
-        return { response, memberGroupId: context.memberGroupId };
+        const primary = await prepareChange(context, mutation);
+        let member;
+        if (mutation.kind === "add" && groupId !== context.memberGroupId) {
+            const members = await context.loadGroup(context.memberGroupId);
+            if (!members.currentPolicy.currentProjection.some((entry) => entry.userId === mutation.targetUserId)) {
+                member = await prepareChange(members, {
+                    ...mutation,
+                    expectedGroupName: "Members",
+                });
+            }
+        }
+        assertProjectionVerificationCurrent(context.stillCurrent);
+        const response = await commitCurrentGroupPolicyMutation({
+            ...input,
+            apiClient: input.runtime.apiClient,
+            groupId,
+            ...primary,
+            member,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        });
+        return {
+            response,
+            memberGroupId: context.memberGroupId,
+            enrolled: Boolean(member),
+        };
     });
 }
 async function buildCurrentMutationRequest(input, context, mutation) {

package/client/organizations/currentPrincipalMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentPrincipalMutations.js","sourceRoot":"","sources":["currentPrincipalMutations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,iCAAiC,GAElC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAyBnF,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAe,EAAE,QAA8B,EAAE,EAAE,CACzD,MAAM,CACJ;QACE,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAC/C,KAAK,EACL,OAAO,EACP,QAAQ,CACT,CAAC;QACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO;YACP,OAAO;YACP,OAAO;YACP,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,yBAAyB,EAAE,CAAC,UAAU,EAAE,EAAE,CACxC,kCAAkC,CAAC;gBACjC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU;gBACV,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,sBAAsB,EAAE,KAAK,CAAC,YAAY;gBAC1C,+BAA+B,EAC7B,OAAO,CAAC,+BAA+B;gBACzC,kBAAkB,EAChB,QAAQ,CAAC,IAAI,KAAK,QAAQ;oBACxB,CAAC,CAAC,QAAQ,CAAC,kBAAkB;oBAC7B,CAAC,CAAC,SAAS;aAChB,CAAC;SACL,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC,CACF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAoC,EACpC,OAA2C,EAC3C,QAA8B;IAE9B,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAC7B,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAE,EAAE,CAClD,6BAA6B,CAAC;QAC5B,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,OAAO;KACR,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAC3D,IAAI,OAAkC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACvD,IAAI,CAAC,oBAAoB;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;YACpC,GAAG,iBAAiB,CAAC,UAAU,CAAC;YAChC,QAAQ,CAAC,YAAY;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,8BAA8B,CAAC;YAC7C,GAAG,MAAM;YACT,oBAAoB;YACpB,UAAU;YACV,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,MAAM,iCAAiC,CAAC;YAChD,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,MAAM,YAAY,CAChC,iBAAiB,CACf,UAAU,CAAC,MAAM,CACf,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CACrD,CACF,CACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,sCAAsC,CAAC;YACrD,GAAG,MAAM;YACT,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../workflows/organizations/commitCurrentGroupPolicyMutation\";\nimport { assertGroupMembershipName } from \"../../workflows/organizations/groupMembershipName\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n} from \"../../workflows/organizations/groupPolicyRequests\";\nimport {\n  createRuntimeCurrentGroupMutation,\n  type RuntimeCurrentGroupMutationContext,\n} from \"../../workflows/organizations/runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../../workflows/organizations/trustedOrganizationUsers\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\ntype CurrentGroupMutation =\n  | {\n      readonly kind: \"add\";\n      readonly expectedGroupName: string;\n      readonly targetUserId: string;\n    }\n  | {\n      readonly kind: \"remove\";\n      readonly expectedGroupName: string;\n      readonly removedUserId: string;\n    }\n  | { readonly kind: \"revoke\"; readonly revokedContainerId: string };\n\n/** Built-in hosts with private custody use bounded current-policy mutation work. */\ninterface CurrentPrincipalMutationInput {\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent: () => boolean;\n}\n\nexport function createCurrentPrincipalMutation(\n  input: CurrentPrincipalMutationInput,\n) {\n  const mutate = createRuntimeCurrentGroupMutation(input.runtime);\n  if (!mutate) return undefined;\n  return (groupId: string, mutation: CurrentGroupMutation) =>\n    mutate(\n      {\n        groupId,\n        organizationId: input.organizationId,\n        signerUserId: input.signerUserId,\n        stillCurrent: input.stillCurrent,\n      },\n      async (context) => {\n        const request = await buildCurrentMutationRequest(\n          input,\n          context,\n          mutation,\n        );\n        assertProjectionVerificationCurrent(context.stillCurrent);\n        const response = await commitCurrentGroupPolicyMutation({\n          ...input,\n          apiClient: input.runtime.apiClient,\n          groupId,\n          context,\n          request,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n          prepareContainerMutations: (nextPolicy) =>\n            preparePrincipalContainerMutations({\n              currentPolicy: context.currentPolicy,\n              nextPolicy,\n              groupId,\n              organizationId: input.organizationId,\n              runtime: input.runtime,\n              stillCurrent: context.stillCurrent,\n              recitationStillCurrent: input.stillCurrent,\n              resolveAuthoredPolicyReferences:\n                context.resolveAuthoredPolicyReferences,\n              revokedContainerId:\n                mutation.kind === \"revoke\"\n                  ? mutation.revokedContainerId\n                  : undefined,\n            }),\n        });\n        return { response, memberGroupId: context.memberGroupId };\n      },\n    );\n}\n\nasync function buildCurrentMutationRequest(\n  input: CurrentPrincipalMutationInput,\n  context: RuntimeCurrentGroupMutationContext,\n  mutation: CurrentGroupMutation,\n): Promise<PutPrincipalPolicyRequest> {\n  const shared = {\n    ...context,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n  if (mutation.kind !