@keyneom/sync-kit 0.2.0-rc.0 → 0.2.0-rc.10

package/dist/sharing/controller.js

@@ -1,6 +1,15 @@
 import { SyncKitError } from "../core/errors.js";
 import { canAdministerSharedBackup, parseSharedBackupEnvelopeV1, sharedBackupParticipant, sharedBackupParticipants, } from "./index.js";
 import { acceptSharingPublicKeyResponseV1, createSharedBackupEnvelopeV1, createSharingInvitationV1, createSharingPublicKeyResponseV1, decryptSharedBackupEnvelopeV1, verifySharedBackupEnvelopeV1, verifySharingInvitationV1, } from "./web-crypto.js";
+import { formatSharingInviteEmailMessage, appendSharingJoinParams } from "./join.js";
+export { IndexedDbSharedBackupRegistry } from "./registry-indexeddb.js";
+/**
+ * Placeholder recipient permission id for the link-carried exchange, which has
+ * no Drive exchange grant. Set identically on the invitation and passed to
+ * accept, so the anti-substitution equality check passes; account provenance in
+ * this flow comes from the response signature, not a Drive permission.
+ */
+const SHARING_LINK_PERMISSION_ID = "link";
 export class MemorySharedBackupRegistry {
     records = new Map();
     get(datasetId) {
@@ -54,6 +63,49 @@ export class SharedBackupController {
             return result(stored, value, "created");
         });
     }
+    /**
+     * Reconnect to an existing dataset this identity can already decrypt —
+     * e.g. after a reinstall, or when an interrupted setup left the remote
+     * file without a local registry record. The owner key is pinned from the
+     * envelope itself (trust-on-first-use), so callers recovering their own
+     * dataset should pass `requireOwned` to insist this identity is the
+     * dataset's owner.
+     */
+    adoptDataset(datasetId, options) {
+        return this.serialized(async () => {
+            const stored = await this.readDatasetById(datasetId);
+            const previous = await this.options.registry.get(datasetId);
+            const record = previous ?? this.initialOwnerRecord(stored);
+            await verifySharedBackupEnvelopeV1(stored.envelope, this.crypto(), {
+                trustedOwnerKeyId: record.trustedOwnerKeyId,
+            });
+            const identity = await this.options.identity();
+            if (options?.requireOwned) {
+                const self = sharedBackupParticipant(stored.envelope, identity.publicKey.keyId);
+                if (self?.role !== "owner") {
+                    throw new SyncKitError("authorization", `This identity does not own dataset ${datasetId}.`);
+                }
+            }
+            const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+            await this.persistHead(stored, record.trustedOwnerKeyId, previous ?? undefined);
+            return result(stored, value, "adopted");
+        });
+    }
+    /** Delete a dataset file from the transport and forget its local record. */
+    deleteDataset(datasetId) {
+        return this.serialized(async () => {
+            requireNonEmpty(datasetId, "datasetId");
+            const fileId = (await this.options.registry.get(datasetId))?.fileId ??
+                (await this.options.transport.listDatasets()).find((candidate) => candidate.datasetId === datasetId)?.fileId;
+            if (fileId) {
+                if (!this.options.transport.deleteDataset) {
+                    throw new SyncKitError("state", "This transport does not support deleting datasets.");
+                }
+                await this.options.transport.deleteDataset(fileId);
+            }
+            await this.options.registry.delete(datasetId);
+        });
+    }
     loadDataset(datasetId) {
         return this.serialized(async () => {
             const stored = await this.readDatasetById(datasetId);
@@ -121,11 +173,27 @@ export class SharedBackupController {
             if (!trustedOwnerKeyId) {
                 throw new SyncKitError("state", "The invitation has no owner trust root.");
             }
+            const storage = await this.options.transport.ensureStorage();
+            const appDisplayName = input.appDisplayName?.trim() ?? this.options.appId;
+            const emailMessage = input.emailMessage ??
