@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/containers/child/mutationSubmit.js.map

@@ -1 +1 @@
-{"version":3,"file":"mutationSubmit.js","sourceRoot":"","sources":["mutationSubmit.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,GAE/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAUjG,OAAO,EAEL,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAa7D,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAsD;IAEtD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAG7C;IACC,OAAO,KAAK,CAAC,MAAM;QACjB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE;QAChB,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IAIC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,IACE,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;QACvE,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM;QACpC,CAAC,KAAK,CAAC,aAAa,EACpB,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ;QAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAC1E,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,qBAAqB,CAC3B,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACjE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAEvD,KAgBD;IAKC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACzB,qEAAqE;QACrE,IAAI,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC;YACjD,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAEvC,MAAM,YAAY,GAChB,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,MAAM,4BAA4B,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;QACJ,CAAC,CAAC,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,iCAAiC,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC5D,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;IACT,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnE,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,KAAK,CAAC,kBAAkB;SACnC,CAAC,CAAC;QACH,iCAAiC,CAAC;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sEAAsE;YACtE,uEAAuE;YACvE,yDAAyD;YACzD,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,YAAY;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport {\n  CONTAINER_MUTATION_ERROR_CODES,\n  type ContainerRotationResponse,\n} from \"@tearleads/validators/response\";\nimport { ContainerPathTooDeepError } from \"../../../data/containers/shared/containerPathLimits\";\nimport { rememberVerifiedContainerHeads } from \"../../../data/containers/shared/heldContainerHeads\";\nimport {\n  acknowledgeContainerMutation,\n  acknowledgeContainerMutationBatch,\n} from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { isContainerPathTooDeepFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRotationResult,\n  MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  type CarriedRekeyPlanningInput,\n  planCarriedDescendantRekeys,\n  type SpeculativePath,\n} from \"./carriedDescendantRekeys\";\nimport { scheduleHeldDescendantRecitations } from \"./recite\";\n\n/**\n * Supplied by mutations that mint a new key epoch (rekey, revoke, move). The\n * server refuses one that would strand a level above a directly granted\n * container, and names the descendant rekeys it must carry instead (#2340).\n */\nexport interface CarriedRekeys {\n  readonly planning: CarriedRekeyPlanningInput;\n  /** The rotated container's own path once the rotation is accepted. */\n  readonly rotated: () => Promise<SpeculativePath>;\n}\n\n/** A mutation with no status-bearing variant: a share mints nothing to carry. */\nexport async function submitPlainContainerMutation(\n  plain: () => Promise<ContainerRotationResponse | null>,\n): Promise<ContainerRotationResult> {\n  const data = await plain();\n  return data ? { data, ok: true } : { ok: false, status: null };\n}\n\n/**\n * Adapt a rotation endpoint pair to one status-bearing call. An adapter with\n * only the plain method still rotates; it just cannot learn what to carry, so a\n * rotation that needs descendants fails as any other refusal does.\n */\nexport async function submitContainerRotation(input: {\n  plain: () => Promise<ContainerRotationResponse | null>;\n  result: (() => Promise<ContainerRotationResult>) | undefined;\n}): Promise<ContainerRotationResult> {\n  return input.result\n    ? input.result()\n    : submitPlainContainerMutation(input.plain);\n}\n\n/**\n * Submit a rotation; if the server refuses it for stranding a level above a\n * directly granted container, sign the descendant rekeys it names and resubmit\n * once with them carried. The refused attempt rolled back whole, so the signed\n * rotation still extends the current head and only the descendants need\n * signing. A second refusal means the tree moved underneath, and the caller's\n * own retry starts from a fresh projection.\n */\nexport async function submitRotationCarryingDescendants(input: {\n  carriedRekeys?: CarriedRekeys | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  submit: (\n    carried: readonly ContainerMutationRequest[],\n  ) => Promise<ContainerRotationResult>;\n}): Promise<{\n  carriedPlans: MaterializedContainerRekeyPlan[];\n  result: ContainerRotationResult;\n}> {\n  const result = await input.submit([]);\n  if (\n    result.ok ||\n    result.