@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/containers/child/shareMaterialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareMaterialization.js","sourceRoot":"","sources":["shareMaterialization.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAKhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAOrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,6BAA6B,EAE7B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,KAAK,UAAU,wBAAwB,CAAC,KAOvC;IAKC,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC;YACtD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B;YACjD,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,cAAc,CAAC,eAAe;YAC/C,iBAAiB,EAAE,6BAA6B,CAAC;gBAC/C,mBAAmB,EAAE,cAAc,CAAC,gBAAgB;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YACF,IAAI,EAAE,cAAc,CAAC,IAAI;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,sBAAsB;QAC9D,aAAa,EAAE,iCAAiC,CAC9C,KAAK,CAAC,SAAS,CAAC,eAAe,CAChC;KACF,CAAC,CAAC;IACH,OAAO;QACL,eAAe,EAAE,cAAc,CAAC,eAAe;QAC/C,iBAAiB,EAAE,6BAA6B,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,EAAE,cAAc,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAoBD,KAAK,UAAU,oBAAoB,CAAC,KAQnC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAyB;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;QACpC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;KACzC,CAAC;IACF,MAAM,uBAAuB,GAC3B,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;QACpC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,KAAK;QACL,uBAAuB;KACxB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,YAAY;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,4BAA4B,CAAC;QAC5D,SAAS;QACT,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,cAAc;QACtC,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,KAAK;QACL,SAAS;QACT,KAAK;QACL,aAAa;QACb,GAAG,kBAAkB;KACtB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAA+C;IAE/C,MAAM,iBAAiB,GAAG,MAAM,sCAAsC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA+C;IAE/C,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,EACJ,IAAI,EACJ,KAAK,EACL,SAAS,EACT,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,KAAK,GACN,GAAG,MAAM,oBAAoB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAChD,MAAM,wBAAwB,CAAC;QAC7B,YAAY;QACZ,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACnD,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;KACtB,CAAC,CAAC;IACL,MAAM,aAAa,GAAG,qBAAqB,CACzC,MAAM,CAAC,GAAG,CAAC,KAAK,EAChB,gCAAgC,CACjC,CAAC;IAEF,OAAO,6BAA6B,CAAC;QACnC,IAAI;QACJ,wBAAwB,EAAE,oBAAoB,CAAC;YAC7C,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;SAChC,CAAC;QACF,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,KAAK;QACL,SAAS;QACT,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,eAAe;QACf,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,iBAAiB;QACjB,KAAK,EAAE,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerKekRecipientTarget,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  getTargetContainerContext,\n  readContainerState,\n  uniqueSortedManifestHashes,\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport { readContainerKeyWraps } from \"../../../data/containers/shared/readers\";\nimport type {\n  ContainerMutationAuthor,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\nimport {\n  buildContainerSharePlanResult,\n  type ContainerShareRecipient,\n  collectContainerSharePrincipalPolicies,\n  collectShareUserRecipientKeys,\n  deriveContainerShareManifest,\n  referencedPrincipalHeadFromPolicy,\n  replaceContainerWrap,\n  shareManifestHistory,\n} from \"./sharePlanCore\";\n\nasync function materializeRecipientWrap(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  recipient: ContainerShareRecipient;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): Promise<{\n  recipientTarget: ContainerKekRecipientTarget;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wrap: ContainerKeyWrap;\n}> {\n  if (input.recipient.subjectType === \"user\") {\n    const shareRecipient = await wrapContainerKeyToRootUser({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      recipientEncapsulationPublicKey:\n        input.recipient.recipientEncapsulationPublicKey,\n      userId: input.recipient.subjectId,\n    });\n    return {\n      recipientTarget: shareRecipient.recipientTarget,\n      userRecipientKeys: collectShareUserRecipientKeys({\n        newUserRecipientKey: shareRecipient.userRecipientKey,\n        state: input.state,\n        targetKek: input.targetKek,\n      }),\n      wrap: shareRecipient.wrap,\n    };\n  }\n\n  const shareRecipient = await wrapContainerKeyToManagedPrincipal({\n    containerKey: input.containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    manifestHash: input.manifestHash,\n    principalEncapsulationPublicKey:\n      input.recipient.principalPolicy.state.encapsulationPublicKey,\n    principalHead: referencedPrincipalHeadFromPolicy(\n      input.recipient.principalPolicy,\n    ),\n  });\n  return {\n    recipientTarget: shareRecipient.recipientTarget,\n    userRecipientKeys: collectShareUserRecipientKeys({\n      state: input.state,\n      targetKek: input.targetKek,\n    }),\n    wrap: shareRecipient.wrap,\n  };\n}\n\ninterface BuildMaterializedContainerSharePlanInput {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /** False for a projection re-rooted on rotations not yet acknowledged. */\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nasync function buildShareTransition(input: {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  signedAt?: string | undefined;\n  targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}) {\n  const previousState = readContainerState(input.targetManifest);\n  if (previousState.organizationId !