== \"revoke\") {\n    await assertGroupMembershipName(\n      context.currentPolicy,\n      mutation.expectedGroupName,\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        input.organizationId,\n        context.stillCurrent,\n        context.verifyMetadataContainer,\n      ).readName,\n    );\n  }\n  const resolveUsers = (userIds: readonly string[]) =>\n    resolveRequiredUserIdentities({\n      resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n      userIds,\n    });\n  const projection = context.currentPolicy.currentProjection;\n  let request: PutPrincipalPolicyRequest;\n  if (mutation.kind === \"add\") {\n    const currentUserSecretKey =\n      input.runtime.crypto.encapsulationKeyPair?.secretKey;\n    if (!currentUserSecretKey)\n      throw new Error(\"Organization encryption context is unavailable\");\n    const identities = await resolveUsers([\n      ...projectionUserIds(projection),\n      mutation.targetUserId,\n    ]);\n    const targetUser = identities.find(\n      (identity) => identity.userId === mutation.targetUserId,\n    );\n    if (!targetUser) throw new Error(\"Group target identity is unavailable\");\n    request = await buildAddGroupUserPolicyRequest({\n      ...shared,\n      currentUserSecretKey,\n      targetUser,\n      currentUsers: identities.filter(\n        (identity) => identity.userId !== mutation.targetUserId,\n      ),\n      reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    });\n  } else if (mutation.kind === \"remove\") {\n    request = await buildRemoveGroupUserPolicyRequest({\n      ...shared,\n      removedUserId: mutation.removedUserId,\n      remainingUsers: await resolveUsers(\n        projectionUserIds(\n          projection.filter(\n            (member) => member.userId !== mutation.removedUserId,\n          ),\n        ),\n      ),\n    });\n  } else {\n    request = await buildGroupAccessSetShrinkPolicyRequest({\n      ...shared,\n      revokedContainerId: mutation.revokedContainerId,\n      currentUsers: await resolveUsers(projectionUserIds(projection)),\n    });\n  }\n\n  return request;\n}\n"]}
+{"version":3,"file":"currentPrincipalMutations.js","sourceRoot":"","sources":["currentPrincipalMutations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,iCAAiC,GAElC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAyBnF,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAe,EAAE,QAA8B,EAAE,EAAE,CACzD,MAAM,CACJ;QACE,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,KAAK,EACzB,QAA4C,EAC5C,MAA4B,EAC5B,EAAE,CAAC,CAAC;YACJ,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,2BAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;YACnE,yBAAyB,EAAE,CACzB,UAEkB,EAClB,SAEiB,EACjB,EAAE,CACF,kCAAkC,CAAC;gBACjC,SAAS;gBACT,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,UAAU;gBACV,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;gBACxD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,sBAAsB,EAAE,KAAK,CAAC,YAAY;gBAC1C,+BAA+B,EAC7B,QAAQ,CAAC,+BAA+B;gBAC1C,kBAAkB,EAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;oBACtB,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,SAAS;aAChB,CAAC;SACL,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,MAA6D,CAAC;QAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/D,IACE,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAClD,EACD,CAAC;gBACD,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;oBACpC,GAAG,QAAQ;oBACX,iBAAiB,EAAE,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO;YACP,GAAG,OAAO;YACV,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;SACrE,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAoC,EACpC,OAA2C,EAC3C,QAA8B;IAE9B,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAC7B,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAE,EAAE,CAClD,6BAA6B,CAAC;QAC5B,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,OAAO;KACR,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAC3D,IAAI,OAAkC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACvD,IAAI,CAAC,oBAAoB;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;YACpC,GAAG,iBAAiB,CAAC,UAAU,CAAC;YAChC,QAAQ,CAAC,YAAY;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,8BAA8B,CAAC;YAC7C,GAAG,MAAM;YACT,oBAAoB;YACpB,UAAU;YACV,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,MAAM,iCAAiC,CAAC;YAChD,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,MAAM,YAAY,CAChC,iBAAiB,CACf,UAAU,CAAC,MAAM,CACf,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CACrD,CACF,CACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,sCAAsC,CAAC;YACrD,GAAG,MAAM;YACT,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../workflows/organizations/commitCurrentGroupPolicyMutation\";\nimport { assertGroupMembershipName } from \"../../workflows/organizations/groupMembershipName\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n} from \"../../workflows/organizations/groupPolicyRequests\";\nimport {\n  createRuntimeCurrentGroupMutation,\n  type RuntimeCurrentGroupMutationContext,\n} from \"../../workflows/organizations/runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../../workflows/organizations/trustedOrganizationUsers\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\ntype CurrentGroupMutation =\n  | {\n      readonly kind: \"add\";\n      readonly expectedGroupName: string;\n      readonly targetUserId: string;\n    }\n  | {\n      readonly kind: \"remove\";\n      readonly expectedGroupName: string;\n      readonly removedUserId: string;\n    }\n  | { readonly kind: \"revoke\"; readonly revokedContainerId: string };\n\n/** Built-in hosts with private custody use bounded current-policy mutation work. */\ninterface CurrentPrincipalMutationInput {\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent: () => boolean;\n}\n\nexport function createCurrentPrincipalMutation(\n  input: CurrentPrincipalMutationInput,\n) {\n  const mutate = createRuntimeCurrentGroupMutation(input.runtime);\n  if (!mutate) return undefined;\n  return (groupId: string, mutation: CurrentGroupMutation) =>\n    mutate(\n      {\n        groupId,\n        organizationId: input.organizationId,\n        signerUserId: input.signerUserId,\n        stillCurrent: input.stillCurrent,\n      },\n      async (context) => {\n        const prepareChange = async (\n          selected: RuntimeCurrentGroupMutationContext,\n          change: CurrentGroupMutation,\n        ) => ({\n          context: selected,\n          request: await buildCurrentMutationRequest(input, selected, change),\n          prepareContainerMutations: (\n            nextPolicy: Parameters<\n              typeof preparePrincipalContainerMutations\n            >[0][\"nextPolicy\"],\n            preceding?: Parameters<\n              typeof preparePrincipalContainerMutations\n            >[0][\"preceding\"],\n          ) =>\n            preparePrincipalContainerMutations({\n              preceding,\n              currentPolicy: selected.currentPolicy,\n              nextPolicy,\n              groupId: selected.currentPolicy.currentState.principalId,\n              organizationId: input.organizationId,\n              runtime: input.runtime,\n              stillCurrent: selected.stillCurrent,\n              recitationStillCurrent: input.stillCurrent,\n              resolveAuthoredPolicyReferences:\n                selected.resolveAuthoredPolicyReferences,\n              revokedContainerId:\n                change.kind === \"revoke\"\n                  ? change.revokedContainerId\n                  : undefined,\n            }),\n        });\n        const primary = await prepareChange(context, mutation);\n        let member: Awaited<ReturnType<typeof prepareChange>> | undefined;\n        if (mutation.kind === \"add\" && groupId !