@tearleads/client-sdk 0.1.75 → 0.1.77

package/workflows/containers/child/share/sharePrincipalPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sharePrincipalPolicy.js","sourceRoot":"","sources":["sharePrincipalPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mFAAmF,CAAC;AACvI,OAAO,EAAE,6BAA6B,EAAE,MAAM,4EAA4E,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AACpH,OAAO,EAAE,qCAAqC,EAAE,MAAM,kFAAkF,CAAC;AACzI,OAAO,EAAE,mCAAmC,EAAE,MAAM,0FAA0F,CAAC;AAC/I,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sCAAsC,GAEvC,MAAM,wCAAwC,CAAC;AA2BhD,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,qCAAqC,CACvD,KAAK,CAAC,kBAAkB,CACzB,EAAE,CAAC;YACF,MAAM,mCAAmC,CAAC;gBACxC,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACxB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,QAGC,EACD,YAA0C;IAE1C,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;QACrC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,CAAC,cAAc,EACvB,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAqC,EACrC,OAAe;IAEf,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC7C,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,iDAAiD,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;YAChD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,qCAAqC,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,eAAe,CACtB;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CACxD,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,iBAAiB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,uBAAuB;IACtE,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAe3D;IACC,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,uBAAuB,CAAC,UAAU,EAClC,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,KAAK;QACR,iBAAiB,EAAE,kBAAkB;QACrC,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,kBAAkB;QACrC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAChC,uBAAuB,CAAC,iBAAiB;QAC3C,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,oBAAoB,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,uBAAuB;QAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,kBAAkB;QAClB,iBAAiB,EAAE,qCAAqC,CACtD,uBAAuB,CACxB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerShareApi } from \"../../../../data/containers/shared/types\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../../data/keyingProjectionVerification/error\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../../data/persistence/principalPolicy/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../../data/trustedUserIdentity\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport type { CurrentPrincipalPolicyReader } from \"../../../principals/currentPrincipalPolicyReader\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../../principals/externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../../principals/policyVerification\";\n\nexport interface ContainerManagedPrincipalShareApi\n  extends ContainerShareApi,\n    CurrentPrincipalPolicyReader,\n    Pick<\n      ApiClient,\n      \"evictContainerWriterProjection\" | \"getContainerWriterProjectionResult\"\n    > {\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n}\n\nexport interface VerifiedSharePrincipalPolicy {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nasync function retainVerifiedSharePolicies(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  execSql: ExecSql;\n  organizationId: string;\n  organizationPolicy: VerifiedExternalAdminPolicy | null;\n  policy: VerifiedPrincipalPolicy;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const retainedAt = new Date().toISOString();\n  if (input.organizationPolicy) {\n    for (const entry of externalAdminPolicyPersistenceEntries(\n      input.organizationPolicy,\n    )) {\n      await retainVerifiedPrincipalPolicyBundle({\n        ...entry,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        stillCurrent: input.stillCurrent,\n        updatedAt: retainedAt,\n      });\n    }\n  }\n  await retainVerifiedPrincipalPolicyBundle({\n    bundle: input.bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policy: input.policy,\n    stillCurrent: input.stillCurrent,\n    updatedAt: retainedAt,\n  });\n  return [\n    ...(input.organizationPolicy\n      ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map(\n          (entry) => entry.policy,\n        )\n      : []),\n    input.policy,\n  ];\n}\n\n/**\n * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call\n * deferred: advances the keying checkpoints for the verified policies and\n * caches the dependency bundles they were verified against.\n */\nexport async function advanceVerifiedSharePolicies(\n  execSql: ExecSql,\n  verified: Pick<\n    VerifiedSharePrincipalPolicy,\n    \"checkpointPolicies\" | \"dependencyBundles\" | \"organizationId\"\n  >,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql,\n    organizationId: verified.organizationId,\n    policies: verified.checkpointPolicies,\n    stillCurrent,\n  });\n  if (stillCurrent?.() === false) return;\n  for (const bundle of verified.dependencyBundles) {\n    await savePrincipalPolicyBundle(\n      execSql,\n      bundle,\n      new Date().toISOString(),\n      verified.organizationId,\n      { stillCurrent },\n    );\n    if (stillCurrent?.() === false) return;\n  }\n}\n\nfunction assertGroupPolicyTarget(\n  bundle: PrincipalPolicyBundleResponse,\n  groupId: string,\n): void {\n  if (\n    bundle.currentState.principalType !