@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/containers/child/revoke.js

@@ -0,0 +1,229 @@
+import { computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, deriveContainerKekWrappingPublicKey, } from "../../../internal/crypto/index.js";
+import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
+import { buildContainerCreateKeyEpoch, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
+import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
+import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
+import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { buildContainerRotationArtifacts } from "./moveRotation.js";
+import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
+import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "./mutationSubmit.js";
+import { containerWriterProjectionFromRotationPlan } from "./rekeyProjection.js";
+import { deriveContainerRevokeManifest, } from "./revokeManifest.js";
+import { resolveRotationContext } from "./rotationContext.js";
+import { collectContainerRevokePrincipalPolicies } from "./rotationPrincipalPolicies.js";
+import { buildContainerRotationWraps } from "./rotationWraps.js";
+function buildContainerRevokeRequest(input) {
+    return {
+        ...containerMutationRequestCore("revoke", input),
+        ...previousPathRequestFields(input.previousManifest, input.previousProjection),
+        predecessorBridge: readCanonicalRecord(input.predecessorBridge, "Container revoke predecessor bridge"),
+        keyring: readCanonicalRecord(input.keyring, "Container revoke keyring"),
+        parentKekState: readCanonicalRecordOrNull(input.parentKek, "Container revoke parent KEK state"),
+    };
+}
+function buildContainerRevokePlanResult(input) {
+    const plan = {
+        body: input.body,
+        containerId: input.containerId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        event: input.event,
+        eventHash: input.eventHash,
+        keyEpoch: input.keyEpoch,
+        keyring: input.keyring,
+        manifest: input.manifest,
+        manifestHash: input.manifestHash,
+        previousManifest: input.previousManifest,
+        request: buildContainerRevokeRequest({
+            body: input.body,
+            event: input.event,
+            keyEpoch: input.keyEpoch,
+            keyring: input.keyring,
+            manifest: input.manifest,
+            manifestHash: input.manifestHash,
+            parentKek: input.parentKek,
+            predecessorBridge: input.predecessorBridge,
+            previousManifest: input.previousManifest,
+            previousProjection: input.previousProjection,
+            principalPolicies: input.principalPolicies,
+            userRecipientKeys: input.userRecipientKeys,
+            wraps: input.wraps,
+        }),
+        state: input.state,
+        userRecipientKeys: input.userRecipientKeys,
+        wraps: input.wraps,
+    };
+    return { containerKey: input.containerKey, plan };
+}
+// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.
+export async function buildMaterializedContainerRevokePlan(input) {
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container revoke");
+    const { parentKek, parentPublicKey, predecessorContainerKey, previousState, target, } = await resolveRotationContext(input, "revoke");
+    const principalPolicies = await collectContainerRevokePrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        previousProjection: input.previousProjection,
+        principalPolicyCache: input.principalPolicyCache,
+        resolveUserKey: resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    assertContainerAuthorAccess({
+        author: input.author,
+        projection: input.previousProjection,
+        principalPolicies,
+        minimumAccess: "admin",
+    });
+    const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;
+    const { containerKey, containerKeyEpochId, keyring, predecessorBridge } = await buildContainerRotationArtifacts({
+        containerId: previousState.containerId,
+        currentKek: target.kek,
+        currentKeyMaterial: predecessorContainerKey,
+        keyEpoch: nextContainerKeyEpoch,
+        signedEpochIds: target.signedEpochIds,
+    });
+    const body = {
+        eventType: "container.revoke",
+        parentManifestHash: input.previousProjection.path.at(-2)?.manifestHash ?? null,
+        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
+            containerId: previousState.containerId,
+            keyMaterial: containerKey,
+        }),
+        containerKeyEpochId,
+        keyringHash: await computeContainerKekKeyringHash(keyring),
+        predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(predecessorBridge),
+        subjectId: input.revokedSubject.subjectId,
+        subjectType: input.revokedSubject.subjectType,
+    };
+    const { event, eventHash } = await signContainerMutationEvent({
+        author: input.author,
+        body,
+        containerId: previousState.containerId,
+        dependencyManifestHashes: uniqueSortedManifestHashes(input.previousProjection.path),
+        eventId: input.eventId ?? crypto.randomUUID(),
+        previousManifestHash: target.manifest.manifestHash,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    });
+    const { manifest, manifestHash, state } = await deriveContainerRevokeManifest({
+        containerKeyPublicKey: body.containerKeyPublicKey,
+        parentManifestHash: body.parentManifestHash,
+        containerKeyEpochId,
+        eventHash,
+        previousManifest: target.manifest,
+        revokedSubject: input.revokedSubject,
+    });
+    const keyEpoch = buildContainerCreateKeyEpoch({
+        containerId: previousState.containerId,
+        containerKeyEpochId,
+        eventHash,
+        keyEpoch: nextContainerKeyEpoch,
+        manifestHash,
+        parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,
+    });
+    const replacementPrincipalPolicy = input.replacementPrincipalPolicy;
+    if (replacementPrincipalPolicy &&
+        (replacementPrincipalPolicy.principalType !==
+            input.revokedSubject.subjectType ||
+            replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)) {
+        throw new Error("Container revoke replacement principal does not match");
+    }
+    const currentPrincipalPolicies = replacementPrincipalPolicy
+        ? principalPolicies.filter((policy) => policy.principalType !== replacementPrincipalPolicy.principalType ||
+            policy.principalId !== replacementPrincipalPolicy.principalId)
+        : principalPolicies;
+    const { userRecipientKeys, wraps } = await buildContainerRotationWraps({
+        containerKey,
+        containerKeyEpochId,
+        manifestHash,
+        operationLabel: "Container revoke",
+        parentKek,
+        parentPublicKey,
+        principalPolicies: currentPrincipalPolicies,
+        resolveUserKey: resolveProjectionUserKey,
+        state,
+    });
+    return buildContainerRevokePlanResult({
+        body,
+        containerId: previousState.containerId,
+        containerKey,
+        containerKeyEpochId,
+        event,
+        eventHash,
+        keyEpoch,
+        keyring,
+        manifest,
+        manifestHash,
+        parentKek,
+        predecessorBridge,
+        previousManifest: asContainerManifestBundle(target.manifest),
+        previousProjection: input.previousProjection,
+        principalPolicies: currentPrincipalPolicies,
+        state,
+        userRecipientKeys,
+        wraps,
+    });
+}
+export async function revokeRemoteContainer(input) {
+    const previousProjection = await input.apiClient.getContainerWriterProjection(input.containerId);
+    if (!previousProjection) {
+        return null;
+    }
+    const materializedPlan = await buildMaterializedContainerRevokePlan({
+        author: input.author,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        previousProjection,
+        revokedSubject: input.revokedSubject,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    return submitAcknowledgedContainerMutation({
+        reportSecurityIncident: input.reportSecurityIncident,
+        recitationPolicies: [],
+        apiClient: input.apiClient,
+        author: input.author,
+        carriedRekeys: {
+            planning: {
+                apiClient: input.apiClient,
+                author: input.author,
+                execSql: input.execSql,
+                knownContainerKeks: new Map([
+                    [
+                        materializedPlan.plan.containerKeyEpochId,
+                        materializedPlan.containerKey,
+                    ],
+                ]),
+                resolveProjectionUserKey: input.resolveProjectionUserKey,
+                stillCurrent: input.stillCurrent,
+                targetSecretKey: input.targetSecretKey,
+                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+            },
+            rotated: () => containerWriterProjectionFromRotationPlan({
+                plan: materializedPlan.plan,
+                previousProjection,
+            }),
+        },
+        containerKey: materializedPlan.containerKey,
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+        submit: (carried) => {
+            const request = carried.length
+                ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }
+                : materializedPlan.plan.request;
+            const options = {
+                expectedPaymentRequiredOrganizationId: input.author.organizationId,
+            };
+            const { revokeContainerResult } = input.apiClient;
+            return submitContainerRotation({
+                plain: () => input.apiClient.revokeContainer(input.containerId, request, options),
+                result: revokeContainerResult
+                    ? () => revokeContainerResult.call(input.apiClient, input.containerId, request, { ...options, reportErrors: false })
+                    : undefined,
+            });
+        },
+    });
+}
+//# sourceMappingURL=revoke.js.map

