@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/organizations/principalContainerRematerializationPlanning.js

@@ -1,77 +0,0 @@
-import { MAX_ROTATION_CONTAINER_REKEYS } from "../../internal/validators/util/index.js";
-import { planCarriedDescendantRekey, } from "../containers/child/carriedDescendantRekeys.js";
-/** How many rekeys the batch carries beyond its rematerializations. */
-function carriedCount(batch) {
-    return batch.plans.filter((entry) => entry.carried).length;
-}
-/**
- * Sign a rekey of `served` under the batch's rotations above it, and add it.
- * The server accepts at most `MAX_ROTATION_CONTAINER_REKEYS` carried entries;
- * past that a rematerialization below them could not be signed on a current
- * path, so the batch is refused here, before signing what the server would
- * refuse anyway, and the policy change has to wait for a lazy repair of the
- * tree. Groups granted that far apart on one chain are not a shape the SDK
- * creates.
- */
-export async function carryLevel(batch, served) {
-    const { rematerialization } = batch;
-    if (carriedCount(batch) >= MAX_ROTATION_CONTAINER_REKEYS) {
-        throw new Error(`Policy change would carry more than ${MAX_ROTATION_CONTAINER_REKEYS} descendant rekeys`);
-    }
-    const planned = await planCarriedDescendantRekey({
-        apiClient: rematerialization.apiClient,
-        author: rematerialization.author,
-        execSql: rematerialization.execSql,
-        knownContainerKeks: batch.knownContainerKeks,
-        principalPolicyCache: batch.principalPolicyCache,
-        // Its path cites the policy this batch commits, so like every
-        // rematerialized rotation it must cite the successor.
-        replacementPrincipalPolicy: rematerialization.nextPolicy,
-        resolveAuthoredPolicyReferences: rematerialization.resolveAuthoredPolicyReferences,
-        resolveProjectionUserKey: batch.resolveProjectionUserKey,
-        rotated: batch.rotatedAbove,
-        served,
-        stillCurrent: rematerialization.stillCurrent,
-        targetSecretKey: rematerialization.targetSecretKey,
-        warmReferencedPrincipalPolicies: rematerialization.warmReferencedPrincipalPolicies,
-    });
-    addPlan(batch, {
-        carried: true,
-        planned,
-        rotated: planned.writerProjection,
-        nextProjection: planned.writerProjection,
-    });
-}
-export function addPlan(batch, entry) {
-    batch.plans.push(entry);
-    if (!entry.rotated)
-        return;
-    batch.rotatedAbove.push(entry.rotated);
-    const minted = entry.rotated.containerKeks.at(-1)?.containerKeyEpochId;
-    if (minted)
-        batch.knownContainerKeks.set(minted, entry.planned.containerKey);
-}
-/**
- * Levels of a re-rooted path pinned to an epoch the batch retires above them:
- * those strictly between the rotated ancestor the path was re-rooted on and
- * the target, parent-first, from the first stale one down. A rotation planned
- * above a target strands every level between the two, and each must be
- * re-keyed under the one above before the target can be signed. The batch
- * carries them without waiting to be told: they are proper ancestors of a
- * granted container, so the server would name them, and a refusal per level
- * is a round trip each. Anything stale above the rotated ancestor is not this
- * batch's doing and is left alone. `carryLevel` holds the count to the cap.
- */
-export function staleLevelsAbove(projection, rotatedAncestorId) {
-    const keks = projection.containerKeks;
-    const ancestor = keks.findIndex((kek) => kek.containerId === rotatedAncestorId);
-    if (ancestor < 0)
-        return [];
-    const between = keks.slice(ancestor, -1);
-    const firstStale = between.findIndex((kek, index) => index > 0 &&
-        kek.parentContainerKeyEpochId !== between[index - 1]?.containerKeyEpochId);
-    return firstStale < 0
-        ? []
-        : between.slice(firstStale).map((kek) => kek.containerId);
-}
-//# sourceMappingURL=principalContainerRematerializationPlanning.js.map

