@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/principalPolicy.d.ts

@@ -1,98 +0,0 @@
-export { createOrganizationGroup } from "./groupCreation.js";
-import type { ReferencedPrincipalHead, SigningKeyPair, VerifiedPrincipalPolicy } from "../../internal/crypto/index.js";
-import type { ContainerMutationRequest } from "../../internal/validators/request/index.js";
-import type { ContainerMutationResponse, PrincipalPolicyBundleResponse, PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
-import type { SecurityIncidentReporter } from "../../data/shared/securityIncidents.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
-import { type PrincipalPolicyReadWriteApi } from "./groupPolicyMutationContext.js";
-import type { GroupPolicyNameReader } from "./principalPolicyRequest.js";
-import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest } from "./principalPolicyRequest.js";
-export { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };
-interface PreparedGroupContainerMutations {
-    readonly retiredContainerIds: readonly string[];
-    readonly acknowledge: (responses: readonly ContainerMutationResponse[], stillCurrent?: (() => boolean) | undefined) => Promise<void>;
-    /** Sign the descendant rekeys a refused commit named; see `carry` there. */
-    readonly carry?: ((requiredContainerIds: readonly string[]) => Promise<readonly ContainerMutationRequest[]>) | undefined;
-    readonly requests: readonly ContainerMutationRequest[];
-}
-type PrepareGroupContainerMutations = (input: {
-    readonly currentPolicy: PrincipalPolicyBundleResponse;
-    readonly nextPolicy: VerifiedPrincipalPolicy;
-}) => Promise<readonly ContainerMutationRequest[] | PreparedGroupContainerMutations>;
-export declare function addOrganizationGroupUser(input: {
-    readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;
-    readonly apiClient: PrincipalPolicyReadWriteApi;
-    readonly currentUserSecretKey: Uint8Array;
-    readonly execSql: ExecSql;
-    readonly expectedGroupName: string;
-    readonly readEncryptedName?: GroupPolicyNameReader;
-    readonly groupId: string;
-    readonly organizationId: string;
-    readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-    readonly targetUserId: string;
-    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    readonly beforePolicyCommit: (head: ReferencedPrincipalHead, authority: {
-        readonly adminGroupId: string;
-        readonly memberGroupId: string;
-    }) => void;
-    readonly prepareContainerMutations?: PrepareGroupContainerMutations | undefined;
-}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;
-export declare function removeOrganizationGroupUser(input: {
-    readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;
-    readonly apiClient: PrincipalPolicyReadWriteApi;
-    readonly execSql: ExecSql;
-    readonly expectedGroupName: string;
-    readonly readEncryptedName?: GroupPolicyNameReader;
-    readonly groupId: string;
-    readonly organizationId: string;
-    readonly removedUserId: string;
-    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-    readonly beforePolicyCommit: (head: ReferencedPrincipalHead, authority: {
-        readonly adminGroupId: string;
-        readonly memberGroupId: string;
-    }) => void;
-    readonly prepareContainerMutations?: PrepareGroupContainerMutations | undefined;
-}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;
-/**
- * Adds or changes one container in the group's signed complete grant set and
- * commits every resulting container rematerialization in the same request.
- */
-export declare function setOrganizationGroupContainerGrant(input: {
-    readonly accessLevel: "admin" | "read" | "write";
-    readonly apiClient: PrincipalPolicyReadWriteApi;
-    readonly assertCanCommit?: (() => void) | undefined;
-    readonly containerId: string;
-    readonly execSql: ExecSql;
-    readonly groupId: string;
-    readonly organizationId: string;
-    readonly prepareContainerMutations: PrepareGroupContainerMutations;
-    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;
-/**
- * A group losing a container grant rotates its own key in the same request as
- * that container revoke and the rekeys of all remaining grants. This prevents
- * a later member from using the group's still-current key to open a retained
- * wrap from before the revoke.
- */
-export declare function rotateOrganizationGroupForAccessSetShrink(input: {
-    readonly apiClient: PrincipalPolicyReadWriteApi;
-    readonly execSql: ExecSql;
-    readonly groupId: string;
-    readonly organizationId: string;
-    readonly revokedContainerId: string;
-    readonly prepareContainerMutations: PrepareGroupContainerMutations;
-    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;

package/workflows/organizations/principalPolicy.js

@@ -1,256 +0,0 @@
-export { createOrganizationGroup } from "./groupCreation.js";
-import { assertGroupMembershipName } from "./groupMembershipName.js";
-import { prepareAuthoredGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
-import { cacheGroupPolicy, commitGroupPolicyMutation, loadGroupPolicyMutationContext, } from "./groupPolicyMutationContext.js";
-import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
-import { buildAddGroupUserPolicyRequest, buildGroupAccessSetShrinkPolicyRequest, buildRemoveGroupUserPolicyRequest, buildSetGroupContainerGrantPolicyRequest, } from "./groupPolicyRequests.js";
-import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
-import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "./principalPolicyRequest.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
-export { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };
-function createPolicyMutationCommitGuard(assertCanCommit) {
-    if (!assertCanCommit)
-        return undefined;
-    return () => {
-        assertCanCommit();
-        return true;
-    };
-}
-/**
- * Plan the container mutations the policy change rematerializes and place their
- * requests on the policy request. A bare request list has nothing to
- * acknowledge or carry; a prepared batch does both.
