@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/containers/child/share.js

@@ -0,0 +1,265 @@
+import { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { principalPolicyCacheForVerifiedPolicies } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { savePrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { requireTrustedUserIdentityResolver, } from "../../../data/trustedUserIdentity/index.js";
+import { createGroupMetadataAccess } from "../../organizations/groupMetadataAccess.js";
+import { createGroupMetadataContainerVerifier } from "../../organizations/groupMetadataContainerAuthority.js";
+import { preparePrincipalContainerRematerializationBatch } from "../../organizations/principalContainerRematerialization.js";
+import { setOrganizationGroupContainerGrant } from "../../organizations/principalPolicy.js";
+import { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "./mutationSubmit.js";
+import { projectionWithCurrentAncestors } from "./shareAncestorRepair.js";
+import { buildMaterializedContainerSharePlan } from "./shareMaterialization.js";
+import { advanceVerifiedSharePolicies, loadVerifiedGroupSharePrincipalPolicy, } from "./sharePrincipalPolicy.js";
+class ContainerShareGenerationExpiredError extends Error {
+}
+async function buildCurrentContainerSharePlan(input) {
+    return nullOnProjectionVerificationCancellation(() => buildMaterializedContainerSharePlan(input));
+}
+/** The container's projection, with any lazily stale chain above it repaired. */
+async function resolveShareProjection(input, resolveProjectionUserKey) {
+    const servedProjection = input.previousProjection ??
+        (await input.apiClient.getContainerWriterProjection(input.containerId));
+    if (!servedProjection || input.stillCurrent?.() === false)
+        return null;
+    const previousProjection = await projectionWithCurrentAncestors({
+        ...input,
+        previousProjection: servedProjection,
+        resolveProjectionUserKey,
+    });
+    return input.stillCurrent?.() === false ? null : previousProjection;
+}
+export async function shareRemoteContainer(input) {
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container share");
+    const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(input.resolveTrustedUserIdentity);
+    const recipientIdentity = await resolveTrustedUserIdentity(input.recipientUserId);
+    if (!recipientIdentity || input.stillCurrent?.() === false) {
+        return null;
+    }
+    const previousProjection = await resolveShareProjection(input, resolveProjectionUserKey);
+    if (!previousProjection)
+        return null;
+    const materializedPlan = await buildCurrentContainerSharePlan({
+        accessLevel: input.accessLevel,
+        author: input.author,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        previousProjection,
+        recipient: {
+            recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,
+            subjectId: input.recipientUserId,
+            subjectType: "user",
+        },
+        resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (!materializedPlan)
+        return null;
+    return submitAcknowledgedContainerMutation({
+        reportSecurityIncident: input.reportSecurityIncident,
+        recitationPolicies: [],
+        apiClient: input.apiClient,
+        author: input.author,
+        containerKey: materializedPlan.containerKey,
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+        submit: () => submitPlainContainerMutation(() => input.apiClient.shareContainer(input.containerId, materializedPlan.plan.request, {
+            expectedPaymentRequiredOrganizationId: input.author.organizationId,
+        })),
+    });
+}
+function isMaterializedContainerSharePlan(value) {
+    return value.plan.body.eventType === "container.grant";
+}
+async function prepareMissingGroupGrantMutations(input) {
+    const { currentPolicy, nextPolicy, shareInput } = input;
+    return preparePrincipalContainerRematerializationBatch({
+        reportSecurityIncident: shareInput.reportSecurityIncident,
+        apiClient: shareInput.apiClient,
+        author: shareInput.author,
+        execSql: shareInput.execSql,
+        grants: [
+            ...new Map([...currentPolicy.currentGrants, ...nextPolicy.grants].map((grant) => [grant.containerId, grant])).values(),
+        ],
+        groupId: shareInput.recipientGroupId,
+        nextPolicy,
+        resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,
+        stillCurrent: shareInput.stillCurrent,
+        targetSecretKey: shareInput.targetSecretKey,
+        warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,
+    });
+}
+async function commitMissingGroupGrantPolicy(input) {
+    const signingKeyPair = input.signingKeyPair;
+    if (!signingKeyPair) {
+        throw new Error("Container group share requires principal policy signing context");
+    }
+    const policyApi = {
+        commitOrganizationGroupPolicy: input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),
+        getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(input.apiClient),
+    };
+    let preparedTarget;
+    try {
+        const storedPolicy = await setOrganizationGroupContainerGrant({
+            accessLevel: input.accessLevel,
+            apiClient: policyApi,
+            assertCanCommit: () => {
+                if (input.stillCurrent?.() === false) {
+                    throw new ContainerShareGenerationExpiredError();
+                }
+            },
+            containerId: input.containerId,
+            execSql: input.execSql,
+            groupId: input.recipientGroupId,
+            organizationId: input.author.organizationId,