== context.memberGroupId) {\n          const members = await context.loadGroup(context.memberGroupId);\n          if (\n            !members.currentPolicy.currentProjection.some(\n              (entry) => entry.userId === mutation.targetUserId,\n            )\n          ) {\n            member = await prepareChange(members, {\n              ...mutation,\n              expectedGroupName: \"Members\",\n            });\n          }\n        }\n        assertProjectionVerificationCurrent(context.stillCurrent);\n        const response = await commitCurrentGroupPolicyMutation({\n          ...input,\n          apiClient: input.runtime.apiClient,\n          groupId,\n          ...primary,\n          member,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        });\n        return {\n          response,\n          memberGroupId: context.memberGroupId,\n          enrolled: Boolean(member),\n        };\n      },\n    );\n}\n\nasync function buildCurrentMutationRequest(\n  input: CurrentPrincipalMutationInput,\n  context: RuntimeCurrentGroupMutationContext,\n  mutation: CurrentGroupMutation,\n): Promise<PutPrincipalPolicyRequest> {\n  const shared = {\n    ...context,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n  if (mutation.kind !== \"revoke\") {\n    await assertGroupMembershipName(\n      context.currentPolicy,\n      mutation.expectedGroupName,\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        input.organizationId,\n        context.stillCurrent,\n        context.verifyMetadataContainer,\n      ).readName,\n    );\n  }\n  const resolveUsers = (userIds: readonly string[]) =>\n    resolveRequiredUserIdentities({\n      resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n      userIds,\n    });\n  const projection = context.currentPolicy.currentProjection;\n  let request: PutPrincipalPolicyRequest;\n  if (mutation.kind === \"add\") {\n    const currentUserSecretKey =\n      input.runtime.crypto.encapsulationKeyPair?.secretKey;\n    if (!currentUserSecretKey)\n      throw new Error(\"Organization encryption context is unavailable\");\n    const identities = await resolveUsers([\n      ...projectionUserIds(projection),\n      mutation.targetUserId,\n    ]);\n    const targetUser = identities.find(\n      (identity) => identity.userId === mutation.targetUserId,\n    );\n    if (!targetUser) throw new Error(\"Group target identity is unavailable\");\n    request = await buildAddGroupUserPolicyRequest({\n      ...shared,\n      currentUserSecretKey,\n      targetUser,\n      currentUsers: identities.filter(\n        (identity) => identity.userId !== mutation.targetUserId,\n      ),\n      reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    });\n  } else if (mutation.kind === \"remove\") {\n    request = await buildRemoveGroupUserPolicyRequest({\n      ...shared,\n      removedUserId: mutation.removedUserId,\n      remainingUsers: await resolveUsers(\n        projectionUserIds(\n          projection.filter(\n            (member) => member.userId !== mutation.removedUserId,\n          ),\n        ),\n      ),\n    });\n  } else {\n    request = await buildGroupAccessSetShrinkPolicyRequest({\n      ...shared,\n      revokedContainerId: mutation.revokedContainerId,\n      currentUsers: await resolveUsers(projectionUserIds(projection)),\n    });\n  }\n\n  return request;\n}\n"]}

package/client/organizations/principalContainerMutations.js

@@ -8,6 +8,7 @@ export async function preparePrincipalContainerMutations(input) {
         throw new Error("Organization container rematerialization context is unavailable");
     }
     return preparePrincipalContainerRematerializationBatch({
+        preceding: input.preceding,
         stillCurrent: input.stillCurrent,
         recitationStillCurrent: input.recitationStillCurrent,
         reportSecurityIncident: input.runtime.util.reportSecurityIncident,

package/client/organizations/principalContainerMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAYxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly organizationId: string;\n  readonly revokedContainerId?: string | undefined;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !targetSecretKey) {\n    throw new Error(\n      \"Organization container rematerialization context is unavailable\",\n    );\n  }\n  return preparePrincipalContainerRematerializationBatch({\n    stillCurrent: input.stillCurrent,\n    recitationStillCurrent: input.recitationStillCurrent,\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient: input.runtime.apiClient,\n    author,\n    execSql: input.runtime.infra.execSql,\n    grants: [\n      ...new Map(\n        [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: input.groupId,\n    nextPolicy: input.nextPolicy,\n    resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n    revokedContainerId: input.revokedContainerId,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n}\n"]}
+{"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly organizationId: string;\n  readonly revokedContainerId?: string | undefined;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !targetSecretKey) {\n    throw new Error(\n      \"Organization container rematerialization context is unavailable\",\n    );\n  }\n  return preparePrincipalContainerRematerializationBatch({\n    preceding: input.preceding,\n    stillCurrent: input.stillCurrent,\n    recitationStillCurrent: input.recitationStillCurrent,\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient: input.runtime.apiClient,\n    author,\n    execSql: input.runtime.infra.execSql,\n    grants: [\n      ...new Map(\n        [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: input.groupId,\n    nextPolicy: input.nextPolicy,\n    resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n    revokedContainerId: input.revokedContainerId,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n}\n"]}

package/client/organizations/principalMutations.js

@@ -44,12 +44,12 @@ export async function addUserToOrganizationGroup(input) {
         });
         if (!mutateCurrent)
             throw new ProjectionDependencyUnavailableError("Principal history recovery is unavailable");
-        const { memberGroupId, response: bundle } = await mutateCurrent(input.groupId, {