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||\n    !result.requiredContainerIds?.length ||\n    !input.carriedRekeys\n  ) {\n    return { carriedPlans: [], result: reportTerminalRefusal(result) };\n  }\n  // Answerable, so not an error: callers submit with `reportErrors: false` and\n  // only the refusal that ends the attempt is surfaced.\n  const carriedPlans = await planCarriedDescendantRekeys({\n    ...input.carriedRekeys.planning,\n    requiredContainerIds: result.requiredContainerIds,\n    rotated: [await input.carriedRekeys.rotated()],\n  });\n  // Superseded mid-flight: hand back the refusal unreported, since the caller\n  // discards it and the generation that owned this attempt is gone.\n  if (input.stillCurrent?.() === false) return { carriedPlans: [], result };\n  return {\n    carriedPlans,\n    result: reportTerminalRefusal(\n      await input.submit(carriedPlans.map(({ plan }) => plan.request)),\n    ),\n  };\n}\n\nfunction reportTerminalRefusal(\n  result: ContainerRotationResult,\n): ContainerRotationResult {\n  if (!result.ok) result.report?.();\n  return result;\n}\n\n/**\n * Submit and acknowledge remote share/rekey/revoke/move plans before scheduling\n * opportunistic descendant re-citations. Create separately handles its lost\n * response conflict; group share caches the rotated policy after this tail.\n */\nexport async function submitAcknowledgedContainerMutation<\n  TPlan extends Parameters<typeof acknowledgeContainerMutation>[0][\"plan\"],\n>(input: {\n  apiClient: ContainerReciteApi;\n  author: ContainerMutationAuthor;\n  /** Present exactly when the plan minted a new key epoch. */\n  carriedRekeys?: CarriedRekeys | undefined;\n  containerKey: Uint8Array;\n  execSql: ExecSql;\n  plan: TPlan;\n  recitationPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n  /** Session lifetime for best-effort work after durable acknowledgement. */\n  recitationStillCurrent?: (() => boolean) | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  stillCurrent?: (() => boolean) | undefined;\n  submit: (\n    carried: readonly ContainerMutationRequest[],\n  ) => Promise<ContainerRotationResult>;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: TPlan;\n  response: ContainerRotationResponse;\n} | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const submitted = await submitRotationCarryingDescendants(input);\n  if (!submitted.result.ok) {\n    // Final, unlike the other refusals: a queued move must not retry it.\n    if (isContainerPathTooDeepFailure(submitted.result))\n      throw new ContainerPathTooDeepError();\n    return null;\n  }\n  const { carriedPlans } = submitted;\n  const response = submitted.result.data;\n\n  const acknowledged =\n    carriedPlans.length === 0\n      ? await acknowledgeContainerMutation({\n          execSql: input.execSql,\n          plan: input.plan,\n          response,\n          stillCurrent: input.stillCurrent,\n        })\n      : // The rotation and what it carried committed together, so their pins\n        // advance together: a missing acknowledgement refuses the whole batch.\n        await acknowledgeContainerMutationBatch({\n          execSql: input.execSql,\n          plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n          responses: [response, ...(response.containerRekeys ?? [])],\n          stillCurrent: input.stillCurrent,\n        });\n  if (!acknowledged || input.stillCurrent?.() === false) return null;\n\n  try {\n    rememberVerifiedContainerHeads({\n      execSql: input.execSql,\n      organizationId: input.author.organizationId,\n      heads: [],\n      policies: input.recitationPolicies,\n    });\n    scheduleHeldDescendantRecitations({\n      apiClient: input.apiClient,\n      author: input.author,\n      execSql: input.execSql,\n      // `plans` are the containers whose descendants get re-cited; they are\n      // never re-cited themselves. A carried rekey already cites the current\n      // path, so listing it here spares its recitation budget.\n      plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n      reportSecurityIncident: input.reportSecurityIncident,\n      stillCurrent: input.recitationStillCurrent ?? input.stillCurrent,\n    });\n  } catch {\n    // Optional cache population cannot change an acknowledged mutation result.\n  }\n  return {\n    containerKey: input.containerKey,\n    plan: input.plan,\n    response,\n  };\n}\n"]}
