@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/containers/child/keyringOverrideLineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyringOverrideLineage.js","sourceRoot":"","sources":["keyringOverrideLineage.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,KAAK,GAAG,kCAAkC,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAC3D;QACE,KAAK,CACH,GAAG,KAAK,uFAAuF,CAChG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAA4C,EAC5C,cAAmC;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,GAAG,KAAK,wDAAwD,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,kCAAkC,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import {\n  type ContainerKekKeyringEntry,\n  KeyingVerificationError,\n} from \"@tearleads/crypto\";\n\nconst LABEL = \"Container rekey keyring override\";\n\n/**\n * A rebuilt keyring override that omits an epoch the container's signed\n * lineage names. That is what a rebuild made before a concurrent rotation\n * looks like, so it is not tampering: rebuild from the current log and retry.\n * It is deliberately not a `KeyingVerificationError`, which callers may read\n * as tampering, unlike an epoch outside the lineage, which no honest rebuild\n * names.\n */\nexport class ContainerKeyringOverrideStaleError extends Error {\n  constructor() {\n    super(\n      `${LABEL} omits an epoch the container's signed lineage names; rebuild it from the current log`,\n    );\n    this.name = \"ContainerKeyringOverrideStaleError\";\n  }\n}\n\n/**\n * A rebuilt keyring override is sealed forward under this device's signature,\n * so it must name exactly the epochs the container's signed lineage commits to\n * (#2365 finding 32). `signedEpochIds` is that lineage as the rotation's own\n * verification walked it, wherever the projection served it: the target KEK's\n * own served history is not enough, since a server can serve the target's\n * older manifests under its parent's KEK, letting an invented id over\n * server-chosen material take the real epoch's ordinal.\n */\nexport function assertOverrideMatchesSignedLineage(\n  entries: readonly ContainerKekKeyringEntry[],\n  signedEpochIds: ReadonlySet<string>,\n): void {\n  const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));\n  for (const epochId of entryIds) {\n    if (!signedEpochIds.has(epochId)) {\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        `${LABEL} names an epoch outside the container's signed lineage`,\n      );\n    }\n  }\n  for (const epochId of signedEpochIds) {\n    if (!entryIds.has(epochId)) {\n      throw new ContainerKeyringOverrideStaleError();\n    }\n  }\n}\n"]}

package/workflows/containers/child/move.d.ts

@@ -0,0 +1,23 @@
+import type { ContainerRotationResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerMoveApi, ContainerMovePlan, ContainerMutationAuthor } from "../../../data/containers/shared/types.js";
+import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+export declare function moveRemoteContainer(input: {
+    reportSecurityIncident: SecurityIncidentReporter;
+    apiClient: ContainerMoveApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    destinationParentContainerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<{
+    containerKey: Uint8Array;
+    plan: ContainerMovePlan;
+    response: ContainerRotationResponse;
+} | null>;

package/workflows/containers/child/move.js

@@ -0,0 +1,268 @@
+import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
+import { assertContainerChildPathFits } from "../../../data/containers/shared/containerPathLimits.js";
+import { asContainerManifestBundle, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
+import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
+import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { buildMoveRotationWithBody, deriveMoveManifestArtifacts, } from "./moveArtifacts.js";
+import { buildContainerMoveWraps, collectContainerMovePrincipalPolicies, } from "./moveWraps.js";
+import { containerMutationRequestCore, previousPathRequestFields, } from "./mutationRequestCore.js";
+import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "./mutationSubmit.js";
+import { containerWriterProjectionFromRotationPlan } from "./rekeyProjection.js";
+import { requireUnwrappedKek, signedRotationTarget, } from "./rotationContext.js";
+function buildContainerMoveRequest(input) {
+    return {
+        ...containerMutationRequestCore("move", input),
+        ...previousPathRequestFields(input.previousManifest, input.previousProjection),
+        destinationParentContainerPath: input.destinationParentProjection.path.map(asContainerManifestBundle),
+        predecessorBridge: readCanonicalRecord(input.predecessorBridge, "Container move predecessor bridge"),
+        keyring: readCanonicalRecord(input.keyring, "Container move keyring"),
+        parentKekState: readCanonicalRecord(input.destinationParentKek, "Container move destination parent KEK state"),
+    };
+}
+async function unwrapMoveContainerKeys(input) {
+    const verifiedByHash = new Map();
+    const keksByEpochId = await unwrapContainerKekPath({
+        execSql: input.execSql,
+        projection: input.previousProjection,
+        secretKey: input.targetSecretKey,
+        verifiedByHash,
+        ...projectionVerificationOptions(input),
+    });
+    const source = signedRotationTarget(input.previousProjection, verifiedByHash);
+    const containerKey = requireUnwrappedKek(keksByEpochId, source.kek, "Container move source");
+    const destinationKeksByEpochId = await unwrapContainerKekPath({
+        execSql: input.execSql,
+        projection: input.destinationParentProjection,
+        secretKey: input.targetSecretKey,
+        ...projectionVerificationOptions(input),
+    });
+    const destinationParent = getTargetContainerContext(input.destinationParentProjection);
+    requireUnwrappedKek(destinationKeksByEpochId, destinationParent.kek, "Container move destination parent");
+    return { containerKey, destinationParent, source };
+}
+function assertContainerMoveOrganizations(input) {
+    if (input.previousState.organizationId !== input.authorOrganizationId) {
+        throw new Error("Container move author organization mismatch");
+    }
+    if (input.destinationState.organizationId !== input.authorOrganizationId) {
+        throw new Error("Container move destination organization mismatch");
+    }
+}
+function readContainerMoveStates(input) {
+    const previousState = readContainerState(input.source.manifest);
+    const destinationState = readContainerState(input.destinationParent.manifest);
+    assertContainerMoveOrganizations({
+        authorOrganizationId: input.authorOrganizationId,
+        destinationState,
+        previousState,
+    });
+    return { destinationState, previousState };
+}
+function containerMoveDependencyManifestHashes(input) {
+    return [
+        ...uniqueSortedManifestHashes(input.previousProjection.path),
+        ...uniqueSortedManifestHashes(input.destinationParentProjection.path),
+    ];
+}
+function buildContainerMovePlanResult(input) {
+    const plan = {