+            prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {
+                preparedTarget = await prepareMissingGroupGrantMutations({
+                    currentPolicy,
+                    nextPolicy,
+                    shareInput: input,
+                });
+                return preparedTarget;
+            },
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+            signerUserId: input.author.signerUserId,
+            signingFingerprint: input.author.signerKeyFingerprint,
+            signingKeyPair,
+        });
+        if (!preparedTarget) {
+            throw new Error("Container group share preparation is incomplete");
+        }
+        return { preparedTarget, storedPolicy };
+    }
+    catch (error) {
+        if (error instanceof ContainerShareGenerationExpiredError ||
+            isProjectionVerificationCancelledError(error)) {
+            return null;
+        }
+        throw error;
+    }
+}
+async function commitMissingGroupGrant(input) {
+    if (!input.signingKeyPair) {
+        throw new Error("Container group share requires principal policy signing context");
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    const committed = await commitMissingGroupGrantPolicy(input);
+    if (!committed)
+        return null;
+    const { preparedTarget, storedPolicy } = committed;
+    const targetIndex = preparedTarget?.plans.findIndex((planned) => planned.plan.containerId === input.containerId);
+    const response = targetIndex === undefined || targetIndex < 0
+        ? undefined
+        : storedPolicy.containerMutations[targetIndex];
+    const targetPlan = targetIndex === undefined || targetIndex < 0
+        ? undefined
+        : preparedTarget?.plans[targetIndex];
+    if (!targetPlan ||
+        !response ||
+        !isMaterializedContainerSharePlan(targetPlan)) {
+        throw new Error("Container group share acknowledgement is incomplete");
+    }
+    return {
+        containerKey: targetPlan.containerKey,
+        plan: targetPlan.plan,
+        response,
+    };
+}
+// Only a re-wrap of an existing signed grant may run without the chosen name;
+// minting a grant is exactly the operation the name binding protects.
+function assertGrantMintNamed(expectedGroupName) {
+    if (expectedGroupName === null) {
+        throw new Error("Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it");
+    }
+}
+function loadShareGroupPolicy(input) {
+    return loadVerifiedGroupSharePrincipalPolicy({
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        expectedGroupName: input.expectedGroupName ?? undefined,
+        readEncryptedName: input.readEncryptedName ??
+            createGroupMetadataAccess({
+                ...input,
+                organizationId: input.author.organizationId,
+                verifyMetadataContainer: createGroupMetadataContainerVerifier({
+                    ...input,
+                    organizationId: input.author.organizationId,
+                    stillCurrent: input.stillCurrent ?? (() => true),
+                }),
+            }).readName,
+        groupId: input.recipientGroupId,
+        organizationId: input.author.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+}
+export async function shareRemoteContainerWithGroup(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container share");
+    const previousProjection = await resolveShareProjection(input, resolveProjectionUserKey);
+    if (!previousProjection)
+        return null;
+    const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);
+    if (input.stillCurrent?.() === false)
+        return null;
+    await advanceVerifiedSharePolicies(input.execSql, verifiedPrincipalPolicy, input.stillCurrent);
+    if (input.stillCurrent?.() === false)
+        return null;
+    const signedGrant = verifiedPrincipalPolicy.policy.grants.find((grant) => grant.containerId === input.containerId);
+    if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {
+        assertGrantMintNamed(input.expectedGroupName);
+        return commitMissingGroupGrant(input);
+    }
+    const materializedPlan = await buildCurrentContainerSharePlan({
+        accessLevel: input.accessLevel,
+        author: input.author,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        knownContainerKeks: input.knownContainerKeks,
+        principalPolicyCache: principalPolicyCacheForVerifiedPolicies(verifiedPrincipalPolicy.checkpointPolicies),
+        previousProjection,
+        recipient: {
+            principalPolicy: verifiedPrincipalPolicy.policy,
+            subjectId: input.recipientGroupId,
+            subjectType: "group",
+        },
+        resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (!materializedPlan)
+        return null;
+    const result = await submitAcknowledgedContainerMutation({
+        reportSecurityIncident: input.reportSecurityIncident,
+        recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,
+        apiClient: input.apiClient,
+        author: input.author,
+        containerKey: materializedPlan.containerKey,
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+        submit: () => submitPlainContainerMutation(() => input.apiClient.shareContainer(input.containerId, materializedPlan.plan.request, {
+            expectedPaymentRequiredOrganizationId: input.author.organizationId,
+        })),
+    });
+    if (!result)
+        return null;
+    // Keep the previously cached group epoch available until the old container
+    // wrap has been unwrapped and the replacement has committed. Root has no
+    // parent fallback, so caching the rotated policy any earlier destroys the
+    // only local path to the KEK that must be re-wrapped.