+{"version":3,"file":"mutationSubmit.js","sourceRoot":"","sources":["mutationSubmit.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,GAE/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAUjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAEL,2BAA2B,GAE5B,MAAM,iCAAiC,CAAC;AAazC,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAsD;IAEtD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAG7C;IACC,OAAO,KAAK,CAAC,MAAM;QACjB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE;QAChB,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IAIC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,IACE,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;QACvE,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM;QACpC,CAAC,KAAK,CAAC,aAAa,EACpB,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ;QAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAC1E,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,qBAAqB,CAC3B,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACjE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAEvD,KAgBD;IAKC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACzB,qEAAqE;QACrE,IAAI,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC;YACjD,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAEvC,MAAM,YAAY,GAChB,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,MAAM,4BAA4B,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;QACJ,CAAC,CAAC,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,iCAAiC,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC5D,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;IACT,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnE,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,KAAK,CAAC,kBAAkB;SACnC,CAAC,CAAC;QACH,iCAAiC,CAAC;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sEAAsE;YACtE,uEAAuE;YACvE,yDAAyD;YACzD,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,YAAY;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport {\n  CONTAINER_MUTATION_ERROR_CODES,\n  type ContainerRotationResponse,\n} from \"@tearleads/validators/response\";\nimport { ContainerPathTooDeepError } from \"../../../data/containers/shared/containerPathLimits\";\nimport { rememberVerifiedContainerHeads } from \"../../../data/containers/shared/heldContainerHeads\";\nimport {\n  acknowledgeContainerMutation,\n  acknowledgeContainerMutationBatch,\n} from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { isContainerPathTooDeepFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRotationResult,\n  MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { scheduleHeldDescendantRecitations } from \"./recite\";\nimport {\n  type CarriedRekeyPlanningInput,\n  planCarriedDescendantRekeys,\n  type SpeculativePath,\n} from \"./rekey/carriedDescendantRekeys\";\n\n/**\n * Supplied by mutations that mint a new key epoch (rekey, revoke, move). The\n * server refuses one that would strand a level above a directly granted\n * container, and names the descendant rekeys it must carry instead (#2340).\n */\nexport interface CarriedRekeys {\n  readonly planning: CarriedRekeyPlanningInput;\n  /** The rotated container's own path once the rotation is accepted. */\n  readonly rotated: () => Promise<SpeculativePath>;\n}\n\n/** A mutation with no status-bearing variant: a share mints nothing to carry. */\nexport async function submitPlainContainerMutation(\n  plain: () => Promise<ContainerRotationResponse | null>,\n): Promise<ContainerRotationResult> {\n  const data = await plain();\n  return data ? { data, ok: true } : { ok: false, status: null };\n}\n\n/**\n * Adapt a rotation endpoint pair to one status-bearing call. An adapter with\n * only the plain method still rotates; it just cannot learn what to carry, so a\n * rotation that needs descendants fails as any other refusal does.\n */\nexport async function submitContainerRotation(input: {\n  plain: () => Promise<ContainerRotationResponse | null>;\n  result: (() => Promise<ContainerRotationResult>) | undefined;\n}): Promise<ContainerRotationResult> {\n  return input.result\n    ? input.result()\n    : submitPlainContainerMutation(input.plain);\n}\n\n/**\n * Submit a rotation; if the server refuses it for stranding a level above a\n * directly granted container, sign the descendant rekeys it names and resubmit\n * once with them carried. The refused attempt rolled back whole, so the signed\n * rotation still extends the current head and only the descendants need\n * signing. A second refusal means the tree moved underneath, and the caller's\n * own retry starts from a fresh projection.\n */\nexport async function submitRotationCarryingDescendants(input: {\n  carriedRekeys?: CarriedRekeys | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  submit: (\n    carried: readonly ContainerMutationRequest[],\n  ) => Promise<ContainerRotationResult>;\n}): Promise<{\n  carriedPlans: MaterializedContainerRekeyPlan[];\n  result: ContainerRotationResult;\n}> {\n  const result = await input.submit([]);\n  if (\n    result.ok ||\n    result.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||\n    !result.requiredContainerIds?.length ||\n    !input.carriedRekeys\n  ) {\n    return { carriedPlans: [], result: reportTerminalRefusal(result) };\n  }\n  // Answerable, so not an error: callers submit with `reportErrors: false` and\n  // only the refusal that ends the attempt is surfaced.