== \"group\" ||\n    bundle.currentState.principalId !== groupId\n  ) {\n    throw new Error(\"Container share principal policy target mismatch\");\n  }\n}\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"principal policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"principal policy signer key could not be loaded\";\n  }\n}\n\nasync function loadGroupSharePolicyBundle(input: {\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  groupId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<PrincipalPolicyBundleResponse> {\n  if (\n    input.expectedGroupHead &&\n    (input.expectedGroupHead.principalType !== \"group\" ||\n      input.expectedGroupHead.principalId !== input.groupId)\n  ) {\n    throw new Error(\"Container share expected group policy target mismatch\");\n  }\n  const bundleFromCache = input.expectedGroupHead\n    ? await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        input.expectedGroupHead,\n        input.localCheckpoint,\n      )\n    : null;\n  let bundle = bundleFromCache;\n  bundle ??= await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n  if (!bundle) {\n    throw new Error(\"Container share principal policy could not be loaded\");\n  }\n  assertGroupPolicyTarget(bundle, input.groupId);\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedGroupHead,\n    )\n  ) {\n    throw new Error(\n      \"Container share group policy does not match the signed organization directory\",\n    );\n  }\n  return bundle;\n}\n\n/**\n * The chosen group label does not match the name in the group's verified\n * policy. A KeyingVerificationError (so it is reported as an incident), with\n * its own class so a caller can tell this refusal from every other\n * `object_mismatch` and say what happened.\n */\nexport class GroupShareNameMismatchError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"object_mismatch\", message);\n    this.name = \"GroupShareNameMismatchError\";\n  }\n}\n\n/**\n * The share picker labels groups from the organization read model, which a\n * compromised server can relabel, so the name the user chose must equal the\n * name committed in the target's verified policy. Names compare by their\n * canonical key so look-alike spellings count as the same name. Uniqueness of\n * signed names within an organization is enforced where names enter — group\n * creation verifies every group in the signed directory — so a single\n * verified match identifies the group.\n */\nasync function assertShareGroupName(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  bundle: PrincipalPolicyBundleResponse;\n  expectedGroupName: string;\n}): Promise<void> {\n  // The label comes from the untrusted read model. Signed names never carry\n  // an invisible code point, so a label that does is a look-alike that would\n  // only match after canonicalization strips it; refuse it outright.\n  const mismatch = await groupPolicyNameMismatch(\n    input.bundle,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  if (mismatch === \"forbidden_characters\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name contains control or format characters\",\n    );\n  }\n  if (mismatch === \"name_mismatch\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  }\n}\n\nexport async function loadVerifiedGroupSharePrincipalPolicy(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  /**\n   * The display name the user chose the group by. The read model that labels\n   * groups is a server projection; only the name committed in the signed\n   * group payload can confirm the share lands on the group the user saw.\n   */\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedSharePrincipalPolicy> {\n  const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!organizationAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const committedGroupHead = requireOrganizationGroupHead(\n    organizationAdminPolicy.descriptor,\n    input.groupId,\n  );\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)\n  ) {\n    throw new Error(\n      \"Container share expected group head conflicts with the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.groupId,\n  );\n  const bundle = await loadGroupSharePolicyBundle({\n    ...input,\n    expectedGroupHead: committedGroupHead,\n    localCheckpoint,\n  });\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: committedGroupHead,\n      loadExternalAuthority: async () =>\n        organizationAdminPolicy.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Container share principal policy verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);\n  if (input.expectedGroupName !== undefined) {\n    await assertShareGroupName({\n      readEncryptedName: input.readEncryptedName,\n      bundle,\n      expectedGroupName: input.expectedGroupName,\n    });\n  }\n\n  const checkpointPolicies = await retainVerifiedSharePolicies({\n    bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    organizationPolicy: organizationAdminPolicy,\n    policy: verified.value,\n    stillCurrent: input.stillCurrent,\n  });\n  return {\n    bundle,\n    checkpointPolicies,\n    dependencyBundles: externalAdminPolicyPersistenceEntries(\n      organizationAdminPolicy,\n    ).map((entry) => entry.bundle),\n    organizationId: input.organizationId,\n    policy: verified.value,\n  };\n}\n"]}