npm - @tearleads/client-sdk - Versions diffs - 0.1.58 → 0.1.60 - Mend

@tearleads/client-sdk 0.1.58 → 0.1.60

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (477) hide show

package/workflows/containers/child/recite.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"recite.js","sourceRoot":"","sources":["recite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,EACrB,iCAAiC,GAClC,MAAM,oDAAoD,CAAC;AAI5D,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,oEAAoE,CAAC;AAE5E,OAAO,EAEL,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,oCAAoC,EACpC,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAEtB,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAW9B,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAkC;IAElC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,MAAM,4BAA4B,CACnD,OAAO,EACP,WAAW,EACX,IAAI,CAAC,KAAK,CAAC,cAAc,EACzB,IAAI,CAAC,KAAK,CAAC,WAAW,CACvB,CAAC;QACF,IAAI,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAiC,EACjC,IAAkC,EAClC,QAA8D;IAE9D,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;QACvE,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC;QACH,oCAAoC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,uBAAuB;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,uBAAuB,CACzB,eAAe,EACf,uCAAuC,CACxC,CAAC;QACR,MAAM,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE;YAC1C,SAAS,EAAE,8BAA8B;YACzC,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,YAAY,EAAE;SAC3D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,YAAY;YACV,MAAM,uDAAuD,CAAC;gBAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC;gBAChD,iCAAiC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACrD,UAAU,EAAE,WAAW;oBACvB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;oBAChC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;oBACzC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;oBACvB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;iBACvC,CAAC,CAAC;gBACH,kCAAkC,EAAE,YAAY,CAAC,GAAG,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAC9B;gBACD,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7D,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,iCAAiC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAgB,EAChB,QAAyD;IAEzD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IACE,UAAU,EAAE,OAAO,KAAK,MAAM,CAAC,OAAO;YACtC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAEzC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAiC,EACjC,IAAkC,EAClC,QAAgB;IAEhB,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1C,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CACL,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CACf,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAC9D;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,QAAQ,IAAI,oBAAoB;YAAE,OAAO;QAC7C,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,yEAAyE;YACzE,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAChE,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvE,IAAI,OAAO;gBAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,uEAAuE;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAW,CAAC;AAEvC,wEAAwE;AACxE,MAAM,UAAU,iCAAiC,CAC/C,KAEC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,iCAAiC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IACnC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,KAAK,OAAO,CAAC,OAAO,EAAE;SACnB,IAAI,CAAC,GAAG,EAAE,CACT,qBAAqB,CAAC;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,sEAAsE;QACtE,iEAAiE;QACjE,OAAO,EAAE,SAAS;QAClB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;KACzD,CAAC,CACH;SACA,KAAK,CAAC,GAAG,EAAE;QACV,wEAAwE;IAC1E,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport {\n type HeldContainerHead,\n heldContainerPath,\n heldContainerSnapshot,\n rememberAcknowledgedContainerHead,\n} from \"../../../data/containers/shared/heldContainerHeads\";\nimport type { AuthoredContainerMutationHead } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n loadAccessManifestCheckpoint,\n loadPrincipalPolicyCheckpoint,\n} from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport {\n advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n locallyAuthoredAccessManifestHead,\n} from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport {\n type ExecSql,\n resolveCanonicalExecSql,\n} from \"../../../data/sqlite/sqlSchema\";\nimport {\n assertContainerReciteAcknowledgement,\n buildContainerRecitePlan,\n referencedRecitationPolicies,\n} from \"./recitePlan\";\n\nconst MAX_RECITES_PER_PASS = 8;\nconst RECITE_SPACING_MS = 250;\n\ninterface ReciteHeldDescendantsInput {\n readonly apiClient: ContainerReciteApi;\n readonly author: ContainerMutationAuthor;\n readonly ancestorIds: readonly string[];\n readonly execSql: ExecSql;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}\n\nasync function pathIsPinned(\n execSql: ExecSql,\n path: readonly HeldContainerHead[],\n): Promise<boolean> {\n for (const head of path) {\n const checkpoint = await loadAccessManifestCheckpoint(\n execSql,\n \"container\",\n head.state.organizationId,\n head.state.containerId,\n );\n if (checkpoint?.manifestHash !== head.bundle.manifestHash) return false;\n }\n return true;\n}\n\nasync function recitePinnedPath(\n input: ReciteHeldDescendantsInput,\n path: readonly HeldContainerHead[],\n policies: ReturnType<typeof heldContainerSnapshot>[\"policies\"],\n): Promise<HeldContainerHead \| null> {\n const usedPolicies = referencedRecitationPolicies(path, policies);\n if (!(await policiesArePinned(input.execSql, usedPolicies))) return null;\n const plan = await buildContainerRecitePlan({\n author: input.author,\n path,\n policies: usedPolicies,\n });\n if (!(await policiesArePinned(input.execSql, usedPolicies))) return null;\n if (!(await pathIsPinned(input.execSql, path))) return null;\n if (input.stillCurrent?.() === false) return null;\n const id = plan.state.containerId;\n const response = await input.apiClient.reciteContainer(id, plan.request, {\n reportErrors: false,\n });\n if (!response \|\| input.stillCurrent?.() === false) return null;\n try {\n assertContainerReciteAcknowledgement(plan, response);\n } catch (error) {\n const failure =\n error instanceof KeyingVerificationError\n ? error\n : new KeyingVerificationError(\n \"invalid_shape\",\n \"Malformed re-citation acknowledgement\",\n );\n await input.reportSecurityIncident(failure, {\n operation: \"container.recite.acknowledge\",\n objectKind: \"container\",\n objectId: id,\n organizationId: input.author.organizationId,\n evidenceHashes: { plannedManifestHash: plan.manifestHash },\n });\n return null;\n }\n let acknowledged: boolean;\n try {\n acknowledged =\n await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n execSql: input.execSql,\n heads: [locallyAuthoredAccessManifestHead(plan)],\n expectedAccessManifestCheckpoints: path.map((head) => ({\n objectKind: \"container\",\n objectId: head.state.containerId,\n organizationId: head.state.organizationId,\n epoch: head.state.epoch,\n manifestHash: head.bundle.manifestHash,\n })),\n expectedPrincipalPolicyCheckpoints: usedPolicies.map(\n (policy) => policy.checkpoint,\n ),\n stillCurrent: input.stillCurrent,\n });\n } catch (error) {\n if (!(error instanceof KeyingVerificationError)) throw error;\n // Another local operation can advance the durable pin while the request\n // is in flight. Refuse the write, but do not label that local race as a\n // contradictory server response: the exact signed acknowledgement above\n // already passed. Normal projection verification reconciles newer heads.\n return null;\n }\n if (!acknowledged \|\| input.stillCurrent?.() === false) return null;\n return rememberAcknowledgedContainerHead(input.execSql, plan);\n}\n\nasync function policiesArePinned(\n execSql: ExecSql,\n policies: ReturnType<typeof referencedRecitationPolicies>,\n): Promise<boolean> {\n for (const policy of policies) {\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n execSql,\n policy.principalType,\n policy.principalId,\n );\n if (\n checkpoint?.version !== policy.version \|\|\n checkpoint.stateHash !== policy.stateHash\n )\n return false;\n }\n return true;\n}\n\nasync function waitForPinnedPath(\n input: ReciteHeldDescendantsInput,\n path: readonly HeldContainerHead[],\n attempts: number,\n): Promise<boolean> {\n if (!(await pathIsPinned(input.execSql, path))) return false;\n if (attempts > 0) {\n await new Promise((resolve) => setTimeout(resolve, RECITE_SPACING_MS));\n if (!(await pathIsPinned(input.execSql, path))) return false;\n }\n return input.stillCurrent?.() !== false;\n}\n\n/*\n Best effort only: never fetches a subtree or policy, never retries conflicts,\n * and never turns an unavailable/missing descendant into an ancestor refusal.\n * The API checks admin authority and exact current paths again at commit time.\n /\nexport async function reciteHeldDescendants(\n input: ReciteHeldDescendantsInput,\n): Promise<void> {\n const snapshot = heldContainerSnapshot(\n input.execSql,\n input.author.organizationId,\n );\n const ancestors = new Set(input.ancestorIds);\n const candidates = [...snapshot.heads.keys()]\n .map((id) => ({ id, path: heldContainerPath(snapshot.heads, id) }))\n .filter(\n ({ id, path }) =>\n !ancestors.has(id) &&\n path?.some((head) => ancestors.has(head.state.containerId)),\n )\n .sort((a, b) => (a.path?.length ?? 0) - (b.path?.length ?? 0));\n let attempts = 0;\n for (const { id } of candidates) {\n if (attempts >= MAX_RECITES_PER_PASS) return;\n if (input.stillCurrent?.() === false) return;\n try {\n const path = heldContainerPath(snapshot.heads, id);\n if (!path) continue;\n // Every held head must still equal its durable pin. A failed projection,\n // concurrent mutation, or verify-without-persist result cannot become an\n // implicit checkpoint advance through this opportunistic path.\n if (!(await waitForPinnedPath(input, path, attempts))) continue;\n attempts += 1;\n const updated = await recitePinnedPath(input, path, snapshot.policies);\n if (updated) snapshot.heads.set(id, updated);\n } catch {\n // A later reconciliation can observe any committed response we lost.\n // Do not retry here or change the result of the acknowledged ancestor.\n }\n }\n}\n\nconst running = new WeakSet<ExecSql>();\n\n/* Called only after exact acknowledgement of the original mutation. */\nexport function scheduleHeldDescendantRecitations(\n input: Omit<ReciteHeldDescendantsInput, \"ancestorIds\"> & {\n readonly plans: readonly AuthoredContainerMutationHead[];\n },\n): void {\n if (input.stillCurrent?.() === false) return;\n try {\n for (const plan of input.plans) {\n rememberAcknowledgedContainerHead(input.execSql, plan);\n }\n } catch {\n return;\n }\n const canonical = resolveCanonicalExecSql(input.execSql);\n if (running.has(canonical)) return;\n running.add(canonical);\n void Promise.resolve()\n .then(() =>\n reciteHeldDescendants({\n apiClient: input.apiClient,\n author: input.author,\n // Background work outlives the caller's lock scope. Use the canonical\n // executor so its checkpoint write acquires a new mutation lock.\n execSql: canonical,\n reportSecurityIncident: input.reportSecurityIncident,\n stillCurrent: input.stillCurrent,\n ancestorIds: input.plans.map((plan) => plan.containerId),\n }),\n )\n .catch(() => {\n // Failure is deliberately independent of the user's completed mutation.\n })\n .finally(() => running.delete(canonical));\n}\n"]}