== input.author.organizationId) {\n    throw new Error(\"Container share author organization mismatch\");\n  }\n  const grant: ContainerDirectGrant = {\n    accessLevel: input.accessLevel,\n    subjectId: input.recipient.subjectId,\n    subjectType: input.recipient.subjectType,\n  };\n  const referencedPrincipalHead =\n    input.recipient.subjectType === \"user\"\n      ? null\n      : referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy);\n  const body: ContainerGrantAccessEventBody = {\n    eventType: \"container.grant\",\n    containerKeyEpochId: previousState.containerKeyEpochId,\n    containerKeyPublicKey: previousState.containerKeyPublicKey,\n    grant,\n    referencedPrincipalHead,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.targetManifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const manifestTransition = await deriveContainerShareManifest({\n    eventHash,\n    grant,\n    previousManifest: input.targetManifest,\n    referencedPrincipalHead,\n  });\n  return {\n    body,\n    event,\n    eventHash,\n    grant,\n    previousState,\n    ...manifestTransition,\n  };\n}\n\nasync function collectAuthorizedSharePolicies(\n  input: BuildMaterializedContainerSharePlanInput,\n) {\n  const principalPolicies = await collectContainerSharePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    previousProjection: input.previousProjection,\n    ...(input.recipient.subjectType === \"user\"\n      ? {}\n      : { recipientPolicy: input.recipient.principalPolicy }),\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  return principalPolicies;\n}\n\nexport async function buildMaterializedContainerSharePlan(\n  input: BuildMaterializedContainerSharePlanInput,\n): Promise<MaterializedContainerSharePlan> {\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const principalPolicies = await collectAuthorizedSharePolicies(input);\n  const target = getTargetContainerContext(input.previousProjection);\n  const {\n    body,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousState,\n    state,\n  } = await buildShareTransition({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    previousProjection: input.previousProjection,\n    recipient: input.recipient,\n    signedAt: input.signedAt,\n    targetManifest: target.manifest,\n  });\n  const containerKey = requireUnwrappedKek(\n    keksByEpochId,\n    target.kek,\n    \"Container share target\",\n  );\n  const { recipientTarget, userRecipientKeys, wrap } =\n    await materializeRecipientWrap({\n      containerKey,\n      containerKeyEpochId: target.kek.containerKeyEpochId,\n      manifestHash,\n      recipient: input.recipient,\n      state,\n      targetKek: target.kek,\n    });\n  const previousWraps = readContainerKeyWraps(\n    target.kek.wraps,\n    \"Container share previous wraps\",\n  );\n\n  return buildContainerSharePlanResult({\n    body,\n    containerManifestHistory: shareManifestHistory({\n      containerId: previousState.containerId,\n      targetKek: target.kek,\n      targetManifest: target.manifest,\n    }),\n    containerKey,\n    containerId: previousState.containerId,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies,\n    recipientTarget,\n    state,\n    targetKek: target.kek,\n    userRecipientKeys,\n    wraps: replaceContainerWrap(previousWraps, wrap),\n  });\n}\n"]}

package/workflows/containers/child/sharePlanCore.d.ts

@@ -0,0 +1,81 @@
+import { type AccessEvent, type AccessManifest, type ContainerAccessManifestState, type ContainerDirectGrant, type ContainerGrantAccessEventBody, type ContainerGrantPrincipalHead, type ContainerKekRecipientTarget, type ContainerKeyWrap, type ContainerUserRecipientKey, type VerifiedPrincipalPolicy } from "../../../internal/crypto/index.js";
+import type { AccessManifestBundleWire } from "../../../internal/validators/request/index.js";
+import type { ContainerKekResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerSharePlan, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+export type ContainerShareRecipient = {
+    readonly recipientEncapsulationPublicKey: Uint8Array;
+    readonly subjectId: string;
+    readonly subjectType: "user";
+} | {
+    readonly principalPolicy: VerifiedPrincipalPolicy;
+    readonly subjectId: string;
+    readonly subjectType: "group";
+};
+export declare function referencedPrincipalHeadFromPolicy(policy: VerifiedPrincipalPolicy): ContainerGrantPrincipalHead;
+/**
+ * The previous manifest's referenced principal heads with the replacement
+ * policy's head upserted in place of any stale head for the same principal.
