@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/organizations/groupPolicy/commitCurrentGroupPolicyMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitCurrentGroupPolicyMutation.js","sourceRoot":"","sources":["commitCurrentGroupPolicyMutation.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAEvG,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sCAAsC,EAAE,MAAM,gDAAgD,CAAC;AAIxG,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAsBpE,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,6BAA6B,CAAC;QACnD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CACpD,KAAK,EACL,MAAM,EACN,MAAM,EAAE,SAAS,CAClB,CAAC;IACF,MAAM,mBAAmB,GAAG,MAAM,gBAAgB,CAChD,KAAK,EACL,YAAY,EACZ,MAAM,EAAE,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;QACpC,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;QAC1D,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,sCAAsC,CAC1C;QACE,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,kBAAkB,EAAE,mBAAmB;QACvC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,gBAAgB,EACd,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY;YACnC,CAAC,CAAC;gBACE;oBACE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;oBACtC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;oBAC7B,QAAQ,EAAE,QAAQ,CAAC,YAAY;oBAC/B,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,mBAAmB;iBAC1D;aACF;YACH,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB;QACnB,QAAQ;QACR,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAC/B,QAAQ,CAAC,YAAY,CAAC,kBAAkB,EACxC,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,CAAC,WAAW,CACxB,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EACvC,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,MAAyE,EACzE,SAAiD;IAEjD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC;QAClD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB;QACnD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB;QAC3D,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;KAC1C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,yBAAyB,CACrD,UAAU,EACV,SAAS,CACV,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC3B,CAAC,CAAC;gBACE,GAAG,QAAQ,CAAC,SAAS;gBACrB,QAAQ,EAAE;oBACR,GAAG,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;oBAC9B;wBACE,cAAc,EACZ,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc;wBACtD,MAAM,EAAE,UAAU;wBAClB,YAAY,EAAE;4BACZ,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM;4BACzC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM;yBACnC;wBACD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;qBAC1C;iBACF;aACF;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAkB,EAClB,YAAiE,EACjE,UAA2E;IAE3E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IACE,KAAK,CAAC,MAAM;QACZ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YAC1D,OAAO,CAAC,aAAa;YACrB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY;iBAC1D,SAAS;gBACV,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;QAE/D,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,IAAI,UAAU,GAAG,4BAA4B,CAAC;QAC5C,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,IAAI,UAAU;QACZ,UAAU,GAAG,4BAA4B,CAAC;YACxC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,sBAAsB,EAAE,UAAU,EAAE;YAC7D,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;IACL,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB;QACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,4CAA4C,CAAC;QAClD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,mBAAmB,CAAC,OAAO;QAClD,UAAU,EAAE,OAAO,CAAC,sBAAsB;QAC1C,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  SigningKeyPair,\n  VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"../groups/organizationGroupDirectory\";\nimport { assertAuthoredPrincipalMutationReceipt } from \"../principalMutations/principalMutationReceipt\";\nimport type { RuntimeCurrentGroupMutationContext } from \"../principalMutations/runtimeCurrentGroupMutation\";\nimport type { PreparedPrincipalContainerRematerializationBatch } from \"../rematerialization/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../rematerialization/principalContainerRematerializationPlanning\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  type PrincipalPolicyReadWriteApi,\n  submitGroupPolicyCommit,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\n\ninterface GroupPolicyChange {\n  readonly context: RuntimeCurrentGroupMutationContext;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly prepareContainerMutations: (\n    nextPolicy: VerifiedPrincipalPolicyCurrent,\n    preceding?: PrincipalRematerializationPredecessor | undefined,\n  ) => Promise<PreparedPrincipalContainerRematerializationBatch>;\n}\n\ninterface CommitInput extends GroupPolicyChange {\n  readonly member?: GroupPolicyChange | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\n/** Commit and retain the group, optional roster enrollment and directory together. */\nexport async function commitCurrentGroupPolicyMutation(\n  input: CommitInput,\n): Promise<PrincipalPolicyMutationResponse> {\n  const { context } = input;\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const [signer] = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [input.signerUserId],\n  });\n  if (!signer) throw new Error(\"Group policy signer is unavailable\");\n  const member = input.member\n    ? await prepareChange(input.member, signer)\n    : null;\n  const { expectedHead, prepared } = await prepareChange(\n    input,\n    signer,\n    member?.preceding,\n  );\n  const organizationRequest = await prepareDirectory(\n    input,\n    expectedHead,\n    member?.expectedHead,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  const response = await submitGroupPolicyCommit({\n    apiClient: input.apiClient,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    request: input.request,\n    organizationRequest,\n    memberRequest: input.member?.request,\n    // A compound retry must rebuild both batches' shared speculative heads.\n    // Refuse the whole transaction if a damaged-key repair needs extra rekeys;\n    // ordinary adds preserve key epochs and need no descendant carry retry.\n    carryDescendantRekeys: member ? undefined : prepared.carry,\n    stillCurrent: context.stillCurrent,\n  });\n  if (!response) throw new Error(\"Group policy update failed\");\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  await assertAuthoredPrincipalMutationReceipt(\n    {\n      groupPolicy: input.request,\n      organizationPolicy: organizationRequest,\n      ...