package/workflows/organizations/principalContainerRematerializationPlanning.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalContainerRematerializationPlanning.js","sourceRoot":"","sources":["principalContainerRematerializationPlanning.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAc3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,6CAA6C,CAAC;AA2DrD,uEAAuE;AACvE,SAAS,YAAY,CAAC,KAAoB;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAoB,EACpB,MAAyC;IAEzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,6BAA6B,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,6BAA6B,oBAAoB,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;QAC/C,SAAS,EAAE,iBAAiB,CAAC,SAAS;QACtC,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,8DAA8D;QAC9D,sDAAsD;QACtD,0BAA0B,EAAE,iBAAiB,CAAC,UAAU;QACxD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;QACnD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,YAAY;QAC3B,MAAM;QACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;QAC5C,eAAe,EAAE,iBAAiB,CAAC,eAAe;QAClD,+BAA+B,EAC7B,iBAAiB,CAAC,+BAA+B;KACpD,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,IAAI;QACb,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,gBAAgB;QACjC,cAAc,EAAE,OAAO,CAAC,gBAAgB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,KAAoB,EACpB,KAA+B;IAE/B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO;IAC3B,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACvE,IAAI,MAAM;QAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA6C,EAC7C,iBAAyB;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAC7B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,iBAAiB,CAC/C,CAAC;IACF,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAClC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACb,KAAK,GAAG,CAAC;QACT,GAAG,CAAC,yBAAyB,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAC5E,CAAC;IACF,OAAO,UAAU,GAAG,CAAC;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalContainerGrant } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nimport type { ContainerMutationAuthor } from \"../../data/containers/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport type { ResolvedPrincipalPolicyEvidence } from \"../../data/keyingProjectionVerification/types\";\nimport type { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  planCarriedDescendantRekey,\n  type SpeculativePath,\n} from \"../containers/child/carriedDescendantRekeys\";\nimport type { PlannedRematerialization } from \"./principalContainerRematerializationTargets\";\n\nexport interface RematerializationApi\n  extends ContainerReciteApi,\n    Pick<ApiClient, \"getContainerWriterProjectionResult\"> {\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n}\n\nexport interface PrincipalRematerializationPredecessor {\n  readonly authored?: readonly ResolvedPrincipalPolicyEvidence[] | undefined;\n  readonly policies: readonly PrincipalPolicyCurrentEvidence[];\n  readonly projections: readonly ContainerWriterProjectionResponse[];\n  readonly knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n}\n\nexport interface PrincipalContainerRematerializationInput {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly apiClient: RematerializationApi;\n  readonly author: ContainerMutationAuthor;\n  readonly execSql: ExecSql;\n  readonly grants: readonly PrincipalContainerGrant[];\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly revokedContainerId?: string | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /** Session lifetime for best-effort work after durable acknowledgement. */\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly targetSecretKey: Uint8Array;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/** What the batch has signed so far, in the order it will be submitted. */\nexport interface BatchPlanning {\n  /**\n   * Keys the batch minted, by epoch id. A rotation wraps its successor to the\n   * group at the head this batch commits, which no store can open yet; a\n   * level planned beneath it opens that epoch with the key minted here, and\n   * its keyring then opens the retired epoch the level below is pinned to.\n   */\n  readonly knownContainerKeks: Map<string, Uint8Array>;\n  readonly plans: PlannedRematerialization[];\n  readonly principalPolicyCache: PrincipalPolicyCache;\n  readonly rematerialization: PrincipalContainerRematerializationInput;\n  readonly resolveProjectionUserKey: ReturnType<\n    typeof createProjectionUserKeyResolver\n  >;\n  readonly rotatedAbove: SpeculativePath[];\n}\n\n/** How many rekeys the batch carries beyond its rematerializations. */\nfunction carriedCount(batch: BatchPlanning): number {\n  return batch.plans.filter((entry) => entry.carried).length;\n}\n\n/**\n * Sign a rekey of `served` under the batch's rotations above it, and add it.\n * The server accepts at most `MAX_ROTATION_CONTAINER_REKEYS` carried entries;\n * past that a rematerialization below them could not be signed on a current\n * path, so the batch is refused here, before signing what the server would\n * refuse anyway, and the policy change has to wait for a lazy repair of the\n * tree. Groups granted that far apart on one chain are not a shape the SDK\n * creates.\n */\nexport async function carryLevel(\n  batch: BatchPlanning,\n  served: ContainerWriterProjectionResponse,\n): Promise<void> {\n  const { rematerialization } = batch;\n  if (carriedCount(batch) >= MAX_ROTATION_CONTAINER_REKEYS) {\n    throw new Error(\n      `Policy change would carry more than ${MAX_ROTATION_CONTAINER_REKEYS} descendant rekeys`,\n    );\n  }\n  const planned = await planCarriedDescendantRekey({\n    apiClient: rematerialization.apiClient,\n    author: rematerialization.author,\n    execSql: rematerialization.execSql,\n    knownContainerKeks: batch.knownContainerKeks,\n    principalPolicyCache: batch.principalPolicyCache,\n    // Its path cites the policy this batch commits, so like every\n    // rematerialized rotation it must cite the successor.\n    replacementPrincipalPolicy: rematerialization.nextPolicy,\n    resolveAuthoredPolicyReferences:\n      rematerialization.resolveAuthoredPolicyReferences,\n    resolveProjectionUserKey: batch.resolveProjectionUserKey,\n    rotated: batch.rotatedAbove,\n    served,\n    stillCurrent: rematerialization.stillCurrent,\n    targetSecretKey: rematerialization.targetSecretKey,\n    warmReferencedPrincipalPolicies:\n      rematerialization.warmReferencedPrincipalPolicies,\n  });\n  addPlan(batch, {\n    carried: true,\n    planned,\n    rotated: planned.writerProjection,\n    nextProjection: planned.writerProjection,\n  });\n}\n\nexport function addPlan(\n  batch: BatchPlanning,\n  entry: PlannedRematerialization,\n): void {\n  batch.plans.push(entry);\n  if (!entry.rotated) return;\n  batch.rotatedAbove.push(entry.rotated);\n  const minted = entry.rotated.containerKeks.at(-1)?.containerKeyEpochId;\n  if (minted) batch.knownContainerKeks.set(minted, entry.planned.containerKey);\n}\n\n/**\n * Levels of a re-rooted path pinned to an epoch the batch retires above them:\n * those strictly between the rotated ancestor the path was re-rooted on and\n * the target, parent-first, from the first stale one down. A rotation planned\n * above a target strands every level between the two, and each must be\n * re-keyed under the one above before the target can be signed. The batch\n * carries them without waiting to be told: they are proper ancestors of a\n * granted container, so the server would name them, and a refusal per level\n * is a round trip each. Anything stale above the rotated ancestor is not this\n * batch's doing and is left alone. `carryLevel` holds the count to the cap.\n */\nexport function staleLevelsAbove(\n  projection: ContainerWriterProjectionResponse,\n  rotatedAncestorId: string,\n): string[] {\n  const keks = projection.containerKeks;\n  const ancestor = keks.findIndex(\n    (kek) => kek.containerId === rotatedAncestorId,\n  );\n  if (ancestor < 0) return [];\n  const between = keks.slice(ancestor, -1);\n  const firstStale = between.findIndex(\n    (kek, index) =>\n      index > 0 &&\n      kek.parentContainerKeyEpochId !== between[index - 1]?.containerKeyEpochId,\n  );\n  return firstStale < 0\n    ? []\n    : between.slice(firstStale).map((kek) => kek.containerId);\n}\n"]}

package/workflows/organizations/principalContainerRematerializationTargets.js

@@ -1,79 +0,0 @@
-import { MAX_ROTATION_CONTAINER_REKEYS } from "../../internal/validators/util/index.js";
-import { isContainerNotFoundFailure } from "../../data/containers/shared/mutationFailures.js";
-import { referencedPrincipalPolicyKey } from "../../data/keyingProjectionVerification/principalPolicyCache.js";
-/**
- * Order a batch parent-first, by served depth. A group granted on a container
- * and on one of its descendants rotates both, and the lower rotation must be
- * signed against the epoch the upper one mints in this same batch, or it
- * extends a head the batch itself retires. A carried rekey sits below the
- * rotation it rides for the same reason. Ties keep id order for stability.
- */
-export function orderRematerializationsParentFirst(batch) {
-    return [...batch].sort((left, right) => left.projection.path.length - right.projection.path.length ||
-        left.projection.containerId.localeCompare(right.projection.containerId));
-}
-/** The served projection of a container the batch will sign for. */
-export async function loadServedProjection(apiClient, containerId) {
-    const projection = await apiClient.getContainerWriterProjection(containerId);
-    if (!projection) {
-        throw new Error(`Container ${containerId} could not be prepared for principal rotation`);
-    }
-    if (projection.containerId !== containerId) {
-        throw new Error("Served projection describes another container");
-    }
-    return projection;
-}
-/**
- * Fetch what the batch signs for, parent-first. A named descendant the batch
- * already rematerializes is not fetched twice: its own rotation is re-planned
- * under whatever the batch carries above it. Names are a hint from the server,
- * never an authority; each is verified where it is planned.
- */
-export async function loadRematerializationTargets(input) {
-    const grantByContainerId = new Map(input.grants.map((grant) => [grant.containerId, grant]));
-    const carried = [...new Set(input.carriedContainerIds)]
-        .filter((containerId) => !grantByContainerId.has(containerId))
-        .slice(0, MAX_ROTATION_CONTAINER_REKEYS);
-    const targets = [];
-    const retiredContainerIds = [];
-    for (const containerId of [...grantByContainerId.keys(), ...carried].sort((left, right) => left.localeCompare(right))) {
-        const grantRow = grantByContainerId.get(containerId) ?? null;
-        const result = await input.apiClient.getContainerWriterProjectionResult(containerId, { reportErrors: false });
-        if (!result.ok) {
-            // This is only a planning hint. Keep the signed grant intact; the API
-            // independently requires every live grant under the organization lock.
-            if (grantRow &&
-                result.kind === "http" &&
-                isContainerNotFoundFailure(result)) {
-                retiredContainerIds.push(containerId);
-                continue;
-            }
-            result.report();
-            throw new Error(`Container ${containerId} could not be prepared for principal rotation: ${result.message}`);
-        }
-        if (result.data.containerId !== containerId)
-            throw new Error("Served projection describes another container");
-        targets.push({ grantRow, projection: result.data });
-    }
-    return {
-        targets: orderRematerializationsParentFirst(targets),
-        retiredContainerIds,
-    };
-}
-/** An in-memory cache holding only the policy this batch is about to commit. */
-export function seededPrincipalPolicyCache(nextPolicy) {
-    return new Map([
-        [
-            referencedPrincipalPolicyKey({
-                keyEpoch: nextPolicy.keyEpoch,
-                keyFingerprint: nextPolicy.state.keyFingerprint,
-                principalId: nextPolicy.principalId,
-                principalType: nextPolicy.principalType,
-                stateHash: nextPolicy.stateHash,
-                version: nextPolicy.version,
-            }),
-            nextPolicy,
-        ],
-    ]);
-}
-//# sourceMappingURL=principalContainerRematerializationTargets.js.map

