@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/organizations/groupPolicyMutationAcknowledgement.js

@@ -1,174 +0,0 @@
-import { computePrincipalContainerGrantRoot, computePrincipalMemberEnvelopesRoot, computePrincipalMembershipRoot, computePrincipalProjectionRoot, computePrincipalStatePayloadCiphertextHash, makeVerifiedPrincipalPolicy, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
-import { canonicalKeyingJsonString } from "../../data/keying/canonicalJson.js";
-import { verifyCurrentPolicyMutation, } from "./currentPolicyMutationAcknowledgement.js";
-import { assertPrincipalPolicyReceiptArtifacts } from "./principalPolicyReceiptArtifacts.js";
-export { assertGroupPolicyEnvelopesMatchAcknowledgement } from "./principalPolicyReceiptArtifacts.js";
-function historyWithCurrent(bundle) {
-    return [
-        ...bundle.previousStates,
-        {
-            state: bundle.currentState,
-            projection: bundle.currentProjection,
-            grants: bundle.currentGrants,
-        },
-    ];
-}
-function isAuthoredSuccessorConsistent(state, expectedHead, previous) {
-    return (state.principalType === expectedHead.principalType &&
-        state.principalId === expectedHead.principalId &&
-        state.version === expectedHead.version &&
-        state.keyEpoch === expectedHead.keyEpoch &&
-        state.keyFingerprint === expectedHead.keyFingerprint &&
-        state.principalType === previous.principalType &&
-        state.principalId === previous.principalId &&
-        state.version === previous.version + 1 &&
-        state.prevStateHash === previous.stateHash);
-}
-export function buildAcknowledgedGroupPolicyBundle(input) {
-    assertPrincipalPolicyReceiptArtifacts(input);
-    return {
-        ...input.response,
-        previousStates: historyWithCurrent(input.currentPolicy),
-    };
-}
-async function assertPolicyRequestCommitments(request) {
-    const projection = normalizePrincipalProjectionMembers(request.projection);
-    const members = projection.map((member) => ({ userId: member.userId }));
-    const [membershipRoot, memberEnvelopesRoot, projectionRoot, payloadCiphertextHash, grantRoot,] = await Promise.all([
-        computePrincipalMembershipRoot(members),
-        computePrincipalMemberEnvelopesRoot(request.memberEnvelopes),
-        computePrincipalProjectionRoot(projection),
-        computePrincipalStatePayloadCiphertextHash(request.encryptedPayload.ciphertext),
-        computePrincipalContainerGrantRoot(request.grants),
-    ]);
-    if (request.state.membershipRoot !== membershipRoot ||
-        request.state.memberEnvelopesRoot !== memberEnvelopesRoot ||
-        request.state.projectionRoot !== projectionRoot ||
-        request.state.memberCount !== projection.length ||
-        request.state.grantRoot !== grantRoot ||
-        request.state.grantCount !== request.grants.length ||
-        request.encryptedPayload.ciphertextHash !== payloadCiphertextHash ||
-        request.state.payloadCiphertextHash !== payloadCiphertextHash) {
-        throw new Error("Authored group policy commitments are invalid");
-    }
-}
-function verifiedPolicy(input) {
-    const previousStates = input.currentPolicy
-        ? historyWithCurrent(input.currentPolicy)
-        : [];
-    return makeVerifiedPrincipalPolicy({
-        checkpoint: {
-            principalId: input.state.principalId,
-            principalType: input.state.principalType,
-            stateHash: input.state.stateHash,
-            version: input.state.version,
-        },
-        history: [
-            ...previousStates,
-            {
-                state: input.state,
-                projection: input.projection,
-                grants: input.grants,
-            },
-        ],
-        keyEpoch: input.state.keyEpoch,
-        principalId: input.state.principalId,
-        principalType: input.state.principalType,
-        projection: input.projection,
-        grants: input.grants,
-        state: input.state,
-        stateHash: input.state.stateHash,
-        version: input.state.version,
-    });
-}
-export async function acknowledgeGroupPolicyState(input) {
-    if (input.verifiedCurrentPolicy !== undefined)
-        return verifyCurrentPolicyMutation(input, input.response);
-    await assertPolicyRequestCommitments(input.request);
-    const { createdAt: _createdAt, stateHash, ...responseState } = input.response;
-    const previous = input.currentPolicy.currentState;
-    if (stateHash !== input.expectedHead.stateHash ||
-        !isAuthoredSuccessorConsistent(input.response, input.expectedHead, previous) ||
-        canonicalKeyingJsonString(responseState, "stored group policy state") !==
-            canonicalKeyingJsonString(input.request.state, "authored group policy state")) {
-        throw new Error("Group policy state acknowledgement mismatch");
-    }
-    return verifiedPolicy({
-        currentPolicy: input.currentPolicy,
-        projection: input.request.projection,
-        grants: input.request.grants,
-        state: input.response,
-    });
-}
-export async function prepareAuthoredGroupPolicy(input) {
-    if (input.verifiedCurrentPolicy !== undefined)
-        return verifyCurrentPolicyMutation(input);
-    await assertPolicyRequestCommitments(input.request);
-    const previous = input.currentPolicy.currentState;
-    const state = input.request.state;
-    if (!isAuthoredSuccessorConsistent(state, input.expectedHead, previous)) {
-        throw new Error("Authored group policy successor is inconsistent");
-    }
-    return verifiedPolicy({
-        currentPolicy: input.currentPolicy,
-        projection: input.request.projection,
-        grants: input.request.grants,
-        state: {
-            ...state,
-            stateHash: input.expectedHead.stateHash,
-            createdAt: state.signedAt,
-        },
-    });
-}
-export async function acknowledgeInitialGroupPolicy(input) {
-    await assertPolicyRequestCommitments(input.request.initialGroupPolicy);
-    const state = input.request.initialGroupPolicy.state;
-    if (input.response.groupId !== input.request.groupId ||
-        input.response.organizationId !== input.organizationId ||
-        input.response.isBuiltin ||
-        input.response.currentState?.stateHash !== input.stateHash ||
-        input.response.currentState.version !== state.version ||
-        input.response.currentState.keyEpoch !== state.keyEpoch ||