(input.member ? { memberPolicy: input.member.request } : {}),\n    },\n    response,\n  );\n  await context.retainAcknowledged({\n    additionalGroups:\n      input.member && response.memberPolicy\n        ? [\n            {\n              ...input.member.context.groupRetention,\n              request: input.member.request,\n              response: response.memberPolicy,\n              retiredContainerIds: member?.prepared.retiredContainerIds,\n            },\n          ]\n        : [],\n    request: input.request,\n    organizationRequest,\n    response,\n    retiredContainerIds: prepared.retiredContainerIds,\n  });\n  if (member && response.memberPolicy) {\n    await member.prepared.acknowledge(\n      response.memberPolicy.containerMutations,\n      context.stillCurrent,\n    );\n  }\n  await prepared.acknowledge(\n    response.groupPolicy.containerMutations,\n    context.stillCurrent,\n  );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n  return response.groupPolicy;\n}\n\nasync function prepareChange(\n  change: GroupPolicyChange,\n  signer: Awaited<ReturnType<typeof resolveRequiredUserIdentities>>[number],\n  preceding?: PrincipalRematerializationPredecessor,\n) {\n  const expectedHead = await groupPolicyMutationHead(change.request);\n  const nextPolicy = await prepareAuthoredGroupPolicy({\n    verifiedCurrentPolicy: change.context.verifiedCurrentPolicy,\n    expectedHead,\n    request: change.request,\n    signerPublicKeys: [signer],\n    externalAuthority: change.context.externalAuthority,\n    localPolicyCheckpoint: change.context.localPolicyCheckpoint,\n    stillCurrent: change.context.stillCurrent,\n  });\n  const prepared = await change.prepareContainerMutations(\n    nextPolicy,\n    preceding,\n  );\n  change.request.containerMutations = [...prepared.requests];\n  return {\n    expectedHead,\n    prepared,\n    preceding: prepared.preceding\n      ? {\n          ...prepared.preceding,\n          authored: [\n            ...(preceding?.authored ?? []),\n            {\n              organizationId:\n                change.context.organizationDescriptor.organizationId,\n              policy: nextPolicy,\n              dependencies: [\n                change.context.organizationCurrent.policy,\n                change.context.adminCurrent.policy,\n              ],\n              stillCurrent: change.context.stillCurrent,\n            },\n          ],\n        }\n      : undefined,\n  };\n}\n\nasync function prepareDirectory(\n  input: CommitInput,\n  expectedHead: Awaited<ReturnType<typeof groupPolicyMutationHead>>,\n  memberHead: Awaited<ReturnType<typeof groupPolicyMutationHead>> | undefined,\n) {\n  const { context } = input;\n  if (\n    input.member &&\n    (input.member.context.currentPolicy.currentState.principalId !==\n      context.memberGroupId ||\n      input.member.context.organizationCurrent.current.currentState\n        .stateHash !==\n        context.organizationCurrent.current.currentState.stateHash)\n  )\n    throw new Error(\n      \"Roster and group changes must share the same organization policy\",\n    );\n  let groupHeads = replaceOrganizationGroupHead({\n    descriptor: context.organizationDescriptor,\n    nextHead: expectedHead,\n  });\n  if (memberHead)\n    groupHeads = replaceOrganizationGroupHead({\n      descriptor: { ...context.organizationDescriptor, groupHeads },\n      nextHead: memberHead,\n    });\n  const adminProjection = context.isOrganizationAdminsGroup\n    ? input.request.projection\n    : context.adminCurrent.current.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  return buildOrganizationGroupDirectoryPolicyRequest({\n    adminProjection,\n    adminUsers,\n    currentPolicy: context.organizationCurrent.current,\n    descriptor: context.organizationDescriptor,\n    groupHeads,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n"]}

package/workflows/organizations/groupPolicy/currentGroupPolicyMutationContext.js

@@ -0,0 +1,79 @@
+import { serializeKeyingCanonicalJson, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { requireOrganizationGroupHead } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../groupMetadata/currentGroupMetadataAuthority.js";
+import { assertGroupMetadataBinding } from "../groupMetadata/groupMetadataBinding.js";
+import { loadCurrentOrganizationMutationAuthority } from "../principalMutations/currentOrganizationMutationAuthority.js";
+import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
+/** Exact current directory, strict Admins and group evidence for one mutation. */
+export async function loadCurrentGroupPolicyMutationContext(input) {
+    input = { ...input };
+    const { authority, currentOrgAdminUserIds } = await loadCurrentOrganizationMutationAuthority(input);
+    const group = await authority.readGroup(input.groupId);
+    const stillCurrent = () => input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();
+    assertProjectionVerificationCurrent(stillCurrent);
+    assertGroupMetadataBinding(group.current, authority.descriptor);
+    requireSignerCanManageGroup(group.current, currentOrgAdminUserIds, input.signerUserId);
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policies: [...group.dependencies, group.policy],
+        stillCurrent,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const adminHead = requireOrganizationGroupHead(authority.descriptor, authority.descriptor.adminGroupId);
+    const externalAuthority = {
+        currentHead: adminHead,
+        states: [
+            { head: adminHead, projection: authority.admins.policy.projection },
+        ],
+    };
+    // A reused citation keeps the lifetime of the read that produced it.
+    const references = new Map();
+    return {
+        adminGroupId: authority.descriptor.adminGroupId,
+        adminCurrent: authority.admins,
+        currentPolicy: group.current,
+        verifiedCurrentPolicy: group.policy,
+        verifyMetadataContainer: createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent,
+        }),
+        currentOrgAdminUserIds,
+        externalAuthority,
+        isOrganizationAdminsGroup: input.groupId === authority.descriptor.adminGroupId,
+        localPolicyCheckpoint: group.policy.checkpoint,
+        memberGroupId: authority.descriptor.memberGroupId,
+        organizationDescriptor: authority.descriptor,
+        organizationCurrent: authority.directory,
+        async readPredecessorReference(reference) {
+            assertProjectionVerificationCurrent(stillCurrent);
+            const owned = structuredClone(reference);
+            const key = serializeKeyingCanonicalJson({ ...owned });
+            let pending = references.get(key);
+            if (!pending) {
+                // Keep at most one bounded selection's citations, even across many paths.