1	+ {"version":3,"file":"recite.js","sourceRoot":"","sources":["recite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,EACrB,iCAAiC,GAClC,MAAM,oDAAoD,CAAC;AAI5D,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,oEAAoE,CAAC;AAE5E,OAAO,EAEL,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,oCAAoC,EACpC,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAEtB,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAW9B,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAkC;IAElC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,MAAM,4BAA4B,CACnD,OAAO,EACP,WAAW,EACX,IAAI,CAAC,KAAK,CAAC,cAAc,EACzB,IAAI,CAAC,KAAK,CAAC,WAAW,CACvB,CAAC;QACF,IAAI,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAiC,EACjC,IAAkC,EAClC,QAA8D;IAE9D,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;QACvE,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC;QACH,oCAAoC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,uBAAuB;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,uBAAuB,CACzB,eAAe,EACf,uCAAuC,CACxC,CAAC;QACR,MAAM,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE;YAC1C,SAAS,EAAE,8BAA8B;YACzC,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,YAAY,EAAE;SAC3D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,YAAY;YACV,MAAM,uDAAuD,CAAC;gBAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC;gBAChD,iCAAiC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACrD,UAAU,EAAE,WAAW;oBACvB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;oBAChC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;oBACzC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;oBACvB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;iBACvC,CAAC,CAAC;gBACH,kCAAkC,EAAE,YAAY,CAAC,GAAG,CAClD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAC9B;gBACD,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7D,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,iCAAiC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAgB,EAChB,QAAyD;IAEzD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,IACE,UAAU,EAAE,OAAO,KAAK,MAAM,CAAC,OAAO;YACtC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAEzC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAiC,EACjC,IAAkC,EAClC,QAAgB;IAEhB,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1C,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CACL,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CACf,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAC9D;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,QAAQ,IAAI,oBAAoB;YAAE,OAAO;QAC7C,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,yEAAyE;YACzE,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAChE,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvE,IAAI,OAAO;gBAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,uEAAuE;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAW,CAAC;AAEvC,wEAAwE;AACxE,MAAM,UAAU,iCAAiC,CAC/C,KAEC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,iCAAiC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IACnC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,KAAK,OAAO,CAAC,OAAO,EAAE;SACnB,IAAI,CAAC,GAAG,EAAE,CACT,qBAAqB,CAAC;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,sEAAsE;QACtE,iEAAiE;QACjE,OAAO,EAAE,SAAS;QAClB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;KACzD,CAAC,CACH;SACA,KAAK,CAAC,GAAG,EAAE;QACV,wEAAwE;IAC1E,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport {\n type HeldContainerHead,\n heldContainerPath,\n heldContainerSnapshot,\n rememberAcknowledgedContainerHead,\n} from \"../../../data/containers/shared/heldContainerHeads\";\nimport type { AuthoredContainerMutationHead } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n loadAccessManifestCheckpoint,\n loadPrincipalPolicyCheckpoint,\n} from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport {\n advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n locallyAuthoredAccessManifestHead,\n} from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport {\n type ExecSql,\n resolveCanonicalExecSql,\n} from \"../../../data/sqlite/sqlSchema\";\nimport {\n assertContainerReciteAcknowledgement,\n buildContainerRecitePlan,\n referencedRecitationPolicies,\n} from \"./recitePlan\";\n\nconst MAX_RECITES_PER_PASS = 8;\nconst RECITE_SPACING_MS = 250;\n\ninterface ReciteHeldDescendantsInput {\n readonly apiClient: ContainerReciteApi;\n readonly author: ContainerMutationAuthor;\n readonly ancestorIds: readonly string[];\n readonly execSql: ExecSql;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}\n\nasync function pathIsPinned(\n execSql: ExecSql,\n path: readonly HeldContainerHead[],\n): Promise<boolean> {\n for (const head of path) {\n const checkpoint = await loadAccessManifestCheckpoint(\n execSql,\n \"container\",\n head.state.organizationId,\n head.state.containerId,\n );\n if (checkpoint?.manifestHash !== head.bundle.manifestHash) return false;\n }\n return true;\n}\n\nasync function recitePinnedPath(\n input: ReciteHeldDescendantsInput,\n path: readonly HeldContainerHead[],\n policies: ReturnType<typeof heldContainerSnapshot>[\"policies\"],\n): Promise<HeldContainerHead \| null> {\n const usedPolicies = referencedRecitationPolicies(path, policies);\n if (!(await policiesArePinned(input.execSql, usedPolicies))) return null;\n const plan = await buildContainerRecitePlan({\n author: input.author,\n path,\n policies: usedPolicies,\n });\n if (!(await policiesArePinned(input.execSql, usedPolicies))) return null;\n if (!(await pathIsPinned(input.execSql, path))) return null;\n if (input.stillCurrent?.() === false) return null;\n const id = plan.state.containerId;\n const response = await input.apiClient.reciteContainer(id, plan.request, {\n reportErrors: false,\n });\n if (!response \|\| input.stillCurrent?.() === false) return null;\n try {\n assertContainerReciteAcknowledgement(plan, response);\n } catch (error) {\n const failure =\n error instanceof KeyingVerificationError\n ? error\n : new KeyingVerificationError(\n \"invalid_shape\",\n \"Malformed re-citation acknowledgement\",\n );\n await input.reportSecurityIncident(failure, {\n operation: \"container.recite.acknowledge\",\n objectKind: \"container\",\n objectId: id,\n organizationId: input.author.organizationId,\n evidenceHashes: { plannedManifestHash: plan.manifestHash },\n });\n return null;\n }\n let acknowledged: boolean;\n try {\n acknowledged =\n await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n execSql: input.execSql,\n heads: [locallyAuthoredAccessManifestHead(plan)],\n expectedAccessManifestCheckpoints: path.map((head) => ({\n objectKind: \"container\",\n objectId: head.state.containerId,\n organizationId: head.state.organizationId,\n epoch: head.state.epoch,\n manifestHash: head.bundle.manifestHash,\n })),\n expectedPrincipalPolicyCheckpoints: usedPolicies.map(\n (policy) => policy.checkpoint,\n ),\n stillCurrent: input.stillCurrent,\n });\n } catch (error) {\n if (!(error instanceof KeyingVerificationError)) throw error;\n // Another local operation can advance the durable pin while the request\n // is in flight. Refuse the write, but do not label that local race as a\n // contradictory server response: the exact signed acknowledgement above\n // already passed. Normal projection verification reconciles newer heads.\n return null;\n }\n if (!acknowledged \|\| input.stillCurrent?.() === false) return null;\n return rememberAcknowledgedContainerHead(input.execSql, plan);\n}\n\nasync function policiesArePinned(\n execSql: ExecSql,\n policies: ReturnType<typeof referencedRecitationPolicies>,\n): Promise<boolean> {\n for (const policy of policies) {\n const checkpoint = await loadPrincipalPolicyCheckpoint(\n execSql,\n policy.principalType,\n policy.principalId,\n );\n if (\n checkpoint?.version !== policy.version \|\|\n checkpoint.stateHash !== policy.stateHash\n )\n return false;\n }\n return true;\n}\n\nasync function waitForPinnedPath(\n input: ReciteHeldDescendantsInput,\n path: readonly HeldContainerHead[],\n attempts: number,\n): Promise<boolean> {\n if (!(await pathIsPinned(input.execSql, path))) return false;\n if (attempts > 0) {\n await new Promise((resolve) => setTimeout(resolve, RECITE_SPACING_MS));\n if (!(await pathIsPinned(input.execSql, path))) return false;\n }\n return input.stillCurrent?.() !== false;\n}\n\n/*\n Best effort only: never fetches a subtree or policy, never retries conflicts,\n * and never turns an unavailable/missing descendant into an ancestor refusal.\n * The API checks admin authority and exact current paths again at commit time.\n /\nexport async function reciteHeldDescendants(\n input: ReciteHeldDescendantsInput,\n): Promise<void> {\n const snapshot = heldContainerSnapshot(\n input.execSql,\n input.author.organizationId,\n );\n const ancestors = new Set(input.ancestorIds);\n const candidates = [...snapshot.heads.keys()]\n .map((id) => ({ id, path: heldContainerPath(snapshot.heads, id) }))\n .filter(\n ({ id, path }) =>\n !ancestors.has(id) &&\n path?.some((head) => ancestors.has(head.state.containerId)),\n )\n .sort((a, b) => (a.path?.length ?? 0) - (b.path?.length ?? 0));\n let attempts = 0;\n for (const { id } of candidates) {\n if (attempts >= MAX_RECITES_PER_PASS) return;\n if (input.stillCurrent?.() === false) return;\n try {\n const path = heldContainerPath(snapshot.heads, id);\n if (!path) continue;\n // Every held head must still equal its durable pin. A failed projection,\n // concurrent mutation, or verify-without-persist result cannot become an\n // implicit checkpoint advance through this opportunistic path.\n if (!(await waitForPinnedPath(input, path, attempts))) continue;\n attempts += 1;\n const updated = await recitePinnedPath(input, path, snapshot.policies);\n if (updated) snapshot.heads.set(id, updated);\n } catch {\n // A later reconciliation can observe any committed response we lost.\n // Do not retry here or change the result of the acknowledged ancestor.\n }\n }\n}\n\nconst running = new WeakSet<ExecSql>();\n\n/* Called only after exact acknowledgement of the original mutation. */\nexport function scheduleHeldDescendantRecitations(\n input: Omit<ReciteHeldDescendantsInput, \"ancestorIds\"> & {\n readonly plans: readonly AuthoredContainerMutationHead[];\n },\n): void {\n if (input.stillCurrent?.() === false) return;\n try {\n for (const plan of input.plans) {\n rememberAcknowledgedContainerHead(input.execSql, plan);\n }\n } catch {\n return;\n }\n const canonical = resolveCanonicalExecSql(input.execSql);\n if (running.has(canonical)) return;\n running.add(canonical);\n void Promise.resolve()\n .then(() =>\n reciteHeldDescendants({\n apiClient: input.apiClient,\n author: input.author,\n // Background work outlives the caller's lock scope. Use the canonical\n // executor so its checkpoint write acquires a new mutation lock.\n execSql: canonical,\n reportSecurityIncident: input.reportSecurityIncident,\n stillCurrent: input.stillCurrent,\n ancestorIds: input.plans.map((plan) => plan.containerId),\n }),\n )\n .catch(() => {\n // Failure is deliberately independent of the user's completed mutation.\n })\n .finally(() => running.delete(canonical));\n}\n"]}