-        input.response.currentState.keyFingerprint !== state.keyFingerprint ||
-        input.response.currentState.memberCount !== state.memberCount ||
-        state.principalType !== "group" ||
-        state.principalId !== input.request.groupId ||
-        state.version !== 1 ||
-        state.prevStateHash !== null) {
-        throw new Error("Created group policy acknowledgement mismatch");
-    }
-    const storedState = {
-        ...state,
-        createdAt: input.response.createdAt,
-        stateHash: input.stateHash,
-    };
-    const bundle = {
-        currentMemberEnvelopes: {
-            envelopes: input.request.initialGroupPolicy.memberEnvelopes,
-            epoch: state.keyEpoch,
-            principalId: state.principalId,
-            principalType: state.principalType,
-            stateHash: input.stateHash,
-        },
-        currentPayload: {
-            principalId: state.principalId,
-            principalType: state.principalType,
-            stateHash: input.stateHash,
-            ...input.request.initialGroupPolicy.encryptedPayload,
-            createdAt: input.response.createdAt,
-        },
-        currentProjection: input.request.initialGroupPolicy.projection,
-        currentGrants: input.request.initialGroupPolicy.grants,
-        currentState: storedState,
-        previousStates: [],
-    };
-    return {
-        bundle,
-        policy: verifiedPolicy({
-            projection: input.request.initialGroupPolicy.projection,
-            grants: input.request.initialGroupPolicy.grants,
-            state: storedState,
-        }),
-    };
-}
-//# sourceMappingURL=groupPolicyMutationAcknowledgement.js.map

package/workflows/organizations/groupPolicyMutationAcknowledgement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupPolicyMutationAcknowledgement.js","sourceRoot":"","sources":["groupPolicyMutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,0CAA0C,EAC1C,2BAA2B,EAC3B,mCAAmC,GAIpC,MAAM,mBAAmB,CAAC;AAW3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAEL,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAE1F,OAAO,EAAE,8CAA8C,EAAE,MAAM,mCAAmC,CAAC;AAEnG,SAAS,kBAAkB,CACzB,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,KAQC,EACD,YAAqC,EACrC,QAAgC;IAEhC,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QAClD,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC9C,KAAK,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO;QACtC,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QACxC,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc;QACpD,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC9C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC1C,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,GAAG,CAAC;QACtC,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,SAAS,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,cAAc,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAkC;IAElC,MAAM,UAAU,GAAG,mCAAmC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,CACJ,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACV,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,8BAA8B,CAAC,OAAO,CAAC;QACvC,mCAAmC,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,8BAA8B,CAAC,UAAU,CAAC;QAC1C,0CAA0C,CACxC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CACpC;QACD,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC;KACnD,CAAC,CAAC;IACH,IACE,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,mBAAmB;QACzD,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM;QAC/C,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;QACrC,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM;QAClD,OAAO,CAAC,gBAAgB,CAAC,cAAc,KAAK,qBAAqB;QACjE,OAAO,CAAC,KAAK,CAAC,qBAAqB,KAAK,qBAAqB,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa;QACxC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,2BAA2B,CAAC;QACjC,UAAU,EAAE;YACV,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B;QACD,OAAO,EAAE;YACP,GAAG,cAAc;YACjB;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;KAC7B,CAAC,CAAC;AACL,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAEC;IAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,IACE,SAAS,KAAK,KAAK,CAAC,YAAY,CAAC,SAAS;QAC1C,CAAC,6BAA6B,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,QAAQ,CACT;QACD,yBAAyB,CAAC,aAAa,EAAE,2BAA2B,CAAC;YACnE,yBAAyB,CACvB,KAAK,CAAC,OAAO,CAAC,KAAK,EACnB,6BAA6B,CAC9B,EACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE,KAAK,CAAC,QAAQ;KACtB,CAAC,CAAC;AACL,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA2D;IAE3D,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE;YACL,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;YACvC,SAAS,EAAE,KAAK,CAAC,QAAQ;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IAIC,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACrD,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAChD,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACtD,KAAK,CAAC,QAAQ,CAAC,SAAS;QACxB,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,KAAK,KAAK,CAAC,SAAS;QAC1D,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACrD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACvD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACnE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAC7D,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAC3C,KAAK,CAAC,OAAO,KAAK,CAAC;QACnB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,GAAG,KAAK;QACR,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,MAAM,GAAkC;QAC5C,sBAAsB,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe;YAC3D,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,cAAc,EAAE;YACd,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB;YACpD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;SACpC;QACD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;QAC9D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;QACtD,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,EAAE;KACnB,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM,EAAE,cAAc,CAAC;YACrB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;YACvD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;YAC/C,KAAK,EAAE,WAAW;SACnB,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  computePrincipalContainerGrantRoot,\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalMembershipRoot,\n  computePrincipalProjectionRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  