@tearleads/client-sdk 0.1.11 → 0.1.14

package/workflows/containers/child/revoke.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.js","sourceRoot":"","sources":["revoke.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEL,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,SAAS,2BAA2B,CAAC,KAcpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC;QAChD,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,qCAAqC,CACtC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACvE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAmBvC;IACC,MAAM,IAAI,GAAwB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,gKAAgK;AAChK,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAkB1D;IACC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,MAAM,uCAAuC,CAAC;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACrE,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,kBAAkB,EAAE,uBAAuB;QAC3C,QAAQ,EAAE,qBAAqB;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACL,MAAM,IAAI,GAAmC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,mBAAmB;QACnB,WAAW,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;QAC1D,qBAAqB,EACnB,MAAM,wCAAwC,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,mBAAmB;QACnB,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,qBAAqB;QAC/B,YAAY;QACZ,yBAAyB,EAAE,SAAS,EAAE,mBAAmB,IAAI,IAAI;KAClE,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IACE,0BAA0B;QAC1B,CAAC,0BAA0B,CAAC,aAAa;YACvC,KAAK,CAAC,cAAc,CAAC,WAAW;YAChC,0BAA0B,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,wBAAwB,GAAG,0BAA0B;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CACtB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;YACjE,MAAM,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW,CAChE;QACH,CAAC,CAAC,iBAAiB,CAAC;IACtB,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,kBAAkB;QAClC,SAAS;QACT,eAAe;QACf,iBAAiB,EAAE,wBAAwB;QAC3C,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;QACpC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY;QACZ,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,wBAAwB;QAC3C,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAa3C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAClD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACtE,MAAM,EAAE,qBAAqB;oBAC3B,CAAC,CAAC,GAAG,EAAE,CACH,qBAAqB,CAAC,IAAI,CACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerAccessManifestState,\n  ContainerKekKeyring,\n  ContainerKekPredecessorBridge,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerRevokeAccessEventBody,\n  ContainerUserRecipientKey,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekKeyringHash,\n  computeContainerKekPredecessorBridgeHash,\n  deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerRotationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n  buildContainerCreateKeyEpoch,\n  signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRevokeApi,\n  ContainerRevokePlan,\n  MaterializedContainerRevokePlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n  type ContainerRevokeSubject,\n  deriveContainerRevokeManifest,\n} from \"./revokeManifest\";\nimport { resolveRotationContext } from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\n\nfunction buildContainerRevokeRequest(input: {\n  body: ContainerRevokeAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"revoke\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    predecessorBridge: readCanonicalRecord(\n      input.predecessorBridge,\n      \"Container revoke predecessor bridge\",\n    ),\n    keyring: readCanonicalRecord(input.keyring, \"Container revoke keyring\"),\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container revoke parent KEK state\",\n    ),\n  };\n}\n\nfunction buildContainerRevokePlanResult(input: {\n  body: ContainerRevokeAccessEventBody;\n  containerId: string;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  event: AccessEvent;\n  eventHash: string;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  state: ContainerAccessManifestState;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerRevokePlan {\n  const plan: ContainerRevokePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    event: input.event,\n    eventHash: input.eventHash,\n    keyEpoch: input.keyEpoch,\n    keyring: input.keyring,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousManifest: input.previousManifest,\n    request: buildContainerRevokeRequest({\n      body: input.body,\n      event: input.event,\n      keyEpoch: input.keyEpoch,\n      keyring: input.keyring,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: input.parentKek,\n      predecessorBridge: input.predecessorBridge,\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\n// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.\nexport async function buildMaterializedContainerRevokePlan(input: {\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /** Keys a batch minted above this container and has yet to commit. */\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /** False for a projection re-rooted on rotations not yet acknowledged. */\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  /** Verified policies the path may cite before they are stored locally. */\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;\n  revokedSubject: ContainerRevokeSubject;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<MaterializedContainerRevokePlan> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container revoke\",\n  );\n  const {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  } = await resolveRotationContext(input, \"revoke\");\n  const principalPolicies = await collectContainerRevokePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    previousProjection: input.previousProjection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;\n  const { containerKey, containerKeyEpochId, keyring, predecessorBridge } =\n    await buildContainerRotationArtifacts({\n      containerId: previousState.containerId,\n      currentKek: target.kek,\n      currentKeyMaterial: predecessorContainerKey,\n      keyEpoch: nextContainerKeyEpoch,\n      signedEpochIds: target.signedEpochIds,\n    });\n  const body: ContainerRevokeAccessEventBody = {\n    eventType: \"container.revoke\",\n    parentManifestHash:\n      input.previousProjection.path.at(-2)?.manifestHash ?? null,\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: previousState.containerId,\n      keyMaterial: containerKey,\n    }),\n    containerKeyEpochId,\n    keyringHash: await computeContainerKekKeyringHash(keyring),\n    predecessorBridgeHash:\n      await computeContainerKekPredecessorBridgeHash(predecessorBridge),\n    subjectId: input.revokedSubject.subjectId,\n    subjectType: input.revokedSubject.subjectType,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: target.manifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const { manifest, manifestHash, state } = await deriveContainerRevokeManifest(\n    {\n      containerKeyPublicKey: body.containerKeyPublicKey,\n      parentManifestHash: body.parentManifestHash,\n      containerKeyEpochId,\n      eventHash,\n      previousManifest: target.manifest,\n      revokedSubject: input.revokedSubject,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: previousState.containerId,\n    containerKeyEpochId,\n    eventHash,\n    keyEpoch: nextContainerKeyEpoch,\n    manifestHash,\n    parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,\n  });\n\n  const replacementPrincipalPolicy = input.replacementPrincipalPolicy;\n  if (\n    replacementPrincipalPolicy &&\n    (replacementPrincipalPolicy.principalType !==\n      input.revokedSubject.subjectType ||\n      replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)\n  ) {\n    throw new Error(\"Container revoke replacement principal does not match\");\n  }\n  const currentPrincipalPolicies = replacementPrincipalPolicy\n    ? principalPolicies.filter(\n        (policy) =>\n          policy.principalType !== replacementPrincipalPolicy.principalType ||\n          policy.principalId !== replacementPrincipalPolicy.principalId,\n      )\n    : principalPolicies;\n  const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n    containerKey,\n    containerKeyEpochId,\n    manifestHash,\n    operationLabel: \"Container revoke\",\n    parentKek,\n    parentPublicKey,\n    principalPolicies: currentPrincipalPolicies,\n    resolveUserKey: resolveProjectionUserKey,\n    state,\n  });\n\n  return buildContainerRevokePlanResult({\n    body,\n    containerId: previousState.containerId,\n    containerKey,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyring,\n    manifest,\n    manifestHash,\n    parentKek,\n    predecessorBridge,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies: currentPrincipalPolicies,\n    state,\n    userRecipientKeys,\n    wraps,\n  });\n}\n\nexport async function revokeRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  apiClient: ContainerRevokeApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  revokedSubject: ContainerRevokeSubject;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerRevokePlan;\n  response: ContainerRotationResponse;\n} | null> {\n  const previousProjection = await input.apiClient.getContainerWriterProjection(\n    input.containerId,\n  );\n  if (!previousProjection) {\n    return null;\n  }\n\n  const materializedPlan = await buildMaterializedContainerRevokePlan({\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    revokedSubject: input.revokedSubject,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    carriedRekeys: {\n      planning: {\n        apiClient: input.apiClient,\n        author: input.author,\n        execSql: input.execSql,\n        knownContainerKeks: new Map([\n          [\n            materializedPlan.plan.containerKeyEpochId,\n            materializedPlan.containerKey,\n          ],\n        ]),\n        resolveProjectionUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        targetSecretKey: input.targetSecretKey,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      rotated: () =>\n        containerWriterProjectionFromRotationPlan({\n          plan: materializedPlan.plan,\n          previousProjection,\n        }),\n    },\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: (carried) => {\n      const request = carried.length\n        ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n        : materializedPlan.plan.request;\n      const options = {\n        expectedPaymentRequiredOrganizationId: input.author.organizationId,\n      };\n      const { revokeContainerResult } = input.apiClient;\n      return submitContainerRotation({\n        plain: () =>\n          input.apiClient.revokeContainer(input.containerId, request, options),\n        result: revokeContainerResult\n          ? () =>\n              revokeContainerResult.call(\n                input.apiClient,\n                input.containerId,\n                request,\n                { ...options, reportErrors: false },\n              )\n          : undefined,\n      });\n    },\n  });\n}\n"]}