+                (input.joinLandingUrl
+                    ? formatSharingInviteEmailMessage({
+                        joinUrl: appendSharingJoinParams(input.joinLandingUrl, {
+                            appFolderId: storage.appFolderId,
+                        }),
+                        appDisplayName,
+                    })
+                    : input.joinUrl
+                        ? formatSharingInviteEmailMessage({
+                            joinUrl: input.joinUrl,
+                            appDisplayName,
+                        })
+                        : undefined);
             const access = await this.options.transport.grantExchangeAccess(input.emailAddress, {
                 ...(input.sendNotificationEmail === undefined
                     ? {}
                     : { sendNotificationEmail: input.sendNotificationEmail }),
-                ...(input.emailMessage ? { emailMessage: input.emailMessage } : {}),
+                ...(emailMessage ? { emailMessage } : {}),
             });
             const invitation = await createSharingInvitationV1(identity, {
                 appId: this.options.appId,
@@ -228,128 +296,301 @@ export class SharedBackupController {
             if (verifiedAccount) {
                 await this.options.transport.deleteExchange(input.responseFileId);
             }
-            const results = [];
-            for (const grant of accepted) {
-                try {
-                    const stored = await this.readDatasetById(grant.datasetId);
-                    const record = (await this.options.registry.get(grant.datasetId)) ??
-                        this.initialOwnerRecord(stored);
-                    await this.verifyHead(stored, record);
-                    const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
-                    const participants = participantInputs(stored.envelope).filter((participant) => participant.publicKey.keyId !==
-                        grant.participant.publicKey.keyId);
-                    participants.push(grant.participant);
-                    const next = await createSharedBackupEnvelopeV1(value, this.options.codec, identity, {
-                        appId: this.options.appId,
-                        backupId: grant.datasetId,
-                        participants,
-                        previous: stored.envelope,
-                    }, this.cryptoOptions());
-                    const updated = await this.options.transport.writeDataset(stored, next);
-                    const permission = await this.options.transport.setDatasetPermission(stored.fileId, input.recipientEmailAddress, grant.participant.role === "owner"
-                        ? "admin"
-                        : grant.participant.role, {
-                        hasInheritedReadAccess: true,
-                    });
-                    const participantPermissionIds = {
-                        ...record.participantPermissionIds,
-                        ...(permission.permissionId
-                            ? {
-                                [grant.participant.publicKey.keyId]: permission.permissionId,
-                            }
-                            : {}),
-                    };
-                    const nextRecord = {
-                        ...record,
-                        fileId: updated.fileId,
-                        lastRevisionId: updated.envelope.revisionId,
-                        participantPermissionIds,
-                    };
-                    await this.options.registry.set(nextRecord);
-                    results.push({
-                        datasetId: grant.datasetId,
-                        fileId: updated.fileId,
-                        revisionId: updated.envelope.revisionId,
-                        ...(permission.permissionId
-                            ? { permissionId: permission.permissionId }
-                            : {}),
-                        status: "accepted",
-                    });
+            return this.applyAcceptedGrants(accepted, identity, input.recipientEmailAddress);
+        });
+    }
+    /**
+     * Applies verified acceptance grants to each dataset: add the participant,
+     * re-encrypt, write, and per-email-share the dataset file. Shared by the
+     * Drive-file accept path and the link-payload accept path.
+     */
+    async applyAcceptedGrants(accepted, identity, recipientEmailAddress) {
+        const results = [];
+        for (const grant of accepted) {
+            try {
+                const stored = await this.readDatasetById(grant.datasetId);
+                const record = (await this.options.registry.get(grant.datasetId)) ??
