@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/principalMutations/principalMutationJournalSession.js

@@ -0,0 +1,85 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { claimPrincipalMutationJournal, clearPrincipalMutationJournal, loadPrincipalMutationJournal, } from "../../../data/persistence/principalMutationJournalPersistence.js";
+import { openPrincipalMutation, principalMutationJournalScopeId, sealPrincipalMutation, } from "../../../data/principals/principalMutationJournal.js";
+import { getOrCreatePrincipalPolicyCoordinator } from "../../../data/principals/principalPolicyCoordinator.js";
+import { assertAuthoredPrincipalOperationReceipt, } from "./principalOperationReceipt.js";
+export class PrincipalMutationOutcomeUnknownError extends Error {
+    constructor(options) {
+        super("A saved policy request may have committed; resolve its outcome or explicitly abandon its retry before another mutation", options);
+        this.name = "PrincipalMutationOutcomeUnknownError";
+    }
+}
+function knownInitialRefusal(result) {
+    if (result.ok)
+        return false;
+    // ApiClient separates pre-dispatch cancellation from an uncertain sent write.
+    if (result.kind === "cancelled")
+        return true;
+    if (result.kind !== "http")
+        return false;
+    return ([400, 401, 402, 403, 409].includes(result.status ?? 0) ||
+        (result.status === 503 &&
+            result.code === "principal_history_preparation_unavailable"));
+}
+async function submitSavedMutation(input, row, recovering) {
+    const mutation = await openPrincipalMutation({
+        scope: input.scope,
+        row,
+        signingPublicKey: input.signingKeyPair.signingPublicKey,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    // Keep the authenticated copy for acknowledgement checks even if a transport
+    // mutates its argument while preparing or retrying the HTTP request.
+    let result;
+    try {
+        result = await input.submit(structuredClone(mutation));
+    }
+    catch (cause) {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        throw new PrincipalMutationOutcomeUnknownError({ cause });
+    }
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    if (result.ok) {
+        await assertAuthoredPrincipalOperationReceipt(mutation, result.data);
+    }
+    else if (recovering || !knownInitialRefusal(result)) {
+        // A refusal today (including loss of admin access) cannot establish whether
+        // an earlier disconnected attempt committed. Preserve the original intent.
+        throw new PrincipalMutationOutcomeUnknownError();
+    }
+    await clearPrincipalMutationJournal({
+        execSql: input.execSql,
+        row,
+        stillCurrent: input.stillCurrent,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    return { mutation, result };
+}
+/** No HTTP begins until the exact authored request is durably claimed. */
+export async function submitJournaledPrincipalMutation(input) {
+    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const row = await sealPrincipalMutation(input);
+        await claimPrincipalMutationJournal({
+            execSql: input.execSql,
+            row,
+            stillCurrent: input.stillCurrent,
+        });
+        return (await submitSavedMutation(input, row, false)).result;
+    });
+}
+/** Retry only authenticated saved bytes, never an application mutation callback. */
+export async function recoverJournaledPrincipalMutation(input) {
+    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        const row = await loadPrincipalMutationJournal(input.execSql, await principalMutationJournalScopeId(input.scope));
+        assertProjectionVerificationCurrent(input.stillCurrent);
+        if (!row)
+            return null;
+        const { mutation, result } = await submitSavedMutation(input, row, true);
+        if (!result.ok)
+            throw new PrincipalMutationOutcomeUnknownError();
+        return { mutation, response: result.data };
+    });
+}
+//# sourceMappingURL=principalMutationJournalSession.js.map

package/workflows/organizations/principalMutations/principalMutationJournalSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationJournalSession.js","sourceRoot":"","sources":["principalMutationJournalSession.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,GAE7B,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAEL,qBAAqB,EAErB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,qCAAqC,EAAE,MAAM,qDAAqD,CAAC;AAE5G,OAAO,EACL,uCAAuC,GAExC,MAAM,6BAA6B,CAAC;AAcrC,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAsB;QAChC,KAAK,CACH,wHAAwH,EACxH,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,MAAsB;IACjD,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,8EAA8E;IAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,CACL,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACtD,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;YACpB,MAAM,CAAC,IAAI,KAAK,2CAA2C,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAsC,EACtC,GAAgC,EAChC,UAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG;QACH,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;KACxD,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,IAAI,oCAAoC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,uCAAuC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,IAAI,oCAAoC,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG;QACH,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAEC;IAED,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,6BAA6B,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG;YACH,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAsC;IAKtC,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAC5C,KAAK,CAAC,OAAO,EACb,MAAM,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CACnD,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,oCAAoC,EAAE,CAAC;QACjE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport {\n  claimPrincipalMutationJournal,\n  clearPrincipalMutationJournal,\n  loadPrincipalMutationJournal,\n  type PrincipalMutationJournalRow,\n} from \"../../../data/persistence/principalMutationJournalPersistence\";\nimport {\n  type AuthoredPrincipalMutation,\n  openPrincipalMutation,\n  type PrincipalMutationJournalScope,\n  principalMutationJournalScopeId,\n  sealPrincipalMutation,\n} from \"../../../data/principals/principalMutationJournal\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../../data/principals/principalPolicyCoordinator\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  assertAuthoredPrincipalOperationReceipt,\n  type PrincipalMutationResponse,\n} from \"./principalOperationReceipt\";\n\ntype MutationResult = RequestResult<PrincipalMutationResponse>;\n\nexport interface PrincipalMutationJournalContext {\n  readonly execSql: ExecSql;\n  readonly scope: PrincipalMutationJournalScope;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent: () => boolean;\n  readonly submit: (\n    mutation: AuthoredPrincipalMutation,\n  ) => Promise<MutationResult>;\n}\n\nexport class PrincipalMutationOutcomeUnknownError extends Error {\n  constructor(options?: ErrorOptions) {\n    super(\n      \"A saved policy request may have committed; resolve its outcome or explicitly abandon its retry before another mutation\",\n      options,\n    );\n    this.name = \"PrincipalMutationOutcomeUnknownError\";\n  }\n}\n\nfunction knownInitialRefusal(result: MutationResult): boolean {\n  if (result.ok) return false;\n  // ApiClient separates pre-dispatch cancellation from an uncertain sent write.\n  if (result.kind === \"cancelled\") return true;\n  if (result.kind !== \"http\") return false;\n  return (\n    [400, 401, 402, 403, 409].includes(result.status ?? 0) ||\n    (result.status === 503 &&\n      result.code === \"principal_history_preparation_unavailable\")\n  );\n}\n\nasync function submitSavedMutation(\n  input: PrincipalMutationJournalContext,\n  row: PrincipalMutationJournalRow,\n  recovering: boolean,\n): Promise<{ mutation: AuthoredPrincipalMutation; result: MutationResult }> {\n  const mutation = await openPrincipalMutation({\n    scope: input.scope,\n    row,\n    signingPublicKey: input.signingKeyPair.signingPublicKey,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  // Keep the authenticated copy for acknowledgement checks even if a transport\n  // mutates its argument while preparing or retrying the HTTP request.\n  let result: MutationResult;\n  try {\n    result = await input.submit(structuredClone(mutation));\n  } catch (cause) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    throw new PrincipalMutationOutcomeUnknownError({ cause });\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (result.ok) {\n    await assertAuthoredPrincipalOperationReceipt(mutation, result.data);\n  } else if (recovering || !knownInitialRefusal(result)) {\n    // A refusal today (including loss of admin access) cannot establish whether\n    // an earlier disconnected attempt committed. Preserve the original intent.\n    throw new PrincipalMutationOutcomeUnknownError();\n  }\n  await clearPrincipalMutationJournal({\n    execSql: input.execSql,\n    row,\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { mutation, result };\n}\n\n/** No HTTP begins until the exact authored request is durably claimed. */\nexport async function submitJournaledPrincipalMutation(\n  input: PrincipalMutationJournalContext & {\n    readonly mutation: AuthoredPrincipalMutation;\n  },\n): Promise<MutationResult> {\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const row = await sealPrincipalMutation(input);\n    await claimPrincipalMutationJournal({\n      execSql: input.execSql,\n      row,\n      stillCurrent: input.stillCurrent,\n    });\n    return (await submitSavedMutation(input, row, false)).result;\n  });\n}\n\n/** Retry only authenticated saved bytes, never an application mutation callback. */\nexport async function recoverJournaledPrincipalMutation(\n  input: PrincipalMutationJournalContext,\n): Promise<{\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly response: PrincipalMutationResponse;\n} | null> {\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const row = await loadPrincipalMutationJournal(\n      input.execSql,\n      await principalMutationJournalScopeId(input.scope),\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!row) return null;\n    const { mutation, result } = await submitSavedMutation(input, row, true);\n    if (!result.ok) throw new PrincipalMutationOutcomeUnknownError();\n    return { mutation, response: result.data };\n  });\n}\n"]}