package/workflows/organizations/principalContainerRematerializationTargets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalContainerRematerializationTargets.js","sourceRoot":"","sources":["principalContainerRematerializationTargets.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAO3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAC;AA4B5G;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAOhD,KAAmB;IACnB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM;QAC1D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAC1E,CAAC;AACJ,CAAC;AAQD,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAwB,EACxB,WAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,aAAa,WAAW,+CAA+C,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IAIC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAAC,CACjE,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC3C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CACvE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC3C,EAAE,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,WAAW,EACX,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,sEAAsE;YACtE,uEAAuE;YACvE,IACE,QAAQ;gBACR,MAAM,CAAC,IAAI,KAAK,MAAM;gBACtB,0BAA0B,CAAC,MAAM,CAAC,EAClC,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,aAAa,WAAW,kDAAkD,MAAM,CAAC,OAAO,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,kCAAkC,CAAC,OAAO,CAAC;QACpD,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,UAA0C;IAE1C,OAAO,IAAI,GAAG,CAAC;QACb;YACE,4BAA4B,CAAC;gBAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc;gBAC/C,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC;YACF,UAAU;SACX;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { PrincipalContainerGrant } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport { isContainerNotFoundFailure } from \"../../data/containers/shared/mutationFailures\";\nimport type {\n  MaterializedContainerRekeyPlan,\n  MaterializedContainerRevokePlan,\n  MaterializedContainerSharePlan,\n} from \"../../data/containers/shared/types\";\nimport type { PrincipalPolicyCache } from \"../../data/keyingProjectionVerification\";\nimport { referencedPrincipalPolicyKey } from \"../../data/keyingProjectionVerification/principalPolicyCache\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport type { SpeculativePath } from \"../containers/child/carriedDescendantRekeys\";\n\nexport type MaterializedPrincipalContainerMutationPlan =\n  | MaterializedContainerRekeyPlan\n  | MaterializedContainerRevokePlan\n  | MaterializedContainerSharePlan;\n\n/** Authored paths for chaining plans; only rotated is null for a grant. */\nexport interface PlannedRematerialization {\n  /** The authored successor for either a grant or a rotation. */\n  readonly nextProjection?: ContainerWriterProjectionResponse | undefined;\n  /** A descendant rekey carried for a rotation above, not a rematerialization. */\n  readonly carried: boolean;\n  readonly planned: MaterializedPrincipalContainerMutationPlan;\n  readonly rotated: SpeculativePath | null;\n}\n\n/**\n * One container a batch signs for: a group grant it rematerializes, or a\n * descendant rekey it carries for a rotation above (`grantRow` null).\n */\nexport interface RematerializationTarget {\n  readonly grantRow: PrincipalContainerGrant | null;\n  readonly projection: ContainerWriterProjectionResponse;\n}\n\n/**\n * Order a batch parent-first, by served depth. A group granted on a container\n * and on one of its descendants rotates both, and the lower rotation must be\n * signed against the epoch the upper one mints in this same batch, or it\n * extends a head the batch itself retires. A carried rekey sits below the\n * rotation it rides for the same reason. Ties keep id order for stability.\n */\nexport function orderRematerializationsParentFirst<\n  T extends {\n    readonly projection: {\n      readonly containerId: string;\n      readonly path: readonly unknown[];\n    };\n  },\n>(batch: readonly T[]): T[] {\n  return [...batch].sort(\n    (left, right) =>\n      left.projection.path.length - right.projection.path.length ||\n      left.projection.containerId.localeCompare(right.projection.containerId),\n  );\n}\n\ninterface ProjectionApi {\n  getContainerWriterProjection(\n    containerId: string,\n  ): Promise<ContainerWriterProjectionResponse | null>;\n}\n\n/** The served projection of a container the batch will sign for. */\nexport async function loadServedProjection(\n  apiClient: ProjectionApi,\n  containerId: string,\n): Promise<ContainerWriterProjectionResponse> {\n  const projection = await apiClient.getContainerWriterProjection(containerId);\n  if (!projection) {\n    throw new Error(\n      `Container ${containerId} could not be prepared for principal rotation`,\n    );\n  }\n  if (projection.containerId !== containerId) {\n    throw new Error(\"Served projection describes another container\");\n  }\n  return projection;\n}\n\n/**\n * Fetch what the batch signs for, parent-first. A named descendant the batch\n * already rematerializes is not fetched twice: its own rotation is re-planned\n * under whatever the batch carries above it. Names are a hint from the server,\n * never an authority; each is verified where it is planned.\n */\nexport async function loadRematerializationTargets(input: {\n  readonly apiClient: Pick<ApiClient, \"getContainerWriterProjectionResult\">;\n  readonly carriedContainerIds: readonly string[];\n  readonly grants: readonly PrincipalContainerGrant[];\n}): Promise<{\n  targets: RematerializationTarget[];\n  retiredContainerIds: string[];\n}> {\n  const grantByContainerId = new Map(\n    input.grants.map((grant) => [grant.containerId, grant] as const),\n  );\n  const carried = [...new Set(input.carriedContainerIds)]\n    .filter((containerId) => !grantByContainerId.has(containerId))\n    .slice(0, MAX_ROTATION_CONTAINER_REKEYS);\n  const targets: RematerializationTarget[] = [];\n  const retiredContainerIds: string[] = [];\n  for (const containerId of [...grantByContainerId.keys(), ...carried].sort(\n    (left, right) => left.localeCompare(right),\n  )) {\n    const grantRow = grantByContainerId.get(containerId) ?? null;\n    const result = await input.apiClient.getContainerWriterProjectionResult(\n      containerId,\n      { reportErrors: false },\n    );\n    if (!result.ok) {\n      // This is only a planning hint. Keep the signed grant intact; the API\n      // independently requires every live grant under the organization lock.\n      if (\n        grantRow &&\n        result.kind === \"http\" &&\n        isContainerNotFoundFailure(result)\n      ) {\n        retiredContainerIds.push(containerId);\n        continue;\n      }\n      result.report();\n      throw new Error(\n        `Container ${containerId} could not be prepared for principal rotation: ${result.message}`,\n      );\n    }\n    if (result.data.containerId !== containerId)\n      throw new Error(\"Served projection describes another container\");\n    targets.push({ grantRow, projection: result.data });\n  }\n  return {\n    targets: orderRematerializationsParentFirst(targets),\n    retiredContainerIds,\n  };\n}\n\n/** An in-memory cache holding only the policy this batch is about to commit. */\nexport function seededPrincipalPolicyCache(\n  nextPolicy: PrincipalPolicyCurrentEvidence,\n): PrincipalPolicyCache {\n  return new Map([\n    [\n      referencedPrincipalPolicyKey({\n        keyEpoch: nextPolicy.keyEpoch,\n        keyFingerprint: nextPolicy.state.keyFingerprint,\n        principalId: nextPolicy.principalId,\n        principalType: nextPolicy.principalType,\n        stateHash: nextPolicy.stateHash,\n        version: nextPolicy.version,\n      }),\n      nextPolicy,\n    ],\n  ]);\n}\n"]}