+    if (input.stillCurrent?.() !== false) {
+        await savePrincipalPolicyBundle(input.execSql, verifiedPrincipalPolicy.bundle, new Date().toISOString(), input.author.organizationId, { stillCurrent: input.stillCurrent });
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    return result;
+}
+//# sourceMappingURL=share.js.map

package/workflows/containers/child/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["share.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,sCAAsC,EACtC,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uCAAuC,EAAE,MAAM,iEAAiE,CAAC;AAC1H,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,EACL,kCAAkC,GAEnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC3G,OAAO,EAAE,+CAA+C,EAAE,MAAM,yDAAyD,CAAC;AAC1H,OAAO,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAC;AAEzF,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAE5B,qCAAqC,GACtC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,oCAAqC,SAAQ,KAAK;CAAG;AAE3D,KAAK,UAAU,8BAA8B,CAC3C,KAAgE;IAEhE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,mCAAmC,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,sBAAsB,CACnC,KAG0E,EAC1E,wBAAmD;IAEnD,MAAM,gBAAgB,GACpB,KAAK,CAAC,kBAAkB;QACxB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAAC;QAC9D,GAAG,KAAK;QACR,kBAAkB,EAAE,gBAAgB;QACpC,wBAAwB;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAgB1C;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,SAAS,EAAE;YACT,+BAA+B,EAAE,iBAAiB,CAAC,sBAAsB;YACzE,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,WAAW,EAAE,MAAM;SACpB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;AACL,CAAC;AAqCD,SAAS,gCAAgC,CACvC,KAEkB;IAElB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAIhD;IACC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,+CAA+C,CAAC;QACrD,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACxD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,UAAU,CAAC,gBAAgB;QACpC,UAAU;QACV,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAOrC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,6BAA6B,EAC3B,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACrE,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CACvE,KAAK,CAAC,SAAS,CAChB;KACF,CAAC;IACF,IAAI,cAIS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;YAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,GAAG,EAAE;gBACpB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;oBACrC,MAAM,IAAI,oCAAoC,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,yBAAyB,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;gBACjE,cAAc,GAAG,MAAM,iCAAiC,CAAC;oBACvD,aAAa;oBACb,UAAU;oBACV,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,oCAAoC;YACrD,sCAAsC,CAAC,KAAK,CAAC,EAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnD,MAAM,WAAW,GAAG,cAAc,EAAE,KAAK,CAAC,SAAS,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,CAAC;IACF,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,UAAU,GACd,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,IACE,CAAC,UAAU;QACX,CAAC,QAAQ;QACT,CAAC,gCAAgC,CAAC,UAAU,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,iBAAgC;IAC5D,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAqC;IACjE,OAAO,qCAAqC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;QACvD,iBAAiB,EACf,KAAK,CAAC,iBAAiB;YACvB,yBAAyB,CAAC;gBACxB,GAAG,KAAK;gBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,uBAAuB,EAAE,oCAAoC,CAAC;oBAC5D,GAAG,KAAK;oBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;iBACjD,CAAC;aACH,CAAC,CAAC,QAAQ;QACb,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAqC;IAErC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,uBAAuB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,uBAAuB,EACvB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,oBAAoB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9C,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,uCAAuC,CAC3D,uBAAuB,CAAC,kBAAkB,CAC3C;QACD,kBAAkB;QAClB,SAAS,EAAE;YACT,eAAe,EAAE,uBAAuB,CAAC,MAAM;YAC/C,SAAS,EAAE,KAAK,CAAC,gBAAgB;YACjC,WAAW,EAAE,OAAO;SACrB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;QACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,uBAAuB,CAAC,kBAAkB;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,sDAAsD;IACtD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,uBAAuB,CAAC,MAAM,EAC9B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerShareApi,\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { savePrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../../data/trustedUserIdentity\";\nimport { createGroupMetadataAccess } from \"../../organizations/groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"../../organizations/groupMetadataContainerAuthority\";\nimport { preparePrincipalContainerRematerializationBatch } from \"../../organizations/principalContainerRematerialization\";\nimport { setOrganizationGroupContainerGrant } from \"../../organizations/principalPolicy\";\nimport type { GroupPolicyNameReader } from \"../../organizations/principalPolicyRequest\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"./mutationSubmit\";\nimport { projectionWithCurrentAncestors } from \"./shareAncestorRepair\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport {\n  advanceVerifiedSharePolicies,\n  type ContainerManagedPrincipalShareApi,\n  loadVerifiedGroupSharePrincipalPolicy,\n} from \"./sharePrincipalPolicy\";\n\nclass ContainerShareGenerationExpiredError extends Error {}\n\nasync function buildCurrentContainerSharePlan(\n  input: Parameters<typeof buildMaterializedContainerSharePlan>[0],\n): Promise<MaterializedContainerSharePlan | null> {\n  return nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerSharePlan(input),\n  );\n}\n\n/** The container's projection, with any lazily stale chain above it repaired. */\nasync function resolveShareProjection(\n  input: Omit<\n    Parameters<typeof projectionWithCurrentAncestors>[0],\n    \"previousProjection\" | \"resolveProjectionUserKey\"\n  > & { previousProjection?: ContainerWriterProjectionResponse | undefined },\n  resolveProjectionUserKey: ProjectionUserKeyResolver,\n): Promise<ContainerWriterProjectionResponse | null> {\n  const servedProjection =\n    input.previousProjection ??