+                if (references.size === 128) {
+                    const oldest = references.keys().next().value;
+                    if (oldest !== undefined)
+                        references.delete(oldest);
+                }
+                pending = authority.readGroup(input.groupId, owned);
+                references.set(key, pending);
+            }
+            const selected = await pending.catch((error) => {
+                if (references.get(key) === pending)
+                    references.delete(key);
+                throw error;
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            assertProjectionVerificationCurrent(selected.stillCurrent);
+            return selected.policy;
+        },
+        stillCurrent,
+    };
+}
+//# sourceMappingURL=currentGroupPolicyMutationContext.js.map

package/workflows/organizations/groupPolicy/currentGroupPolicyMutationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentGroupPolicyMutationContext.js","sourceRoot":"","sources":["currentGroupPolicyMutationContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,EAAE,mDAAmD,EAAE,MAAM,gDAAgD,CAAC;AACrH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,4DAA4D,CAAC;AACtH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAY3D;IACC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACrB,MAAM,EAAE,SAAS,EAAE,sBAAsB,EAAE,GACzC,MAAM,wCAAwC,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,KAAK,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IAC3E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAChE,2BAA2B,CACzB,KAAK,CAAC,OAAO,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;QAC/C,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,4BAA4B,CAC5C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CAAC,YAAY,CAClC,CAAC;IACF,MAAM,iBAAiB,GAAqC;QAC1D,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;SACpE;KACF,CAAC;IACF,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAMvB,CAAC;IACJ,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,YAAY;QAC/C,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,aAAa,EAAE,KAAK,CAAC,OAAO;QAC5B,qBAAqB,EAAE,KAAK,CAAC,MAAM;QACnC,uBAAuB,EACrB,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC;QACJ,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB,EACvB,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,UAAU,CAAC,YAAY;QACrD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QAC9C,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,aAAa;QACjD,sBAAsB,EAAE,SAAS,CAAC,UAAU;QAC5C,mBAAmB,EAAE,SAAS,CAAC,SAAS;QACxC,KAAK,CAAC,wBAAwB,CAAC,SAAkC;YAC/D,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,IAAI,UAAU,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;oBAC9C,IAAI,MAAM,KAAK,SAAS;wBAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACpD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACtD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;oBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,YAAY;KACb,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type PrincipalPolicyExternalAuthority,\n  type ReferencedPrincipalHead,\n  serializeKeyingCanonicalJson,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { requireOrganizationGroupHead } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { createRuntimePrincipalPolicyCurrentResolver } from \"../../principals/runtimePolicyRecovery\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../groupMetadata/currentGroupMetadataAuthority\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport { loadCurrentOrganizationMutationAuthority } from \"../principalMutations/currentOrganizationMutationAuthority\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\n\n/** Exact current directory, strict Admins and group evidence for one mutation. */\nexport async function loadCurrentGroupPolicyMutationContext(input: {\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly resolveCurrentPolicy: NonNullable<\n    ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>\n  >;\n  readonly recoverPendingPrincipalMutation: (\n    organizationId: string,\n  ) => Promise<void>;\n  readonly stillCurrent: () => boolean;\n}) {\n  input = { ...input };\n  const { authority, currentOrgAdminUserIds } =\n    await loadCurrentOrganizationMutationAuthority(input);\n  const group = await authority.readGroup(input.groupId);\n  const stillCurrent = () =>\n    input.stillCurrent() && authority.stillCurrent() && group.stillCurrent();\n  assertProjectionVerificationCurrent(stillCurrent);\n  assertGroupMetadataBinding(group.current, authority.descriptor);\n  requireSignerCanManageGroup(\n    group.current,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policies: [...group.dependencies, group.policy],\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const adminHead = requireOrganizationGroupHead(\n    authority.descriptor,\n    authority.descriptor.adminGroupId,\n  );\n  const externalAuthority: PrincipalPolicyExternalAuthority = {\n    currentHead: adminHead,\n    states: [\n      { head: adminHead, projection: authority.admins.policy.projection },\n    ],\n  };\n  // A reused citation keeps the lifetime of the read that produced it.\n  const references = new Map<\n    string,\n    Promise<{\n      readonly policy: VerifiedPrincipalPolicyCurrent;\n      readonly stillCurrent: () => boolean;\n    }>\n  >();\n  return {\n    adminGroupId: authority.descriptor.adminGroupId,\n    adminCurrent: authority.admins,\n    currentPolicy: group.current,\n    verifiedCurrentPolicy: group.policy,\n    verifyMetadataContainer:\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup:\n      input.groupId === authority.descriptor.adminGroupId,\n    localPolicyCheckpoint: group.policy.checkpoint,\n    memberGroupId: authority.descriptor.memberGroupId,\n    organizationDescriptor: authority.descriptor,\n    organizationCurrent: authority.directory,\n    async readPredecessorReference(reference: ReferencedPrincipalHead) {\n      assertProjectionVerificationCurrent(stillCurrent);\n      const owned = structuredClone(reference);\n      const key = serializeKeyingCanonicalJson({ ...owned });\n      let pending = references.get(key);\n      if (!pending) {\n        // Keep at most one bounded selection's citations, even across many paths.\n        if (references.size === 128) {\n          const oldest = references.keys().next().value;\n          if (oldest !== undefined) references.delete(oldest);\n        }\n        pending = authority.readGroup(input.groupId, owned);\n        references.set(key, pending);\n      }\n      const selected = await pending.catch((error: unknown) => {\n        if (references.get(key) === pending) references.delete(key);\n        throw error;\n      });\n      assertProjectionVerificationCurrent(stillCurrent);\n      assertProjectionVerificationCurrent(selected.stillCurrent);\n      return selected.policy;\n    },\n    stillCurrent,\n  };\n}\n"]}