+        body: input.body,
+        containerId: input.containerId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        event: input.event,
+        eventHash: input.eventHash,
+        keyEpoch: input.keyEpoch,
+        keyring: input.keyring,
+        manifest: input.manifest,
+        manifestHash: input.manifestHash,
+        previousManifest: input.previousManifest,
+        request: buildContainerMoveRequest({
+            body: input.body,
+            destinationParentKek: input.destinationParentKek,
+            destinationParentProjection: input.destinationParentProjection,
+            event: input.event,
+            keyEpoch: input.keyEpoch,
+            keyring: input.keyring,
+            manifest: input.manifest,
+            manifestHash: input.manifestHash,
+            previousManifest: input.previousManifest,
+            previousProjection: input.previousProjection,
+            predecessorBridge: input.predecessorBridge,
+            principalPolicies: input.principalPolicies,
+            userRecipientKeys: input.userRecipientKeys,
+            wraps: input.wraps,
+        }),
+        state: input.state,
+        wraps: input.wraps,
+    };
+    return { containerKey: input.containerKey, plan };
+}
+async function collectAuthorizedMovePolicies(input) {
+    const principalPolicies = await collectContainerMovePrincipalPolicies({
+        ...input,
+        resolveUserKey: input.resolveProjectionUserKey,
+    });
+    assertContainerAuthorAccess({
+        author: input.author,
+        projection: input.previousProjection,
+        principalPolicies,
+        minimumAccess: "admin",
+    });
+    assertContainerAuthorAccess({
+        author: input.author,
+        projection: input.destinationParentProjection,
+        principalPolicies,
+        minimumAccess: "write",
+    });
+    return principalPolicies;
+}
+async function buildMaterializedContainerMovePlan(input) {
+    const { containerKey: predecessorContainerKey, destinationParent, source, } = await unwrapMoveContainerKeys({
+        destinationParentProjection: input.destinationParentProjection,
+        execSql: input.execSql,
+        previousProjection: input.previousProjection,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    // Only a verified path is a final depth refusal; a padded unverified path
+    // must fail verification (an incident), never look like an honest refusal.
+    assertContainerChildPathFits(input.destinationParentProjection.path);
+    const { destinationState, previousState } = readContainerMoveStates({
+        authorOrganizationId: input.author.organizationId,
+        destinationParent,
+        source,
+    });
+    const principalPolicies = await collectAuthorizedMovePolicies(input);
+    const { body, containerKey, containerKeyEpochId, keyring, predecessorBridge, } = await buildMoveRotationWithBody({
+        destinationParent,
+        destinationState,
+        override: input.containerKeyEpochId,
+        predecessorContainerKey,
+        previousState,
+        source,
+    });
+    const { event, eventHash, keyEpoch, manifest, manifestHash, state } = await deriveMoveManifestArtifacts({
+        body,
+        containerKeyEpochId,
+        destinationParent,
+        previousState,
+        signing: {
+            author: input.author,
+            dependencyManifestHashes: containerMoveDependencyManifestHashes(input),
+            eventId: input.eventId,
+            signedAt: input.signedAt,
+        },
+        source,
+    });
+    const { userRecipientKeys, wraps } = await buildContainerMoveWraps({
+        principalPolicies,
+        containerKey,
+        containerKeyEpochId,
+        destinationParentKek: destinationParent.kek,
+        destinationParentProjection: input.destinationParentProjection,
+        execSql: input.execSql,
+        manifestHash,
+        previousProjection: input.previousProjection,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        state,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    return buildContainerMovePlanResult({
+        body,
+        containerKey,
+        containerId: previousState.containerId,
+        containerKeyEpochId,
+        destinationParentKek: destinationParent.kek,
+        destinationParentProjection: input.destinationParentProjection,
+        event,
+        eventHash,
+        keyEpoch,
+        keyring,
+        manifest,
+        manifestHash,
+        previousManifest: asContainerManifestBundle(source.manifest),
+        previousProjection: input.previousProjection,
+        predecessorBridge,
+        principalPolicies,
+        state,
+        userRecipientKeys,
+        wraps,
+    });
+}
+export async function moveRemoteContainer(input) {
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container move");
+    const [previousProjection, destinationParentProjection] = await Promise.all([
+        input.apiClient.getContainerWriterProjection(input.containerId),
+        input.apiClient.getContainerWriterProjection(input.destinationParentContainerId),
+    ]);
+    if (!previousProjection || !destinationParentProjection) {
+        return null;
+    }
+    const materializedPlan = await nullOnProjectionVerificationCancellation(() => buildMaterializedContainerMovePlan({
+        author: input.author,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        previousProjection,
+        destinationParentProjection,
+        resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    }));
+    if (!materializedPlan)
+        return null;
+    return submitAcknowledgedContainerMutation({
+        reportSecurityIncident: input.reportSecurityIncident,
+        recitationPolicies: [],
+        apiClient: input.apiClient,
+        author: input.author,
+        carriedRekeys: {
+            planning: {
+                apiClient: input.apiClient,
+                author: input.author,
+                execSql: input.execSql,
+                knownContainerKeks: new Map([
+                    [
+                        materializedPlan.plan.containerKeyEpochId,
+                        materializedPlan.containerKey,
+                    ],
+                ]),
+                resolveProjectionUserKey: resolveProjectionUserKey,
+                stillCurrent: input.stillCurrent,
+                targetSecretKey: input.targetSecretKey,
+                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+            },
+            rotated: () => containerWriterProjectionFromRotationPlan({
+                ancestors: destinationParentProjection,
+                plan: materializedPlan.plan,
+                previousProjection,
+            }),
+        },
+        containerKey: materializedPlan.containerKey,
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+        submit: (carried) => {
+            const request = carried.length
+                ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }
+                : materializedPlan.plan.request;
+            const options = {
+                expectedPaymentRequiredOrganizationId: input.author.organizationId,