package/workflows/organizations/principalMutations/principalMutationReceipt.js

@@ -0,0 +1,28 @@
+import { computePrincipalStateHash } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../../data/keying/canonicalJson.js";
+import { assertPrincipalPolicyReceiptArtifacts } from "../principalPolicy/principalPolicyReceiptArtifacts.js";
+/** A past commit acknowledgement is not evidence for advancing current pins. */
+export async function assertAuthoredPrincipalMutationReceipt(request, response) {
+    for (const part of ["groupPolicy", "organizationPolicy"]) {
+        await assertAuthoredPrincipalPolicyReceipt(request[part], response[part]);
+    }
+    if (Boolean(request.memberPolicy) !== Boolean(response.memberPolicy)) {
+        throw new Error("Principal mutation receipt Members policy differs");
+    }
+    if (request.memberPolicy && response.memberPolicy) {
+        await assertAuthoredPrincipalPolicyReceipt(request.memberPolicy, response.memberPolicy);
+    }
+}
+export async function assertAuthoredPrincipalPolicyReceipt(expected, observed) {
+    const { stateHash, createdAt: _createdAt, ...state } = observed.currentState;
+    if (stateHash !== (await computePrincipalStateHash(expected.state)) ||
+        canonicalKeyingJsonString(state, "principal mutation receipt state") !==
+            canonicalKeyingJsonString(expected.state, "authored principal state"))
+        throw new Error("Principal mutation receipt state differs from the authored request");
+    assertPrincipalPolicyReceiptArtifacts({
+        request: expected,
+        response: observed,
+        expectedHead: { ...observed.currentState, stateHash },
+    });
+}
+//# sourceMappingURL=principalMutationReceipt.js.map

package/workflows/organizations/principalMutations/principalMutationReceipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMutationReceipt.js","sourceRoot":"","sources":["principalMutationReceipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAE3G,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAA6C,EAC7C,QAA+C;IAE/C,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAU,EAAE,CAAC;QAClE,MAAM,oCAAoC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClD,MAAM,oCAAoC,CACxC,OAAO,CAAC,YAAY,EACpB,QAAQ,CAAC,YAAY,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,QAA6D,EAC7D,QAA8D;IAE9D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC7E,IACE,SAAS,KAAK,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/D,yBAAyB,CAAC,KAAK,EAAE,kCAAkC,CAAC;YAClE,yBAAyB,CAAC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;QAEvE,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,qCAAqC,CAAC;QACpC,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE;KACtD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type { CommitOrganizationGroupPolicyResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../../data/keying/canonicalJson\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"../principalPolicy/principalPolicyReceiptArtifacts\";\n\n/** A past commit acknowledgement is not evidence for advancing current pins. */\nexport async function assertAuthoredPrincipalMutationReceipt(\n  request: CommitOrganizationGroupPolicyRequest,\n  response: CommitOrganizationGroupPolicyResponse,\n): Promise<void> {\n  for (const part of [\"groupPolicy\", \"organizationPolicy\"] as const) {\n    await assertAuthoredPrincipalPolicyReceipt(request[part], response[part]);\n  }\n  if (Boolean(request.memberPolicy) !== Boolean(response.memberPolicy)) {\n    throw new Error(\"Principal mutation receipt Members policy differs\");\n  }\n  if (request.memberPolicy && response.memberPolicy) {\n    await assertAuthoredPrincipalPolicyReceipt(\n      request.memberPolicy,\n      response.memberPolicy,\n    );\n  }\n}\n\nexport async function assertAuthoredPrincipalPolicyReceipt(\n  expected: CommitOrganizationGroupPolicyRequest[\"groupPolicy\"],\n  observed: CommitOrganizationGroupPolicyResponse[\"groupPolicy\"],\n): Promise<void> {\n  const { stateHash, createdAt: _createdAt, ...state } = observed.currentState;\n  if (\n    stateHash !== (await computePrincipalStateHash(expected.state)) ||\n    canonicalKeyingJsonString(state, \"principal mutation receipt state\") !==\n      canonicalKeyingJsonString(expected.state, \"authored principal state\")\n  )\n    throw new Error(\n      \"Principal mutation receipt state differs from the authored request\",\n    );\n  assertPrincipalPolicyReceiptArtifacts({\n    request: expected,\n    response: observed,\n    expectedHead: { ...observed.currentState, stateHash },\n  });\n}\n"]}

package/workflows/organizations/principalMutations/principalOperationReceipt.d.ts