+        const { memberGroupId, response: bundle, enrolled, } = await mutateCurrent(input.groupId, {
             kind: "add",
             expectedGroupName: input.expectedGroupName,
             targetUserId: input.targetUserId,
         });
-        if (input.groupId === memberGroupId) {
+        if (input.groupId === memberGroupId || enrolled) {
             await syncOrganizationMetadataProfile({
                 containerContents: input.containerContents,
                 log: input.runtime.util.log,

package/client/organizations/principalMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAiCpF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7D,KAAK,CAAC,OAAO,EACb;YACE,IAAI,EAAE,KAAK;YACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;gBAClD,SAAS,EAAE,OAAO;gBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CACH;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7D,KAAK,CAAC,OAAO,EACb;YACE,IAAI,EAAE,QAAQ;YACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,8BAA8B,CAAC;oBACnD,GAAG,cAAc;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,aAAa;oBAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;gBACJ,OAAO,CACL,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;oBACnC,IAAI,EAAE,QAAQ;oBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;iBACtC,CAAC,CACH,CAAC,QAAQ,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,gCAAgC,CAAC;oBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;oBACD,GAAG,cAAc;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { revokeOrganizationContainerGrant } from \"../../workflows/organizations\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/createCurrentOrganizationGroup\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/deleteCurrentOrganizationGroup\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport interface OrganizationGrantRef {\n  containerId: string;\n  subjectId: string;\n  subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n  groupId: string;\n  expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n  organizationId: string;\n  signerUserId: string;\n  signingFingerprint: string;\n  signingKeyPair: NonNullable<\n    InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n  >;\n}\n\nfunction requireSigningContext(\n  runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.auth.userId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair\n  ) {\n    throw new Error(\"Organization signing context is unavailable\");\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerUserId: runtime.auth.userId,\n    signingFingerprint: runtime.crypto.signingFingerprint,\n    signingKeyPair: runtime.crypto.signingKeyPair,\n  };\n}\n\nfunction requireEncapsulationKeyPair(\n  runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n  if (!runtime.crypto.encapsulationKeyPair) {\n    throw new Error(\"Organization encryption context is unavailable\");\n  }\n\n  return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n  readonly stillCurrent: () => boolean;\n  readonly containerContents: ContainerContents;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n  input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.add\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      if (!mutateCurrent)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      const { memberGroupId, response: bundle } = await mutateCurrent(\n        input.groupId,\n        {\n          kind: \"add\",\n          expectedGroupName: input.expectedGroupName,\n          targetUserId: input.targetUserId,\n        },\n      );\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport function createGroupForOrganization(input: {\n  readonly name: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: signingContext.organizationId,\n      objectKind: \"principal\",\n      operation: \"group.create\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n        input.runtime,\n      );\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (!mutate)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      return mutate(\n        { ...signingContext, stillCurrent: input.stillCurrent },\n        (context) =>\n          createCurrentOrganizationGroup({\n            ...signingContext,\n            context,\n            apiClient: input.runtime.apiClient,\n            creatorEncapsulationKeyPair,\n            execSql: input.runtime.infra.execSql,\n            name: input.name,\n            metadataAccess: createRuntimeGroupMetadataAccess(\n              input.runtime,\n              signingContext.organizationId,\n              context.stillCurrent,\n              createSelectedCurrentGroupMetadataContainerVerifier({\n                authority: context,\n                organizationId: signingContext.organizationId,\n                stillCurrent: context.stillCurrent,\n              }),\n            ),\n            reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n          }),\n      );\n    },\n  );\n}\n\nexport function deleteGroupForOrganization(input: {\n  readonly groupId: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.delete\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (!mutate)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      return mutate(\n        { ...signingContext, stillCurrent: input.stillCurrent },\n        (context) =>\n          deleteCurrentOrganizationGroup({\n            ...signingContext,\n            context,\n            groupId: input.groupId,\n            apiClient: input.runtime.apiClient,\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n          }),\n      );\n    },\n  );\n}\n\nexport async function removeUserFromOrganizationGroup(\n  input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.remove\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      if (!mutateCurrent)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      const { memberGroupId, response: bundle } = await mutateCurrent(\n        input.groupId,\n        {\n          kind: \"remove\",\n          expectedGroupName: input.expectedGroupName,\n          removedUserId: input.removedUserId,\n        },\n      );\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport async function revokeOrganizationGrant(\n  input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n  if (input.runtime.infra.dbStatus !