makeVerifiedPrincipalPolicy,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type {\n  CreateOrganizationGroupRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationGroupSummaryResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n  PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../data/keying/canonicalJson\";\nimport {\n  type CurrentPolicyMutationInput,\n  verifyCurrentPolicyMutation,\n} from \"./currentPolicyMutationAcknowledgement\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"./principalPolicyReceiptArtifacts\";\n\nexport { assertGroupPolicyEnvelopesMatchAcknowledgement } from \"./principalPolicyReceiptArtifacts\";\n\nfunction historyWithCurrent(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"previousStates\"] {\n  return [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ];\n}\n\nfunction isAuthoredSuccessorConsistent(\n  state: Pick<\n    PrincipalStateResponse,\n    | \"keyEpoch\"\n    | \"keyFingerprint\"\n    | \"prevStateHash\"\n    | \"principalId\"\n    | \"principalType\"\n    | \"version\"\n  >,\n  expectedHead: ReferencedPrincipalHead,\n  previous: PrincipalStateResponse,\n): boolean {\n  return (\n    state.principalType === expectedHead.principalType &&\n    state.principalId === expectedHead.principalId &&\n    state.version === expectedHead.version &&\n    state.keyEpoch === expectedHead.keyEpoch &&\n    state.keyFingerprint === expectedHead.keyFingerprint &&\n    state.principalType === previous.principalType &&\n    state.principalId === previous.principalId &&\n    state.version === previous.version + 1 &&\n    state.prevStateHash === previous.stateHash\n  );\n}\n\nexport function buildAcknowledgedGroupPolicyBundle(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly response: PrincipalPolicyMutationResponse;\n}): PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse {\n  assertPrincipalPolicyReceiptArtifacts(input);\n  return {\n    ...input.response,\n    previousStates: historyWithCurrent(input.currentPolicy),\n  };\n}\n\nasync function assertPolicyRequestCommitments(\n  request: PutPrincipalPolicyRequest,\n): Promise<void> {\n  const projection = normalizePrincipalProjectionMembers(request.projection);\n  const members = projection.map((member) => ({ userId: member.userId }));\n  const [\n    membershipRoot,\n    memberEnvelopesRoot,\n    projectionRoot,\n    payloadCiphertextHash,\n    grantRoot,\n  ] = await Promise.all([\n    computePrincipalMembershipRoot(members),\n    computePrincipalMemberEnvelopesRoot(request.memberEnvelopes),\n    computePrincipalProjectionRoot(projection),\n    computePrincipalStatePayloadCiphertextHash(\n      request.encryptedPayload.ciphertext,\n    ),\n    computePrincipalContainerGrantRoot(request.grants),\n  ]);\n  if (\n    request.state.membershipRoot !== membershipRoot ||\n    request.state.memberEnvelopesRoot !== memberEnvelopesRoot ||\n    request.state.projectionRoot !== projectionRoot ||\n    request.state.memberCount !== projection.length ||\n    request.state.grantRoot !== grantRoot ||\n    request.state.grantCount !== request.grants.length ||\n    request.encryptedPayload.ciphertextHash !== payloadCiphertextHash ||\n    request.state.payloadCiphertextHash !== payloadCiphertextHash\n  ) {\n    throw new Error(\"Authored group policy commitments are invalid\");\n  }\n}\n\nfunction verifiedPolicy(input: {\n  currentPolicy?: PrincipalPolicyBundleResponse | undefined;\n  projection: PutPrincipalPolicyRequest[\"projection\"];\n  grants: PutPrincipalPolicyRequest[\"grants\"];\n  state: PrincipalStateResponse;\n}): VerifiedPrincipalPolicy {\n  const previousStates = input.currentPolicy\n    ? historyWithCurrent(input.currentPolicy)\n    : [];\n  return makeVerifiedPrincipalPolicy({\n    checkpoint: {\n      principalId: input.state.principalId,\n      principalType: input.state.principalType,\n      stateHash: input.state.stateHash,\n      version: input.state.version,\n    },\n    history: [\n      ...previousStates,\n      {\n        state: input.state,\n        projection: input.projection,\n        grants: input.grants,\n      },\n    ],\n    keyEpoch: input.state.keyEpoch,\n    principalId: input.state.principalId,\n    principalType: input.state.principalType,\n    projection: input.projection,\n    grants: input.grants,\n    state: input.state,\n    stateHash: input.state.stateHash,\n    version: input.state.version,\n  });\n}\n\ninterface FullPolicyMutationInput {\n  readonly verifiedCurrentPolicy?: never;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n}\n\nexport function acknowledgeGroupPolicyState(\n  input: CurrentPolicyMutationInput & {\n    readonly response: PrincipalStateResponse;\n  },\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function acknowledgeGroupPolicyState(\n  input: FullPolicyMutationInput & {\n    readonly response: PrincipalStateResponse;\n  },\n): Promise<VerifiedPrincipalPolicy>;\nexport async function acknowledgeGroupPolicyState(\n  input: (FullPolicyMutationInput | CurrentPolicyMutationInput) & {\n    readonly response: PrincipalStateResponse;\n  },\n): Promise<VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent> {\n  if (input.verifiedCurrentPolicy !== undefined)\n    return verifyCurrentPolicyMutation(input, input.response);\n  await assertPolicyRequestCommitments(input.request);\n  const { createdAt: _createdAt, stateHash, ...responseState } = input.response;\n  const previous = input.currentPolicy.currentState;\n  if (\n    stateHash !== input.expectedHead.stateHash ||\n    !isAuthoredSuccessorConsistent(\n      input.response,\n      input.expectedHead,\n      previous,\n    ) ||\n    canonicalKeyingJsonString(responseState, \"stored group policy state\") !==\n      canonicalKeyingJsonString(\n        input.request.state,\n        \"authored group policy state\",\n      )\n  ) {\n    throw new Error(\"Group policy state acknowledgement mismatch\");\n  }\n  return verifiedPolicy({\n    currentPolicy: input.currentPolicy,\n    projection: input.request.projection,\n    grants: input.request.grants,\n    state: input.response,\n  });\n}\n\n/**\n * Materialize the locally signed successor before submission so dependent\n * container mutations can wrap to the exact head that will commit with it.\n * The server still performs the authoritative signature, transition, and\n * authorization checks inside the combined transaction.