@@ -0,0 +1,5 @@
+import { type CommitOrganizationGroupPolicyResponse, type CreateOrganizationGroupResponse, type DeleteOrganizationGroupResponse, type PrincipalPolicyMutationResponse } from "../../../internal/validators/response/index.js";
+import type { AuthoredPrincipalMutation } from "../../../data/principals/principalMutationJournal.js";
+export type PrincipalMutationResponse = CommitOrganizationGroupPolicyResponse | CreateOrganizationGroupResponse | DeleteOrganizationGroupResponse | PrincipalPolicyMutationResponse;
+/** Match both the operation's route and its exact authored policy artifacts. */
+export declare function assertAuthoredPrincipalOperationReceipt(mutation: AuthoredPrincipalMutation, response: PrincipalMutationResponse): Promise<void>;

package/workflows/organizations/principalMutations/principalOperationReceipt.js

@@ -0,0 +1,36 @@
+import { computePrincipalStateHash } from "../../../internal/crypto/index.js";
+import { isCommitOrganizationGroupPolicyResponse, isCreateOrganizationGroupResponse, isDeleteOrganizationGroupResponse, isPrincipalPolicyMutationResponse, } from "../../../internal/validators/response/index.js";
+import { acknowledgeInitialGroupPolicy } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { assertAuthoredPrincipalMutationReceipt, assertAuthoredPrincipalPolicyReceipt, } from "./principalMutationReceipt.js";
+/** Match both the operation's route and its exact authored policy artifacts. */
+export async function assertAuthoredPrincipalOperationReceipt(mutation, response) {
+    switch (mutation.kind) {
+        case "compound":
+            if (!isCommitOrganizationGroupPolicyResponse(response))
+                break;
+            return assertAuthoredPrincipalMutationReceipt(mutation.request, response);
+        case "organization":
+            if (!isPrincipalPolicyMutationResponse(response))
+                break;
+            return assertAuthoredPrincipalPolicyReceipt(mutation.request, response);
+        case "group-create":
+            if (!isCreateOrganizationGroupResponse(response))
+                break;
+            await acknowledgeInitialGroupPolicy({
+                organizationId: mutation.request.organizationPolicy.state.principalId,
+                request: mutation.request,
+                response: response.group,
+                stateHash: await computePrincipalStateHash(mutation.request.initialGroupPolicy.state),
+            });
+            return assertAuthoredPrincipalPolicyReceipt(mutation.request.organizationPolicy, response.organizationPolicy);
+        case "group-delete":
+            if (!isDeleteOrganizationGroupResponse(response) ||
+                response.groupId !== mutation.groupId ||
+                response.organizationId !==
+                    mutation.request.organizationPolicy.state.principalId)
+                break;
+            return assertAuthoredPrincipalPolicyReceipt(mutation.request.organizationPolicy, response.organizationPolicy);
+    }
+    throw new Error("Principal mutation receipt operation or target differs");
+}
+//# sourceMappingURL=principalOperationReceipt.js.map

package/workflows/organizations/principalMutations/principalOperationReceipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalOperationReceipt.js","sourceRoot":"","sources":["principalOperationReceipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAIL,uCAAuC,EACvC,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EACL,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,4BAA4B,CAAC;AAQpC,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,QAAmC,EACnC,QAAmC;IAEnC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,UAAU;YACb,IAAI,CAAC,uCAAuC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YAC9D,OAAO,sCAAsC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,OAAO,oCAAoC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,MAAM,6BAA6B,CAAC;gBAClC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBACrE,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK;gBACxB,SAAS,EAAE,MAAM,yBAAyB,CACxC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAC1C;aACF,CAAC,CAAC;YACH,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QACJ,KAAK,cAAc;YACjB,IACE,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAC5C,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,QAAQ,CAAC,cAAc;oBACrB,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBAEvD,MAAM;YACR,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;IACN,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport {\n  type CommitOrganizationGroupPolicyResponse,\n  type CreateOrganizationGroupResponse,\n  type DeleteOrganizationGroupResponse,\n  isCommitOrganizationGroupPolicyResponse,\n  isCreateOrganizationGroupResponse,\n  isDeleteOrganizationGroupResponse,\n  isPrincipalPolicyMutationResponse,\n  type PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { AuthoredPrincipalMutation } from \"../../../data/principals/principalMutationJournal\";\nimport { acknowledgeInitialGroupPolicy } from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport {\n  assertAuthoredPrincipalMutationReceipt,\n  assertAuthoredPrincipalPolicyReceipt,\n} from \"./principalMutationReceipt\";\n\nexport type PrincipalMutationResponse =\n  | CommitOrganizationGroupPolicyResponse\n  | CreateOrganizationGroupResponse\n  | DeleteOrganizationGroupResponse\n  | PrincipalPolicyMutationResponse;\n\n/** Match both the operation's route and its exact authored policy artifacts. */\nexport async function assertAuthoredPrincipalOperationReceipt(\n  mutation: AuthoredPrincipalMutation,\n  response: PrincipalMutationResponse,\n): Promise<void> {\n  switch (mutation.kind) {\n    case \"compound\":\n      if (!isCommitOrganizationGroupPolicyResponse(response)) break;\n      return assertAuthoredPrincipalMutationReceipt(mutation.request, response);\n    case \"organization\":\n      if (!isPrincipalPolicyMutationResponse(response)) break;\n      return assertAuthoredPrincipalPolicyReceipt(mutation.request, response);\n    case \"group-create\":\n      if (!isCreateOrganizationGroupResponse(response)) break;\n      await acknowledgeInitialGroupPolicy({\n        organizationId: mutation.request.organizationPolicy.state.principalId,\n        request: mutation.request,\n        response: response.group,\n        stateHash: await computePrincipalStateHash(\n          mutation.request.initialGroupPolicy.state,\n        ),\n      });\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n    case \"group-delete\":\n      if (\n        !isDeleteOrganizationGroupResponse(response) ||\n        response.groupId !== mutation.groupId ||\n        response.organizationId !==\n          mutation.request.organizationPolicy.state.principalId\n      )\n        break;\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n  }\n  throw new Error(\"Principal mutation receipt operation or target differs\");\n}\n"]}

package/workflows/organizations/principalMutations/retainAcknowledgedPrincipalCurrents.d.ts