+            };
+            const { moveContainerResult } = input.apiClient;
+            return submitContainerRotation({
+                plain: () => input.apiClient.moveContainer(input.containerId, request, options),
+                result: moveContainerResult
+                    ? () => moveContainerResult.call(input.apiClient, input.containerId, request, { ...options, reportErrors: false })
+                    : undefined,
+            });
+        },
+    });
+}
+//# sourceMappingURL=move.js.map

package/workflows/containers/child/move.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"move.js","sourceRoot":"","sources":["move.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAQpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,SAAS,yBAAyB,CAAC,KAelC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,MAAM,EAAE,KAAK,CAAC;QAC9C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,8BAA8B,EAAE,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CACxE,yBAAyB,CAC1B;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,mCAAmC,CACpC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC;QACrE,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,oBAAoB,EAC1B,6CAA6C,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAQtC;IAKC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,uBAAuB,CACxB,CAAC;IAEF,MAAM,wBAAwB,GAAG,MAAM,sBAAsB,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,2BAA2B,CAClC,CAAC;IACF,mBAAmB,CACjB,wBAAwB,EACxB,iBAAiB,CAAC,GAAG,EACrB,mCAAmC,CACpC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,IAAI,KAAK,CAAC,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9E,gCAAgC,CAAC;QAC/B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,qCAAqC,CAAC,KAG9C;IACC,OAAO;QACL,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5D,GAAG,0BAA0B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAoBrC;IACC,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,yBAAyB,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAWD,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAErC,MAAM,iBAAiB,GAAG,MAAM,qCAAqC,CAAC;QACpE,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,wBAAwB;KAC/C,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,KAAqC;IAErC,MAAM,EACJ,YAAY,EAAE,uBAAuB,EACrC,iBAAiB,EACjB,MAAM,GACP,GAAG,MAAM,uBAAuB,CAAC;QAChC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,uBAAuB,CAAC;QAClE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACjD,iBAAiB;QACjB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,mBAAmB,EACnB,OAAO,EACP,iBAAiB,GAClB,GAAG,MAAM,yBAAyB,CAAC;QAClC,iBAAiB;QACjB,gBAAgB;QAChB,QAAQ,EAAE,KAAK,CAAC,mBAAmB;QACnC,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,2BAA2B,CAAC;QAChC,IAAI;QACJ,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,wBAAwB,EAAE,qCAAqC,CAAC,KAAK,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;QACD,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACjE,iBAAiB;QACjB,YAAY;QACZ,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IAEH,OAAO,4BAA4B,CAAC;QAClC,IAAI;QACJ,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAazC;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,uBAAuB,CACxB,CAAC;IACF,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1E,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/D,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC1C,KAAK,CAAC,4BAA4B,CACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAC3E,kCAAkC,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,2BAA2B;QAC3B,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,wBAAwB;gBAClD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,SAAS,EAAE,2BAA2B;gBACtC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAChD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACpE,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,GAAG,EAAE,CACH,mBAAmB,CAAC,IAAI,CACtB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerAccessManifestState,\n  ContainerKekKeyring,\n  ContainerKekPredecessorBridge,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerMoveAccessEventBody,\n  ContainerUserRecipientKey,\n  VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerRotationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n  asContainerManifestBundle,\n  getTargetContainerContext,\n  readContainerState,\n  uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  BuildMaterializedContainerMovePlanInput,\n  ContainerMoveApi,\n  ContainerMovePlan,\n  ContainerMutationAuthor,\n  MaterializedContainerMovePlan,\n} from \"../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  buildMoveRotationWithBody,\n  deriveMoveManifestArtifacts,\n} from \"./moveArtifacts\";\nimport {\n  buildContainerMoveWraps,\n  collectContainerMovePrincipalPolicies,\n} from \"./moveWraps\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n} from \"./mutationRequestCore\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n  requireUnwrappedKek,\n  type SignedRotationTarget,\n  signedRotationTarget,\n} from \"./rotationContext\";\n\nfunction buildContainerMoveRequest(input: {\n  body: ContainerMoveAccessEventBody;\n  destinationParentKek: ContainerKekResponse;\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"move\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    destinationParentContainerPath: input.destinationParentProjection.path.map(\n      asContainerManifestBundle,\n    ),\n    predecessorBridge: readCanonicalRecord(\n      input.predecessorBridge,\n      \"Container move predecessor bridge\",\n    ),\n    keyring: readCanonicalRecord(input.keyring, \"Container move keyring\"),\n    parentKekState: readCanonicalRecord(\n      input.destinationParentKek,\n      \"Container move destination parent KEK state\",\n    ),\n  };\n}\n\nasync function unwrapMoveContainerKeys(input: {\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  execSql: ExecSql;\n  previousProjection: ContainerWriterProjectionResponse;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  source: SignedRotationTarget;\n}> {\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    ...projectionVerificationOptions(input),\n  });\n  const source = signedRotationTarget(input.previousProjection, verifiedByHash);\n  const containerKey = requireUnwrappedKek(\n    keksByEpochId,\n    source.kek,\n    \"Container move source\",\n  );\n\n  const destinationKeksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    projection: input.destinationParentProjection,\n    secretKey: input.targetSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const destinationParent = getTargetContainerContext(\n    input.destinationParentProjection,\n  );\n  requireUnwrappedKek(\n    destinationKeksByEpochId,\n    destinationParent.kek,\n    \"Container move destination parent\",\n  );\n\n  return { containerKey, destinationParent, source };\n}\n\nfunction assertContainerMoveOrganizations(input: {\n  authorOrganizationId: string;\n  destinationState: ContainerAccessManifestState;\n  previousState: ContainerAccessManifestState;\n}): void {\n  if (input.previousState.organizationId !