@tearleads/client-sdk 0.1.80 → 0.1.81

package/data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence.js

@@ -1,11 +1,9 @@
-import { accessManifestCheckpointFromManifest, KeyingVerificationError, verifyAccessManifestLocalCheckpoint, verifyPrincipalPolicyCheckpoint, } from "../../../internal/crypto/index.js";
-import { keyingCheckpointTables, principalPolicyTables, } from "../../sqlite/schema/index.js";
+import { accessManifestCheckpointFromManifest, KeyingVerificationError, verifyAccessManifestLocalCheckpoint, } from "../../../internal/crypto/index.js";
+import { keyingCheckpointTables } from "../../sqlite/schema/index.js";
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
-import { assertContainerNotRetired, storePrincipalGrantRetirements, } from "../principalKeys/principalGrantRetirementPersistence.js";
-import { retainPrincipalPolicyBundleInTransaction, writePrincipalPolicyBundleInTransaction, } from "../principalPolicy/principalPolicyPersistence.js";
-import { assertBundleMatchesVerifiedPolicy } from "../principalPolicy/verifiedPrincipalPolicyBundle.js";
-import { accessManifestObjectKey, loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertAccessManifestCheckpointInTransaction, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
+import { assertContainerNotRetired } from "../principalKeys/principalGrantRetirementPersistence.js";
+import { accessManifestObjectKey, loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, upsertAccessManifestCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
 export function locallyAuthoredAccessManifestHead(plan) {
     return {
         checkpoint: accessManifestCheckpointFromManifest({
@@ -85,83 +83,4 @@ export async function advanceLocallyAcknowledgedAccessManifestHeadsAtomically(in
     await runtime.transaction(acknowledge, { behavior: "immediate" });
     return true;
 }
-function validateAcknowledgedPolicy(policy, checkpoint) {
-    verifyPrincipalPolicyCheckpoint({
-        chain: policy.history ?? [],
-        currentState: policy.state,
-        localCheckpoint: checkpoint,
-    });
-    if (!checkpoint && policy.version !== 1) {
-        throw new KeyingVerificationError("stale_predecessor", "locally acknowledged principal policy does not begin at version 1");
-    }
-    if (checkpoint && policy.version > checkpoint.version + 1) {
-        throw new KeyingVerificationError("stale_predecessor", "locally acknowledged principal policy does not directly extend the durable checkpoint");
-    }
-}
-function assertUniqueAcknowledgedPolicies(entries) {
-    const seen = new Set();
-    for (const { policy } of entries) {
-        const key = principalPolicyKey(policy);
-        if (seen.has(key)) {
-            throw new KeyingVerificationError("duplicate_entry", `locally acknowledged policy batch repeats ${key}`);
-        }
-        seen.add(key);
-    }
-}
-async function storeAcknowledgedPrincipalPolicyBundles(input) {
-    assertUniqueAcknowledgedPolicies(input.entries);
-    await Promise.all(input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)));
-    await ensureSqlTables(input.execSql, [
-        ...principalPolicyTables,
-        ...keyingCheckpointTables,
-    ]);
-    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
-    const store = async (tx) => {
-        for (const { policy } of input.entries) {
-            validateAcknowledgedPolicy(policy, await loadStoredPrincipalPolicyCheckpoint(tx, policy));
-        }
-        if (input.retiredContainers)
-            await storePrincipalGrantRetirements(tx, input.retiredContainers, input.entries.map(({ policy }) => policy), input.organizationId);
-        for (const entry of input.entries) {
-            if (input.placement === "current") {
-                await writePrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
-            }
-            else {
-                await retainPrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
-            }
-        }
-        for (const { policy } of input.entries) {
-            await upsertPrincipalPolicyCheckpointInTransaction(tx, policy.checkpoint, input.updatedAt, input.organizationId);
-        }
-    };
-    if (input.stillCurrent) {
-        await runtime.guardedTransaction(store, input.stillCurrent, {
-            behavior: "immediate",
-        });
-        return;
-    }
-    await runtime.transaction(store, { behavior: "immediate" });
-}
-/** Atomically pins and caches exact full policy bundles acknowledged by the API. */
-export function persistLocallyAcknowledgedPrincipalPolicyBundles(input) {
-    return storeAcknowledgedPrincipalPolicyBundles({
-        ...input,
-        placement: "current",
-    });
-}
-export function persistLocallyAcknowledgedPrincipalPolicyBundle(input) {
-    return persistLocallyAcknowledgedPrincipalPolicyBundles({
-        entries: [input],
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        stillCurrent: input.stillCurrent,
-        updatedAt: input.updatedAt,
-    });
-}
-export function retainLocallyAcknowledgedPrincipalPolicyBundles(input) {
-    return storeAcknowledgedPrincipalPolicyBundles({
-        ...input,
-        placement: "history",
-    });
-}
 //# sourceMappingURL=locallyAcknowledgedCheckpointPersistence.js.map