package/workflows/containers/child/recitePlan.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { computeAccessManifestHash, deriveContainerAccessManifest, KeyingVerific
 import { signContainerMutationEvent } from "../../../data/containers/shared/events.js";
 import { principalPolicyRequestRecord } from "../../../data/containers/shared/principalPolicies.js";
 import { containerManifestRef } from "../../../data/containers/shared/projection.js";
-import { canonicalKeyingJsonString, readCanonicalRecord, } from "../../../data/keyingCanonicalJson.js";
+import { canonicalKeyingJsonString, readCanonicalRecord, } from "../../../data/keying/canonicalJson.js";
 export function referencedRecitationPolicies(path, policies) {
     const referencedIds = new Set(path.flatMap((head) => head.state.referencedPrincipalHeads.map((ref) => `${ref.principalType}:${ref.principalId}`)));
     return policies.filter((policy) => referencedIds.has(`${policy.principalType}:${policy.principalId}`));

package/workflows/containers/child/recitePlan.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"recitePlan.js","sourceRoot":"","sources":["recitePlan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,~~mCAAmC~~,CAAC;~~AAG3C~~,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,QAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,CACnD,CACF,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,wCAAwC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,KAAK,OAAO,EACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,kBAA2B;QACtC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,qBAAqB;KAC5D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QACvC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CACnC;QACD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;QAClD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,KAAK;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAC/B,SAAS;QACT,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,IAAI;QACJ,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACrD,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC9D,oBAAoB,EAAE,YAAY;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1D,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAClC;QACD,iBAAiB,EAAE,4BAA4B,CAC7C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,CACf,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,IAA0D,EAC1D,QAAiC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,iBAAiB,GAAG;QACxB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;KAC3B,CAAC,KAAK,CACL,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CACrB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACxD,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CACzD,CAAC;IACF,IACE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAC/C,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;QACrD,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAClD,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,CAAC,YAAY,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxD,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACzC,CAAC,iBAAiB;QAClB,yBAAyB,CACvB,QAAQ,CAAC,wBAAwB,EACjC,uBAAuB,CACxB;YACC,yBAAyB,CACvB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EACtC,+BAA+B,CAChC;QAEH,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n computeAccessManifestHash,\n deriveContainerAccessManifest,\n KeyingVerificationError,\n MAX_CONTAINER_RECITATION_EPOCH,\n resolveContainerStatePathUserAccessLevel,\n} from \"@tearleads/crypto\";\nimport type { ContainerReciteRequest } from \"@tearleads/validators/request\";\nimport type { ContainerReciteResponse } from \"@tearleads/validators/response\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport type { HeldContainerHead } from \"../../../data/containers/shared/heldContainerHeads\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n canonicalKeyingJsonString,\n readCanonicalRecord,\n} from \"../../../data/~~keyingCanonicalJson~~\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function referencedRecitationPolicies(\n path: readonly HeldContainerHead[],\n policies: readonly PrincipalPolicyCheckpointEvidence[],\n): readonly PrincipalPolicyCheckpointEvidence[] {\n const referencedIds = new Set(\n path.flatMap((head) =>\n head.state.referencedPrincipalHeads.map(\n (ref) => `${ref.principalType}:${ref.principalId}`,\n ),\n ),\n );\n return policies.filter((policy) =>\n referencedIds.has(`${policy.principalType}:${policy.principalId}`),\n );\n}\n\nexport async function buildContainerRecitePlan(input: {\n readonly author: ContainerMutationAuthor;\n readonly path: readonly HeldContainerHead[];\n readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n}) {\n const previous = input.path.at(-1);\n if (!previous) throw new Error(\"Recitation requires a held container path\");\n if (previous.state.epoch >= MAX_CONTAINER_RECITATION_EPOCH) {\n throw new Error(\"Container re-citation history budget is exhausted\");\n }\n if (\n input.path.some(\n (head) => head.state.organizationId !== input.author.organizationId,\n )\n ) {\n throw new Error(\"Recitation cannot cross organizations\");\n }\n if (\n resolveContainerStatePathUserAccessLevel({\n states: input.path.map((head) => head.state),\n principalPolicies: input.policies,\n userId: input.author.signerUserId,\n }) !== \"admin\"\n ) {\n throw new KeyingVerificationError(\n \"unauthorized\",\n \"Container re-citation signer lacks admin access on the held path\",\n );\n }\n const body = {\n eventType: \"container.recite\" as const,\n containerKeyEpochId: previous.state.containerKeyEpochId,\n containerKeyPublicKey: previous.state.containerKeyPublicKey,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previous.state.containerId,\n dependencyManifestHashes: input.path.map(\n (head) => head.bundle.manifestHash,\n ),\n eventId: crypto.randomUUID(),\n previousManifestHash: previous.bundle.manifestHash,\n signedAt: new Date().toISOString(),\n });\n const state = {\n ...previous.state,\n epoch: previous.state.epoch + 1,\n eventHash,\n previousManifestHash: previous.bundle.manifestHash,\n };\n const manifest = await deriveContainerAccessManifest(state);\n const manifestHash = await computeAccessManifestHash(manifest);\n const request: ContainerReciteRequest = {\n body,\n event: readCanonicalRecord(event, \"Recitation event\"),\n manifest: readCanonicalRecord(manifest, \"Recitation manifest\"),\n expectedManifestHash: manifestHash,\n previousManifestRef: containerManifestRef(previous.bundle),\n previousContainerPathRefs: input.path.map((head) =>\n containerManifestRef(head.bundle),\n ),\n principalPolicies: referencedRecitationPolicies(\n input.path,\n input.policies,\n ).map((policy) => principalPolicyRequestRecord(policy)),\n };\n return { body, event, eventHash, manifest, manifestHash, state, request };\n}\n\nexport function assertContainerReciteAcknowledgement(\n plan: Awaited<ReturnType<typeof buildContainerRecitePlan>>,\n response: ContainerReciteResponse,\n): void {\n const bundle = response.accessManifest;\n const signedFieldsMatch = [\n [bundle.event.event, plan.event],\n [bundle.event.body, plan.body],\n [bundle.manifest, plan.manifest],\n [bundle.state, plan.state],\n ].every(\n ([actual, expected]) =>\n canonicalKeyingJsonString(actual, \"Recitation response\") ===\n canonicalKeyingJsonString(expected, \"Recitation plan\"),\n );\n if (\n response.containerId !== plan.state.containerId \|\|\n response.organizationId !== plan.state.organizationId \|\|\n response.parentId !== plan.state.parentContainerId \|\|\n response.manifestHead.epoch !== plan.state.epoch \|\|\n response.manifestHead.manifestHash !== plan.manifestHash \|\|\n bundle.manifestHash !== plan.manifestHash \|\|\n bundle.event.eventHash !== plan.eventHash \|\|\n !signedFieldsMatch \|\|\n canonicalKeyingJsonString(\n response.referencedPrincipalHeads,\n \"Recitation references\",\n ) !==\n canonicalKeyingJsonString(\n plan.manifest.referencedPrincipalHeads,\n \"Recitation planned references\",\n )\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Container recitation response does not match the signed plan\",\n );\n}\n"]}
1	+ {"version":3,"file":"recitePlan.js","sourceRoot":"","sources":["recitePlan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAG5C,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,QAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,CACnD,CACF,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,wCAAwC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,KAAK,OAAO,EACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,kBAA2B;QACtC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,qBAAqB;KAC5D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QACvC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CACnC;QACD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;QAClD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,KAAK;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAC/B,SAAS;QACT,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,IAAI;QACJ,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACrD,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC9D,oBAAoB,EAAE,YAAY;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1D,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAClC;QACD,iBAAiB,EAAE,4BAA4B,CAC7C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,CACf,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,IAA0D,EAC1D,QAAiC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,iBAAiB,GAAG;QACxB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;KAC3B,CAAC,KAAK,CACL,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CACrB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACxD,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CACzD,CAAC;IACF,IACE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAC/C,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;QACrD,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAClD,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,CAAC,YAAY,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxD,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACzC,CAAC,iBAAiB;QAClB,yBAAyB,CACvB,QAAQ,CAAC,wBAAwB,EACjC,uBAAuB,CACxB;YACC,yBAAyB,CACvB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EACtC,+BAA+B,CAChC;QAEH,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n computeAccessManifestHash,\n deriveContainerAccessManifest,\n KeyingVerificationError,\n MAX_CONTAINER_RECITATION_EPOCH,\n resolveContainerStatePathUserAccessLevel,\n} from \"@tearleads/crypto\";\nimport type { ContainerReciteRequest } from \"@tearleads/validators/request\";\nimport type { ContainerReciteResponse } from \"@tearleads/validators/response\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport type { HeldContainerHead } from \"../../../data/containers/shared/heldContainerHeads\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n canonicalKeyingJsonString,\n readCanonicalRecord,\n} from \"../../../data/keying/canonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function referencedRecitationPolicies(\n path: readonly HeldContainerHead[],\n policies: readonly PrincipalPolicyCheckpointEvidence[],\n): readonly PrincipalPolicyCheckpointEvidence[] {\n const referencedIds = new Set(\n path.flatMap((head) =>\n head.state.referencedPrincipalHeads.map(\n (ref) => `${ref.principalType}:${ref.principalId}`,\n ),\n ),\n );\n return policies.filter((policy) =>\n referencedIds.has(`${policy.principalType}:${policy.principalId}`),\n );\n}\n\nexport async function buildContainerRecitePlan(input: {\n readonly author: ContainerMutationAuthor;\n readonly path: readonly HeldContainerHead[];\n readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n}) {\n const previous = input.path.at(-1);\n if (!previous) throw new Error(\"Recitation requires a held container path\");\n if (previous.state.epoch >= MAX_CONTAINER_RECITATION_EPOCH) {\n throw new Error(\"Container re-citation history budget is exhausted\");\n }\n if (\n input.path.some(\n (head) => head.state.organizationId !== input.author.organizationId,\n )\n ) {\n throw new Error(\"Recitation cannot cross organizations\");\n }\n if (\n resolveContainerStatePathUserAccessLevel({\n states: input.path.map((head) => head.state),\n principalPolicies: input.policies,\n userId: input.author.signerUserId,\n }) !== \"admin\"\n ) {\n throw new KeyingVerificationError(\n \"unauthorized\",\n \"Container re-citation signer lacks admin access on the held path\",\n );\n }\n const body = {\n eventType: \"container.recite\" as const,\n containerKeyEpochId: previous.state.containerKeyEpochId,\n containerKeyPublicKey: previous.state.containerKeyPublicKey,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previous.state.containerId,\n dependencyManifestHashes: input.path.map(\n (head) => head.bundle.manifestHash,\n ),\n eventId: crypto.randomUUID(),\n previousManifestHash: previous.bundle.manifestHash,\n signedAt: new Date().toISOString(),\n });\n const state = {\n ...previous.state,\n epoch: previous.state.epoch + 1,\n eventHash,\n previousManifestHash: previous.bundle.manifestHash,\n };\n const manifest = await deriveContainerAccessManifest(state);\n const manifestHash = await computeAccessManifestHash(manifest);\n const request: ContainerReciteRequest = {\n body,\n event: readCanonicalRecord(event, \"Recitation event\"),\n manifest: readCanonicalRecord(manifest, \"Recitation manifest\"),\n expectedManifestHash: manifestHash,\n previousManifestRef: containerManifestRef(previous.bundle),\n previousContainerPathRefs: input.path.map((head) =>\n containerManifestRef(head.bundle),\n ),\n principalPolicies: referencedRecitationPolicies(\n input.path,\n input.policies,\n ).map((policy) => principalPolicyRequestRecord(policy)),\n };\n return { body, event, eventHash, manifest, manifestHash, state, request };\n}\n\nexport function assertContainerReciteAcknowledgement(\n plan: Awaited<ReturnType<typeof buildContainerRecitePlan>>,\n response: ContainerReciteResponse,\n): void {\n const bundle = response.accessManifest;\n const signedFieldsMatch = [\n [bundle.event.event, plan.event],\n [bundle.event.body, plan.body],\n [bundle.manifest, plan.manifest],\n [bundle.state, plan.state],\n ].every(\n ([actual, expected]) =>\n canonicalKeyingJsonString(actual, \"Recitation response\") ===\n canonicalKeyingJsonString(expected, \"Recitation plan\"),\n );\n if (\n response.containerId !== plan.state.containerId \|\|\n response.organizationId !== plan.state.organizationId \|\|\n response.parentId !== plan.state.parentContainerId \|\|\n response.manifestHead.epoch !== plan.state.epoch \|\|\n response.manifestHead.manifestHash !== plan.manifestHash \|\|\n bundle.manifestHash !== plan.manifestHash \|\|\n bundle.event.eventHash !== plan.eventHash \|\|\n !signedFieldsMatch \|\|\n canonicalKeyingJsonString(\n response.referencedPrincipalHeads,\n \"Recitation references\",\n ) !==\n canonicalKeyingJsonString(\n plan.manifest.referencedPrincipalHeads,\n \"Recitation planned references\",\n )\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Container recitation response does not match the signed plan\",\n );\n}\n"]}

package/workflows/containers/child/rekey.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
 import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerMutationAuthor, MaterializedContainerRekeyPlan } from "../../../data/containers/shared/types.js";
-import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
 import type { PrincipalPolicyCurrentEvidence } from "../../../data/principals/principalPolicyEvidence.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 /**

package/workflows/containers/child/rekey.js CHANGED Viewed

@@ -2,8 +2,8 @@ import { computeAccessManifestHash, computeContainerKekKeyringHash, computeConta
 import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
 import { buildContainerCreateKeyEpoch, resolveContainerKekEpochId, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
 import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
-import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
-import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
+import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { assertOverrideMatchesSignedLineage } from "./keyringOverrideLineage.js";
 import { sealRotationKeyring, verifyKeyringEntriesForSeal, } from "./moveRotation.js";
 import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";