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["revoke.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEL,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,SAAS,2BAA2B,CAAC,KAcpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC;QAChD,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,qCAAqC,CACtC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACvE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAmBvC;IACC,MAAM,IAAI,GAAwB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,gKAAgK;AAChK,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAkB1D;IACC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,MAAM,uCAAuC,CAAC;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACrE,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,kBAAkB,EAAE,uBAAuB;QAC3C,QAAQ,EAAE,qBAAqB;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACL,MAAM,IAAI,GAAmC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,mBAAmB;QACnB,WAAW,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;QAC1D,qBAAqB,EACnB,MAAM,wCAAwC,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,mBAAmB;QACnB,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,qBAAqB;QAC/B,YAAY;QACZ,yBAAyB,EAAE,SAAS,EAAE,mBAAmB,IAAI,IAAI;KAClE,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IACE,0BAA0B;QAC1B,CAAC,0BAA0B,CAAC,aAAa;YACvC,KAAK,CAAC,cAAc,CAAC,WAAW;YAChC,0BAA0B,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,wBAAwB,GAAG,0BAA0B;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CACtB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;YACjE,MAAM,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW,CAChE;QACH,CAAC,CAAC,iBAAiB,CAAC;IACtB,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,kBAAkB;QAClC,SAAS;QACT,eAAe;QACf,iBAAiB,EAAE,wBAAwB;QAC3C,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;QACpC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY;QACZ,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,wBAAwB;QAC3C,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAa3C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAClD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACtE,MAAM,EAAE,qBAAqB;oBAC3B,CAAC,CAAC,GAAG,EAAE,CACH,qBAAqB,CAAC,IAAI,CACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AccessEvent,\n  AccessManifest,\n  ContainerAccessManifestState,\n  ContainerKekKeyring,\n  ContainerKekPredecessorBridge,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerRevokeAccessEventBody,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n  computeContainerKekKeyringHash,\n  computeContainerKekPredecessorBridgeHash,\n  deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerRotationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n  buildContainerCreateKeyEpoch,\n  signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRevokeApi,\n  ContainerRevokePlan,\n  MaterializedContainerRevokePlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n  type ContainerRevokeSubject,\n  deriveContainerRevokeManifest,\n} from \"./revokeManifest\";\nimport { resolveRotationContext } from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\n\nfunction buildContainerRevokeRequest(input: {\n  body: ContainerRevokeAccessEventBody;\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"revoke\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    predecessorBridge: readCanonicalRecord(\n      input.predecessorBridge,\n      \"Container revoke predecessor bridge\",\n    ),\n    keyring: readCanonicalRecord(input.keyring, \"Container revoke keyring\"),\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container revoke parent KEK state\",\n    ),\n  };\n}\n\nfunction buildContainerRevokePlanResult(input: {\n  body: ContainerRevokeAccessEventBody;\n  containerId: string;\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  event: AccessEvent;\n  eventHash: string;\n  keyEpoch: ContainerKeyEpoch;\n  keyring: ContainerKekKeyring;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  predecessorBridge: ContainerKekPredecessorBridge;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  state: ContainerAccessManifestState;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerRevokePlan {\n  const plan: ContainerRevokePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    event: input.event,\n    eventHash: input.eventHash,\n    keyEpoch: input.keyEpoch,\n    keyring: input.keyring,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousManifest: input.previousManifest,\n    request: buildContainerRevokeRequest({\n      body: input.body,\n      event: input.event,\n      keyEpoch: input.keyEpoch,\n      keyring: input.keyring,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: input.parentKek,\n      predecessorBridge: input.predecessorBridge,\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\n// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.\nexport async function buildMaterializedContainerRevokePlan(input: {\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /** Keys a batch minted above this container and has yet to commit. */\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /** False for a projection re-rooted on rotations not yet acknowledged. */\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  /** Verified policies the path may cite before they are stored locally. */\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n  revokedSubject: ContainerRevokeSubject;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<MaterializedContainerRevokePlan> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container revoke\",\n  );\n  const {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  } = await resolveRotationContext(input, \"revoke\");\n  const principalPolicies = await collectContainerRevokePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    previousProjection: input.previousProjection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey: resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;\n  const { containerKey, containerKeyEpochId, keyring, predecessorBridge } =\n    await buildContainerRotationArtifacts({\n      containerId: previousState.containerId,\n      currentKek: target.kek,\n      currentKeyMaterial: predecessorContainerKey,\n      keyEpoch: nextContainerKeyEpoch,\n      signedEpochIds: target.signedEpochIds,\n    });\n  const body: ContainerRevokeAccessEventBody = {\n    eventType: \"container.revoke\",\n    parentManifestHash:\n      input.previousProjection.path.at(-2)?.manifestHash ?? null,\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: previousState.containerId,\n      keyMaterial: containerKey,\n    }),\n    containerKeyEpochId,\n    keyringHash: await computeContainerKekKeyringHash(keyring),\n    predecessorBridgeHash:\n      await computeContainerKekPredecessorBridgeHash(predecessorBridge),\n    subjectId: input.revokedSubject.subjectId,\n    subjectType: input.revokedSubject.subjectType,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: target.manifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const { manifest, manifestHash, state } = await deriveContainerRevokeManifest(\n    {\n      containerKeyPublicKey: body.containerKeyPublicKey,\n      parentManifestHash: body.parentManifestHash,\n      containerKeyEpochId,\n      eventHash,\n      previousManifest: target.manifest,\n      revokedSubject: input.revokedSubject,\n    },\n  );\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: previousState.containerId,\n    containerKeyEpochId,\n    eventHash,\n    keyEpoch: nextContainerKeyEpoch,\n    manifestHash,\n    parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,\n  });\n\n  const replacementPrincipalPolicy = input.replacementPrincipalPolicy;\n  if (\n    replacementPrincipalPolicy &&\n    (replacementPrincipalPolicy.principalType !==\n      input.revokedSubject.subjectType ||\n      replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)\n  ) {\n    throw new Error(\"Container revoke replacement principal does not match\");\n  }\n  const currentPrincipalPolicies = replacementPrincipalPolicy\n    ? principalPolicies.filter(\n        (policy) =>\n          policy.principalType !== replacementPrincipalPolicy.principalType ||\n          policy.principalId !== replacementPrincipalPolicy.principalId,\n      )\n    : principalPolicies;\n  const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n    containerKey,\n    containerKeyEpochId,\n    manifestHash,\n    operationLabel: \"Container revoke\",\n    parentKek,\n    parentPublicKey,\n    principalPolicies: currentPrincipalPolicies,\n    resolveUserKey: resolveProjectionUserKey,\n    state,\n  });\n\n  return buildContainerRevokePlanResult({\n    body,\n    containerId: previousState.containerId,\n    containerKey,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyring,\n    manifest,\n    manifestHash,\n    parentKek,\n    predecessorBridge,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies: currentPrincipalPolicies,\n    state,\n    userRecipientKeys,\n    wraps,\n  });\n}\n\nexport async function revokeRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  apiClient: ContainerRevokeApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  revokedSubject: ContainerRevokeSubject;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerRevokePlan;\n  response: ContainerRotationResponse;\n} | null> {\n  const previousProjection = await input.apiClient.getContainerWriterProjection(\n    input.containerId,\n  );\n  if (!previousProjection) {\n    return null;\n  }\n\n  const materializedPlan = await buildMaterializedContainerRevokePlan({\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    revokedSubject: input.revokedSubject,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    carriedRekeys: {\n      planning: {\n        apiClient: input.apiClient,\n        author: input.author,\n        execSql: input.execSql,\n        knownContainerKeks: new Map([\n          [\n            materializedPlan.plan.containerKeyEpochId,\n            materializedPlan.containerKey,\n          ],\n        ]),\n        resolveProjectionUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        targetSecretKey: input.targetSecretKey,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      rotated: () =>\n        containerWriterProjectionFromRotationPlan({\n          plan: materializedPlan.plan,\n          previousProjection,\n        }),\n    },\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: (carried) => {\n      const request = carried.length\n        ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n        : materializedPlan.plan.request;\n      const options = {\n        expectedPaymentRequiredOrganizationId: input.author.organizationId,\n      };\n      const { revokeContainerResult } = input.apiClient;\n      return submitContainerRotation({\n        plain: () =>\n          input.apiClient.revokeContainer(input.containerId, request, options),\n        result: revokeContainerResult\n          ? () =>\n              revokeContainerResult.call(\n                input.apiClient,\n                input.containerId,\n                request,\n                { ...options, reportErrors: false },\n              )\n          : undefined,\n      });\n    },\n  });\n}\n"]}