package/data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"locallyAcknowledgedCheckpointPersistence.js","sourceRoot":"","sources":["locallyAcknowledgedCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oCAAoC,EACpC,uBAAuB,EAGvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAEL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AAOvC,MAAM,UAAU,iCAAiC,CAAC,IAGjD;IACC,OAAO;QACL,UAAU,EAAE,oCAAoC,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAA2C,EAC3C,eAAgD;IAEhD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,EAAE;QAC1B,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,UAAU;YAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD;QACD,eAAe;KAChB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAAgC,EAChC,KAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,0DAA0D,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,wBAAwB,CACtB,IAAI,EACJ,MAAM,kCAAkC,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAC9D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAsD,EACtD,SAAiB;IAEjB,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uDAAuD,CAAC,KAO7E;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC7D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,EAAE,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvE,IACE,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK;gBACjC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAC9C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,kCAAkC,IAAI,EAAE,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACxE,IACE,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EACxC,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,0EAA0E,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CACL,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE;YAChE,QAAQ,EAAE,WAAW;SACtB,CAAC,CACH,CAAC,SAAS,CAAC;IACd,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,MAA+B,EAC/B,UAA4C;IAE5C,+BAA+B,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC3B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,uFAAuF,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,gCAAgC,CACvC,OAA4D;IAE5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,GAAG,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uCAAuC,CAAC,KAUtD;IACC,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACvD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,0BAA0B,CACxB,MAAM,EACN,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB;YACzB,MAAM,8BAA8B,CAClC,EAAE,EACF,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EACzC,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,wCAAwC,CAC5C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;YAC1D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gDAAgD,CAAC,KAMhE;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAC7D,KAKC;IAED,OAAO,gDAAgD,CAAC;QACtD,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAAC,KAS/D;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  accessManifestCheckpointFromManifest,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type VerifiedPrincipalPolicy,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport {\n  type AcknowledgedPrincipalGrantRetirements,\n  assertContainerNotRetired,\n  storePrincipalGrantRetirements,\n} from \"../principalKeys/principalGrantRetirementPersistence\";\nimport {\n  retainPrincipalPolicyBundleInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"../principalPolicy/principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"../principalPolicy/verifiedPrincipalPolicyBundle\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\n\nexport interface LocallyAcknowledgedAccessManifestHead {\n  readonly checkpoint: AccessManifestCheckpoint;\n  readonly previousManifestHash: string | null;\n}\n\nexport function locallyAuthoredAccessManifestHead(plan: {\n  readonly manifest: AccessManifest;\n  readonly manifestHash: string;\n}): LocallyAcknowledgedAccessManifestHead {\n  return {\n    checkpoint: accessManifestCheckpointFromManifest({\n      manifest: plan.manifest,\n      manifestHash: plan.manifestHash,\n    }),\n    previousManifestHash: plan.manifest.previousManifestHash,\n  };\n}\n\nfunction validateAcknowledgedHead(\n  head: LocallyAcknowledgedAccessManifestHead,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): void {\n  if (!localCheckpoint) {\n    if (head.checkpoint.epoch !== 1 || head.previousManifestHash !== null) {\n      throw new KeyingVerificationError(\n        \"stale_predecessor\",\n        \"locally acknowledged access manifest does not begin at epoch 1\",\n      );\n    }\n    return;\n  }\n\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: [],\n    current: {\n      ...head.checkpoint,\n      previousManifestHash: head.previousManifestHash,\n    },\n    localCheckpoint,\n  });\n}\n\nasync function validateAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  heads: readonly LocallyAcknowledgedAccessManifestHead[],\n): Promise<Map<string, AccessManifestCheckpoint>> {\n  const pending = new Map<string, AccessManifestCheckpoint>();\n  for (const head of heads) {\n    await assertContainerNotRetired(tx, head.checkpoint);\n    const key = accessManifestObjectKey(head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `locally acknowledged batch contains multiple heads for ${key}`,\n      );\n    }\n    validateAcknowledgedHead(\n      head,\n      await loadStoredAccessManifestCheckpoint(tx, head.checkpoint),\n    );\n    pending.set(key, head.checkpoint);\n  }\n  return pending;\n}\n\nasync function writeAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, AccessManifestCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const checkpoint of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\n/**\n * Commits only heads authored and signed by this client after an exact remote\n * acknowledgement check. Every non-initial head must directly extend the\n * latest durable pin; arbitrary remote projections must use the verified\n * projection checkpoint path instead.\n */\nexport async function advanceLocallyAcknowledgedAccessManifestHeadsAtomically(input: {\n  readonly execSql: ExecSql;\n  readonly heads: readonly LocallyAcknowledgedAccessManifestHead[];\n  /** Optional optimistic read dependencies, checked inside the write transaction. */\n  readonly expectedAccessManifestCheckpoints?: readonly AccessManifestCheckpoint[];\n  readonly expectedPrincipalPolicyCheckpoints?: readonly PrincipalPolicyCheckpoint[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  await ensureSqlTables(input.execSql, keyingCheckpointTables);\n  const updatedAt = new Date().toISOString();\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const acknowledge = async (tx: ClientSQLiteTransactionScope) => {\n    for (const expected of input.expectedAccessManifestCheckpoints ?? []) {\n      const current = await loadStoredAccessManifestCheckpoint(tx, expected);\n      if (\n        current?.epoch !== expected.epoch ||\n        current.manifestHash !== expected.manifestHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation container checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    for (const expected of input.expectedPrincipalPolicyCheckpoints ?? []) {\n      const current = await loadStoredPrincipalPolicyCheckpoint(tx, expected);\n      if (\n        current?.version !== expected.version ||\n        current.stateHash !== expected.stateHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation principal policy checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    const pending = await validateAcknowledgedHeads(tx, input.heads);\n    await writeAcknowledgedHeads(tx, pending, updatedAt);\n  };\n  if (input.stillCurrent) {\n    return (\n      await runtime.guardedTransaction(acknowledge, input.stillCurrent, {\n        behavior: \"immediate\",\n      })\n    ).committed;\n  }\n  await runtime.transaction(acknowledge, { behavior: \"immediate\" });\n  return true;\n}\n\nfunction validateAcknowledgedPolicy(\n  policy: VerifiedPrincipalPolicy,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): void {\n  verifyPrincipalPolicyCheckpoint({\n    chain: policy.history ?? [],\n    currentState: policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (!checkpoint && policy.version !== 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not begin at version 1\",\n    );\n  }\n  if (checkpoint && policy.version > checkpoint.version + 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not directly extend the durable checkpoint\",\n    );\n  }\n}\n\ninterface LocallyAcknowledgedPrincipalPolicyBundle {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nfunction assertUniqueAcknowledgedPolicies(\n  entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[],\n): void {\n  const seen = new Set<string>();\n  for (const { policy } of entries) {\n    const key = principalPolicyKey(policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `locally acknowledged policy batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n}\n\nasync function storeAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly placement: \"current\" | \"history\";\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  assertUniqueAcknowledgedPolicies(input.entries);\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const store = async (tx: ClientSQLiteTransactionScope) => {\n    for (const { policy } of input.entries) {\n      validateAcknowledgedPolicy(\n        policy,\n        await loadStoredPrincipalPolicyCheckpoint(tx, policy),\n      );\n    }\n    if (input.retiredContainers)\n      await storePrincipalGrantRetirements(\n        tx,\n        input.retiredContainers,\n        input.entries.map(({ policy }) => policy),\n        input.organizationId,\n      );\n    for (const entry of input.entries) {\n      if (input.placement === \"current\") {\n        await writePrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      } else {\n        await retainPrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      }\n    }\n    for (const { policy } of input.entries) {\n      await upsertPrincipalPolicyCheckpointInTransaction(\n        tx,\n        policy.checkpoint,\n        input.updatedAt,\n        input.organizationId,\n      );\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(store, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(store, { behavior: \"immediate\" });\n}\n\n/** Atomically pins and caches exact full policy bundles acknowledged by the API. */\nexport function persistLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"current\",\n  });\n}\n\nexport function persistLocallyAcknowledgedPrincipalPolicyBundle(\n  input: LocallyAcknowledgedPrincipalPolicyBundle & {\n    readonly execSql: ExecSql;\n    readonly organizationId?: string | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly updatedAt: string;\n  },\n): Promise<void> {\n  return persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [input],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: input.updatedAt,\n  });\n}\n\nexport function retainLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"history\",\n  });\n}\n"]}
+{"version":3,"file":"locallyAcknowledgedCheckpointPersistence.js","sourceRoot":"","sources":["locallyAcknowledgedCheckpointPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oCAAoC,EACpC,uBAAuB,EAEvB,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,2CAA2C,GAC5C,MAAM,+BAA+B,CAAC;AAOvC,MAAM,UAAU,iCAAiC,CAAC,IAGjD;IACC,OAAO;QACL,UAAU,EAAE,oCAAoC,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAA2C,EAC3C,eAAgD;IAEhD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,mCAAmC,CAAC;QAClC,sBAAsB,EAAE,EAAE;QAC1B,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,UAAU;YAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD;QACD,eAAe;KAChB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAAgC,EAChC,KAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,0DAA0D,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,wBAAwB,CACtB,IAAI,EACJ,MAAM,kCAAkC,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAC9D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAsD,EACtD,SAAiB;IAEjB,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uDAAuD,CAAC,KAO7E;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC7D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,EAAE,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvE,IACE,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK;gBACjC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAC9C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,kCAAkC,IAAI,EAAE,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACxE,IACE,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACrC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EACxC,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,0EAA0E,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CACL,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE;YAChE,QAAQ,EAAE,WAAW;SACtB,CAAC,CACH,CAAC,SAAS,CAAC;IACd,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import {\n  type AccessManifest,\n  type AccessManifestCheckpoint,\n  accessManifestCheckpointFromManifest,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  verifyAccessManifestLocalCheckpoint,\n} from \"@tearleads/crypto\";\nimport { keyingCheckpointTables } from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { assertContainerNotRetired } from \"../principalKeys/principalGrantRetirementPersistence\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  upsertAccessManifestCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\n\nexport interface LocallyAcknowledgedAccessManifestHead {\n  readonly checkpoint: AccessManifestCheckpoint;\n  readonly previousManifestHash: string | null;\n}\n\nexport function locallyAuthoredAccessManifestHead(plan: {\n  readonly manifest: AccessManifest;\n  readonly manifestHash: string;\n}): LocallyAcknowledgedAccessManifestHead {\n  return {\n    checkpoint: accessManifestCheckpointFromManifest({\n      manifest: plan.manifest,\n      manifestHash: plan.manifestHash,\n    }),\n    previousManifestHash: plan.manifest.previousManifestHash,\n  };\n}\n\nfunction validateAcknowledgedHead(\n  head: LocallyAcknowledgedAccessManifestHead,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): void {\n  if (!localCheckpoint) {\n    if (head.checkpoint.epoch !== 1 || head.previousManifestHash !== null) {\n      throw new KeyingVerificationError(\n        \"stale_predecessor\",\n        \"locally acknowledged access manifest does not begin at epoch 1\",\n      );\n    }\n    return;\n  }\n\n  verifyAccessManifestLocalCheckpoint({\n    checkpointPredecessors: [],\n    current: {\n      ...head.checkpoint,\n      previousManifestHash: head.previousManifestHash,\n    },\n    localCheckpoint,\n  });\n}\n\nasync function validateAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  heads: readonly LocallyAcknowledgedAccessManifestHead[],\n): Promise<Map<string, AccessManifestCheckpoint>> {\n  const pending = new Map<string, AccessManifestCheckpoint>();\n  for (const head of heads) {\n    await assertContainerNotRetired(tx, head.checkpoint);\n    const key = accessManifestObjectKey(head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `locally acknowledged batch contains multiple heads for ${key}`,\n      );\n    }\n    validateAcknowledgedHead(\n      head,\n      await loadStoredAccessManifestCheckpoint(tx, head.checkpoint),\n    );\n    pending.set(key, head.checkpoint);\n  }\n  return pending;\n}\n\nasync function writeAcknowledgedHeads(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, AccessManifestCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const checkpoint of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\n/**\n * Commits only heads authored and signed by this client after an exact remote\n * acknowledgement check. Every non-initial head must directly extend the\n * latest durable pin; arbitrary remote projections must use the verified\n * projection checkpoint path instead.\n */\nexport async function advanceLocallyAcknowledgedAccessManifestHeadsAtomically(input: {\n  readonly execSql: ExecSql;\n  readonly heads: readonly LocallyAcknowledgedAccessManifestHead[];\n  /** Optional optimistic read dependencies, checked inside the write transaction. */\n  readonly expectedAccessManifestCheckpoints?: readonly AccessManifestCheckpoint[];\n  readonly expectedPrincipalPolicyCheckpoints?: readonly PrincipalPolicyCheckpoint[];\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  await ensureSqlTables(input.execSql, keyingCheckpointTables);\n  const updatedAt = new Date().toISOString();\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const acknowledge = async (tx: ClientSQLiteTransactionScope) => {\n    for (const expected of input.expectedAccessManifestCheckpoints ?? []) {\n      const current = await loadStoredAccessManifestCheckpoint(tx, expected);\n      if (\n        current?.epoch !== expected.epoch ||\n        current.manifestHash !== expected.manifestHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation container checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    for (const expected of input.expectedPrincipalPolicyCheckpoints ?? []) {\n      const current = await loadStoredPrincipalPolicyCheckpoint(tx, expected);\n      if (\n        current?.version !== expected.version ||\n        current.stateHash !== expected.stateHash\n      ) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          \"A re-citation principal policy checkpoint changed before acknowledgement\",\n        );\n      }\n    }\n    const pending = await validateAcknowledgedHeads(tx, input.heads);\n    await writeAcknowledgedHeads(tx, pending, updatedAt);\n  };\n  if (input.stillCurrent) {\n    return (\n      await runtime.guardedTransaction(acknowledge, input.stillCurrent, {\n        behavior: \"immediate\",\n      })\n    ).committed;\n  }\n  await runtime.transaction(acknowledge, { behavior: \"immediate\" });\n  return true;\n}\n"]}