package/workflows/organizations/principalMutationJournalManagement.d.ts

@@ -1,26 +0,0 @@
-import { type AuthoredPrincipalMutation } from "../../data/principals/principalMutationJournal.js";
-import type { PrincipalMutationJournalContext } from "./principalMutationJournalSession.js";
-export interface PrincipalMutationRecoveryApi {
-    readonly readPendingPrincipalMutation: (organizationId: string) => Promise<AuthoredPrincipalMutation | null>;
-    readonly recoverPendingPrincipalMutation: (organizationId: string) => Promise<void>;
-    readonly abandonPendingPrincipalMutation: (organizationId: string, mutation: AuthoredPrincipalMutation, acknowledgeUnknownOutcome: true) => Promise<boolean>;
-    readonly discardUnreadablePrincipalMutation: (organizationId: string, recordId: string, acknowledgeUnknownOutcome: true) => Promise<boolean>;
-}
-type JournalIdentity = Pick<PrincipalMutationJournalContext, "execSql" | "scope" | "signingKeyPair" | "stillCurrent">;
-/** Discard only the inspected unreadable bytes; never parse them for submission. */
-export declare function discardUnreadableJournaledPrincipalMutation(input: JournalIdentity & {
-    readonly recordId: string;
-    readonly acknowledgeUnknownOutcome: true;
-}): Promise<boolean>;
-/** Inspect authenticated authored work without retrying it or changing checkpoints. */
-export declare function readJournaledPrincipalMutation(input: JournalIdentity): Promise<AuthoredPrincipalMutation | null>;
-/**
- * An explicit host/user choice to stop retries, not a claim that the write failed.
- * The exact inspected request must still own the lane; ordinary recovery never
- * calls this. Future authoring must still verify the latest policy state.
- */
-export declare function abandonJournaledPrincipalMutation(input: JournalIdentity & {
-    readonly mutation: AuthoredPrincipalMutation;
-    readonly acknowledgeUnknownOutcome: true;
-}): Promise<boolean>;
-export {};

package/workflows/organizations/principalMutationJournalManagement.js

@@ -1,104 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-import { canonicalKeyingJsonString } from "../../data/keying/canonicalJson.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { clearPrincipalMutationJournal, loadPrincipalMutationJournal, } from "../../data/persistence/principalMutationJournalPersistence.js";
-import { openPrincipalMutation, principalMutationJournalScopeId, } from "../../data/principals/principalMutationJournal.js";
-import { principalMutationJournalRecordId, UnreadablePrincipalMutationError, } from "../../data/principals/principalMutationJournalRecord.js";
-import { getOrCreatePrincipalPolicyCoordinator } from "../../data/principals/principalPolicyCoordinator.js";
-async function loadAuthenticatedMutation(input) {
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    const row = await loadPrincipalMutationJournal(input.execSql, await principalMutationJournalScopeId(input.scope));
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    if (!row)
-        return null;
-    let mutation;
-    try {
-        mutation = await openPrincipalMutation({
-            scope: input.scope,
-            row,
-            signingPublicKey: input.signingKeyPair.signingPublicKey,
-        });
-    }
-    catch (error) {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        if (!(error instanceof KeyingVerificationError))
-            throw error;
-        const recordId = await principalMutationJournalRecordId(row);
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        throw new UnreadablePrincipalMutationError(recordId, error.code === "invalid_shape" ? "format" : "authentication");
-    }
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    return { row, mutation };
-}
-/** Discard only the inspected unreadable bytes; never parse them for submission. */
-export async function discardUnreadableJournaledPrincipalMutation(input) {
-    if (input.acknowledgeUnknownOutcome !== true)
-        throw new Error("Discarding unreadable work requires acknowledging its unknown outcome");
-    const expected = input.recordId;
-    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const row = await loadPrincipalMutationJournal(input.execSql, await principalMutationJournalScopeId(input.scope));
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        if (!row)
-            return false;
-        if ((await principalMutationJournalRecordId(row)) !== expected)
-            throw new Error("The unreadable principal mutation changed after inspection");
-        let unreadable = false;
-        try {
-            await openPrincipalMutation({
-                scope: input.scope,
-                row,
-                signingPublicKey: input.signingKeyPair.signingPublicKey,
-            });
-        }
-        catch (error) {
-            if (!(error instanceof KeyingVerificationError))
-                throw error;
-            unreadable = true;
-        }
-        if (!unreadable)
-            throw new Error("Readable principal mutations require ordinary abandonment");
-        const removed = await clearPrincipalMutationJournal({
-            execSql: input.execSql,
-            row,
-            stillCurrent: input.stillCurrent,
-        });
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        if (!removed)
-            throw new Error("The unreadable principal mutation changed during discard");
-        return true;
-    });
-}
-/** Inspect authenticated authored work without retrying it or changing checkpoints. */
-export async function readJournaledPrincipalMutation(input) {
-    // Inspection may observe an owned dispatch; all mutations still use the lane.
-    return (await loadAuthenticatedMutation(input))?.mutation ?? null;
-}
-/**
- * An explicit host/user choice to stop retries, not a claim that the write failed.
- * The exact inspected request must still own the lane; ordinary recovery never
- * calls this. Future authoring must still verify the latest policy state.
- */
-export async function abandonJournaledPrincipalMutation(input) {
-    if (input.acknowledgeUnknownOutcome !== true)
-        throw new Error("Abandoning authored work requires acknowledging its unknown outcome");
-    const expected = canonicalKeyingJsonString(JSON.parse(JSON.stringify(input.mutation)), "inspected authored mutation");
-    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
-        const saved = await loadAuthenticatedMutation(input);
-        if (!saved)
-            return false;
-        if (canonicalKeyingJsonString(saved.mutation, "saved authored mutation") !==
-            expected)
-            throw new Error("The pending principal mutation changed after inspection");
-        const removed = await clearPrincipalMutationJournal({
-            execSql: input.execSql,
-            row: saved.row,
-            stillCurrent: input.stillCurrent,
-        });
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        if (!removed)
-            throw new Error("The pending principal mutation changed during abandonment");
-        return true;
-    });
-}
-//# sourceMappingURL=principalMutationJournalManagement.js.map

