@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/containers/child/sharePrincipalPolicy.js

@@ -0,0 +1,194 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { savePrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../data/persistence/principalPolicyReferencePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "../../organizations/groupMetadataBinding.js";
+import { groupPolicyNameMismatch, } from "../../organizations/principalPolicyRequest.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../principals/externalAdminPolicy.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../../principals/policyVerification.js";
+async function retainVerifiedSharePolicies(input) {
+    const retainedAt = new Date().toISOString();
+    if (input.organizationPolicy) {
+        for (const entry of externalAdminPolicyPersistenceEntries(input.organizationPolicy)) {
+            await retainVerifiedPrincipalPolicyBundle({
+                ...entry,
+                execSql: input.execSql,
+                organizationId: input.organizationId,
+                stillCurrent: input.stillCurrent,
+                updatedAt: retainedAt,
+            });
+        }
+    }
+    await retainVerifiedPrincipalPolicyBundle({
+        bundle: input.bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policy: input.policy,
+        stillCurrent: input.stillCurrent,
+        updatedAt: retainedAt,
+    });
+    return [
+        ...(input.organizationPolicy
+            ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map((entry) => entry.policy)
+            : []),
+        input.policy,
+    ];
+}
+/**
+ * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call
+ * deferred: advances the keying checkpoints for the verified policies and
+ * caches the dependency bundles they were verified against.
+ */
+export async function advanceVerifiedSharePolicies(execSql, verified, stillCurrent) {
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql,
+        organizationId: verified.organizationId,
+        policies: verified.checkpointPolicies,
+        stillCurrent,
+    });
+    if (stillCurrent?.() === false)
+        return;
+    for (const bundle of verified.dependencyBundles) {
+        await savePrincipalPolicyBundle(execSql, bundle, new Date().toISOString(), verified.organizationId, { stillCurrent });
+        if (stillCurrent?.() === false)
+            return;
+    }
+}
+function assertGroupPolicyTarget(bundle, groupId) {
+    if (bundle.currentState.principalType !== "group" ||
+        bundle.currentState.principalId !== groupId) {
+        throw new Error("Container share principal policy target mismatch");
+    }
+}
+function signerPublicKeyLoadErrorMessage(code) {
+    switch (code) {
+        case "fingerprint-mismatch":
+            return "principal policy signer key fingerprint mismatch";
+        case "not-found":
+            return "principal policy signer key could not be loaded";
+    }
+}
+async function loadGroupSharePolicyBundle(input) {
+    if (input.expectedGroupHead &&
+        (input.expectedGroupHead.principalType !== "group" ||
+            input.expectedGroupHead.principalId !== input.groupId)) {
+        throw new Error("Container share expected group policy target mismatch");
+    }
+    const bundleFromCache = input.expectedGroupHead
+        ? await loadPrincipalPolicyBundleForReference(input.execSql, input.expectedGroupHead, input.localCheckpoint)
+        : null;
+    let bundle = bundleFromCache;
+    bundle ??= await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
+    if (!bundle) {
+        throw new Error("Container share principal policy could not be loaded");
+    }
+    assertGroupPolicyTarget(bundle, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), input.expectedGroupHead)) {
+        throw new Error("Container share group policy does not match the signed organization directory");
+    }
+    return bundle;
+}
+/**
+ * The chosen group label does not match the name in the group's verified
+ * policy. A KeyingVerificationError (so it is reported as an incident), with
+ * its own class so a caller can tell this refusal from every other
+ * `object_mismatch` and say what happened.
+ */
+export class GroupShareNameMismatchError extends KeyingVerificationError {
+    constructor(message) {
+        super("object_mismatch", message);
+        this.name = "GroupShareNameMismatchError";
+    }
+}
+/**
+ * The share picker labels groups from the organization read model, which a
+ * compromised server can relabel, so the name the user chose must equal the
+ * name committed in the target's verified policy. Names compare by their
+ * canonical key so look-alike spellings count as the same name. Uniqueness of
+ * signed names within an organization is enforced where names enter — group
+ * creation verifies every group in the signed directory — so a single
+ * verified match identifies the group.
+ */
+async function assertShareGroupName(input) {
+    // The label comes from the untrusted read model. Signed names never carry
+    // an invisible code point, so a label that does is a look-alike that would
+    // only match after canonicalization strips it; refuse it outright.
+    const mismatch = await groupPolicyNameMismatch(input.bundle, input.expectedGroupName, input.readEncryptedName);
+    if (mismatch === "forbidden_characters") {
+        throw new GroupShareNameMismatchError("Container share group name contains control or format characters");
+    }
+    if (mismatch === "name_mismatch") {
+        throw new GroupShareNameMismatchError("Container share group name does not match the signed group policy");
+    }
+}
+export async function loadVerifiedGroupSharePrincipalPolicy(input) {
+    const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        execSql: input.execSql,
+        getCurrentPrincipalPolicy: (principalType, principalId) => input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!organizationAdminPolicy) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const committedGroupHead = requireOrganizationGroupHead(organizationAdminPolicy.descriptor, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)) {
+        throw new Error("Container share expected group head conflicts with the signed organization directory");
+    }
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", input.groupId);
+    const bundle = await loadGroupSharePolicyBundle({
+        ...input,
+        expectedGroupHead: committedGroupHead,
+        localCheckpoint,
+    });
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));
+    }
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: committedGroupHead,
+        loadExternalAuthority: async () => organizationAdminPolicy.externalAuthority,
+        localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Container share principal policy verification failed");
+    }
+    assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);
+    if (input.expectedGroupName !== undefined) {
+        await assertShareGroupName({
+            readEncryptedName: input.readEncryptedName,
+            bundle,
+            expectedGroupName: input.expectedGroupName,
+        });
+    }
+    const checkpointPolicies = await retainVerifiedSharePolicies({
+        bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        organizationPolicy: organizationAdminPolicy,
+        policy: verified.value,
+        stillCurrent: input.stillCurrent,
+    });
+    return {
+        bundle,
+        checkpointPolicies,
+        dependencyBundles: externalAdminPolicyPersistenceEntries(organizationAdminPolicy).map((entry) => entry.bundle),
+        organizationId: input.organizationId,
+        policy: verified.value,
+    };
+}
+//# sourceMappingURL=sharePrincipalPolicy.js.map