package/data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence.js

@@ -0,0 +1,88 @@
+import { KeyingVerificationError, verifyPrincipalPolicyCheckpoint, } from "../../../internal/crypto/index.js";
+import { keyingCheckpointTables, principalPolicyTables, } from "../../sqlite/schema/index.js";
+import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
+import { loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertPrincipalPolicyCheckpointInTransaction, } from "../keyingCheckpoints/keyingCheckpointPersistence.js";
+import { storePrincipalGrantRetirements, } from "../principalKeys/principalGrantRetirementPersistence.js";
+import { retainPrincipalPolicyBundleInTransaction, writePrincipalPolicyBundleInTransaction, } from "./principalPolicyPersistence.js";
+import { assertBundleMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyBundle.js";
+function validateAcknowledgedPolicy(policy, checkpoint) {
+    verifyPrincipalPolicyCheckpoint({
+        chain: policy.history ?? [],
+        currentState: policy.state,
+        localCheckpoint: checkpoint,
+    });
+    if (!checkpoint && policy.version !== 1) {
+        throw new KeyingVerificationError("stale_predecessor", "locally acknowledged principal policy does not begin at version 1");
+    }
+    if (checkpoint && policy.version > checkpoint.version + 1) {
+        throw new KeyingVerificationError("stale_predecessor", "locally acknowledged principal policy does not directly extend the durable checkpoint");
+    }
+}
+function assertUniqueAcknowledgedPolicies(entries) {
+    const seen = new Set();
+    for (const { policy } of entries) {
+        const key = principalPolicyKey(policy);
+        if (seen.has(key)) {
+            throw new KeyingVerificationError("duplicate_entry", `locally acknowledged policy batch repeats ${key}`);
+        }
+        seen.add(key);
+    }
+}
+async function storeAcknowledgedPrincipalPolicyBundles(input) {
+    assertUniqueAcknowledgedPolicies(input.entries);
+    await Promise.all(input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)));
+    await ensureSqlTables(input.execSql, [
+        ...principalPolicyTables,
+        ...keyingCheckpointTables,
+    ]);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const store = async (tx) => {
+        for (const { policy } of input.entries) {
+            validateAcknowledgedPolicy(policy, await loadStoredPrincipalPolicyCheckpoint(tx, policy));
+        }
+        if (input.retiredContainers)
+            await storePrincipalGrantRetirements(tx, input.retiredContainers, input.entries.map(({ policy }) => policy), input.organizationId);
+        for (const entry of input.entries) {
+            if (input.placement === "current") {
+                await writePrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
+            }
+            else {
+                await retainPrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
+            }
+        }
+        for (const { policy } of input.entries) {
+            await upsertPrincipalPolicyCheckpointInTransaction(tx, policy.checkpoint, input.updatedAt, input.organizationId);
+        }
+    };
+    if (input.stillCurrent) {
+        await runtime.guardedTransaction(store, input.stillCurrent, {
+            behavior: "immediate",
+        });
+        return;
+    }
+    await runtime.transaction(store, { behavior: "immediate" });
+}
+/** Atomically pins and caches exact full policy bundles acknowledged by the API. */
+export function persistLocallyAcknowledgedPrincipalPolicyBundles(input) {
+    return storeAcknowledgedPrincipalPolicyBundles({
+        ...input,
+        placement: "current",
+    });
+}
+export function persistLocallyAcknowledgedPrincipalPolicyBundle(input) {
+    return persistLocallyAcknowledgedPrincipalPolicyBundles({
+        entries: [input],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        stillCurrent: input.stillCurrent,
+        updatedAt: input.updatedAt,
+    });
+}
+export function retainLocallyAcknowledgedPrincipalPolicyBundles(input) {
+    return storeAcknowledgedPrincipalPolicyBundles({
+        ...input,
+        placement: "history",
+    });
+}
+//# sourceMappingURL=locallyAcknowledgedPrincipalPolicyPersistence.js.map

package/data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locallyAcknowledgedPrincipalPolicyPersistence.js","sourceRoot":"","sources":["locallyAcknowledgedPrincipalPolicyPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,mCAAmC,EACnC,kBAAkB,EAClB,4CAA4C,GAC7C,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAEL,8BAA8B,GAC/B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEpF,SAAS,0BAA0B,CACjC,MAA+B,EAC/B,UAA4C;IAE5C,+BAA+B,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC3B,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,uFAAuF,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,gCAAgC,CACvC,OAA4D;IAE5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,GAAG,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uCAAuC,CAAC,KAUtD;IACC,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACvD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,0BAA0B,CACxB,MAAM,EACN,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB;YACzB,MAAM,8BAA8B,CAClC,EAAE,EACF,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EACzC,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,wCAAwC,CAC5C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;YAC1D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gDAAgD,CAAC,KAMhE;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAC7D,KAKC;IAED,OAAO,gDAAgD,CAAC;QACtD,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+CAA+C,CAAC,KAS/D;IACC,OAAO,uCAAuC,CAAC;QAC7C,GAAG,KAAK;QACR,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type VerifiedPrincipalPolicy,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport {\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"../keyingCheckpoints/keyingCheckpointPersistence\";\nimport {\n  type AcknowledgedPrincipalGrantRetirements,\n  storePrincipalGrantRetirements,\n} from \"../principalKeys/principalGrantRetirementPersistence\";\nimport {\n  retainPrincipalPolicyBundleInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\nfunction validateAcknowledgedPolicy(\n  policy: VerifiedPrincipalPolicy,\n  checkpoint: PrincipalPolicyCheckpoint | null,\n): void {\n  verifyPrincipalPolicyCheckpoint({\n    chain: policy.history ?? [],\n    currentState: policy.state,\n    localCheckpoint: checkpoint,\n  });\n  if (!checkpoint && policy.version !== 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not begin at version 1\",\n    );\n  }\n  if (checkpoint && policy.version > checkpoint.version + 1) {\n    throw new KeyingVerificationError(\n      \"stale_predecessor\",\n      \"locally acknowledged principal policy does not directly extend the durable checkpoint\",\n    );\n  }\n}\n\ninterface LocallyAcknowledgedPrincipalPolicyBundle {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nfunction assertUniqueAcknowledgedPolicies(\n  entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[],\n): void {\n  const seen = new Set<string>();\n  for (const { policy } of entries) {\n    const key = principalPolicyKey(policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `locally acknowledged policy batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n}\n\nasync function storeAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly placement: \"current\" | \"history\";\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  assertUniqueAcknowledgedPolicies(input.entries);\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const store = async (tx: ClientSQLiteTransactionScope) => {\n    for (const { policy } of input.entries) {\n      validateAcknowledgedPolicy(\n        policy,\n        await loadStoredPrincipalPolicyCheckpoint(tx, policy),\n      );\n    }\n    if (input.retiredContainers)\n      await storePrincipalGrantRetirements(\n        tx,\n        input.retiredContainers,\n        input.entries.map(({ policy }) => policy),\n        input.organizationId,\n      );\n    for (const entry of input.entries) {\n      if (input.placement === \"current\") {\n        await writePrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      } else {\n        await retainPrincipalPolicyBundleInTransaction(\n          tx,\n          entry.bundle,\n          input.updatedAt,\n          input.organizationId,\n        );\n      }\n    }\n    for (const { policy } of input.entries) {\n      await upsertPrincipalPolicyCheckpointInTransaction(\n        tx,\n        policy.checkpoint,\n        input.updatedAt,\n        input.organizationId,\n      );\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(store, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(store, { behavior: \"immediate\" });\n}\n\n/** Atomically pins and caches exact full policy bundles acknowledged by the API. */\nexport function persistLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"current\",\n  });\n}\n\nexport function persistLocallyAcknowledgedPrincipalPolicyBundle(\n  input: LocallyAcknowledgedPrincipalPolicyBundle & {\n    readonly execSql: ExecSql;\n    readonly organizationId?: string | undefined;\n    readonly stillCurrent?: (() => boolean) | undefined;\n    readonly updatedAt: string;\n  },\n): Promise<void> {\n  return persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [input],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: input.updatedAt,\n  });\n}\n\nexport function retainLocallyAcknowledgedPrincipalPolicyBundles(input: {\n  readonly retiredContainers?:\n    | AcknowledgedPrincipalGrantRetirements\n    | undefined;\n  readonly entries: readonly LocallyAcknowledgedPrincipalPolicyBundle[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  return storeAcknowledgedPrincipalPolicyBundles({\n    ...input,\n    placement: \"history\",\n  });\n}\n"]}