package/workflows/containers/child/rotationPrincipalPolicies.js.map

@@ -1 +1 @@
-{"version":3,"file":"rotationPrincipalPolicies.js","sourceRoot":"","sources":["rotationPrincipalPolicies.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAGpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAQ7D;IACC,OAAO,uBAAuB,CAC5B,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/**\n * Shared by rekey and revoke. Lives apart from both: background descendant\n * repair imports the rekey planner, and revoke schedules that repair, so\n * declaring this in revoke would close a dependency cycle.\n */\nexport async function collectContainerRevokePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  return uniquePrincipalPolicies(\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  );\n}\n"]}
+{"version":3,"file":"rotationPrincipalPolicies.js","sourceRoot":"","sources":["rotationPrincipalPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAIpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAQ7D;IACC,OAAO,uBAAuB,CAC5B,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/**\n * Shared by rekey and revoke. Lives apart from both: background descendant\n * repair imports the rekey planner, and revoke schedules that repair, so\n * declaring this in revoke would close a dependency cycle.\n */\nexport async function collectContainerRevokePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  return uniquePrincipalPolicies(\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  );\n}\n"]}

package/workflows/containers/child/rotationWraps.js.map

@@ -1 +1 @@
-{"version":3,"file":"rotationWraps.js","sourceRoot":"","sources":["rotationWraps.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAGpD,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CACzC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa;QACzD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW;QACrD,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO;QAC7C,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC,QAAQ;QAC/C,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CACpD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,eAAe,KAAK,CAAC,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,SAAS,CAAC,OAAO,eAAe,KAAK,CAAC,SAAS,CAAC,QAAQ,sHAAsH,CACtS,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAIjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACzD,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QACnD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAClD,CAAC;IACF,IAAI,SAAS,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,uCAAuC,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAUjD;IAIC,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,wCAAwC,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,MAAM,wBAAwB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,mDAAmD,KAAK,CAAC,SAAS,EAAE,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;gBACjD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,OAAO,CAAC,sBAAsB;gBAC/D,MAAM,EAAE,KAAK,CAAC,SAAS;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;YACpE,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC;QACD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,CACvD,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAC9C,CACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantPrincipalHead,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\n\nfunction findPrincipalPolicy(input: {\n  operationLabel: string;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  reference: ReferencedPrincipalHead;\n}): VerifiedPrincipalPolicy {\n  const policy = input.principalPolicies.find(\n    (candidate) =>\n      candidate.principalType === input.reference.principalType &&\n      candidate.principalId === input.reference.principalId &&\n      candidate.version === input.reference.version &&\n      candidate.keyEpoch === input.reference.keyEpoch &&\n      candidate.stateHash === input.reference.stateHash,\n  );\n  if (!policy) {\n    // Invariant, not a recoverable state: the API commits a container head\n    // only when every referenced group head equals the group's current state\n    // (packages/api groupReferenceHeads.ts), and a group change that would\n    // leave a grant stale is refused unless it rematerializes that container\n    // in the same transaction (principalContainerRematerialization.ts). A\n    // verified projection therefore always carries the policy its manifest\n    // references; a miss means the caller resolved policies for a different\n    // head than the manifest it is rotating.\n    throw new Error(\n      `${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`,\n    );\n  }\n  return policy;\n}\n\nfunction referenceForManagedGrant(input: {\n  grant: ContainerDirectGrant;\n  operationLabel: string;\n  state: ContainerAccessManifestState;\n}): ContainerGrantPrincipalHead {\n  const reference = input.state.referencedPrincipalHeads.find(\n    (candidate) =>\n      candidate.principalType === input.grant.subjectType &&\n      candidate.principalId === input.grant.subjectId,\n  );\n  if (reference?.principalType !== \"group\") {\n    throw new Error(\n      `${input.operationLabel} referenced principal head is missing`,\n    );\n  }\n  return { ...reference, principalType: \"group\" };\n}\n\nexport async function buildContainerRotationWraps(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  operationLabel: string;\n  parentKek: ContainerKekResponse | null;\n  parentPublicKey: string | null;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  state: ContainerAccessManifestState;\n}): Promise<{\n  readonly userRecipientKeys: ContainerUserRecipientKey[];\n  readonly wraps: ContainerKeyWrap[];\n}> {\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n  const wraps: ContainerKeyWrap[] = [];\n  if (input.parentKek) {\n    if (!input.parentPublicKey) {\n      throw new Error(\n        `${input.operationLabel} parent wrapping public key is missing`,\n      );\n    }\n    wraps.push(\n      await wrapContainerKeyToParent({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        parentKek: input.parentKek,\n        parentPublicKey: input.parentPublicKey,\n      }),\n    );\n  }\n\n  for (const grant of input.state.directGrants) {\n    if (grant.subjectType === \"user\") {\n      const userKey = await input.resolveUserKey(grant.subjectId);\n      if (!userKey) {\n        throw new Error(\n          `${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`,\n        );\n      }\n      const recipient = await wrapContainerKeyToRootUser({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,\n        userId: grant.subjectId,\n      });\n      userRecipientKeys.push(recipient.userRecipientKey);\n      wraps.push(recipient.wrap);\n      continue;\n    }\n\n    const reference = referenceForManagedGrant({\n      grant,\n      operationLabel: input.operationLabel,\n      state: input.state,\n    });\n    const policy = findPrincipalPolicy({\n      operationLabel: input.operationLabel,\n      principalPolicies: input.principalPolicies,\n      reference,\n    });\n    const recipient = await wrapContainerKeyToManagedPrincipal({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,\n      principalHead: reference,\n    });\n    wraps.push(recipient.wrap);\n  }\n\n  return {\n    userRecipientKeys: userRecipientKeys.sort((left, right) =>\n      left.userId.localeCompare(right.userId),\n    ),\n    wraps: wraps.sort((left, right) =>\n      `${left.recipientKind}:${left.recipientId}`.localeCompare(\n        `${right.recipientKind}:${right.recipientId}`,\n      ),\n    ),\n  };\n}\n"]}
+{"version":3,"file":"rotationWraps.js","sourceRoot":"","sources":["rotationWraps.ts"],"names":[],"mappings":"AASA,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAIpD,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CACzC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa;QACzD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW;QACrD,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO;QAC7C,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC,QAAQ;QAC/C,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CACpD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,eAAe,KAAK,CAAC,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,SAAS,CAAC,OAAO,eAAe,KAAK,CAAC,SAAS,CAAC,QAAQ,sHAAsH,CACtS,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAIjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACzD,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QACnD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAClD,CAAC;IACF,IAAI,SAAS,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,uCAAuC,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAUjD;IAIC,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,wCAAwC,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,MAAM,wBAAwB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,mDAAmD,KAAK,CAAC,SAAS,EAAE,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;gBACjD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,OAAO,CAAC,sBAAsB;gBAC/D,MAAM,EAAE,KAAK,CAAC,SAAS;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;YACpE,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC;QACD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,CACvD,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAC9C,CACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantPrincipalHead,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nfunction findPrincipalPolicy(input: {\n  operationLabel: string;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  reference: ReferencedPrincipalHead;\n}): PrincipalPolicyCurrentEvidence {\n  const policy = input.principalPolicies.find(\n    (candidate) =>\n      candidate.principalType === input.reference.principalType &&\n      candidate.principalId === input.reference.principalId &&\n      candidate.version === input.reference.version &&\n      candidate.keyEpoch === input.reference.keyEpoch &&\n      candidate.stateHash === input.reference.stateHash,\n  );\n  if (!policy) {\n    // Invariant, not a recoverable state: the API commits a container head\n    // only when every referenced group head equals the group's current state\n    // (packages/api groupReferenceHeads.ts), and a group change that would\n    // leave a grant stale is refused unless it rematerializes that container\n    // in the same transaction (principalContainerRematerialization.ts). A\n    // verified projection therefore always carries the policy its manifest\n    // references; a miss means the caller resolved policies for a different\n    // head than the manifest it is rotating.\n    throw new Error(\n      `${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`,\n    );\n  }\n  return policy;\n}\n\nfunction referenceForManagedGrant(input: {\n  grant: ContainerDirectGrant;\n  operationLabel: string;\n  state: ContainerAccessManifestState;\n}): ContainerGrantPrincipalHead {\n  const reference = input.state.referencedPrincipalHeads.find(\n    (candidate) =>\n      candidate.principalType === input.grant.subjectType &&\n      candidate.principalId === input.grant.subjectId,\n  );\n  if (reference?.principalType !== \"group\") {\n    throw new Error(\n      `${input.operationLabel} referenced principal head is missing`,\n    );\n  }\n  return { ...reference, principalType: \"group\" };\n}\n\nexport async function buildContainerRotationWraps(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  operationLabel: string;\n  parentKek: ContainerKekResponse | null;\n  parentPublicKey: string | null;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  state: ContainerAccessManifestState;\n}): Promise<{\n  readonly userRecipientKeys: ContainerUserRecipientKey[];\n  readonly wraps: ContainerKeyWrap[];\n}> {\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n  const wraps: ContainerKeyWrap[] = [];\n  if (input.parentKek) {\n    if (!input.parentPublicKey) {\n      throw new Error(\n        `${input.operationLabel} parent wrapping public key is missing`,\n      );\n    }\n    wraps.push(\n      await wrapContainerKeyToParent({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        parentKek: input.parentKek,\n        parentPublicKey: input.parentPublicKey,\n      }),\n    );\n  }\n\n  for (const grant of input.state.directGrants) {\n    if (grant.subjectType === \"user\") {\n      const userKey = await input.resolveUserKey(grant.subjectId);\n      if (!userKey) {\n        throw new Error(\n          `${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`,\n        );\n      }\n      const recipient = await wrapContainerKeyToRootUser({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,\n        userId: grant.subjectId,\n      });\n      userRecipientKeys.push(recipient.userRecipientKey);\n      wraps.push(recipient.wrap);\n      continue;\n    }\n\n    const reference = referenceForManagedGrant({\n      grant,\n      operationLabel: input.operationLabel,\n      state: input.state,\n    });\n    const policy = findPrincipalPolicy({\n      operationLabel: input.operationLabel,\n      principalPolicies: input.principalPolicies,\n      reference,\n    });\n    const recipient = await wrapContainerKeyToManagedPrincipal({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,\n      principalHead: reference,\n    });\n    wraps.push(recipient.wrap);\n  }\n\n  return {\n    userRecipientKeys: userRecipientKeys.sort((left, right) =>\n      left.userId.localeCompare(right.userId),\n    ),\n    wraps: wraps.sort((left, right) =>\n      `${left.recipientKind}:${left.recipientId}`.localeCompare(\n        `${right.recipientKind}:${right.recipientId}`,\n      ),\n    ),\n  };\n}\n"]}