package/workflows/containers/child/rekey.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rekey.js","sourceRoot":"","sources":["rekey.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EAIzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IAOC,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,WAAW,EAAE,KAAK,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,KAAK,CAAC,YAAY;QACzC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,qDAAqD;QACrD,kCAAkC,CAChC,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;QACF,MAAM,2BAA2B,CAC/B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAwB,KAAK,CAAC,sBAAsB;QAC/D,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,sBAAsB;gBAC/B;oBACE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;oBACzD,WAAW,EAAE,KAAK,CAAC,uBAAuB;iBAC3C;aACF;YACD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC;QACJ,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;YACjD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC,CAAC;IACP,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAe3C;IACC,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,aAAa;QACtB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC;QACpC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,SAAS;QACT,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY;QACZ,yBAAyB,EAAE,KAAK,CAAC,SAAS,EAAE,mBAAmB,IAAI,IAAI;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AA2BD,SAAS,yBAAyB,CAAC,KAAqB;IACtD,OAAO,sCAAsC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACrE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE;QACrD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqB,EACrB,cAAyC;IAEzC,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;QACnD,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqB;IAErB,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACvD,MAAM,2BAA2B,CAAC;QAChC,YAAY;QACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QACvD,uBAAuB;QACvB,mBAAmB,EAAE,aAAa,CAAC,WAAW;QAC9C,MAAM;KACP,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAC3D,aAAa,EACb,wBAAwB,CACzB,CAAC;IAEF,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;QAC5D,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACvE,MAAM,4BAA4B,CAAC;QACjC,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,SAAS;QACT,iBAAiB;QACjB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,aAAa;QACb,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,iBAAiB;QACjC,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO;QACL,GAAG,gBAAgB;QACnB,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;YAC7D,gBAAgB;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAoBhC;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE;YACP,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;YAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;YACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,oCAAoC,CACrC;YACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;YACtE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;SACF;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n ContainerGrantPrincipalHead,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerRekeyAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n computeAccessManifestHash,\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n deriveContainerAccessManifest,\n deriveContainerKekWrappingPublicKey,\n sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n buildContainerCreateKeyEpoch,\n resolveContainerKekEpochId,\n signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n asContainerManifestBundle,\n type getParentKekForTarget,\n type getTargetContainerContext,\n type readContainerState,\n uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerMutationAuthor,\n ContainerRekeyPlan,\n MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { assertOverrideMatchesSignedLineage } from \"./keyringOverrideLineage\";\nimport {\n sealRotationKeyring,\n verifyKeyringEntriesForSeal,\n} from \"./moveRotation\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n containerWriterProjectionFromRekeyPlan,\n isSpeculativeContainerWriterProjection,\n} from \"./rekeyProjection\";\nimport {\n resolveRotationContext,\n type SignedRotationTarget,\n} from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\nimport {\n refreshedPrincipalPolicies,\n refreshedPrincipalReferences,\n} from \"./sharePlanCore\";\n\nasync function buildRekeyRotationArtifacts(input: {\n containerKey: Uint8Array;\n keyringEntriesOverride: readonly ContainerKekKeyringEntry[] \| undefined;\n nextContainerKeyEpoch: number;\n predecessorContainerKey: Uint8Array;\n previousContainerId: string;\n target: SignedRotationTarget;\n}): Promise<{\n containerKeyEpochId: string;\n keyring: ContainerKekKeyring;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n}> {\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.previousContainerId,\n keyEpoch: input.nextContainerKeyEpoch,\n keyMaterial: input.containerKey,\n });\n const predecessorBridge = await createContainerKekPredecessorBridge({\n containerId: input.previousContainerId,\n predecessorContainerKey: input.predecessorContainerKey,\n predecessorContainerKeyEpochId: input.target.kek.containerKeyEpochId,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n if (input.keyringEntriesOverride) {\n // A rebuilt override still has to agree with the epochs the projection's\n // signed history commits to; otherwise a repair could seal a forgery.\n // Exact match first, for distinct errors; the seal check below then adds\n // only the per-entry material check for an override.\n assertOverrideMatchesSignedLineage(\n input.keyringEntriesOverride,\n input.target.signedEpochIds,\n );\n await verifyKeyringEntriesForSeal(\n input.previousContainerId,\n input.keyringEntriesOverride,\n input.target.signedEpochIds,\n );\n }\n const keyring: ContainerKekKeyring = input.keyringEntriesOverride\n ? await sealContainerKekKeyring({\n containerId: input.previousContainerId,\n entries: [\n ...input.keyringEntriesOverride,\n {\n containerKeyEpochId: input.target.kek.containerKeyEpochId,\n keyMaterial: input.predecessorContainerKey,\n },\n ],\n keyEpoch: input.nextContainerKeyEpoch,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n })\n : await sealRotationKeyring({\n containerId: input.previousContainerId,\n currentKek: input.target.kek,\n currentKeyMaterial: input.predecessorContainerKey,\n keyEpoch: input.nextContainerKeyEpoch,\n signedEpochIds: input.target.signedEpochIds,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n return { containerKeyEpochId, keyring, predecessorBridge };\n}\n\nasync function deriveRekeyManifestArtifacts(input: {\n containerKey: Uint8Array;\n author: ContainerMutationAuthor;\n containerKeyEpochId: string;\n eventId: string \| undefined;\n keyring: ContainerKekKeyring;\n parentKek: ReturnType<typeof getParentKekForTarget>;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n previousProjection: ContainerWriterProjectionResponse;\n previousState: ReturnType<typeof readContainerState>;\n referencedPrincipalHeads: readonly ContainerGrantPrincipalHead[];\n signedAt: string \| undefined;\n target: ReturnType<typeof getTargetContainerContext>;\n}) {\n const body: ContainerRekeyAccessEventBody = {\n eventType: \"container.rekey\",\n parentManifestHash:\n input.previousProjection.path.at(-2)?.manifestHash ?? null,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: input.previousState.containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: input.containerKeyEpochId,\n keyringHash: await computeContainerKekKeyringHash(input.keyring),\n predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n input.predecessorBridge,\n ),\n referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: input.previousState.containerId,\n dependencyManifestHashes: uniqueSortedManifestHashes(\n input.previousProjection.path,\n ),\n eventId: input.eventId ?? crypto.randomUUID(),\n previousManifestHash: input.target.manifest.manifestHash,\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const state = {\n ...input.previousState,\n parentManifestHash: body.parentManifestHash,\n containerKeyPublicKey: body.containerKeyPublicKey,\n epoch: input.previousState.epoch + 1,\n previousManifestHash: input.target.manifest.manifestHash,\n eventHash,\n containerKeyEpochId: input.containerKeyEpochId,\n referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n };\n const manifest = await deriveContainerAccessManifest(state);\n const manifestHash = await computeAccessManifestHash(manifest);\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: input.previousState.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n eventHash,\n keyEpoch: input.target.kek.containerKeyEpoch + 1,\n manifestHash,\n parentContainerKeyEpochId: input.parentKek?.containerKeyEpochId ?? null,\n });\n return { body, event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\n/*\n An explicit container KEK rotation with no membership change. Doubles as\n * the repair operation: passing `keyringEntriesOverride` seals a keyring\n * rebuilt from the bridge log instead of re-opening the served one, so a\n * poisoned snapshot is replaced by ground truth.\n /\ninterface RekeyPlanInput {\n author: ContainerMutationAuthor;\n eventId?: string \| undefined;\n execSql: ExecSql;\n keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] \| undefined;\n /* Keys a batch minted above this container and has yet to commit. /\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n persistVerificationCheckpoints?: boolean \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /* Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}\n\nfunction speculativeSafeRekeyInput(input: RekeyPlanInput): RekeyPlanInput {\n return isSpeculativeContainerWriterProjection(input.previousProjection)\n ? { ...input, persistVerificationCheckpoints: false }\n : input;\n}\n\nasync function collectRekeyPrincipalPolicies(\n input: RekeyPlanInput,\n resolveUserKey: ProjectionUserKeyResolver,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n const previousPolicies = await collectContainerRevokePrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n previousProjection: input.previousProjection,\n principalPolicyCache: input.principalPolicyCache,\n resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n const principalPolicies = refreshedPrincipalPolicies({\n previousPolicies,\n replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"write\",\n });\n return principalPolicies;\n}\n\nexport async function buildMaterializedContainerRekeyPlan(\n input: RekeyPlanInput,\n): Promise<MaterializedContainerRekeyPlan> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container rekey\",\n );\n const planningInput = speculativeSafeRekeyInput(input);\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n } = await resolveRotationContext(planningInput, \"rekey\");\n const { containerKeyEpochId, keyring, predecessorBridge } =\n await buildRekeyRotationArtifacts({\n containerKey,\n keyringEntriesOverride: input.keyringEntriesOverride,\n nextContainerKeyEpoch: target.kek.containerKeyEpoch + 1,\n predecessorContainerKey,\n previousContainerId: previousState.containerId,\n target,\n });\n const principalPolicies = await collectRekeyPrincipalPolicies(\n planningInput,\n resolveProjectionUserKey,\n );\n\n const referencedPrincipalHeads = refreshedPrincipalReferences({\n previousState,\n replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n });\n const { body, event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveRekeyManifestArtifacts({\n containerKey,\n author: input.author,\n containerKeyEpochId,\n eventId: input.eventId,\n keyring,\n parentKek,\n predecessorBridge,\n previousProjection: input.previousProjection,\n previousState,\n referencedPrincipalHeads,\n signedAt: input.signedAt,\n target,\n });\n const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n containerKey,\n containerKeyEpochId,\n manifestHash,\n operationLabel: \"Container rekey\",\n parentKek,\n parentPublicKey,\n principalPolicies,\n resolveUserKey: resolveProjectionUserKey,\n state,\n });\n\n const plan = buildContainerRekeyPlan({\n body,\n containerId: previousState.containerId,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n parentKek,\n predecessorBridge,\n previousManifest: asContainerManifestBundle(target.manifest),\n previousProjection: input.previousProjection,\n principalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n const materializedPlan = { containerKey, plan };\n return {\n ...materializedPlan,\n writerProjection: await containerWriterProjectionFromRekeyPlan({\n materializedPlan,\n previousProjection: input.previousProjection,\n }),\n };\n}\n\nfunction buildContainerRekeyPlan(input: {\n body: ContainerRekeyAccessEventBody;\n containerId: string;\n containerKeyEpochId: string;\n event: ContainerRekeyPlan[\"event\"];\n eventHash: string;\n keyEpoch: ContainerRekeyPlan[\"keyEpoch\"];\n keyring: ContainerKekKeyring;\n manifest: ContainerRekeyPlan[\"manifest\"];\n manifestHash: string;\n parentKek: ReturnType<typeof getParentKekForTarget>;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n previousManifest: ContainerRekeyPlan[\"previousManifest\"];\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerRekeyPlan[\"state\"];\n userRecipientKeys: ContainerRekeyPlan[\"userRecipientKeys\"];\n wraps: ContainerRekeyPlan[\"wraps\"];\n}): ContainerRekeyPlan {\n return {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: {\n ...containerMutationRequestCore(\"rekey\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container rekey predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container rekey keyring\"),\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container rekey parent KEK state\",\n ),\n },\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n}\n"]}