package/data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence.js

@@ -0,0 +1,53 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { keyingCheckpointTables, principalPolicyTables, } from "../../sqlite/schema/index.js";
+import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
+import { validatePrincipalPolicyCheckpointAdvances, writePrincipalPolicyCheckpoints, } from "../keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
+import { loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, } from "../keyingCheckpoints/keyingCheckpointPersistence.js";
+import { assertPrincipalPolicyBundleStoredInTransaction, writePrincipalPolicyBundleInTransaction, } from "./principalPolicyPersistence.js";
+import { assertBundleMatchesVerifiedPolicy } from "./verifiedPrincipalPolicyBundle.js";
+/**
+ * Persists each verified full policy bundle together with its durable head.
+ * This prevents a crash or bundle-write failure from leaving a checkpoint
+ * without the exact same-head payload and member-envelope evidence.
+ */
+export async function persistVerifiedPrincipalPolicyBundlesAtomically(input) {
+    const seen = new Set();
+    for (const entry of input.entries) {
+        const key = principalPolicyKey(entry.policy);
+        if (seen.has(key)) {
+            throw new KeyingVerificationError("duplicate_entry", `verified policy bundle batch repeats ${key}`);
+        }
+        seen.add(key);
+    }
+    await Promise.all(input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)));
+    await ensureSqlTables(input.execSql, [
+        ...principalPolicyTables,
+        ...keyingCheckpointTables,
+    ]);
+    const runtime = getClientSQLitePersistenceRuntime(input.execSql);
+    const persist = async (tx) => {
+        const policies = await validatePrincipalPolicyCheckpointAdvances(tx, input.entries.map((entry) => entry.policy));
+        for (const entry of input.entries) {
+            await writePrincipalPolicyBundleInTransaction(tx, entry.bundle, input.updatedAt, input.organizationId);
+            await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);
+        }
+        await writePrincipalPolicyCheckpoints(tx, policies, input.updatedAt, input.organizationId);
+        for (const policy of policies.values()) {
+            const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);
+            if (!checkpoint ||
+                checkpoint.version !== policy.version ||
+                checkpoint.stateHash !== policy.stateHash) {
+                throw new Error("Verified principal policy checkpoint was not persisted");
+            }
+        }
+    };
+    if (input.stillCurrent) {
+        await runtime.guardedTransaction(persist, input.stillCurrent, {
+            behavior: "immediate",
+        });
+        return;
+    }
+    await runtime.transaction(persist, { behavior: "immediate" });
+}
+//# sourceMappingURL=verifiedPrincipalPolicyBundlePersistence.js.map

package/data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedPrincipalPolicyBundlePersistence.js","sourceRoot":"","sources":["verifiedPrincipalPolicyBundlePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,yCAAyC,EACzC,+BAA+B,GAChC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,mCAAmC,EACnC,kBAAkB,GACnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,8CAA8C,EAC9C,uCAAuC,GACxC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAOpF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAMrE;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,qBAAqB;QACxB,GAAG,sBAAsB;KAC1B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,uCAAuC,CAC3C,EAAE,EACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,MAAM,8CAA8C,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,+BAA+B,CACnC,EAAE,EACF,QAAQ,EACR,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IACE,CAAC,UAAU;gBACX,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBACrC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport {\n  validatePrincipalPolicyCheckpointAdvances,\n  writePrincipalPolicyCheckpoints,\n} from \"../keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport {\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n} from \"../keyingCheckpoints/keyingCheckpointPersistence\";\nimport {\n  assertPrincipalPolicyBundleStoredInTransaction,\n  writePrincipalPolicyBundleInTransaction,\n} from \"./principalPolicyPersistence\";\nimport { assertBundleMatchesVerifiedPolicy } from \"./verifiedPrincipalPolicyBundle\";\n\ninterface VerifiedPrincipalPolicyBundleEntry {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\n/**\n * Persists each verified full policy bundle together with its durable head.\n * This prevents a crash or bundle-write failure from leaving a checkpoint\n * without the exact same-head payload and member-envelope evidence.\n */\nexport async function persistVerifiedPrincipalPolicyBundlesAtomically(input: {\n  readonly entries: readonly VerifiedPrincipalPolicyBundleEntry[];\n  readonly execSql: ExecSql;\n  readonly organizationId?: string | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly updatedAt: string;\n}): Promise<void> {\n  const seen = new Set<string>();\n  for (const entry of input.entries) {\n    const key = principalPolicyKey(entry.policy);\n    if (seen.has(key)) {\n      throw new KeyingVerificationError(\n        \"duplicate_entry\",\n        `verified policy bundle batch repeats ${key}`,\n      );\n    }\n    seen.add(key);\n  }\n  await Promise.all(\n    input.entries.map((entry) => assertBundleMatchesVerifiedPolicy(entry)),\n  );\n  await ensureSqlTables(input.execSql, [\n    ...principalPolicyTables,\n    ...keyingCheckpointTables,\n  ]);\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const persist = async (tx: ClientSQLiteTransactionScope) => {\n    const policies = await validatePrincipalPolicyCheckpointAdvances(\n      tx,\n      input.entries.map((entry) => entry.policy),\n    );\n    for (const entry of input.entries) {\n      await writePrincipalPolicyBundleInTransaction(\n        tx,\n        entry.bundle,\n        input.updatedAt,\n        input.organizationId,\n      );\n      await assertPrincipalPolicyBundleStoredInTransaction(tx, entry.bundle);\n    }\n    await writePrincipalPolicyCheckpoints(\n      tx,\n      policies,\n      input.updatedAt,\n      input.organizationId,\n    );\n    for (const policy of policies.values()) {\n      const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n      if (\n        !checkpoint ||\n        checkpoint.version !== policy.version ||\n        checkpoint.stateHash !== policy.stateHash\n      ) {\n        throw new Error(\n          \"Verified principal policy checkpoint was not persisted\",\n        );\n      }\n    }\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(persist, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(persist, { behavior: \"immediate\" });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.80",
+  "version": "0.1.81",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/organizations/groupPolicy/groupPolicyMutationContext.js