\n    (await input.apiClient.getContainerWriterProjection(input.containerId));\n  if (!servedProjection || input.stillCurrent?.() === false) return null;\n  const previousProjection = await projectionWithCurrentAncestors({\n    ...input,\n    previousProjection: servedProjection,\n    resolveProjectionUserKey,\n  });\n  return input.stillCurrent?.() === false ? null : previousProjection;\n}\n\nexport async function shareRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const recipientIdentity = await resolveTrustedUserIdentity(\n    input.recipientUserId,\n  );\n  if (!recipientIdentity || input.stillCurrent?.() === false) {\n    return null;\n  }\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    recipient: {\n      recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,\n      subjectId: input.recipientUserId,\n      subjectType: \"user\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n}\n\ninterface RemoteContainerGroupShareInput {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerManagedPrincipalShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /**\n   * The display name the user chose the group by, checked against the name\n   * committed in the verified group policy so a relabeled read-model row\n   * cannot redirect the share onto another group. `null` is reserved for the\n   * grant-preserving re-wrap: a share that would mint a new grant without a\n   * name is refused.\n   */\n  expectedGroupName: string | null;\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\ninterface RemoteContainerGroupShareResult {\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n}\n\nfunction isMaterializedContainerSharePlan(\n  value: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >[\"plans\"][number],\n): value is MaterializedContainerSharePlan {\n  return value.plan.body.eventType === \"container.grant\";\n}\n\nasync function prepareMissingGroupGrantMutations(input: {\n  currentPolicy: PrincipalPolicyBundleResponse;\n  nextPolicy: VerifiedPrincipalPolicy;\n  shareInput: RemoteContainerGroupShareInput;\n}) {\n  const { currentPolicy, nextPolicy, shareInput } = input;\n  return preparePrincipalContainerRematerializationBatch({\n    reportSecurityIncident: shareInput.reportSecurityIncident,\n    apiClient: shareInput.apiClient,\n    author: shareInput.author,\n    execSql: shareInput.execSql,\n    grants: [\n      ...new Map(\n        [...currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: shareInput.recipientGroupId,\n    nextPolicy,\n    resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,\n    stillCurrent: shareInput.stillCurrent,\n    targetSecretKey: shareInput.targetSecretKey,\n    warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,\n  });\n}\n\nasync function commitMissingGroupGrantPolicy(\n  input: RemoteContainerGroupShareInput,\n): Promise<{\n  preparedTarget: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >;\n  storedPolicy: Awaited<ReturnType<typeof setOrganizationGroupContainerGrant>>;\n} | null> {\n  const signingKeyPair = input.signingKeyPair;\n  if (!signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  const policyApi = {\n    commitOrganizationGroupPolicy:\n      input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),\n    getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(\n      input.apiClient,\n    ),\n  };\n  let preparedTarget:\n    | Awaited<\n        ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n      >\n    | undefined;\n  try {\n    const storedPolicy = await setOrganizationGroupContainerGrant({\n      accessLevel: input.accessLevel,\n      apiClient: policyApi,\n      assertCanCommit: () => {\n        if (input.stillCurrent?.() === false) {\n          throw new ContainerShareGenerationExpiredError();\n        }\n      },\n      containerId: input.containerId,\n      execSql: input.execSql,\n      groupId: input.recipientGroupId,\n      organizationId: input.author.organizationId,\n      prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {\n        preparedTarget = await prepareMissingGroupGrantMutations({\n          currentPolicy,\n          nextPolicy,\n          shareInput: input,\n        });\n        return preparedTarget;\n      },\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n      signerUserId: input.author.signerUserId,\n      signingFingerprint: input.author.signerKeyFingerprint,\n      signingKeyPair,\n    });\n    if (!preparedTarget) {\n      throw new Error(\"Container group share preparation is incomplete\");\n    }\n    return { preparedTarget, storedPolicy };\n  } catch (error) {\n    if (\n      error instanceof ContainerShareGenerationExpiredError ||\n      isProjectionVerificationCancelledError(error)\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n\nasync function commitMissingGroupGrant(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (!input.signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n  const committed = await commitMissingGroupGrantPolicy(input);\n  if (!committed) return null;\n  const { preparedTarget, storedPolicy } = committed;\n  const targetIndex = preparedTarget?.plans.findIndex(\n    (planned) => planned.plan.containerId === input.containerId,\n  );\n  const response =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : storedPolicy.containerMutations[targetIndex];\n  const targetPlan =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : preparedTarget?.plans[targetIndex];\n  if (\n    !targetPlan ||\n    !response ||\n    !isMaterializedContainerSharePlan(targetPlan)\n  ) {\n    throw new Error(\"Container group share acknowledgement is incomplete\");\n  }\n  return {\n    containerKey: targetPlan.containerKey,\n    plan: targetPlan.plan,\n    response,\n  };\n}\n\n// Only a re-wrap of an existing signed grant may run without the chosen name;\n// minting a grant is exactly the operation the name binding protects.