package/workflows/organizations/groupPolicy/currentPolicyMutationAcknowledgement.js

@@ -0,0 +1,65 @@
+import { verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrentSuccessor, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../../data/keying/canonicalJson.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { assertPrincipalPolicyCurrentStateMatchesHead } from "./groupPolicyMutationHead.js";
+/** Verify a single authored successor; this neither admits it nor persists a pin. */
+export async function verifyCurrentPolicyMutation(input, acknowledgedState) {
+    const previous = input.verifiedCurrentPolicy;
+    const stillCurrent = input.stillCurrent;
+    const owned = structuredClone({
+        expectedHead: input.expectedHead,
+        request: input.request,
+        signerPublicKeys: input.signerPublicKeys,
+        externalAuthority: input.externalAuthority,
+        localPolicyCheckpoint: input.localPolicyCheckpoint,
+        acknowledgedState,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    const { request, expectedHead } = owned;
+    const state = owned.acknowledgedState ?? {
+        ...request.state,
+        stateHash: expectedHead.stateHash,
+        createdAt: request.state.signedAt,
+    };
+    if (owned.acknowledgedState) {
+        const { createdAt: _createdAt, stateHash, ...responseState } = state;
+        if (stateHash !== expectedHead.stateHash ||
+            canonicalKeyingJsonString(responseState, "stored group policy state") !==
+                canonicalKeyingJsonString(request.state, "authored group policy state"))
+            throw new Error("Group policy state acknowledgement mismatch");
+    }
+    const verified = await verifyPrincipalPolicyCurrentSuccessor({
+        previous,
+        signerPublicKeys: owned.signerPublicKeys,
+        externalAuthority: owned.externalAuthority,
+        current: {
+            currentState: state,
+            currentProjection: request.projection,
+            currentGrants: request.grants,
+            currentPayload: {
+                ...request.encryptedPayload,
+                principalId: state.principalId,
+                principalType: state.principalType,
+                stateHash: state.stateHash,
+            },
+            currentMemberEnvelopes: {
+                envelopes: request.memberEnvelopes,
+                principalId: state.principalId,
+                principalType: state.principalType,
+                stateHash: state.stateHash,
+                epoch: state.keyEpoch,
+            },
+        },
+    });
+    if (!verified.ok)
+        throw verified.error;
+    assertPrincipalPolicyCurrentStateMatchesHead(verified.value.state, expectedHead);
+    verifyPrincipalPolicyCheckpoint({
+        chain: verified.value.retainedHistory,
+        currentState: verified.value.state,
+        localCheckpoint: owned.localPolicyCheckpoint,
+    });
+    assertProjectionVerificationCurrent(stillCurrent);
+    return verified.value;
+}
+//# sourceMappingURL=currentPolicyMutationAcknowledgement.js.map

package/workflows/organizations/groupPolicy/currentPolicyMutationAcknowledgement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentPolicyMutationAcknowledgement.js","sourceRoot":"","sources":["currentPolicyMutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,4CAA4C,EAAE,MAAM,2BAA2B,CAAC;AAazF,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAiC,EACjC,iBAA0C;IAE1C,MAAM,QAAQ,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,iBAAiB;KAClB,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,IAAI;QACvC,GAAG,OAAO,CAAC,KAAK;QAChB,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;KAClC,CAAC;IACF,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC;QACrE,IACE,SAAS,KAAK,YAAY,CAAC,SAAS;YACpC,yBAAyB,CAAC,aAAa,EAAE,2BAA2B,CAAC;gBACnE,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,6BAA6B,CAAC;YAEzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAAC;QAC3D,QAAQ;QACR,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE;YACP,YAAY,EAAE,KAAK;YACnB,iBAAiB,EAAE,OAAO,CAAC,UAAU;YACrC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,cAAc,EAAE;gBACd,GAAG,OAAO,CAAC,gBAAgB;gBAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;YACD,sBAAsB,EAAE;gBACtB,SAAS,EAAE,OAAO,CAAC,eAAe;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,QAAQ;aACtB;SACF;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,4CAA4C,CAC1C,QAAQ,CAAC,KAAK,CAAC,KAAK,EACpB,YAAY,CACb,CAAC;IACF,+BAA+B,CAAC;QAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;QACrC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;QAClC,eAAe,EAAE,KAAK,CAAC,qBAAqB;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC","sourcesContent":["import {\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrentSuccessor,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalStateResponse } from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../../data/keying/canonicalJson\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { assertPrincipalPolicyCurrentStateMatchesHead } from \"./groupPolicyMutationHead\";\n\nexport interface CurrentPolicyMutationInput {\n  readonly currentPolicy?: never;\n  readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly stillCurrent: () => boolean;\n}\n\n/** Verify a single authored successor; this neither admits it nor persists a pin. */\nexport async function verifyCurrentPolicyMutation(\n  input: CurrentPolicyMutationInput,\n  acknowledgedState?: PrincipalStateResponse,\n): Promise<VerifiedPrincipalPolicyCurrent> {\n  const previous = input.verifiedCurrentPolicy;\n  const stillCurrent = input.stillCurrent;\n  const owned = structuredClone({\n    expectedHead: input.expectedHead,\n    request: input.request,\n    signerPublicKeys: input.signerPublicKeys,\n    externalAuthority: input.externalAuthority,\n    localPolicyCheckpoint: input.localPolicyCheckpoint,\n    acknowledgedState,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const { request, expectedHead } = owned;\n  const state = owned.acknowledgedState ?? {\n    ...request.state,\n    stateHash: expectedHead.stateHash,\n    createdAt: request.state.signedAt,\n  };\n  if (owned.acknowledgedState) {\n    const { createdAt: _createdAt, stateHash, ...responseState } = state;\n    if (\n      stateHash !== expectedHead.stateHash ||\n      canonicalKeyingJsonString(responseState, \"stored group policy state\") !