@@ -1,5 +1,5 @@
-import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
-import { retainLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence.js";
+import { retainLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence.js";
+import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../../data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence.js";
 import { requireOrganizationGroupHead } from "../../../data/principals/organizationAuthorityDescriptor.js";
 import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../principals/externalAdminPolicy.js";
 import { assertGroupMetadataBinding } from "../groupMetadata/groupMetadataBinding.js";

package/workflows/organizations/groupPolicy/groupPolicyMutationContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"groupPolicyMutationContext.js","sourceRoot":"","sources":["groupPolicyMutationContext.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,+CAA+C,EAAE,MAAM,gFAAgF,CAAC;AACjJ,OAAO,EAAE,+CAA+C,EAAE,MAAM,sFAAsF,CAAC;AACvJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAKnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EACL,2BAA2B,EAC3B,8CAA8C,EAC9C,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,4CAA4C,EAC5C,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,iBAAiB,EACjB,+CAA+C,GAChD,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAOpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAYpE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAatC;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC5D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,aAAa,EAAE,MAAM;QACrB,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,4CAA4C,CAC1C,MAAM,CAAC,YAAY,EACnB,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtC,8CAA8C,CAC5C,KAAK,CAAC,2BAA2B,EACjC,MAAM,CAAC,sBAAsB,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC;QAC5D,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,4BAA4B,CACpD,WAAW,CAAC,UAAU,EACtB,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,aAAa,GACjB,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,YAAY;QACxC,CAAC,CAAC,WAAW,CAAC,WAAW;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,4CAA4C,CAC1C,aAAa,CAAC,YAAY,EAC1B,iBAAiB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC;IAC7E,MAAM,sBAAsB,GAAG,WAAW,CAAC,aAAa,CAAC;IACzD,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACxD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB;QACxC,CAAC,CAAC,MAAM,iBAAiB,CAAC;YACtB,aAAa;YACb,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC;QACJ,CAAC,CAAC,MAAM,+CAA+C,CAAC;YACpD,aAAa;YACb,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;YACpD,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC,CAAC;IACP,0BAA0B,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClE,2BAA2B,CACzB,aAAa,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE;YACP,GAAG,qCAAqC,CAAC,WAAW,CAAC,CAAC,MAAM,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;gBACrD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;YACD,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,iBAAiB,EAAE,WAAW,CAAC,WAAW;QAC1C,aAAa;QACb,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,sBAAsB,EAAE,WAAW,CAAC,UAAU;QAC9C,wBAAwB,EAAE,WAAW,CAAC,MAAM;QAC5C,GAAG,YAAY;QACf,qBAAqB,EAAE,QAAQ,CAAC,UAAU;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAqB/C;IACC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,kCAAkC,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CACpD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,2BAA2B,CAAC;QACjE,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,+CAA+C,CAAC;QACpD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE;YACjD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,kBAAkB;SAC3B;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACnD;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,wBAAwB;aACjC;SACF;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type {\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyExternalAuthority,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  CurrentPrincipalMemberEnvelopesResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport { retainLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence\";\nimport { requireOrganizationGroupHead } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../principals/externalAdminPolicy\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport type {\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"../principalPolicy/principalPolicyApi\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport {\n  acknowledgeGroupPolicyState,\n  assertGroupPolicyEnvelopesMatchAcknowledgement,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { FullGroupMembershipMutationInput } from \"./groupPolicyMutationEvidence\";\nimport {\n  assertPrincipalPolicyCurrentStateMatchesHead,\n  groupPolicyMutationHead,\n} from \"./groupPolicyMutationHead\";\nimport {\n  collectGroupPolicySignerPublicKeys,\n  prepareGroupPolicyVerification,\n  verifyGroupPolicy,\n  verifyGroupPolicyWithExternalOrganizationAdmins,\n} from \"./groupPolicyVerification\";\nimport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\nexport type {\n  OrganizationPrincipalPolicyApi,\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"../principalPolicy/principalPolicyApi\";\nexport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\ninterface LoadedGroupPolicyMutationContext\n  extends FullGroupMembershipMutationInput {\n  readonly adminGroupId: string;\n  readonly adminPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly currentOrgAdminUserIds: readonly string[];\n  readonly organizationDescriptor: VerifiedExternalAdminPolicy[\"descriptor\"];\n  readonly organizationPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly memberGroupId: string;\n}\n\nexport async function cacheGroupPolicy(input: {\n  readonly acknowledgedMemberEnvelopes?:\n    | CurrentPrincipalMemberEnvelopesResponse\n    | undefined;\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly execSql: ExecSql;\n  readonly expectedCurrentHead?: ReferencedPrincipalHead | undefined;\n  readonly groupId: string;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse> {\n  const bundle = await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n\n  if (!bundle) {\n    throw new Error(\"Updated group policy could not be loaded\");\n  }\n\n  const signerPublicKeys = await collectGroupPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const verified = await verifyGroupPolicy({\n    currentPolicy: bundle,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n    signerPublicKeys,\n  });\n  if (input.expectedCurrentHead) {\n    assertPrincipalPolicyCurrentStateMatchesHead(\n      bundle.currentState,\n      input.expectedCurrentHead,\n    );\n  }\n  if (input.acknowledgedMemberEnvelopes) {\n    assertGroupPolicyEnvelopesMatchAcknowledgement(\n      input.acknowledgedMemberEnvelopes,\n      bundle.currentMemberEnvelopes,\n    );\n  }\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [{ bundle, policy: verified }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return bundle;\n}\n\nexport async function loadGroupPolicyMutationContext(input: {\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<LoadedGroupPolicyMutationContext> {\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  const adminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!adminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const expectedGroupHead = requireOrganizationGroupHead(\n    adminPolicy.descriptor,\n    input.groupId,\n  );\n  const currentPolicy =\n    input.groupId === adminPolicy.adminGroupId\n      ? adminPolicy.adminBundle\n      : await input.apiClient.getCurrentPrincipalPolicy(\"group\", input.groupId);\n  if (!currentPolicy) {\n    throw new Error(\"Group policy could not be loaded\");\n  }\n  assertPrincipalPolicyCurrentStateMatchesHead(\n    currentPolicy.currentState,\n    expectedGroupHead,\n  );\n  const verification = await prepareGroupPolicyVerification({\n    currentPolicy,\n    execSql: input.execSql,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const isOrganizationAdminsGroup = adminPolicy.adminGroupId === input.groupId;\n  const currentOrgAdminUserIds = adminPolicy.signerUserIds;\n  const externalAuthority = adminPolicy.externalAuthority;\n  if (!currentOrgAdminUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority is required\");\n  }\n  const verified = isOrganizationAdminsGroup\n    ? await verifyGroupPolicy({\n        currentPolicy,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      })\n    : await verifyGroupPolicyWithExternalOrganizationAdmins({\n        currentPolicy,\n        loadExternalAuthority: async () => externalAuthority,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      });\n  assertGroupMetadataBinding(currentPolicy, adminPolicy.descriptor);\n  requireSignerCanManageGroup(\n    currentPolicy,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [\n      ...externalAdminPolicyPersistenceEntries(adminPolicy).filter(\n        (entry) =>\n          entry.policy.principalType !== verified.principalType ||\n          entry.policy.principalId !== verified.principalId,\n      ),\n      { bundle: currentPolicy, policy: verified },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n  });\n\n  return {\n    adminGroupId: adminPolicy.adminGroupId,\n    adminPolicyBundle: adminPolicy.adminBundle,\n    currentPolicy,\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup,\n    memberGroupId: adminPolicy.memberGroupId,\n    organizationDescriptor: adminPolicy.descriptor,\n    organizationPolicyBundle: adminPolicy.bundle,\n    ...verification,\n    localPolicyCheckpoint: verified.checkpoint,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n}\n\nexport async function commitGroupPolicyMutation(input: {\n  readonly retiredContainerIds?: (() => readonly string[]) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly organizationPolicy: PrincipalPolicyBundleResponse;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  /**\n   * Re-sign the batch with the descendant rekeys a refusal named woven in; the\n   * result replaces `containerMutations` and the commit is retried once.\n   */\n  readonly carryDescendantRekeys?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stored = await submitGroupPolicyCommit(input);\n  if (!stored) {\n    throw new Error(\"Group policy update failed\");\n  }\n  const storedPolicy = stored.groupPolicy;\n  const acknowledgedPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy.currentState,\n  });\n  const groupBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy,\n  });\n  const organizationHead = await groupPolicyMutationHead(\n    input.organizationRequest,\n  );\n  const acknowledgedOrganization = await acknowledgeGroupPolicyState({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await retainLocallyAcknowledgedPrincipalPolicyBundles({\n    retiredContainers: {\n      containerIds: input.retiredContainerIds?.() ?? [],\n      organizationId: input.organizationId,\n      policy: acknowledgedPolicy,\n    },\n    entries: [\n      { bundle: groupBundle, policy: acknowledgedPolicy },\n      {\n        bundle: organizationBundle,\n        policy: acknowledgedOrganization,\n      },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return groupBundle;\n}\n"]}