\n */\nexport function prepareAuthoredGroupPolicy(\n  input: CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function prepareAuthoredGroupPolicy(\n  input: FullPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy>;\nexport async function prepareAuthoredGroupPolicy(\n  input: FullPolicyMutationInput | CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent> {\n  if (input.verifiedCurrentPolicy !== undefined)\n    return verifyCurrentPolicyMutation(input);\n  await assertPolicyRequestCommitments(input.request);\n  const previous = input.currentPolicy.currentState;\n  const state = input.request.state;\n  if (!isAuthoredSuccessorConsistent(state, input.expectedHead, previous)) {\n    throw new Error(\"Authored group policy successor is inconsistent\");\n  }\n  return verifiedPolicy({\n    currentPolicy: input.currentPolicy,\n    projection: input.request.projection,\n    grants: input.request.grants,\n    state: {\n      ...state,\n      stateHash: input.expectedHead.stateHash,\n      createdAt: state.signedAt,\n    },\n  });\n}\n\nexport async function acknowledgeInitialGroupPolicy(input: {\n  readonly organizationId: string;\n  readonly request: CreateOrganizationGroupRequest;\n  readonly response: OrganizationGroupSummaryResponse;\n  readonly stateHash: string;\n}): Promise<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}> {\n  await assertPolicyRequestCommitments(input.request.initialGroupPolicy);\n  const state = input.request.initialGroupPolicy.state;\n  if (\n    input.response.groupId !== input.request.groupId ||\n    input.response.organizationId !== input.organizationId ||\n    input.response.isBuiltin ||\n    input.response.currentState?.stateHash !== input.stateHash ||\n    input.response.currentState.version !== state.version ||\n    input.response.currentState.keyEpoch !== state.keyEpoch ||\n    input.response.currentState.keyFingerprint !== state.keyFingerprint ||\n    input.response.currentState.memberCount !== state.memberCount ||\n    state.principalType !== \"group\" ||\n    state.principalId !== input.request.groupId ||\n    state.version !== 1 ||\n    state.prevStateHash !== null\n  ) {\n    throw new Error(\"Created group policy acknowledgement mismatch\");\n  }\n  const storedState = {\n    ...state,\n    createdAt: input.response.createdAt,\n    stateHash: input.stateHash,\n  };\n  const bundle: PrincipalPolicyBundleResponse = {\n    currentMemberEnvelopes: {\n      envelopes: input.request.initialGroupPolicy.memberEnvelopes,\n      epoch: state.keyEpoch,\n      principalId: state.principalId,\n      principalType: state.principalType,\n      stateHash: input.stateHash,\n    },\n    currentPayload: {\n      principalId: state.principalId,\n      principalType: state.principalType,\n      stateHash: input.stateHash,\n      ...input.request.initialGroupPolicy.encryptedPayload,\n      createdAt: input.response.createdAt,\n    },\n    currentProjection: input.request.initialGroupPolicy.projection,\n    currentGrants: input.request.initialGroupPolicy.grants,\n    currentState: storedState,\n    previousStates: [],\n  };\n  return {\n    bundle,\n    policy: verifiedPolicy({\n      projection: input.request.initialGroupPolicy.projection,\n      grants: input.request.initialGroupPolicy.grants,\n      state: storedState,\n    }),\n  };\n}\n"]}

package/workflows/organizations/groupPolicyMutationContext.d.ts

@@ -1,58 +0,0 @@
-import type { PrincipalPolicyCheckpoint, PrincipalPolicyExternalAuthority, ReferencedPrincipalHead, SigningKeyPair } from "../../internal/crypto/index.js";
-import type { ContainerMutationRequest, PutPrincipalPolicyRequest } from "../../internal/validators/request/index.js";
-import type { CurrentPrincipalMemberEnvelopesResponse, PrincipalPolicyBundleResponse, PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
-import { type VerifiedExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
-import type { FullGroupMembershipMutationInput } from "./groupPolicyMutationEvidence.js";
-import type { PrincipalPolicyReadApi, PrincipalPolicyReadWriteApi } from "./principalPolicyApi.js";
-export type { OrganizationPrincipalPolicyApi, PrincipalPolicyReadApi, PrincipalPolicyReadWriteApi, } from "./principalPolicyApi.js";
-export { submitGroupPolicyCommit } from "./submitGroupPolicyCommit.js";
-interface LoadedGroupPolicyMutationContext extends FullGroupMembershipMutationInput {
-    readonly adminGroupId: string;
-    readonly adminPolicyBundle: PrincipalPolicyBundleResponse;
-    readonly currentOrgAdminUserIds: readonly string[];
-    readonly organizationDescriptor: VerifiedExternalAdminPolicy["descriptor"];
-    readonly organizationPolicyBundle: PrincipalPolicyBundleResponse;
-    readonly memberGroupId: string;
-}
-export declare function cacheGroupPolicy(input: {
-    readonly acknowledgedMemberEnvelopes?: CurrentPrincipalMemberEnvelopesResponse | undefined;
-    readonly apiClient: PrincipalPolicyReadApi;
-    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
-    readonly execSql: ExecSql;
-    readonly expectedCurrentHead?: ReferencedPrincipalHead | undefined;
-    readonly groupId: string;
-    readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;
-    readonly organizationId: string;
-    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    readonly stillCurrent?: (() => boolean) | undefined;
-}): Promise<PrincipalPolicyBundleResponse>;
-export declare function loadGroupPolicyMutationContext(input: {
-    readonly apiClient: PrincipalPolicyReadApi;
-    readonly execSql: ExecSql;
-    readonly groupId: string;
-    readonly organizationId: string;
-    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-}): Promise<LoadedGroupPolicyMutationContext>;
-export declare function commitGroupPolicyMutation(input: {
-    readonly retiredContainerIds?: (() => readonly string[]) | undefined;
-    readonly apiClient: PrincipalPolicyReadWriteApi;
-    readonly currentPolicy: PrincipalPolicyBundleResponse;
-    readonly execSql: ExecSql;
-    readonly expectedHead: ReferencedPrincipalHead;
-    readonly groupId: string;
-    readonly organizationId: string;
-    readonly organizationPolicy: PrincipalPolicyBundleResponse;
-    readonly organizationRequest: PutPrincipalPolicyRequest;
-    /**
-     * Re-sign the batch with the descendant rekeys a refusal named woven in; the
-     * result replaces `containerMutations` and the commit is retried once.