- */
-async function prepareGroupContainerMutations(input, expectedHead) {
-    if (!input.prepareContainerMutations)
-        return null;
-    const prepared = await input.prepareContainerMutations({
-        currentPolicy: input.currentPolicy,
-        nextPolicy: await prepareAuthoredGroupPolicy({
-            currentPolicy: input.currentPolicy,
-            expectedHead,
-            request: input.request,
-        }),
-    });
-    if ("requests" in prepared) {
-        input.request.containerMutations = [...prepared.requests];
-        return prepared;
-    }
-    input.request.containerMutations = [...prepared];
-    return {};
-}
-async function commitAndCacheGroupPolicyMutation(input) {
-    const stillCurrent = createPolicyMutationCommitGuard(input.assertCanCommit);
-    const expectedHead = await groupPolicyMutationHead(input.request);
-    input.beforePolicyCommit?.(expectedHead);
-    const containerMutations = await prepareGroupContainerMutations(input, expectedHead);
-    const nextAdminProjection = input.policyContext.isOrganizationAdminsGroup
-        ? input.request.projection
-        : input.policyContext.adminPolicyBundle.currentProjection;
-    const adminUsers = await resolveRequiredUserIdentities({
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        userIds: projectionUserIds(nextAdminProjection),
-    });
-    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
-        adminProjection: nextAdminProjection,
-        adminUsers,
-        currentPolicy: input.policyContext.organizationPolicyBundle,
-        descriptor: input.policyContext.organizationDescriptor,
-        groupHeads: replaceOrganizationGroupHead({
-            descriptor: input.policyContext.organizationDescriptor,
-            nextHead: expectedHead,
-        }),
-        signerUserId: input.policyContext.signerUserId,
-        signingFingerprint: input.policyContext.signingFingerprint,
-        signingKeyPair: input.policyContext.signingKeyPair,
-    });
-    input.assertCanCommit?.();
-    const acknowledgedBundle = await commitGroupPolicyMutation({
-        apiClient: input.apiClient,
-        carryDescendantRekeys: containerMutations?.carry,
-        retiredContainerIds: () => containerMutations?.retiredContainerIds ?? [],
-        currentPolicy: input.currentPolicy,
-        execSql: input.execSql,
-        expectedHead,
-        groupId: input.groupId,
-        organizationId: input.organizationId,
-        organizationPolicy: input.policyContext.organizationPolicyBundle,
-        organizationRequest,
-        request: input.request,
-        stillCurrent,
-    });
-    input.assertCanCommit?.();
-    if (containerMutations?.acknowledge) {
-        await containerMutations.acknowledge(acknowledgedBundle.containerMutations, stillCurrent);
-    }
-    input.assertCanCommit?.();
-    await input.afterPolicyCommitBeforeCache?.();
-    input.assertCanCommit?.();
-    await cacheGroupPolicy({
-        acknowledgedMemberEnvelopes: acknowledgedBundle.currentMemberEnvelopes,
-        apiClient: input.apiClient,
-        execSql: input.execSql,
-        expectedCurrentHead: expectedHead,
-        externalAuthority: input.externalAuthority,
-        groupId: input.groupId,
-        localPolicyCheckpoint: {
-            principalId: expectedHead.principalId,
-            principalType: expectedHead.principalType,
-            stateHash: expectedHead.stateHash,
-            version: expectedHead.version,
-        },
-        organizationId: input.organizationId,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        stillCurrent,
-    });
-    input.assertCanCommit?.();
-    return acknowledgedBundle;
-}
-export async function addOrganizationGroupUser(input) {
-    const policyContext = await loadGroupPolicyMutationContext(input);
-    await assertGroupMembershipName(policyContext.currentPolicy, input.expectedGroupName, input.readEncryptedName);
-    const identities = await resolveRequiredUserIdentities({
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        userIds: [
-            ...projectionUserIds(policyContext.currentPolicy.currentProjection),
-            input.targetUserId,
-        ],
-    });
-    const targetUser = identities.find((identity) => identity.userId === input.targetUserId);
-    if (!targetUser) {
-        throw new Error(`User identity could not be loaded for ${input.targetUserId}`);
-    }
-    const request = await buildAddGroupUserPolicyRequest({
-        ...policyContext,
-        currentUserSecretKey: input.currentUserSecretKey,
-        currentUsers: identities.filter((identity) => identity.userId !== input.targetUserId),
-        reportSecurityIncident: input.reportSecurityIncident,
-        targetUser,
-    });
-    return commitAndCacheGroupPolicyMutation({
-        afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,
-        apiClient: input.apiClient,
-        beforePolicyCommit: (head) => input.beforePolicyCommit(head, {
-            adminGroupId: policyContext.adminGroupId,
-            memberGroupId: policyContext.memberGroupId,
-        }),
-        currentPolicy: policyContext.currentPolicy,
-        execSql: input.execSql,
-        externalAuthority: policyContext.externalAuthority,
-        groupId: input.groupId,
-        prepareContainerMutations: input.prepareContainerMutations,
-        request,
-        organizationId: input.organizationId,
-        policyContext,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-}
-export async function removeOrganizationGroupUser(input) {
-    const policyContext = await loadGroupPolicyMutationContext(input);
-    await assertGroupMembershipName(policyContext.currentPolicy, input.expectedGroupName, input.readEncryptedName);
-    const removedKey = input.removedUserId;
-    const projection = policyContext.currentPolicy.currentProjection.filter((member) => member.userId !== removedKey);
-    if (projection.length === policyContext.currentPolicy.currentProjection.length) {
-        throw new Error("User is not a group member");
-    }
-    const remainingUsers = await resolveRequiredUserIdentities({
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        userIds: projectionUserIds(projection),
-    });
-    const request = await buildRemoveGroupUserPolicyRequest({
-        ...policyContext,
-        remainingUsers,
-        removedUserId: input.removedUserId,
-    });
-    return commitAndCacheGroupPolicyMutation({
-        afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,
-        apiClient: input.apiClient,
-        beforePolicyCommit: (head) => input.beforePolicyCommit(head, {
-            adminGroupId: policyContext.adminGroupId,
-            memberGroupId: policyContext.memberGroupId,
-        }),
-        currentPolicy: policyContext.currentPolicy,
-        execSql: input.execSql,
-        externalAuthority: policyContext.externalAuthority,
-        groupId: input.groupId,
-        prepareContainerMutations: input.prepareContainerMutations,
-        request,
-        organizationId: input.organizationId,
-        policyContext,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-}
-/**
- * Adds or changes one container in the group's signed complete grant set and
- * commits every resulting container rematerialization in the same request.