package/workflows/containers/child/sharePrincipalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePrincipalPolicy.js","sourceRoot":"","sources":["sharePrincipalPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAKxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+DAA+D,CAAC;AACtH,OAAO,EAAE,mCAAmC,EAAE,MAAM,uEAAuE,CAAC;AAC5H,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,sDAAsD,CAAC;AAG9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAEL,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,sCAAsC,GAEvC,MAAM,qCAAqC,CAAC;AA2B7C,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,qCAAqC,CACvD,KAAK,CAAC,kBAAkB,CACzB,EAAE,CAAC;YACF,MAAM,mCAAmC,CAAC;gBACxC,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACxB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,QAGC,EACD,YAA0C;IAE1C,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;QACrC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,CAAC,cAAc,EACvB,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAqC,EACrC,OAAe;IAEf,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC7C,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,iDAAiD,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;YAChD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,qCAAqC,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,eAAe,CACtB;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CACxD,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,iBAAiB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,uBAAuB;IACtE,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAe3D;IACC,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,uBAAuB,CAAC,UAAU,EAClC,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,KAAK;QACR,iBAAiB,EAAE,kBAAkB;QACrC,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,kBAAkB;QACrC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAChC,uBAAuB,CAAC,iBAAiB;QAC3C,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,oBAAoB,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,uBAAuB;QAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,kBAAkB;QAClB,iBAAiB,EAAE,qCAAqC,CACtD,uBAAuB,CACxB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type ManagedPrincipalKind,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerShareApi } from \"../../../data/containers/shared/types\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../data/keyingProjectionVerification/error\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { savePrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { assertGroupMetadataBinding } from \"../../organizations/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../organizations/principalPolicyRequest\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../principals/externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../principals/policyVerification\";\n\nexport interface ContainerManagedPrincipalShareApi\n  extends ContainerShareApi,\n    Pick<\n      ApiClient,\n      \"evictContainerWriterProjection\" | \"getContainerWriterProjectionResult\"\n    > {\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n  getCurrentPrincipalPolicy: (\n    principalType: ManagedPrincipalKind,\n    principalId: string,\n  ) => Promise<PrincipalPolicyBundleResponse | null>;\n}\n\nexport interface VerifiedSharePrincipalPolicy {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nasync function retainVerifiedSharePolicies(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  execSql: ExecSql;\n  organizationId: string;\n  organizationPolicy: VerifiedExternalAdminPolicy | null;\n  policy: VerifiedPrincipalPolicy;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const retainedAt = new Date().toISOString();\n  if (input.organizationPolicy) {\n    for (const entry of externalAdminPolicyPersistenceEntries(\n      input.organizationPolicy,\n    )) {\n      await retainVerifiedPrincipalPolicyBundle({\n        ...entry,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        stillCurrent: input.stillCurrent,\n        updatedAt: retainedAt,\n      });\n    }\n  }\n  await retainVerifiedPrincipalPolicyBundle({\n    bundle: input.bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policy: input.policy,\n    stillCurrent: input.stillCurrent,\n    updatedAt: retainedAt,\n  });\n  return [\n    ...(input.organizationPolicy\n      ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map(\n          (entry) => entry.policy,\n        )\n      : []),\n    input.policy,\n  ];\n}\n\n/**\n * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call\n * deferred: advances the keying checkpoints for the verified policies and\n * caches the dependency bundles they were verified against.\n */\nexport async function advanceVerifiedSharePolicies(\n  execSql: ExecSql,\n  verified: Pick<\n    VerifiedSharePrincipalPolicy,\n    \"checkpointPolicies\" | \"dependencyBundles\" | \"organizationId\"\n  >,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql,\n    organizationId: verified.organizationId,\n    policies: verified.checkpointPolicies,\n    stillCurrent,\n  });\n  if (stillCurrent?.() === false) return;\n  for (const bundle of verified.dependencyBundles) {\n    await savePrincipalPolicyBundle(\n      execSql,\n      bundle,\n      new Date().toISOString(),\n      verified.organizationId,\n      { stillCurrent },\n    );\n    if (stillCurrent?.() === false) return;\n  }\n}\n\nfunction assertGroupPolicyTarget(\n  bundle: PrincipalPolicyBundleResponse,\n  groupId: string,\n): void {\n  if (\n    bundle.currentState.principalType !