+                    this.initialOwnerRecord(stored);
+                await this.verifyHead(stored, record);
+                const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+                const participants = participantInputs(stored.envelope).filter((participant) => participant.publicKey.keyId !==
+                    grant.participant.publicKey.keyId);
+                participants.push(grant.participant);
+                const next = await createSharedBackupEnvelopeV1(value, this.options.codec, identity, {
+                    appId: this.options.appId,
+                    backupId: grant.datasetId,
+                    participants,
+                    previous: stored.envelope,
+                }, this.cryptoOptions());
+                const updated = await this.options.transport.writeDataset(stored, next);
+                const permission = await this.options.transport.setDatasetPermission(stored.fileId, recipientEmailAddress, grant.participant.role === "owner"
+                    ? "admin"
+                    : grant.participant.role, {
+                    hasInheritedReadAccess: true,
+                });
+                const participantPermissionIds = {
+                    ...record.participantPermissionIds,
+                    ...(permission.permissionId
+                        ? {
+                            [grant.participant.publicKey.keyId]: permission.permissionId,
+                        }
+                        : {}),
+                };
+                const nextRecord = {
+                    ...record,
+                    fileId: updated.fileId,
+                    lastRevisionId: updated.envelope.revisionId,
+                    participantPermissionIds,
+                };
+                await this.options.registry.set(nextRecord);
+                results.push({
+                    datasetId: grant.datasetId,
+                    fileId: updated.fileId,
+                    revisionId: updated.envelope.revisionId,
+                    ...(permission.permissionId
+                        ? { permissionId: permission.permissionId }
+                        : {}),
+                    status: "accepted",
+                });
+            }
+            catch (error) {
+                results.push({
+                    datasetId: grant.datasetId,
+                    status: "failed",
+                    error,
+                });
+            }
+        }
+        return results;
+    }
+    /**
+     * Owner side of the link-carried exchange. Shares each granted dataset file
+     * with the recipient's email (so it lands in their Picker) and returns the
+     * signed invitation plus the file list to embed in the join link. Unlike
+     * {@link inviteParticipant} it writes no Drive `exchanges/` invitation file.
+     */
+    inviteParticipantForLink(input) {
+        return this.serialized(async () => {
+            const identity = await this.options.identity();
+            const trustedOwnerKeyIds = new Set();
+            const files = [];
+            for (const grant of input.requestedGrants) {
+                const stored = await this.readDatasetById(grant.datasetId);
+                const record = await this.requiredRegistry(grant.datasetId);
+                const verified = await verifySharedBackupEnvelopeV1(stored.envelope, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
+                const actor = sharedBackupParticipant(verified, identity.publicKey.keyId);
+                if (!actor || !canAdministerSharedBackup(actor.role)) {
+                    throw new SyncKitError("authorization", `This identity cannot invite participants to ${grant.datasetId}.`);
                 }
-                catch (error) {
-                    results.push({
+                trustedOwnerKeyIds.add(record.trustedOwnerKeyId);
+                await this.options.transport.setDatasetPermission(stored.fileId, input.emailAddress, grant.role, { hasInheritedReadAccess: false });
+                files.push({
+                    datasetId: grant.datasetId,
+                    fileId: stored.fileId,
+                    role: grant.role,
+                });
+            }
+            if (trustedOwnerKeyIds.size !== 1) {
+                throw new SyncKitError("configuration", "One invitation cannot combine datasets with different owner trust roots.");
+            }
+            const trustedOwnerKeyId = [...trustedOwnerKeyIds][0];
+            if (!trustedOwnerKeyId) {
+                throw new SyncKitError("state", "The invitation has no owner trust root.");
+            }
+            const storage = await this.options.transport.ensureStorage();
+            const invitation = await createSharingInvitationV1(identity, {
+                appId: this.options.appId,
+                appFolderId: storage.appFolderId,
+                recipientDrivePermissionId: SHARING_LINK_PERMISSION_ID,
+                requestedGrants: input.requestedGrants,
+                trustedOwnerKeyId,
+                ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),
+            }, this.cryptoOptions());
+            return { invitation, files };
+        });
+    }
+    /**
+     * Recipient side of the link-carried exchange. Verifies the invitation carried
+     * in the join link, registers the granted datasets with their file ids (so
+     * later reads/writes resolve without listing the owner's folder), and returns
+     * a signed key response to send back to the owner. Reads/writes no Drive
+     * `exchanges/` file.