==\n        canonicalKeyingJsonString(request.state, \"authored group policy state\")\n    )\n      throw new Error(\"Group policy state acknowledgement mismatch\");\n  }\n  const verified = await verifyPrincipalPolicyCurrentSuccessor({\n    previous,\n    signerPublicKeys: owned.signerPublicKeys,\n    externalAuthority: owned.externalAuthority,\n    current: {\n      currentState: state,\n      currentProjection: request.projection,\n      currentGrants: request.grants,\n      currentPayload: {\n        ...request.encryptedPayload,\n        principalId: state.principalId,\n        principalType: state.principalType,\n        stateHash: state.stateHash,\n      },\n      currentMemberEnvelopes: {\n        envelopes: request.memberEnvelopes,\n        principalId: state.principalId,\n        principalType: state.principalType,\n        stateHash: state.stateHash,\n        epoch: state.keyEpoch,\n      },\n    },\n  });\n  if (!verified.ok) throw verified.error;\n  assertPrincipalPolicyCurrentStateMatchesHead(\n    verified.value.state,\n    expectedHead,\n  );\n  verifyPrincipalPolicyCheckpoint({\n    chain: verified.value.retainedHistory,\n    currentState: verified.value.state,\n    localCheckpoint: owned.localPolicyCheckpoint,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return verified.value;\n}\n"]}

package/workflows/organizations/groupPolicy/groupPolicyMutationAcknowledgement.js

@@ -0,0 +1,174 @@
+import { computePrincipalContainerGrantRoot, computePrincipalMemberEnvelopesRoot, computePrincipalMembershipRoot, computePrincipalProjectionRoot, computePrincipalStatePayloadCiphertextHash, makeVerifiedPrincipalPolicy, normalizePrincipalProjectionMembers, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../../data/keying/canonicalJson.js";
+import { assertPrincipalPolicyReceiptArtifacts } from "../principalPolicy/principalPolicyReceiptArtifacts.js";
+import { verifyCurrentPolicyMutation, } from "./currentPolicyMutationAcknowledgement.js";
+export { assertGroupPolicyEnvelopesMatchAcknowledgement } from "../principalPolicy/principalPolicyReceiptArtifacts.js";
+function historyWithCurrent(bundle) {
+    return [
+        ...bundle.previousStates,
+        {
+            state: bundle.currentState,
+            projection: bundle.currentProjection,
+            grants: bundle.currentGrants,
+        },
+    ];
+}
+function isAuthoredSuccessorConsistent(state, expectedHead, previous) {
+    return (state.principalType === expectedHead.principalType &&
+        state.principalId === expectedHead.principalId &&
+        state.version === expectedHead.version &&
+        state.keyEpoch === expectedHead.keyEpoch &&
+        state.keyFingerprint === expectedHead.keyFingerprint &&
+        state.principalType === previous.principalType &&
+        state.principalId === previous.principalId &&
+        state.version === previous.version + 1 &&
+        state.prevStateHash === previous.stateHash);
+}
+export function buildAcknowledgedGroupPolicyBundle(input) {
+    assertPrincipalPolicyReceiptArtifacts(input);
+    return {
+        ...input.response,
+        previousStates: historyWithCurrent(input.currentPolicy),
+    };
+}
+async function assertPolicyRequestCommitments(request) {
+    const projection = normalizePrincipalProjectionMembers(request.projection);
+    const members = projection.map((member) => ({ userId: member.userId }));
+    const [membershipRoot, memberEnvelopesRoot, projectionRoot, payloadCiphertextHash, grantRoot,] = await Promise.all([
+        computePrincipalMembershipRoot(members),
+        computePrincipalMemberEnvelopesRoot(request.memberEnvelopes),
+        computePrincipalProjectionRoot(projection),
+        computePrincipalStatePayloadCiphertextHash(request.encryptedPayload.ciphertext),
+        computePrincipalContainerGrantRoot(request.grants),
+    ]);
+    if (request.state.membershipRoot !== membershipRoot ||
+        request.state.memberEnvelopesRoot !== memberEnvelopesRoot ||
+        request.state.projectionRoot !== projectionRoot ||
+        request.state.memberCount !== projection.length ||
+        request.state.grantRoot !== grantRoot ||
+        request.state.grantCount !== request.grants.length ||
+        request.encryptedPayload.ciphertextHash !== payloadCiphertextHash ||
+        request.state.payloadCiphertextHash !== payloadCiphertextHash) {
+        throw new Error("Authored group policy commitments are invalid");
+    }
+}
+function verifiedPolicy(input) {
+    const previousStates = input.currentPolicy
+        ? historyWithCurrent(input.currentPolicy)
+        : [];
+    return makeVerifiedPrincipalPolicy({
+        checkpoint: {
+            principalId: input.state.principalId,
+            principalType: input.state.principalType,
+            stateHash: input.state.stateHash,
+            version: input.state.version,
+        },
+        history: [
+            ...previousStates,
+            {
+                state: input.state,
+                projection: input.projection,
+                grants: input.grants,
+            },
+        ],
+        keyEpoch: input.state.keyEpoch,
+        principalId: input.state.principalId,
+        principalType: input.state.principalType,
+        projection: input.projection,
+        grants: input.grants,
+        state: input.state,
+        stateHash: input.state.stateHash,
+        version: input.state.version,
+    });
+}
+export async function acknowledgeGroupPolicyState(input) {
+    if (input.verifiedCurrentPolicy !== undefined)
+        return verifyCurrentPolicyMutation(input, input.response);
+    await assertPolicyRequestCommitments(input.request);
+    const { createdAt: _createdAt, stateHash, ...responseState } = input.response;
+    const previous = input.currentPolicy.currentState;
+    if (stateHash !== input.expectedHead.stateHash ||
+        !isAuthoredSuccessorConsistent(input.response, input.expectedHead, previous) ||
+        canonicalKeyingJsonString(responseState, "stored group policy state") !==
+            canonicalKeyingJsonString(input.request.state, "authored group policy state")) {
+        throw new Error("Group policy state acknowledgement mismatch");
+    }
+    return verifiedPolicy({
+        currentPolicy: input.currentPolicy,
+        projection: input.request.projection,
+        grants: input.request.grants,
+        state: input.response,
+    });
+}
+export async function prepareAuthoredGroupPolicy(input) {
+    if (input.verifiedCurrentPolicy !== undefined)
+        return verifyCurrentPolicyMutation(input);
+    await assertPolicyRequestCommitments(input.request);
+    const previous = input.currentPolicy.currentState;
+    const state = input.request.state;
+    if (!isAuthoredSuccessorConsistent(state, input.expectedHead, previous)) {
+        throw new Error("Authored group policy successor is inconsistent");
+    }
+    return verifiedPolicy({
+        currentPolicy: input.currentPolicy,
+        projection: input.request.projection,