package/workflows/containers/child/sharePlanCore.d.ts

@@ -1,19 +1,20 @@
-import { type AccessEvent, type AccessManifest, type ContainerAccessManifestState, type ContainerDirectGrant, type ContainerGrantAccessEventBody, type ContainerGrantPrincipalHead, type ContainerKekRecipientTarget, type ContainerKeyWrap, type ContainerUserRecipientKey, type VerifiedPrincipalPolicy } from "../../../internal/crypto/index.js";
+import { type AccessEvent, type AccessManifest, type ContainerAccessManifestState, type ContainerDirectGrant, type ContainerGrantAccessEventBody, type ContainerGrantPrincipalHead, type ContainerKekRecipientTarget, type ContainerKeyWrap, type ContainerUserRecipientKey } from "../../../internal/crypto/index.js";
 import type { AccessManifestBundleWire } from "../../../internal/validators/request/index.js";
 import type { ContainerKekResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerSharePlan, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
 import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import type { PrincipalPolicyCurrentEvidence } from "../../../data/principals/principalPolicyEvidence.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 export type ContainerShareRecipient = {
     readonly recipientEncapsulationPublicKey: Uint8Array;
     readonly subjectId: string;
     readonly subjectType: "user";
 } | {
-    readonly principalPolicy: VerifiedPrincipalPolicy;
+    readonly principalPolicy: PrincipalPolicyCurrentEvidence;
     readonly subjectId: string;
     readonly subjectType: "group";
 };
-export declare function referencedPrincipalHeadFromPolicy(policy: VerifiedPrincipalPolicy): ContainerGrantPrincipalHead;
+export declare function referencedPrincipalHeadFromPolicy(policy: PrincipalPolicyCurrentEvidence): ContainerGrantPrincipalHead;
 /**
  * The previous manifest's referenced principal heads with the replacement
  * policy's head upserted in place of any stale head for the same principal.
@@ -23,16 +24,16 @@ export declare function referencedPrincipalHeadFromPolicy(policy: VerifiedPrinci
  */
 export declare function refreshedPrincipalReferences(input: {
     readonly previousState: ContainerAccessManifestState;
-    readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;
+    readonly replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
 }): ContainerGrantPrincipalHead[];
 /**
  * The previous policies with the replacement policy substituted for any
  * existing policy of the same principal identity.
  */
 export declare function refreshedPrincipalPolicies(input: {
-    readonly previousPolicies: readonly VerifiedPrincipalPolicy[];
-    readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;
-}): VerifiedPrincipalPolicy[];
+    readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];
+    readonly replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
+}): PrincipalPolicyCurrentEvidence[];
 export declare function deriveContainerShareManifest(input: {
     eventHash: string;
     grant: ContainerDirectGrant;
@@ -57,7 +58,7 @@ export declare function buildContainerSharePlanResult(input: {
     manifestHash: string;
     previousManifest: AccessManifestBundleWire;
     previousProjection: ContainerWriterProjectionResponse;
-    principalPolicies: readonly VerifiedPrincipalPolicy[];
+    principalPolicies: readonly PrincipalPolicyCurrentEvidence[];
     recipientTarget: ContainerKekRecipientTarget;
     state: ContainerAccessManifestState;
     targetKek: ContainerKekResponse;
@@ -74,8 +75,8 @@ export declare function collectContainerSharePrincipalPolicies(input: {
     persistVerificationCheckpoints?: boolean | undefined;
     principalPolicyCache?: PrincipalPolicyCache | undefined;
     previousProjection: ContainerWriterProjectionResponse;
-    recipientPolicy?: VerifiedPrincipalPolicy | undefined;
+    recipientPolicy?: PrincipalPolicyCurrentEvidence | undefined;
     resolveUserKey: ProjectionUserKeyResolver;
     stillCurrent?: (() => boolean) | undefined;
     warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<VerifiedPrincipalPolicy[]>;
+}): Promise<PrincipalPolicyCurrentEvidence[]>;