\nfunction assertGrantMintNamed(expectedGroupName: string | null): void {\n  if (expectedGroupName === null) {\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  }\n}\n\nfunction loadShareGroupPolicy(input: RemoteContainerGroupShareInput) {\n  return loadVerifiedGroupSharePrincipalPolicy({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedGroupName: input.expectedGroupName ?? undefined,\n    readEncryptedName:\n      input.readEncryptedName ??\n      createGroupMetadataAccess({\n        ...input,\n        organizationId: input.author.organizationId,\n        verifyMetadataContainer: createGroupMetadataContainerVerifier({\n          ...input,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        }),\n      }).readName,\n    groupId: input.recipientGroupId,\n    organizationId: input.author.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function shareRemoteContainerWithGroup(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n  const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);\n  if (input.stillCurrent?.() === false) return null;\n  await advanceVerifiedSharePolicies(\n    input.execSql,\n    verifiedPrincipalPolicy,\n    input.stillCurrent,\n  );\n  if (input.stillCurrent?.() === false) return null;\n\n  const signedGrant = verifiedPrincipalPolicy.policy.grants.find(\n    (grant) => grant.containerId === input.containerId,\n  );\n  if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {\n    assertGrantMintNamed(input.expectedGroupName);\n    return commitMissingGroupGrant(input);\n  }\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    principalPolicyCache: principalPolicyCacheForVerifiedPolicies(\n      verifiedPrincipalPolicy.checkpointPolicies,\n    ),\n    previousProjection,\n    recipient: {\n      principalPolicy: verifiedPrincipalPolicy.policy,\n      subjectId: input.recipientGroupId,\n      subjectType: \"group\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  const result = await submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n  if (!result) return null;\n\n  // Keep the previously cached group epoch available until the old container\n  // wrap has been unwrapped and the replacement has committed. Root has no\n  // parent fallback, so caching the rotated policy any earlier destroys the\n  // only local path to the KEK that must be re-wrapped.\n  if (input.stillCurrent?.() !== false) {\n    await savePrincipalPolicyBundle(\n      input.execSql,\n      verifiedPrincipalPolicy.bundle,\n      new Date().toISOString(),\n      input.author.organizationId,\n      { stillCurrent: input.stillCurrent },\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n\n  return result;\n}\n"]}

package/workflows/containers/child/shareAncestorRepair.js

@@ -0,0 +1,95 @@
+import { ContainerAuthorAccessError } from "../../../data/containers/shared/authorAccess.js";
+import { ContainerKekRepairInaccessibleError } from "../../../data/documents/shared/containerKekCurrency.js";
+import { ContainerKekTargetUnreachableError } from "../../../data/documents/shared/containerKekPath.js";
+import { rekeyRemoteContainer } from "./rekeyRemote.js";
+function carriesDirectGrant(projection) {
+    const directGrants = Reflect.get(Object(projection.path.at(-1)?.state), "directGrants");
+    return Array.isArray(directGrants) && directGrants.length > 0;
+}
+/** The first level on the path, the container included, pinning a retired epoch. */
+function firstStaleLevelId(projection) {
+    const keks = projection.containerKeks;
+    for (let index = 1; index < keks.length; index += 1) {
+        const kek = keks[index];
+        if (kek &&
+            kek.parentContainerKeyEpochId !== keks[index - 1]?.containerKeyEpochId) {
+            return kek.containerId;
+        }
+    }
+    return null;
+}
+/**
+ * Repair a stale path down to and including a container before granting on it
+ * (#2340).
+ *
+ * A chain with no grant beneath it may sit lazily stale after an ancestor
+ * rotation, since nobody's writes depend on it. The first grant changes that:
+ * its grantee could never re-key the levels above its container, so the server
+ * refuses a first grant below a stale chain. The container's own edge must be
+ * current too, because a grant cites the parent's current epoch and the
+ * container's key epoch has to pin it. The sharer administers the container
+ * through a grant at or above it, and the levels above that grant are already
+ * current, so every stale level here is one the sharer can re-key. These
+ * repairs are standalone and need not be atomic with the grant: a repair never
+ * strands anyone.
+ *
+ * Every share does this, not only a first grant, which is all the server
+ * insists on. A container that already carries a grant is stale only past the
+ * carried-rekey cap, and its grantees are then parked behind exactly these
+ * levels; the sharer is already here and able.
+ */
+export async function projectionWithCurrentAncestors(input) {
+    const { rekeyContainer, rekeyContainerResult } = input.apiClient;
+    let projection = input.previousProjection;
+    // Each round repairs one level, and a path has a bounded number of them.
+    for (let round = 0; round < projection.containerKeks.length; round += 1) {
+        const staleLevelId = firstStaleLevelId(projection);
+        if (staleLevelId === null)
+            return projection;
+        if (!rekeyContainer) {
+            // Not a repair someone else owes: the adapter simply cannot make one.