package/workflows/containers/child/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["revoke.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEL,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,SAAS,2BAA2B,CAAC,KAcpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC;QAChD,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,qCAAqC,CACtC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACvE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAmBvC;IACC,MAAM,IAAI,GAAwB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,gKAAgK;AAChK,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAkB1D;IACC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,MAAM,uCAAuC,CAAC;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACrE,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,kBAAkB,EAAE,uBAAuB;QAC3C,QAAQ,EAAE,qBAAqB;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACL,MAAM,IAAI,GAAmC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,mBAAmB;QACnB,WAAW,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;QAC1D,qBAAqB,EACnB,MAAM,wCAAwC,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,mBAAmB;QACnB,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,qBAAqB;QAC/B,YAAY;QACZ,yBAAyB,EAAE,SAAS,EAAE,mBAAmB,IAAI,IAAI;KAClE,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IACE,0BAA0B;QAC1B,CAAC,0BAA0B,CAAC,aAAa;YACvC,KAAK,CAAC,cAAc,CAAC,WAAW;YAChC,0BAA0B,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,wBAAwB,GAAG,0BAA0B;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CACtB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;YACjE,MAAM,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW,CAChE;QACH,CAAC,CAAC,iBAAiB,CAAC;IACtB,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,kBAAkB;QAClC,SAAS;QACT,eAAe;QACf,iBAAiB,EAAE,wBAAwB;QAC3C,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;QACpC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY;QACZ,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,wBAAwB;QAC3C,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAa3C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAClD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACtE,MAAM,EAAE,qBAAqB;oBAC3B,CAAC,CAAC,GAAG,EAAE,CACH,qBAAqB,CAAC,IAAI,CACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerAccessManifestState,\n  ContainerKekKeyring,\n  ContainerKekPredecessorBridge,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerRevokeAccessEventBody,\n  ContainerUserRecipientKey,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekKeyringHash,\n  computeContainerKekPredecessorBridgeHash,\n  deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerRotationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n  buildContainerCreateKeyEpoch,\n  signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRevokeApi,\n  ContainerRevokePlan,\n  MaterializedContainerRevokePlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n  type ContainerRevokeSubject,\n  deriveContainerRevokeManifest,\n} from \"./revokeManifest\";\nimport { resolveRotationContext } from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\n\nfunction buildContainerRevokeRequest(input: {\n  body: ContainerRevokeAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"revoke\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    predecessorBridge: readCanonicalRecord(\n      input.predecessorBridge,\n      \"Container revoke predecessor bridge\",\n    ),\n    keyring: readCanonicalRecord(input.keyring, \"Container revoke keyring\"),\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container revoke parent KEK state\",\n    ),\n  };\n}\n\nfunction buildContainerRevokePlanResult(input: {\n  body: ContainerRevokeAccessEventBody;\n  containerId: string;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  event: AccessEvent;\n  eventHash: string;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  state: ContainerAccessManifestState;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerRevokePlan {\n  const plan: ContainerRevokePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    event: input.event,\n    eventHash: input.eventHash,\n    keyEpoch: input.keyEpoch,\n    keyring: input.keyring,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousManifest: input.previousManifest,\n    request: buildContainerRevokeRequest({\n      body: input.body,\n      event: input.event,\n      keyEpoch: input.keyEpoch,\n      keyring: input.keyring,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: input.parentKek,\n      predecessorBridge: input.predecessorBridge,\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\n// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.\nexport async function buildMaterializedContainerRevokePlan(input: {\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /** Keys a batch minted above this container and has yet to commit. */\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /** False for a projection re-rooted on rotations not yet acknowledged. */\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  /** Verified policies the path may cite before they are stored locally. */\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;\n  revokedSubject: ContainerRevokeSubject;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<MaterializedContainerRevokePlan> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container revoke\",\n  );\n  const {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  } = await resolveRotationContext(input, \"revoke\");\n  