-     */
-    readonly carryDescendantRekeys?: ((requiredContainerIds: readonly string[]) => Promise<readonly ContainerMutationRequest[]>) | undefined;
-    readonly request: PutPrincipalPolicyRequest;
-    readonly stillCurrent?: (() => boolean) | undefined;
-}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;

package/workflows/organizations/groupPolicyMutationContext.js

@@ -1,166 +0,0 @@
-import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
-import { retainLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
-import { requireOrganizationGroupHead } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../principals/externalAdminPolicy.js";
-import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
-import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
-import { acknowledgeGroupPolicyState, assertGroupPolicyEnvelopesMatchAcknowledgement, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
-import { assertPrincipalPolicyCurrentStateMatchesHead, groupPolicyMutationHead, } from "./groupPolicyMutationHead.js";
-import { collectGroupPolicySignerPublicKeys, prepareGroupPolicyVerification, verifyGroupPolicy, verifyGroupPolicyWithExternalOrganizationAdmins, } from "./groupPolicyVerification.js";
-import { submitGroupPolicyCommit } from "./submitGroupPolicyCommit.js";
-export { submitGroupPolicyCommit } from "./submitGroupPolicyCommit.js";
-export async function cacheGroupPolicy(input) {
-    const bundle = await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
-    if (!bundle) {
-        throw new Error("Updated group policy could not be loaded");
-    }
-    const signerPublicKeys = await collectGroupPolicySignerPublicKeys({
-        bundle,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-    const verified = await verifyGroupPolicy({
-        currentPolicy: bundle,
-        ...(input.externalAuthority
-            ? { externalAuthority: input.externalAuthority }
-            : {}),
-        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
-        signerPublicKeys,
-    });
-    if (input.expectedCurrentHead) {
-        assertPrincipalPolicyCurrentStateMatchesHead(bundle.currentState, input.expectedCurrentHead);
-    }
-    if (input.acknowledgedMemberEnvelopes) {
-        assertGroupPolicyEnvelopesMatchAcknowledgement(input.acknowledgedMemberEnvelopes, bundle.currentMemberEnvelopes);
-    }
-    await persistVerifiedPrincipalPolicyBundlesAtomically({
-        entries: [{ bundle, policy: verified }],
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        stillCurrent: input.stillCurrent,
-        updatedAt: new Date().toISOString(),
-    });
-    return bundle;
-}
-export async function loadGroupPolicyMutationContext(input) {
-    await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
-    const adminPolicy = await loadOrganizationExternalAdminPolicy({
-        currentPolicyReader: input.apiClient,
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-    if (!adminPolicy) {
-        throw new Error("Organization admin authority could not be verified");
-    }
-    const expectedGroupHead = requireOrganizationGroupHead(adminPolicy.descriptor, input.groupId);
-    const currentPolicy = input.groupId === adminPolicy.adminGroupId
-        ? adminPolicy.adminBundle
-        : await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
-    if (!currentPolicy) {
-        throw new Error("Group policy could not be loaded");
-    }
-    assertPrincipalPolicyCurrentStateMatchesHead(currentPolicy.currentState, expectedGroupHead);
-    const verification = await prepareGroupPolicyVerification({
-        currentPolicy,
-        execSql: input.execSql,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-    const isOrganizationAdminsGroup = adminPolicy.adminGroupId === input.groupId;
-    const currentOrgAdminUserIds = adminPolicy.signerUserIds;
-    const externalAuthority = adminPolicy.externalAuthority;
-    if (!currentOrgAdminUserIds.includes(input.signerUserId)) {
-        throw new Error("Organization admin authority is required");
-    }
-    const verified = isOrganizationAdminsGroup
-        ? await verifyGroupPolicy({
-            currentPolicy,
-            localPolicyCheckpoint: verification.localPolicyCheckpoint,
-            signerPublicKeys: verification.currentPolicySignerPublicKeys,
-        })
-        : await verifyGroupPolicyWithExternalOrganizationAdmins({
-            currentPolicy,
-            loadExternalAuthority: async () => externalAuthority,
-            localPolicyCheckpoint: verification.localPolicyCheckpoint,
-            signerPublicKeys: verification.currentPolicySignerPublicKeys,
-        });
-    assertGroupMetadataBinding(currentPolicy, adminPolicy.descriptor);
-    requireSignerCanManageGroup(currentPolicy, currentOrgAdminUserIds, input.signerUserId);
-    await persistVerifiedPrincipalPolicyBundlesAtomically({
-        entries: [
-            ...externalAdminPolicyPersistenceEntries(adminPolicy).filter((entry) => entry.policy.principalType !== verified.principalType ||
-                entry.policy.principalId !== verified.principalId),
-            { bundle: currentPolicy, policy: verified },
-        ],
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        updatedAt: new Date().toISOString(),
-    });
-    return {
-        adminGroupId: adminPolicy.adminGroupId,
-        adminPolicyBundle: adminPolicy.adminBundle,
-        currentPolicy,
-        currentOrgAdminUserIds,
-        externalAuthority,
-        isOrganizationAdminsGroup,
-        memberGroupId: adminPolicy.memberGroupId,
-        organizationDescriptor: adminPolicy.descriptor,
-        organizationPolicyBundle: adminPolicy.bundle,
-        ...verification,
-        localPolicyCheckpoint: verified.checkpoint,
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    };
-}
-export async function commitGroupPolicyMutation(input) {
-    const stored = await submitGroupPolicyCommit(input);
-    if (!stored) {
-        throw new Error("Group policy update failed");
-    }
-    const storedPolicy = stored.groupPolicy;
-    const acknowledgedPolicy = await acknowledgeGroupPolicyState({
-        currentPolicy: input.currentPolicy,
-        expectedHead: input.expectedHead,
-        request: input.request,
-        response: storedPolicy.currentState,
-    });
-    const groupBundle = buildAcknowledgedGroupPolicyBundle({
-        currentPolicy: input.currentPolicy,
-        expectedHead: input.expectedHead,
-        request: input.request,
-        response: storedPolicy,
-    });
-    const organizationHead = await groupPolicyMutationHead(input.organizationRequest);
-    const acknowledgedOrganization = await acknowledgeGroupPolicyState({
-        currentPolicy: input.organizationPolicy,
-        expectedHead: organizationHead,
-        request: input.organizationRequest,
-        response: stored.organizationPolicy.currentState,
-    });
-    const organizationBundle = buildAcknowledgedGroupPolicyBundle({
-        currentPolicy: input.organizationPolicy,
-        expectedHead: organizationHead,
-        request: input.organizationRequest,
-        response: stored.organizationPolicy,
-    });
-    await retainLocallyAcknowledgedPrincipalPolicyBundles({
-        retiredContainers: {
-            containerIds: input.retiredContainerIds?.() ?? [],
-            organizationId: input.organizationId,
-            policy: acknowledgedPolicy,
-        },
-        entries: [
-            { bundle: groupBundle, policy: acknowledgedPolicy },