== \"group\" ||\n    bundle.currentState.principalId !== groupId\n  ) {\n    throw new Error(\"Container share principal policy target mismatch\");\n  }\n}\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"principal policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"principal policy signer key could not be loaded\";\n  }\n}\n\nasync function loadGroupSharePolicyBundle(input: {\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  groupId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<PrincipalPolicyBundleResponse> {\n  if (\n    input.expectedGroupHead &&\n    (input.expectedGroupHead.principalType !== \"group\" ||\n      input.expectedGroupHead.principalId !== input.groupId)\n  ) {\n    throw new Error(\"Container share expected group policy target mismatch\");\n  }\n  const bundleFromCache = input.expectedGroupHead\n    ? await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        input.expectedGroupHead,\n        input.localCheckpoint,\n      )\n    : null;\n  let bundle = bundleFromCache;\n  bundle ??= await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n  if (!bundle) {\n    throw new Error(\"Container share principal policy could not be loaded\");\n  }\n  assertGroupPolicyTarget(bundle, input.groupId);\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedGroupHead,\n    )\n  ) {\n    throw new Error(\n      \"Container share group policy does not match the signed organization directory\",\n    );\n  }\n  return bundle;\n}\n\n/**\n * The chosen group label does not match the name in the group's verified\n * policy. A KeyingVerificationError (so it is reported as an incident), with\n * its own class so a caller can tell this refusal from every other\n * `object_mismatch` and say what happened.\n */\nexport class GroupShareNameMismatchError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"object_mismatch\", message);\n    this.name = \"GroupShareNameMismatchError\";\n  }\n}\n\n/**\n * The share picker labels groups from the organization read model, which a\n * compromised server can relabel, so the name the user chose must equal the\n * name committed in the target's verified policy. Names compare by their\n * canonical key so look-alike spellings count as the same name. Uniqueness of\n * signed names within an organization is enforced where names enter — group\n * creation verifies every group in the signed directory — so a single\n * verified match identifies the group.\n */\nasync function assertShareGroupName(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  bundle: PrincipalPolicyBundleResponse;\n  expectedGroupName: string;\n}): Promise<void> {\n  // The label comes from the untrusted read model. Signed names never carry\n  // an invisible code point, so a label that does is a look-alike that would\n  // only match after canonicalization strips it; refuse it outright.\n  const mismatch = await groupPolicyNameMismatch(\n    input.bundle,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  if (mismatch === \"forbidden_characters\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name contains control or format characters\",\n    );\n  }\n  if (mismatch === \"name_mismatch\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  }\n}\n\nexport async function loadVerifiedGroupSharePrincipalPolicy(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  /**\n   * The display name the user chose the group by. The read model that labels\n   * groups is a server projection; only the name committed in the signed\n   * group payload can confirm the share lands on the group the user saw.\n   */\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedSharePrincipalPolicy> {\n  const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    execSql: input.execSql,\n    getCurrentPrincipalPolicy: (principalType, principalId) =>\n      input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!organizationAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const committedGroupHead = requireOrganizationGroupHead(\n    organizationAdminPolicy.descriptor,\n    input.groupId,\n  );\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)\n  ) {\n    throw new Error(\n      \"Container share expected group head conflicts with the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.groupId,\n  );\n  const bundle = await loadGroupSharePolicyBundle({\n    ...input,\n    expectedGroupHead: committedGroupHead,\n    localCheckpoint,\n  });\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: committedGroupHead,\n      loadExternalAuthority: async () =>\n        organizationAdminPolicy.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Container share principal policy verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);\n  if (input.expectedGroupName !== undefined) {\n    await assertShareGroupName({\n      readEncryptedName: input.readEncryptedName,\n      bundle,\n      expectedGroupName: input.expectedGroupName,\n    });\n  }\n\n  const checkpointPolicies = await retainVerifiedSharePolicies({\n    bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    organizationPolicy: organizationAdminPolicy,\n    policy: verified.value,\n    stillCurrent: input.stillCurrent,\n  });\n  return {\n    bundle,\n    checkpointPolicies,\n    dependencyBundles: externalAdminPolicyPersistenceEntries(\n      organizationAdminPolicy,\n    ).map((entry) => entry.bundle),\n    organizationId: input.organizationId,\n    policy: verified.value,\n  };\n}\n"]}