+        grants: input.request.grants,
+        state: {
+            ...state,
+            stateHash: input.expectedHead.stateHash,
+            createdAt: state.signedAt,
+        },
+    });
+}
+export async function acknowledgeInitialGroupPolicy(input) {
+    await assertPolicyRequestCommitments(input.request.initialGroupPolicy);
+    const state = input.request.initialGroupPolicy.state;
+    if (input.response.groupId !== input.request.groupId ||
+        input.response.organizationId !== input.organizationId ||
+        input.response.isBuiltin ||
+        input.response.currentState?.stateHash !== input.stateHash ||
+        input.response.currentState.version !== state.version ||
+        input.response.currentState.keyEpoch !== state.keyEpoch ||
+        input.response.currentState.keyFingerprint !== state.keyFingerprint ||
+        input.response.currentState.memberCount !== state.memberCount ||
+        state.principalType !== "group" ||
+        state.principalId !== input.request.groupId ||
+        state.version !== 1 ||
+        state.prevStateHash !== null) {
+        throw new Error("Created group policy acknowledgement mismatch");
+    }
+    const storedState = {
+        ...state,
+        createdAt: input.response.createdAt,
+        stateHash: input.stateHash,
+    };
+    const bundle = {
+        currentMemberEnvelopes: {
+            envelopes: input.request.initialGroupPolicy.memberEnvelopes,
+            epoch: state.keyEpoch,
+            principalId: state.principalId,
+            principalType: state.principalType,
+            stateHash: input.stateHash,
+        },
+        currentPayload: {
+            principalId: state.principalId,
+            principalType: state.principalType,
+            stateHash: input.stateHash,
+            ...input.request.initialGroupPolicy.encryptedPayload,
+            createdAt: input.response.createdAt,
+        },
+        currentProjection: input.request.initialGroupPolicy.projection,
+        currentGrants: input.request.initialGroupPolicy.grants,
+        currentState: storedState,
+        previousStates: [],
+    };
+    return {
+        bundle,
+        policy: verifiedPolicy({
+            projection: input.request.initialGroupPolicy.projection,
+            grants: input.request.initialGroupPolicy.grants,
+            state: storedState,
+        }),
+    };
+}
+//# sourceMappingURL=groupPolicyMutationAcknowledgement.js.map

package/workflows/organizations/groupPolicy/groupPolicyMutationAcknowledgement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyMutationAcknowledgement.js","sourceRoot":"","sources":["groupPolicyMutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,0CAA0C,EAC1C,2BAA2B,EAC3B,mCAAmC,GAIpC,MAAM,mBAAmB,CAAC;AAW3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAC3G,OAAO,EAEL,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,8CAA8C,EAAE,MAAM,oDAAoD,CAAC;AAEpH,SAAS,kBAAkB,CACzB,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,KAQC,EACD,YAAqC,EACrC,QAAgC;IAEhC,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QAClD,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC9C,KAAK,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO;QACtC,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QACxC,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc;QACpD,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC9C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC1C,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,GAAG,CAAC;QACtC,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,SAAS,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,cAAc,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAkC;IAElC,MAAM,UAAU,GAAG,mCAAmC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,CACJ,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACV,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,8BAA8B,CAAC,OAAO,CAAC;QACvC,mCAAmC,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,8BAA8B,CAAC,UAAU,CAAC;QAC1C,0CAA0C,CACxC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CACpC;QACD,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC;KACnD,CAAC,CAAC;IACH,IACE,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,mBAAmB;QACzD,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM;QAC/C,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;QACrC,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM;QAClD,OAAO,CAAC,gBAAgB,CAAC,cAAc,KAAK,qBAAqB;QACjE,OAAO,CAAC,KAAK,CAAC,qBAAqB,KAAK,qBAAqB,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa;QACxC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,2BAA2B,CAAC;QACjC,UAAU,EAAE;YACV,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B;QACD,OAAO,EAAE;YACP,GAAG,cAAc;YACjB;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;KAC7B,CAAC,CAAC;AACL,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAEC;IAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,IACE,SAAS,KAAK,KAAK,CAAC,YAAY,CAAC,SAAS;QAC1C,CAAC,6BAA6B,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,QAAQ,CACT;QACD,yBAAyB,CAAC,aAAa,EAAE,2BAA2B,CAAC;YACnE,yBAAyB,CACvB,KAAK,CAAC,OAAO,CAAC,KAAK,EACnB,6BAA6B,CAC9B,EACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE,KAAK,CAAC,QAAQ;KACtB,CAAC,CAAC;AACL,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA2D;IAE3D,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE;YACL,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;YACvC,SAAS,EAAE,KAAK,CAAC,QAAQ;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IAIC,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACrD,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAChD,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACtD,KAAK,CAAC,QAAQ,CAAC,SAAS;QACxB,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,KAAK,KAAK,CAAC,SAAS;QAC1D,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACrD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACvD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACnE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAC7D,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAC3C,KAAK,CAAC,OAAO,KAAK,CAAC;QACnB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,GAAG,KAAK;QACR,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,MAAM,GAAkC;QAC5C,sBAAsB,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe;YAC3D,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,cAAc,EAAE;YACd,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB;YACpD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;SACpC;QACD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;QAC9D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;QACtD,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,EAAE;KACnB,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM,EAAE,cAAc,CAAC;YACrB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;YACvD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;YAC/C,KAAK,EAAE,WAAW;SACnB,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  