-            {
-                bundle: organizationBundle,
-                policy: acknowledgedOrganization,
-            },
-        ],
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        stillCurrent: input.stillCurrent,
-        updatedAt: new Date().toISOString(),
-    });
-    return groupBundle;
-}
-//# sourceMappingURL=groupPolicyMutationContext.js.map

package/workflows/organizations/groupPolicyMutationContext.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupPolicyMutationContext.js","sourceRoot":"","sources":["groupPolicyMutationContext.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,+CAA+C,EAAE,MAAM,2DAA2D,CAAC;AAC5H,OAAO,EAAE,+CAA+C,EAAE,MAAM,iEAAiE,CAAC;AAClI,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AAGrG,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EACL,2BAA2B,EAC3B,8CAA8C,EAC9C,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,4CAA4C,EAC5C,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,iBAAiB,EACjB,+CAA+C,GAChD,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAOpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAYpE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAatC;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC5D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,aAAa,EAAE,MAAM;QACrB,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,4CAA4C,CAC1C,MAAM,CAAC,YAAY,EACnB,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtC,8CAA8C,CAC5C,KAAK,CAAC,2BAA2B,EACjC,MAAM,CAAC,sBAAsB,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC;QAC5D,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,4BAA4B,CACpD,WAAW,CAAC,UAAU,EACtB,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,aAAa,GACjB,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,YAAY;QACxC,CAAC,CAAC,WAAW,CAAC,WAAW;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,4CAA4C,CAC1C,aAAa,CAAC,YAAY,EAC1B,iBAAiB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC;IAC7E,MAAM,sBAAsB,GAAG,WAAW,CAAC,aAAa,CAAC;IACzD,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACxD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB;QACxC,CAAC,CAAC,MAAM,iBAAiB,CAAC;YACtB,aAAa;YACb,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC;QACJ,CAAC,CAAC,MAAM,+CAA+C,CAAC;YACpD,aAAa;YACb,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;YACpD,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC,CAAC;IACP,0BAA0B,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClE,2BAA2B,CACzB,aAAa,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE;YACP,GAAG,qCAAqC,CAAC,WAAW,CAAC,CAAC,MAAM,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;gBACrD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;YACD,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,iBAAiB,EAAE,WAAW,CAAC,WAAW;QAC1C,aAAa;QACb,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,sBAAsB,EAAE,WAAW,CAAC,UAAU;QAC9C,wBAAwB,EAAE,WAAW,CAAC,MAAM;QAC5C,GAAG,YAAY;QACf,qBAAqB,EAAE,QAAQ,CAAC,UAAU;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAqB/C;IACC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,kCAAkC,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CACpD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,2BAA2B,CAAC;QACjE,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,+CAA+C,CAAC;QACpD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE;YACjD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,kBAAkB;SAC3B;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACnD;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,wBAAwB;aACjC;SACF;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type {\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyExternalAuthority,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  CurrentPrincipalMemberEnvelopesResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { retainLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport { requireOrganizationGroupHead } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../principals/externalAdminPolicy\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport {\n  acknowledgeGroupPolicyState,\n  assertGroupPolicyEnvelopesMatchAcknowledgement,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { FullGroupMembershipMutationInput } from \"./groupPolicyMutationEvidence\";\nimport {\n  assertPrincipalPolicyCurrentStateMatchesHead,\n  groupPolicyMutationHead,\n} from \"./groupPolicyMutationHead\";\nimport {\n  collectGroupPolicySignerPublicKeys,\n  prepareGroupPolicyVerification,\n  verifyGroupPolicy,\n  verifyGroupPolicyWithExternalOrganizationAdmins,\n} from \"./groupPolicyVerification\";\nimport type {\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"./principalPolicyApi\";\nimport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\nexport type {\n  OrganizationPrincipalPolicyApi,\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"./principalPolicyApi\";\nexport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\ninterface LoadedGroupPolicyMutationContext\n  extends FullGroupMembershipMutationInput {\n  readonly adminGroupId: string;\n  readonly adminPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly currentOrgAdminUserIds: readonly string[];\n  readonly organizationDescriptor: VerifiedExternalAdminPolicy[\"descriptor\"];\n  readonly organizationPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly memberGroupId: string;\n}\n\nexport async function cacheGroupPolicy(input: {\n  readonly acknowledgedMemberEnvelopes?:\n    | CurrentPrincipalMemberEnvelopesResponse\n    | undefined;\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly execSql: ExecSql;\n  readonly expectedCurrentHead?: ReferencedPrincipalHead | undefined;\n  readonly groupId: string;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse> {\n  const bundle = await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n\n  if (!bundle) {\n    throw new Error(\"Updated group policy could not be loaded\");\n  }\n\n  const signerPublicKeys = await collectGroupPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const verified = await verifyGroupPolicy({\n    currentPolicy: bundle,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n    signerPublicKeys,\n  });\n  if (input.expectedCurrentHead) {\n    assertPrincipalPolicyCurrentStateMatchesHead(\n      bundle.currentState,\n      input.expectedCurrentHead,\n    );\n  }\n  if (input.acknowledgedMemberEnvelopes) {\n    assertGroupPolicyEnvelopesMatchAcknowledgement(\n      input.acknowledgedMemberEnvelopes,\n      bundle.currentMemberEnvelopes,\n    );\n  }\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [{ bundle, policy: verified }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return bundle;\n}\n\nexport async function loadGroupPolicyMutationContext(input: {\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<LoadedGroupPolicyMutationContext> {\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  const adminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!adminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const expectedGroupHead = requireOrganizationGroupHead(\n    adminPolicy.descriptor,\n    input.groupId,\n  );\n  const currentPolicy =\n    input.groupId === adminPolicy.adminGroupId\n      ? adminPolicy.adminBundle\n      : await input.apiClient.getCurrentPrincipalPolicy(\"group\", input.groupId);\n  if (!currentPolicy) {\n    throw new Error(\"Group policy could not be loaded\");\n  }\n  assertPrincipalPolicyCurrentStateMatchesHead(\n    currentPolicy.currentState,\n    expectedGroupHead,\n  );\n  const