@@ -0,0 +1,6 @@
+import type { VerifiedPrincipalPolicyCurrent } from "../../../internal/crypto/index.js";
+import { type AcknowledgedPrincipalCurrentBatch } from "../../principals/acknowledgements/acknowledgedPrincipalCurrents.js";
+export type { AcknowledgedPrincipalCurrentRetirement } from "../../../data/persistence/principalCurrentAcknowledgementPersistence.js";
+export type { AcknowledgedPrincipalCurrentInput } from "../../principals/acknowledgements/acknowledgedPrincipalCurrents.js";
+/** Extend authenticated local progress and retain exact acknowledged artifacts atomically with pins. */
+export declare function retainAcknowledgedPrincipalCurrents(input: AcknowledgedPrincipalCurrentBatch): Promise<VerifiedPrincipalPolicyCurrent[]>;

package/workflows/organizations/principalMutations/retainAcknowledgedPrincipalCurrents.js

@@ -0,0 +1,20 @@
+import { recordAcknowledgedPrincipalCurrents, } from "../../principals/acknowledgements/acknowledgedPrincipalCurrents.js";
+import { acknowledgeGroupPolicyState } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { assertPrincipalPolicyReceiptArtifacts } from "../principalPolicy/principalPolicyReceiptArtifacts.js";
+import { assertAcknowledgedDirectoryBindings } from "./acknowledgedDirectoryBindings.js";
+/** How organization and group mutations check an acknowledgement they authored. */
+const principalAcknowledgementChecks = {
+    authoredHead: groupPolicyMutationHead,
+    assertReceipt: assertPrincipalPolicyReceiptArtifacts,
+    acknowledgeSuccessor: (input) => acknowledgeGroupPolicyState(input),
+    assertDirectoryBindings: assertAcknowledgedDirectoryBindings,
+};
+/** Extend authenticated local progress and retain exact acknowledged artifacts atomically with pins. */
+export function retainAcknowledgedPrincipalCurrents(input) {
+    return recordAcknowledgedPrincipalCurrents({
+        ...input,
+        checks: principalAcknowledgementChecks,
+    });
+}
+//# sourceMappingURL=retainAcknowledgedPrincipalCurrents.js.map

package/workflows/organizations/principalMutations/retainAcknowledgedPrincipalCurrents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainAcknowledgedPrincipalCurrents.js","sourceRoot":"","sources":["retainAcknowledgedPrincipalCurrents.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,mCAAmC,GACpC,MAAM,iEAAiE,CAAC;AAEzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAC3G,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAKtF,mFAAmF;AACnF,MAAM,8BAA8B,GAAmC;IACrE,YAAY,EAAE,uBAAuB;IACrC,aAAa,EAAE,qCAAqC;IACpD,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC;IACnE,uBAAuB,EAAE,mCAAmC;CAC7D,CAAC;AAEF,wGAAwG;AACxG,MAAM,UAAU,mCAAmC,CACjD,KAAwC;IAExC,OAAO,mCAAmC,CAAC;QACzC,GAAG,KAAK;QACR,MAAM,EAAE,8BAA8B;KACvC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicyCurrent } from \"@tearleads/crypto\";\nimport {\n  type AcknowledgedPrincipalCurrentBatch,\n  recordAcknowledgedPrincipalCurrents,\n} from \"../../principals/acknowledgements/acknowledgedPrincipalCurrents\";\nimport type { PrincipalAcknowledgementChecks } from \"../../principals/acknowledgements/principalAcknowledgementChecks\";\nimport { acknowledgeGroupPolicyState } from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"../principalPolicy/principalPolicyReceiptArtifacts\";\nimport { assertAcknowledgedDirectoryBindings } from \"./acknowledgedDirectoryBindings\";\n\nexport type { AcknowledgedPrincipalCurrentRetirement } from \"../../../data/persistence/principalCurrentAcknowledgementPersistence\";\nexport type { AcknowledgedPrincipalCurrentInput } from \"../../principals/acknowledgements/acknowledgedPrincipalCurrents\";\n\n/** How organization and group mutations check an acknowledgement they authored. */\nconst principalAcknowledgementChecks: PrincipalAcknowledgementChecks = {\n  authoredHead: groupPolicyMutationHead,\n  assertReceipt: assertPrincipalPolicyReceiptArtifacts,\n  acknowledgeSuccessor: (input) => acknowledgeGroupPolicyState(input),\n  assertDirectoryBindings: assertAcknowledgedDirectoryBindings,\n};\n\n/** Extend authenticated local progress and retain exact acknowledged artifacts atomically with pins. */\nexport function retainAcknowledgedPrincipalCurrents(\n  input: AcknowledgedPrincipalCurrentBatch,\n): Promise<VerifiedPrincipalPolicyCurrent[]> {\n  return recordAcknowledgedPrincipalCurrents({\n    ...input,\n    checks: principalAcknowledgementChecks,\n  });\n}\n"]}

package/workflows/organizations/principalMutations/runtimeCurrentGroupMutation.js