== input.authorOrganizationId) {\n    throw new Error(\"Container move author organization mismatch\");\n  }\n  if (input.destinationState.organizationId !== input.authorOrganizationId) {\n    throw new Error(\"Container move destination organization mismatch\");\n  }\n}\n\nfunction readContainerMoveStates(input: {\n  authorOrganizationId: string;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  const previousState = readContainerState(input.source.manifest);\n  const destinationState = readContainerState(input.destinationParent.manifest);\n  assertContainerMoveOrganizations({\n    authorOrganizationId: input.authorOrganizationId,\n    destinationState,\n    previousState,\n  });\n  return { destinationState, previousState };\n}\n\nfunction containerMoveDependencyManifestHashes(input: {\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  previousProjection: ContainerWriterProjectionResponse;\n}): string[] {\n  return [\n    ...uniqueSortedManifestHashes(input.previousProjection.path),\n    ...uniqueSortedManifestHashes(input.destinationParentProjection.path),\n  ];\n}\n\nfunction buildContainerMovePlanResult(input: {\n  body: ContainerMoveAccessEventBody;\n  containerId: string;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  destinationParentKek: ContainerKekResponse;\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  event: AccessEvent;\n  eventHash: string;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  state: ContainerAccessManifestState;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerMovePlan {\n  const plan: ContainerMovePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    event: input.event,\n    eventHash: input.eventHash,\n    keyEpoch: input.keyEpoch,\n    keyring: input.keyring,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousManifest: input.previousManifest,\n    request: buildContainerMoveRequest({\n      body: input.body,\n      destinationParentKek: input.destinationParentKek,\n      destinationParentProjection: input.destinationParentProjection,\n      event: input.event,\n      keyEpoch: input.keyEpoch,\n      keyring: input.keyring,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      predecessorBridge: input.predecessorBridge,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\ntype MaterializedContainerMoveInput =\n  BuildMaterializedContainerMovePlanInput & {\n    resolveProjectionUserKey: ProjectionUserKeyResolver;\n    stillCurrent?: (() => boolean) | undefined;\n    warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  };\n\nasync function collectAuthorizedMovePolicies(\n  input: MaterializedContainerMoveInput,\n) {\n  const principalPolicies = await collectContainerMovePrincipalPolicies({\n    ...input,\n    resolveUserKey: input.resolveProjectionUserKey,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.destinationParentProjection,\n    principalPolicies,\n    minimumAccess: \"write\",\n  });\n  return principalPolicies;\n}\n\nasync function buildMaterializedContainerMovePlan(\n  input: MaterializedContainerMoveInput,\n): Promise<MaterializedContainerMovePlan> {\n  const {\n    containerKey: predecessorContainerKey,\n    destinationParent,\n    source,\n  } = await unwrapMoveContainerKeys({\n    destinationParentProjection: input.destinationParentProjection,\n    execSql: input.execSql,\n    previousProjection: input.previousProjection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  // Only a verified path is a final depth refusal; a padded unverified path\n  // must fail verification (an incident), never look like an honest refusal.\n  assertContainerChildPathFits(input.destinationParentProjection.path);\n  const { destinationState, previousState } = readContainerMoveStates({\n    authorOrganizationId: input.author.organizationId,\n    destinationParent,\n    source,\n  });\n  const principalPolicies = await collectAuthorizedMovePolicies(input);\n  const {\n    body,\n    containerKey,\n    containerKeyEpochId,\n    keyring,\n    predecessorBridge,\n  } = await buildMoveRotationWithBody({\n    destinationParent,\n    destinationState,\n    override: input.containerKeyEpochId,\n    predecessorContainerKey,\n    previousState,\n    source,\n  });\n  const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n    await deriveMoveManifestArtifacts({\n      body,\n      containerKeyEpochId,\n      destinationParent,\n      previousState,\n      signing: {\n        author: input.author,\n        dependencyManifestHashes: containerMoveDependencyManifestHashes(input),\n        eventId: input.eventId,\n        signedAt: input.signedAt,\n      },\n      source,\n    });\n  const { userRecipientKeys, wraps } = await buildContainerMoveWraps({\n    principalPolicies,\n    containerKey,\n    containerKeyEpochId,\n    destinationParentKek: destinationParent.kek,\n    destinationParentProjection: input.destinationParentProjection,\n    execSql: input.execSql,\n    manifestHash,\n    previousProjection: input.previousProjection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    state,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n\n  return buildContainerMovePlanResult({\n    body,\n    containerKey,\n    containerId: previousState.containerId,\n    containerKeyEpochId,\n    destinationParentKek: destinationParent.kek,\n    destinationParentProjection: input.destinationParentProjection,\n    event,\n    eventHash,\n    keyEpoch,\n    keyring,\n    manifest,\n    manifestHash,\n    previousManifest: asContainerManifestBundle(source.manifest),\n    previousProjection: input.previousProjection,\n    predecessorBridge,\n    principalPolicies,\n    state,\n    userRecipientKeys,\n    wraps,\n  });\n}\n\nexport async function moveRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  apiClient: ContainerMoveApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  destinationParentContainerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerMovePlan;\n  response: ContainerRotationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container move\",\n  );\n  const [previousProjection, destinationParentProjection] = await Promise.all([\n    input.apiClient.getContainerWriterProjection(input.containerId),\n    input.apiClient.getContainerWriterProjection(\n      input.destinationParentContainerId,\n    ),\n  ]);\n  if (!previousProjection || !destinationParentProjection) {\n    return null;\n  }\n\n  const materializedPlan = await nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerMovePlan({\n      author: input.author,\n      eventId: input.eventId,\n      execSql: input.execSql,\n      previousProjection,\n      destinationParentProjection,\n      resolveProjectionUserKey,\n      signedAt: input.signedAt,\n      stillCurrent: input.stillCurrent,\n      targetSecretKey: input.targetSecretKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  );\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    carriedRekeys: {\n      planning: {\n        apiClient: input.apiClient,\n        author: input.author,\n        execSql: input.execSql,\n        knownContainerKeks: new Map([\n          [\n            