package/workflows/organizations/principalMutationJournalManagement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalMutationJournalManagement.js","sourceRoot":"","sources":["principalMutationJournalManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAEL,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AA2BzG,KAAK,UAAU,yBAAyB,CAAC,KAAsB;IAC7D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAC5C,KAAK,CAAC,OAAO,EACb,MAAM,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CACnD,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,QAAmC,CAAC;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,qBAAqB,CAAC;YACrC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG;YACH,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;SACxD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC7D,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,IAAI,gCAAgC,CACxC,QAAQ,EACR,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAC7D,CAAC;IACJ,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,KAGC;IAED,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI;QAC1C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAC5C,KAAK,CAAC,OAAO,EACb,MAAM,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CACnD,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM,gCAAgC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ;YAC5D,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;gBACH,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;aACxD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC7D,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG;YACH,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAsB;IAEtB,8EAA8E;IAC9E,OAAO,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI;QAC1C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,MAAM,QAAQ,GAAG,yBAAyB,CACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC1C,6BAA6B,CAC9B,CAAC;IACF,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IACE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,yBAAyB,CAAC;YACpE,QAAQ;YAER,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { canonicalKeyingJsonString } from \"../../data/keying/canonicalJson\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport {\n  clearPrincipalMutationJournal,\n  loadPrincipalMutationJournal,\n} from \"../../data/persistence/principalMutationJournalPersistence\";\nimport {\n  type AuthoredPrincipalMutation,\n  openPrincipalMutation,\n  principalMutationJournalScopeId,\n} from \"../../data/principals/principalMutationJournal\";\nimport {\n  principalMutationJournalRecordId,\n  UnreadablePrincipalMutationError,\n} from \"../../data/principals/principalMutationJournalRecord\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../data/principals/principalPolicyCoordinator\";\nimport type { PrincipalMutationJournalContext } from \"./principalMutationJournalSession\";\n\nexport interface PrincipalMutationRecoveryApi {\n  readonly readPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<AuthoredPrincipalMutation | null>;\n  readonly recoverPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<void>;\n  readonly abandonPendingPrincipalMutation: (\n    organizationId: string,\n    mutation: AuthoredPrincipalMutation,\n    acknowledgeUnknownOutcome: true,\n  ) => Promise<boolean>;\n  readonly discardUnreadablePrincipalMutation: (\n    organizationId: string,\n    recordId: string,\n    acknowledgeUnknownOutcome: true,\n  ) => Promise<boolean>;\n}\n\ntype JournalIdentity = Pick<\n  PrincipalMutationJournalContext,\n  \"execSql\" | \"scope\" | \"signingKeyPair\" | \"stillCurrent\"\n>;\n\nasync function loadAuthenticatedMutation(input: JournalIdentity) {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const row = await loadPrincipalMutationJournal(\n    input.execSql,\n    await principalMutationJournalScopeId(input.scope),\n  );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!row) return null;\n  let mutation: AuthoredPrincipalMutation;\n  try {\n    mutation = await openPrincipalMutation({\n      scope: input.scope,\n      row,\n      signingPublicKey: input.signingKeyPair.signingPublicKey,\n    });\n  } catch (error) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!(error instanceof KeyingVerificationError)) throw error;\n    const recordId = await principalMutationJournalRecordId(row);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    throw new UnreadablePrincipalMutationError(\n      recordId,\n      error.code === \"invalid_shape\" ? \"format\" : \"authentication\",\n    );\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { row, mutation };\n}\n\n/** Discard only the inspected unreadable bytes; never parse them for submission. */\nexport async function discardUnreadableJournaledPrincipalMutation(\n  input: JournalIdentity & {\n    readonly recordId: string;\n    readonly acknowledgeUnknownOutcome: true;\n  },\n): Promise<boolean> {\n  if (input.acknowledgeUnknownOutcome !== true)\n    throw new Error(\n      \"Discarding unreadable work requires acknowledging its unknown outcome\",\n    );\n  const expected = input.recordId;\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const row = await loadPrincipalMutationJournal(\n      input.execSql,\n      await principalMutationJournalScopeId(input.scope),\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!row) return false;\n    if ((await principalMutationJournalRecordId(row)) !== expected)\n      throw new Error(\n        \"The unreadable principal mutation changed after inspection\",\n      );\n    let unreadable = false;\n    try {\n      await openPrincipalMutation({\n        scope: input.scope,\n        row,\n        signingPublicKey: input.signingKeyPair.signingPublicKey,\n      });\n    } catch (error) {\n      if (!(error instanceof KeyingVerificationError)) throw error;\n      unreadable = true;\n    }\n    if (!unreadable)\n      throw new Error(\n        \"Readable principal mutations require ordinary abandonment\",\n      );\n    const removed = await clearPrincipalMutationJournal({\n      execSql: input.execSql,\n      row,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!removed)\n      throw new Error(\n        \"The unreadable principal mutation changed during discard\",\n      );\n    return true;\n  });\n}\n\n/** Inspect authenticated authored work without retrying it or changing checkpoints. */\nexport async function readJournaledPrincipalMutation(\n  input: JournalIdentity,\n): Promise<AuthoredPrincipalMutation | null> {\n  // Inspection may observe an owned dispatch; all mutations still use the lane.\n  return (await loadAuthenticatedMutation(input))?.mutation ?? null;\n}\n\n/**\n * An explicit host/user choice to stop retries, not a claim that the write failed.\n * The exact inspected request must still own the lane; ordinary recovery never\n * calls this. Future authoring must still verify the latest policy state.\n */\nexport async function abandonJournaledPrincipalMutation(\n  input: JournalIdentity & {\n    readonly mutation: AuthoredPrincipalMutation;\n    readonly acknowledgeUnknownOutcome: true;\n  },\n): Promise<boolean> {\n  if (input.acknowledgeUnknownOutcome !== true)\n    throw new Error(\n      \"Abandoning authored work requires acknowledging its unknown outcome\",\n    );\n  const expected = canonicalKeyingJsonString(\n    JSON.parse(JSON.stringify(input.mutation)),\n    \"inspected authored mutation\",\n  );\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    const saved = await loadAuthenticatedMutation(input);\n    if (!saved) return false;\n    if (\n      canonicalKeyingJsonString(saved.mutation, \"saved authored mutation\") !==\n      expected\n    )\n      throw new Error(\n        \"The pending principal mutation changed after inspection\",\n      );\n    const removed = await clearPrincipalMutationJournal({\n      execSql: input.execSql,\n      row: saved.row,\n      stillCurrent: input.stillCurrent,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!removed)\n      throw new Error(\n        \"The pending principal mutation changed during abandonment\",\n      );\n    return true;\n  });\n}\n"]}