+     */
+    submitKeyResponseFromInvitation(invitation, datasetFiles) {
+        return this.serialized(async () => {
+            const verified = await verifySharingInvitationV1(invitation, {
+                crypto: this.crypto(),
+                ...(this.options.now ? { now: this.options.now } : {}),
+            });
+            if (verified.appId !== this.options.appId) {
+                throw new SyncKitError("compatibility", "The invitation belongs to another app.");
+            }
+            const identity = await this.options.identity();
+            const accountBinding = await this.options.createAccountBinding?.({
+                appId: this.options.appId,
+                exchangeId: verified.exchangeId,
+                sharingKeyId: identity.publicKey.keyId,
+            });
+            const response = await createSharingPublicKeyResponseV1(identity, {
+                appId: this.options.appId,
+                exchangeId: verified.exchangeId,
+                ...(accountBinding ? { accountBinding } : {}),
+            }, this.cryptoOptions());
+            const fileById = new Map(datasetFiles.map((file) => [file.datasetId, file.fileId]));
+            for (const grant of verified.requestedGrants) {
+                const existing = await this.options.registry.get(grant.datasetId);
+                if (existing &&
+                    existing.trustedOwnerKeyId !== verified.trustedOwnerKeyId) {
+                    throw new SyncKitError("conflict", `Dataset ${grant.datasetId} is already pinned to another owner key.`);
+                }
+                const fileId = fileById.get(grant.datasetId);
+                await this.options.registry.set(existing
+                    ? { ...existing, ...(fileId ? { fileId } : {}) }
+                    : {
                         datasetId: grant.datasetId,
-                        status: "failed",
-                        error,
+                        ...(fileId ? { fileId } : {}),
+                        trustedOwnerKeyId: verified.trustedOwnerKeyId,
                     });
-                }
             }
-            return results;
+            return response;
+        });
+    }
+    /**
+     * Owner side. Accepts a key response carried in a response link (no Drive
+     * `exchanges/` read), adds the recipient to each granted dataset, and
+     * per-email shares the dataset files (re-affirming the invite-time share).
+     * The invitation must be supplied by the caller (persisted at invite time,
+     * keyed by exchange id).
+     */
+    acceptKeyResponseFromPayload(input) {
+        return this.serialized(async () => {
+            const identity = await this.options.identity();
+            const binding = input.response.accountBinding;
+            if (this.options.requireAccountBinding && !binding) {
+                throw new SyncKitError("authorization", "The key response has no required account binding.");
+            }
+            const verifiedAccount = binding && this.options.verifyAccountBinding
+                ? await this.options.verifyAccountBinding(binding, {
+                    appId: this.options.appId,
+                    exchangeId: input.invitation.exchangeId,
+                    sharingKeyId: input.response.keyId,
+                    credentialId: binding.passkey.credentialId,
+                })
+                : undefined;
+            const accepted = await acceptSharingPublicKeyResponseV1(input.invitation, input.response, {
+                acceptedByKeyId: identity.publicKey.keyId,
+                drivePermissionId: input.invitation.recipientDrivePermissionId,
+                ...(verifiedAccount ? { googleSubject: verifiedAccount.subject } : {}),
+            }, this.cryptoOptions());
+            return this.applyAcceptedGrants(accepted, identity, input.recipientEmailAddress);
         });
     }
     setDatasetRole(input) {
-        return this.changeParticipants(input.datasetId, (stored, value) => {
+        return this.serialized(async () => {
+            requireNonEmpty(input.datasetId, "datasetId");
+            requireNonEmpty(input.keyId, "keyId");
+            requireNonEmpty(input.emailAddress, "emailAddress");
+            const stored = await this.readDatasetById(input.datasetId);
+            const record = await this.requiredRegistry(input.datasetId);
+            await this.verifyHead(stored, record);
+            const identity = await this.options.identity();
+            const actor = sharedBackupParticipant(stored.envelope, identity.publicKey.keyId);
+            if (!actor || !canAdministerSharedBackup(actor.role)) {
+                throw new SyncKitError("authorization", "Only a current owner or admin can change dataset access.");
+            }
+            const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
             const participants = participantInputs(stored.envelope);
             const participant = participants.find((candidate) => candidate.publicKey.keyId === input.keyId);
             if (!participant) {
                 throw new SyncKitError("not-found", `Participant ${input.keyId} is not in this dataset.`);
             }