1	+ {"version":3,"file":"rekey.js","sourceRoot":"","sources":["rekey.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EAIzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IAOC,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,WAAW,EAAE,KAAK,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,KAAK,CAAC,YAAY;QACzC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,qDAAqD;QACrD,kCAAkC,CAChC,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;QACF,MAAM,2BAA2B,CAC/B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAwB,KAAK,CAAC,sBAAsB;QAC/D,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,sBAAsB;gBAC/B;oBACE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;oBACzD,WAAW,EAAE,KAAK,CAAC,uBAAuB;iBAC3C;aACF;YACD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC;QACJ,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;YACjD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC,CAAC;IACP,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAe3C;IACC,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,aAAa;QACtB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC;QACpC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,SAAS;QACT,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY;QACZ,yBAAyB,EAAE,KAAK,CAAC,SAAS,EAAE,mBAAmB,IAAI,IAAI;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AA2BD,SAAS,yBAAyB,CAAC,KAAqB;IACtD,OAAO,sCAAsC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACrE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE;QACrD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqB,EACrB,cAAyC;IAEzC,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;QACnD,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqB;IAErB,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACvD,MAAM,2BAA2B,CAAC;QAChC,YAAY;QACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QACvD,uBAAuB;QACvB,mBAAmB,EAAE,aAAa,CAAC,WAAW;QAC9C,MAAM;KACP,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAC3D,aAAa,EACb,wBAAwB,CACzB,CAAC;IAEF,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;QAC5D,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACvE,MAAM,4BAA4B,CAAC;QACjC,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,SAAS;QACT,iBAAiB;QACjB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,aAAa;QACb,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,iBAAiB;QACjC,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO;QACL,GAAG,gBAAgB;QACnB,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;YAC7D,gBAAgB;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAoBhC;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE;YACP,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;YAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;YACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,oCAAoC,CACrC;YACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;YACtE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;SACF;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n ContainerGrantPrincipalHead,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerRekeyAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n computeAccessManifestHash,\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n deriveContainerAccessManifest,\n deriveContainerKekWrappingPublicKey,\n sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n buildContainerCreateKeyEpoch,\n resolveContainerKekEpochId,\n signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n asContainerManifestBundle,\n type getParentKekForTarget,\n type getTargetContainerContext,\n type readContainerState,\n uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerMutationAuthor,\n ContainerRekeyPlan,\n MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { assertOverrideMatchesSignedLineage } from \"./keyringOverrideLineage\";\nimport {\n sealRotationKeyring,\n verifyKeyringEntriesForSeal,\n} from \"./moveRotation\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n containerWriterProjectionFromRekeyPlan,\n isSpeculativeContainerWriterProjection,\n} from \"./rekeyProjection\";\nimport {\n resolveRotationContext,\n type SignedRotationTarget,\n} from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\nimport {\n refreshedPrincipalPolicies,\n refreshedPrincipalReferences,\n} from \"./sharePlanCore\";\n\nasync function buildRekeyRotationArtifacts(input: {\n containerKey: Uint8Array;\n keyringEntriesOverride: readonly ContainerKekKeyringEntry[] \| undefined;\n nextContainerKeyEpoch: number;\n predecessorContainerKey: Uint8Array;\n previousContainerId: string;\n target: SignedRotationTarget;\n}): Promise<{\n containerKeyEpochId: string;\n keyring: ContainerKekKeyring;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n}> {\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.previousContainerId,\n keyEpoch: input.nextContainerKeyEpoch,\n keyMaterial: input.containerKey,\n });\n const predecessorBridge = await createContainerKekPredecessorBridge({\n containerId: input.previousContainerId,\n predecessorContainerKey: input.predecessorContainerKey,\n predecessorContainerKeyEpochId: input.target.kek.containerKeyEpochId,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n if (input.keyringEntriesOverride) {\n // A rebuilt override still has to agree with the epochs the projection's\n // signed history commits to; otherwise a repair could seal a forgery.\n // Exact match first, for distinct errors; the seal check below then adds\n // only the per-entry material check for an override.\n assertOverrideMatchesSignedLineage(\n input.keyringEntriesOverride,\n input.target.signedEpochIds,\n );\n await verifyKeyringEntriesForSeal(\n input.previousContainerId,\n input.keyringEntriesOverride,\n input.target.signedEpochIds,\n );\n }\n const keyring: ContainerKekKeyring = input.keyringEntriesOverride\n ? await sealContainerKekKeyring({\n containerId: input.previousContainerId,\n entries: [\n ...input.keyringEntriesOverride,\n {\n containerKeyEpochId: input.target.kek.containerKeyEpochId,\n keyMaterial: input.predecessorContainerKey,\n },\n ],\n keyEpoch: input.nextContainerKeyEpoch,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n })\n : await sealRotationKeyring({\n containerId: input.previousContainerId,\n currentKek: input.target.kek,\n currentKeyMaterial: input.predecessorContainerKey,\n keyEpoch: input.nextContainerKeyEpoch,\n signedEpochIds: input.target.signedEpochIds,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n return { containerKeyEpochId, keyring, predecessorBridge };\n}\n\nasync function deriveRekeyManifestArtifacts(input: {\n containerKey: Uint8Array;\n author: ContainerMutationAuthor;\n containerKeyEpochId: string;\n eventId: string \| undefined;\n keyring: ContainerKekKeyring;\n parentKek: ReturnType<typeof getParentKekForTarget>;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n previousProjection: ContainerWriterProjectionResponse;\n previousState: ReturnType<typeof readContainerState>;\n referencedPrincipalHeads: readonly ContainerGrantPrincipalHead[];\n signedAt: string \| undefined;\n target: ReturnType<typeof getTargetContainerContext>;\n}) {\n const body: ContainerRekeyAccessEventBody = {\n eventType: \"container.rekey\",\n parentManifestHash:\n input.previousProjection.path.at(-2)?.manifestHash ?? null,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: input.previousState.containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: input.containerKeyEpochId,\n keyringHash: await computeContainerKekKeyringHash(input.keyring),\n predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n input.predecessorBridge,\n ),\n referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: input.previousState.containerId,\n dependencyManifestHashes: uniqueSortedManifestHashes(\n input.previousProjection.path,\n ),\n eventId: input.eventId ?? crypto.randomUUID(),\n previousManifestHash: input.target.manifest.manifestHash,\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const state = {\n ...input.previousState,\n parentManifestHash: body.parentManifestHash,\n containerKeyPublicKey: body.containerKeyPublicKey,\n epoch: input.previousState.epoch + 1,\n previousManifestHash: input.target.manifest.manifestHash,\n eventHash,\n containerKeyEpochId: input.containerKeyEpochId,\n referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n };\n const manifest = await deriveContainerAccessManifest(state);\n const manifestHash = await computeAccessManifestHash(manifest);\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: input.previousState.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n eventHash,\n keyEpoch: input.target.kek.containerKeyEpoch + 1,\n manifestHash,\n parentContainerKeyEpochId: input.parentKek?.containerKeyEpochId ?? null,\n });\n return { body, event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\n/*\n An explicit container KEK rotation with no membership change. Doubles as\n * the repair operation: passing `keyringEntriesOverride` seals a keyring\n * rebuilt from the bridge log instead of re-opening the served one, so a\n * poisoned snapshot is replaced by ground truth.\n /\ninterface RekeyPlanInput {\n author: ContainerMutationAuthor;\n eventId?: string \| undefined;\n execSql: ExecSql;\n keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] \| undefined;\n /* Keys a batch minted above this container and has yet to commit. /\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n persistVerificationCheckpoints?: boolean \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /* Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}\n\nfunction speculativeSafeRekeyInput(input: RekeyPlanInput): RekeyPlanInput {\n return isSpeculativeContainerWriterProjection(input.previousProjection)\n ? { ...input, persistVerificationCheckpoints: false }\n : input;\n}\n\nasync function collectRekeyPrincipalPolicies(\n input: RekeyPlanInput,\n resolveUserKey: ProjectionUserKeyResolver,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n const previousPolicies = await collectContainerRevokePrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n previousProjection: input.previousProjection,\n principalPolicyCache: input.principalPolicyCache,\n resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n const principalPolicies = refreshedPrincipalPolicies({\n previousPolicies,\n replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"write\",\n });\n return principalPolicies;\n}\n\nexport async function buildMaterializedContainerRekeyPlan(\n input: RekeyPlanInput,\n): Promise<MaterializedContainerRekeyPlan> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container rekey\",\n );\n const planningInput = speculativeSafeRekeyInput(input);\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n } = await resolveRotationContext(planningInput, \"rekey\");\n const { containerKeyEpochId, keyring, predecessorBridge } =\n await buildRekeyRotationArtifacts({\n containerKey,\n keyringEntriesOverride: input.keyringEntriesOverride,\n nextContainerKeyEpoch: target.kek.containerKeyEpoch + 1,\n predecessorContainerKey,\n previousContainerId: previousState.containerId,\n target,\n });\n const principalPolicies = await collectRekeyPrincipalPolicies(\n planningInput,\n resolveProjectionUserKey,\n );\n\n const referencedPrincipalHeads = refreshedPrincipalReferences({\n previousState,\n replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n });\n const { body, event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveRekeyManifestArtifacts({\n containerKey,\n author: input.author,\n containerKeyEpochId,\n eventId: input.eventId,\n keyring,\n parentKek,\n predecessorBridge,\n previousProjection: input.previousProjection,\n previousState,\n referencedPrincipalHeads,\n signedAt: input.signedAt,\n target,\n });\n const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n containerKey,\n containerKeyEpochId,\n manifestHash,\n operationLabel: \"Container rekey\",\n parentKek,\n parentPublicKey,\n principalPolicies,\n resolveUserKey: resolveProjectionUserKey,\n state,\n });\n\n const plan = buildContainerRekeyPlan({\n body,\n containerId: previousState.containerId,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n parentKek,\n predecessorBridge,\n previousManifest: asContainerManifestBundle(target.manifest),\n previousProjection: input.previousProjection,\n principalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n const materializedPlan = { containerKey, plan };\n return {\n ...materializedPlan,\n writerProjection: await containerWriterProjectionFromRekeyPlan({\n materializedPlan,\n previousProjection: input.previousProjection,\n }),\n };\n}\n\nfunction buildContainerRekeyPlan(input: {\n body: ContainerRekeyAccessEventBody;\n containerId: string;\n containerKeyEpochId: string;\n event: ContainerRekeyPlan[\"event\"];\n eventHash: string;\n keyEpoch: ContainerRekeyPlan[\"keyEpoch\"];\n keyring: ContainerKekKeyring;\n manifest: ContainerRekeyPlan[\"manifest\"];\n manifestHash: string;\n parentKek: ReturnType<typeof getParentKekForTarget>;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n previousManifest: ContainerRekeyPlan[\"previousManifest\"];\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerRekeyPlan[\"state\"];\n userRecipientKeys: ContainerRekeyPlan[\"userRecipientKeys\"];\n wraps: ContainerRekeyPlan[\"wraps\"];\n}): ContainerRekeyPlan {\n return {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: {\n ...containerMutationRequestCore(\"rekey\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container rekey predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container rekey keyring\"),\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container rekey parent KEK state\",\n ),\n },\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n}\n"]}