+{"version":3,"file":"groupPolicyMutationContext.js","sourceRoot":"","sources":["groupPolicyMutationContext.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,+CAA+C,EAAE,MAAM,yFAAyF,CAAC;AAC1J,OAAO,EAAE,+CAA+C,EAAE,MAAM,oFAAoF,CAAC;AACrJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAKnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EACL,2BAA2B,EAC3B,8CAA8C,EAC9C,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,4CAA4C,EAC5C,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,iBAAiB,EACjB,+CAA+C,GAChD,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAOpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAYpE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAatC;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC5D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,aAAa,EAAE,MAAM;QACrB,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,4CAA4C,CAC1C,MAAM,CAAC,YAAY,EACnB,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtC,8CAA8C,CAC5C,KAAK,CAAC,2BAA2B,EACjC,MAAM,CAAC,sBAAsB,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC;QAC5D,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,4BAA4B,CACpD,WAAW,CAAC,UAAU,EACtB,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,aAAa,GACjB,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,YAAY;QACxC,CAAC,CAAC,WAAW,CAAC,WAAW;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,4CAA4C,CAC1C,aAAa,CAAC,YAAY,EAC1B,iBAAiB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC;IAC7E,MAAM,sBAAsB,GAAG,WAAW,CAAC,aAAa,CAAC;IACzD,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACxD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB;QACxC,CAAC,CAAC,MAAM,iBAAiB,CAAC;YACtB,aAAa;YACb,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC;QACJ,CAAC,CAAC,MAAM,+CAA+C,CAAC;YACpD,aAAa;YACb,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;YACpD,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC,CAAC;IACP,0BAA0B,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClE,2BAA2B,CACzB,aAAa,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE;YACP,GAAG,qCAAqC,CAAC,WAAW,CAAC,CAAC,MAAM,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;gBACrD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;YACD,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,iBAAiB,EAAE,WAAW,CAAC,WAAW;QAC1C,aAAa;QACb,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,sBAAsB,EAAE,WAAW,CAAC,UAAU;QAC9C,wBAAwB,EAAE,WAAW,CAAC,MAAM;QAC5C,GAAG,YAAY;QACf,qBAAqB,EAAE,QAAQ,CAAC,UAAU;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAqB/C;IACC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,kCAAkC,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CACpD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,2BAA2B,CAAC;QACjE,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,+CAA+C,CAAC;QACpD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE;YACjD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,kBAAkB;SAC3B;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACnD;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,wBAAwB;aACjC;SACF;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type {\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyExternalAuthority,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  CurrentPrincipalMemberEnvelopesResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { retainLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../../data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence\";\nimport { requireOrganizationGroupHead } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../principals/externalAdminPolicy\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport type {\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"../principalPolicy/principalPolicyApi\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport {\n  acknowledgeGroupPolicyState,\n  assertGroupPolicyEnvelopesMatchAcknowledgement,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { FullGroupMembershipMutationInput } from \"./groupPolicyMutationEvidence\";\nimport {\n  assertPrincipalPolicyCurrentStateMatchesHead,\n  groupPolicyMutationHead,\n} from \"./groupPolicyMutationHead\";\nimport {\n  collectGroupPolicySignerPublicKeys,\n  prepareGroupPolicyVerification,\n  verifyGroupPolicy,\n  verifyGroupPolicyWithExternalOrganizationAdmins,\n} from \"./groupPolicyVerification\";\nimport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\nexport type {\n  OrganizationPrincipalPolicyApi,\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"../principalPolicy/principalPolicyApi\";\nexport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\ninterface LoadedGroupPolicyMutationContext\n  extends FullGroupMembershipMutationInput {\n  readonly adminGroupId: string;\n  readonly adminPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly currentOrgAdminUserIds: readonly string[];\n  readonly organizationDescriptor: VerifiedExternalAdminPolicy[\"descriptor\"];\n  readonly organizationPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly memberGroupId: string;\n}\n\nexport async function cacheGroupPolicy(input: {\n  readonly acknowledgedMemberEnvelopes?:\n    | CurrentPrincipalMemberEnvelopesResponse\n    | undefined;\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly execSql: ExecSql;\n  readonly expectedCurrentHead?: ReferencedPrincipalHead | undefined;\n  readonly groupId: string;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse> {\n  const bundle = await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n\n  if (!bundle) {\n    throw new Error(\"Updated group policy could not be loaded\");\n  }\n\n  const signerPublicKeys = await collectGroupPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const verified = await verifyGroupPolicy({\n    currentPolicy: bundle,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n    signerPublicKeys,\n  });\n  if (input.expectedCurrentHead) {\n    assertPrincipalPolicyCurrentStateMatchesHead(\n      bundle.currentState,\n      input.expectedCurrentHead,\n    );\n  }\n  if (input.acknowledgedMemberEnvelopes) {\n    assertGroupPolicyEnvelopesMatchAcknowledgement(\n      input.acknowledgedMemberEnvelopes,\n      bundle.currentMemberEnvelopes,\n    );\n  }\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [{ bundle, policy: verified }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return bundle;\n}\n\nexport async function loadGroupPolicyMutationContext(input: {\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<LoadedGroupPolicyMutationContext> {\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  const adminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!adminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const expectedGroupHead = requireOrganizationGroupHead(\n    adminPolicy.descriptor,\n    input.groupId,\n  );\n  const currentPolicy =\n    input.groupId === adminPolicy.adminGroupId\n      ? adminPolicy.adminBundle\n      : await input.apiClient.getCurrentPrincipalPolicy(\"group\", input.groupId);\n  if (!currentPolicy) {\n    throw new Error(\"Group policy could not be loaded\");\n  }\n  assertPrincipalPolicyCurrentStateMatchesHead(\n    currentPolicy.currentState,\n    expectedGroupHead,\n  );\n  const verification = await prepareGroupPolicyVerification({\n    currentPolicy,\n    execSql: input.execSql,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const isOrganizationAdminsGroup = adminPolicy.adminGroupId === input.groupId;\n  const currentOrgAdminUserIds = adminPolicy.signerUserIds;\n  const externalAuthority = adminPolicy.externalAuthority;\n  if (!currentOrgAdminUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority is required\");\n  }\n  const verified = isOrganizationAdminsGroup\n    ? await verifyGroupPolicy({\n        currentPolicy,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      })\n    : await verifyGroupPolicyWithExternalOrganizationAdmins({\n        currentPolicy,\n        loadExternalAuthority: async () => externalAuthority,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      });\n  assertGroupMetadataBinding(currentPolicy, adminPolicy.descriptor);\n  requireSignerCanManageGroup(\n    currentPolicy,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [\n      ...externalAdminPolicyPersistenceEntries(adminPolicy).filter(\n        (entry) =>\n          entry.policy.principalType !== verified.principalType ||\n          entry.policy.principalId !== verified.principalId,\n      ),\n      { bundle: currentPolicy, policy: verified },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n  });\n\n  return {\n    adminGroupId: adminPolicy.adminGroupId,\n    adminPolicyBundle: adminPolicy.adminBundle,\n    currentPolicy,\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup,\n    memberGroupId: adminPolicy.memberGroupId,\n    organizationDescriptor: adminPolicy.descriptor,\n    organizationPolicyBundle: adminPolicy.bundle,\n    ...verification,\n    localPolicyCheckpoint: verified.checkpoint,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n}\n\nexport async function commitGroupPolicyMutation(input: {\n  readonly retiredContainerIds?: (() => readonly string[]) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly organizationPolicy: PrincipalPolicyBundleResponse;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  /**\n   * Re-sign the batch with the descendant rekeys a refusal named woven in; the\n   * result replaces `containerMutations` and the commit is retried once.\n   */\n  readonly carryDescendantRekeys?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stored = await submitGroupPolicyCommit(input);\n  if (!stored) {\n    throw new Error(\"Group policy update failed\");\n  }\n  const storedPolicy = stored.groupPolicy;\n  const acknowledgedPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy.currentState,\n  });\n  const groupBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy,\n  });\n  const organizationHead = await groupPolicyMutationHead(\n    input.organizationRequest,\n  );\n  const acknowledgedOrganization = await acknowledgeGroupPolicyState({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await retainLocallyAcknowledgedPrincipalPolicyBundles({\n    retiredContainers: {\n      containerIds: input.retiredContainerIds?.() ?? [],\n      organizationId: input.organizationId,\n      policy: acknowledgedPolicy,\n    },\n    entries: [\n      { bundle: groupBundle, policy: acknowledgedPolicy },\n      {\n        bundle: organizationBundle,\n        policy: acknowledgedOrganization,\n      },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return groupBundle;\n}\n"]}