const principalPolicies = await collectContainerRevokePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    previousProjection: input.previousProjection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;\n  const { containerKey, containerKeyEpochId, keyring, predecessorBridge } =\n    await buildContainerRotationArtifacts({\n      containerId: previousState.containerId,\n      currentKek: target.kek,\n      currentKeyMaterial: predecessorContainerKey,\n      keyEpoch: nextContainerKeyEpoch,\n      signedEpochIds: target.signedEpochIds,\n    });\n  const body: ContainerRevokeAccessEventBody = {\n    eventType: \"container.revoke\",\n    parentManifestHash:\n      input.previousProjection.path.at(-2)?.manifestHash ?? null,\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: previousState.containerId,\n      keyMaterial: containerKey,\n    }),\n    containerKeyEpochId,\n    keyringHash: await computeContainerKekKeyringHash(keyring),\n    predecessorBridgeHash:\n      await computeContainerKekPredecessorBridgeHash(predecessorBridge),\n    subjectId: input.revokedSubject.subjectId,\n    subjectType: input.revokedSubject.subjectType,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: target.manifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const { manifest, manifestHash, state } = await deriveContainerRevokeManifest(\n    {\n      containerKeyPublicKey: body.containerKeyPublicKey,\n      parentManifestHash: body.parentManifestHash,\n      containerKeyEpochId,\n      eventHash,\n      previousManifest: target.manifest,\n      revokedSubject: input.revokedSubject,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: previousState.containerId,\n    containerKeyEpochId,\n    eventHash,\n    keyEpoch: nextContainerKeyEpoch,\n    manifestHash,\n    parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,\n  });\n\n  const replacementPrincipalPolicy = input.replacementPrincipalPolicy;\n  if (\n    replacementPrincipalPolicy &&\n    (replacementPrincipalPolicy.principalType !==\n      input.revokedSubject.subjectType ||\n      replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)\n  ) {\n    throw new Error(\"Container revoke replacement principal does not match\");\n  }\n  const currentPrincipalPolicies = replacementPrincipalPolicy\n    ? principalPolicies.filter(\n        (policy) =>\n          policy.principalType !== replacementPrincipalPolicy.principalType ||\n          policy.principalId !== replacementPrincipalPolicy.principalId,\n      )\n    : principalPolicies;\n  const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n    containerKey,\n    containerKeyEpochId,\n    manifestHash,\n    operationLabel: \"Container revoke\",\n    parentKek,\n    parentPublicKey,\n    principalPolicies: currentPrincipalPolicies,\n    resolveUserKey: resolveProjectionUserKey,\n    state,\n  });\n\n  return buildContainerRevokePlanResult({\n    body,\n    containerId: previousState.containerId,\n    containerKey,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyring,\n    manifest,\n    manifestHash,\n    parentKek,\n    predecessorBridge,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies: currentPrincipalPolicies,\n    state,\n    userRecipientKeys,\n    wraps,\n  });\n}\n\nexport async function revokeRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  apiClient: ContainerRevokeApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  revokedSubject: ContainerRevokeSubject;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerRevokePlan;\n  response: ContainerRotationResponse;\n} | null> {\n  const previousProjection = await input.apiClient.getContainerWriterProjection(\n    input.containerId,\n  );\n  if (!previousProjection) {\n    return null;\n  }\n\n  const materializedPlan = await buildMaterializedContainerRevokePlan({\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    revokedSubject: input.revokedSubject,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    carriedRekeys: {\n      planning: {\n        apiClient: input.apiClient,\n        author: input.author,\n        execSql: input.execSql,\n        knownContainerKeks: new Map([\n          [\n            materializedPlan.plan.containerKeyEpochId,\n            materializedPlan.containerKey,\n          ],\n        ]),\n        resolveProjectionUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        targetSecretKey: input.targetSecretKey,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      rotated: () =>\n        containerWriterProjectionFromRotationPlan({\n          plan: materializedPlan.plan,\n          previousProjection,\n        }),\n    },\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: (carried) => {\n      const request = carried.length\n        ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n        : materializedPlan.plan.request;\n      const options = {\n        expectedPaymentRequiredOrganizationId: input.author.organizationId,\n      };\n      const { revokeContainerResult } = input.apiClient;\n      return submitContainerRotation({\n        plain: () =>\n          input.apiClient.revokeContainer(input.containerId, request, options),\n        result: revokeContainerResult\n          ? () =>\n              revokeContainerResult.call(\n                input.apiClient,\n                input.containerId,\n                request,\n                { ...options, reportErrors: false },\n              )\n          : undefined,\n      });\n    },\n  });\n}\n"]}