package/workflows/containers/child/rekeyProjection.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, } from "../../../internal/crypto/index.js";
-import { canonicalKeyingJsonString, readCanonicalRecord, readCanonicalRecords, } from "../../../data/keyingCanonicalJson.js";
+import { canonicalKeyingJsonString, readCanonicalRecord, readCanonicalRecords, } from "../../../data/keying/canonicalJson.js";
 import { mergeProjectionPolicyEvidence } from "../../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js";
 const speculativeProjections = new WeakSet();
 export function isSpeculativeContainerWriterProjection(projection) {

package/workflows/containers/child/rekeyProjection.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rekeyProjection.js","sourceRoot":"","sources":["rekeyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0EAA0E,CAAC;AAEzH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEhF,MAAM,UAAU,sCAAsC,CACpD,UAA6C;IAE7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAqBD,SAAS,gBAAgB,CACvB,IAA0C;IAE1C,OAAO,IAAI,CAAC,KAAK;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,yBAAyB,CACvB,IAAI,EACJ,2BAA2B,CAC5B,CAAC,aAAa,CACb,yBAAyB,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAC9D,CACF,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAO/D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IACE,CAAC,gBAAgB;QACjB,CAAC,WAAW;QACZ,gBAAgB,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QACpE,WAAW,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG;QACnB,KAAK,EAAE;YACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;YAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;YAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC;QACxE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KAChE,CAAC;IACF,MAAM,OAAO,GAAG;QACd,kBAAkB,EAAE,IAAI,CAAC,YAAY;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,wBAAwB,EAAE;YACxB,gBAAgB;YAChB,GAAG,WAAW,CAAC,wBAAwB;SACxC;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC;QACzE,YAAY,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/D,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;QACpE,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,yBAAyB;QAClE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,mCAAmC,CACpC;QACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KACjE,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI;QACnC,aAAa,EAAE,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;KACjD,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,KAAK,CAAC,kBAAkB;QAC3B,cAAc,EAAE,6BAA6B,CAAC;YAC5C,KAAK,CAAC,kBAAkB,CAAC,cAAc;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;QACvC,aAAa,EAAE,CAAC,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC;KACrD,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,yCAAyC,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI;QACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAA6C,EAC7C,OAGC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAC9C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CACvC,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,UAAU,GAAG;QACjB,GAAG,UAAU;QACb,cAAc,EAAE,6BAA6B,CAAC;YAC5C,UAAU,CAAC,cAAc;YACzB,OAAO,CAAC,cAAc;SACvB,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5D,aAAa,EAAE;YACb,GAAG,OAAO,CAAC,aAAa;YACxB,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAC7C;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAG5D;IACC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IACE,CAAC,QAAQ;QACT,CAAC,GAAG;QACJ,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QAC5D,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAEpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG;QACjB,GAAG,kBAAkB;QACrB,IAAI,EAAE;YACJ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD;gBACE,GAAG,GAAG;gBACN,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,wBAAwB,CAAC;gBACrE,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;gBACpE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,yBAAyB,CAC1B;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n type ContainerKekRecipientTarget,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type {\n MaterializedContainerRekeyPlan,\n MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n canonicalKeyingJsonString,\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/keyingCanonicalJson\";\nimport { mergeProjectionPolicyEvidence } from \"../../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence\";\n\nconst speculativeProjections = new WeakSet<ContainerWriterProjectionResponse>();\n\nexport function isSpeculativeContainerWriterProjection(\n projection: ContainerWriterProjectionResponse,\n): boolean {\n return speculativeProjections.has(projection);\n}\n\n/*\n What any rotation plan (rekey, revoke, move) holds in common: enough to say\n * what its container's path entry will be once the server accepts it.\n /\nexport interface RotationPlanArtifacts {\n readonly body: object;\n readonly containerId: string;\n readonly containerKeyEpochId: string;\n readonly event: MaterializedContainerRekeyPlan[\"plan\"][\"event\"];\n readonly eventHash: string;\n readonly keyEpoch: MaterializedContainerRekeyPlan[\"plan\"][\"keyEpoch\"];\n readonly manifest: MaterializedContainerRekeyPlan[\"plan\"][\"manifest\"];\n readonly manifestHash: string;\n readonly previousManifest: MaterializedContainerRekeyPlan[\"plan\"][\"previousManifest\"];\n readonly keyring: MaterializedContainerRekeyPlan[\"plan\"][\"keyring\"];\n readonly state: MaterializedContainerRekeyPlan[\"plan\"][\"state\"];\n readonly wraps: MaterializedContainerRekeyPlan[\"plan\"][\"wraps\"];\n}\n\nfunction recipientTargets(\n plan: Pick<RotationPlanArtifacts, \"wraps\">,\n): ContainerKekRecipientTarget[] {\n return plan.wraps\n .map((wrap) => ({\n recipientId: wrap.recipientId,\n recipientKeyEpochId: wrap.recipientKeyEpochId,\n recipientKeyFingerprint: wrap.recipientKeyFingerprint,\n recipientKind: wrap.recipientKind,\n }))\n .sort((left, right) =>\n canonicalKeyingJsonString(\n left,\n \"Container rekey recipient\",\n ).localeCompare(\n canonicalKeyingJsonString(right, \"Container rekey recipient\"),\n ),\n );\n}\n\n/\n The projection a rotation will leave behind, before the server has accepted\n * it. `ancestors` is the path above the container afterwards: unchanged for a\n * rekey or revoke, the destination parent's path for a move.\n /\nexport async function containerWriterProjectionFromRotationPlan(input: {\n ancestors?: Pick<\n ContainerWriterProjectionResponse,\n \"containerKeks\" \| \"path\" \| \"policyEvidence\"\n >;\n plan: RotationPlanArtifacts;\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n const { plan } = input;\n const previousManifest = input.previousProjection.path.at(-1);\n const previousKek = input.previousProjection.containerKeks.at(-1);\n if (\n !previousManifest \|\|\n !previousKek \|\|\n previousManifest.manifestHash !== plan.previousManifest.manifestHash \|\|\n previousKek.containerId !== plan.containerId\n ) {\n throw new Error(\"Container rekey projection predecessor mismatch\");\n }\n const targets = recipientTargets(plan);\n const nextManifest = {\n event: {\n body: readCanonicalRecord(plan.body, \"Container rekey body\"),\n event: readCanonicalRecord(plan.event, \"Container rekey event\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(plan.manifest, \"Container rekey manifest\"),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container rekey state\"),\n };\n const nextKek = {\n accessManifestHash: plan.manifestHash,\n containerId: plan.containerId,\n containerKeyEpoch: plan.keyEpoch.keyEpoch,\n containerKeyEpochId: plan.containerKeyEpochId,\n containerManifestHistory: [\n previousManifest,\n ...previousKek.containerManifestHistory,\n ],\n keyEpoch: readCanonicalRecord(plan.keyEpoch, \"Container rekey key epoch\"),\n keyEpochHash: await computeContainerKeyEpochHash(plan.keyEpoch),\n keyring: { ...plan.keyring },\n keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n parentContainerKeyEpochId: plan.keyEpoch.parentContainerKeyEpochId,\n recipientTargets: readCanonicalRecords(\n targets,\n \"Container rekey recipient targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container rekey wraps\"),\n };\n const ancestors = input.ancestors ?? {\n containerKeks: input.previousProjection.containerKeks.slice(0, -1),\n path: input.previousProjection.path.slice(0, -1),\n };\n const projection = {\n ...input.previousProjection,\n policyEvidence: mergeProjectionPolicyEvidence([\n input.previousProjection.policyEvidence,\n ...(input.ancestors ? [input.ancestors.policyEvidence] : []),\n ]),\n path: [...ancestors.path, nextManifest],\n containerKeks: [...ancestors.containerKeks, nextKek],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n\nexport function containerWriterProjectionFromRekeyPlan(input: {\n materializedPlan: Pick<\n MaterializedContainerRekeyPlan,\n \"containerKey\" \| \"plan\"\n >;\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n return containerWriterProjectionFromRotationPlan({\n plan: input.materializedPlan.plan,\n previousProjection: input.previousProjection,\n });\n}\n\n/\n A descendant's served projection, re-rooted on rotations the server has not\n * accepted yet: `rotated` replaces the path down to and including its own\n * container. Null when the descendant does not sit below that container.\n /\nexport function rebaseContainerWriterProjection(\n descendant: ContainerWriterProjectionResponse,\n rotated: Pick<\n ContainerWriterProjectionResponse,\n \"containerKeks\" \| \"path\" \| \"policyEvidence\"\n >,\n): ContainerWriterProjectionResponse \| null {\n const rotatedId = rotated.containerKeks.at(-1)?.containerId;\n const index = descendant.containerKeks.findIndex(\n (kek) => kek.containerId === rotatedId,\n );\n if (rotatedId === undefined \|\| index < 0) return null;\n if (index === descendant.containerKeks.length - 1) return null;\n const projection = {\n ...descendant,\n policyEvidence: mergeProjectionPolicyEvidence([\n descendant.policyEvidence,\n rotated.policyEvidence,\n ]),\n path: [...rotated.path, ...descendant.path.slice(index + 1)],\n containerKeks: [\n ...rotated.containerKeks,\n ...descendant.containerKeks.slice(index + 1),\n ],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n\n/* A grant keeps its key epoch while advancing the manifest and recipient wraps. */\nexport async function containerWriterProjectionFromSharePlan(input: {\n plan: MaterializedContainerSharePlan[\"plan\"];\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n const { plan, previousProjection } = input;\n const previous = previousProjection.path.at(-1);\n const kek = previousProjection.containerKeks.at(-1);\n if (\n !previous \|\|\n !kek \|\|\n previous.manifestHash !== plan.previousManifest.manifestHash \|\|\n kek.containerId !== plan.containerId\n )\n throw new Error(\"Container grant projection predecessor mismatch\");\n const targets = recipientTargets({ wraps: plan.wraps });\n const projection = {\n ...previousProjection,\n path: [\n ...previousProjection.path.slice(0, -1),\n {\n event: {\n body: readCanonicalRecord(plan.body, \"Container grant body\"),\n event: readCanonicalRecord(plan.event, \"Container grant event\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(\n plan.manifest,\n \"Container grant manifest\",\n ),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container grant state\"),\n },\n ],\n containerKeks: [\n ...previousProjection.containerKeks.slice(0, -1),\n {\n ...kek,\n accessManifestHash: plan.manifestHash,\n containerManifestHistory: [previous, ...kek.containerManifestHistory],\n keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n recipientTargets: readCanonicalRecords(\n targets,\n \"Container grant targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container grant wraps\"),\n },\n ],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n"]}
1	+ {"version":3,"file":"rekeyProjection.js","sourceRoot":"","sources":["rekeyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0EAA0E,CAAC;AAEzH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEhF,MAAM,UAAU,sCAAsC,CACpD,UAA6C;IAE7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAqBD,SAAS,gBAAgB,CACvB,IAA0C;IAE1C,OAAO,IAAI,CAAC,KAAK;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,yBAAyB,CACvB,IAAI,EACJ,2BAA2B,CAC5B,CAAC,aAAa,CACb,yBAAyB,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAC9D,CACF,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAO/D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IACE,CAAC,gBAAgB;QACjB,CAAC,WAAW;QACZ,gBAAgB,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QACpE,WAAW,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG;QACnB,KAAK,EAAE;YACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;YAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;YAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC;QACxE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KAChE,CAAC;IACF,MAAM,OAAO,GAAG;QACd,kBAAkB,EAAE,IAAI,CAAC,YAAY;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,wBAAwB,EAAE;YACxB,gBAAgB;YAChB,GAAG,WAAW,CAAC,wBAAwB;SACxC;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC;QACzE,YAAY,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/D,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;QACpE,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,yBAAyB;QAClE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,mCAAmC,CACpC;QACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KACjE,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI;QACnC,aAAa,EAAE,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;KACjD,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,KAAK,CAAC,kBAAkB;QAC3B,cAAc,EAAE,6BAA6B,CAAC;YAC5C,KAAK,CAAC,kBAAkB,CAAC,cAAc;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;QACvC,aAAa,EAAE,CAAC,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC;KACrD,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,yCAAyC,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI;QACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAA6C,EAC7C,OAGC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAC9C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CACvC,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,UAAU,GAAG;QACjB,GAAG,UAAU;QACb,cAAc,EAAE,6BAA6B,CAAC;YAC5C,UAAU,CAAC,cAAc;YACzB,OAAO,CAAC,cAAc;SACvB,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5D,aAAa,EAAE;YACb,GAAG,OAAO,CAAC,aAAa;YACxB,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAC7C;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAG5D;IACC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IACE,CAAC,QAAQ;QACT,CAAC,GAAG;QACJ,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QAC5D,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAEpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG;QACjB,GAAG,kBAAkB;QACrB,IAAI,EAAE;YACJ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD;gBACE,GAAG,GAAG;gBACN,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,wBAAwB,CAAC;gBACrE,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;gBACpE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,yBAAyB,CAC1B;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n type ContainerKekRecipientTarget,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type {\n MaterializedContainerRekeyPlan,\n MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n canonicalKeyingJsonString,\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\nimport { mergeProjectionPolicyEvidence } from \"../../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence\";\n\nconst speculativeProjections = new WeakSet<ContainerWriterProjectionResponse>();\n\nexport function isSpeculativeContainerWriterProjection(\n projection: ContainerWriterProjectionResponse,\n): boolean {\n return speculativeProjections.has(projection);\n}\n\n/*\n What any rotation plan (rekey, revoke, move) holds in common: enough to say\n * what its container's path entry will be once the server accepts it.\n /\nexport interface RotationPlanArtifacts {\n readonly body: object;\n readonly containerId: string;\n readonly containerKeyEpochId: string;\n readonly event: MaterializedContainerRekeyPlan[\"plan\"][\"event\"];\n readonly eventHash: string;\n readonly keyEpoch: MaterializedContainerRekeyPlan[\"plan\"][\"keyEpoch\"];\n readonly manifest: MaterializedContainerRekeyPlan[\"plan\"][\"manifest\"];\n readonly manifestHash: string;\n readonly previousManifest: MaterializedContainerRekeyPlan[\"plan\"][\"previousManifest\"];\n readonly keyring: MaterializedContainerRekeyPlan[\"plan\"][\"keyring\"];\n readonly state: MaterializedContainerRekeyPlan[\"plan\"][\"state\"];\n readonly wraps: MaterializedContainerRekeyPlan[\"plan\"][\"wraps\"];\n}\n\nfunction recipientTargets(\n plan: Pick<RotationPlanArtifacts, \"wraps\">,\n): ContainerKekRecipientTarget[] {\n return plan.wraps\n .map((wrap) => ({\n recipientId: wrap.recipientId,\n recipientKeyEpochId: wrap.recipientKeyEpochId,\n recipientKeyFingerprint: wrap.recipientKeyFingerprint,\n recipientKind: wrap.recipientKind,\n }))\n .sort((left, right) =>\n canonicalKeyingJsonString(\n left,\n \"Container rekey recipient\",\n ).localeCompare(\n canonicalKeyingJsonString(right, \"Container rekey recipient\"),\n ),\n );\n}\n\n/\n The projection a rotation will leave behind, before the server has accepted\n * it. `ancestors` is the path above the container afterwards: unchanged for a\n * rekey or revoke, the destination parent's path for a move.\n /\nexport async function containerWriterProjectionFromRotationPlan(input: {\n ancestors?: Pick<\n ContainerWriterProjectionResponse,\n \"containerKeks\" \| \"path\" \| \"policyEvidence\"\n >;\n plan: RotationPlanArtifacts;\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n const { plan } = input;\n const previousManifest = input.previousProjection.path.at(-1);\n const previousKek = input.previousProjection.containerKeks.at(-1);\n if (\n !previousManifest \|\|\n !previousKek \|\|\n previousManifest.manifestHash !== plan.previousManifest.manifestHash \|\|\n previousKek.containerId !== plan.containerId\n ) {\n throw new Error(\"Container rekey projection predecessor mismatch\");\n }\n const targets = recipientTargets(plan);\n const nextManifest = {\n event: {\n body: readCanonicalRecord(plan.body, \"Container rekey body\"),\n event: readCanonicalRecord(plan.event, \"Container rekey event\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(plan.manifest, \"Container rekey manifest\"),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container rekey state\"),\n };\n const nextKek = {\n accessManifestHash: plan.manifestHash,\n containerId: plan.containerId,\n containerKeyEpoch: plan.keyEpoch.keyEpoch,\n containerKeyEpochId: plan.containerKeyEpochId,\n containerManifestHistory: [\n previousManifest,\n ...previousKek.containerManifestHistory,\n ],\n keyEpoch: readCanonicalRecord(plan.keyEpoch, \"Container rekey key epoch\"),\n keyEpochHash: await computeContainerKeyEpochHash(plan.keyEpoch),\n keyring: { ...plan.keyring },\n keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n parentContainerKeyEpochId: plan.keyEpoch.parentContainerKeyEpochId,\n recipientTargets: readCanonicalRecords(\n targets,\n \"Container rekey recipient targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container rekey wraps\"),\n };\n const ancestors = input.ancestors ?? {\n containerKeks: input.previousProjection.containerKeks.slice(0, -1),\n path: input.previousProjection.path.slice(0, -1),\n };\n const projection = {\n ...input.previousProjection,\n policyEvidence: mergeProjectionPolicyEvidence([\n input.previousProjection.policyEvidence,\n ...(input.ancestors ? [input.ancestors.policyEvidence] : []),\n ]),\n path: [...ancestors.path, nextManifest],\n containerKeks: [...ancestors.containerKeks, nextKek],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n\nexport function containerWriterProjectionFromRekeyPlan(input: {\n materializedPlan: Pick<\n MaterializedContainerRekeyPlan,\n \"containerKey\" \| \"plan\"\n >;\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n return containerWriterProjectionFromRotationPlan({\n plan: input.materializedPlan.plan,\n previousProjection: input.previousProjection,\n });\n}\n\n/\n A descendant's served projection, re-rooted on rotations the server has not\n * accepted yet: `rotated` replaces the path down to and including its own\n * container. Null when the descendant does not sit below that container.\n /\nexport function rebaseContainerWriterProjection(\n descendant: ContainerWriterProjectionResponse,\n rotated: Pick<\n ContainerWriterProjectionResponse,\n \"containerKeks\" \| \"path\" \| \"policyEvidence\"\n >,\n): ContainerWriterProjectionResponse \| null {\n const rotatedId = rotated.containerKeks.at(-1)?.containerId;\n const index = descendant.containerKeks.findIndex(\n (kek) => kek.containerId === rotatedId,\n );\n if (rotatedId === undefined \|\| index < 0) return null;\n if (index === descendant.containerKeks.length - 1) return null;\n const projection = {\n ...descendant,\n policyEvidence: mergeProjectionPolicyEvidence([\n descendant.policyEvidence,\n rotated.policyEvidence,\n ]),\n path: [...rotated.path, ...descendant.path.slice(index + 1)],\n containerKeks: [\n ...rotated.containerKeks,\n ...descendant.containerKeks.slice(index + 1),\n ],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n\n/* A grant keeps its key epoch while advancing the manifest and recipient wraps. */\nexport async function containerWriterProjectionFromSharePlan(input: {\n plan: MaterializedContainerSharePlan[\"plan\"];\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n const { plan, previousProjection } = input;\n const previous = previousProjection.path.at(-1);\n const kek = previousProjection.containerKeks.at(-1);\n if (\n !previous \|\|\n !kek \|\|\n previous.manifestHash !== plan.previousManifest.manifestHash \|\|\n kek.containerId !== plan.containerId\n )\n throw new Error(\"Container grant projection predecessor mismatch\");\n const targets = recipientTargets({ wraps: plan.wraps });\n const projection = {\n ...previousProjection,\n path: [\n ...previousProjection.path.slice(0, -1),\n {\n event: {\n body: readCanonicalRecord(plan.body, \"Container grant body\"),\n event: readCanonicalRecord(plan.event, \"Container grant event\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(\n plan.manifest,\n \"Container grant manifest\",\n ),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container grant state\"),\n },\n ],\n containerKeks: [\n ...previousProjection.containerKeks.slice(0, -1),\n {\n ...kek,\n accessManifestHash: plan.manifestHash,\n containerManifestHistory: [previous, ...kek.containerManifestHistory],\n keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n recipientTargets: readCanonicalRecords(\n targets,\n \"Container grant targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container grant wraps\"),\n },\n ],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n"]}