@@ -0,0 +1,113 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { scopedGroupHistoryProtection } from "../../../data/principals/principalHistoryScopeProtection.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { captureAcknowledgedPrincipalPredecessor } from "../../principals/acknowledgements/acknowledgedPrincipalPredecessor.js";
+import { loadCurrentGroupPolicyMutationContext } from "../groupPolicy/currentGroupPolicyMutationContext.js";
+import { resolveCurrentGroupMutationReferences } from "./currentGroupMutationReferences.js";
+import { createCurrentPrincipalMutationLease } from "./currentPrincipalMutationLease.js";
+import { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+/** Keep private prefix custody inside the entire mutation and its acknowledgement. */
+export function createRuntimeCurrentGroupMutation(runtime) {
+    const lease = createCurrentPrincipalMutationLease(runtime);
+    if (!lease)
+        return undefined;
+    return async (input, work) => {
+        input = { ...input };
+        return lease(input.stillCurrent, async ({ protection, stillCurrent, resolveCurrentPolicy, historyReader, directoryRecovery, }) => {
+            const loadGroup = async (groupId) => {
+                const context = await loadCurrentGroupPolicyMutationContext({
+                    ...input,
+                    groupId,
+                    execSql: runtime.infra.execSql,
+                    resolveCurrentPolicy,
+                    recoverPendingPrincipalMutation: (organizationId) => runtime.apiClient.recoverPendingPrincipalMutation(organizationId),
+                    stillCurrent,
+                });
+                const retention = await createCurrentMutationRetention(runtime, { ...input, groupId }, context, protection, historyReader, directoryRecovery(context.organizationCurrent.current));
+                return {
+                    ...context,
+                    ...retention,
+                    loadGroup,
+                    resolveAuthoredPolicyReferences: (current, references) => resolveCurrentGroupMutationReferences({
+                        current,
+                        predecessor: context.verifiedCurrentPolicy,
+                        references,
+                        readPredecessorReference: context.readPredecessorReference,
+                        stillCurrent: context.stillCurrent,
+                    }),
+                };
+            };
+            const context = await loadGroup(input.groupId);
+            const result = await work(context);
+            assertProjectionVerificationCurrent(context.stillCurrent);
+            return result;
+        });
+    };
+}
+async function createCurrentMutationRetention(runtime, input, context, protection, historyReader, directoryRecovery) {
+    const common = {
+        historyReader,
+        resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
+    };
+    const groupRecovery = {
+        ...common,
+        expectedHead: principalPolicyReferenceFromBundle(context.currentPolicy),
+        protection: context.isOrganizationAdminsGroup
+            ? protection
+            : scopedGroupHistoryProtection(protection, input.organizationId, context.adminGroupId),
+        historyVerification: context.isOrganizationAdminsGroup
+            ? "direct-admins"
+            : "standard",
+        ...(context.isOrganizationAdminsGroup
+            ? {}
+            : { loadExternalAuthority: async () => context.externalAuthority }),
+    };
+    const capture = (recovery) => captureAcknowledgedPrincipalPredecessor({
+        ...recovery,
+        execSql: runtime.infra.execSql,
+        organizationId: input.organizationId,
+        stillCurrent: context.stillCurrent,
+    });
+    const groupPredecessor = await capture(groupRecovery);
+    const directoryPredecessor = await capture(directoryRecovery);
+    const retainAcknowledged = async (receipt) => {
+        assertProjectionVerificationCurrent(context.stillCurrent);
+        await retainAcknowledgedPrincipalCurrents({
+            execSql: runtime.infra.execSql,
+            organizationId: input.organizationId,
+            entries: [
+                ...(receipt.additionalGroups ?? []),
+                {
+                    recovery: groupRecovery,
+                    predecessor: groupPredecessor,
+                    request: receipt.request,
+                    response: receipt.response.groupPolicy,
+                },
+                {
+                    recovery: directoryRecovery,
+                    predecessor: directoryPredecessor,
+                    request: receipt.organizationRequest,
+                    response: receipt.response.organizationPolicy,
+                },
+            ],
+            retirements: [
+                ...(receipt.additionalGroups ?? []).map((entry) => ({
+                    principalId: entry.request.state.principalId,
+                    principalType: "group",
+                    containerIds: entry.retiredContainerIds ?? [],
+                })),
+                {
+                    principalId: input.groupId,
+                    principalType: "group",
+                    containerIds: receipt.retiredContainerIds ?? [],
+                },
+            ],
+            stillCurrent: context.stillCurrent,
+        });
+    };
+    return {
+        groupRetention: { recovery: groupRecovery, predecessor: groupPredecessor },
+        retainAcknowledged,
+    };
+}
+//# sourceMappingURL=runtimeCurrentGroupMutation.js.map