package/workflows/organizations/groups/deleteOrganizationGroup.js

@@ -1,5 +1,5 @@
 import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
-import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence.js";
 import { loadOrganizationExternalAdminPolicy } from "../../principals/externalAdminPolicy.js";
 import { acknowledgeGroupPolicyState, buildAcknowledgedGroupPolicyBundle, } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
 import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";

package/workflows/organizations/groups/deleteOrganizationGroup.js.map

@@ -1 +1 @@
-{"version":3,"file":"deleteOrganizationGroup.js","sourceRoot":"","sources":["deleteOrganizationGroup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,sFAAsF,CAAC;AAGxJ,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAgB7C;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,UAAU,EAAE,mBAAmB,CAAC,UAAU;QAC1C,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,mBAAmB,CAAC,UAAU;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC5C,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { DeleteOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport type { DeleteOrganizationGroupResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport {\n  acknowledgeGroupPolicyState,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { PrincipalPolicyReadApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\nexport async function deleteOrganizationGroup(input: {\n  readonly apiClient: PrincipalPolicyReadApi & {\n    deleteOrganizationGroup: (\n      organizationId: string,\n      groupId: string,\n      request: DeleteOrganizationGroupRequest,\n    ) => Promise<DeleteOrganizationGroupResponse | null>;\n  };\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<DeleteOrganizationGroupResponse> {\n  const stillCurrent = input.stillCurrent;\n  assertProjectionVerificationCurrent(stillCurrent);\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const adminProjection = externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: externalAdminPolicy.bundle,\n      descriptor: externalAdminPolicy.descriptor,\n      groupHeads: removeOrganizationGroupHead({\n        descriptor: externalAdminPolicy.descriptor,\n        groupId: input.groupId,\n      }),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const stored = await input.apiClient.deleteOrganizationGroup(\n    input.organizationId,\n    input.groupId,\n    { organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!stored) {\n    throw new Error(\"Group could not be deleted\");\n  }\n  if (\n    stored.organizationId !== input.organizationId ||\n    stored.groupId !== input.groupId\n  ) {\n    throw new Error(\"Group deletion response target mismatch\");\n  }\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [{ bundle: organizationBundle, policy: organizationPolicy }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return stored;\n}\n"]}
+{"version":3,"file":"deleteOrganizationGroup.js","sourceRoot":"","sources":["deleteOrganizationGroup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,yFAAyF,CAAC;AAG3J,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAgB7C;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,UAAU,EAAE,mBAAmB,CAAC,UAAU;QAC1C,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,mBAAmB,CAAC,UAAU;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC5C,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { DeleteOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport type { DeleteOrganizationGroupResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport {\n  acknowledgeGroupPolicyState,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { PrincipalPolicyReadApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\nexport async function deleteOrganizationGroup(input: {\n  readonly apiClient: PrincipalPolicyReadApi & {\n    deleteOrganizationGroup: (\n      organizationId: string,\n      groupId: string,\n      request: DeleteOrganizationGroupRequest,\n    ) => Promise<DeleteOrganizationGroupResponse | null>;\n  };\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<DeleteOrganizationGroupResponse> {\n  const stillCurrent = input.stillCurrent;\n  assertProjectionVerificationCurrent(stillCurrent);\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  assertProjectionVerificationCurrent(stillCurrent);\n  const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const adminProjection = externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: externalAdminPolicy.bundle,\n      descriptor: externalAdminPolicy.descriptor,\n      groupHeads: removeOrganizationGroupHead({\n        descriptor: externalAdminPolicy.descriptor,\n        groupId: input.groupId,\n      }),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(stillCurrent);\n  const stored = await input.apiClient.deleteOrganizationGroup(\n    input.organizationId,\n    input.groupId,\n    { organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(stillCurrent);\n  if (!stored) {\n    throw new Error(\"Group could not be deleted\");\n  }\n  if (\n    stored.organizationId !== input.organizationId ||\n    stored.groupId !== input.groupId\n  ) {\n    throw new Error(\"Group deletion response target mismatch\");\n  }\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [{ bundle: organizationBundle, policy: organizationPolicy }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent,\n  });\n  assertProjectionVerificationCurrent(stillCurrent);\n  return stored;\n}\n"]}

package/workflows/organizations/groups/organizationGroupDirectory.js

@@ -1,7 +1,7 @@
 import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, normalizePrincipalProjectionMembers, signPrincipalState, toFingerprint, } from "../../../internal/crypto/index.js";
 import { bytesToBase64 } from "../../../internal/encoding/index.js";
 import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
-import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence.js";
 import { encodeOrganizationAuthorityDescriptor, normalizeOrganizationGroupHeads, } from "../../../data/principals/organizationAuthorityDescriptor.js";
 import { assertGroupNameUniqueInDirectory } from "../groupNames/groupNameUniqueness.js";
 import { acknowledgeGroupPolicyState, acknowledgeInitialGroupPolicy, buildAcknowledgedGroupPolicyBundle, } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";