computePrincipalContainerGrantRoot,\n  computePrincipalMemberEnvelopesRoot,\n  computePrincipalMembershipRoot,\n  computePrincipalProjectionRoot,\n  computePrincipalStatePayloadCiphertextHash,\n  makeVerifiedPrincipalPolicy,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type {\n  CreateOrganizationGroupRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationGroupSummaryResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n  PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../../data/keying/canonicalJson\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"../principalPolicy/principalPolicyReceiptArtifacts\";\nimport {\n  type CurrentPolicyMutationInput,\n  verifyCurrentPolicyMutation,\n} from \"./currentPolicyMutationAcknowledgement\";\n\nexport { assertGroupPolicyEnvelopesMatchAcknowledgement } from \"../principalPolicy/principalPolicyReceiptArtifacts\";\n\nfunction historyWithCurrent(\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"previousStates\"] {\n  return [\n    ...bundle.previousStates,\n    {\n      state: bundle.currentState,\n      projection: bundle.currentProjection,\n      grants: bundle.currentGrants,\n    },\n  ];\n}\n\nfunction isAuthoredSuccessorConsistent(\n  state: Pick<\n    PrincipalStateResponse,\n    | \"keyEpoch\"\n    | \"keyFingerprint\"\n    | \"prevStateHash\"\n    | \"principalId\"\n    | \"principalType\"\n    | \"version\"\n  >,\n  expectedHead: ReferencedPrincipalHead,\n  previous: PrincipalStateResponse,\n): boolean {\n  return (\n    state.principalType === expectedHead.principalType &&\n    state.principalId === expectedHead.principalId &&\n    state.version === expectedHead.version &&\n    state.keyEpoch === expectedHead.keyEpoch &&\n    state.keyFingerprint === expectedHead.keyFingerprint &&\n    state.principalType === previous.principalType &&\n    state.principalId === previous.principalId &&\n    state.version === previous.version + 1 &&\n    state.prevStateHash === previous.stateHash\n  );\n}\n\nexport function buildAcknowledgedGroupPolicyBundle(input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly response: PrincipalPolicyMutationResponse;\n}): PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse {\n  assertPrincipalPolicyReceiptArtifacts(input);\n  return {\n    ...input.response,\n    previousStates: historyWithCurrent(input.currentPolicy),\n  };\n}\n\nasync function assertPolicyRequestCommitments(\n  request: PutPrincipalPolicyRequest,\n): Promise<void> {\n  const projection = normalizePrincipalProjectionMembers(request.projection);\n  const members = projection.map((member) => ({ userId: member.userId }));\n  const [\n    membershipRoot,\n    memberEnvelopesRoot,\n    projectionRoot,\n    payloadCiphertextHash,\n    grantRoot,\n  ] = await Promise.all([\n    computePrincipalMembershipRoot(members),\n    computePrincipalMemberEnvelopesRoot(request.memberEnvelopes),\n    computePrincipalProjectionRoot(projection),\n    computePrincipalStatePayloadCiphertextHash(\n      request.encryptedPayload.ciphertext,\n    ),\n    computePrincipalContainerGrantRoot(request.grants),\n  ]);\n  if (\n    request.state.membershipRoot !== membershipRoot ||\n    request.state.memberEnvelopesRoot !== memberEnvelopesRoot ||\n    request.state.projectionRoot !== projectionRoot ||\n    request.state.memberCount !== projection.length ||\n    request.state.grantRoot !== grantRoot ||\n    request.state.grantCount !== request.grants.length ||\n    request.encryptedPayload.ciphertextHash !== payloadCiphertextHash ||\n    request.state.payloadCiphertextHash !== payloadCiphertextHash\n  ) {\n    throw new Error(\"Authored group policy commitments are invalid\");\n  }\n}\n\nfunction verifiedPolicy(input: {\n  currentPolicy?: PrincipalPolicyBundleResponse | undefined;\n  projection: PutPrincipalPolicyRequest[\"projection\"];\n  grants: PutPrincipalPolicyRequest[\"grants\"];\n  state: PrincipalStateResponse;\n}): VerifiedPrincipalPolicy {\n  const previousStates = input.currentPolicy\n    ? historyWithCurrent(input.currentPolicy)\n    : [];\n  return makeVerifiedPrincipalPolicy({\n    checkpoint: {\n      principalId: input.state.principalId,\n      principalType: input.state.principalType,\n      stateHash: input.state.stateHash,\n      version: input.state.version,\n    },\n    history: [\n      ...previousStates,\n      {\n        state: input.state,\n        projection: input.projection,\n        grants: input.grants,\n      },\n    ],\n    keyEpoch: input.state.keyEpoch,\n    principalId: input.state.principalId,\n    principalType: input.state.principalType,\n    projection: input.projection,\n    grants: input.grants,\n    state: input.state,\n    stateHash: input.state.stateHash,\n    version: input.state.version,\n  });\n}\n\ninterface FullPolicyMutationInput {\n  readonly verifiedCurrentPolicy?: never;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n}\n\nexport function acknowledgeGroupPolicyState(\n  input: CurrentPolicyMutationInput & {\n    readonly response: PrincipalStateResponse;\n  },\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function acknowledgeGroupPolicyState(\n  input: FullPolicyMutationInput & {\n    readonly response: PrincipalStateResponse;\n  },\n): Promise<VerifiedPrincipalPolicy>;\nexport async function acknowledgeGroupPolicyState(\n  input: (FullPolicyMutationInput | CurrentPolicyMutationInput) & {\n    readonly response: PrincipalStateResponse;\n  },\n): Promise<VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent> {\n  if (input.verifiedCurrentPolicy !== undefined)\n    return verifyCurrentPolicyMutation(input, input.response);\n  await assertPolicyRequestCommitments(input.request);\n  const { createdAt: _createdAt, stateHash, ...responseState } = input.response;\n  const previous = input.currentPolicy.currentState;\n  if (\n    stateHash !== input.expectedHead.stateHash ||\n    !isAuthoredSuccessorConsistent(\n      input.response,\n      input.expectedHead,\n      previous,\n    ) ||\n    canonicalKeyingJsonString(responseState, \"stored group policy state\") !==\n      canonicalKeyingJsonString(\n        input.request.state,\n        \"authored group policy state\",\n      )\n  ) {\n    throw new Error(\"Group policy state acknowledgement mismatch\");\n  }\n  return verifiedPolicy({\n    currentPolicy: input.currentPolicy,\n    projection: input.request.projection,\n    grants: input.request.grants,\n    state: input.response,\n  });\n}\n\n/**\n * Materialize the locally signed successor before submission so dependent\n * container mutations can wrap to the exact head that will commit with it.