- */
-export async function setOrganizationGroupContainerGrant(input) {
-    const policyContext = await loadGroupPolicyMutationContext({
-        apiClient: input.apiClient,
-        execSql: input.execSql,
-        groupId: input.groupId,
-        organizationId: input.organizationId,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-    const request = await buildSetGroupContainerGrantPolicyRequest({
-        ...policyContext,
-        accessLevel: input.accessLevel,
-        containerId: input.containerId,
-    });
-    return commitAndCacheGroupPolicyMutation({
-        apiClient: input.apiClient,
-        assertCanCommit: input.assertCanCommit,
-        currentPolicy: policyContext.currentPolicy,
-        execSql: input.execSql,
-        externalAuthority: policyContext.externalAuthority,
-        groupId: input.groupId,
-        prepareContainerMutations: input.prepareContainerMutations,
-        request,
-        organizationId: input.organizationId,
-        policyContext,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-}
-/**
- * A group losing a container grant rotates its own key in the same request as
- * that container revoke and the rekeys of all remaining grants. This prevents
- * a later member from using the group's still-current key to open a retained
- * wrap from before the revoke.
- */
-export async function rotateOrganizationGroupForAccessSetShrink(input) {
-    const policyContext = await loadGroupPolicyMutationContext({
-        apiClient: input.apiClient,
-        execSql: input.execSql,
-        groupId: input.groupId,
-        organizationId: input.organizationId,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-    const currentUsers = await resolveRequiredUserIdentities({
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        userIds: projectionUserIds(policyContext.currentPolicy.currentProjection),
-    });
-    const request = await buildGroupAccessSetShrinkPolicyRequest({
-        ...policyContext,
-        currentUsers,
-        revokedContainerId: input.revokedContainerId,
-    });
-    return commitAndCacheGroupPolicyMutation({
-        apiClient: input.apiClient,
-        currentPolicy: policyContext.currentPolicy,
-        execSql: input.execSql,
-        externalAuthority: policyContext.externalAuthority,
-        groupId: input.groupId,
-        prepareContainerMutations: input.prepareContainerMutations,
-        request,
-        organizationId: input.organizationId,
-        policyContext,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-}
-//# sourceMappingURL=principalPolicy.js.map

package/workflows/organizations/principalPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalPolicy.js","sourceRoot":"","sources":["principalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAoB1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,CAAC;AA8ChF,SAAS,+BAA+B,CACtC,eAAyC;IAEzC,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,GAAG,EAAE;QACV,eAAe,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,8BAA8B,CAC3C,KAA6C,EAC7C,YAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,MAAM,0BAA0B,CAAC;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAA6C;IAE7C,MAAM,YAAY,GAAG,+BAA+B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,KAAK,CAAC,kBAAkB,EAAE,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAC7D,KAAK,EACL,YAAY,CACb,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC,yBAAyB;QACvE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe,EAAE,mBAAmB;QACpC,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;QACtD,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;YACtD,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY;QAC9C,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,kBAAkB;QAC1D,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc;KACnD,CAAC,CAAC;IACL,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,qBAAqB,EAAE,kBAAkB,EAAE,KAAK;QAChD,mBAAmB,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,IAAI,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAChE,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,IAAI,kBAAkB,EAAE,WAAW,EAAE,CAAC;QACpC,MAAM,kBAAkB,CAAC,WAAW,CAClC,kBAAkB,CAAC,kBAAkB,EACrC,YAAY,CACb,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC;IAC7C,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE,kBAAkB,CAAC,sBAAsB;QACtE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAyB9C;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE;YACP,GAAG,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;YACnE,KAAK,CAAC,YAAY;SACnB;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,aAAa;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD;QACD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,UAAU;KACX,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAuBjD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC;IACvC,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CACrE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CACzC,CAAC;IACF,IACE,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,6BAA6B,CAAC;QACzD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,UAAU,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC;QACtD,GAAG,aAAa;QAChB,cAAc;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;QAC7D,GAAG,aAAa;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAW/D;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;KAC1E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;QAC3D,GAAG,aAAa;QAChB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["export { createOrganizationGroup } from \"./groupCreation\";\n\nimport type {\n  PrincipalPolicyExternalAuthority,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { assertGroupMembershipName } from \"./groupMembershipName\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  cacheGroupPolicy,\n  commitGroupPolicyMutation,\n  loadGroupPolicyMutationContext,\n  type PrincipalPolicyReadWriteApi,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n  buildSetGroupContainerGrantPolicyRequest,\n} from \"./groupPolicyRequests\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport type { GroupPolicyNameReader } from \"./principalPolicyRequest\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"./principalPolicyRequest\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\nexport { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };\n\ninterface PreparedGroupContainerMutations {\n  readonly retiredContainerIds: readonly string[];\n  readonly acknowledge: (\n    responses: readonly ContainerMutationResponse[],\n    stillCurrent?: (() => boolean) | undefined,\n  ) => Promise<void>;\n  /** Sign the descendant rekeys a refused commit named; see `carry` there. */\n  readonly carry?