verification = await prepareGroupPolicyVerification({\n    currentPolicy,\n    execSql: input.execSql,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const isOrganizationAdminsGroup = adminPolicy.adminGroupId === input.groupId;\n  const currentOrgAdminUserIds = adminPolicy.signerUserIds;\n  const externalAuthority = adminPolicy.externalAuthority;\n  if (!currentOrgAdminUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority is required\");\n  }\n  const verified = isOrganizationAdminsGroup\n    ? await verifyGroupPolicy({\n        currentPolicy,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      })\n    : await verifyGroupPolicyWithExternalOrganizationAdmins({\n        currentPolicy,\n        loadExternalAuthority: async () => externalAuthority,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      });\n  assertGroupMetadataBinding(currentPolicy, adminPolicy.descriptor);\n  requireSignerCanManageGroup(\n    currentPolicy,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [\n      ...externalAdminPolicyPersistenceEntries(adminPolicy).filter(\n        (entry) =>\n          entry.policy.principalType !== verified.principalType ||\n          entry.policy.principalId !== verified.principalId,\n      ),\n      { bundle: currentPolicy, policy: verified },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n  });\n\n  return {\n    adminGroupId: adminPolicy.adminGroupId,\n    adminPolicyBundle: adminPolicy.adminBundle,\n    currentPolicy,\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup,\n    memberGroupId: adminPolicy.memberGroupId,\n    organizationDescriptor: adminPolicy.descriptor,\n    organizationPolicyBundle: adminPolicy.bundle,\n    ...verification,\n    localPolicyCheckpoint: verified.checkpoint,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n}\n\nexport async function commitGroupPolicyMutation(input: {\n  readonly retiredContainerIds?: (() => readonly string[]) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly organizationPolicy: PrincipalPolicyBundleResponse;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  /**\n   * Re-sign the batch with the descendant rekeys a refusal named woven in; the\n   * result replaces `containerMutations` and the commit is retried once.\n   */\n  readonly carryDescendantRekeys?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stored = await submitGroupPolicyCommit(input);\n  if (!stored) {\n    throw new Error(\"Group policy update failed\");\n  }\n  const storedPolicy = stored.groupPolicy;\n  const acknowledgedPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy.currentState,\n  });\n  const groupBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy,\n  });\n  const organizationHead = await groupPolicyMutationHead(\n    input.organizationRequest,\n  );\n  const acknowledgedOrganization = await acknowledgeGroupPolicyState({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await retainLocallyAcknowledgedPrincipalPolicyBundles({\n    retiredContainers: {\n      containerIds: input.retiredContainerIds?.() ?? [],\n      organizationId: input.organizationId,\n      policy: acknowledgedPolicy,\n    },\n    entries: [\n      { bundle: groupBundle, policy: acknowledgedPolicy },\n      {\n        bundle: organizationBundle,\n        policy: acknowledgedOrganization,\n      },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return groupBundle;\n}\n"]}

package/workflows/organizations/groupPolicyMutationEvidence.d.ts

@@ -1,26 +0,0 @@
-import type { PrincipalPolicyPageCurrent } from "../../internal/api-client/index.js";
-import { type PrincipalPolicyCheckpoint, type PrincipalPolicyExternalAuthority, type PrincipalPolicySignerPublicKey, type SigningKeyPair, type VerifiedPrincipalPolicyCurrent } from "../../internal/crypto/index.js";
-import type { PutPrincipalPolicyRequest } from "../../internal/validators/request/index.js";
-import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
-interface GroupMembershipSigningInput {
-    readonly currentOrgAdminUserIds?: readonly string[] | undefined;
-    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
-    readonly isOrganizationAdminsGroup?: boolean | undefined;
-    readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-}
-export interface FullGroupMembershipMutationInput extends GroupMembershipSigningInput {
-    readonly currentPolicy: PrincipalPolicyBundleResponse;
-    readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];
-}
-interface CurrentGroupMembershipMutationInput extends GroupMembershipSigningInput {
-    readonly currentPolicy: PrincipalPolicyPageCurrent;
-    readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;
-    readonly stillCurrent: () => boolean;
-}
-export type BuildGroupMembershipMutationInput = FullGroupMembershipMutationInput | CurrentGroupMembershipMutationInput;
-/** Current artifacts require their verified evidence; omitted history is never a bundle. */
-export declare function withVerifiedGroupMutation<T extends BuildGroupMembershipMutationInput>(input: T, work: (owned: T) => Promise<PutPrincipalPolicyRequest>): Promise<PutPrincipalPolicyRequest>;
-export {};

package/workflows/organizations/groupPolicyMutationEvidence.js

@@ -1,64 +0,0 @@
-import { verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrentMutation, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { assertCurrentMatchesVerifiedPolicy } from "../../data/persistence/verifiedPrincipalPolicyCurrent.js";
-import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
-import { verifyGroupPolicy } from "./groupPolicyVerification.js";
-/** Current artifacts require their verified evidence; omitted history is never a bundle. */
-export async function withVerifiedGroupMutation(input, work) {
-    input = {
-        ...input,
-        currentPolicy: structuredClone(input.currentPolicy),
-        ...("currentPolicySignerPublicKeys" in input
-            ? {
-                currentPolicySignerPublicKeys: structuredClone(input.currentPolicySignerPublicKeys),
-            }
-            : {}),
-        currentOrgAdminUserIds: structuredClone(input.currentOrgAdminUserIds),
-        externalAuthority: structuredClone(input.externalAuthority),
-        localPolicyCheckpoint: structuredClone(input.localPolicyCheckpoint),
-        signingKeyPair: structuredClone(input.signingKeyPair),
-    };
-    try {
-        const current = () => !("verifiedCurrentPolicy" in input) || input.stillCurrent();
-        assertProjectionVerificationCurrent(current);
-        if ("verifiedCurrentPolicy" in input) {
-            await assertCurrentMatchesVerifiedPolicy({
-                current: input.currentPolicy,
-                policy: input.verifiedCurrentPolicy,
-            });
-            requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
-            const verified = await verifyPrincipalPolicyCurrentMutation({
-                current: input.currentPolicy,
-                policy: input.verifiedCurrentPolicy,
-                signerUserId: input.signerUserId,
-                externalAuthority: input.externalAuthority,
-            });
-            if (!verified.ok)
-                throw verified.error;
-            verifyPrincipalPolicyCheckpoint({
-                chain: verified.value.retainedHistory,
-                currentState: verified.value.state,
-                localCheckpoint: input.localPolicyCheckpoint,
-            });
-        }
-        else {
-            await verifyGroupPolicy({
-                currentPolicy: input.currentPolicy,