+            throw new Error("Container share must re-key a stale path, which needs rekeyContainer");
+        }
+        // This sharer may be unable to re-key a level above a container that
+        // already carries a grant, stale past the carried-rekey cap. The server
+        // asks a current chain only of a first grant, so it decides rather than
+        // this blocking a grant it would accept.
+        const serverDecides = staleLevelId !== input.containerId && carriesDirectGrant(projection);
+        const repaired = await rekeyRemoteContainer({
+            apiClient: {
+                getContainerWriterProjection: (containerId) => input.apiClient.getContainerWriterProjection(containerId),
+                reciteContainer: (...args) => input.apiClient.reciteContainer(...args),
+                rekeyContainer: rekeyContainer.bind(input.apiClient),
+                ...(rekeyContainerResult
+                    ? { rekeyContainerResult: rekeyContainerResult.bind(input.apiClient) }
+                    : {}),
+            },
+            author: input.author,
+            containerId: staleLevelId,
+            execSql: input.execSql,
+            reportSecurityIncident: input.reportSecurityIncident,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            targetSecretKey: input.targetSecretKey,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        }).catch((error) => {
+            const outOfReach = error instanceof ContainerAuthorAccessError ||
+                error instanceof ContainerKekTargetUnreachableError;
+            if (outOfReach && serverDecides)
+                return null;
+            throw outOfReach
+                ? new ContainerKekRepairInaccessibleError(staleLevelId)
+                : error;
+        });
+        if (input.stillCurrent?.() === false)
+            return null;
+        if (!repaired)
+            return serverDecides ? projection : null;
+        const refreshed = await input.apiClient.getContainerWriterProjection(input.containerId);
+        if (!refreshed)
+            return null;
+        projection = refreshed;
+    }
+    return firstStaleLevelId(projection) === null ? projection : null;
+}
+//# sourceMappingURL=shareAncestorRepair.js.map

package/workflows/containers/child/shareAncestorRepair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareAncestorRepair.js","sourceRoot":"","sources":["shareAncestorRepair.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAM1F,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAOrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,SAAS,kBAAkB,CACzB,UAA6C;IAE7C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EACrC,cAAc,CACf,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,oFAAoF;AACpF,SAAS,iBAAiB,CACxB,UAA6C;IAE7C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IACE,GAAG;YACH,GAAG,CAAC,yBAAyB,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,mBAAmB,EACtE,CAAC;YACD,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAYpD;IACC,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IACjE,IAAI,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAC1C,yEAAyE;IACzE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC7C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,aAAa,GACjB,YAAY,KAAK,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,SAAS,EAAE;gBACT,4BAA4B,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5C,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC;gBAC3D,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;gBACtE,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;gBACpD,GAAG,CAAC,oBAAoB;oBACtB,CAAC,CAAC,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;oBACtE,CAAC,CAAC,EAAE,CAAC;aACR;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,YAAY;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,MAAM,UAAU,GACd,KAAK,YAAY,0BAA0B;gBAC3C,KAAK,YAAY,kCAAkC,CAAC;YACtD,IAAI,UAAU,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC;YAC7C,MAAM,UAAU;gBACd,CAAC,CAAC,IAAI,mCAAmC,CAAC,YAAY,CAAC;gBACvD,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAClE,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { ContainerAuthorAccessError } from \"../../../data/containers/shared/authorAccess\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  ContainerShareApi,\n} from \"../../../data/containers/shared/types\";\nimport { ContainerKekRepairInaccessibleError } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { ContainerKekTargetUnreachableError } from \"../../../data/documents/shared/containerKekPath\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { rekeyRemoteContainer } from \"./rekeyRemote\";\n\nfunction carriesDirectGrant(\n  projection: ContainerWriterProjectionResponse,\n): boolean {\n  const directGrants = Reflect.get(\n    Object(projection.path.at(-1)?.state),\n    \"directGrants\",\n  );\n  return Array.isArray(directGrants) && directGrants.length > 0;\n}\n\n/** The first level on the path, the container included, pinning a retired epoch. */\nfunction firstStaleLevelId(\n  projection: ContainerWriterProjectionResponse,\n): string | null {\n  const keks = projection.containerKeks;\n  for (let index = 1; index < keks.length; index += 1) {\n    const kek = keks[index];\n    if (\n      kek &&\n      kek.parentContainerKeyEpochId !== keks[index - 1]?.containerKeyEpochId\n    ) {\n      return kek.containerId;\n    }\n  }\n  return null;\n}\n\n/**\n * Repair a stale path down to and including a container before granting on it\n * (#2340).