package/workflows/containers/child/rekeyRemote.d.ts CHANGED Viewed

@@ -1,8 +1,8 @@
 import type { ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
 import type { ContainerRotationResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerMutationAuthor, ContainerRekeyApi, ContainerRekeyPlan } from "../../../data/containers/shared/types.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
-import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 export declare function rekeyRemoteContainer(input: {
     reportSecurityIncident: SecurityIncidentReporter;

package/workflows/containers/child/rekeyRemote.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rekeyRemote.js","sourceRoot":"","sources":["rekeyRemote.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAa1C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,mCAAmC,CAAC;QACjE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB;QAClB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,gBAAgB;SACvD;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YACjD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACrE,MAAM,EAAE,oBAAoB;oBAC1B,CAAC,CAAC,GAAG,EAAE,CACH,oBAAoB,CAAC,IAAI,CACvB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerKekKeyringEntry } from \"@tearleads/crypto\";\nimport type { ContainerRotationResponse } from \"@tearleads/validators/response\";\nimport type {\n ContainerMutationAuthor,\n ContainerRekeyApi,\n ContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { buildMaterializedContainerRekeyPlan } from \"./rekey\";\n\nexport async function rekeyRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerRekeyApi;\n author: ContainerMutationAuthor;\n containerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] \| undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerRekeyPlan;\n response: ContainerRotationResponse;\n} \| null> {\n const previousProjection = await input.apiClient.getContainerWriterProjection(\n input.containerId,\n );\n if (!previousProjection) {\n return null;\n }\n\n const materializedPlan = await buildMaterializedContainerRekeyPlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n keyringEntriesOverride: input.keyringEntriesOverride,\n previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: async () => materializedPlan.writerProjection,\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { rekeyContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.rekeyContainer(input.containerId, request, options),\n result: rekeyContainerResult\n ? () =>\n rekeyContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}
1	+ {"version":3,"file":"rekeyRemote.js","sourceRoot":"","sources":["rekeyRemote.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAa1C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,mCAAmC,CAAC;QACjE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB;QAClB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,gBAAgB;SACvD;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YACjD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACrE,MAAM,EAAE,oBAAoB;oBAC1B,CAAC,CAAC,GAAG,EAAE,CACH,oBAAoB,CAAC,IAAI,CACvB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerKekKeyringEntry } from \"@tearleads/crypto\";\nimport type { ContainerRotationResponse } from \"@tearleads/validators/response\";\nimport type {\n ContainerMutationAuthor,\n ContainerRekeyApi,\n ContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { buildMaterializedContainerRekeyPlan } from \"./rekey\";\n\nexport async function rekeyRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerRekeyApi;\n author: ContainerMutationAuthor;\n containerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] \| undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerRekeyPlan;\n response: ContainerRotationResponse;\n} \| null> {\n const previousProjection = await input.apiClient.getContainerWriterProjection(\n input.containerId,\n );\n if (!previousProjection) {\n return null;\n }\n\n const materializedPlan = await buildMaterializedContainerRekeyPlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n keyringEntriesOverride: input.keyringEntriesOverride,\n previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: async () => materializedPlan.writerProjection,\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { rekeyContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.rekeyContainer(input.containerId, request, options),\n result: rekeyContainerResult\n ? () =>\n rekeyContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}

package/workflows/containers/child/revoke.d.ts CHANGED Viewed

@@ -1,8 +1,8 @@
 import type { ContainerRotationResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerMutationAuthor, ContainerRevokeApi, ContainerRevokePlan, MaterializedContainerRevokePlan } from "../../../data/containers/shared/types.js";
-import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
 import type { PrincipalPolicyCurrentEvidence } from "../../../data/principals/principalPolicyEvidence.js";
-import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 import { type ContainerRevokeSubject } from "./revokeManifest.js";
 export declare function buildMaterializedContainerRevokePlan(input: {

package/workflows/containers/child/revoke.js CHANGED Viewed

@@ -2,8 +2,8 @@ import { computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHas
 import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
 import { buildContainerCreateKeyEpoch, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
 import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
-import { readCanonicalRecord } from "../../../data/keyingCanonicalJson.js";
-import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
+import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { buildContainerRotationArtifacts } from "./moveRotation.js";
 import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
 import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "./mutationSubmit.js";