package/workflows/organizations/groups/organizationGroupDirectory.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationGroupDirectory.js","sourceRoot":"","sources":["organizationGroupDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EAGnC,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,sFAAsF,CAAC;AACxJ,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAGhC,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAK/F,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,SAAS,qBAAqB,CAC5B,IAA6B;IAE7B,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,+BAA+B,CAAC;QACrC,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;QACD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,IACE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC/C,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,+BAA+B,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KASlE;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9E,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,KAAK,EAAE,KAAK,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,GAAG,KAAK,CAAC,UAAU;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC5C,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS;QACzD,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;KACnD,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,MAAM,EAAE,EAAE;QACV,eAAe;QACf,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAgBnD;IAIC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,gCAAgC,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,iBAAiB;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CACjC,CAAC;IACF,MAAM,eAAe,GACnB,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU;YAClD,qBAAqB,CAAC,YAAY,CAAC;SACpC;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC9D,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;YAC5D,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC3D;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  generateKemSeedAndKeyPair,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationGroupSummaryResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/keyingCheckpoints/locallyAcknowledgedCheckpointPersistence\";\nimport {\n  encodeOrganizationAuthorityDescriptor,\n  normalizeOrganizationGroupHeads,\n  type OrganizationAuthorityDescriptor,\n  type OrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type {\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"../../../data/trustedUserIdentity\";\nimport type { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport { assertGroupNameUniqueInDirectory } from \"../groupNames/groupNameUniqueness\";\nimport {\n  acknowledgeGroupPolicyState,\n  acknowledgeInitialGroupPolicy,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport { rewrapProjectionMemberEnvelopes } from \"../principalPolicy/principalPolicyRecipients\";\nimport type {\n  buildInitialGroupPolicyRequest,\n  GroupPolicyNameReader,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\n\nfunction organizationGroupHead(\n  head: ReferencedPrincipalHead,\n): OrganizationGroupHead {\n  if (head.principalType !== \"group\") {\n    throw new Error(\"Organization directory can contain only group heads\");\n  }\n  return { ...head, principalType: \"group\" };\n}\n\nexport function replaceOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly nextHead: ReferencedPrincipalHead;\n}): OrganizationGroupHead[] {\n  const nextHead = organizationGroupHead(input.nextHead);\n  return normalizeOrganizationGroupHeads([\n    ...input.descriptor.groupHeads.filter(\n      (head) => head.principalId !== nextHead.principalId,\n    ),\n    nextHead,\n  ]);\n}\n\nexport function removeOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupId: string;\n}): OrganizationGroupHead[] {\n  if (\n    input.groupId === input.descriptor.adminGroupId ||\n    input.groupId === input.descriptor.memberGroupId\n  ) {\n    throw new Error(\"Built-in groups cannot be removed from the directory\");\n  }\n  const groupHeads = input.descriptor.groupHeads.filter(\n    (head) => head.principalId !== input.groupId,\n  );\n  if (groupHeads.length === input.descriptor.groupHeads.length) {\n    throw new Error(\"Organization directory does not commit the deleted group\");\n  }\n  return normalizeOrganizationGroupHeads(groupHeads);\n}\n\nexport async function buildOrganizationGroupDirectoryPolicyRequest(input: {\n  readonly adminProjection: readonly PrincipalProjectionMemberRequest[];\n  readonly adminUsers: readonly TrustedUserIdentity[];\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentState\">;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupHeads: readonly OrganizationGroupHead[];\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PutPrincipalPolicyRequest> {\n  const projection = normalizePrincipalProjectionMembers(input.adminProjection);\n  if (\n    projection.length === 0 ||\n    projection.some((member) => member.role !== \"admin\")\n  ) {\n    throw new Error(\"Organization policy must mirror the Admins projection\");\n  }\n  const organizationKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: organizationKem.secretKey,\n    users: input.adminUsers,\n  });\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    ...input.descriptor,\n    groupHeads: input.groupHeads,\n  });\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.descriptor.organizationId,\n      version: input.currentPolicy.currentState.version + 1,\n      prevStateHash: input.currentPolicy.currentState.stateHash,\n      keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: projection.map((member) => ({ userId: member.userId })),\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.signerUserId,\n      signerUserKeyFingerprint: input.signingFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    grants: [],\n    memberEnvelopes,\n    projection,\n    state,\n  };\n}\n\nexport async function commitCreatedGroupToDirectory(input: {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly name: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly apiClient: OrganizationPrincipalPolicyApi;\n  readonly execSql: ExecSql;\n  readonly externalAdminPolicy: NonNullable<\n    Awaited<ReturnType<typeof loadOrganizationExternalAdminPolicy>>\n  >;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly request: Awaited<ReturnType<typeof buildInitialGroupPolicyRequest>>;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<{\n  readonly group: OrganizationGroupSummaryResponse;\n  readonly head: ReferencedPrincipalHead;\n}> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  // Signed group names are unique per organization; refuse a collision before\n  // anything reaches the server.\n  await assertGroupNameUniqueInDirectory({\n    apiClient: input.apiClient,\n    descriptor: input.externalAdminPolicy.descriptor,\n    execSql: input.execSql,\n    externalAuthority: input.externalAdminPolicy.externalAuthority,\n    name: input.name,\n    readEncryptedName: input.readEncryptedName,\n    organizationId: input.organizationId,\n    reportSecurityIncident: input.reportSecurityIncident,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const expectedHead = await groupPolicyMutationHead(\n    input.request.initialGroupPolicy,\n  );\n  const adminProjection =\n    input.externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: input.externalAdminPolicy.bundle,\n      descriptor: input.externalAdminPolicy.descriptor,\n      groupHeads: [\n        ...input.externalAdminPolicy.descriptor.groupHeads,\n        organizationGroupHead(expectedHead),\n      ],\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const stored = await input.apiClient.createOrganizationGroup(\n    input.organizationId,\n    { ...input.request, organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!stored) {\n    throw new Error(\"Group could not be created\");\n  }\n  const acknowledged = await acknowledgeInitialGroupPolicy({\n    organizationId: input.organizationId,\n    request: input.request,\n    response: stored.group,\n    stateHash: expectedHead.stateHash,\n  });\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [\n      { bundle: acknowledged.bundle, policy: acknowledged.policy },\n      { bundle: organizationBundle, policy: organizationPolicy },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { group: stored.group, head: expectedHead };\n}\n"]}
+{"version":3,"file":"organizationGroupDirectory.js","sourceRoot":"","sources":["organizationGroupDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EAGnC,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,yFAAyF,CAAC;AAC3J,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAGhC,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAK/F,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,SAAS,qBAAqB,CAC5B,IAA6B;IAE7B,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,+BAA+B,CAAC;QACrC,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;QACD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,IACE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC/C,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,+BAA+B,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KASlE;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9E,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,KAAK,EAAE,KAAK,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,GAAG,KAAK,CAAC,UAAU;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC5C,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS;QACzD,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;KACnD,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,MAAM,EAAE,EAAE;QACV,eAAe;QACf,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAgBnD;IAIC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,gCAAgC,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,iBAAiB;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CACjC,CAAC;IACF,MAAM,eAAe,GACnB,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU;YAClD,qBAAqB,CAAC,YAAY,CAAC;SACpC;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC9D,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;YAC5D,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC3D;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  generateKemSeedAndKeyPair,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationGroupSummaryResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/principalPolicy/locallyAcknowledgedPrincipalPolicyPersistence\";\nimport {\n  encodeOrganizationAuthorityDescriptor,\n  normalizeOrganizationGroupHeads,\n  type OrganizationAuthorityDescriptor,\n  type OrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type {\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"../../../data/trustedUserIdentity\";\nimport type { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport { assertGroupNameUniqueInDirectory } from \"../groupNames/groupNameUniqueness\";\nimport {\n  acknowledgeGroupPolicyState,\n  acknowledgeInitialGroupPolicy,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport { rewrapProjectionMemberEnvelopes } from \"../principalPolicy/principalPolicyRecipients\";\nimport type {\n  buildInitialGroupPolicyRequest,\n  GroupPolicyNameReader,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\n\nfunction organizationGroupHead(\n  head: ReferencedPrincipalHead,\n): OrganizationGroupHead {\n  if (head.principalType !== \"group\") {\n    throw new Error(\"Organization directory can contain only group heads\");\n  }\n  return { ...head, principalType: \"group\" };\n}\n\nexport function replaceOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly nextHead: ReferencedPrincipalHead;\n}): OrganizationGroupHead[] {\n  const nextHead = organizationGroupHead(input.nextHead);\n  return normalizeOrganizationGroupHeads([\n    ...input.descriptor.groupHeads.filter(\n      (head) => head.principalId !== nextHead.principalId,\n    ),\n    nextHead,\n  ]);\n}\n\nexport function removeOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupId: string;\n}): OrganizationGroupHead[] {\n  if (\n    input.groupId === input.descriptor.adminGroupId ||\n    input.groupId === input.descriptor.memberGroupId\n  ) {\n    throw new Error(\"Built-in groups cannot be removed from the directory\");\n  }\n  const groupHeads = input.descriptor.groupHeads.filter(\n    (head) => head.principalId !== input.groupId,\n  );\n  if (groupHeads.length === input.descriptor.groupHeads.length) {\n    throw new Error(\"Organization directory does not commit the deleted group\");\n  }\n  return normalizeOrganizationGroupHeads(groupHeads);\n}\n\nexport async function buildOrganizationGroupDirectoryPolicyRequest(input: {\n  readonly adminProjection: readonly PrincipalProjectionMemberRequest[];\n  readonly adminUsers: readonly TrustedUserIdentity[];\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentState\">;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupHeads: readonly OrganizationGroupHead[];\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PutPrincipalPolicyRequest> {\n  const projection = normalizePrincipalProjectionMembers(input.adminProjection);\n  if (\n    projection.length === 0 ||\n    projection.some((member) => member.role !== \"admin\")\n  ) {\n    throw new Error(\"Organization policy must mirror the Admins projection\");\n  }\n  const organizationKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: organizationKem.secretKey,\n    users: input.adminUsers,\n  });\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    ...input.descriptor,\n    groupHeads: input.groupHeads,\n  });\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.descriptor.organizationId,\n      version: input.currentPolicy.currentState.version + 1,\n      prevStateHash: input.currentPolicy.currentState.stateHash,\n      keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: projection.map((member) => ({ userId: member.userId })),\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.signerUserId,\n      signerUserKeyFingerprint: input.signingFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    grants: [],\n    memberEnvelopes,\n    projection,\n    state,\n  };\n}\n\nexport async function commitCreatedGroupToDirectory(input: {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly name: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly apiClient: OrganizationPrincipalPolicyApi;\n  readonly execSql: ExecSql;\n  readonly externalAdminPolicy: NonNullable<\n    Awaited<ReturnType<typeof loadOrganizationExternalAdminPolicy>>\n  >;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly request: Awaited<ReturnType<typeof buildInitialGroupPolicyRequest>>;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<{\n  readonly group: OrganizationGroupSummaryResponse;\n  readonly head: ReferencedPrincipalHead;\n}> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  // Signed group names are unique per organization; refuse a collision before\n  // anything reaches the server.\n  await assertGroupNameUniqueInDirectory({\n    apiClient: input.apiClient,\n    descriptor: input.externalAdminPolicy.descriptor,\n    execSql: input.execSql,\n    externalAuthority: input.externalAdminPolicy.externalAuthority,\n    name: input.name,\n    readEncryptedName: input.readEncryptedName,\n    organizationId: input.organizationId,\n    reportSecurityIncident: input.reportSecurityIncident,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const expectedHead = await groupPolicyMutationHead(\n    input.request.initialGroupPolicy,\n  );\n  const adminProjection =\n    input.externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: input.externalAdminPolicy.bundle,\n      descriptor: input.externalAdminPolicy.descriptor,\n      groupHeads: [\n        ...input.externalAdminPolicy.descriptor.groupHeads,\n        organizationGroupHead(expectedHead),\n      ],\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const stored = await input.apiClient.createOrganizationGroup(\n    input.organizationId,\n    { ...input.request, organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!stored) {\n    throw new Error(\"Group could not be created\");\n  }\n  const acknowledged = await acknowledgeInitialGroupPolicy({\n    organizationId: input.organizationId,\n    request: input.request,\n    response: stored.group,\n    stateHash: expectedHead.stateHash,\n  });\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [\n      { bundle: acknowledged.bundle, policy: acknowledged.policy },\n      { bundle: organizationBundle, policy: organizationPolicy },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { group: stored.group, head: expectedHead };\n}\n"]}

package/workflows/principals/externalAdminPolicy.js

@@ -1,6 +1,6 @@
 import { KeyingVerificationError, verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
-import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
 import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js";
+import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../data/persistence/principalPolicy/verifiedPrincipalPolicyBundlePersistence.js";
 import { parseOrganizationAuthorityDescriptor, previousStatesIncludeHead, principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
 import { organizationAdminExternalAuthority, organizationAdminSignerUserIds, principalPolicyReferenceFromBundle, verifyOrganizationAdminPolicy, } from "../../data/principals/principalPolicyAdminSigners.js";
 import { collectPrincipalPolicySignerPublicKeys, } from "./policyVerification.js";