\n *\n * A chain with no grant beneath it may sit lazily stale after an ancestor\n * rotation, since nobody's writes depend on it. The first grant changes that:\n * its grantee could never re-key the levels above its container, so the server\n * refuses a first grant below a stale chain. The container's own edge must be\n * current too, because a grant cites the parent's current epoch and the\n * container's key epoch has to pin it. The sharer administers the container\n * through a grant at or above it, and the levels above that grant are already\n * current, so every stale level here is one the sharer can re-key. These\n * repairs are standalone and need not be atomic with the grant: a repair never\n * strands anyone.\n *\n * Every share does this, not only a first grant, which is all the server\n * insists on. A container that already carries a grant is stale only past the\n * carried-rekey cap, and its grantees are then parked behind exactly these\n * levels; the sharer is already here and able.\n */\nexport async function projectionWithCurrentAncestors(input: {\n  apiClient: ContainerShareApi &\n    Partial<Pick<ContainerRekeyApi, \"rekeyContainer\" | \"rekeyContainerResult\">>;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  execSql: ExecSql;\n  previousProjection: ContainerWriterProjectionResponse;\n  reportSecurityIncident: SecurityIncidentReporter;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<ContainerWriterProjectionResponse | null> {\n  const { rekeyContainer, rekeyContainerResult } = input.apiClient;\n  let projection = input.previousProjection;\n  // Each round repairs one level, and a path has a bounded number of them.\n  for (let round = 0; round < projection.containerKeks.length; round += 1) {\n    const staleLevelId = firstStaleLevelId(projection);\n    if (staleLevelId === null) return projection;\n    if (!rekeyContainer) {\n      // Not a repair someone else owes: the adapter simply cannot make one.\n      throw new Error(\n        \"Container share must re-key a stale path, which needs rekeyContainer\",\n      );\n    }\n    // This sharer may be unable to re-key a level above a container that\n    // already carries a grant, stale past the carried-rekey cap. The server\n    // asks a current chain only of a first grant, so it decides rather than\n    // this blocking a grant it would accept.\n    const serverDecides =\n      staleLevelId !== input.containerId && carriesDirectGrant(projection);\n    const repaired = await rekeyRemoteContainer({\n      apiClient: {\n        getContainerWriterProjection: (containerId) =>\n          input.apiClient.getContainerWriterProjection(containerId),\n        reciteContainer: (...args) => input.apiClient.reciteContainer(...args),\n        rekeyContainer: rekeyContainer.bind(input.apiClient),\n        ...(rekeyContainerResult\n          ? { rekeyContainerResult: rekeyContainerResult.bind(input.apiClient) }\n          : {}),\n      },\n      author: input.author,\n      containerId: staleLevelId,\n      execSql: input.execSql,\n      reportSecurityIncident: input.reportSecurityIncident,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      targetSecretKey: input.targetSecretKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }).catch((error: unknown) => {\n      const outOfReach =\n        error instanceof ContainerAuthorAccessError ||\n        error instanceof ContainerKekTargetUnreachableError;\n      if (outOfReach && serverDecides) return null;\n      throw outOfReach\n        ? new ContainerKekRepairInaccessibleError(staleLevelId)\n        : error;\n    });\n    if (input.stillCurrent?.() === false) return null;\n    if (!repaired) return serverDecides ? projection : null;\n    const refreshed = await input.apiClient.getContainerWriterProjection(\n      input.containerId,\n    );\n    if (!refreshed) return null;\n    projection = refreshed;\n  }\n  return firstStaleLevelId(projection) === null ? projection : null;\n}\n"]}

package/workflows/containers/child/shareMaterialization.d.ts

@@ -0,0 +1,25 @@
+import type { ContainerAccessLevel } from "../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
+import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { type ContainerShareRecipient } from "./sharePlanCore.js";
+interface BuildMaterializedContainerSharePlanInput {
+    accessLevel: ContainerAccessLevel;
+    author: ContainerMutationAuthor;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    /** False for a projection re-rooted on rotations not yet acknowledged. */
+    persistVerificationCheckpoints?: boolean | undefined;
+    principalPolicyCache?: PrincipalPolicyCache | undefined;
+    previousProjection: ContainerWriterProjectionResponse;
+    recipient: ContainerShareRecipient;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+export declare function buildMaterializedContainerSharePlan(input: BuildMaterializedContainerSharePlanInput): Promise<MaterializedContainerSharePlan>;
+export {};

package/workflows/containers/child/shareMaterialization.js

@@ -0,0 +1,164 @@
+import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
+import { signContainerMutationEvent } from "../../../data/containers/shared/events.js";
+import { asContainerManifestBundle, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToRootUser, } from "../../../data/containers/shared/projection.js";
+import { readContainerKeyWraps } from "../../../data/containers/shared/readers.js";
+import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { requireUnwrappedKek } from "./rotationContext.js";
+import { buildContainerSharePlanResult, collectContainerSharePrincipalPolicies, collectShareUserRecipientKeys, deriveContainerShareManifest, referencedPrincipalHeadFromPolicy, replaceContainerWrap, shareManifestHistory, } from "./sharePlanCore.js";
+async function materializeRecipientWrap(input) {
+    if (input.recipient.subjectType === "user") {