             participant.role = input.role;
-            return Promise.resolve({
+            const existingPermission = await this.findDirectDatasetPermission(stored.fileId, record.participantPermissionIds?.[input.keyId], input.emailAddress);
+            const permission = await this.options.transport.setDatasetPermission(stored.fileId, input.emailAddress, input.role, {
+                ...(existingPermission
+                    ? { existingDirectPermissionId: existingPermission.permissionId }
+                    : {}),
+                ...(input.role === "viewer"
+                    ? { hasInheritedReadAccess: true }
+                    : {}),
+            });
+            const participantPermissionIds = permission.permissionId
+                ? {
+                    ...record.participantPermissionIds,
+                    [input.keyId]: permission.permissionId,
+                }
+                : Object.fromEntries(Object.entries(record.participantPermissionIds ?? {}).filter(([keyId]) => keyId !== input.keyId));
+            const next = await createSharedBackupEnvelopeV1(value, this.options.codec, identity, {
+                appId: this.options.appId,
+                backupId: input.datasetId,
                 participants,
-                value,
-                afterWrite: async (updated, record) => {
-                    const permission = await this.options.transport.setDatasetPermission(updated.fileId, input.emailAddress, input.role, {
-                        ...(record.participantPermissionIds?.[input.keyId]
-                            ? {
-                                existingDirectPermissionId: record.participantPermissionIds[input.keyId],
-                            }
-                            : {}),
-                        ...(input.role === "viewer"
-                            ? { hasInheritedReadAccess: true }
-                            : {}),
-                    });
-                    const participantPermissionIds = {
-                        ...record.participantPermissionIds,
-                        ...(permission.permissionId
-                            ? { [input.keyId]: permission.permissionId }
-                            : {}),
-                    };
-                    await this.options.registry.set({
-                        ...record,
-                        participantPermissionIds,
-                    });
-                },
+                previous: stored.envelope,
+            }, this.cryptoOptions());
+            const updated = await this.options.transport.writeDataset(stored, next);
+            await this.persistHead(updated, record.trustedOwnerKeyId, {
+                ...record,
+                participantPermissionIds,
             });
+            return result(updated, value, "updated");
         });
     }
     revokeDatasetKey(input) {
-        return this.changeParticipants(input.datasetId, (stored, value) => {
+        return this.serialized(async () => {
+            const stored = await this.readDatasetById(input.datasetId);
+            const record = await this.requiredRegistry(input.datasetId);
+            await this.verifyHead(stored, record);
+            const identity = await this.options.identity();
+            const actor = sharedBackupParticipant(stored.envelope, identity.publicKey.keyId);
+            if (!actor || !canAdministerSharedBackup(actor.role)) {
+                throw new SyncKitError("authorization", "Only a current owner or admin can change dataset access.");
+            }
+            const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
             const participant = sharedBackupParticipant(stored.envelope, input.keyId);
             if (!participant) {
-                throw new SyncKitError("not-found", `Participant ${input.keyId} is not in this dataset.`);
+                const permission = await this.findDirectDatasetPermission(stored.fileId, record.participantPermissionIds?.[input.keyId], input.emailAddress);
+                if (permission) {
+                    await this.options.transport.removeDatasetPermission(stored.fileId, permission.permissionId);
+                }
+                await this.options.registry.set({
+                    ...record,
+                    participantPermissionIds: Object.fromEntries(Object.entries(record.participantPermissionIds ?? {}).filter(([keyId]) => keyId !== input.keyId)),
+                });
+                return result(stored, value, "unchanged");
             }
             if (participant.role === "owner") {
                 throw new SyncKitError("authorization", "Owner transfer or removal is not supported by sharing v1.");
             }
+            const permission = await this.findDirectDatasetPermission(stored.fileId, record.participantPermissionIds?.[input.keyId], input.emailAddress);
+            if (permission) {
+                await this.options.transport.removeDatasetPermission(stored.fileId, permission.permissionId);
+            }
             const participants = participantInputs(stored.envelope).filter((candidate) => candidate.publicKey.keyId !== input.keyId);
-            return Promise.resolve({