+ * A rekey substitutes references and never adds one: a manifest may reference
+ * only principals it grants, so a replacement for one it does not grant —
+ * a carried rekey below the container the policy is granted on — is left out.
+ */
+export declare function refreshedPrincipalReferences(input: {
+    readonly previousState: ContainerAccessManifestState;
+    readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;
+}): ContainerGrantPrincipalHead[];
+/**
+ * The previous policies with the replacement policy substituted for any
+ * existing policy of the same principal identity.
+ */
+export declare function refreshedPrincipalPolicies(input: {
+    readonly previousPolicies: readonly VerifiedPrincipalPolicy[];
+    readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;
+}): VerifiedPrincipalPolicy[];
+export declare function deriveContainerShareManifest(input: {
+    eventHash: string;
+    grant: ContainerDirectGrant;
+    previousManifest: ContainerWriterProjectionResponse["path"][number];
+    referencedPrincipalHead: ContainerGrantPrincipalHead | null;
+}): Promise<Pick<ContainerSharePlan, "manifest" | "manifestHash" | "state">>;
+export declare function replaceContainerWrap(wraps: readonly ContainerKeyWrap[], nextWrap: ContainerKeyWrap): ContainerKeyWrap[];
+export declare function shareManifestHistory(input: {
+    readonly containerId: string;
+    readonly targetKek: ContainerKekResponse;
+    readonly targetManifest: ContainerWriterProjectionResponse["path"][number];
+}): AccessManifestBundleWire[];
+export declare function buildContainerSharePlanResult(input: {
+    body: ContainerGrantAccessEventBody;
+    containerManifestHistory: readonly AccessManifestBundleWire[];
+    containerId: string;
+    containerKey: Uint8Array;
+    event: AccessEvent;
+    eventHash: string;
+    grant: ContainerDirectGrant;
+    manifest: AccessManifest;
+    manifestHash: string;
+    previousManifest: AccessManifestBundleWire;
+    previousProjection: ContainerWriterProjectionResponse;
+    principalPolicies: readonly VerifiedPrincipalPolicy[];
+    recipientTarget: ContainerKekRecipientTarget;
+    state: ContainerAccessManifestState;
+    targetKek: ContainerKekResponse;
+    userRecipientKeys: ContainerUserRecipientKey[];
+    wraps: ContainerKeyWrap[];
+}): MaterializedContainerSharePlan;
+export declare function collectShareUserRecipientKeys(input: {
+    newUserRecipientKey?: ContainerUserRecipientKey | undefined;
+    state: ContainerAccessManifestState;
+    targetKek: ContainerKekResponse;
+}): ContainerUserRecipientKey[];
+export declare function collectContainerSharePrincipalPolicies(input: {
+    execSql: ExecSql;
+    persistVerificationCheckpoints?: boolean | undefined;
+    principalPolicyCache?: PrincipalPolicyCache | undefined;
+    previousProjection: ContainerWriterProjectionResponse;
+    recipientPolicy?: VerifiedPrincipalPolicy | undefined;
+    resolveUserKey: ProjectionUserKeyResolver;
+    stillCurrent?: (() => boolean) | undefined;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<VerifiedPrincipalPolicy[]>;

package/workflows/containers/child/sharePlanCore.js

@@ -0,0 +1,191 @@
+import { computeAccessManifestHash, deriveContainerAccessManifest, } from "../../../internal/crypto/index.js";
+import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
+import { asContainerManifestBundle, getParentKekForTarget, readContainerState, } from "../../../data/containers/shared/projection.js";
+import { readContainerKekRecipientTargets, readContainerKeyEpoch, } from "../../../data/containers/shared/readers.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification.js";
+import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
+function grantKey(grant) {
+    return `${grant.subjectType}:${grant.subjectId}`;
+}
+function upsertContainerGrant(grants, grant) {
+    return [
+        ...grants.filter((existingGrant) => grantKey(existingGrant) !== grantKey(grant)),
+        grant,
+    ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));
+}
+function referencedPrincipalKey(reference) {
+    return `${reference.principalType}:${reference.principalId}`;
+}
+export function referencedPrincipalHeadFromPolicy(policy) {
+    if (policy.principalType !== "group") {
+        throw new Error("Container grants can reference only group policies");
+    }
+    return {
+        principalType: "group",
+        principalId: policy.principalId,
+        version: policy.version,
+        keyEpoch: policy.keyEpoch,
+        stateHash: policy.stateHash,
+        keyFingerprint: policy.state.keyFingerprint,
+    };
+}
+function upsertReferencedPrincipalHead(references, reference) {
+    return [
+        ...references.filter((existingReference) => referencedPrincipalKey(existingReference) !==
+            referencedPrincipalKey(reference)),
+        reference,
+    ].sort((left, right) => referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)));
+}
+/**
+ * The previous manifest's referenced principal heads with the replacement
+ * policy's head upserted in place of any stale head for the same principal.