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly requests: readonly ContainerMutationRequest[];\n}\n\ntype PrepareGroupContainerMutations = (input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly nextPolicy: VerifiedPrincipalPolicy;\n}) => Promise<\n  readonly ContainerMutationRequest[] | PreparedGroupContainerMutations\n>;\n\ninterface CommitAndCacheGroupPolicyMutationInput {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly assertCanCommit?: (() => void) | undefined;\n  readonly beforePolicyCommit?:\n    | ((head: ReferencedPrincipalHead) => void)\n    | undefined;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority | undefined;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly policyContext: Awaited<\n    ReturnType<typeof loadGroupPolicyMutationContext>\n  >;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nfunction createPolicyMutationCommitGuard(\n  assertCanCommit: (() => void) | undefined,\n): (() => boolean) | undefined {\n  if (!assertCanCommit) return undefined;\n  return () => {\n    assertCanCommit();\n    return true;\n  };\n}\n\n/**\n * Plan the container mutations the policy change rematerializes and place their\n * requests on the policy request. A bare request list has nothing to\n * acknowledge or carry; a prepared batch does both.\n */\nasync function prepareGroupContainerMutations(\n  input: CommitAndCacheGroupPolicyMutationInput,\n  expectedHead: ReferencedPrincipalHead,\n): Promise<Partial<PreparedGroupContainerMutations> | null> {\n  if (!input.prepareContainerMutations) return null;\n  const prepared = await input.prepareContainerMutations({\n    currentPolicy: input.currentPolicy,\n    nextPolicy: await prepareAuthoredGroupPolicy({\n      currentPolicy: input.currentPolicy,\n      expectedHead,\n      request: input.request,\n    }),\n  });\n  if (\"requests\" in prepared) {\n    input.request.containerMutations = [...prepared.requests];\n    return prepared;\n  }\n  input.request.containerMutations = [...prepared];\n  return {};\n}\n\nasync function commitAndCacheGroupPolicyMutation(\n  input: CommitAndCacheGroupPolicyMutationInput,\n): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stillCurrent = createPolicyMutationCommitGuard(input.assertCanCommit);\n  const expectedHead = await groupPolicyMutationHead(input.request);\n  input.beforePolicyCommit?.(expectedHead);\n  const containerMutations = await prepareGroupContainerMutations(\n    input,\n    expectedHead,\n  );\n  const nextAdminProjection = input.policyContext.isOrganizationAdminsGroup\n    ? input.request.projection\n    : input.policyContext.adminPolicyBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(nextAdminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection: nextAdminProjection,\n      adminUsers,\n      currentPolicy: input.policyContext.organizationPolicyBundle,\n      descriptor: input.policyContext.organizationDescriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: input.policyContext.organizationDescriptor,\n        nextHead: expectedHead,\n      }),\n      signerUserId: input.policyContext.signerUserId,\n      signingFingerprint: input.policyContext.signingFingerprint,\n      signingKeyPair: input.policyContext.signingKeyPair,\n    });\n  input.assertCanCommit?.();\n  const acknowledgedBundle = await commitGroupPolicyMutation({\n    apiClient: input.apiClient,\n    carryDescendantRekeys: containerMutations?.carry,\n    retiredContainerIds: () => containerMutations?.retiredContainerIds ?? [],\n    currentPolicy: input.currentPolicy,\n    execSql: input.execSql,\n    expectedHead,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    organizationPolicy: input.policyContext.organizationPolicyBundle,\n    organizationRequest,\n    request: input.request,\n    stillCurrent,\n  });\n  input.assertCanCommit?.();\n  if (containerMutations?.acknowledge) {\n    await containerMutations.acknowledge(\n      acknowledgedBundle.containerMutations,\n      stillCurrent,\n    );\n  }\n  input.assertCanCommit?.();\n  await input.afterPolicyCommitBeforeCache?.();\n  input.assertCanCommit?.();\n  await cacheGroupPolicy({\n    acknowledgedMemberEnvelopes: acknowledgedBundle.currentMemberEnvelopes,\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedCurrentHead: expectedHead,\n    externalAuthority: input.externalAuthority,\n    groupId: input.groupId,\n    localPolicyCheckpoint: {\n      principalId: expectedHead.principalId,\n      principalType: expectedHead.principalType,\n      stateHash: expectedHead.stateHash,\n      version: expectedHead.version,\n    },\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n  input.assertCanCommit?.