package/workflows/containers/index.d.ts

@@ -0,0 +1,22 @@
+export { ContainerAuthorAccessError } from "../../data/containers/shared/authorAccess.js";
+export { ContainerPathTooDeepError } from "../../data/containers/shared/containerPathLimits.js";
+export type { ContainerReciteApi } from "../../data/containers/shared/reciteApi.js";
+export type { ContainerMutationAuthor, MaterializedContainerRekeyPlan, } from "../../data/containers/shared/types.js";
+export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
+export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "../../data/documents/shared/keyringRebuild.js";
+export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWrapUnavailableReason, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
+export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
+export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
+export { moveRemoteContainer } from "./child/move.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
+export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
+export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
+export { type ContainerWriteRefusal, classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js

@@ -0,0 +1,27 @@
+// Refusals the SDK raises before it encrypts or sends a container-scoped
+// write; hosts classify them with classifyContainerWriteRefusal.
+export { ContainerAuthorAccessError } from "../../data/containers/shared/authorAccess.js";
+// A create or move past the readable path length; `code` is
+// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.
+export { ContainerPathTooDeepError } from "../../data/containers/shared/containerPathLimits.js";
+export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, } from "../../data/documents/shared/containerKekCurrency.js";
+export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
+// A share's projection verification can be cancelled by a newer generation
+// underneath the caller; hosts filter that outcome from their own reporting.
+export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
+// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.
+export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
+export { moveRemoteContainer } from "./child/move.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
+export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
+export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
+export { classifyContainerWriteRefusal, } from "./writeRefusal.js";
+//# sourceMappingURL=index.js.map

package/workflows/containers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,sCAAsC,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/keyringOverrideLineage\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}

package/workflows/containers/mutationResponse.d.ts

@@ -0,0 +1,13 @@
+import { type ReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
+export declare function readContainerMutationMetadataDocumentId(input: {
+    response: {
+        accessManifest: {
+            state: Record<string, unknown>;
+        };
+    };
+}): string;
+export declare function referencedPrincipalHeadsFromContainerMutationResponse(input: {
+    response: {
+        referencedPrincipalHeads: readonly unknown[];
+    };
+}): ReferencedPrincipalStateResponse[];