package/workflows/organizations/principalMutations/runtimeCurrentGroupMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCurrentGroupMutation.js","sourceRoot":"","sources":["runtimeCurrentGroupMutation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAEvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,oEAAoE,CAAC;AAG7H,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AACzG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,OAAO,EAEL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AA4C/C,sFAAsF;AACtF,MAAM,UAAU,iCAAiC,CAAC,OAAwB;IACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAoB,EACpB,IAAiE,EACrD,EAAE;QACd,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EACL,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,iBAAiB,GAClB,EAAE,EAAE;YACH,MAAM,SAAS,GAAG,KAAK,EACrB,OAAe,EAC8B,EAAE;gBAC/C,MAAM,OAAO,GAAG,MAAM,qCAAqC,CAAC;oBAC1D,GAAG,KAAK;oBACR,OAAO;oBACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;oBAC9B,oBAAoB;oBACpB,+BAA+B,EAAE,CAAC,cAAc,EAAE,EAAE,CAClD,OAAO,CAAC,SAAS,CAAC,+BAA+B,CAAC,cAAc,CAAC;oBACnE,YAAY;iBACb,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,8BAA8B,CACpD,OAAO,EACP,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EACrB,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CACvD,CAAC;gBACF,OAAO;oBACL,GAAG,OAAO;oBACV,GAAG,SAAS;oBACZ,SAAS;oBACT,+BAA+B,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CACvD,qCAAqC,CAAC;wBACpC,OAAO;wBACP,WAAW,EAAE,OAAO,CAAC,qBAAqB;wBAC1C,UAAU;wBACV,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;wBAC1D,YAAY,EAAE,OAAO,CAAC,YAAY;qBACnC,CAAC;iBACL,CAAC;YACJ,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAwB,EACxB,KAAoB,EACpB,OAA+B,EAC/B,UAAiD,EACjD,aAAwC,EACxC,iBAAgE;IAEhE,MAAM,MAAM,GAAG;QACb,aAAa;QACb,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;KAC/D,CAAC;IACF,MAAM,aAAa,GAAkD;QACnE,GAAG,MAAM;QACT,YAAY,EAAE,kCAAkC,CAAC,OAAO,CAAC,aAAa,CAAC;QACvE,UAAU,EAAE,OAAO,CAAC,yBAAyB;YAC3C,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,4BAA4B,CAC1B,UAAU,EACV,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,CACrB;QACL,mBAAmB,EAAE,OAAO,CAAC,yBAAyB;YACpD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,UAAU;QACd,GAAG,CAAC,OAAO,CAAC,yBAAyB;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;KACtE,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,QAAuD,EAAE,EAAE,CAC1E,uCAAuC,CAAC;QACtC,GAAG,QAAQ;QACX,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACL,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,KAAK,EAC9B,OAA+B,EAChB,EAAE;QACjB,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,mCAAmC,CAAC;YACxC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBACnC;oBACE,QAAQ,EAAE,aAAa;oBACvB,WAAW,EAAE,gBAAgB;oBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;iBACvC;gBACD;oBACE,QAAQ,EAAE,iBAAiB;oBAC3B,WAAW,EAAE,oBAAoB;oBACjC,OAAO,EAAE,OAAO,CAAC,mBAAmB;oBACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;iBAC9C;aACF;YACD,WAAW,EAAE;gBACX,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAClD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;oBAC5C,aAAa,EAAE,OAAgB;oBAC/B,YAAY,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;iBAC9C,CAAC,CAAC;gBACH;oBACE,WAAW,EAAE,KAAK,CAAC,OAAO;oBAC1B,aAAa,EAAE,OAAO;oBACtB,YAAY,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE;iBAChD;aACF;YACD,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,cAAc,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;QAC1E,kBAAkB;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { CommitOrganizationGroupPolicyResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../data/principals/currentPolicyReferenceResolver\";\nimport { scopedGroupHistoryProtection } from \"../../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport { captureAcknowledgedPrincipalPredecessor } from \"../../principals/acknowledgements/acknowledgedPrincipalPredecessor\";\nimport type { PrincipalPolicyPageReader } from \"../../principals/principalPolicyHistoryReader\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"../../principals/runtimePolicyRecovery\";\nimport { loadCurrentGroupPolicyMutationContext } from \"../groupPolicy/currentGroupPolicyMutationContext\";\nimport { resolveCurrentGroupMutationReferences } from \"./currentGroupMutationReferences\";\nimport { createCurrentPrincipalMutationLease } from \"./currentPrincipalMutationLease\";\nimport type { PrincipalMutationRecoveryApi } from \"./principalMutationJournalManagement\";\nimport {\n  type AcknowledgedPrincipalCurrentInput,\n  retainAcknowledgedPrincipalCurrents,\n} from \"./retainAcknowledgedPrincipalCurrents\";\n\ntype MutationRuntime = PrincipalPolicyRecoveryRuntime & {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] &\n    Pick<PrincipalMutationRecoveryApi, \"recoverPendingPrincipalMutation\">;\n};\n\ntype CurrentMutationContext = Awaited<\n  ReturnType<typeof loadCurrentGroupPolicyMutationContext>\n>;\n\nexport type RuntimeCurrentGroupMutationContext = CurrentMutationContext & {\n  readonly resolveAuthoredPolicyReferences: CurrentPolicyReferenceResolver;\n  readonly loadGroup: (\n    groupId: string,\n  ) => Promise<RuntimeCurrentGroupMutationContext>;\n  readonly groupRetention: Pick<\n    AcknowledgedPrincipalCurrentInput,\n    \"recovery\" | \"predecessor\"\n  >;\n  readonly retainAcknowledged: (\n    receipt: CurrentMutationReceipt,\n  ) => Promise<void>;\n};\n\ninterface CurrentMutationReceipt {\n  readonly additionalGroups?:\n    | readonly (AcknowledgedPrincipalCurrentInput & {\n        readonly retiredContainerIds?: readonly string[] | undefined;\n      })[]\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  readonly response: CommitOrganizationGroupPolicyResponse;\n  readonly retiredContainerIds?: readonly string[] | undefined;\n}\n\ninterface MutationInput {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly stillCurrent: () => boolean;\n}\n\n/** Keep private prefix custody inside the entire mutation and its acknowledgement. */\nexport function createRuntimeCurrentGroupMutation(runtime: MutationRuntime) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: MutationInput,\n    work: (context: RuntimeCurrentGroupMutationContext) => Promise<T>,\n  ): Promise<T> => {\n    input = { ...input };\n    return lease(\n      input.stillCurrent,\n      async ({\n        protection,\n        stillCurrent,\n        resolveCurrentPolicy,\n        historyReader,\n        directoryRecovery,\n      }) => {\n        const loadGroup = async (\n          groupId: string,\n        ): Promise<RuntimeCurrentGroupMutationContext> => {\n          const context = await loadCurrentGroupPolicyMutationContext({\n            ...input,\n            groupId,\n            execSql: runtime.infra.execSql,\n            resolveCurrentPolicy,\n            recoverPendingPrincipalMutation: (organizationId) =>\n              runtime.apiClient.recoverPendingPrincipalMutation(organizationId),\n            stillCurrent,\n          });\n          const retention = await createCurrentMutationRetention(\n            runtime,\n            { ...input, groupId },\n            context,\n            protection,\n            historyReader,\n            directoryRecovery(context.organizationCurrent.current),\n          );\n          return {\n            ...context,\n            ...retention,\n            loadGroup,\n            resolveAuthoredPolicyReferences: (current, references) =>\n              resolveCurrentGroupMutationReferences({\n                current,\n                predecessor: context.verifiedCurrentPolicy,\n                references,\n                readPredecessorReference: context.readPredecessorReference,\n                stillCurrent: context.stillCurrent,\n              }),\n          };\n        };\n        const context = await loadGroup(input.groupId);\n        const result = await work(context);\n        assertProjectionVerificationCurrent(context.stillCurrent);\n        return result;\n      },\n    );\n  };\n}\n\nasync function createCurrentMutationRetention(\n  runtime: MutationRuntime,\n  input: MutationInput,\n  context: CurrentMutationContext,\n  protection: PrincipalPolicyHistoryProgressOptions,\n  historyReader: PrincipalPolicyPageReader,\n  directoryRecovery: AcknowledgedPrincipalCurrentInput[\"recovery\"],\n) {\n  const common = {\n    historyReader,\n    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n  };\n  const groupRecovery: AcknowledgedPrincipalCurrentInput[\"recovery\"] = {\n    ...common,\n    expectedHead: principalPolicyReferenceFromBundle(context.currentPolicy),\n    protection: context.isOrganizationAdminsGroup\n      ? protection\n      : scopedGroupHistoryProtection(\n          protection,\n          input.organizationId,\n          context.adminGroupId,\n        ),\n    historyVerification: context.isOrganizationAdminsGroup\n      ? \"direct-admins\"\n      : \"standard\",\n    ...(context.isOrganizationAdminsGroup\n      ? {}\n      : { loadExternalAuthority: async () => context.externalAuthority }),\n  };\n  const capture = (recovery: AcknowledgedPrincipalCurrentInput[\"recovery\"]) =>\n    captureAcknowledgedPrincipalPredecessor({\n      ...recovery,\n      execSql: runtime.infra.execSql,\n      organizationId: input.organizationId,\n      stillCurrent: context.stillCurrent,\n    });\n  const groupPredecessor = await capture(groupRecovery);\n  const directoryPredecessor = await capture(directoryRecovery);\n  const retainAcknowledged = async (\n    receipt: CurrentMutationReceipt,\n  ): Promise<void> => {\n    assertProjectionVerificationCurrent(context.stillCurrent);\n    await retainAcknowledgedPrincipalCurrents({\n      execSql: runtime.infra.execSql,\n      organizationId: input.organizationId,\n      entries: [\n        ...(receipt.additionalGroups ?? []),\n        {\n          recovery: groupRecovery,\n          predecessor: groupPredecessor,\n          request: receipt.request,\n          response: receipt.response.groupPolicy,\n        },\n        {\n          recovery: directoryRecovery,\n          predecessor: directoryPredecessor,\n          request: receipt.organizationRequest,\n          response: receipt.response.organizationPolicy,\n        },\n      ],\n      retirements: [\n        ...(receipt.additionalGroups ?? []).map((entry) => ({\n          principalId: entry.request.state.principalId,\n          principalType: \"group\" as const,\n          containerIds: entry.retiredContainerIds ?? [],\n        })),\n        {\n          principalId: input.groupId,\n          principalType: \"group\",\n          containerIds: receipt.retiredContainerIds ?? [],\n        },\n      ],\n      stillCurrent: context.stillCurrent,\n    });\n  };\n  return {\n    groupRetention: { recovery: groupRecovery, predecessor: groupPredecessor },\n    retainAcknowledged,\n  };\n}\n"]}