();\n  return acknowledgedBundle;\n}\n\nexport async function addOrganizationGroupUser(input: {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly execSql: ExecSql;\n  readonly expectedGroupName: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly targetUserId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly beforePolicyCommit: (\n    head: ReferencedPrincipalHead,\n    authority: {\n      readonly adminGroupId: string;\n      readonly memberGroupId: string;\n    },\n  ) => void;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext(input);\n  await assertGroupMembershipName(\n    policyContext.currentPolicy,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  const identities = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [\n      ...projectionUserIds(policyContext.currentPolicy.currentProjection),\n      input.targetUserId,\n    ],\n  });\n  const targetUser = identities.find(\n    (identity) => identity.userId === input.targetUserId,\n  );\n  if (!targetUser) {\n    throw new Error(\n      `User identity could not be loaded for ${input.targetUserId}`,\n    );\n  }\n  const request = await buildAddGroupUserPolicyRequest({\n    ...policyContext,\n    currentUserSecretKey: input.currentUserSecretKey,\n    currentUsers: identities.filter(\n      (identity) => identity.userId !== input.targetUserId,\n    ),\n    reportSecurityIncident: input.reportSecurityIncident,\n    targetUser,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n    apiClient: input.apiClient,\n    beforePolicyCommit: (head) =>\n      input.beforePolicyCommit(head, {\n        adminGroupId: policyContext.adminGroupId,\n        memberGroupId: policyContext.memberGroupId,\n      }),\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\nexport async function removeOrganizationGroupUser(input: {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly execSql: ExecSql;\n  readonly expectedGroupName: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly removedUserId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly beforePolicyCommit: (\n    head: ReferencedPrincipalHead,\n    authority: {\n      readonly adminGroupId: string;\n      readonly memberGroupId: string;\n    },\n  ) => void;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext(input);\n  await assertGroupMembershipName(\n    policyContext.currentPolicy,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  const removedKey = input.removedUserId;\n  const projection = policyContext.currentPolicy.currentProjection.filter(\n    (member) => member.userId !== removedKey,\n  );\n  if (\n    projection.length === policyContext.currentPolicy.currentProjection.length\n  ) {\n    throw new Error(\"User is not a group member\");\n  }\n  const remainingUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(projection),\n  });\n  const request = await buildRemoveGroupUserPolicyRequest({\n    ...policyContext,\n    remainingUsers,\n    removedUserId: input.removedUserId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n    apiClient: input.apiClient,\n    beforePolicyCommit: (head) =>\n      input.beforePolicyCommit(head, {\n        adminGroupId: policyContext.adminGroupId,\n        memberGroupId: policyContext.memberGroupId,\n      }),\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\n/**\n * Adds or changes one container in the group's signed complete grant set and\n * commits every resulting container rematerialization in the same request.\n */\nexport async function setOrganizationGroupContainerGrant(input: {\n  readonly accessLevel: \"admin\" | \"read\" | \"write\";\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly assertCanCommit?: (() => void) | undefined;\n  readonly containerId: string;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly prepareContainerMutations: PrepareGroupContainerMutations;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const request = await buildSetGroupContainerGrantPolicyRequest({\n    ...policyContext,\n    accessLevel: input.accessLevel,\n    containerId: input.containerId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    apiClient: input.apiClient,\n    assertCanCommit: input.assertCanCommit,\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\n/**\n * A group losing a container grant rotates its own key in the same request as\n * that container revoke and the rekeys of all remaining grants. This prevents\n * a later member from using the group's still-current key to open a retained\n * wrap from before the revoke.\n */\nexport async function rotateOrganizationGroupForAccessSetShrink(input: {\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly revokedContainerId: string;\n  readonly prepareContainerMutations: PrepareGroupContainerMutations;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const currentUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(policyContext.currentPolicy.currentProjection),\n  });\n  const request = await buildGroupAccessSetShrinkPolicyRequest({\n    ...policyContext,\n    currentUsers,\n    revokedContainerId: input.revokedContainerId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    apiClient: input.apiClient,\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n"]}

package/workflows/organizations/principalPolicyApi.d.ts

@@ -1,33 +0,0 @@
-import type { RequestFailureKind } from "../../internal/api-client/index.js";
-import type { CommitOrganizationGroupPolicyRequest, CreateOrganizationGroupWithPolicyRequest } from "../../internal/validators/request/index.js";
-import type { CommitOrganizationGroupPolicyResponse, CreateOrganizationGroupResponse } from "../../internal/validators/response/index.js";
-import type { CurrentPrincipalPolicyReader } from "../principals/currentPrincipalPolicyReader.js";
-export interface PrincipalPolicyReadApi extends CurrentPrincipalPolicyReader {
-    /** Resolve authored work before reading the state for a new mutation. */
-    readonly recoverPendingPrincipalMutation?: ((organizationId: string) => Promise<void>) | undefined;
-}
-export interface PrincipalPolicyReadWriteApi extends PrincipalPolicyReadApi {
-    commitOrganizationGroupPolicy: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest) => Promise<CommitOrganizationGroupPolicyResponse | null>;
-    /**
-     * Optional status-bearing variant. A rematerialized rotation the server
-     * refuses for stranding a granted path names the descendant rekeys the batch
-     * must carry; without this the refusal is a plain failure.