+ * A rekey substitutes references and never adds one: a manifest may reference
+ * only principals it grants, so a replacement for one it does not grant —
+ * a carried rekey below the container the policy is granted on — is left out.
+ */
+export function refreshedPrincipalReferences(input) {
+    const replacement = input.replacementPrincipalPolicy;
+    if (!replacement ||
+        !input.previousState.directGrants.some((grant) => grant.subjectType === replacement.principalType &&
+            grant.subjectId === replacement.principalId)) {
+        return [...input.previousState.referencedPrincipalHeads];
+    }
+    return upsertReferencedPrincipalHead(input.previousState.referencedPrincipalHeads, referencedPrincipalHeadFromPolicy(replacement));
+}
+/**
+ * The previous policies with the replacement policy substituted for any
+ * existing policy of the same principal identity.
+ */
+export function refreshedPrincipalPolicies(input) {
+    const replacement = input.replacementPrincipalPolicy;
+    if (!replacement) {
+        return uniquePrincipalPolicies(input.previousPolicies);
+    }
+    return uniquePrincipalPolicies([
+        ...input.previousPolicies.filter((policy) => policy.principalType !== replacement.principalType ||
+            policy.principalId !== replacement.principalId),
+        replacement,
+    ]);
+}
+export async function deriveContainerShareManifest(input) {
+    const previousState = readContainerState(input.previousManifest);
+    const state = {
+        ...previousState,
+        epoch: previousState.epoch + 1,
+        previousManifestHash: input.previousManifest.manifestHash,
+        eventHash: input.eventHash,
+        directGrants: upsertContainerGrant(previousState.directGrants, input.grant),
+        referencedPrincipalHeads: input.referencedPrincipalHead
+            ? upsertReferencedPrincipalHead(previousState.referencedPrincipalHeads, input.referencedPrincipalHead)
+            : previousState.referencedPrincipalHeads,
+    };
+    const manifest = await deriveContainerAccessManifest(state);
+    return {
+        manifest,
+        manifestHash: await computeAccessManifestHash(manifest),
+        state,
+    };
+}
+function buildContainerShareRequest(input) {
+    return {
+        ...containerMutationRequestCore("share", input),
+        ...previousPathRequestFields(input.previousManifest, input.previousProjection),
+        containerManifestHistory: [...input.containerManifestHistory],
+        predecessorBridge: null,
+        keyring: null,
+        parentKekState: readCanonicalRecordOrNull(input.parentKek, "Container share parent KEK state"),
+    };
+}
+export function replaceContainerWrap(wraps, nextWrap) {
+    return [
+        ...wraps.filter((wrap) => !(wrap.recipientKind === nextWrap.recipientKind &&
+            wrap.recipientId === nextWrap.recipientId)),
+        nextWrap,
+    ];
+}
+export function shareManifestHistory(input) {
+    const byHash = new Map();
+    for (const bundle of [
+        input.targetManifest,
+        ...input.targetKek.containerManifestHistory,
+    ]) {
+        if (readContainerState(bundle).containerId === input.containerId &&
+            !byHash.has(bundle.manifestHash)) {
+            byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));
+        }
+    }
+    return [...byHash.values()];
+}
+export function buildContainerSharePlanResult(input) {
+    const keyEpoch = readContainerKeyEpoch(input.targetKek.keyEpoch, "Container share key epoch");
+    const plan = {
+        body: input.body,
+        containerId: input.containerId,
+        event: input.event,
+        eventHash: input.eventHash,
+        grant: input.grant,
+        keyEpoch,
+        manifest: input.manifest,
+        manifestHash: input.manifestHash,
+        previousKeyring: readCanonicalRecordOrNull(input.previousProjection.containerKeks.at(-1)?.keyring ?? null, "Container share previous keyring"),
+        previousManifest: input.previousManifest,
+        recipientTarget: input.recipientTarget,
+        request: buildContainerShareRequest({
+            body: input.body,
+            containerManifestHistory: input.containerManifestHistory,
+            event: input.event,
+            keyEpoch,
+            manifest: input.manifest,
+            manifestHash: input.manifestHash,
+            parentKek: getParentKekForTarget(input.previousProjection),
+            previousManifest: input.previousManifest,
+            previousProjection: input.previousProjection,
+            principalPolicies: input.principalPolicies,
+            userRecipientKeys: input.userRecipientKeys,
+            wraps: input.wraps,
+        }),
+        state: input.state,
+        userRecipientKeys: input.userRecipientKeys,
+        wraps: input.wraps,
+    };
+    return { containerKey: input.containerKey, plan };
+}
+export function collectShareUserRecipientKeys(input) {
+    const directUserIds = new Set(input.state.directGrants.flatMap((grant) => grant.subjectType === "user" ? [grant.subjectId] : []));