package/workflows/containers/child/sharePlanCore.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAE9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAc/B,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAA+B;IAE/B,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;QAC7D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerAccessManifestState,\n  type ContainerDirectGrant,\n  type ContainerGrantAccessEventBody,\n  type ContainerGrantPrincipalHead,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  type ContainerUserRecipientKey,\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  asContainerManifestBundle,\n  getParentKekForTarget,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n  readContainerKekRecipientTargets,\n  readContainerKeyEpoch,\n} from \"../../../data/containers/shared/readers\";\nimport type {\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n  | {\n      readonly recipientEncapsulationPublicKey: Uint8Array;\n      readonly subjectId: string;\n      readonly subjectType: \"user\";\n    }\n  | {\n      readonly principalPolicy: VerifiedPrincipalPolicy;\n      readonly subjectId: string;\n      readonly subjectType: \"group\";\n    };\n\nfunction grantKey(\n  grant: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n): string {\n  return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n  grants: readonly ContainerDirectGrant[],\n  grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n  return [\n    ...grants.filter(\n      (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n    ),\n    grant,\n  ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n  readonly principalId: string;\n  readonly principalType: \"group\";\n}): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n  policy: VerifiedPrincipalPolicy,\n): ContainerGrantPrincipalHead {\n  if (policy.principalType !== \"group\") {\n    throw new Error(\"Container grants can reference only group policies\");\n  }\n  return {\n    principalType: \"group\",\n    principalId: policy.principalId,\n    version: policy.version,\n    keyEpoch: policy.keyEpoch,\n    stateHash: policy.stateHash,\n    keyFingerprint: policy.state.keyFingerprint,\n  };\n}\n\nfunction upsertReferencedPrincipalHead(\n  references: readonly ContainerGrantPrincipalHead[],\n  reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n  return [\n    ...references.filter(\n      (existingReference) =>\n        referencedPrincipalKey(existingReference) !==\n        referencedPrincipalKey(reference),\n    ),\n    reference,\n  ].sort((left, right) =>\n    referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n  );\n}\n\n/**\n * The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n */\nexport function refreshedPrincipalReferences(input: {\n  readonly previousState: ContainerAccessManifestState;\n  readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;\n}): ContainerGrantPrincipalHead[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (\n    !replacement ||\n    !input.previousState.directGrants.some(\n      (grant) =>\n        grant.subjectType === replacement.principalType &&\n        grant.subjectId === replacement.principalId,\n    )\n  ) {\n    return [...input.previousState.referencedPrincipalHeads];\n  }\n  return upsertReferencedPrincipalHead(\n    input.previousState.referencedPrincipalHeads,\n    referencedPrincipalHeadFromPolicy(replacement),\n  );\n}\n\n/**\n * The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n  readonly previousPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly replacementPrincipalPolicy?: VerifiedPrincipalPolicy | undefined;\n}): VerifiedPrincipalPolicy[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (!replacement) {\n    return uniquePrincipalPolicies(input.previousPolicies);\n  }\n  return uniquePrincipalPolicies([\n    ...input.previousPolicies.filter(\n      (policy) =>\n        policy.principalType !== replacement.principalType ||\n        policy.principalId !== replacement.principalId,\n    ),\n    replacement,\n  ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  referencedPrincipalHead: ContainerGrantPrincipalHead | null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n    referencedPrincipalHeads: input.referencedPrincipalHead\n      ? upsertReferencedPrincipalHead(\n          previousState.referencedPrincipalHeads,\n          input.referencedPrincipalHead,\n        )\n      : previousState.referencedPrincipalHeads,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nfunction buildContainerShareRequest(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"share\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    containerManifestHistory: [...input.containerManifestHistory],\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container share parent KEK state\",\n    ),\n  };\n}\n\nexport function replaceContainerWrap(\n  wraps: readonly ContainerKeyWrap[],\n  nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n  return [\n    ...wraps.filter(\n      (wrap) =>\n        !(\n          wrap.recipientKind === nextWrap.recipientKind &&\n          wrap.recipientId === nextWrap.recipientId\n        ),\n    ),\n    nextWrap,\n  ];\n}\n\nexport function shareManifestHistory(input: {\n  readonly containerId: string;\n  readonly targetKek: ContainerKekResponse;\n  readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n  const byHash = new Map<string, AccessManifestBundleWire>();\n  for (const bundle of [\n    input.targetManifest,\n    ...input.targetKek.containerManifestHistory,\n  ]) {\n    if (\n      readContainerState(bundle).containerId === input.containerId &&\n      !byHash.has(bundle.manifestHash)\n    ) {\n      byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n    }\n  }\n  return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  containerId: string;\n  containerKey: Uint8Array;\n  event: AccessEvent;\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly VerifiedPrincipalPolicy[];\n  recipientTarget: ContainerKekRecipientTarget;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n  const keyEpoch = readContainerKeyEpoch(\n    input.targetKek.keyEpoch,\n    \"Container share key epoch\",\n  );\n  const plan: ContainerSharePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    event: input.event,\n    eventHash: input.eventHash,\n    grant: input.grant,\n    keyEpoch,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousKeyring: readCanonicalRecordOrNull(\n      input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n      \"Container share previous keyring\",\n    ),\n    previousManifest: input.previousManifest,\n    recipientTarget: input.recipientTarget,\n    request: buildContainerShareRequest({\n      body: input.body,\n      containerManifestHistory: input.containerManifestHistory,\n      event: input.event,\n      keyEpoch,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: getParentKekForTarget(input.previousProjection),\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n  newUserRecipientKey?: ContainerUserRecipientKey | undefined;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n  const directUserIds = new Set(\n    input.state.directGrants.flatMap((grant) =>\n      grant.subjectType === \"user\" ? [grant.subjectId] : [],\n    ),\n  );\n  const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n  for (const target of readContainerKekRecipientTargets(\n    input.targetKek.recipientTargets,\n    \"Container share target KEK recipient targets\",\n  )) {\n    if (\n      target.recipientKind !== \"user\" ||\n      !directUserIds.has(target.recipientId)\n    ) {\n      continue;\n    }\n    userRecipientKeyByUserId.set(target.recipientId, {\n      userId: target.recipientId,\n      recipientKeyEpochId: target.recipientKeyEpochId,\n      recipientKeyFingerprint: target.recipientKeyFingerprint,\n    });\n  }\n\n  if (input.newUserRecipientKey) {\n    userRecipientKeyByUserId.set(\n      input.newUserRecipientKey.userId,\n      input.newUserRecipientKey,\n    );\n  }\n\n  const missingUserId = [...directUserIds].find(\n    (userId) => !userRecipientKeyByUserId.has(userId),\n  );\n  if (missingUserId) {\n    throw new Error(\n      `Container share recipient key is missing for direct user grant ${missingUserId}`,\n    );\n  }\n\n  return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n    left.userId.localeCompare(right.userId),\n  );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientPolicy?: VerifiedPrincipalPolicy | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const previousPolicies =\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  return refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.recipientPolicy,\n  });\n}\n"]}
+{"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAc/B,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;QAC7D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerAccessManifestState,\n  type ContainerDirectGrant,\n  type ContainerGrantAccessEventBody,\n  type ContainerGrantPrincipalHead,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  type ContainerUserRecipientKey,\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  asContainerManifestBundle,\n  getParentKekForTarget,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n  readContainerKekRecipientTargets,\n  readContainerKeyEpoch,\n} from \"../../../data/containers/shared/readers\";\nimport type {\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n  | {\n      readonly recipientEncapsulationPublicKey: Uint8Array;\n      readonly subjectId: string;\n      readonly subjectType: \"user\";\n    }\n  | {\n      readonly principalPolicy: PrincipalPolicyCurrentEvidence;\n      readonly subjectId: string;\n      readonly subjectType: \"group\";\n    };\n\nfunction grantKey(\n  grant: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n): string {\n  return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n  grants: readonly ContainerDirectGrant[],\n  grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n  return [\n    ...grants.filter(\n      (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n    ),\n    grant,\n  ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n  readonly principalId: string;\n  readonly principalType: \"group\";\n}): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n  policy: PrincipalPolicyCurrentEvidence,\n): ContainerGrantPrincipalHead {\n  if (policy.principalType !== \"group\") {\n    throw new Error(\"Container grants can reference only group policies\");\n  }\n  return {\n    principalType: \"group\",\n    principalId: policy.principalId,\n    version: policy.version,\n    keyEpoch: policy.keyEpoch,\n    stateHash: policy.stateHash,\n    keyFingerprint: policy.state.keyFingerprint,\n  };\n}\n\nfunction upsertReferencedPrincipalHead(\n  references: readonly ContainerGrantPrincipalHead[],\n  reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n  return [\n    ...references.filter(\n      (existingReference) =>\n        referencedPrincipalKey(existingReference) !==\n        referencedPrincipalKey(reference),\n    ),\n    reference,\n  ].sort((left, right) =>\n    referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n  );\n}\n\n/**\n * The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n */\nexport function refreshedPrincipalReferences(input: {\n  readonly previousState: ContainerAccessManifestState;\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): ContainerGrantPrincipalHead[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (\n    !replacement ||\n    !input.previousState.directGrants.some(\n      (grant) =>\n        grant.subjectType === replacement.principalType &&\n        grant.subjectId === replacement.principalId,\n    )\n  ) {\n    return [...input.previousState.referencedPrincipalHeads];\n  }\n  return upsertReferencedPrincipalHead(\n    input.previousState.referencedPrincipalHeads,\n    referencedPrincipalHeadFromPolicy(replacement),\n  );\n}\n\n/**\n * The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n  readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): PrincipalPolicyCurrentEvidence[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (!replacement) {\n    return uniquePrincipalPolicies(input.previousPolicies);\n  }\n  return uniquePrincipalPolicies([\n    ...input.previousPolicies.filter(\n      (policy) =>\n        policy.principalType !== replacement.principalType ||\n        policy.principalId !== replacement.principalId,\n    ),\n    replacement,\n  ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  referencedPrincipalHead: ContainerGrantPrincipalHead | null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n    referencedPrincipalHeads: input.referencedPrincipalHead\n      ? upsertReferencedPrincipalHead(\n          previousState.referencedPrincipalHeads,\n          input.referencedPrincipalHead,\n        )\n      : previousState.referencedPrincipalHeads,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nfunction buildContainerShareRequest(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"share\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    containerManifestHistory: [...input.containerManifestHistory],\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container share parent KEK state\",\n    ),\n  };\n}\n\nexport function replaceContainerWrap(\n  wraps: readonly ContainerKeyWrap[],\n  nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n  return [\n    ...wraps.filter(\n      (wrap) =>\n        !(\n          wrap.recipientKind === nextWrap.recipientKind &&\n          wrap.recipientId === nextWrap.recipientId\n        ),\n    ),\n    nextWrap,\n  ];\n}\n\nexport function shareManifestHistory(input: {\n  readonly containerId: string;\n  readonly targetKek: ContainerKekResponse;\n  readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n  const byHash = new Map<string, AccessManifestBundleWire>();\n  for (const bundle of [\n    input.targetManifest,\n    ...input.targetKek.containerManifestHistory,\n  ]) {\n    if (\n      readContainerState(bundle).containerId === input.containerId &&\n      !byHash.has(bundle.manifestHash)\n    ) {\n      byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n    }\n  }\n  return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  containerId: string;\n  containerKey: Uint8Array;\n  event: AccessEvent;\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  recipientTarget: ContainerKekRecipientTarget;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n  const keyEpoch = readContainerKeyEpoch(\n    input.targetKek.keyEpoch,\n    \"Container share key epoch\",\n  );\n  const plan: ContainerSharePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    event: input.event,\n    eventHash: input.eventHash,\n    grant: input.grant,\n    keyEpoch,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousKeyring: readCanonicalRecordOrNull(\n      input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n      \"Container share previous keyring\",\n    ),\n    previousManifest: input.previousManifest,\n    recipientTarget: input.recipientTarget,\n    request: buildContainerShareRequest({\n      body: input.body,\n      containerManifestHistory: input.containerManifestHistory,\n      event: input.event,\n      keyEpoch,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: getParentKekForTarget(input.previousProjection),\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n  newUserRecipientKey?: ContainerUserRecipientKey | undefined;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n  const directUserIds = new Set(\n    input.state.directGrants.flatMap((grant) =>\n      grant.subjectType === \"user\" ? [grant.subjectId] : [],\n    ),\n  );\n  const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n  for (const target of readContainerKekRecipientTargets(\n    input.targetKek.recipientTargets,\n    \"Container share target KEK recipient targets\",\n  )) {\n    if (\n      target.recipientKind !== \"user\" ||\n      !directUserIds.has(target.recipientId)\n    ) {\n      continue;\n    }\n    userRecipientKeyByUserId.set(target.recipientId, {\n      userId: target.recipientId,\n      recipientKeyEpochId: target.recipientKeyEpochId,\n      recipientKeyFingerprint: target.recipientKeyFingerprint,\n    });\n  }\n\n  if (input.newUserRecipientKey) {\n    userRecipientKeyByUserId.set(\n      input.newUserRecipientKey.userId,\n      input.newUserRecipientKey,\n    );\n  }\n\n  const missingUserId = [...directUserIds].find(\n    (userId) => !userRecipientKeyByUserId.has(userId),\n  );\n  if (missingUserId) {\n    throw new Error(\n      `Container share recipient key is missing for direct user grant ${missingUserId}`,\n    );\n  }\n\n  return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n    left.userId.localeCompare(right.userId),\n  );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const previousPolicies =\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  return refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.recipientPolicy,\n  });\n}\n"]}