package/workflows/containers/mutationResponse.js

@@ -0,0 +1,29 @@
+import { isReferencedPrincipalStateResponse, } from "../../internal/validators/response/index.js";
+export function readContainerMutationMetadataDocumentId(input) {
+    const metadataDocumentId = Reflect.get(input.response.accessManifest.state, "metadataDocumentId");
+    if (typeof metadataDocumentId !== "string" ||
+        metadataDocumentId.length === 0) {
+        throw new Error("Container mutation response is missing metadata state");
+    }
+    return metadataDocumentId;
+}
+export function referencedPrincipalHeadsFromContainerMutationResponse(input) {
+    return input.response.referencedPrincipalHeads.flatMap((head) => {
+        if (!isReferencedPrincipalStateResponse(head) ||
+            !Number.isInteger(head.version) ||
+            !Number.isInteger(head.keyEpoch)) {
+            return [];
+        }
+        return [
+            {
+                principalType: head.principalType,
+                principalId: head.principalId,
+                version: head.version,
+                keyEpoch: head.keyEpoch,
+                stateHash: head.stateHash,
+                keyFingerprint: head.keyFingerprint,
+            },
+        ];
+    });
+}
+//# sourceMappingURL=mutationResponse.js.map

package/workflows/containers/mutationResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutationResponse.js","sourceRoot":"","sources":["mutationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAExC,MAAM,UAAU,uCAAuC,CAAC,KAIvD;IACC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CACpC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EACnC,oBAAoB,CACrB,CAAC;IACF,IACE,OAAO,kBAAkB,KAAK,QAAQ;QACtC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,qDAAqD,CAAC,KAErE;IACC,OAAO,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9D,IACE,CAAC,kCAAkC,CAAC,IAAI,CAAC;YACzC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAChC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  isReferencedPrincipalStateResponse,\n  type ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\n\nexport function readContainerMutationMetadataDocumentId(input: {\n  response: {\n    accessManifest: { state: Record<string, unknown> };\n  };\n}): string {\n  const metadataDocumentId = Reflect.get(\n    input.response.accessManifest.state,\n    \"metadataDocumentId\",\n  );\n  if (\n    typeof metadataDocumentId !== \"string\" ||\n    metadataDocumentId.length === 0\n  ) {\n    throw new Error(\"Container mutation response is missing metadata state\");\n  }\n\n  return metadataDocumentId;\n}\n\nexport function referencedPrincipalHeadsFromContainerMutationResponse(input: {\n  response: { referencedPrincipalHeads: readonly unknown[] };\n}): ReferencedPrincipalStateResponse[] {\n  return input.response.referencedPrincipalHeads.flatMap((head) => {\n    if (\n      !isReferencedPrincipalStateResponse(head) ||\n      !Number.isInteger(head.version) ||\n      !Number.isInteger(head.keyEpoch)\n    ) {\n      return [];\n    }\n\n    return [\n      {\n        principalType: head.principalType,\n        principalId: head.principalId,\n        version: head.version,\n        keyEpoch: head.keyEpoch,\n        stateHash: head.stateHash,\n        keyFingerprint: head.keyFingerprint,\n      },\n    ];\n  });\n}\n"]}

package/workflows/containers/root/create.d.ts

@@ -0,0 +1,16 @@
+import type { ContainerSystemSlot } from "../../../internal/validators/containerSystemSlot.js";
+import type { CreateOrganizationGroupRequest } from "../../../internal/validators/request/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import type { ContainerCreatePlan, ContainerMutationAuthor, MaterializedContainerCreatePlan } from "../../../data/containers/shared/types.js";
+export declare function buildRootContainerCreatePlan(input: {
+    adminGroup?: CreateOrganizationGroupRequest | undefined;
+    memberGroup?: CreateOrganizationGroupRequest | undefined;
+    systemSlot?: ContainerSystemSlot | undefined;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    containerKey?: Uint8Array | undefined;
+    metadataDocumentId: string;
+    recipientEncapsulationPublicKey: Uint8Array;
+    signedAt?: string | undefined;
+}): Promise<MaterializedContainerCreatePlan>;
+export declare function rootContainerWriterProjectionFromCreatePlan(plan: ContainerCreatePlan): ContainerWriterProjectionResponse;