package/workflows/containers/child/revokeManifest.d.ts

@@ -0,0 +1,12 @@
+import type { ContainerDirectGrant } from "../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerRevokePlan } from "../../../data/containers/shared/types.js";
+export type ContainerRevokeSubject = Pick<ContainerDirectGrant, "subjectId" | "subjectType">;
+export declare function deriveContainerRevokeManifest(input: {
+    containerKeyEpochId: string;
+    parentManifestHash: string | null;
+    containerKeyPublicKey: string | null;
+    eventHash: string;
+    previousManifest: ContainerWriterProjectionResponse["path"][number];
+    revokedSubject: ContainerRevokeSubject;
+}): Promise<Pick<ContainerRevokePlan, "manifest" | "manifestHash" | "state">>;

package/workflows/containers/child/revokeManifest.js

@@ -0,0 +1,48 @@
+import { computeAccessManifestHash, deriveContainerAccessManifest, } from "../../../internal/crypto/index.js";
+import { readContainerState } from "../../../data/containers/shared/projection.js";
+function isSameContainerGrantSubject(left, right) {
+    return (left.subjectType === right.subjectType && left.subjectId === right.subjectId);
+}
+function isSameReferencedPrincipalSubject(head, revokedSubject) {
+    return (head.principalType === revokedSubject.subjectType &&
+        head.principalId === revokedSubject.subjectId);
+}
+function removeContainerGrant(grants, revokedSubject) {
+    return grants.filter((grant) => !isSameContainerGrantSubject(grant, revokedSubject));
+}
+function removeReferencedPrincipalHead(principalHeads, revokedSubject) {
+    if (revokedSubject.subjectType === "user") {
+        return principalHeads;
+    }
+    return principalHeads.filter((head) => !isSameReferencedPrincipalSubject(head, revokedSubject));
+}
+function requireRevokedGrantExists(input) {
+    if (!input.previousState.directGrants.some((grant) => isSameContainerGrantSubject(grant, input.revokedSubject))) {
+        throw new Error("Container grant is not present");
+    }
+}
+export async function deriveContainerRevokeManifest(input) {
+    const previousState = readContainerState(input.previousManifest);
+    requireRevokedGrantExists({
+        previousState,
+        revokedSubject: input.revokedSubject,
+    });
+    const state = {
+        ...previousState,
+        parentManifestHash: input.parentManifestHash,
+        containerKeyPublicKey: input.containerKeyPublicKey,
+        epoch: previousState.epoch + 1,
+        previousManifestHash: input.previousManifest.manifestHash,
+        eventHash: input.eventHash,
+        containerKeyEpochId: input.containerKeyEpochId,
+        directGrants: removeContainerGrant(previousState.directGrants, input.revokedSubject),
+        referencedPrincipalHeads: removeReferencedPrincipalHead(previousState.referencedPrincipalHeads, input.revokedSubject),
+    };
+    const manifest = await deriveContainerAccessManifest(state);
+    return {
+        manifest,
+        manifestHash: await computeAccessManifestHash(manifest),
+        state,
+    };
+}
+//# sourceMappingURL=revokeManifest.js.map