+            const next = await createSharedBackupEnvelopeV1(value, this.options.codec, identity, {
+                appId: this.options.appId,
+                backupId: input.datasetId,
                 participants,
-                value,
-                afterWrite: async (_updated, record) => {
-                    const permissionId = record.participantPermissionIds?.[input.keyId];
-                    if (permissionId) {
-                        await this.options.transport.removeDatasetPermission(stored.fileId, permissionId);
-                    }
-                    const participantPermissionIds = Object.fromEntries(Object.entries(record.participantPermissionIds ?? {}).filter(([keyId]) => keyId !== input.keyId));
-                    await this.options.registry.set({
-                        ...record,
-                        participantPermissionIds,
-                    });
-                },
+                previous: stored.envelope,
+            }, this.cryptoOptions());
+            const updated = await this.options.transport.writeDataset(stored, next);
+            await this.persistHead(updated, record.trustedOwnerKeyId, {
+                ...record,
+                participantPermissionIds: Object.fromEntries(Object.entries(record.participantPermissionIds ?? {}).filter(([keyId]) => keyId !== input.keyId)),
             });
+            return result(updated, value, "updated");
         });
     }
+    async findDirectDatasetPermission(fileId, permissionId, emailAddress) {
+        const directPermissions = (await this.options.transport.listDatasetPermissions(fileId)).filter((permission) => !permission.inherited);
+        if (permissionId) {
+            const byId = directPermissions.find((permission) => permission.permissionId === permissionId);
+            if (byId)
+                return byId;
+        }
+        const normalizedEmail = emailAddress?.trim().toLowerCase();
+        if (!normalizedEmail)
+            return undefined;
+        return directPermissions.find((permission) => permission.emailAddress?.toLowerCase() === normalizedEmail);
+    }
     rotateLocalKey(replacementIdentity, datasetIds) {
         return this.serialized(async () => {
             const currentIdentity = await this.options.identity();
@@ -403,28 +644,127 @@ export class SharedBackupController {
             return results;
         });
     }
-    changeParticipants(datasetId, change) {
+    reconcileDrivePermissions(input) {
         return this.serialized(async () => {
-            const stored = await this.readDatasetById(datasetId);
-            const record = await this.requiredRegistry(datasetId);
+            const stored = await this.readDatasetById(input.datasetId);
+            const record = await this.requiredRegistry(input.datasetId);
             await this.verifyHead(stored, record);
             const identity = await this.options.identity();
             const actor = sharedBackupParticipant(stored.envelope, identity.publicKey.keyId);
             if (!actor || !canAdministerSharedBackup(actor.role)) {
-                throw new SyncKitError("authorization", "Only a current owner or admin can change dataset access.");
+                throw new SyncKitError("authorization", "Only a current owner or admin can reconcile Drive permissions.");
             }
-            const value = await decryptSharedBackupEnvelopeV1(stored.envelope, this.options.codec, identity, this.crypto(), { trustedOwnerKeyId: record.trustedOwnerKeyId });
-            const changed = await change(stored, value);
-            const next = await createSharedBackupEnvelopeV1(changed.value, this.options.codec, identity, {
-                appId: this.options.appId,
-                backupId: datasetId,
-                participants: changed.participants,
-                previous: stored.envelope,
-            }, this.cryptoOptions());
-            const updated = await this.options.transport.writeDataset(stored, next);
-            const nextRecord = await this.persistHead(updated, record.trustedOwnerKeyId, record);
-            await changed.afterWrite?.(updated, nextRecord);
-            return result(updated, changed.value, "updated");
+            const livePermissions = await this.options.transport.listDatasetPermissions(stored.fileId);
+            const directPermissions = livePermissions.filter((permission) => !permission.inherited);
+            const actions = [];
+            const expectedPermissionIds = new Set();
+            let participantPermissionIds = {
+                ...record.participantPermissionIds,
+            };
+            const participants = sharedBackupParticipants(stored.envelope).filter((participant) => participant.role !== "owner");
+            for (const participant of participants) {
+                const emailAddress = input.participantEmails[participant.keyId]?.trim();
+                const expectedRole = sharingRoleToDriveRole(participant.role);
+                const permissionId = participantPermissionIds[participant.keyId];
+                const live = permissionId
+                    ? directPermissions.find((permission) => permission.permissionId === permissionId)