package/workflows/containers/child/revoke.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"revoke.js","sourceRoot":"","sources":["revoke.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEL,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,SAAS,2BAA2B,CAAC,KAcpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC;QAChD,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,qCAAqC,CACtC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACvE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAmBvC;IACC,MAAM,IAAI,GAAwB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,gKAAgK;AAChK,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAkB1D;IACC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,MAAM,uCAAuC,CAAC;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACrE,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,kBAAkB,EAAE,uBAAuB;QAC3C,QAAQ,EAAE,qBAAqB;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACL,MAAM,IAAI,GAAmC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,mBAAmB;QACnB,WAAW,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;QAC1D,qBAAqB,EACnB,MAAM,wCAAwC,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,mBAAmB;QACnB,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,qBAAqB;QAC/B,YAAY;QACZ,yBAAyB,EAAE,SAAS,EAAE,mBAAmB,IAAI,IAAI;KAClE,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IACE,0BAA0B;QAC1B,CAAC,0BAA0B,CAAC,aAAa;YACvC,KAAK,CAAC,cAAc,CAAC,WAAW;YAChC,0BAA0B,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,wBAAwB,GAAG,0BAA0B;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CACtB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;YACjE,MAAM,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW,CAChE;QACH,CAAC,CAAC,iBAAiB,CAAC;IACtB,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,kBAAkB;QAClC,SAAS;QACT,eAAe;QACf,iBAAiB,EAAE,wBAAwB;QAC3C,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;QACpC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY;QACZ,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,wBAAwB;QAC3C,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAa3C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAClD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACtE,MAAM,EAAE,qBAAqB;oBAC3B,CAAC,CAAC,GAAG,EAAE,CACH,qBAAqB,CAAC,IAAI,CACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerRotationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n buildContainerCreateKeyEpoch,\n signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n asContainerManifestBundle,\n uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerMutationAuthor,\n ContainerRevokeApi,\n ContainerRevokePlan,\n MaterializedContainerRevokePlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n type ContainerRevokeSubject,\n deriveContainerRevokeManifest,\n} from \"./revokeManifest\";\nimport { resolveRotationContext } from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\n\nfunction buildContainerRevokeRequest(input: {\n body: ContainerRevokeAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"revoke\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container revoke predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container revoke keyring\"),\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container revoke parent KEK state\",\n ),\n };\n}\n\nfunction buildContainerRevokePlanResult(input: {\n body: ContainerRevokeAccessEventBody;\n containerId: string;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n event: AccessEvent;\n eventHash: string;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerAccessManifestState;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerRevokePlan {\n const plan: ContainerRevokePlan = {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: buildContainerRevokeRequest({\n body: input.body,\n event: input.event,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n parentKek: input.parentKek,\n predecessorBridge: input.predecessorBridge,\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\n// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.\nexport async function buildMaterializedContainerRevokePlan(input: {\n author: ContainerMutationAuthor;\n eventId?: string \| undefined;\n execSql: ExecSql;\n /** Keys a batch minted above this container and has yet to commit. /\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n /* False for a projection re-rooted on rotations not yet acknowledged. /\n persistVerificationCheckpoints?: boolean \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /* Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<MaterializedContainerRevokePlan> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container revoke\",\n );\n const {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n } = await resolveRotationContext(input, \"revoke\");\n const principalPolicies = await collectContainerRevokePrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n previousProjection: input.previousProjection,\n principalPolicyCache: input.principalPolicyCache,\n resolveUserKey: resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"admin\",\n });\n const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;\n const { containerKey, containerKeyEpochId, keyring, predecessorBridge } =\n await buildContainerRotationArtifacts({\n containerId: previousState.containerId,\n currentKek: target.kek,\n currentKeyMaterial: predecessorContainerKey,\n keyEpoch: nextContainerKeyEpoch,\n signedEpochIds: target.signedEpochIds,\n });\n const body: ContainerRevokeAccessEventBody = {\n eventType: \"container.revoke\",\n parentManifestHash:\n input.previousProjection.path.at(-2)?.manifestHash ?? null,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: previousState.containerId,\n keyMaterial: containerKey,\n }),\n containerKeyEpochId,\n keyringHash: await computeContainerKekKeyringHash(keyring),\n predecessorBridgeHash:\n await computeContainerKekPredecessorBridgeHash(predecessorBridge),\n subjectId: input.revokedSubject.subjectId,\n subjectType: input.revokedSubject.subjectType,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previousState.containerId,\n dependencyManifestHashes: uniqueSortedManifestHashes(\n input.previousProjection.path,\n ),\n eventId: input.eventId ?? crypto.randomUUID(),\n previousManifestHash: target.manifest.manifestHash,\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const { manifest, manifestHash, state } = await deriveContainerRevokeManifest(\n {\n containerKeyPublicKey: body.containerKeyPublicKey,\n parentManifestHash: body.parentManifestHash,\n containerKeyEpochId,\n eventHash,\n previousManifest: target.manifest,\n revokedSubject: input.revokedSubject,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: previousState.containerId,\n containerKeyEpochId,\n eventHash,\n keyEpoch: nextContainerKeyEpoch,\n manifestHash,\n parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,\n });\n\n const replacementPrincipalPolicy = input.replacementPrincipalPolicy;\n if (\n replacementPrincipalPolicy &&\n (replacementPrincipalPolicy.principalType !==\n input.revokedSubject.subjectType \|\|\n replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)\n ) {\n throw new Error(\"Container revoke replacement principal does not match\");\n }\n const currentPrincipalPolicies = replacementPrincipalPolicy\n ? principalPolicies.filter(\n (policy) =>\n policy.principalType !== replacementPrincipalPolicy.principalType \|\|\n policy.principalId !== replacementPrincipalPolicy.principalId,\n )\n : principalPolicies;\n const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n containerKey,\n containerKeyEpochId,\n manifestHash,\n operationLabel: \"Container revoke\",\n parentKek,\n parentPublicKey,\n principalPolicies: currentPrincipalPolicies,\n resolveUserKey: resolveProjectionUserKey,\n state,\n });\n\n return buildContainerRevokePlanResult({\n body,\n containerId: previousState.containerId,\n containerKey,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n parentKek,\n predecessorBridge,\n previousManifest: asContainerManifestBundle(target.manifest),\n previousProjection: input.previousProjection,\n principalPolicies: currentPrincipalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n}\n\nexport async function revokeRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerRevokeApi;\n author: ContainerMutationAuthor;\n containerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerRevokePlan;\n response: ContainerRotationResponse;\n} \| null> {\n const previousProjection = await input.apiClient.getContainerWriterProjection(\n input.containerId,\n );\n if (!previousProjection) {\n return null;\n }\n\n const materializedPlan = await buildMaterializedContainerRevokePlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n previousProjection,\n revokedSubject: input.revokedSubject,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: () =>\n containerWriterProjectionFromRotationPlan({\n plan: materializedPlan.plan,\n previousProjection,\n }),\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { revokeContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.revokeContainer(input.containerId, request, options),\n result: revokeContainerResult\n ? () =>\n revokeContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}
1	+ {"version":3,"file":"revoke.js","sourceRoot":"","sources":["revoke.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEL,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,SAAS,2BAA2B,CAAC,KAcpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC;QAChD,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,qCAAqC,CACtC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACvE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAmBvC;IACC,MAAM,IAAI,GAAwB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,gKAAgK;AAChK,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAkB1D;IACC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,MAAM,uCAAuC,CAAC;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACrE,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,kBAAkB,EAAE,uBAAuB;QAC3C,QAAQ,EAAE,qBAAqB;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACL,MAAM,IAAI,GAAmC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,mBAAmB;QACnB,WAAW,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;QAC1D,qBAAqB,EACnB,MAAM,wCAAwC,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,mBAAmB;QACnB,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,qBAAqB;QAC/B,YAAY;QACZ,yBAAyB,EAAE,SAAS,EAAE,mBAAmB,IAAI,IAAI;KAClE,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IACE,0BAA0B;QAC1B,CAAC,0BAA0B,CAAC,aAAa;YACvC,KAAK,CAAC,cAAc,CAAC,WAAW;YAChC,0BAA0B,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,wBAAwB,GAAG,0BAA0B;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CACtB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;YACjE,MAAM,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW,CAChE;QACH,CAAC,CAAC,iBAAiB,CAAC;IACtB,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,kBAAkB;QAClC,SAAS;QACT,eAAe;QACf,iBAAiB,EAAE,wBAAwB;QAC3C,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;QACpC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY;QACZ,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,wBAAwB;QAC3C,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAa3C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAClD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACtE,MAAM,EAAE,qBAAqB;oBAC3B,CAAC,CAAC,GAAG,EAAE,CACH,qBAAqB,CAAC,IAAI,CACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerRotationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n buildContainerCreateKeyEpoch,\n signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n asContainerManifestBundle,\n uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerMutationAuthor,\n ContainerRevokeApi,\n ContainerRevokePlan,\n MaterializedContainerRevokePlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n type ContainerRevokeSubject,\n deriveContainerRevokeManifest,\n} from \"./revokeManifest\";\nimport { resolveRotationContext } from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\n\nfunction buildContainerRevokeRequest(input: {\n body: ContainerRevokeAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"revoke\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container revoke predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container revoke keyring\"),\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container revoke parent KEK state\",\n ),\n };\n}\n\nfunction buildContainerRevokePlanResult(input: {\n body: ContainerRevokeAccessEventBody;\n containerId: string;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n event: AccessEvent;\n eventHash: string;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerAccessManifestState;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerRevokePlan {\n const plan: ContainerRevokePlan = {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: buildContainerRevokeRequest({\n body: input.body,\n event: input.event,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n parentKek: input.parentKek,\n predecessorBridge: input.predecessorBridge,\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\n// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.\nexport async function buildMaterializedContainerRevokePlan(input: {\n author: ContainerMutationAuthor;\n eventId?: string \| undefined;\n execSql: ExecSql;\n /** Keys a batch minted above this container and has yet to commit. /\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n /* False for a projection re-rooted on rotations not yet acknowledged. /\n persistVerificationCheckpoints?: boolean \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /* Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<MaterializedContainerRevokePlan> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container revoke\",\n );\n const {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n } = await resolveRotationContext(input, \"revoke\");\n const principalPolicies = await collectContainerRevokePrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n previousProjection: input.previousProjection,\n principalPolicyCache: input.principalPolicyCache,\n resolveUserKey: resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"admin\",\n });\n const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;\n const { containerKey, containerKeyEpochId, keyring, predecessorBridge } =\n await buildContainerRotationArtifacts({\n containerId: previousState.containerId,\n currentKek: target.kek,\n currentKeyMaterial: predecessorContainerKey,\n keyEpoch: nextContainerKeyEpoch,\n signedEpochIds: target.signedEpochIds,\n });\n const body: ContainerRevokeAccessEventBody = {\n eventType: \"container.revoke\",\n parentManifestHash:\n input.previousProjection.path.at(-2)?.manifestHash ?? null,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: previousState.containerId,\n keyMaterial: containerKey,\n }),\n containerKeyEpochId,\n keyringHash: await computeContainerKekKeyringHash(keyring),\n predecessorBridgeHash:\n await computeContainerKekPredecessorBridgeHash(predecessorBridge),\n subjectId: input.revokedSubject.subjectId,\n subjectType: input.revokedSubject.subjectType,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previousState.containerId,\n dependencyManifestHashes: uniqueSortedManifestHashes(\n input.previousProjection.path,\n ),\n eventId: input.eventId ?? crypto.randomUUID(),\n previousManifestHash: target.manifest.manifestHash,\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const { manifest, manifestHash, state } = await deriveContainerRevokeManifest(\n {\n containerKeyPublicKey: body.containerKeyPublicKey,\n parentManifestHash: body.parentManifestHash,\n containerKeyEpochId,\n eventHash,\n previousManifest: target.manifest,\n revokedSubject: input.revokedSubject,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: previousState.containerId,\n containerKeyEpochId,\n eventHash,\n keyEpoch: nextContainerKeyEpoch,\n manifestHash,\n parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,\n });\n\n const replacementPrincipalPolicy = input.replacementPrincipalPolicy;\n if (\n replacementPrincipalPolicy &&\n (replacementPrincipalPolicy.principalType !==\n input.revokedSubject.subjectType \|\|\n replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)\n ) {\n throw new Error(\"Container revoke replacement principal does not match\");\n }\n const currentPrincipalPolicies = replacementPrincipalPolicy\n ? principalPolicies.filter(\n (policy) =>\n policy.principalType !== replacementPrincipalPolicy.principalType \|\|\n policy.principalId !== replacementPrincipalPolicy.principalId,\n )\n : principalPolicies;\n const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n containerKey,\n containerKeyEpochId,\n manifestHash,\n operationLabel: \"Container revoke\",\n parentKek,\n parentPublicKey,\n principalPolicies: currentPrincipalPolicies,\n resolveUserKey: resolveProjectionUserKey,\n state,\n });\n\n return buildContainerRevokePlanResult({\n body,\n containerId: previousState.containerId,\n containerKey,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n parentKek,\n predecessorBridge,\n previousManifest: asContainerManifestBundle(target.manifest),\n previousProjection: input.previousProjection,\n principalPolicies: currentPrincipalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n}\n\nexport async function revokeRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerRevokeApi;\n author: ContainerMutationAuthor;\n containerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerRevokePlan;\n response: ContainerRotationResponse;\n} \| null> {\n const previousProjection = await input.apiClient.getContainerWriterProjection(\n input.containerId,\n );\n if (!previousProjection) {\n return null;\n }\n\n const materializedPlan = await buildMaterializedContainerRevokePlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n previousProjection,\n revokedSubject: input.revokedSubject,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: () =>\n containerWriterProjectionFromRotationPlan({\n plan: materializedPlan.plan,\n previousProjection,\n }),\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { revokeContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.revokeContainer(input.containerId, request, options),\n result: revokeContainerResult\n ? () =>\n revokeContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}

package/workflows/containers/child/rotationPrincipalPolicies.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
-import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
 /**
  * Shared by rekey and revoke. Lives apart from both: background descendant
  * repair imports the rekey planner, and revoke schedules that repair, so

package/workflows/containers/child/runtimeCurrentGroupShare.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { principalPolicyCacheForVerifiedPolicies } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
 import { inheritPrincipalHistoryProtection } from "../../../data/principals/principalHistoryRuntime.js";
 import { createRuntimeCurrentGroupMutation } from "../../organizations/runtimeCurrentGroupMutation.js";

package/workflows/containers/child/share.d.ts CHANGED Viewed

@@ -1,8 +1,8 @@
 import type { ContainerAccessLevel, SigningKeyPair } from "../../../internal/crypto/index.js";
 import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
 import type { ContainerMutationAuthor, ContainerShareApi, ContainerSharePlan } from "../../../data/containers/shared/types.js";
-import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification.js";
-import type { SecurityIncidentReporter } from "../../../data/securityIncidents.js";
+import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 import { type TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
 import type { GroupPolicyNameReader } from "../../organizations/principalPolicyRequest.js";

package/workflows/containers/child/share.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification.js";
+import { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
 import { principalPolicyCacheForVerifiedPolicies } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
 import { savePrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
 import { requireTrustedUserIdentityResolver, } from "../../../data/trustedUserIdentity/index.js";