-     */
-    commitOrganizationGroupPolicyResult?: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest, options?: {
-        readonly reportErrors?: boolean | undefined;
-    }) => Promise<{
-        readonly ok: true;
-        readonly data: CommitOrganizationGroupPolicyResponse;
-    } | {
-        readonly ok: false;
-        readonly kind?: RequestFailureKind | undefined;
-        readonly message?: string | undefined;
-        readonly code?: string | undefined;
-        readonly report?: (() => void) | undefined;
-        readonly requiredContainerIds?: readonly string[] | undefined;
-        readonly status: number | null;
-    }>;
-}
-export interface OrganizationPrincipalPolicyApi extends PrincipalPolicyReadApi {
-    createOrganizationGroup: (organizationId: string, input: CreateOrganizationGroupWithPolicyRequest) => Promise<CreateOrganizationGroupResponse | null>;
-}

package/workflows/organizations/principalPolicyApi.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalPolicyApi.js","sourceRoot":"","sources":["principalPolicyApi.ts"],"names":[],"mappings":"","sourcesContent":["import type { RequestFailureKind } from \"@tearleads/api-client\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  CreateOrganizationGroupResponse,\n} from \"@tearleads/validators/response\";\nimport type { CurrentPrincipalPolicyReader } from \"../principals/currentPrincipalPolicyReader\";\n\nexport interface PrincipalPolicyReadApi extends CurrentPrincipalPolicyReader {\n  /** Resolve authored work before reading the state for a new mutation. */\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n}\n\nexport interface PrincipalPolicyReadWriteApi extends PrincipalPolicyReadApi {\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n  /**\n   * Optional status-bearing variant. A rematerialized rotation the server\n   * refuses for stranding a granted path names the descendant rekeys the batch\n   * must carry; without this the refusal is a plain failure.\n   */\n  commitOrganizationGroupPolicyResult?: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options?: { readonly reportErrors?: boolean | undefined },\n  ) => Promise<\n    | {\n        readonly ok: true;\n        readonly data: CommitOrganizationGroupPolicyResponse;\n      }\n    | {\n        readonly ok: false;\n        readonly kind?: RequestFailureKind | undefined;\n        readonly message?: string | undefined;\n        readonly code?: string | undefined;\n        readonly report?: (() => void) | undefined;\n        readonly requiredContainerIds?: readonly string[] | undefined;\n        readonly status: number | null;\n      }\n  >;\n}\n\nexport interface OrganizationPrincipalPolicyApi extends PrincipalPolicyReadApi {\n  createOrganizationGroup: (\n    organizationId: string,\n    input: CreateOrganizationGroupWithPolicyRequest,\n  ) => Promise<CreateOrganizationGroupResponse | null>;\n}\n"]}

package/workflows/organizations/principalPolicyReceiptArtifacts.js

@@ -1,74 +0,0 @@
-import { compareCanonicalStrings, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
-import { canonicalKeyingJsonString } from "../../data/keying/canonicalJson.js";
-function sortedCanonicalValues(values, label) {
-    return [...values].sort((left, right) => compareCanonicalStrings(canonicalKeyingJsonString(left, label), canonicalKeyingJsonString(right, label)));
-}
-export function assertGroupPolicyEnvelopesMatchAcknowledgement(expected, observed) {
-    const normalized = (value) => ({
-        ...value,
-        envelopes: sortedCanonicalValues(value.envelopes, "principal member envelope"),
-    });
-    if (canonicalKeyingJsonString(normalized(expected), "acknowledged group member envelopes") !==
-        canonicalKeyingJsonString(normalized(observed), "observed group member envelopes")) {
-        throw new Error("Group member envelopes changed after acknowledgement");
-    }
-}
-function assertContainerMutationAcknowledgements(input) {
-    if (!input.responses || input.responses.length !== input.requests.length) {
-        throw new Error("Group policy container acknowledgement batch is incomplete");
-    }
-    for (const [index, request] of input.requests.entries()) {
-        const response = input.responses[index];
-        if (!response) {
-            throw new Error("Group policy container acknowledgement batch is incomplete");
-        }
-        const expected = {
-            body: request.body,
-            event: request.event,
-            keyEpoch: request.keyEpoch,
-            manifest: request.manifest,
-            wraps: sortedCanonicalValues(request.wraps, "authored container wrap"),
-        };
-        const observed = {
-            body: response.accessManifest.event.body,
-            event: response.accessManifest.event.event,
-            keyEpoch: response.containerKek.keyEpoch,
-            manifest: response.accessManifest.manifest,
-            wraps: sortedCanonicalValues(response.containerKek.wraps, "stored container wrap"),
-        };
-        if (canonicalKeyingJsonString(observed, "stored group policy container mutation") !==
-            canonicalKeyingJsonString(expected, "authored group policy container mutation")) {
-            throw new Error("Group policy container acknowledgement mismatch");
-        }
-    }
-}
-/** Compare receipt artifacts without manufacturing predecessor history or pins. */
-export function assertPrincipalPolicyReceiptArtifacts(input) {
-    assertContainerMutationAcknowledgements({
-        requests: input.request.containerMutations ?? [],
-        responses: input.response.containerMutations,
-    });
-    const { createdAt: _payloadCreatedAt, ...observedPayload } = input.response.currentPayload;
-    const expectedPayload = {
-        principalType: input.request.state.principalType,
-        principalId: input.request.state.principalId,
-        stateHash: input.expectedHead.stateHash,
-        ...input.request.encryptedPayload,
-    };
-    if (canonicalKeyingJsonString(observedPayload, "stored group policy payload") !==
-        canonicalKeyingJsonString(expectedPayload, "authored group policy payload") ||
-        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(input.response.currentProjection), "stored group policy projection") !==
-            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(input.request.projection), "authored group policy projection") ||
-        canonicalKeyingJsonString(normalizePrincipalContainerGrants(input.response.currentGrants), "stored group policy grants") !==