materializedPlan.plan.containerKeyEpochId,\n            materializedPlan.containerKey,\n          ],\n        ]),\n        resolveProjectionUserKey: resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        targetSecretKey: input.targetSecretKey,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      rotated: () =>\n        containerWriterProjectionFromRotationPlan({\n          ancestors: destinationParentProjection,\n          plan: materializedPlan.plan,\n          previousProjection,\n        }),\n    },\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: (carried) => {\n      const request = carried.length\n        ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n        : materializedPlan.plan.request;\n      const options = {\n        expectedPaymentRequiredOrganizationId: input.author.organizationId,\n      };\n      const { moveContainerResult } = input.apiClient;\n      return submitContainerRotation({\n        plain: () =>\n          input.apiClient.moveContainer(input.containerId, request, options),\n        result: moveContainerResult\n          ? () =>\n              moveContainerResult.call(\n                input.apiClient,\n                input.containerId,\n                request,\n                { ...options, reportErrors: false },\n              )\n          : undefined,\n      });\n    },\n  });\n}\n"]}

package/workflows/containers/child/moveArtifacts.js

@@ -0,0 +1,102 @@
+import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, } from "../../../internal/crypto/index.js";
+import { buildContainerCreateKeyEpoch, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
+import { readContainerState, } from "../../../data/containers/shared/projection.js";
+import { buildContainerRotationArtifacts } from "./moveRotation.js";
+async function deriveContainerMoveManifest(input) {
+    const previousState = readContainerState(input.previousManifest);
+    const destinationState = readContainerState(input.destinationParent);
+    const state = {
+        ...previousState,
+        epoch: previousState.epoch + 1,
+        previousManifestHash: input.previousManifest.manifestHash,
+        eventHash: input.eventHash,
+        parentContainerId: destinationState.containerId,
+        parentManifestHash: input.destinationParent.manifestHash,
+        containerKeyEpochId: input.containerKeyEpochId,
+        containerKeyPublicKey: input.containerKeyPublicKey,
+    };
+    const manifest = await deriveContainerAccessManifest(state);
+    return {
+        manifest,
+        manifestHash: await computeAccessManifestHash(manifest),
+        state,
+    };
+}
+async function buildContainerMoveEventBody(input) {
+    return {
+        eventType: "container.move",
+        parentContainerId: input.parentContainerId,
+        parentManifestHash: input.parentManifestHash,
+        containerKeyEpochId: input.containerKeyEpochId,
+        containerKeyPublicKey: input.containerKeyPublicKey,
+        keyringHash: await computeContainerKekKeyringHash(input.keyring),
+        predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(input.predecessorBridge),
+    };
+}
+function signContainerMoveEvent(input) {
+    return signContainerMutationEvent({
+        author: input.signing.author,
+        body: input.body,
+        containerId: input.containerId,
+        dependencyManifestHashes: input.signing.dependencyManifestHashes,
+        eventId: input.signing.eventId ?? crypto.randomUUID(),
+        previousManifestHash: input.source.manifest.manifestHash,
+        signedAt: input.signing.signedAt ?? new Date().toISOString(),
+    });
+}
+function buildMoveKeyEpoch(input) {
+    return buildContainerCreateKeyEpoch({
+        containerId: readContainerState(input.source.manifest).containerId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        eventHash: input.eventHash,
+        keyEpoch: input.source.kek.containerKeyEpoch + 1,
+        manifestHash: input.manifestHash,
+        parentContainerKeyEpochId: input.destinationParent.kek.containerKeyEpochId,
+    });
+}
+export async function buildMoveRotationWithBody(input) {
+    const rotation = await buildContainerRotationArtifacts({
+        containerId: input.previousState.containerId,
+        currentKek: input.source.kek,
+        currentKeyMaterial: input.predecessorContainerKey,
+        keyEpoch: input.source.kek.containerKeyEpoch + 1,
+        override: input.override,
+        signedEpochIds: input.source.signedEpochIds,
+    });
+    const body = await buildContainerMoveEventBody({
+        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
+            containerId: input.previousState.containerId,
+            keyMaterial: rotation.containerKey,
+        }),
+        containerKeyEpochId: rotation.containerKeyEpochId,
+        keyring: rotation.keyring,
+        parentContainerId: input.destinationState.containerId,
+        parentManifestHash: input.destinationParent.manifest.manifestHash,
+        predecessorBridge: rotation.predecessorBridge,
+    });
+    return { ...rotation, body };
+}
+export async function deriveMoveManifestArtifacts(input) {
+    const { event, eventHash } = await signContainerMoveEvent({
+        body: input.body,
+        containerId: input.previousState.containerId,
+        signing: input.signing,
+        source: input.source,
+    });
+    const { manifest, manifestHash, state } = await deriveContainerMoveManifest({
+        containerKeyPublicKey: input.body.containerKeyPublicKey,
+        containerKeyEpochId: input.containerKeyEpochId,
+        destinationParent: input.destinationParent.manifest,
+        eventHash,
+        previousManifest: input.source.manifest,
+    });
+    const keyEpoch = buildMoveKeyEpoch({
+        containerKeyEpochId: input.containerKeyEpochId,
+        destinationParent: input.destinationParent,
+        eventHash,
+        manifestHash,
+        source: input.source,
+    });
+    return { event, eventHash, keyEpoch, manifest, manifestHash, state };
+}
+//# sourceMappingURL=moveArtifacts.js.map