package/workflows/containers/child/revokeManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeManifest.js","sourceRoot":"","sources":["revokeManifest.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAQhF,SAAS,2BAA2B,CAClC,IAA6D,EAC7D,KAA8D;IAE9D,OAAO,CACL,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,IAAiC,EACjC,cAAsC;IAEtC,OAAO,CACL,IAAI,CAAC,aAAa,KAAK,cAAc,CAAC,WAAW;QACjD,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,SAAS,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,cAAsC;IAEtC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,cAAc,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,cAA6C,EAC7C,cAAsC;IAEtC,IAAI,cAAc,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,CAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gCAAgC,CAAC,IAAI,EAAE,cAAc,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAGlC;IACC,IACE,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CACzD,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAOnD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,yBAAyB,CAAC;QACxB,aAAa;QACb,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,oBAAoB,CAChC,aAAa,CAAC,YAAY,EAC1B,KAAK,CAAC,cAAc,CACrB;QACD,wBAAwB,EAAE,6BAA6B,CACrD,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,cAAc,CACrB;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantPrincipalHead,\n} from \"@tearleads/crypto\";\nimport {\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { readContainerState } from \"../../../data/containers/shared/projection\";\nimport type { ContainerRevokePlan } from \"../../../data/containers/shared/types\";\n\nexport type ContainerRevokeSubject = Pick<\n  ContainerDirectGrant,\n  \"subjectId\" | \"subjectType\"\n>;\n\nfunction isSameContainerGrantSubject(\n  left: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n  right: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n): boolean {\n  return (\n    left.subjectType === right.subjectType && left.subjectId === right.subjectId\n  );\n}\n\nfunction isSameReferencedPrincipalSubject(\n  head: ContainerGrantPrincipalHead,\n  revokedSubject: ContainerRevokeSubject,\n): boolean {\n  return (\n    head.principalType === revokedSubject.subjectType &&\n    head.principalId === revokedSubject.subjectId\n  );\n}\n\nfunction removeContainerGrant(\n  grants: readonly ContainerDirectGrant[],\n  revokedSubject: ContainerRevokeSubject,\n): ContainerDirectGrant[] {\n  return grants.filter(\n    (grant) => !isSameContainerGrantSubject(grant, revokedSubject),\n  );\n}\n\nfunction removeReferencedPrincipalHead(\n  principalHeads: ContainerGrantPrincipalHead[],\n  revokedSubject: ContainerRevokeSubject,\n): ContainerGrantPrincipalHead[] {\n  if (revokedSubject.subjectType === \"user\") {\n    return principalHeads;\n  }\n\n  return principalHeads.filter(\n    (head) => !isSameReferencedPrincipalSubject(head, revokedSubject),\n  );\n}\n\nfunction requireRevokedGrantExists(input: {\n  previousState: ContainerAccessManifestState;\n  revokedSubject: ContainerRevokeSubject;\n}): void {\n  if (\n    !input.previousState.directGrants.some((grant) =>\n      isSameContainerGrantSubject(grant, input.revokedSubject),\n    )\n  ) {\n    throw new Error(\"Container grant is not present\");\n  }\n}\n\nexport async function deriveContainerRevokeManifest(input: {\n  containerKeyEpochId: string;\n  parentManifestHash: string | null;\n  containerKeyPublicKey: string | null;\n  eventHash: string;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  revokedSubject: ContainerRevokeSubject;\n}): Promise<Pick<ContainerRevokePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  requireRevokedGrantExists({\n    previousState,\n    revokedSubject: input.revokedSubject,\n  });\n\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    parentManifestHash: input.parentManifestHash,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    containerKeyEpochId: input.containerKeyEpochId,\n    directGrants: removeContainerGrant(\n      previousState.directGrants,\n      input.revokedSubject,\n    ),\n    referencedPrincipalHeads: removeReferencedPrincipalHead(\n      previousState.referencedPrincipalHeads,\n      input.revokedSubject,\n    ),\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n"]}

package/workflows/containers/child/rotationContext.js

@@ -0,0 +1,64 @@
+import { getParentKekForTarget, getParentWrappingPublicKey, getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
+import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
+import { signedHistoryEpochIds } from "../../../data/documents/shared/containerKekPathHistory.js";
+import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+/**
+ * The projection's target with its signed lineage ids, read from the manifests
+ * this rotation's own verification recorded. Every rotation that re-seals a
+ * keyring builds its target here, so none can skip the anchor.
+ */
+export function signedRotationTarget(projection, verifiedByHash) {
+    const target = getTargetContainerContext(projection);
+    return {
+        ...target,
+        signedEpochIds: signedHistoryEpochIds({
+            headManifestHash: target.manifest.manifestHash,
+            kek: target.kek,
+            verifiedByHash,
+        }),
+    };
+}
+export function requireUnwrappedKek(keksByEpochId, kek, label) {
+    const keyMaterial = keksByEpochId.get(kek.containerKeyEpochId);
+    if (!keyMaterial) {
+        throw new Error(`${label} KEK could not be unwrapped`);
+    }
+    return keyMaterial;
+}
+/**
+ * The shared rotation prologue for rekey and revoke: unwrap the projection's
+ * KEK path, require the predecessor key, check the author's organization, and
+ * surface the authenticated parent public key when one exists.
+ */
+export async function resolveRotationContext(input, operationLabel) {
+    // The target may need repair, but wrapping its successor requires a current parent prefix.
+    assertContainerKekPathCurrent(input.previousProjection.containerKeks.slice(0, -1));
+    const verifiedByHash = new Map();
+    const keksByEpochId = await unwrapContainerKekPath({
+        execSql: input.execSql,
+        knownContainerKeks: input.knownContainerKeks,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        secretKey: input.targetSecretKey,
+        verifiedByHash,
+        ...projectionVerificationOptions(input),
+    });
+    const target = signedRotationTarget(input.previousProjection, verifiedByHash);
+    const predecessorContainerKey = requireUnwrappedKek(keksByEpochId, target.kek, `Container ${operationLabel} predecessor`);
+    const previousState = readContainerState(target.manifest);
+    if (previousState.organizationId !== input.author.organizationId) {
+        throw new Error(`Container ${operationLabel} author organization mismatch`);
+    }
+    const parentKek = getParentKekForTarget(input.previousProjection);
+    const parentPublicKey = getParentWrappingPublicKey(input.previousProjection);
+    return {
+        parentKek,
+        parentPublicKey,
+        predecessorContainerKey,
+        previousState,
+        target,
+    };
+}
+//# sourceMappingURL=rotationContext.js.map