package/workflows/organizations/principalMutations/runtimeCurrentOrganizationMutation.js

@@ -0,0 +1,48 @@
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { loadCurrentOrganizationMutationAuthority } from "./currentOrganizationMutationAuthority.js";
+import { createCurrentOrganizationMutationRetention } from "./currentOrganizationMutationRetention.js";
+import { createCurrentPrincipalMutationLease } from "./currentPrincipalMutationLease.js";
+/** Keep directory authoring and exact acknowledgement inside one private lease. */
+export function createRuntimeCurrentOrganizationMutation(runtime) {
+    const lease = createCurrentPrincipalMutationLease(runtime);
+    if (!lease)
+        return undefined;
+    return async (input, work) => {
+        const owned = { ...input };
+        return lease(owned.stillCurrent, async ({ protection, historyReader, stillCurrent, resolveCurrentPolicy, directoryRecovery, }) => {
+            const { authority } = await loadCurrentOrganizationMutationAuthority({
+                execSql: runtime.infra.execSql,
+                organizationId: owned.organizationId,
+                signerUserId: owned.signerUserId,
+                recoverPendingPrincipalMutation: (organizationId) => runtime.apiClient.recoverPendingPrincipalMutation(organizationId),
+                resolveCurrentPolicy,
+                stillCurrent,
+            });
+            const current = () => stillCurrent() && authority.stillCurrent();
+            await advanceKeyingCheckpointsAtomically({
+                access: [],
+                execSql: runtime.infra.execSql,
+                organizationId: owned.organizationId,
+                policies: [authority.directory.policy, authority.admins.policy],
+                stillCurrent: current,
+            });
+            const result = await work({
+                ...authority,
+                stillCurrent: current,
+                ...(await createCurrentOrganizationMutationRetention({
+                    runtime,
+                    authority,
+                    protection,
+                    historyReader,
+                    organizationId: owned.organizationId,
+                    directoryRecovery: directoryRecovery(authority.directory.current),
+                    stillCurrent: current,
+                })),
+            });
+            assertProjectionVerificationCurrent(current);
+            return result;
+        });
+    };
+}
+//# sourceMappingURL=runtimeCurrentOrganizationMutation.js.map