package/workflows/containers/child/moveArtifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"moveArtifacts.js","sourceRoot":"","sources":["moveArtifacts.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAEL,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAGjE,KAAK,UAAU,2BAA2B,CAAC,KAM1C;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,gBAAgB,CAAC,WAAW;QAC/C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,YAAY;QACxD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,OAAO;QACL,SAAS,EAAE,gBAAgB;QAC3B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;KACF,CAAC;AACJ,CAAC;AASD,SAAS,sBAAsB,CAAC,KAK/B;IACC,OAAO,0BAA0B,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,wBAAwB;QAChE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW;QAClE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,yBAAyB,EAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;QAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;QACjD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC;QAC7C,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,QAAQ,CAAC,YAAY;SACnC,CAAC;QACF,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC,WAAW;QACrD,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY;QACjE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAOjD;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,sBAAsB,CAAC;QACxD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QAC1E,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ;QACnD,SAAS;QACT,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;KACxC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS;QACT,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerKekKeyring,\n  ContainerKekPredecessorBridge,\n  ContainerMoveAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n  computeAccessManifestHash,\n  computeContainerKekKeyringHash,\n  computeContainerKekPredecessorBridgeHash,\n  deriveContainerAccessManifest,\n  deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  buildContainerCreateKeyEpoch,\n  signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  type getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerMovePlan,\n  ContainerMutationAuthor,\n} from \"../../../data/containers/shared/types\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport type { SignedRotationTarget } from \"./rotationContext\";\n\nasync function deriveContainerMoveManifest(input: {\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string | null;\n  destinationParent: ContainerWriterProjectionResponse[\"path\"][number];\n  eventHash: string;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): Promise<Pick<ContainerMovePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const destinationState = readContainerState(input.destinationParent);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    parentContainerId: destinationState.containerId,\n    parentManifestHash: input.destinationParent.manifestHash,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nasync function buildContainerMoveEventBody(input: {\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string | null;\n  keyring: ContainerKekKeyring;\n  parentContainerId: string;\n  parentManifestHash: string;\n  predecessorBridge: ContainerKekPredecessorBridge;\n}): Promise<ContainerMoveAccessEventBody> {\n  return {\n    eventType: \"container.move\",\n    parentContainerId: input.parentContainerId,\n    parentManifestHash: input.parentManifestHash,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    keyringHash: await computeContainerKekKeyringHash(input.keyring),\n    predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n      input.predecessorBridge,\n    ),\n  };\n}\n\ninterface MoveSigningContext {\n  author: ContainerMutationAuthor;\n  dependencyManifestHashes: readonly string[];\n  eventId: string | undefined;\n  signedAt: string | undefined;\n}\n\nfunction signContainerMoveEvent(input: {\n  body: ContainerMoveAccessEventBody;\n  containerId: string;\n  signing: MoveSigningContext;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  return signContainerMutationEvent({\n    author: input.signing.author,\n    body: input.body,\n    containerId: input.containerId,\n    dependencyManifestHashes: input.signing.dependencyManifestHashes,\n    eventId: input.signing.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.source.manifest.manifestHash,\n    signedAt: input.signing.signedAt ?? new Date().toISOString(),\n  });\n}\n\nfunction buildMoveKeyEpoch(input: {\n  containerKeyEpochId: string;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  eventHash: string;\n  manifestHash: string;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  return buildContainerCreateKeyEpoch({\n    containerId: readContainerState(input.source.manifest).containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventHash: input.eventHash,\n    keyEpoch: input.source.kek.containerKeyEpoch + 1,\n    manifestHash: input.manifestHash,\n    parentContainerKeyEpochId: input.destinationParent.kek.containerKeyEpochId,\n  });\n}\n\nexport async function buildMoveRotationWithBody(input: {\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  destinationState: ContainerAccessManifestState;\n  override: string | undefined;\n  predecessorContainerKey: Uint8Array;\n  previousState: ContainerAccessManifestState;\n  source: SignedRotationTarget;\n}) {\n  const rotation = await buildContainerRotationArtifacts({\n    containerId: input.previousState.containerId,\n    currentKek: input.source.kek,\n    currentKeyMaterial: input.predecessorContainerKey,\n    keyEpoch: input.source.kek.containerKeyEpoch + 1,\n    override: input.override,\n    signedEpochIds: input.source.signedEpochIds,\n  });\n  const body = await buildContainerMoveEventBody({\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: input.previousState.containerId,\n      keyMaterial: rotation.containerKey,\n    }),\n    containerKeyEpochId: rotation.containerKeyEpochId,\n    keyring: rotation.keyring,\n    parentContainerId: input.destinationState.containerId,\n    parentManifestHash: input.destinationParent.manifest.manifestHash,\n    predecessorBridge: rotation.predecessorBridge,\n  });\n  return { ...rotation, body };\n}\n\nexport async function deriveMoveManifestArtifacts(input: {\n  body: ContainerMoveAccessEventBody;\n  containerKeyEpochId: string;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  previousState: ContainerAccessManifestState;\n  signing: MoveSigningContext;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  const { event, eventHash } = await signContainerMoveEvent({\n    body: input.body,\n    containerId: input.previousState.containerId,\n    signing: input.signing,\n    source: input.source,\n  });\n  const { manifest, manifestHash, state } = await deriveContainerMoveManifest({\n    containerKeyPublicKey: input.body.containerKeyPublicKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    destinationParent: input.destinationParent.manifest,\n    eventHash,\n    previousManifest: input.source.manifest,\n  });\n  const keyEpoch = buildMoveKeyEpoch({\n    containerKeyEpochId: input.containerKeyEpochId,\n    destinationParent: input.destinationParent,\n    eventHash,\n    manifestHash,\n    source: input.source,\n  });\n  return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n"]}

package/workflows/containers/child/moveRotation.js

@@ -0,0 +1,88 @@
+import { createContainerKekPredecessorBridge, KeyingVerificationError, normalizeContainerKekKeyring, openContainerKekKeyring, sealContainerKekKeyring, } from "../../../internal/crypto/index.js";
+import { resolveContainerKekEpochId } from "../../../data/containers/shared/events.js";
+import { verifyContainerKekEntries } from "../../../data/documents/shared/containerKekEntryVerification.js";
+/**
+ * A rotation must never launder history it did not verify: an
+ * authenticated-but-poisoned keyring (sealed by a prior authorized writer
+ * with wrong material) would otherwise be re-signed under the honest
+ * rotator's event. Every entry is checked against the material-id its
+ * ordinal commits to before it is sealed forward; entry i is key epoch
+ * i + 1.