-            canonicalKeyingJsonString(normalizePrincipalContainerGrants(input.request.grants), "authored group policy grants")) {
-        throw new Error("Group policy bundle acknowledgement mismatch");
-    }
-    assertGroupPolicyEnvelopesMatchAcknowledgement({
-        principalType: input.request.state.principalType,
-        principalId: input.request.state.principalId,
-        stateHash: input.expectedHead.stateHash,
-        epoch: input.request.state.keyEpoch,
-        envelopes: input.request.memberEnvelopes,
-    }, input.response.currentMemberEnvelopes);
-}
-//# sourceMappingURL=principalPolicyReceiptArtifacts.js.map

package/workflows/organizations/principalPolicyReceiptArtifacts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalPolicyReceiptArtifacts.js","sourceRoot":"","sources":["principalPolicyReceiptArtifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,SAAS,qBAAqB,CAAI,MAAoB,EAAE,KAAa;IACnE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtC,uBAAuB,CACrB,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,EACtC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CACxC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,QAAiD,EACjD,QAAiD;IAEjD,MAAM,UAAU,GAAG,CAAC,KAA8C,EAAE,EAAE,CAAC,CAAC;QACtE,GAAG,KAAK;QACR,SAAS,EAAE,qBAAqB,CAC9B,KAAK,CAAC,SAAS,EACf,2BAA2B,CAC5B;KACF,CAAC,CAAC;IACH,IACE,yBAAyB,CACvB,UAAU,CAAC,QAAQ,CAAC,EACpB,qCAAqC,CACtC;QACD,yBAAyB,CACvB,UAAU,CAAC,QAAQ,CAAC,EACpB,iCAAiC,CAClC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,uCAAuC,CAAC,KAKhD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,CAAC;SACvE,CAAC;QACF,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;YACxC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK;YAC1C,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,QAAQ;YAC1C,KAAK,EAAE,qBAAqB,CAC1B,QAAQ,CAAC,YAAY,CAAC,KAAK,EAC3B,uBAAuB,CACxB;SACF,CAAC;QACF,IACE,yBAAyB,CACvB,QAAQ,EACR,wCAAwC,CACzC;YACD,yBAAyB,CACvB,QAAQ,EACR,0CAA0C,CAC3C,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qCAAqC,CAAC,KAIrD;IACC,uCAAuC,CAAC;QACtC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE;QAChD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,eAAe,EAAE,GACxD,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,MAAM,eAAe,GAAG;QACtB,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa;QAChD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB;KAClC,CAAC;IAEF,IACE,yBAAyB,CACvB,eAAe,EACf,6BAA6B,CAC9B;QACC,yBAAyB,CACvB,eAAe,EACf,+BAA+B,CAChC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EACrE,gCAAgC,CACjC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAC7D,kCAAkC,CACnC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC/D,4BAA4B,CAC7B;YACC,yBAAyB,CACvB,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACvD,8BAA8B,CAC/B,EACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,8CAA8C,CAC5C;QACE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa;QAChD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ;QACnC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;KACzC,EACD,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CACtC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  CurrentPrincipalMemberEnvelopesResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../data/keying/canonicalJson\";\n\nfunction sortedCanonicalValues<T>(values: readonly T[], label: string): T[] {\n  return [...values].sort((left, right) =>\n    compareCanonicalStrings(\n      canonicalKeyingJsonString(left, label),\n      canonicalKeyingJsonString(right, label),\n    ),\n  );\n}\n\nexport function assertGroupPolicyEnvelopesMatchAcknowledgement(\n  expected: CurrentPrincipalMemberEnvelopesResponse,\n  observed: CurrentPrincipalMemberEnvelopesResponse,\n): void {\n  const normalized = (value: CurrentPrincipalMemberEnvelopesResponse) => ({\n    ...value,\n    envelopes: sortedCanonicalValues(\n      value.envelopes,\n      \"principal member envelope\",\n    ),\n  });\n  if (\n    canonicalKeyingJsonString(\n      normalized(expected),\n      \"acknowledged group member envelopes\",\n    ) !==\n    canonicalKeyingJsonString(\n      normalized(observed),\n      \"observed group member envelopes\",\n    )\n  ) {\n    throw new Error(\"Group member envelopes changed after acknowledgement\");\n  }\n}\n\nfunction assertContainerMutationAcknowledgements(input: {\n  readonly requests: readonly NonNullable<\n    PutPrincipalPolicyRequest[\"containerMutations\"]\n  >[number][];\n  readonly responses: readonly ContainerMutationResponse[] | undefined;\n}): void {\n  if (!input.responses || input.responses.length !== input.requests.length) {\n    throw new Error(\n      \"Group policy container acknowledgement batch is incomplete\",\n    );\n  }\n  for (const [index, request] of input.requests.entries()) {\n    const response = input.responses[index];\n    if (!response) {\n      throw new Error(\n        \"Group policy container acknowledgement batch is incomplete\",\n      );\n    }\n    const expected = {\n      body: request.body,\n      event: request.event,\n      keyEpoch: request.keyEpoch,\n      manifest: request.manifest,\n      wraps: sortedCanonicalValues(request.wraps, \"authored container wrap\"),\n    };\n    const observed = {\n      body: response.accessManifest.event.body,\n      event: response.accessManifest.event.event,\n      keyEpoch: response.containerKek.keyEpoch,\n      manifest: response.accessManifest.manifest,\n      wraps: sortedCanonicalValues(\n        response.containerKek.wraps,\n        \"stored container wrap\",\n      ),\n    };\n    if (\n      canonicalKeyingJsonString(\n        observed,\n        \"stored group policy container mutation\",\n      ) !==\n      canonicalKeyingJsonString(\n        expected,\n        \"authored group policy container mutation\",\n      )\n    ) {\n      throw new Error(\"Group policy container acknowledgement mismatch\");\n    }\n  }\n}\n\n/** Compare receipt artifacts without manufacturing predecessor history or pins. */\nexport function assertPrincipalPolicyReceiptArtifacts(input: {\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly response: PrincipalPolicyMutationResponse;\n}): void {\n  assertContainerMutationAcknowledgements({\n    requests: input.request.containerMutations ?? [],\n    responses: input.response.containerMutations,\n  });\n  const { createdAt: _payloadCreatedAt, ...observedPayload } =\n    input.response.currentPayload;\n  const expectedPayload = {\n    principalType: input.request.state.principalType,\n    principalId: input.request.state.principalId,\n    stateHash: input.expectedHead.stateHash,\n    ...input.request.encryptedPayload,\n  };\n\n  if (\n    canonicalKeyingJsonString(\n      observedPayload,\n      \"stored group policy payload\",\n    ) !