package/workflows/organizations/principalMutationJournalSession.d.ts

@@ -1,26 +0,0 @@
-import type { RequestResult } from "../../internal/api-client/index.js";
-import type { SigningKeyPair } from "../../internal/crypto/index.js";
-import { type AuthoredPrincipalMutation, type PrincipalMutationJournalScope } from "../../data/principals/principalMutationJournal.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import { type PrincipalMutationResponse } from "./principalOperationReceipt.js";
-type MutationResult = RequestResult<PrincipalMutationResponse>;
-export interface PrincipalMutationJournalContext {
-    readonly execSql: ExecSql;
-    readonly scope: PrincipalMutationJournalScope;
-    readonly signingKeyPair: SigningKeyPair;
-    readonly stillCurrent: () => boolean;
-    readonly submit: (mutation: AuthoredPrincipalMutation) => Promise<MutationResult>;
-}
-export declare class PrincipalMutationOutcomeUnknownError extends Error {
-    constructor(options?: ErrorOptions);
-}
-/** No HTTP begins until the exact authored request is durably claimed. */
-export declare function submitJournaledPrincipalMutation(input: PrincipalMutationJournalContext & {
-    readonly mutation: AuthoredPrincipalMutation;
-}): Promise<MutationResult>;
-/** Retry only authenticated saved bytes, never an application mutation callback. */
-export declare function recoverJournaledPrincipalMutation(input: PrincipalMutationJournalContext): Promise<{
-    readonly mutation: AuthoredPrincipalMutation;
-    readonly response: PrincipalMutationResponse;
-} | null>;
-export {};

package/workflows/organizations/principalMutationJournalSession.js

@@ -1,85 +0,0 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { claimPrincipalMutationJournal, clearPrincipalMutationJournal, loadPrincipalMutationJournal, } from "../../data/persistence/principalMutationJournalPersistence.js";
-import { openPrincipalMutation, principalMutationJournalScopeId, sealPrincipalMutation, } from "../../data/principals/principalMutationJournal.js";
-import { getOrCreatePrincipalPolicyCoordinator } from "../../data/principals/principalPolicyCoordinator.js";
-import { assertAuthoredPrincipalOperationReceipt, } from "./principalOperationReceipt.js";
-export class PrincipalMutationOutcomeUnknownError extends Error {
-    constructor(options) {
-        super("A saved policy request may have committed; resolve its outcome or explicitly abandon its retry before another mutation", options);
-        this.name = "PrincipalMutationOutcomeUnknownError";
-    }
-}
-function knownInitialRefusal(result) {
-    if (result.ok)
-        return false;
-    // ApiClient separates pre-dispatch cancellation from an uncertain sent write.
-    if (result.kind === "cancelled")
-        return true;
-    if (result.kind !== "http")
-        return false;
-    return ([400, 401, 402, 403, 409].includes(result.status ?? 0) ||
-        (result.status === 503 &&
-            result.code === "principal_history_preparation_unavailable"));
-}
-async function submitSavedMutation(input, row, recovering) {
-    const mutation = await openPrincipalMutation({
-        scope: input.scope,
-        row,
-        signingPublicKey: input.signingKeyPair.signingPublicKey,
-    });
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    // Keep the authenticated copy for acknowledgement checks even if a transport
-    // mutates its argument while preparing or retrying the HTTP request.
-    let result;
-    try {
-        result = await input.submit(structuredClone(mutation));
-    }
-    catch (cause) {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        throw new PrincipalMutationOutcomeUnknownError({ cause });
-    }
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    if (result.ok) {
-        await assertAuthoredPrincipalOperationReceipt(mutation, result.data);
-    }
-    else if (recovering || !knownInitialRefusal(result)) {
-        // A refusal today (including loss of admin access) cannot establish whether
-        // an earlier disconnected attempt committed. Preserve the original intent.
-        throw new PrincipalMutationOutcomeUnknownError();
-    }
-    await clearPrincipalMutationJournal({
-        execSql: input.execSql,
-        row,
-        stillCurrent: input.stillCurrent,
-    });
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    return { mutation, result };
-}
-/** No HTTP begins until the exact authored request is durably claimed. */
-export async function submitJournaledPrincipalMutation(input) {
-    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const row = await sealPrincipalMutation(input);
-        await claimPrincipalMutationJournal({
-            execSql: input.execSql,
-            row,
-            stillCurrent: input.stillCurrent,
-        });
-        return (await submitSavedMutation(input, row, false)).result;
-    });
-}
-/** Retry only authenticated saved bytes, never an application mutation callback. */
-export async function recoverJournaledPrincipalMutation(input) {
-    return getOrCreatePrincipalPolicyCoordinator(input.execSql).runJournalOperation(input.scope, async () => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const row = await loadPrincipalMutationJournal(input.execSql, await principalMutationJournalScopeId(input.scope));
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        if (!row)
-            return null;
-        const { mutation, result } = await submitSavedMutation(input, row, true);
-        if (!result.ok)
-            throw new PrincipalMutationOutcomeUnknownError();
-        return { mutation, response: result.data };
-    });
-}
-//# sourceMappingURL=principalMutationJournalSession.js.map