+ */
+export async function verifyKeyringEntriesForSeal(containerId, entries, 
+/**
+ * The epoch ids the KEK's signed history commits to, wherever the
+ * projection served it (`signedHistoryEpochIds`). A self-consistent forgery
+ * passes the material check but cannot also make a real id disappear, so an
+ * honest rotation never re-signs one. The KEK's own served history alone is
+ * not enough: a server can serve it under another KEK (#2365 finding 32).
+ */
+signedEpochIds) {
+    await verifyContainerKekEntries(containerId, entries);
+    const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));
+    for (const historicalId of signedEpochIds) {
+        if (!entryIds.has(historicalId)) {
+            // Classified like the reader's and the override's refusal of it.
+            throw new KeyingVerificationError("missing_dependency", "Container KEK keyring omits an epoch its manifest history commits to");
+        }
+    }
+}
+/**
+ * Re-seals the container's key history for a rotation: the previous
+ * keyring's entries plus the retiring key, under the new epoch's key. One
+ * decrypt and one seal regardless of container age.
+ */
+export async function sealRotationKeyring(input) {
+    const previousEntries = input.currentKek.keyring
+        ? await openContainerKekKeyring({
+            keyEpoch: input.currentKek.containerKeyEpoch,
+            keyring: normalizeContainerKekKeyring(input.currentKek.keyring),
+            successorContainerKey: input.currentKeyMaterial,
+        })
+        : [];
+    await verifyKeyringEntriesForSeal(input.containerId, previousEntries, input.signedEpochIds);
+    return sealContainerKekKeyring({
+        containerId: input.containerId,
+        entries: [
+            ...previousEntries,
+            {
+                containerKeyEpochId: input.currentKek.containerKeyEpochId,
+                keyMaterial: input.currentKeyMaterial,
+            },
+        ],
+        keyEpoch: input.keyEpoch,
+        successorContainerKey: input.successorContainerKey,
+        successorContainerKeyEpochId: input.successorContainerKeyEpochId,
+    });
+}
+/**
+ * Mints one container KEK rotation: fresh entropy for the new epoch, the
+ * write-once bridge to the retiring epoch, and the re-sealed keyring.
+ */
+export async function buildContainerRotationArtifacts(input) {
+    const containerKey = crypto.getRandomValues(new Uint8Array(32));
+    const containerKeyEpochId = await resolveContainerKekEpochId({
+        containerId: input.containerId,
+        keyEpoch: input.keyEpoch,
+        keyMaterial: containerKey,
+        override: input.override,
+    });
+    const predecessorBridge = await createContainerKekPredecessorBridge({
+        containerId: input.containerId,
+        predecessorContainerKey: input.currentKeyMaterial,
+        predecessorContainerKeyEpochId: input.currentKek.containerKeyEpochId,
+        successorContainerKey: containerKey,
+        successorContainerKeyEpochId: containerKeyEpochId,
+    });
+    const keyring = await sealRotationKeyring({
+        containerId: input.containerId,
+        currentKek: input.currentKek,
+        currentKeyMaterial: input.currentKeyMaterial,
+        keyEpoch: input.keyEpoch,
+        signedEpochIds: input.signedEpochIds,
+        successorContainerKey: containerKey,
+        successorContainerKeyEpochId: containerKeyEpochId,
+    });
+    return { containerKey, containerKeyEpochId, keyring, predecessorBridge };
+}
+//# sourceMappingURL=moveRotation.js.map

package/workflows/containers/child/moveRotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"moveRotation.js","sourceRoot":"","sources":["moveRotation.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAA4C;AAC5C;;;;;;GAMG;AACH,cAAmC;IAEnC,MAAM,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO;QAC9C,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB;YAC5C,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/D,qBAAqB,EAAE,KAAK,CAAC,kBAAkB;SAChD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,2BAA2B,CAC/B,KAAK,CAAC,WAAW,EACjB,eAAe,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,OAAO,uBAAuB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE;YACP,GAAG,eAAe;YAClB;gBACE,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;gBACzD,WAAW,EAAE,KAAK,CAAC,kBAAkB;aACtC;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAOrD;IAMC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,uBAAuB,EAAE,KAAK,CAAC,kBAAkB;QACjD,8BAA8B,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type {\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerKekPredecessorBridge,\n} from \"@tearleads/crypto\";\nimport {\n  createContainerKekPredecessorBridge,\n  KeyingVerificationError,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport { resolveContainerKekEpochId } from \"../../../data/containers/shared/events\";\nimport { verifyContainerKekEntries } from \"../../../data/documents/shared/containerKekEntryVerification\";\n\n/**\n * A rotation must never launder history it did not verify: an\n * authenticated-but-poisoned keyring (sealed by a prior authorized writer\n * with wrong material) would otherwise be re-signed under the honest\n * rotator's event. Every entry is checked against the material-id its\n * ordinal commits to before it is sealed forward; entry i is key epoch\n * i + 1.\n */\nexport async function verifyKeyringEntriesForSeal(\n  containerId: string,\n  entries: readonly ContainerKekKeyringEntry[],\n  /**\n   * The epoch ids the KEK's signed history commits to, wherever the\n   * projection served it (`signedHistoryEpochIds`). A self-consistent forgery\n   * passes the material check but cannot also make a real id disappear, so an\n   * honest rotation never re-signs one. The KEK's own served history alone is\n   * not enough: a server can serve it under another KEK (#2365 finding 32).