package/workflows/documents/linkSetAuthority.js.map

@@ -1 +1 @@
-{"version":3,"file":"linkSetAuthority.js","sourceRoot":"","sources":["linkSetAuthority.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAEL,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iDAAiD,GAElD,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AAGxG,iFAAiF;AACjF,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,MAAM;QACf,cAAc,EAAE,KAAK,CAAC,yBAAyB,CAAC,cAAc;KAC/D,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,MAAM;QACN,aAAa,EAAE,OAAgB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;IACF,2BAA2B,CAAC;QAC1B,GAAG,UAAU;QACb,UAAU,EAAE,KAAK,CAAC,yBAAyB;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,0CAA0C,CACvD,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,2BAA2B,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAClC,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAKiC;IAEjC,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,OAAO;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,UAAU,IAAI;YACvB,KAAK,CAAC,yBAAyB;YAC/B,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;SACxD,EAAE,CAAC;YACF,MAAM,iDAAiD,CAAC;gBACtD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uCAAuC,CACrC,KAAK,EACL,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { AnyVerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  assertContainerAuthorAccess,\n  ContainerAuthorAccessError,\n} from \"../../data/containers/shared/authorAccess\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../data/documents/shared/projection\";\nimport type { DocumentCreateAuthor } from \"../../data/documents/shared/types\";\nimport {\n  type ProjectionVerificationOptions,\n  resolveProjectionVerifier,\n} from \"../../data/documents/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../data/keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\n/** Both paths have been verified; a readable proof does not authorize a link. */\nexport function assertDocumentLinkAuthorAccess(input: {\n  author: DocumentCreateAuthor;\n  principalPolicies: readonly AnyVerifiedPrincipalPolicy[];\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  const author = {\n    ...input.author,\n    organizationId: input.targetContainerProjection.organizationId,\n  };\n  const permission = {\n    author,\n    minimumAccess: \"write\" as const,\n    principalPolicies: input.principalPolicies,\n  };\n  assertContainerAuthorAccess({\n    ...permission,\n    projection: input.targetContainerProjection,\n  });\n  const linked = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    if (!linked.includes(projection.containerId)) continue;\n    try {\n      assertContainerAuthorAccess({ ...permission, projection });\n      return;\n    } catch (error) {\n      if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    }\n  }\n  throw new ContainerAuthorAccessError(\n    \"Document signer lacks write access through a linked container\",\n  );\n}\n\n/** Current write authorization needs full policies for the readable paths. */\nexport async function verifyDocumentLinkSetCurrentPolicies(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache: PrincipalPolicyCache;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<void> {\n  resolveProjectionVerifier(input, \"Document link-set current policies\");\n  if (input.trustedLocalProjection === true) return;\n  try {\n    for (const projection of [\n      input.targetContainerProjection,\n      ...documentContainerProjections(input.writerProjection),\n    ]) {\n      await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      });\n    }\n  } catch (error) {\n    throwKeyingVerificationErrorWithContext(\n      error,\n      \"Document link-set current policy verification failed\",\n    );\n  }\n}\n"]}
+{"version":3,"file":"linkSetAuthority.js","sourceRoot":"","sources":["linkSetAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAEL,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iDAAiD,GAElD,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AAIxG,iFAAiF;AACjF,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,MAAM;QACf,cAAc,EAAE,KAAK,CAAC,yBAAyB,CAAC,cAAc;KAC/D,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,MAAM;QACN,aAAa,EAAE,OAAgB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;IACF,2BAA2B,CAAC;QAC1B,GAAG,UAAU;QACb,UAAU,EAAE,KAAK,CAAC,yBAAyB;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,0CAA0C,CACvD,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,2BAA2B,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAClC,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAKiC;IAEjC,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,OAAO;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,UAAU,IAAI;YACvB,KAAK,CAAC,yBAAyB;YAC/B,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;SACxD,EAAE,CAAC;YACF,MAAM,iDAAiD,CAAC;gBACtD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uCAAuC,CACrC,KAAK,EACL,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  assertContainerAuthorAccess,\n  ContainerAuthorAccessError,\n} from \"../../data/containers/shared/authorAccess\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../data/documents/shared/projection\";\nimport type { DocumentCreateAuthor } from \"../../data/documents/shared/types\";\nimport {\n  type ProjectionVerificationOptions,\n  resolveProjectionVerifier,\n} from \"../../data/documents/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../data/keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\n/** Both paths have been verified; a readable proof does not authorize a link. */\nexport function assertDocumentLinkAuthorAccess(input: {\n  author: DocumentCreateAuthor;\n  principalPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  const author = {\n    ...input.author,\n    organizationId: input.targetContainerProjection.organizationId,\n  };\n  const permission = {\n    author,\n    minimumAccess: \"write\" as const,\n    principalPolicies: input.principalPolicies,\n  };\n  assertContainerAuthorAccess({\n    ...permission,\n    projection: input.targetContainerProjection,\n  });\n  const linked = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    if (!linked.includes(projection.containerId)) continue;\n    try {\n      assertContainerAuthorAccess({ ...permission, projection });\n      return;\n    } catch (error) {\n      if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    }\n  }\n  throw new ContainerAuthorAccessError(\n    \"Document signer lacks write access through a linked container\",\n  );\n}\n\n/** Current write authorization needs full policies for the readable paths. */\nexport async function verifyDocumentLinkSetCurrentPolicies(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache: PrincipalPolicyCache;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<void> {\n  resolveProjectionVerifier(input, \"Document link-set current policies\");\n  if (input.trustedLocalProjection === true) return;\n  try {\n    for (const projection of [\n      input.targetContainerProjection,\n      ...documentContainerProjections(input.writerProjection),\n    ]) {\n      await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      });\n    }\n  } catch (error) {\n    throwKeyingVerificationErrorWithContext(\n      error,\n      \"Document link-set current policy verification failed\",\n    );\n  }\n}\n"]}