package/workflows/containers/child/rotationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotationContext.js","sourceRoot":"","sources":["rotationContext.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAiBrF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA6C,EAC7C,cAAoE;IAEpE,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,qBAAqB,CAAC;YACpC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,cAAc;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,aAA8C,EAC9C,GAAsD,EACtD,KAAa;IAEb,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAkBC,EACD,cAAsB;IAQtB,2FAA2F;IAC3F,6BAA6B,CAC3B,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,uBAAuB,GAAG,mBAAmB,CACjD,aAAa,EACb,MAAM,CAAC,GAAG,EACV,aAAa,cAAc,cAAc,CAC1C,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,aAAa,cAAc,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7E,OAAO;QACL,SAAS;QACT,eAAe;QACf,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  getParentKekForTarget,\n  getParentWrappingPublicKey,\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { signedHistoryEpochIds } from \"../../../data/documents/shared/containerKekPathHistory\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/**\n * A rotation's target container, with the epoch ids its verified lineage\n * names wherever the projection served it; the re-sealed keyring is anchored\n * to them (#2365 finding 32).\n */\nexport type SignedRotationTarget = ReturnType<\n  typeof getTargetContainerContext\n> & { readonly signedEpochIds: ReadonlySet<string> };\n\n/**\n * The projection's target with its signed lineage ids, read from the manifests\n * this rotation's own verification recorded. Every rotation that re-seals a\n * keyring builds its target here, so none can skip the anchor.\n */\nexport function signedRotationTarget(\n  projection: ContainerWriterProjectionResponse,\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): SignedRotationTarget {\n  const target = getTargetContainerContext(projection);\n  return {\n    ...target,\n    signedEpochIds: signedHistoryEpochIds({\n      headManifestHash: target.manifest.manifestHash,\n      kek: target.kek,\n      verifiedByHash,\n    }),\n  };\n}\n\nexport function requireUnwrappedKek(\n  keksByEpochId: ReadonlyMap<string, Uint8Array>,\n  kek: Pick<ContainerKekResponse, \"containerKeyEpochId\">,\n  label: string,\n): Uint8Array {\n  const keyMaterial = keksByEpochId.get(kek.containerKeyEpochId);\n  if (!keyMaterial) {\n    throw new Error(`${label} KEK could not be unwrapped`);\n  }\n  return keyMaterial;\n}\n\n/**\n * The shared rotation prologue for rekey and revoke: unwrap the projection's\n * KEK path, require the predecessor key, check the author's organization, and\n * surface the authenticated parent public key when one exists.\n */\nexport async function resolveRotationContext(\n  input: {\n    author: ContainerMutationAuthor;\n    execSql: ExecSql;\n    /**\n     * Keys of epochs the projection names that no wrap on it opens for this\n     * signer yet: the ones a batch minted above and has not committed.\n     */\n    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    previousProjection: ContainerWriterProjectionResponse;\n    /** Verified policies the path may cite before they are stored locally. */\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    resolveProjectionUserKey: ProjectionUserKeyResolver;\n    stillCurrent?: (() => boolean) | undefined;\n    targetSecretKey: Uint8Array;\n    warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  },\n  operationLabel: string,\n): Promise<{\n  parentKek: ReturnType<typeof getParentKekForTarget>;\n  parentPublicKey: string | null;\n  predecessorContainerKey: Uint8Array;\n  previousState: ReturnType<typeof readContainerState>;\n  target: SignedRotationTarget;\n}> {\n  // The target may need repair, but wrapping its successor requires a current parent prefix.\n  assertContainerKekPathCurrent(\n    input.previousProjection.containerKeks.slice(0, -1),\n  );\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    ...projectionVerificationOptions(input),\n  });\n  const target = signedRotationTarget(input.previousProjection, verifiedByHash);\n  const predecessorContainerKey = requireUnwrappedKek(\n    keksByEpochId,\n    target.kek,\n    `Container ${operationLabel} predecessor`,\n  );\n  const previousState = readContainerState(target.manifest);\n  if (previousState.organizationId !== input.author.organizationId) {\n    throw new Error(`Container ${operationLabel} author organization mismatch`);\n  }\n\n  const parentKek = getParentKekForTarget(input.previousProjection);\n  const parentPublicKey = getParentWrappingPublicKey(input.previousProjection);\n  return {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  };\n}\n"]}

package/workflows/containers/child/rotationPrincipalPolicies.js

@@ -0,0 +1,19 @@
+import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification.js";
+/**
+ * Shared by rekey and revoke. Lives apart from both: background descendant
+ * repair imports the rekey planner, and revoke schedules that repair, so
+ * declaring this in revoke would close a dependency cycle.
+ */
+export async function collectContainerRevokePrincipalPolicies(input) {
+    return uniquePrincipalPolicies(await collectContainerWriterProjectionPrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        resolveUserKey: input.resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    }));
+}
+//# sourceMappingURL=rotationPrincipalPolicies.js.map