==\n      canonicalKeyingJsonString(\n        expectedPayload,\n        \"authored group policy payload\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(input.response.currentProjection),\n      \"stored group policy projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(input.request.projection),\n        \"authored group policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(input.response.currentGrants),\n      \"stored group policy grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(input.request.grants),\n        \"authored group policy grants\",\n      )\n  ) {\n    throw new Error(\"Group policy bundle acknowledgement mismatch\");\n  }\n\n  assertGroupPolicyEnvelopesMatchAcknowledgement(\n    {\n      principalType: input.request.state.principalType,\n      principalId: input.request.state.principalId,\n      stateHash: input.expectedHead.stateHash,\n      epoch: input.request.state.keyEpoch,\n      envelopes: input.request.memberEnvelopes,\n    },\n    input.response.currentMemberEnvelopes,\n  );\n}\n"]}

package/workflows/organizations/principalPolicyRecipients.js

@@ -1,43 +0,0 @@
-import { wrapDekForRecipients } from "../../internal/crypto/index.js";
-import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
-function toPrincipalMemberEnvelopeRequest(input) {
-    return {
-        userId: input.userId,
-        memberKeyFingerprint: input.envelope.keyFingerprint,
-        kemCipherText: bytesToBase64(input.envelope.kemCipherText),
-        wrappedKey: bytesToBase64(input.envelope.wrappedKey),
-    };
-}
-export function toRecipientEntries(envelopes) {
-    return envelopes.map((envelope) => ({
-        keyFingerprint: envelope.memberKeyFingerprint,
-        kemCipherText: base64ToBytes(envelope.kemCipherText),
-        wrappedKey: base64ToBytes(envelope.wrappedKey),
-    }));
-}
-/** Every projected member is a user, so there is no group recipient branch. */
-function toRekeyRecipientEntries(input) {
-    const usersById = new Map(input.users.map((user) => [user.userId, user]));
-    return input.projection.map((member) => {
-        const user = usersById.get(member.userId);
-        if (!user) {
-            throw new Error(`Missing recipient key for user ${member.userId}`);
-        }
-        return {
-            encapsulationPublicKey: user.encapsulationPublicKey,
-            userId: user.userId,
-        };
-    });
-}
-export async function rewrapProjectionMemberEnvelopes(input) {
-    const recipients = toRekeyRecipientEntries(input);
-    if (recipients.length === 0) {
-        return [];
-    }
-    const wrappedRecipients = await wrapDekForRecipients(input.secretKey, recipients.map((recipient) => recipient.encapsulationPublicKey));
-    return wrappedRecipients.map((envelope, index) => toPrincipalMemberEnvelopeRequest({
-        envelope,
-        userId: recipients[index]?.userId ?? "",
-    }));
-}
-//# sourceMappingURL=principalPolicyRecipients.js.map

package/workflows/organizations/principalPolicyRecipients.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalPolicyRecipients.js","sourceRoot":"","sources":["principalPolicyRecipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAanE,SAAS,gCAAgC,CAAC,KAOzC;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QACnD,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1D,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,KAGhC;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1E,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAClD,KAAK,CAAC,SAAS,EACf,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAChE,CAAC;IAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAC/C,gCAAgC,CAAC;QAC/B,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE;KACxC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { wrapDekForRecipients } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalMemberEnvelopeRequest,\n  PrincipalProjectionMemberRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalMemberEnvelopeResponse } from \"@tearleads/validators/response\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\n\ntype PrincipalRekeyRecipient = {\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly userId: string;\n};\n\nfunction toPrincipalMemberEnvelopeRequest(input: {\n  readonly envelope: {\n    readonly keyFingerprint: string;\n    readonly kemCipherText: Uint8Array;\n    readonly wrappedKey: Uint8Array;\n  };\n  readonly userId: string;\n}): PrincipalMemberEnvelopeRequest {\n  return {\n    userId: input.userId,\n    memberKeyFingerprint: input.envelope.keyFingerprint,\n    kemCipherText: bytesToBase64(input.envelope.kemCipherText),\n    wrappedKey: bytesToBase64(input.envelope.wrappedKey),\n  };\n}\n\nexport function toRecipientEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n) {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\n/** Every projected member is a user, so there is no group recipient branch. */\nfunction toRekeyRecipientEntries(input: {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n  readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): PrincipalRekeyRecipient[] {\n  const usersById = new Map(input.users.map((user) => [user.userId, user]));\n\n  return input.projection.map((member) => {\n    const user = usersById.get(member.userId);\n    if (!user) {\n      throw new Error(`Missing recipient key for user ${member.userId}`);\n    }\n\n    return {\n      encapsulationPublicKey: user.encapsulationPublicKey,\n      userId: user.userId,\n    };\n  });\n}\n\nexport async function rewrapProjectionMemberEnvelopes(input: {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n  readonly secretKey: Uint8Array;\n  readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): Promise<PrincipalMemberEnvelopeRequest[]> {\n  const recipients = toRekeyRecipientEntries(input);\n  if (recipients.length === 0) {\n    return [];\n  }\n  const wrappedRecipients = await wrapDekForRecipients(\n    input.secretKey,\n    recipients.map((recipient) => recipient.encapsulationPublicKey),\n  );\n\n  return wrappedRecipients.map((envelope, index) =>\n    toPrincipalMemberEnvelopeRequest({\n      envelope,\n      userId: recipients[index]?.userId ?? \"\",\n    }),\n  );\n}\n"]}