== \"ready\") {\n    throw new Error(\"Organization local database is unavailable\");\n  }\n\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.subjectId,\n      objectKind: \"principal\",\n      operation: \"principal.grant.revoke\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const revoke = async () => {\n        if (input.subjectType === \"group\") {\n          const mutateCurrent = createCurrentPrincipalMutation({\n            ...signingContext,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          });\n          if (!mutateCurrent)\n            throw new ProjectionDependencyUnavailableError(\n              \"Principal history recovery is unavailable\",\n            );\n          return (\n            await mutateCurrent(input.subjectId, {\n              kind: \"revoke\",\n              revokedContainerId: input.containerId,\n            })\n          ).response;\n        } else {\n          return revokeOrganizationContainerGrant({\n            stillCurrent: input.stillCurrent,\n            reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n            apiClient: input.runtime.apiClient,\n            containerId: input.containerId,\n            encapsulationKeyPair,\n            execSql: input.runtime.infra.execSql,\n            revokedSubject: {\n              subjectId: input.subjectId,\n              subjectType: input.subjectType,\n            },\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n              input.runtime,\n            ),\n            ...signingContext,\n          });\n        }\n      };\n      const response = await revoke();\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return response;\n    },\n  );\n}\n"]}
+{"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAiCpF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EACJ,aAAa,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,GACT,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;YACrC,IAAI,EAAE,KAAK;YACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,QAAQ,EAAE,CAAC;YAChD,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;gBAClD,SAAS,EAAE,OAAO;gBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CACH;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7D,KAAK,CAAC,OAAO,EACb;YACE,IAAI,EAAE,QAAQ;YACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,8BAA8B,CAAC;oBACnD,GAAG,cAAc;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,aAAa;oBAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;gBACJ,OAAO,CACL,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;oBACnC,IAAI,EAAE,QAAQ;oBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;iBACtC,CAAC,CACH,CAAC,QAAQ,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,gCAAgC,CAAC;oBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;oBACD,GAAG,cAAc;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { revokeOrganizationContainerGrant } from \"../../workflows/organizations\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/createCurrentOrganizationGroup\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/deleteCurrentOrganizationGroup\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport interface OrganizationGrantRef {\n  containerId: string;\n  subjectId: string;\n  subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n  groupId: string;\n  expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n  extends OrganizationGroupUserMutationInput {\n  removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n  organizationId: string;\n  signerUserId: string;\n  signingFingerprint: string;\n  signingKeyPair: NonNullable<\n    InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n  >;\n}\n\nfunction requireSigningContext(\n  runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n  if (\n    !runtime.auth.organizationId ||\n    !runtime.auth.userId ||\n    !runtime.crypto.signingFingerprint ||\n    !runtime.crypto.signingKeyPair\n  ) {\n    throw new Error(\"Organization signing context is unavailable\");\n  }\n\n  return {\n    organizationId: runtime.auth.organizationId,\n    signerUserId: runtime.auth.userId,\n    signingFingerprint: runtime.crypto.signingFingerprint,\n    signingKeyPair: runtime.crypto.signingKeyPair,\n  };\n}\n\nfunction requireEncapsulationKeyPair(\n  runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n  if (!runtime.crypto.encapsulationKeyPair) {\n    throw new Error(\"Organization encryption context is unavailable\");\n  }\n\n  return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n  readonly stillCurrent: () => boolean;\n  readonly containerContents: ContainerContents;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n  input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.add\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      if (!mutateCurrent)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      const {\n        memberGroupId,\n        response: bundle,\n        enrolled,\n      } = await mutateCurrent(input.groupId, {\n        kind: \"add\",\n        expectedGroupName: input.expectedGroupName,\n        targetUserId: input.targetUserId,\n      });\n      if (input.groupId === memberGroupId || enrolled) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport function createGroupForOrganization(input: {\n  readonly name: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: signingContext.organizationId,\n      objectKind: \"principal\",\n      operation: \"group.create\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n        input.runtime,\n      );\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (!mutate)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      return mutate(\n        { ...signingContext, stillCurrent: input.stillCurrent },\n        (context) =>\n          createCurrentOrganizationGroup({\n            ...signingContext,\n            context,\n            apiClient: input.runtime.apiClient,\n            creatorEncapsulationKeyPair,\n            execSql: input.runtime.infra.execSql,\n            name: input.name,\n            metadataAccess: createRuntimeGroupMetadataAccess(\n              input.runtime,\n              signingContext.organizationId,\n              context.stillCurrent,\n              createSelectedCurrentGroupMetadataContainerVerifier({\n                authority: context,\n                organizationId: signingContext.organizationId,\n                stillCurrent: context.stillCurrent,\n              }),\n            ),\n            reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n          }),\n      );\n    },\n  );\n}\n\nexport function deleteGroupForOrganization(input: {\n  readonly groupId: string;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n}) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.delete\",\n      organizationId: signingContext.organizationId,\n    },\n    () => {\n      const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n      if (!mutate)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      return mutate(\n        { ...signingContext, stillCurrent: input.stillCurrent },\n        (context) =>\n          deleteCurrentOrganizationGroup({\n            ...signingContext,\n            context,\n            groupId: input.groupId,\n            apiClient: input.runtime.apiClient,\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n          }),\n      );\n    },\n  );\n}\n\nexport async function removeUserFromOrganizationGroup(\n  input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.groupId,\n      objectKind: \"principal\",\n      operation: \"group.member.remove\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const mutateCurrent = createCurrentPrincipalMutation({\n        ...signingContext,\n        runtime: input.runtime,\n        stillCurrent: input.stillCurrent,\n      });\n      if (!mutateCurrent)\n        throw new ProjectionDependencyUnavailableError(\n          \"Principal history recovery is unavailable\",\n        );\n      const { memberGroupId, response: bundle } = await mutateCurrent(\n        input.groupId,\n        {\n          kind: \"remove\",\n          expectedGroupName: input.expectedGroupName,\n          removedUserId: input.removedUserId,\n        },\n      );\n      if (input.groupId === memberGroupId) {\n        await syncOrganizationMetadataProfile({\n          containerContents: input.containerContents,\n          log: input.runtime.util.log,\n          organizationId: signingContext.organizationId,\n        });\n      }\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return bundle;\n    },\n  );\n}\n\nexport async function revokeOrganizationGrant(\n  input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n  const signingContext = requireSigningContext(input.runtime);\n  const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n  if (input.runtime.infra.dbStatus !== \"ready\") {\n    throw new Error(\"Organization local database is unavailable\");\n  }\n\n  return runWithSecurityIncidentReporting(\n    input.runtime.util.reportSecurityIncident,\n    {\n      objectId: input.subjectId,\n      objectKind: \"principal\",\n      operation: \"principal.grant.revoke\",\n      organizationId: signingContext.organizationId,\n    },\n    async () => {\n      const revoke = async () => {\n        if (input.subjectType === \"group\") {\n          const mutateCurrent = createCurrentPrincipalMutation({\n            ...signingContext,\n            runtime: input.runtime,\n            stillCurrent: input.stillCurrent,\n          });\n          if (!mutateCurrent)\n            throw new ProjectionDependencyUnavailableError(\n              \"Principal history recovery is unavailable\",\n            );\n          return (\n            await mutateCurrent(input.subjectId, {\n              kind: \"revoke\",\n              revokedContainerId: input.containerId,\n            })\n          ).response;\n        } else {\n          return revokeOrganizationContainerGrant({\n            stillCurrent: input.stillCurrent,\n            reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n            apiClient: input.runtime.apiClient,\n            containerId: input.containerId,\n            encapsulationKeyPair,\n            execSql: input.runtime.infra.execSql,\n            revokedSubject: {\n              subjectId: input.subjectId,\n              subjectType: input.subjectType,\n            },\n            resolveTrustedUserIdentity:\n              input.runtime.resolveTrustedUserIdentity,\n            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n              input.runtime,\n            ),\n            ...signingContext,\n          });\n        }\n      };\n      const response = await revoke();\n      await input.readModelCoordinator.reconcileAfterMutation(\n        signingContext.organizationId,\n      );\n      return response;\n    },\n  );\n}\n"]}

package/data/principals/principalMutationJournalShape.js

@@ -33,6 +33,12 @@ export function readPrincipalMutation(value, scope) {
         throw new Error("Principal mutation journal operation is unsupported");
     const request = CommitOrganizationGroupPolicyRequestSchema.parse(body);
     assertStateScope(request.groupPolicy.state, "group", groupId, scope);
+    if (request.memberPolicy) {
+        // The server binds this signed group ID to the organization's Members group.
+        assertStateScope(request.memberPolicy.state, "group", request.memberPolicy.state.principalId, scope);
+        if (request.memberPolicy.state.principalId === groupId)
+            throw new Error("Principal mutation journal Members target is duplicated");
+    }
     assertStateScope(request.organizationPolicy.state, "organization", scope.organizationId, scope);
     return { kind, groupId, request };
 }

package/data/principals/principalMutationJournalShape.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutationJournalShape.js","sourceRoot":"","sources":["principalMutationJournalShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,EAE1C,8CAA8C,EAE9C,oCAAoC,EAEpC,wCAAwC,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA8B5D,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAkB;IAElB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,IAAI;YAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,gBAAgB,CACd,OAAO,CAAC,KAAK,EACb,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,8CAA8C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAkD,EAClD,aAAuC,EACvC,WAAmB,EACnB,KAAkB;IAElB,IACE,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;QACnC,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,kBAAkB;QAE3D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["import {\n  type CommitOrganizationGroupPolicyRequest,\n  CommitOrganizationGroupPolicyRequestSchema,\n  type CreateOrganizationGroupWithPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequestSchema,\n  type DeleteOrganizationGroupRequest,\n  DeleteOrganizationGroupRequestSchema,\n  type OrganizationPrincipalPolicyRequest,\n  OrganizationPrincipalPolicyRequestSchema,\n} from \"@tearleads/validators/request\";\nimport { isUuidV4String } from \"@tearleads/validators/util\";\n\nexport type AuthoredPrincipalMutation =\n  | {\n      readonly kind: \"compound\";\n      readonly groupId: string;\n      readonly request: CommitOrganizationGroupPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-create\";\n      readonly groupId: string;\n      readonly request: CreateOrganizationGroupWithPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-delete\";\n      readonly groupId: string;\n      readonly request: DeleteOrganizationGroupRequest;\n    }\n  | {\n      readonly kind: \"organization\";\n      readonly groupId: null;\n      readonly request: OrganizationPrincipalPolicyRequest;\n    };\n\ninterface SignerScope {\n  readonly organizationId: string;\n  readonly userId: string;\n  readonly signingFingerprint: string;\n}\n\n/** Validate authored inputs; opening an existing row authenticates it first. */\nexport function readPrincipalMutation(\n  value: unknown,\n  scope: SignerScope,\n): AuthoredPrincipalMutation {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Principal mutation journal payload is invalid\");\n  const groupId: unknown = Reflect.get(value, \"groupId\");\n  const kind: unknown = Reflect.get(value, \"kind\");\n  const body: unknown = Reflect.get(value, \"request\");\n  if (kind === \"organization\") {\n    if (groupId !