package/workflows/organizations/principalMutationJournalSession.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalMutationJournalSession.js","sourceRoot":"","sources":["principalMutationJournalSession.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,GAE7B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAEL,qBAAqB,EAErB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,qCAAqC,EAAE,MAAM,kDAAkD,CAAC;AAEzG,OAAO,EACL,uCAAuC,GAExC,MAAM,6BAA6B,CAAC;AAcrC,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAsB;QAChC,KAAK,CACH,wHAAwH,EACxH,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,MAAsB;IACjD,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,8EAA8E;IAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,CACL,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACtD,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;YACpB,MAAM,CAAC,IAAI,KAAK,2CAA2C,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAsC,EACtC,GAAgC,EAChC,UAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG;QACH,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;KACxD,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,IAAI,oCAAoC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,uCAAuC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,IAAI,oCAAoC,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG;QACH,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAEC;IAED,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,6BAA6B,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG;YACH,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAsC;IAKtC,OAAO,qCAAqC,CAC1C,KAAK,CAAC,OAAO,CACd,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC5C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAC5C,KAAK,CAAC,OAAO,EACb,MAAM,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CACnD,CAAC;QACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,oCAAoC,EAAE,CAAC;QACjE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport {\n  claimPrincipalMutationJournal,\n  clearPrincipalMutationJournal,\n  loadPrincipalMutationJournal,\n  type PrincipalMutationJournalRow,\n} from \"../../data/persistence/principalMutationJournalPersistence\";\nimport {\n  type AuthoredPrincipalMutation,\n  openPrincipalMutation,\n  type PrincipalMutationJournalScope,\n  principalMutationJournalScopeId,\n  sealPrincipalMutation,\n} from \"../../data/principals/principalMutationJournal\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../data/principals/principalPolicyCoordinator\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  assertAuthoredPrincipalOperationReceipt,\n  type PrincipalMutationResponse,\n} from \"./principalOperationReceipt\";\n\ntype MutationResult = RequestResult<PrincipalMutationResponse>;\n\nexport interface PrincipalMutationJournalContext {\n  readonly execSql: ExecSql;\n  readonly scope: PrincipalMutationJournalScope;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent: () => boolean;\n  readonly submit: (\n    mutation: AuthoredPrincipalMutation,\n  ) => Promise<MutationResult>;\n}\n\nexport class PrincipalMutationOutcomeUnknownError extends Error {\n  constructor(options?: ErrorOptions) {\n    super(\n      \"A saved policy request may have committed; resolve its outcome or explicitly abandon its retry before another mutation\",\n      options,\n    );\n    this.name = \"PrincipalMutationOutcomeUnknownError\";\n  }\n}\n\nfunction knownInitialRefusal(result: MutationResult): boolean {\n  if (result.ok) return false;\n  // ApiClient separates pre-dispatch cancellation from an uncertain sent write.\n  if (result.kind === \"cancelled\") return true;\n  if (result.kind !== \"http\") return false;\n  return (\n    [400, 401, 402, 403, 409].includes(result.status ?? 0) ||\n    (result.status === 503 &&\n      result.code === \"principal_history_preparation_unavailable\")\n  );\n}\n\nasync function submitSavedMutation(\n  input: PrincipalMutationJournalContext,\n  row: PrincipalMutationJournalRow,\n  recovering: boolean,\n): Promise<{ mutation: AuthoredPrincipalMutation; result: MutationResult }> {\n  const mutation = await openPrincipalMutation({\n    scope: input.scope,\n    row,\n    signingPublicKey: input.signingKeyPair.signingPublicKey,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  // Keep the authenticated copy for acknowledgement checks even if a transport\n  // mutates its argument while preparing or retrying the HTTP request.\n  let result: MutationResult;\n  try {\n    result = await input.submit(structuredClone(mutation));\n  } catch (cause) {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    throw new PrincipalMutationOutcomeUnknownError({ cause });\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (result.ok) {\n    await assertAuthoredPrincipalOperationReceipt(mutation, result.data);\n  } else if (recovering || !knownInitialRefusal(result)) {\n    // A refusal today (including loss of admin access) cannot establish whether\n    // an earlier disconnected attempt committed. Preserve the original intent.\n    throw new PrincipalMutationOutcomeUnknownError();\n  }\n  await clearPrincipalMutationJournal({\n    execSql: input.execSql,\n    row,\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { mutation, result };\n}\n\n/** No HTTP begins until the exact authored request is durably claimed. */\nexport async function submitJournaledPrincipalMutation(\n  input: PrincipalMutationJournalContext & {\n    readonly mutation: AuthoredPrincipalMutation;\n  },\n): Promise<MutationResult> {\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const row = await sealPrincipalMutation(input);\n    await claimPrincipalMutationJournal({\n      execSql: input.execSql,\n      row,\n      stillCurrent: input.stillCurrent,\n    });\n    return (await submitSavedMutation(input, row, false)).result;\n  });\n}\n\n/** Retry only authenticated saved bytes, never an application mutation callback. */\nexport async function recoverJournaledPrincipalMutation(\n  input: PrincipalMutationJournalContext,\n): Promise<{\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly response: PrincipalMutationResponse;\n} | null> {\n  return getOrCreatePrincipalPolicyCoordinator(\n    input.execSql,\n  ).runJournalOperation(input.scope, async () => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const row = await loadPrincipalMutationJournal(\n      input.execSql,\n      await principalMutationJournalScopeId(input.scope),\n    );\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    if (!row) return null;\n    const { mutation, result } = await submitSavedMutation(input, row, true);\n    if (!result.ok) throw new PrincipalMutationOutcomeUnknownError();\n    return { mutation, response: result.data };\n  });\n}\n"]}

package/workflows/organizations/principalMutationReceipt.js

@@ -1,28 +0,0 @@
-import { computePrincipalStateHash } from "../../internal/crypto/index.js";
-import { canonicalKeyingJsonString } from "../../data/keying/canonicalJson.js";
-import { assertPrincipalPolicyReceiptArtifacts } from "./principalPolicyReceiptArtifacts.js";
-/** A past commit acknowledgement is not evidence for advancing current pins. */
-export async function assertAuthoredPrincipalMutationReceipt(request, response) {
-    for (const part of ["groupPolicy", "organizationPolicy"]) {
-        await assertAuthoredPrincipalPolicyReceipt(request[part], response[part]);
-    }
-    if (Boolean(request.memberPolicy) !== Boolean(response.memberPolicy)) {
-        throw new Error("Principal mutation receipt Members policy differs");
-    }
-    if (request.memberPolicy && response.memberPolicy) {
-        await assertAuthoredPrincipalPolicyReceipt(request.memberPolicy, response.memberPolicy);
-    }
-}
-export async function assertAuthoredPrincipalPolicyReceipt(expected, observed) {
-    const { stateHash, createdAt: _createdAt, ...state } = observed.currentState;
-    if (stateHash !== (await computePrincipalStateHash(expected.state)) ||
-        canonicalKeyingJsonString(state, "principal mutation receipt state") !==
-            canonicalKeyingJsonString(expected.state, "authored principal state"))
-        throw new Error("Principal mutation receipt state differs from the authored request");
-    assertPrincipalPolicyReceiptArtifacts({
-        request: expected,
-        response: observed,
-        expectedHead: { ...observed.currentState, stateHash },
-    });
-}
-//# sourceMappingURL=principalMutationReceipt.js.map

package/workflows/organizations/principalMutationReceipt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalMutationReceipt.js","sourceRoot":"","sources":["principalMutationReceipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAE1F,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAA6C,EAC7C,QAA+C;IAE/C,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAU,EAAE,CAAC;QAClE,MAAM,oCAAoC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClD,MAAM,oCAAoC,CACxC,OAAO,CAAC,YAAY,EACpB,QAAQ,CAAC,YAAY,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,QAA6D,EAC7D,QAA8D;IAE9D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC7E,IACE,SAAS,KAAK,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/D,yBAAyB,CAAC,KAAK,EAAE,kCAAkC,CAAC;YAClE,yBAAyB,CAAC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;QAEvE,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,qCAAqC,CAAC;QACpC,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE;KACtD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type { CommitOrganizationGroupPolicyResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../data/keying/canonicalJson\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"./principalPolicyReceiptArtifacts\";\n\n/** A past commit acknowledgement is not evidence for advancing current pins. */\nexport async function assertAuthoredPrincipalMutationReceipt(\n  request: CommitOrganizationGroupPolicyRequest,\n  response: CommitOrganizationGroupPolicyResponse,\n): Promise<void> {\n  for (const part of [\"groupPolicy\", \"organizationPolicy\"] as const) {\n    await assertAuthoredPrincipalPolicyReceipt(request[part], response[part]);\n  }\n  if (Boolean(request.memberPolicy) !== Boolean(response.memberPolicy)) {\n    throw new Error(\"Principal mutation receipt Members policy differs\");\n  }\n  if (request.memberPolicy && response.memberPolicy) {\n    await assertAuthoredPrincipalPolicyReceipt(\n      request.memberPolicy,\n      response.memberPolicy,\n    );\n  }\n}\n\nexport async function assertAuthoredPrincipalPolicyReceipt(\n  expected: CommitOrganizationGroupPolicyRequest[\"groupPolicy\"],\n  observed: CommitOrganizationGroupPolicyResponse[\"groupPolicy\"],\n): Promise<void> {\n  const { stateHash, createdAt: _createdAt, ...state } = observed.currentState;\n  if (\n    stateHash !== (await computePrincipalStateHash(expected.state)) ||\n    canonicalKeyingJsonString(state, \"principal mutation receipt state\") !==\n      canonicalKeyingJsonString(expected.state, \"authored principal state\")\n  )\n    throw new Error(\n      \"Principal mutation receipt state differs from the authored request\",\n    );\n  assertPrincipalPolicyReceiptArtifacts({\n    request: expected,\n    response: observed,\n    expectedHead: { ...observed.currentState, stateHash },\n  });\n}\n"]}