\n * The server still performs the authoritative signature, transition, and\n * authorization checks inside the combined transaction.\n */\nexport function prepareAuthoredGroupPolicy(\n  input: CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function prepareAuthoredGroupPolicy(\n  input: FullPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy>;\nexport async function prepareAuthoredGroupPolicy(\n  input: FullPolicyMutationInput | CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy | VerifiedPrincipalPolicyCurrent> {\n  if (input.verifiedCurrentPolicy !== undefined)\n    return verifyCurrentPolicyMutation(input);\n  await assertPolicyRequestCommitments(input.request);\n  const previous = input.currentPolicy.currentState;\n  const state = input.request.state;\n  if (!isAuthoredSuccessorConsistent(state, input.expectedHead, previous)) {\n    throw new Error(\"Authored group policy successor is inconsistent\");\n  }\n  return verifiedPolicy({\n    currentPolicy: input.currentPolicy,\n    projection: input.request.projection,\n    grants: input.request.grants,\n    state: {\n      ...state,\n      stateHash: input.expectedHead.stateHash,\n      createdAt: state.signedAt,\n    },\n  });\n}\n\nexport async function acknowledgeInitialGroupPolicy(input: {\n  readonly organizationId: string;\n  readonly request: CreateOrganizationGroupRequest;\n  readonly response: OrganizationGroupSummaryResponse;\n  readonly stateHash: string;\n}): Promise<{\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}> {\n  await assertPolicyRequestCommitments(input.request.initialGroupPolicy);\n  const state = input.request.initialGroupPolicy.state;\n  if (\n    input.response.groupId !== input.request.groupId ||\n    input.response.organizationId !== input.organizationId ||\n    input.response.isBuiltin ||\n    input.response.currentState?.stateHash !== input.stateHash ||\n    input.response.currentState.version !== state.version ||\n    input.response.currentState.keyEpoch !== state.keyEpoch ||\n    input.response.currentState.keyFingerprint !== state.keyFingerprint ||\n    input.response.currentState.memberCount !== state.memberCount ||\n    state.principalType !== \"group\" ||\n    state.principalId !== input.request.groupId ||\n    state.version !== 1 ||\n    state.prevStateHash !== null\n  ) {\n    throw new Error(\"Created group policy acknowledgement mismatch\");\n  }\n  const storedState = {\n    ...state,\n    createdAt: input.response.createdAt,\n    stateHash: input.stateHash,\n  };\n  const bundle: PrincipalPolicyBundleResponse = {\n    currentMemberEnvelopes: {\n      envelopes: input.request.initialGroupPolicy.memberEnvelopes,\n      epoch: state.keyEpoch,\n      principalId: state.principalId,\n      principalType: state.principalType,\n      stateHash: input.stateHash,\n    },\n    currentPayload: {\n      principalId: state.principalId,\n      principalType: state.principalType,\n      stateHash: input.stateHash,\n      ...input.request.initialGroupPolicy.encryptedPayload,\n      createdAt: input.response.createdAt,\n    },\n    currentProjection: input.request.initialGroupPolicy.projection,\n    currentGrants: input.request.initialGroupPolicy.grants,\n    currentState: storedState,\n    previousStates: [],\n  };\n  return {\n    bundle,\n    policy: verifiedPolicy({\n      projection: input.request.initialGroupPolicy.projection,\n      grants: input.request.initialGroupPolicy.grants,\n      state: storedState,\n    }),\n  };\n}\n"]}

package/workflows/organizations/groupPolicy/groupPolicyMutationContext.d.ts

@@ -0,0 +1,58 @@
+import type { PrincipalPolicyCheckpoint, PrincipalPolicyExternalAuthority, ReferencedPrincipalHead, SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { ContainerMutationRequest, PutPrincipalPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { CurrentPrincipalMemberEnvelopesResponse, PrincipalPolicyBundleResponse, PrincipalPolicyMutationResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import { type VerifiedExternalAdminPolicy } from "../../principals/externalAdminPolicy.js";
+import type { PrincipalPolicyReadApi, PrincipalPolicyReadWriteApi } from "../principalPolicy/principalPolicyApi.js";
+import type { FullGroupMembershipMutationInput } from "./groupPolicyMutationEvidence.js";
+export type { OrganizationPrincipalPolicyApi, PrincipalPolicyReadApi, PrincipalPolicyReadWriteApi, } from "../principalPolicy/principalPolicyApi.js";
+export { submitGroupPolicyCommit } from "./submitGroupPolicyCommit.js";
+interface LoadedGroupPolicyMutationContext extends FullGroupMembershipMutationInput {
+    readonly adminGroupId: string;
+    readonly adminPolicyBundle: PrincipalPolicyBundleResponse;
+    readonly currentOrgAdminUserIds: readonly string[];
+    readonly organizationDescriptor: VerifiedExternalAdminPolicy["descriptor"];
+    readonly organizationPolicyBundle: PrincipalPolicyBundleResponse;
+    readonly memberGroupId: string;
+}
+export declare function cacheGroupPolicy(input: {
+    readonly acknowledgedMemberEnvelopes?: CurrentPrincipalMemberEnvelopesResponse | undefined;
+    readonly apiClient: PrincipalPolicyReadApi;
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
+    readonly execSql: ExecSql;
+    readonly expectedCurrentHead?: ReferencedPrincipalHead | undefined;
+    readonly groupId: string;
+    readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;
+    readonly organizationId: string;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<PrincipalPolicyBundleResponse>;
+export declare function loadGroupPolicyMutationContext(input: {
+    readonly apiClient: PrincipalPolicyReadApi;
+    readonly execSql: ExecSql;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<LoadedGroupPolicyMutationContext>;
+export declare function commitGroupPolicyMutation(input: {
+    readonly retiredContainerIds?: (() => readonly string[]) | undefined;
+    readonly apiClient: PrincipalPolicyReadWriteApi;
+    readonly currentPolicy: PrincipalPolicyBundleResponse;
+    readonly execSql: ExecSql;
+    readonly expectedHead: ReferencedPrincipalHead;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly organizationPolicy: PrincipalPolicyBundleResponse;
+    readonly organizationRequest: PutPrincipalPolicyRequest;
+    /**
+     * Re-sign the batch with the descendant rekeys a refusal named woven in; the
+     * result replaces `containerMutations` and the commit is retried once.
+     */
+    readonly carryDescendantRekeys?: ((requiredContainerIds: readonly string[]) => Promise<readonly ContainerMutationRequest[]>) | undefined;
+    readonly request: PutPrincipalPolicyRequest;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse>;