== null)\n      throw new Error(\"Organization journal target differs\");\n    const request = OrganizationPrincipalPolicyRequestSchema.parse(body);\n    assertStateScope(\n      request.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (typeof groupId !== \"string\" || !isUuidV4String(groupId))\n    throw new Error(\"Principal mutation journal group target is invalid\");\n  if (kind === \"group-create\") {\n    const request = CreateOrganizationGroupWithPolicyRequestSchema.parse(body);\n    if (request.groupId !== groupId)\n      throw new Error(\"Group creation journal target differs\");\n    assertStateScope(request.initialGroupPolicy.state, \"group\", groupId, scope);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind === \"group-delete\") {\n    const request = DeleteOrganizationGroupRequestSchema.parse(body);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind !== \"compound\")\n    throw new Error(\"Principal mutation journal operation is unsupported\");\n  const request = CommitOrganizationGroupPolicyRequestSchema.parse(body);\n  assertStateScope(request.groupPolicy.state, \"group\", groupId, scope);\n  assertStateScope(\n    request.organizationPolicy.state,\n    \"organization\",\n    scope.organizationId,\n    scope,\n  );\n  return { kind, groupId, request };\n}\n\nfunction assertStateScope(\n  state: OrganizationPrincipalPolicyRequest[\"state\"],\n  principalType: \"organization\" | \"group\",\n  principalId: string,\n  scope: SignerScope,\n) {\n  if (\n    state.principalType !== principalType ||\n    state.principalId !== principalId ||\n    state.signerUserId !== scope.userId ||\n    state.signerUserKeyFingerprint !== scope.signingFingerprint\n  )\n    throw new Error(\"Principal mutation journal target or signer differs\");\n}\n"]}
+{"version":3,"file":"principalMutationJournalShape.js","sourceRoot":"","sources":["principalMutationJournalShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,EAE1C,8CAA8C,EAE9C,oCAAoC,EAEpC,wCAAwC,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA8B5D,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAkB;IAElB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,IAAI;YAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,gBAAgB,CACd,OAAO,CAAC,KAAK,EACb,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,8CAA8C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,6EAA6E;QAC7E,gBAAgB,CACd,OAAO,CAAC,YAAY,CAAC,KAAK,EAC1B,OAAO,EACP,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EACtC,KAAK,CACN,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;YACpD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;IACN,CAAC;IACD,gBAAgB,CACd,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAChC,cAAc,EACd,KAAK,CAAC,cAAc,EACpB,KAAK,CACN,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAkD,EAClD,aAAuC,EACvC,WAAmB,EACnB,KAAkB;IAElB,IACE,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;QACnC,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,kBAAkB;QAE3D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["import {\n  type CommitOrganizationGroupPolicyRequest,\n  CommitOrganizationGroupPolicyRequestSchema,\n  type CreateOrganizationGroupWithPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequestSchema,\n  type DeleteOrganizationGroupRequest,\n  DeleteOrganizationGroupRequestSchema,\n  type OrganizationPrincipalPolicyRequest,\n  OrganizationPrincipalPolicyRequestSchema,\n} from \"@tearleads/validators/request\";\nimport { isUuidV4String } from \"@tearleads/validators/util\";\n\nexport type AuthoredPrincipalMutation =\n  | {\n      readonly kind: \"compound\";\n      readonly groupId: string;\n      readonly request: CommitOrganizationGroupPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-create\";\n      readonly groupId: string;\n      readonly request: CreateOrganizationGroupWithPolicyRequest;\n    }\n  | {\n      readonly kind: \"group-delete\";\n      readonly groupId: string;\n      readonly request: DeleteOrganizationGroupRequest;\n    }\n  | {\n      readonly kind: \"organization\";\n      readonly groupId: null;\n      readonly request: OrganizationPrincipalPolicyRequest;\n    };\n\ninterface SignerScope {\n  readonly organizationId: string;\n  readonly userId: string;\n  readonly signingFingerprint: string;\n}\n\n/** Validate authored inputs; opening an existing row authenticates it first. */\nexport function readPrincipalMutation(\n  value: unknown,\n  scope: SignerScope,\n): AuthoredPrincipalMutation {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Principal mutation journal payload is invalid\");\n  const groupId: unknown = Reflect.get(value, \"groupId\");\n  const kind: unknown = Reflect.get(value, \"kind\");\n  const body: unknown = Reflect.get(value, \"request\");\n  if (kind === \"organization\") {\n    if (groupId !== null)\n      throw new Error(\"Organization journal target differs\");\n    const request = OrganizationPrincipalPolicyRequestSchema.parse(body);\n    assertStateScope(\n      request.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (typeof groupId !== \"string\" || !isUuidV4String(groupId))\n    throw new Error(\"Principal mutation journal group target is invalid\");\n  if (kind === \"group-create\") {\n    const request = CreateOrganizationGroupWithPolicyRequestSchema.parse(body);\n    if (request.groupId !== groupId)\n      throw new Error(\"Group creation journal target differs\");\n    assertStateScope(request.initialGroupPolicy.state, \"group\", groupId, scope);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind === \"group-delete\") {\n    const request = DeleteOrganizationGroupRequestSchema.parse(body);\n    assertStateScope(\n      request.organizationPolicy.state,\n      \"organization\",\n      scope.organizationId,\n      scope,\n    );\n    return { kind, groupId, request };\n  }\n  if (kind !== \"compound\")\n    throw new Error(\"Principal mutation journal operation is unsupported\");\n  const request = CommitOrganizationGroupPolicyRequestSchema.parse(body);\n  assertStateScope(request.groupPolicy.state, \"group\", groupId, scope);\n  if (request.memberPolicy) {\n    // The server binds this signed group ID to the organization's Members group.\n    assertStateScope(\n      request.memberPolicy.state,\n      \"group\",\n      request.memberPolicy.state.principalId,\n      scope,\n    );\n    if (request.memberPolicy.state.principalId === groupId)\n      throw new Error(\n        \"Principal mutation journal Members target is duplicated\",\n      );\n  }\n  assertStateScope(\n    request.organizationPolicy.state,\n    \"organization\",\n    scope.organizationId,\n    scope,\n  );\n  return { kind, groupId, request };\n}\n\nfunction assertStateScope(\n  state: OrganizationPrincipalPolicyRequest[\"state\"],\n  principalType: \"organization\" | \"group\",\n  principalId: string,\n  scope: SignerScope,\n) {\n  if (\n    state.principalType !== principalType ||\n    state.principalId !== principalId ||\n    state.signerUserId !== scope.userId ||\n    state.signerUserKeyFingerprint !== scope.signingFingerprint\n  )\n    throw new Error(\"Principal mutation journal target or signer differs\");\n}\n"]}