package/workflows/principals/index.d.ts

@@ -1,3 +1,4 @@
 export { type CachePrincipalPolicyBundlesOptions, type CacheReferencedPrincipalPoliciesOptions, cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
 export { PrincipalPolicyHistoryReadError, type RecoveredPrincipalPolicyHistory, type RecoverPrincipalPolicyHistoryOptions, } from "./principalHistoryRecoveryTypes.js";
 export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+export { type RecoveredScopedPrincipalPolicyHistory, type RecoverScopedPrincipalPolicyHistoryOptions, recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";

package/workflows/principals/index.js

@@ -1,4 +1,5 @@
 export { cachePrincipalPolicyBundles, cacheReferencedPrincipalPolicies, } from "./policyCache.js";
 export { PrincipalPolicyHistoryReadError, } from "./principalHistoryRecoveryTypes.js";
 export { recoverPrincipalPolicyHistory } from "./recoverPrincipalPolicyHistory.js";
+export { recoverScopedPrincipalPolicyHistory, } from "./recoverScopedPrincipalPolicyHistory.js";
 //# sourceMappingURL=index.js.map

package/workflows/principals/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC","sourcesContent":["export {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+BAA+B,GAGhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC","sourcesContent":["export {\n  type CachePrincipalPolicyBundlesOptions,\n  type CacheReferencedPrincipalPoliciesOptions,\n  cachePrincipalPolicyBundles,\n  cacheReferencedPrincipalPolicies,\n} from \"./policyCache\";\nexport {\n  PrincipalPolicyHistoryReadError,\n  type RecoveredPrincipalPolicyHistory,\n  type RecoverPrincipalPolicyHistoryOptions,\n} from \"./principalHistoryRecoveryTypes\";\nexport { recoverPrincipalPolicyHistory } from \"./recoverPrincipalPolicyHistory\";\nexport {\n  type RecoveredScopedPrincipalPolicyHistory,\n  type RecoverScopedPrincipalPolicyHistoryOptions,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./recoverScopedPrincipalPolicyHistory\";\n"]}

package/workflows/principals/principalHistoryRecoveryPrefix.js

@@ -0,0 +1,65 @@
+import { restorePrincipalPolicyHistoryVerifier, serializeKeyingCanonicalJson, } from "../../internal/crypto/index.js";
+import { isReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
+import { discardPrincipalHistoryPrefix, loadPrincipalHistoryPrefix, savePrincipalHistoryPrefix, } from "../../data/persistence/principalHistoryPrefixPersistence.js";
+import { principalHistoryPrefixProtection } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { parsePrincipalHistoryStageCurrent } from "../../data/principals/principalHistoryStageProtection.js";
+export async function loadVerifiedPrincipalHistoryPrefix(options, historyInput, scopeId) {
+    const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);
+    if (!saved)
+        return null;
+    let head;
+    try {
+        head = JSON.parse(saved.headJson);
+    }
+    catch {
+        head = null;
+    }
+    if (saved.organizationId === options.organizationId &&
+        isReferencedPrincipalStateResponse(head) &&
+        head.principalType === historyInput.principalType &&
+        head.principalId === historyInput.principalId &&
+        head.version === saved.version) {
+        const restored = await restorePrincipalPolicyHistoryVerifier(historyInput, saved.progress, await principalHistoryPrefixProtection(options.protection, saved));
+        const current = parsePrincipalHistoryStageCurrent({
+            currentJson: saved.currentJson,
+            afterVersion: saved.version - 1,
+        });
+        if (restored.ok && restored.value.finish(head).ok && current)
+            return { verifier: restored.value, head, current };
+    }
+    await discardPrincipalHistoryPrefix({
+        execSql: options.execSql,
+        prefix: saved,
+        stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),
+    });
+    return null;
+}
+export async function restoreReusablePrincipalHistoryPrefix(options, historyInput, scopeId) {
+    const prefix = await loadVerifiedPrincipalHistoryPrefix(options, historyInput, scopeId);
+    if (!prefix || prefix.head.version > options.expectedHead.version)
+        return null;
+    if (prefix.head.version < options.expectedHead.version ||
+        prefix.verifier.finish(options.expectedHead).ok)
+        return { ...prefix, version: prefix.head.version };
+    // An incompatible target cannot erase an independently valid local hint.
+    return null;
+}
+/** The verifier must use stable empty selection/checkpoint inputs. */
+export async function publishReusablePrincipalHistoryPrefix(options, scopeId, verifier, current) {
+    const prefix = {
+        scopeId,
+        organizationId: options.organizationId,
+        version: options.expectedHead.version,
+        headJson: serializeKeyingCanonicalJson({ ...options.expectedHead }),
+        currentJson: JSON.stringify(current),
+    };
+    const sealed = await verifier.exportProgress(await principalHistoryPrefixProtection(options.protection, prefix));
+    if (!sealed.ok)
+        throw sealed.error;
+    await savePrincipalHistoryPrefix({
+        execSql: options.execSql,
+        prefix: { ...prefix, progress: sealed.value },
+        stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),
+    });
+}
+//# sourceMappingURL=principalHistoryRecoveryPrefix.js.map