+                    : emailAddress
+                        ? directPermissions.find((permission) => permission.emailAddress?.toLowerCase() ===
+                            emailAddress.toLowerCase())
+                        : undefined;
+                if (participant.role === "viewer" &&
+                    !permissionId &&
+                    !emailAddress &&
+                    livePermissions.some((permission) => permission.inherited && permission.role === "reader")) {
+                    actions.push({
+                        kind: "unchanged",
+                        keyId: participant.keyId,
+                    });
+                    continue;
+                }
+                if (!emailAddress) {
+                    if (live?.role === expectedRole) {
+                        expectedPermissionIds.add(live.permissionId);
+                        actions.push({ kind: "unchanged", keyId: participant.keyId });
+                    }
+                    else {
+                        actions.push({
+                            kind: "skipped",
+                            keyId: participant.keyId,
+                            reason: "No email address was provided for reconciliation.",
+                        });
+                        if (live) {
+                            expectedPermissionIds.add(live.permissionId);
+                        }
+                    }
+                    continue;
+                }
+                if (live?.role === expectedRole) {
+                    expectedPermissionIds.add(live.permissionId);
+                    if (permissionId !== live.permissionId) {
+                        participantPermissionIds = {
+                            ...participantPermissionIds,
+                            [participant.keyId]: live.permissionId,
+                        };
+                    }
+                    actions.push({ kind: "unchanged", keyId: participant.keyId });
+                    continue;
+                }
+                const permission = await this.options.transport.setDatasetPermission(stored.fileId, emailAddress, participant.role, {
+                    ...(live?.permissionId
+                        ? { existingDirectPermissionId: live.permissionId }
+                        : {}),
+                    ...(participant.role === "viewer"
+                        ? { hasInheritedReadAccess: true }
+                        : {}),
+                });
+                if (!permission.permissionId) {
+                    actions.push({
+                        kind: "unchanged",
+                        keyId: participant.keyId,
+                    });
+                    continue;
+                }
+                expectedPermissionIds.add(permission.permissionId);
+                participantPermissionIds = {
+                    ...participantPermissionIds,
+                    [participant.keyId]: permission.permissionId,
+                };
+                actions.push({
+                    kind: live ? "updated" : "granted",
+                    keyId: participant.keyId,
+                    permissionId: permission.permissionId,
+                    role: permission.role,
+                });
+            }
+            if (JSON.stringify(participantPermissionIds) !==
+                JSON.stringify(record.participantPermissionIds ?? {})) {
+                await this.options.registry.set({
+                    ...record,
+                    participantPermissionIds,
+                });
+            }
+            const removedPermissionIds = new Set();
+            for (const permission of directPermissions) {
+                const tracked = Object.values(participantPermissionIds).includes(permission.permissionId);
+                if (tracked &&
+                    !expectedPermissionIds.has(permission.permissionId)) {
+                    await this.options.transport.removeDatasetPermission(stored.fileId, permission.permissionId);
+                    removedPermissionIds.add(permission.permissionId);
+                    actions.push({
+                        kind: "removed",
+                        permissionId: permission.permissionId,
+                    });
+                }
+            }
+            if (removedPermissionIds.size > 0) {
+                participantPermissionIds = Object.fromEntries(Object.entries(participantPermissionIds).filter(([, permissionId]) => !removedPermissionIds.has(permissionId)));
+                await this.options.registry.set({
+                    ...record,
+                    participantPermissionIds,
+                });
+            }
+            return { datasetId: input.datasetId, actions };
         });
     }
     async readDatasetById(datasetId) {
@@ -519,6 +859,9 @@ export class SharedBackupController {
 export function createSharedBackupController(options) {
     return new SharedBackupController(options);
 }
+function sharingRoleToDriveRole(role) {
+    return role === "viewer" ? "reader" : "writer";
+}
 function participantInputs(envelope) {
     return sharedBackupParticipants(envelope).map((participant) => ({
         publicKey: {