package/workflows/organizations/principalMutations/runtimeCurrentOrganizationMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCurrentOrganizationMutation.js","sourceRoot":"","sources":["runtimeCurrentOrganizationMutation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAGlH,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAmBtF,mFAAmF;AACnF,MAAM,UAAU,wCAAwC,CAAC,OAAgB;IACvE,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAY,EACZ,IAAiE,EACrD,EAAE;QACd,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EACL,UAAU,EACV,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,GAClB,EAAE,EAAE;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wCAAwC,CAAC;gBACnE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,CAAC,cAAc,EAAE,EAAE,CAClD,OAAO,CAAC,SAAS,CAAC,+BAA+B,CAAC,cAAc,CAAC;gBACnE,oBAAoB;gBACpB,YAAY;aACb,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACjE,MAAM,kCAAkC,CAAC;gBACvC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC/D,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,GAAG,SAAS;gBACZ,YAAY,EAAE,OAAO;gBACrB,GAAG,CAAC,MAAM,0CAA0C,CAAC;oBACnD,OAAO;oBACP,SAAS;oBACT,UAAU;oBACV,aAAa;oBACb,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,iBAAiB,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;oBACjE,YAAY,EAAE,OAAO;iBACtB,CAAC,CAAC;aACJ,CAAC,CAAC;YACH,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport type { PrincipalPolicyRecoveryRuntime } from \"../../principals/runtimePolicyRecovery\";\nimport type { loadCurrentOrganizationAuthority } from \"../currentOrganizationAuthority\";\nimport { loadCurrentOrganizationMutationAuthority } from \"./currentOrganizationMutationAuthority\";\nimport { createCurrentOrganizationMutationRetention } from \"./currentOrganizationMutationRetention\";\nimport { createCurrentPrincipalMutationLease } from \"./currentPrincipalMutationLease\";\nimport type { PrincipalMutationRecoveryApi } from \"./principalMutationJournalManagement\";\n\ntype Runtime = PrincipalPolicyRecoveryRuntime & {\n  readonly apiClient: PrincipalPolicyRecoveryRuntime[\"apiClient\"] &\n    Pick<PrincipalMutationRecoveryApi, \"recoverPendingPrincipalMutation\">;\n};\n\ninterface Input {\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly stillCurrent: () => boolean;\n}\n\ntype Authority = Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>;\n\nexport type CurrentOrganizationMutationContext = Authority &\n  Awaited<ReturnType<typeof createCurrentOrganizationMutationRetention>>;\n\n/** Keep directory authoring and exact acknowledgement inside one private lease. */\nexport function createRuntimeCurrentOrganizationMutation(runtime: Runtime) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: Input,\n    work: (context: CurrentOrganizationMutationContext) => Promise<T>,\n  ): Promise<T> => {\n    const owned = { ...input };\n    return lease(\n      owned.stillCurrent,\n      async ({\n        protection,\n        historyReader,\n        stillCurrent,\n        resolveCurrentPolicy,\n        directoryRecovery,\n      }) => {\n        const { authority } = await loadCurrentOrganizationMutationAuthority({\n          execSql: runtime.infra.execSql,\n          organizationId: owned.organizationId,\n          signerUserId: owned.signerUserId,\n          recoverPendingPrincipalMutation: (organizationId) =>\n            runtime.apiClient.recoverPendingPrincipalMutation(organizationId),\n          resolveCurrentPolicy,\n          stillCurrent,\n        });\n        const current = () => stillCurrent() && authority.stillCurrent();\n        await advanceKeyingCheckpointsAtomically({\n          access: [],\n          execSql: runtime.infra.execSql,\n          organizationId: owned.organizationId,\n          policies: [authority.directory.policy, authority.admins.policy],\n          stillCurrent: current,\n        });\n        const result = await work({\n          ...authority,\n          stillCurrent: current,\n          ...(await createCurrentOrganizationMutationRetention({\n            runtime,\n            authority,\n            protection,\n            historyReader,\n            organizationId: owned.organizationId,\n            directoryRecovery: directoryRecovery(authority.directory.current),\n            stillCurrent: current,\n          })),\n        });\n        assertProjectionVerificationCurrent(current);\n        return result;\n      },\n    );\n  };\n}\n"]}

package/workflows/organizations/principalPolicy/index.d.ts

@@ -0,0 +1,98 @@
+export { createOrganizationGroup } from "../groups/groupCreation.js";
+import type { ReferencedPrincipalHead, SigningKeyPair, VerifiedPrincipalPolicy } from "../../../internal/crypto/index.js";
+import type { ContainerMutationRequest } from "../../../internal/validators/request/index.js";
+import type { ContainerMutationResponse, PrincipalPolicyBundleResponse, PrincipalPolicyMutationResponse } from "../../../internal/validators/response/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import { type PrincipalPolicyReadWriteApi } from "../groupPolicy/groupPolicyMutationContext.js";
+import type { GroupPolicyNameReader } from "./principalPolicyRequest.js";
+import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest } from "./principalPolicyRequest.js";
+export { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };
+interface PreparedGroupContainerMutations {
+    readonly retiredContainerIds: readonly string[];
+    readonly acknowledge: (responses: readonly ContainerMutationResponse[], stillCurrent?: (() => boolean) | undefined) => Promise<void>;
+    /** Sign the descendant rekeys a refused commit named; see `carry` there. */
+    readonly carry?: ((requiredContainerIds: readonly string[]) => Promise<readonly ContainerMutationRequest[]>) | undefined;
+    readonly requests: readonly ContainerMutationRequest[];
+}
+type PrepareGroupContainerMutations = (input: {
+    readonly currentPolicy: PrincipalPolicyBundleResponse;
+    readonly nextPolicy: VerifiedPrincipalPolicy;
+}) => Promise<readonly ContainerMutationRequest[] | PreparedGroupContainerMutations>;
+export declare function addOrganizationGroupUser(input: {
+    readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;
+    readonly apiClient: PrincipalPolicyReadWriteApi;
+    readonly currentUserSecretKey: Uint8Array;
+    readonly execSql: ExecSql;
+    readonly expectedGroupName: string;
+    readonly readEncryptedName?: GroupPolicyNameReader;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+    readonly targetUserId: string;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly beforePolicyCommit: (head: ReferencedPrincipalHead, authority: {
+        readonly adminGroupId: string;
+        readonly memberGroupId: string;
+    }) => void;
+    readonly prepareContainerMutations?: PrepareGroupContainerMutations | undefined;
+}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;
+export declare function removeOrganizationGroupUser(input: {
+    readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;
+    readonly apiClient: PrincipalPolicyReadWriteApi;
+    readonly execSql: ExecSql;
+    readonly expectedGroupName: string;
+    readonly readEncryptedName?: GroupPolicyNameReader;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly removedUserId: string;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+    readonly beforePolicyCommit: (head: ReferencedPrincipalHead, authority: {
+        readonly adminGroupId: string;
+        readonly memberGroupId: string;
+    }) => void;
+    readonly prepareContainerMutations?: PrepareGroupContainerMutations | undefined;
+}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;
+/**
+ * Adds or changes one container in the group's signed complete grant set and
+ * commits every resulting container rematerialization in the same request.
+ */
+export declare function setOrganizationGroupContainerGrant(input: {
+    readonly accessLevel: "admin" | "read" | "write";
+    readonly apiClient: PrincipalPolicyReadWriteApi;
+    readonly assertCanCommit?: (() => void) | undefined;
+    readonly containerId: string;
+    readonly execSql: ExecSql;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly prepareContainerMutations: PrepareGroupContainerMutations;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;
+/**
+ * A group losing a container grant rotates its own key in the same request as
+ * that container revoke and the rekeys of all remaining grants. This prevents
+ * a later member from using the group's still-current key to open a retained
+ * wrap from before the revoke.
+ */
+export declare function rotateOrganizationGroupForAccessSetShrink(input: {
+    readonly apiClient: PrincipalPolicyReadWriteApi;
+    readonly execSql: ExecSql;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly revokedContainerId: string;
+    readonly prepareContainerMutations: PrepareGroupContainerMutations;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;