-                ...(input.externalAuthority
-                    ? { externalAuthority: input.externalAuthority }
-                    : {}),
-                localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
-                signerPublicKeys: input.currentPolicySignerPublicKeys,
-            });
-        }
-        assertProjectionVerificationCurrent(current);
-        requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
-        const result = await work(input);
-        assertProjectionVerificationCurrent(current);
-        return result;
-    }
-    finally {
-        input.signingKeyPair.signingPrivateKey.fill(0);
-    }
-}
-//# sourceMappingURL=groupPolicyMutationEvidence.js.map

package/workflows/organizations/groupPolicyMutationEvidence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupPolicyMutationEvidence.js","sourceRoot":"","sources":["groupPolicyMutationEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EAML,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,uDAAuD,CAAC;AAC3G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA6B9D,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAG7C,KAAQ,EACR,IAAsD;IAEtD,KAAK,GAAG;QACN,GAAG,KAAK;QACR,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QACnD,GAAG,CAAC,+BAA+B,IAAI,KAAK;YAC1C,CAAC,CAAC;gBACE,6BAA6B,EAAE,eAAe,CAC5C,KAAK,CAAC,6BAA6B,CACpC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sBAAsB,EAAE,eAAe,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACrE,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3D,qBAAqB,EAAE,eAAe,CAAC,KAAK,CAAC,qBAAqB,CAAC;QACnE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;KACtD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,CAAC,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9D,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,uBAAuB,IAAI,KAAK,EAAE,CAAC;YACrC,MAAM,kCAAkC,CAAC;gBACvC,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;aACpC,CAAC,CAAC;YACH,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,oCAAoC,CAAC;gBAC1D,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;gBACnC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;YACvC,+BAA+B,CAAC;gBAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;gBACrC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;gBAClC,eAAe,EAAE,KAAK,CAAC,qBAAqB;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,CAAC;gBACtB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB;oBACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;gBAC1D,gBAAgB,EAAE,KAAK,CAAC,6BAA6B;aACtD,CAAC,CAAC;QACL,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type SigningKeyPair,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrentMutation,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"../../data/persistence/verifiedPrincipalPolicyCurrent\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport { verifyGroupPolicy } from \"./groupPolicyVerification\";\n\ninterface GroupMembershipSigningInput {\n  readonly currentOrgAdminUserIds?: readonly string[] | undefined;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly isOrganizationAdminsGroup?: boolean | undefined;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}\n\nexport interface FullGroupMembershipMutationInput\n  extends GroupMembershipSigningInput {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}\n\ninterface CurrentGroupMembershipMutationInput\n  extends GroupMembershipSigningInput {\n  readonly currentPolicy: PrincipalPolicyPageCurrent;\n  readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;\n  readonly stillCurrent: () => boolean;\n}\n\nexport type BuildGroupMembershipMutationInput =\n  | FullGroupMembershipMutationInput\n  | CurrentGroupMembershipMutationInput;\n\n/** Current artifacts require their verified evidence; omitted history is never a bundle. */\nexport async function withVerifiedGroupMutation<\n  T extends BuildGroupMembershipMutationInput,\n>(\n  input: T,\n  work: (owned: T) => Promise<PutPrincipalPolicyRequest>,\n): Promise<PutPrincipalPolicyRequest> {\n  input = {\n    ...input,\n    currentPolicy: structuredClone(input.currentPolicy),\n    ...(\"currentPolicySignerPublicKeys\" in input\n      ? {\n          currentPolicySignerPublicKeys: structuredClone(\n            input.currentPolicySignerPublicKeys,\n          ),\n        }\n      : {}),\n    currentOrgAdminUserIds: structuredClone(input.currentOrgAdminUserIds),\n    externalAuthority: structuredClone(input.externalAuthority),\n    localPolicyCheckpoint: structuredClone(input.localPolicyCheckpoint),\n    signingKeyPair: structuredClone(input.signingKeyPair),\n  };\n  try {\n    const current = () =>\n      !(\"verifiedCurrentPolicy\" in input) || input.stillCurrent();\n    assertProjectionVerificationCurrent(current);\n    if (\"verifiedCurrentPolicy\" in input) {\n      await assertCurrentMatchesVerifiedPolicy({\n        current: input.currentPolicy,\n        policy: input.verifiedCurrentPolicy,\n      });\n      requireSignerCanManageGroup(\n        input.currentPolicy,\n        input.currentOrgAdminUserIds ?? [],\n        input.signerUserId,\n      );\n      const verified = await verifyPrincipalPolicyCurrentMutation({\n        current: input.currentPolicy,\n        policy: input.verifiedCurrentPolicy,\n        signerUserId: input.signerUserId,\n        externalAuthority: input.externalAuthority,\n      });\n      if (!verified.ok) throw verified.error;\n      verifyPrincipalPolicyCheckpoint({\n        chain: verified.value.retainedHistory,\n        currentState: verified.value.state,\n        localCheckpoint: input.localPolicyCheckpoint,\n      });\n    } else {\n      await verifyGroupPolicy({\n        currentPolicy: input.currentPolicy,\n        ...(input.externalAuthority\n          ? { externalAuthority: input.externalAuthority }\n          : {}),\n        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n        signerPublicKeys: input.currentPolicySignerPublicKeys,\n      });\n    }\n    assertProjectionVerificationCurrent(current);\n    requireSignerCanManageGroup(\n      input.currentPolicy,\n      input.currentOrgAdminUserIds ?? [],\n      input.signerUserId,\n    );\n    const result = await work(input);\n    assertProjectionVerificationCurrent(current);\n    return result;\n  } finally {\n    input.signingKeyPair.signingPrivateKey.fill(0);\n  }\n}\n"]}

package/workflows/organizations/groupPolicyMutationHead.js

@@ -1,26 +0,0 @@
-import { computePrincipalStateHash, } from "../../internal/crypto/index.js";
-export async function groupPolicyMutationHead(request) {
-    const state = request.state;
-    return {
-        principalType: state.principalType,
-        principalId: state.principalId,
-        version: state.version,
-        keyEpoch: state.keyEpoch,
-        stateHash: await computePrincipalStateHash(state),
-        keyFingerprint: state.keyFingerprint,
-    };
-}
-function principalPolicyCurrentStateMatchesHead(state, head) {
-    return (state.principalType === head.principalType &&
-        state.principalId === head.principalId &&
-        state.version === head.version &&
-        state.keyEpoch === head.keyEpoch &&
-        state.stateHash === head.stateHash &&
-        state.keyFingerprint === head.keyFingerprint);
-}
-export function assertPrincipalPolicyCurrentStateMatchesHead(state, head) {
-    if (!principalPolicyCurrentStateMatchesHead(state, head)) {
-        throw new Error("Updated group policy advanced during root re-wrap");
-    }
-}
-//# sourceMappingURL=groupPolicyMutationHead.js.map