+    const userRecipientKeyByUserId = new Map();
+    for (const target of readContainerKekRecipientTargets(input.targetKek.recipientTargets, "Container share target KEK recipient targets")) {
+        if (target.recipientKind !== "user" ||
+            !directUserIds.has(target.recipientId)) {
+            continue;
+        }
+        userRecipientKeyByUserId.set(target.recipientId, {
+            userId: target.recipientId,
+            recipientKeyEpochId: target.recipientKeyEpochId,
+            recipientKeyFingerprint: target.recipientKeyFingerprint,
+        });
+    }
+    if (input.newUserRecipientKey) {
+        userRecipientKeyByUserId.set(input.newUserRecipientKey.userId, input.newUserRecipientKey);
+    }
+    const missingUserId = [...directUserIds].find((userId) => !userRecipientKeyByUserId.has(userId));
+    if (missingUserId) {
+        throw new Error(`Container share recipient key is missing for direct user grant ${missingUserId}`);
+    }
+    return [...userRecipientKeyByUserId.values()].sort((left, right) => left.userId.localeCompare(right.userId));
+}
+export async function collectContainerSharePrincipalPolicies(input) {
+    const previousPolicies = await collectContainerWriterProjectionPrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        resolveUserKey: input.resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    return refreshedPrincipalPolicies({
+        previousPolicies,
+        replacementPrincipalPolicy: input.recipientPolicy,
+    });
+}
+//# sourceMappingURL=sharePlanCore.js.map

package/workflows/containers/child/sharePlanCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAE9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAc/B,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAA+B;IAE/B,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;QAC7D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerAccessManifestState,\n  type ContainerDirectGrant,\n  type ContainerGrantAccessEventBody,\n  type ContainerGrantPrincipalHead,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  type ContainerUserRecipientKey,\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  asContainerManifestBundle,\n  getParentKekForTarget,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n  readContainerKekRecipientTargets,\n  readContainerKeyEpoch,\n} from \"../../../data/containers/shared/readers\";\nimport type {\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n  | {\n      readonly recipientEncapsulationPublicKey: Uint8Array;\n      readonly subjectId: string;\n      readonly subjectType: \"user\";\n    }\n  | {\n      readonly principalPolicy: VerifiedPrincipalPolicy;\n      readonly subjectId: string;\n      readonly subjectType: \"group\";\n    };\n\nfunction grantKey(\n  grant: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n): string {\n  return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n  grants: readonly ContainerDirectGrant[],\n  grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n  return [\n    ...grants.filter(\n      (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n    ),\n    grant,\n  ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n  readonly principalId: string;\n  readonly principalType: \"group\";\n}): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n  policy: VerifiedPrincipalPolicy,\n): ContainerGrantPrincipalHead {\n  if (policy.principalType !== \"group\") {\n    throw new Error(\"Container grants can reference only group policies\");\n  }\n  return {\n    principalType: \"group\",\n    principalId: policy.principalId,\n    version: policy.version,\n    keyEpoch: policy.keyEpoch,\n    stateHash: policy.stateHash,\n    keyFingerprint: policy.state.keyFingerprint,\n  };\n}\n\nfunction upsertReferencedPrincipalHead(\n  references: readonly ContainerGrantPrincipalHead[],\n  reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n  return [\n    ...references.filter(\n      (existingReference) =>\n        referencedPrincipalKey(existingReference) !==\n        referencedPrincipalKey(reference),\n    ),\n    reference,\n  ].sort((left, right) =>\n    referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n  );\n}\n\n/**\n * The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n */\nexport function refreshedPrincipalReferences(input: {\n  readonly previousState: ContainerAccessManifestState;\n  readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;\n}): ContainerGrantPrincipalHead[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (\n    !replacement ||\n    !input.previousState.directGrants.some(\n      (grant) =>\n        grant.subjectType === replacement.principalType &&\n        grant.subjectId === replacement.principalId,\n    )\n  ) {\n    return [...input.previousState.referencedPrincipalHeads];\n  }\n  return upsertReferencedPrincipalHead(\n    input.previousState.referencedPrincipalHeads,\n    referencedPrincipalHeadFromPolicy(replacement),\n  );\n}\n\n/**\n * The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n  readonly previousPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;\n}): VerifiedPrincipalPolicy[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (!replacement) {\n    return uniquePrincipalPolicies(input.previousPolicies);\n  }\n  return uniquePrincipalPolicies([\n    ...input.previousPolicies.filter(\n      (policy) =>\n        policy.principalType !