\n   */\n  signedEpochIds: ReadonlySet<string>,\n): Promise<void> {\n  await verifyContainerKekEntries(containerId, entries);\n  const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));\n  for (const historicalId of signedEpochIds) {\n    if (!entryIds.has(historicalId)) {\n      // Classified like the reader's and the override's refusal of it.\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Container KEK keyring omits an epoch its manifest history commits to\",\n      );\n    }\n  }\n}\n\n/**\n * Re-seals the container's key history for a rotation: the previous\n * keyring's entries plus the retiring key, under the new epoch's key. One\n * decrypt and one seal regardless of container age.\n */\nexport async function sealRotationKeyring(input: {\n  containerId: string;\n  currentKek: ContainerKekResponse;\n  currentKeyMaterial: Uint8Array;\n  keyEpoch: number;\n  signedEpochIds: ReadonlySet<string>;\n  successorContainerKey: Uint8Array;\n  successorContainerKeyEpochId: string;\n}): Promise<ContainerKekKeyring> {\n  const previousEntries = input.currentKek.keyring\n    ? await openContainerKekKeyring({\n        keyEpoch: input.currentKek.containerKeyEpoch,\n        keyring: normalizeContainerKekKeyring(input.currentKek.keyring),\n        successorContainerKey: input.currentKeyMaterial,\n      })\n    : [];\n  await verifyKeyringEntriesForSeal(\n    input.containerId,\n    previousEntries,\n    input.signedEpochIds,\n  );\n  return sealContainerKekKeyring({\n    containerId: input.containerId,\n    entries: [\n      ...previousEntries,\n      {\n        containerKeyEpochId: input.currentKek.containerKeyEpochId,\n        keyMaterial: input.currentKeyMaterial,\n      },\n    ],\n    keyEpoch: input.keyEpoch,\n    successorContainerKey: input.successorContainerKey,\n    successorContainerKeyEpochId: input.successorContainerKeyEpochId,\n  });\n}\n\n/**\n * Mints one container KEK rotation: fresh entropy for the new epoch, the\n * write-once bridge to the retiring epoch, and the re-sealed keyring.\n */\nexport async function buildContainerRotationArtifacts(input: {\n  containerId: string;\n  currentKek: ContainerKekResponse;\n  currentKeyMaterial: Uint8Array;\n  keyEpoch: number;\n  override?: string | undefined;\n  signedEpochIds: ReadonlySet<string>;\n}): Promise<{\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  keyring: ContainerKekKeyring;\n  predecessorBridge: ContainerKekPredecessorBridge;\n}> {\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerKeyEpochId = await resolveContainerKekEpochId({\n    containerId: input.containerId,\n    keyEpoch: input.keyEpoch,\n    keyMaterial: containerKey,\n    override: input.override,\n  });\n  const predecessorBridge = await createContainerKekPredecessorBridge({\n    containerId: input.containerId,\n    predecessorContainerKey: input.currentKeyMaterial,\n    predecessorContainerKeyEpochId: input.currentKek.containerKeyEpochId,\n    successorContainerKey: containerKey,\n    successorContainerKeyEpochId: containerKeyEpochId,\n  });\n  const keyring = await sealRotationKeyring({\n    containerId: input.containerId,\n    currentKek: input.currentKek,\n    currentKeyMaterial: input.currentKeyMaterial,\n    keyEpoch: input.keyEpoch,\n    signedEpochIds: input.signedEpochIds,\n    successorContainerKey: containerKey,\n    successorContainerKeyEpochId: containerKeyEpochId,\n  });\n  return { containerKey, containerKeyEpochId, keyring, predecessorBridge };\n}\n"]}

package/workflows/containers/child/moveWraps.js

@@ -0,0 +1,49 @@
+import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
+import { readContainerState } from "../../../data/containers/shared/projection.js";
+import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification.js";
+import { buildContainerRotationWraps } from "./rotationWraps.js";
+export async function collectContainerMovePrincipalPolicies(input) {
+    const [sourcePolicies, destinationParentPolicies] = await Promise.all([
+        collectContainerWriterProjectionPrincipalPolicies({
+            execSql: input.execSql,
+            projection: input.previousProjection,
+            resolveUserKey: input.resolveUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        }),
+        collectContainerWriterProjectionPrincipalPolicies({
+            execSql: input.execSql,
+            projection: input.destinationParentProjection,
+            resolveUserKey: input.resolveUserKey,
+            stillCurrent: input.stillCurrent,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        }),
+    ]);
+    return uniquePrincipalPolicies([
+        ...sourcePolicies,
+        ...destinationParentPolicies,
+    ]);
+}
+export async function buildContainerMoveWraps(input) {
+    assertContainerKekPathCurrent(input.destinationParentProjection.containerKeks);
+    const principalPolicies = input.principalPolicies;
+    const parentManifest = input.destinationParentProjection.path.at(-1);
+    if (!parentManifest)
+        throw new Error("Container move destination parent is missing");
+    return {
+        principalPolicies,
+        ...(await buildContainerRotationWraps({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            operationLabel: "Container move",
+            parentKek: input.destinationParentKek,
+            parentPublicKey: readContainerState(parentManifest).containerKeyPublicKey,
+            principalPolicies,
+            resolveUserKey: input.resolveProjectionUserKey,
+            state: input.state,
+        })),
+    };
+}
+//# sourceMappingURL=moveWraps.js.map