package/workflows/containers/child/rotationPrincipalPolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotationPrincipalPolicies.js","sourceRoot":"","sources":["rotationPrincipalPolicies.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAGpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAQ7D;IACC,OAAO,uBAAuB,CAC5B,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/**\n * Shared by rekey and revoke. Lives apart from both: background descendant\n * repair imports the rekey planner, and revoke schedules that repair, so\n * declaring this in revoke would close a dependency cycle.\n */\nexport async function collectContainerRevokePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  return uniquePrincipalPolicies(\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  );\n}\n"]}

package/workflows/containers/child/rotationWraps.js

@@ -0,0 +1,85 @@
+import { wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, wrapContainerKeyToRootUser, } from "../../../data/containers/shared/projection.js";
+function findPrincipalPolicy(input) {
+    const policy = input.principalPolicies.find((candidate) => candidate.principalType === input.reference.principalType &&
+        candidate.principalId === input.reference.principalId &&
+        candidate.version === input.reference.version &&
+        candidate.keyEpoch === input.reference.keyEpoch &&
+        candidate.stateHash === input.reference.stateHash);
+    if (!policy) {
+        // Invariant, not a recoverable state: the API commits a container head
+        // only when every referenced group head equals the group's current state
+        // (packages/api groupReferenceHeads.ts), and a group change that would
+        // leave a grant stale is refused unless it rematerializes that container
+        // in the same transaction (principalContainerRematerialization.ts). A
+        // verified projection therefore always carries the policy its manifest
+        // references; a miss means the caller resolved policies for a different
+        // head than the manifest it is rotating.
+        throw new Error(`${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`);
+    }
+    return policy;
+}
+function referenceForManagedGrant(input) {
+    const reference = input.state.referencedPrincipalHeads.find((candidate) => candidate.principalType === input.grant.subjectType &&
+        candidate.principalId === input.grant.subjectId);
+    if (reference?.principalType !== "group") {
+        throw new Error(`${input.operationLabel} referenced principal head is missing`);
+    }
+    return { ...reference, principalType: "group" };
+}
+export async function buildContainerRotationWraps(input) {
+    const userRecipientKeys = [];
+    const wraps = [];
+    if (input.parentKek) {
+        if (!input.parentPublicKey) {
+            throw new Error(`${input.operationLabel} parent wrapping public key is missing`);
+        }
+        wraps.push(await wrapContainerKeyToParent({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            parentKek: input.parentKek,
+            parentPublicKey: input.parentPublicKey,
+        }));
+    }
+    for (const grant of input.state.directGrants) {
+        if (grant.subjectType === "user") {
+            const userKey = await input.resolveUserKey(grant.subjectId);
+            if (!userKey) {
+                throw new Error(`${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`);
+            }
+            const recipient = await wrapContainerKeyToRootUser({
+                containerKey: input.containerKey,
+                containerKeyEpochId: input.containerKeyEpochId,
+                manifestHash: input.manifestHash,
+                recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,
+                userId: grant.subjectId,
+            });
+            userRecipientKeys.push(recipient.userRecipientKey);
+            wraps.push(recipient.wrap);
+            continue;
+        }
+        const reference = referenceForManagedGrant({
+            grant,
+            operationLabel: input.operationLabel,
+            state: input.state,
+        });
+        const policy = findPrincipalPolicy({
+            operationLabel: input.operationLabel,
+            principalPolicies: input.principalPolicies,
+            reference,
+        });
+        const recipient = await wrapContainerKeyToManagedPrincipal({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,
+            principalHead: reference,
+        });
+        wraps.push(recipient.wrap);
+    }
+    return {
+        userRecipientKeys: userRecipientKeys.sort((left, right) => left.userId.localeCompare(right.userId)),
+        wraps: wraps.sort((left, right) => `${left.recipientKind}:${left.recipientId}`.localeCompare(`${right.recipientKind}:${right.recipientId}`)),
+    };
+}
+//# sourceMappingURL=rotationWraps.js.map