== replacement.principalType ||\n        policy.principalId !== replacement.principalId,\n    ),\n    replacement,\n  ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  referencedPrincipalHead: ContainerGrantPrincipalHead | null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n    referencedPrincipalHeads: input.referencedPrincipalHead\n      ? upsertReferencedPrincipalHead(\n          previousState.referencedPrincipalHeads,\n          input.referencedPrincipalHead,\n        )\n      : previousState.referencedPrincipalHeads,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nfunction buildContainerShareRequest(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"share\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    containerManifestHistory: [...input.containerManifestHistory],\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container share parent KEK state\",\n    ),\n  };\n}\n\nexport function replaceContainerWrap(\n  wraps: readonly ContainerKeyWrap[],\n  nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n  return [\n    ...wraps.filter(\n      (wrap) =>\n        !(\n          wrap.recipientKind === nextWrap.recipientKind &&\n          wrap.recipientId === nextWrap.recipientId\n        ),\n    ),\n    nextWrap,\n  ];\n}\n\nexport function shareManifestHistory(input: {\n  readonly containerId: string;\n  readonly targetKek: ContainerKekResponse;\n  readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n  const byHash = new Map<string, AccessManifestBundleWire>();\n  for (const bundle of [\n    input.targetManifest,\n    ...input.targetKek.containerManifestHistory,\n  ]) {\n    if (\n      readContainerState(bundle).containerId === input.containerId &&\n      !byHash.has(bundle.manifestHash)\n    ) {\n      byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n    }\n  }\n  return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  containerId: string;\n  containerKey: Uint8Array;\n  event: AccessEvent;\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  recipientTarget: ContainerKekRecipientTarget;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n  const keyEpoch = readContainerKeyEpoch(\n    input.targetKek.keyEpoch,\n    \"Container share key epoch\",\n  );\n  const plan: ContainerSharePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    event: input.event,\n    eventHash: input.eventHash,\n    grant: input.grant,\n    keyEpoch,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousKeyring: readCanonicalRecordOrNull(\n      input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n      \"Container share previous keyring\",\n    ),\n    previousManifest: input.previousManifest,\n    recipientTarget: input.recipientTarget,\n    request: buildContainerShareRequest({\n      body: input.body,\n      containerManifestHistory: input.containerManifestHistory,\n      event: input.event,\n      keyEpoch,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: getParentKekForTarget(input.previousProjection),\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n  newUserRecipientKey?: ContainerUserRecipientKey | undefined;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n  const directUserIds = new Set(\n    input.state.directGrants.flatMap((grant) =>\n      grant.subjectType === \"user\" ? [grant.subjectId] : [],\n    ),\n  );\n  const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n  for (const target of readContainerKekRecipientTargets(\n    input.targetKek.recipientTargets,\n    \"Container share target KEK recipient targets\",\n  )) {\n    if (\n      target.recipientKind !== \"user\" ||\n      !directUserIds.has(target.recipientId)\n    ) {\n      continue;\n    }\n    userRecipientKeyByUserId.set(target.recipientId, {\n      userId: target.recipientId,\n      recipientKeyEpochId: target.recipientKeyEpochId,\n      recipientKeyFingerprint: target.recipientKeyFingerprint,\n    });\n  }\n\n  if (input.newUserRecipientKey) {\n    userRecipientKeyByUserId.set(\n      input.newUserRecipientKey.userId,\n      input.newUserRecipientKey,\n    );\n  }\n\n  const missingUserId = [...directUserIds].find(\n    (userId) => !userRecipientKeyByUserId.has(userId),\n  );\n  if (missingUserId) {\n    throw new Error(\n      `Container share recipient key is missing for direct user grant ${missingUserId}`,\n    );\n  }\n\n  return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n    left.userId.localeCompare(right.userId),\n  );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientPolicy?: VerifiedPrincipalPolicy | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const previousPolicies =\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  return refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.recipientPolicy,\n  });\n}\n"]}