package/internal/api-client/ApiClient.d.ts

@@ -1750,6 +1750,128 @@ export declare class ApiClient {
                 version: number;
             };
         };
+        memberPolicy?: {
+            containerMutations: {
+                createdAt: string;
+                manifestHead: {
+                    epoch: number;
+                    manifestHash: string;
+                };
+                organizationId: string;
+                parentId: string | null;
+                referencedPrincipalHeads: {
+                    principalType: "group";
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    stateHash: string;
+                    version: number;
+                }[];
+                updatedAt: string;
+                accessManifest: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                };
+                containerId: string;
+                containerKek: {
+                    accessManifestHash: string;
+                    containerId: string;
+                    containerKeyEpoch: number;
+                    containerKeyEpochId: string;
+                    containerManifestHistory: {
+                        event: {
+                            body: unknown;
+                            event: Record<string, unknown>;
+                            eventHash: string;
+                        };
+                        manifest: Record<string, unknown>;
+                        manifestHash: string;
+                        state: Record<string, unknown>;
+                    }[];
+                    keyEpoch: Record<string, unknown>;
+                    keyEpochHash: string;
+                    keyring: {
+                        containerId: string;
+                        containerKeyEpochId: string;
+                        iv: string;
+                        sealed: string;
+                        sealingSuite: string;
+                        version: number;
+                    } | null;
+                    keyTargetHash: string;
+                    parentContainerKeyEpochId: string | null;
+                    recipientTargets: Record<string, unknown>[];
+                    wraps: Record<string, unknown>[];
+                };
+                systemSlot?: string | null | undefined;
+            }[];
+            currentGrants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            currentMemberEnvelopes: {
+                envelopes: {
+                    kemCipherText: string;
+                    memberKeyFingerprint: string;
+                    userId: string;
+                    wrappedKey: string;
+                }[];
+                epoch: number;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentPayload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentProjection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            currentState: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        } | undefined;
     } | null>;
     /**
      * Status-bearing group policy commit. A rematerialized rotation the server

package/internal/api-client/principalPolicyRequests.d.ts

@@ -1060,5 +1060,127 @@ export declare class PrincipalPolicyRequests {
                 version: number;
             };
         };
+        memberPolicy?: {
+            containerMutations: {
+                createdAt: string;
+                manifestHead: {
+                    epoch: number;
+                    manifestHash: string;
+                };
+                organizationId: string;
+                parentId: string | null;
+                referencedPrincipalHeads: {
+                    principalType: "group";
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    stateHash: string;
+                    version: number;
+                }[];
+                updatedAt: string;
+                accessManifest: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                };
+                containerId: string;
+                containerKek: {
+                    accessManifestHash: string;
+                    containerId: string;
+                    containerKeyEpoch: number;
+                    containerKeyEpochId: string;
+                    containerManifestHistory: {
+                        event: {
+                            body: unknown;
+                            event: Record<string, unknown>;
+                            eventHash: string;
+                        };
+                        manifest: Record<string, unknown>;
+                        manifestHash: string;
+                        state: Record<string, unknown>;
+                    }[];
+                    keyEpoch: Record<string, unknown>;
+                    keyEpochHash: string;
+                    keyring: {
+                        containerId: string;
+                        containerKeyEpochId: string;
+                        iv: string;
+                        sealed: string;
+                        sealingSuite: string;
+                        version: number;
+                    } | null;
+                    keyTargetHash: string;
+                    parentContainerKeyEpochId: string | null;
+                    recipientTargets: Record<string, unknown>[];
+                    wraps: Record<string, unknown>[];
+                };
+                systemSlot?: string | null | undefined;
+            }[];
+            currentGrants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            currentMemberEnvelopes: {
+                envelopes: {
+                    kemCipherText: string;
+                    memberKeyFingerprint: string;
+                    userId: string;
+                    wrappedKey: string;
+                }[];
+                epoch: number;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentPayload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentProjection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            currentState: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        } | undefined;
     }>>;
 }