package/workflows/organizations/principalOperationReceipt.d.ts

@@ -1,5 +0,0 @@
-import { type CommitOrganizationGroupPolicyResponse, type CreateOrganizationGroupResponse, type DeleteOrganizationGroupResponse, type PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
-import type { AuthoredPrincipalMutation } from "../../data/principals/principalMutationJournal.js";
-export type PrincipalMutationResponse = CommitOrganizationGroupPolicyResponse | CreateOrganizationGroupResponse | DeleteOrganizationGroupResponse | PrincipalPolicyMutationResponse;
-/** Match both the operation's route and its exact authored policy artifacts. */
-export declare function assertAuthoredPrincipalOperationReceipt(mutation: AuthoredPrincipalMutation, response: PrincipalMutationResponse): Promise<void>;

package/workflows/organizations/principalOperationReceipt.js

@@ -1,36 +0,0 @@
-import { computePrincipalStateHash } from "../../internal/crypto/index.js";
-import { isCommitOrganizationGroupPolicyResponse, isCreateOrganizationGroupResponse, isDeleteOrganizationGroupResponse, isPrincipalPolicyMutationResponse, } from "../../internal/validators/response/index.js";
-import { acknowledgeInitialGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
-import { assertAuthoredPrincipalMutationReceipt, assertAuthoredPrincipalPolicyReceipt, } from "./principalMutationReceipt.js";
-/** Match both the operation's route and its exact authored policy artifacts. */
-export async function assertAuthoredPrincipalOperationReceipt(mutation, response) {
-    switch (mutation.kind) {
-        case "compound":
-            if (!isCommitOrganizationGroupPolicyResponse(response))
-                break;
-            return assertAuthoredPrincipalMutationReceipt(mutation.request, response);
-        case "organization":
-            if (!isPrincipalPolicyMutationResponse(response))
-                break;
-            return assertAuthoredPrincipalPolicyReceipt(mutation.request, response);
-        case "group-create":
-            if (!isCreateOrganizationGroupResponse(response))
-                break;
-            await acknowledgeInitialGroupPolicy({
-                organizationId: mutation.request.organizationPolicy.state.principalId,
-                request: mutation.request,
-                response: response.group,
-                stateHash: await computePrincipalStateHash(mutation.request.initialGroupPolicy.state),
-            });
-            return assertAuthoredPrincipalPolicyReceipt(mutation.request.organizationPolicy, response.organizationPolicy);
-        case "group-delete":
-            if (!isDeleteOrganizationGroupResponse(response) ||
-                response.groupId !== mutation.groupId ||
-                response.organizationId !==
-                    mutation.request.organizationPolicy.state.principalId)
-                break;
-            return assertAuthoredPrincipalPolicyReceipt(mutation.request.organizationPolicy, response.organizationPolicy);
-    }
-    throw new Error("Principal mutation receipt operation or target differs");
-}
-//# sourceMappingURL=principalOperationReceipt.js.map

package/workflows/organizations/principalOperationReceipt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalOperationReceipt.js","sourceRoot":"","sources":["principalOperationReceipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAIL,uCAAuC,EACvC,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EACL,sCAAsC,EACtC,oCAAoC,GACrC,MAAM,4BAA4B,CAAC;AAQpC,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,QAAmC,EACnC,QAAmC;IAEnC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,UAAU;YACb,IAAI,CAAC,uCAAuC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YAC9D,OAAO,sCAAsC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,OAAO,oCAAoC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,KAAK,cAAc;YACjB,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAAE,MAAM;YACxD,MAAM,6BAA6B,CAAC;gBAClC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBACrE,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK;gBACxB,SAAS,EAAE,MAAM,yBAAyB,CACxC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAC1C;aACF,CAAC,CAAC;YACH,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QACJ,KAAK,cAAc;YACjB,IACE,CAAC,iCAAiC,CAAC,QAAQ,CAAC;gBAC5C,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,QAAQ,CAAC,cAAc;oBACrB,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW;gBAEvD,MAAM;YACR,OAAO,oCAAoC,CACzC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EACnC,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;IACN,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import { computePrincipalStateHash } from \"@tearleads/crypto\";\nimport {\n  type CommitOrganizationGroupPolicyResponse,\n  type CreateOrganizationGroupResponse,\n  type DeleteOrganizationGroupResponse,\n  isCommitOrganizationGroupPolicyResponse,\n  isCreateOrganizationGroupResponse,\n  isDeleteOrganizationGroupResponse,\n  isPrincipalPolicyMutationResponse,\n  type PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport { acknowledgeInitialGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  assertAuthoredPrincipalMutationReceipt,\n  assertAuthoredPrincipalPolicyReceipt,\n} from \"./principalMutationReceipt\";\n\nexport type PrincipalMutationResponse =\n  | CommitOrganizationGroupPolicyResponse\n  | CreateOrganizationGroupResponse\n  | DeleteOrganizationGroupResponse\n  | PrincipalPolicyMutationResponse;\n\n/** Match both the operation's route and its exact authored policy artifacts. */\nexport async function assertAuthoredPrincipalOperationReceipt(\n  mutation: AuthoredPrincipalMutation,\n  response: PrincipalMutationResponse,\n): Promise<void> {\n  switch (mutation.kind) {\n    case \"compound\":\n      if (!isCommitOrganizationGroupPolicyResponse(response)) break;\n      return assertAuthoredPrincipalMutationReceipt(mutation.request, response);\n    case \"organization\":\n      if (!isPrincipalPolicyMutationResponse(response)) break;\n      return assertAuthoredPrincipalPolicyReceipt(mutation.request, response);\n    case \"group-create\":\n      if (!isCreateOrganizationGroupResponse(response)) break;\n      await acknowledgeInitialGroupPolicy({\n        organizationId: mutation.request.organizationPolicy.state.principalId,\n        request: mutation.request,\n        response: response.group,\n        stateHash: await computePrincipalStateHash(\n          mutation.request.initialGroupPolicy.state,\n        ),\n      });\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n    case \"group-delete\":\n      if (\n        !isDeleteOrganizationGroupResponse(response) ||\n        response.groupId !== mutation.groupId ||\n        response.organizationId !==\n          mutation.request.organizationPolicy.state.principalId\n      )\n        break;\n      return assertAuthoredPrincipalPolicyReceipt(\n        mutation.request.organizationPolicy,\n        response.organizationPolicy,\n      );\n  }\n  throw new Error(\"Principal mutation receipt operation or target differs\");\n}\n"]}