package/workflows/containers/child/rotationWraps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotationWraps.js","sourceRoot":"","sources":["rotationWraps.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAGpD,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CACzC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa;QACzD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW;QACrD,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO;QAC7C,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC,QAAQ;QAC/C,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CACpD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,eAAe,KAAK,CAAC,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,SAAS,CAAC,OAAO,eAAe,KAAK,CAAC,SAAS,CAAC,QAAQ,sHAAsH,CACtS,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAIjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACzD,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QACnD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAClD,CAAC;IACF,IAAI,SAAS,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,uCAAuC,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAUjD;IAIC,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,wCAAwC,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,MAAM,wBAAwB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,mDAAmD,KAAK,CAAC,SAAS,EAAE,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;gBACjD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,OAAO,CAAC,sBAAsB;gBAC/D,MAAM,EAAE,KAAK,CAAC,SAAS;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;YACpE,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC;QACD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,CACvD,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAC9C,CACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantPrincipalHead,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\n\nfunction findPrincipalPolicy(input: {\n  operationLabel: string;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  reference: ReferencedPrincipalHead;\n}): VerifiedPrincipalPolicy {\n  const policy = input.principalPolicies.find(\n    (candidate) =>\n      candidate.principalType === input.reference.principalType &&\n      candidate.principalId === input.reference.principalId &&\n      candidate.version === input.reference.version &&\n      candidate.keyEpoch === input.reference.keyEpoch &&\n      candidate.stateHash === input.reference.stateHash,\n  );\n  if (!policy) {\n    // Invariant, not a recoverable state: the API commits a container head\n    // only when every referenced group head equals the group's current state\n    // (packages/api groupReferenceHeads.ts), and a group change that would\n    // leave a grant stale is refused unless it rematerializes that container\n    // in the same transaction (principalContainerRematerialization.ts). A\n    // verified projection therefore always carries the policy its manifest\n    // references; a miss means the caller resolved policies for a different\n    // head than the manifest it is rotating.\n    throw new Error(\n      `${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`,\n    );\n  }\n  return policy;\n}\n\nfunction referenceForManagedGrant(input: {\n  grant: ContainerDirectGrant;\n  operationLabel: string;\n  state: ContainerAccessManifestState;\n}): ContainerGrantPrincipalHead {\n  const reference = input.state.referencedPrincipalHeads.find(\n    (candidate) =>\n      candidate.principalType === input.grant.subjectType &&\n      candidate.principalId === input.grant.subjectId,\n  );\n  if (reference?.principalType !== \"group\") {\n    throw new Error(\n      `${input.operationLabel} referenced principal head is missing`,\n    );\n  }\n  return { ...reference, principalType: \"group\" };\n}\n\nexport async function buildContainerRotationWraps(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  operationLabel: string;\n  parentKek: ContainerKekResponse | null;\n  parentPublicKey: string | null;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  state: ContainerAccessManifestState;\n}): Promise<{\n  readonly userRecipientKeys: ContainerUserRecipientKey[];\n  readonly wraps: ContainerKeyWrap[];\n}> {\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n  const wraps: ContainerKeyWrap[] = [];\n  if (input.parentKek) {\n    if (!input.parentPublicKey) {\n      throw new Error(\n        `${input.operationLabel} parent wrapping public key is missing`,\n      );\n    }\n    wraps.push(\n      await wrapContainerKeyToParent({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        parentKek: input.parentKek,\n        parentPublicKey: input.parentPublicKey,\n      }),\n    );\n  }\n\n  for (const grant of input.state.directGrants) {\n    if (grant.subjectType === \"user\") {\n      const userKey = await input.resolveUserKey(grant.subjectId);\n      if (!userKey) {\n        throw new Error(\n          `${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`,\n        );\n      }\n      const recipient = await wrapContainerKeyToRootUser({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,\n        userId: grant.subjectId,\n      });\n      userRecipientKeys.push(recipient.userRecipientKey);\n      wraps.push(recipient.wrap);\n      continue;\n    }\n\n    const reference = referenceForManagedGrant({\n      grant,\n      operationLabel: input.operationLabel,\n      state: input.state,\n    });\n    const policy = findPrincipalPolicy({\n      operationLabel: input.operationLabel,\n      principalPolicies: input.principalPolicies,\n      reference,\n    });\n    const recipient = await wrapContainerKeyToManagedPrincipal({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,\n      principalHead: reference,\n    });\n    wraps.push(recipient.wrap);\n  }\n\n  return {\n    userRecipientKeys: userRecipientKeys.sort((left, right) =>\n      left.userId.localeCompare(right.userId),\n    ),\n    wraps: wraps.sort((left, right) =>\n      `${left.recipientKind}:${left.recipientId}`.localeCompare(\n        `${right.recipientKind}:${right.recipientId}`,\n      ),\n    ),\n  };\n}\n"]}

package/workflows/containers/child/share.d.ts

@@ -0,0 +1,65 @@
+import type { ContainerAccessLevel, SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, ContainerShareApi, ContainerSharePlan } from "../../../data/containers/shared/types.js";
+import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { type TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { GroupPolicyNameReader } from "../../organizations/principalPolicyRequest.js";
+import { type ContainerManagedPrincipalShareApi } from "./sharePrincipalPolicy.js";
+export declare function shareRemoteContainer(input: {
+    reportSecurityIncident: SecurityIncidentReporter;
+    accessLevel: ContainerAccessLevel;
+    apiClient: ContainerShareApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    previousProjection?: ContainerWriterProjectionResponse | undefined;
+    recipientUserId: string;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<{
+    containerKey: Uint8Array;
+    plan: ContainerSharePlan;
+    response: ContainerMutationResponse;
+} | null>;
+interface RemoteContainerGroupShareInput {
+    reportSecurityIncident: SecurityIncidentReporter;
+    accessLevel: ContainerAccessLevel;
+    apiClient: ContainerManagedPrincipalShareApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    /**
+     * The display name the user chose the group by, checked against the name
+     * committed in the verified group policy so a relabeled read-model row
+     * cannot redirect the share onto another group. `null` is reserved for the
+     * grant-preserving re-wrap: a share that would mint a new grant without a
+     * name is refused.
+     */
+    expectedGroupName: string | null;
+    readEncryptedName?: GroupPolicyNameReader | undefined;
+    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    previousProjection?: ContainerWriterProjectionResponse | undefined;
+    recipientGroupId: string;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    signedAt?: string | undefined;
+    signingKeyPair?: SigningKeyPair | null | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+interface RemoteContainerGroupShareResult {
+    containerKey: Uint8Array;
+    plan: ContainerSharePlan;
+    response: ContainerMutationResponse;
+}
+export declare function shareRemoteContainerWithGroup(input: RemoteContainerGroupShareInput): Promise<RemoteContainerGroupShareResult | null>;
+export {};