package/workflows/containers/child/sharePrincipalPolicy.d.ts

@@ -0,0 +1,50 @@
+import type { ApiClient } from "../../../internal/api-client/index.js";
+import { KeyingVerificationError, type ManagedPrincipalKind, type ReferencedPrincipalHead, type VerifiedPrincipalPolicy } from "../../../internal/crypto/index.js";
+import type { CommitOrganizationGroupPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { CommitOrganizationGroupPolicyResponse, PrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerShareApi } from "../../../data/containers/shared/types.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import { type GroupPolicyNameReader } from "../../organizations/principalPolicyRequest.js";
+export interface ContainerManagedPrincipalShareApi extends ContainerShareApi, Pick<ApiClient, "evictContainerWriterProjection" | "getContainerWriterProjectionResult"> {
+    commitOrganizationGroupPolicy: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest) => Promise<CommitOrganizationGroupPolicyResponse | null>;
+    getCurrentPrincipalPolicy: (principalType: ManagedPrincipalKind, principalId: string) => Promise<PrincipalPolicyBundleResponse | null>;
+}
+export interface VerifiedSharePrincipalPolicy {
+    readonly bundle: PrincipalPolicyBundleResponse;
+    readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];
+    readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];
+    readonly organizationId: string;
+    readonly policy: VerifiedPrincipalPolicy;
+}
+/**
+ * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call
+ * deferred: advances the keying checkpoints for the verified policies and
+ * caches the dependency bundles they were verified against.
+ */
+export declare function advanceVerifiedSharePolicies(execSql: ExecSql, verified: Pick<VerifiedSharePrincipalPolicy, "checkpointPolicies" | "dependencyBundles" | "organizationId">, stillCurrent?: (() => boolean) | undefined): Promise<void>;
+/**
+ * The chosen group label does not match the name in the group's verified
+ * policy. A KeyingVerificationError (so it is reported as an incident), with
+ * its own class so a caller can tell this refusal from every other
+ * `object_mismatch` and say what happened.
+ */
+export declare class GroupShareNameMismatchError extends KeyingVerificationError {
+    constructor(message: string);
+}
+export declare function loadVerifiedGroupSharePrincipalPolicy(input: {
+    readEncryptedName?: GroupPolicyNameReader | undefined;
+    apiClient: ContainerManagedPrincipalShareApi;
+    execSql: ExecSql;
+    expectedGroupHead?: ReferencedPrincipalHead | undefined;
+    /**
+     * The display name the user chose the group by. The read model that labels
+     * groups is a server projection; only the name committed in the signed
+     * group payload can confirm the share lands on the group the user saw.
+     */
+    expectedGroupName?: string | undefined;
+    groupId: string;
+    organizationId: string;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    stillCurrent?: (() => boolean) | undefined;
+}): Promise<VerifiedSharePrincipalPolicy>;

package/workflows/containers/child/sharePrincipalPolicy.js

@@ -0,0 +1,194 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { savePrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../data/persistence/principalPolicyReferencePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "../../organizations/groupMetadataBinding.js";
+import { groupPolicyNameMismatch, } from "../../organizations/principalPolicyRequest.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../principals/externalAdminPolicy.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../../principals/policyVerification.js";
+async function retainVerifiedSharePolicies(input) {
+    const retainedAt = new Date().toISOString();
+    if (input.organizationPolicy) {
+        for (const entry of externalAdminPolicyPersistenceEntries(input.organizationPolicy)) {
+            await retainVerifiedPrincipalPolicyBundle({
+                ...entry,
+                execSql: input.execSql,
+                organizationId: input.organizationId,
+                stillCurrent: input.stillCurrent,
+                updatedAt: retainedAt,
+            });
+        }
+    }
+    await retainVerifiedPrincipalPolicyBundle({
+        bundle: input.bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policy: input.policy,
+        stillCurrent: input.stillCurrent,
+        updatedAt: retainedAt,
+    });
+    return [
+        ...(input.organizationPolicy
+            ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map((entry) => entry.policy)
+            : []),
+        input.policy,
+    ];
+}
+/**
+ * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call
+ * deferred: advances the keying checkpoints for the verified policies and
+ * caches the dependency bundles they were verified against.