+        const shareRecipient = await wrapContainerKeyToRootUser({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            recipientEncapsulationPublicKey: input.recipient.recipientEncapsulationPublicKey,
+            userId: input.recipient.subjectId,
+        });
+        return {
+            recipientTarget: shareRecipient.recipientTarget,
+            userRecipientKeys: collectShareUserRecipientKeys({
+                newUserRecipientKey: shareRecipient.userRecipientKey,
+                state: input.state,
+                targetKek: input.targetKek,
+            }),
+            wrap: shareRecipient.wrap,
+        };
+    }
+    const shareRecipient = await wrapContainerKeyToManagedPrincipal({
+        containerKey: input.containerKey,
+        containerKeyEpochId: input.containerKeyEpochId,
+        manifestHash: input.manifestHash,
+        principalEncapsulationPublicKey: input.recipient.principalPolicy.state.encapsulationPublicKey,
+        principalHead: referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy),
+    });
+    return {
+        recipientTarget: shareRecipient.recipientTarget,
+        userRecipientKeys: collectShareUserRecipientKeys({
+            state: input.state,
+            targetKek: input.targetKek,
+        }),
+        wrap: shareRecipient.wrap,
+    };
+}
+async function buildShareTransition(input) {
+    const previousState = readContainerState(input.targetManifest);
+    if (previousState.organizationId !== input.author.organizationId) {
+        throw new Error("Container share author organization mismatch");
+    }
+    const grant = {
+        accessLevel: input.accessLevel,
+        subjectId: input.recipient.subjectId,
+        subjectType: input.recipient.subjectType,
+    };
+    const referencedPrincipalHead = input.recipient.subjectType === "user"
+        ? null
+        : referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy);
+    const body = {
+        eventType: "container.grant",
+        containerKeyEpochId: previousState.containerKeyEpochId,
+        containerKeyPublicKey: previousState.containerKeyPublicKey,
+        grant,
+        referencedPrincipalHead,
+    };
+    const { event, eventHash } = await signContainerMutationEvent({
+        author: input.author,
+        body,
+        containerId: previousState.containerId,
+        dependencyManifestHashes: uniqueSortedManifestHashes(input.previousProjection.path),
+        eventId: input.eventId ?? crypto.randomUUID(),
+        previousManifestHash: input.targetManifest.manifestHash,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    });
+    const manifestTransition = await deriveContainerShareManifest({
+        eventHash,
+        grant,
+        previousManifest: input.targetManifest,
+        referencedPrincipalHead,
+    });
+    return {
+        body,
+        event,
+        eventHash,
+        grant,
+        previousState,
+        ...manifestTransition,
+    };
+}
+async function collectAuthorizedSharePolicies(input) {
+    const principalPolicies = await collectContainerSharePrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        previousProjection: input.previousProjection,
+        ...(input.recipient.subjectType === "user"
+            ? {}
+            : { recipientPolicy: input.recipient.principalPolicy }),
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    assertContainerAuthorAccess({
+        author: input.author,
+        projection: input.previousProjection,
+        principalPolicies,
+        minimumAccess: "admin",
+    });
+    return principalPolicies;
+}
+export async function buildMaterializedContainerSharePlan(input) {
+    const keksByEpochId = await unwrapContainerKekPath({
+        execSql: input.execSql,
+        knownContainerKeks: input.knownContainerKeks,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        secretKey: input.targetSecretKey,
+        ...projectionVerificationOptions(input),
+    });
+    const principalPolicies = await collectAuthorizedSharePolicies(input);
+    const target = getTargetContainerContext(input.previousProjection);
+    const { body, event, eventHash, grant, manifest, manifestHash, previousState, state, } = await buildShareTransition({
+        accessLevel: input.accessLevel,
+        author: input.author,
+        eventId: input.eventId,
+        previousProjection: input.previousProjection,
+        recipient: input.recipient,
+        signedAt: input.signedAt,
+        targetManifest: target.manifest,
+    });
+    const containerKey = requireUnwrappedKek(keksByEpochId, target.kek, "Container share target");
+    const { recipientTarget, userRecipientKeys, wrap } = await materializeRecipientWrap({
+        containerKey,
+        containerKeyEpochId: target.kek.containerKeyEpochId,
+        manifestHash,
+        recipient: input.recipient,
+        state,
+        targetKek: target.kek,
+    });
+    const previousWraps = readContainerKeyWraps(target.kek.wraps, "Container share previous wraps");
+    return buildContainerSharePlanResult({
+        body,
+        containerManifestHistory: shareManifestHistory({
+            containerId: previousState.containerId,
+            targetKek: target.kek,
+            targetManifest: target.manifest,
+        }),
+        containerKey,
+        containerId: previousState.containerId,
+        event,
+        eventHash,
+        grant,
+        manifest,
+        manifestHash,
+        previousManifest: asContainerManifestBundle(target.manifest),
+        previousProjection: input.previousProjection,
+        principalPolicies,
+        recipientTarget,
+        state,
+        targetKek: target.kek,
+        userRecipientKeys,
+        wraps: replaceContainerWrap(previousWraps, wrap),
+    });
+}
+//# sourceMappingURL=shareMaterialization.js.map