package/workflows/principals/principalHistoryRecoveryPrefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryRecoveryPrefix.js","sourceRoot":"","sources":["principalHistoryRecoveryPrefix.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAG1G,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAmE,EACnE,YAAyC,EACzC,OAAe;IAMf,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC/C,kCAAkC,CAAC,IAAI,CAAC;QACxC,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QACjD,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC7C,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAC9B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC1D,YAAY,EACZ,KAAK,CAAC,QAAQ,EACd,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAClE,CAAC;QACF,MAAM,OAAO,GAAG,iCAAiC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO;YAC1D,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,6BAA6B,CAAC;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,YAAyC,EACzC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACrD,OAAO,EACP,YAAY,EACZ,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAC/D,OAAO,IAAI,CAAC;IACd,IACE,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO;QAClD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE;QAE/C,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACrD,yEAAyE;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAA6C,EAC7C,OAAe,EACf,QAAwC,EACxC,OAAmC;IAEnC,MAAM,MAAM,GAAG;QACb,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,OAAO;QACrC,QAAQ,EAAE,4BAA4B,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,MAAM,gCAAgC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CACnE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,0BAA0B,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QAC7C,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyHistoryInput,\n  type PrincipalPolicyHistoryVerifier,\n  type ReferencedPrincipalHead,\n  restorePrincipalPolicyHistoryVerifier,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { isReferencedPrincipalStateResponse } from \"@tearleads/validators/response\";\nimport {\n  discardPrincipalHistoryPrefix,\n  loadPrincipalHistoryPrefix,\n  savePrincipalHistoryPrefix,\n} from \"../../data/persistence/principalHistoryPrefixPersistence\";\nimport { principalHistoryPrefixProtection } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { parsePrincipalHistoryStageCurrent } from \"../../data/principals/principalHistoryStageProtection\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport async function loadVerifiedPrincipalHistoryPrefix(\n  options: Omit<RecoverPrincipalPolicyHistoryOptions, \"expectedHead\">,\n  historyInput: PrincipalPolicyHistoryInput,\n  scopeId: string,\n): Promise<{\n  verifier: PrincipalPolicyHistoryVerifier;\n  head: ReferencedPrincipalHead;\n  current: PrincipalPolicyPageCurrent;\n} | null> {\n  const saved = await loadPrincipalHistoryPrefix(options.execSql, scopeId);\n  if (!saved) return null;\n  let head: unknown;\n  try {\n    head = JSON.parse(saved.headJson);\n  } catch {\n    head = null;\n  }\n  if (\n    saved.organizationId === options.organizationId &&\n    isReferencedPrincipalStateResponse(head) &&\n    head.principalType === historyInput.principalType &&\n    head.principalId === historyInput.principalId &&\n    head.version === saved.version\n  ) {\n    const restored = await restorePrincipalPolicyHistoryVerifier(\n      historyInput,\n      saved.progress,\n      await principalHistoryPrefixProtection(options.protection, saved),\n    );\n    const current = parsePrincipalHistoryStageCurrent({\n      currentJson: saved.currentJson,\n      afterVersion: saved.version - 1,\n    });\n    if (restored.ok && restored.value.finish(head).ok && current)\n      return { verifier: restored.value, head, current };\n  }\n  await discardPrincipalHistoryPrefix({\n    execSql: options.execSql,\n    prefix: saved,\n    stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n  });\n  return null;\n}\n\nexport async function restoreReusablePrincipalHistoryPrefix(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  historyInput: PrincipalPolicyHistoryInput,\n  scopeId: string,\n) {\n  const prefix = await loadVerifiedPrincipalHistoryPrefix(\n    options,\n    historyInput,\n    scopeId,\n  );\n  if (!prefix || prefix.head.version > options.expectedHead.version)\n    return null;\n  if (\n    prefix.head.version < options.expectedHead.version ||\n    prefix.verifier.finish(options.expectedHead).ok\n  )\n    return { ...prefix, version: prefix.head.version };\n  // An incompatible target cannot erase an independently valid local hint.\n  return null;\n}\n\n/** The verifier must use stable empty selection/checkpoint inputs. */\nexport async function publishReusablePrincipalHistoryPrefix(\n  options: RecoverPrincipalPolicyHistoryOptions,\n  scopeId: string,\n  verifier: PrincipalPolicyHistoryVerifier,\n  current: PrincipalPolicyPageCurrent,\n): Promise<void> {\n  const prefix = {\n    scopeId,\n    organizationId: options.organizationId,\n    version: options.expectedHead.version,\n    headJson: serializeKeyingCanonicalJson({ ...options.expectedHead }),\n    currentJson: JSON.stringify(current),\n  };\n  const sealed = await verifier.exportProgress(\n    await principalHistoryPrefixProtection(options.protection, prefix),\n  );\n  if (!sealed.ok) throw sealed.error;\n  await savePrincipalHistoryPrefix({\n    execSql: options.execSql,\n    prefix: { ...prefix, progress: sealed.value },\n    stillCurrent: () => !options.signal?.aborted && options.stillCurrent(),\n  });\n}\n"]}

package/workflows/principals/principalHistoryRecoveryReferences.js

@@ -0,0 +1,60 @@
+import { KeyingVerificationError, verifyPrincipalPolicyHistoryReferences, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadPrincipalHistoryReference } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+export class PrincipalHistoryEvidenceUnavailableError extends Error {
+    verificationError;
+    constructor(verificationError) {
+        super(verificationError.message);
+        this.verificationError = verificationError;
+        this.name = "PrincipalHistoryEvidenceUnavailableError";
+    }
+}
+async function selectReferences(input) {
+    const { options, scopeId, history } = input;
+    const current = () => !options.signal?.aborted && options.stillCurrent();
+    const base = { execSql: options.execSql, scopeId, history };
+    const references = [];
+    for (const reference of options.retainedReferences ?? []) {
+        assertProjectionVerificationCurrent(current);
+        references.push(await loadPrincipalHistoryReference({
+            ...base,
+            version: reference.version,
+        }));
+    }
+    assertProjectionVerificationCurrent(current);
+    const checkpointReference = input.checkpoint
+        ? await loadPrincipalHistoryReference({
+            ...base,
+            version: input.checkpoint.version,
+        })
+        : undefined;
+    const selected = await verifyPrincipalPolicyHistoryReferences({
+        history,
+        references,
+        checkpointReference,
+    });
+    if (!selected.ok)
+        throw selected.error;
+    assertProjectionVerificationCurrent(current);
+    return selected.value;
+}
+export async function selectRecoveredPrincipalHistory(input) {
+    let selected;
+    try {
+        selected = await selectReferences(input);
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError)
+            throw new PrincipalHistoryEvidenceUnavailableError(error);
+        throw error;
+    }
+    // First authenticate the stored entry against the private root. Only then
+    // compare the caller's citation, so a bad request is not treated as cache loss.
+    for (const reference of input.options.retainedReferences ?? []) {
+        if (!selected.retainedEntries.some(({ state }) => principalHeadMatchesReference(state, reference)))
+            throw new KeyingVerificationError("object_mismatch", "Requested citation does not match the verified principal history");
+    }
+    return selected;
+}
+//# sourceMappingURL=principalHistoryRecoveryReferences.js.map

package/workflows/principals/principalHistoryRecoveryReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryRecoveryReferences.js","sourceRoot":"","sources":["principalHistoryRecoveryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAIvB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAGtG,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IAC5C;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE7D,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAAC,KAK/B;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACzD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CACb,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,KAAK,CAAC,UAAU;QAC1C,CAAC,CAAC,MAAM,6BAA6B,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;SAClC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,OAAO;QACP,UAAU;QACV,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA6C;IAE7C,IAAI,QAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAC1C,MAAM,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,gFAAgF;IAChF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAC/D,IACE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC3C,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD;YAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyHistoryReferenceProof,\n  type VerifiedPrincipalPolicyHistory,\n  verifyPrincipalPolicyHistoryReferences,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalHistoryReference } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"./principalHistoryRecoveryTypes\";\n\nexport class PrincipalHistoryEvidenceUnavailableError extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n    this.name = \"PrincipalHistoryEvidenceUnavailableError\";\n  }\n}\n\nasync function selectReferences(input: {\n  readonly options: RecoverPrincipalPolicyHistoryOptions;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly checkpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<VerifiedPrincipalPolicyHistory> {\n  const { options, scopeId, history } = input;\n  const current = () => !options.signal?.aborted && options.stillCurrent();\n  const base = { execSql: options.execSql, scopeId, history };\n  const references: PrincipalPolicyHistoryReferenceProof[] = [];\n  for (const reference of options.retainedReferences ?? []) {\n    assertProjectionVerificationCurrent(current);\n    references.push(\n      await loadPrincipalHistoryReference({\n        ...base,\n        version: reference.version,\n      }),\n    );\n  }\n  assertProjectionVerificationCurrent(current);\n  const checkpointReference = input.checkpoint\n    ? await loadPrincipalHistoryReference({\n        ...base,\n        version: input.checkpoint.version,\n      })\n    : undefined;\n  const selected = await verifyPrincipalPolicyHistoryReferences({\n    history,\n    references,\n    checkpointReference,\n  });\n  if (!selected.ok) throw selected.error;\n  assertProjectionVerificationCurrent(current);\n  return selected.value;\n}\n\nexport async function selectRecoveredPrincipalHistory(\n  input: Parameters<typeof selectReferences>[0],\n): Promise<VerifiedPrincipalPolicyHistory> {\n  let selected: VerifiedPrincipalPolicyHistory;\n  try {\n    selected = await selectReferences(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError)\n      throw new PrincipalHistoryEvidenceUnavailableError(error);\n    throw error;\n  }\n  // First authenticate the stored entry against the private root. Only then\n  // compare the caller's citation, so a bad request is not treated as cache loss.\n  for (const reference of input.options.retainedReferences ?? []) {\n    if (\n      !selected.retainedEntries.some(({ state }) =>\n        principalHeadMatchesReference(state, reference),\n      )\n    )\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"Requested citation does not match the verified principal history\",\n      );\n  }\n  return selected;\n}\n"]}