+ */
+export async function advanceVerifiedSharePolicies(execSql, verified, stillCurrent) {
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql,
+        organizationId: verified.organizationId,
+        policies: verified.checkpointPolicies,
+        stillCurrent,
+    });
+    if (stillCurrent?.() === false)
+        return;
+    for (const bundle of verified.dependencyBundles) {
+        await savePrincipalPolicyBundle(execSql, bundle, new Date().toISOString(), verified.organizationId, { stillCurrent });
+        if (stillCurrent?.() === false)
+            return;
+    }
+}
+function assertGroupPolicyTarget(bundle, groupId) {
+    if (bundle.currentState.principalType !== "group" ||
+        bundle.currentState.principalId !== groupId) {
+        throw new Error("Container share principal policy target mismatch");
+    }
+}
+function signerPublicKeyLoadErrorMessage(code) {
+    switch (code) {
+        case "fingerprint-mismatch":
+            return "principal policy signer key fingerprint mismatch";
+        case "not-found":
+            return "principal policy signer key could not be loaded";
+    }
+}
+async function loadGroupSharePolicyBundle(input) {
+    if (input.expectedGroupHead &&
+        (input.expectedGroupHead.principalType !== "group" ||
+            input.expectedGroupHead.principalId !== input.groupId)) {
+        throw new Error("Container share expected group policy target mismatch");
+    }
+    const bundleFromCache = input.expectedGroupHead
+        ? await loadPrincipalPolicyBundleForReference(input.execSql, input.expectedGroupHead, input.localCheckpoint)
+        : null;
+    let bundle = bundleFromCache;
+    bundle ??= await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
+    if (!bundle) {
+        throw new Error("Container share principal policy could not be loaded");
+    }
+    assertGroupPolicyTarget(bundle, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), input.expectedGroupHead)) {
+        throw new Error("Container share group policy does not match the signed organization directory");
+    }
+    return bundle;
+}
+/**
+ * The chosen group label does not match the name in the group's verified
+ * policy. A KeyingVerificationError (so it is reported as an incident), with
+ * its own class so a caller can tell this refusal from every other
+ * `object_mismatch` and say what happened.
+ */
+export class GroupShareNameMismatchError extends KeyingVerificationError {
+    constructor(message) {
+        super("object_mismatch", message);
+        this.name = "GroupShareNameMismatchError";
+    }
+}
+/**
+ * The share picker labels groups from the organization read model, which a
+ * compromised server can relabel, so the name the user chose must equal the
+ * name committed in the target's verified policy. Names compare by their
+ * canonical key so look-alike spellings count as the same name. Uniqueness of
+ * signed names within an organization is enforced where names enter — group
+ * creation verifies every group in the signed directory — so a single
+ * verified match identifies the group.
+ */
+async function assertShareGroupName(input) {
+    // The label comes from the untrusted read model. Signed names never carry
+    // an invisible code point, so a label that does is a look-alike that would
+    // only match after canonicalization strips it; refuse it outright.
+    const mismatch = await groupPolicyNameMismatch(input.bundle, input.expectedGroupName, input.readEncryptedName);
+    if (mismatch === "forbidden_characters") {
+        throw new GroupShareNameMismatchError("Container share group name contains control or format characters");
+    }
+    if (mismatch === "name_mismatch") {
+        throw new GroupShareNameMismatchError("Container share group name does not match the signed group policy");
+    }
+}
+export async function loadVerifiedGroupSharePrincipalPolicy(input) {
+    const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        execSql: input.execSql,
+        getCurrentPrincipalPolicy: (principalType, principalId) => input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!organizationAdminPolicy) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const committedGroupHead = requireOrganizationGroupHead(organizationAdminPolicy.descriptor, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)) {
+        throw new Error("Container share expected group head conflicts with the signed organization directory");
+    }
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", input.groupId);
+    const bundle = await loadGroupSharePolicyBundle({
+        ...input,
+        expectedGroupHead: committedGroupHead,
+        localCheckpoint,
+    });
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));
+    }
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: committedGroupHead,
+        loadExternalAuthority: async () => organizationAdminPolicy.externalAuthority,
+        localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Container share principal policy verification failed");
+    }
+    assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);
+    if (input.expectedGroupName !== undefined) {
+        await assertShareGroupName({
+            readEncryptedName: input.readEncryptedName,
+            bundle,
+            expectedGroupName: input.expectedGroupName,
+        });
+    }
+    const checkpointPolicies = await retainVerifiedSharePolicies({
+        bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        organizationPolicy: organizationAdminPolicy,
+        policy: verified.value,
+        stillCurrent: input.stillCurrent,
+    });
+    return {
+        bundle,
+        checkpointPolicies,
+        dependencyBundles: externalAdminPolicyPersistenceEntries(organizationAdminPolicy).map((entry) => entry.bundle),
+        organizationId: input.organizationId,
+        policy: verified.value,
+    };
+}
+//# sourceMappingURL=sharePrincipalPolicy.js.map