\n  const carriedPlans = await planCarriedDescendantRekeys({\n    ...input.carriedRekeys.planning,\n    requiredContainerIds: result.requiredContainerIds,\n    rotated: [await input.carriedRekeys.rotated()],\n  });\n  // Superseded mid-flight: hand back the refusal unreported, since the caller\n  // discards it and the generation that owned this attempt is gone.\n  if (input.stillCurrent?.() === false) return { carriedPlans: [], result };\n  return {\n    carriedPlans,\n    result: reportTerminalRefusal(\n      await input.submit(carriedPlans.map(({ plan }) => plan.request)),\n    ),\n  };\n}\n\nfunction reportTerminalRefusal(\n  result: ContainerRotationResult,\n): ContainerRotationResult {\n  if (!result.ok) result.report?.();\n  return result;\n}\n\n/**\n * Submit and acknowledge remote share/rekey/revoke/move plans before scheduling\n * opportunistic descendant re-citations. Create separately handles its lost\n * response conflict; group share caches the rotated policy after this tail.\n */\nexport async function submitAcknowledgedContainerMutation<\n  TPlan extends Parameters<typeof acknowledgeContainerMutation>[0][\"plan\"],\n>(input: {\n  apiClient: ContainerReciteApi;\n  author: ContainerMutationAuthor;\n  /** Present exactly when the plan minted a new key epoch. */\n  carriedRekeys?: CarriedRekeys | undefined;\n  containerKey: Uint8Array;\n  execSql: ExecSql;\n  plan: TPlan;\n  recitationPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n  /** Session lifetime for best-effort work after durable acknowledgement. */\n  recitationStillCurrent?: (() => boolean) | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  stillCurrent?: (() => boolean) | undefined;\n  submit: (\n    carried: readonly ContainerMutationRequest[],\n  ) => Promise<ContainerRotationResult>;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: TPlan;\n  response: ContainerRotationResponse;\n} | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const submitted = await submitRotationCarryingDescendants(input);\n  if (!submitted.result.ok) {\n    // Final, unlike the other refusals: a queued move must not retry it.\n    if (isContainerPathTooDeepFailure(submitted.result))\n      throw new ContainerPathTooDeepError();\n    return null;\n  }\n  const { carriedPlans } = submitted;\n  const response = submitted.result.data;\n\n  const acknowledged =\n    carriedPlans.length === 0\n      ? await acknowledgeContainerMutation({\n          execSql: input.execSql,\n          plan: input.plan,\n          response,\n          stillCurrent: input.stillCurrent,\n        })\n      : // The rotation and what it carried committed together, so their pins\n        // advance together: a missing acknowledgement refuses the whole batch.\n        await acknowledgeContainerMutationBatch({\n          execSql: input.execSql,\n          plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n          responses: [response, ...(response.containerRekeys ?? [])],\n          stillCurrent: input.stillCurrent,\n        });\n  if (!acknowledged || input.stillCurrent?.() === false) return null;\n\n  try {\n    rememberVerifiedContainerHeads({\n      execSql: input.execSql,\n      organizationId: input.author.organizationId,\n      heads: [],\n      policies: input.recitationPolicies,\n    });\n    scheduleHeldDescendantRecitations({\n      apiClient: input.apiClient,\n      author: input.author,\n      execSql: input.execSql,\n      // `plans` are the containers whose descendants get re-cited; they are\n      // never re-cited themselves. A carried rekey already cites the current\n      // path, so listing it here spares its recitation budget.\n      plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n      reportSecurityIncident: input.reportSecurityIncident,\n      stillCurrent: input.recitationStillCurrent ?? input.stillCurrent,\n    });\n  } catch {\n    // Optional cache population cannot change an acknowledged mutation result.\n  }\n  return {\n    containerKey: input.containerKey,\n    plan: input.plan,\n    response,\n  };\n}\n"]}

package/workflows/containers/child/rekey/carriedDescendantRekeys.js

@@ -0,0 +1,126 @@
+import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../../internal/validators/util/index.js";
+import { verifyContainerWriterProjection, } from "../../../../data/keyingProjectionVerification/index.js";
+import { selectReplacementPrincipalPolicyReferences } from "../rotation/replacementPrincipalPolicyReferences.js";
+import { buildMaterializedContainerRekeyPlan } from "./index.js";
+import { rebaseContainerWriterProjection } from "./rekeyProjection.js";
+/**
+ * Re-root a served projection on the deepest not-yet-accepted proper ancestor
+ * among `speculativePaths`. Each carried plan's own path was built the same
+ * way, so the deepest one already holds every speculative level above it. The
+ * container's own path, when the batch rotates it too, is not an ancestor: the
+ * caller is re-planning that rotation, and it extends what sits above.
+ */
+export function rebaseOnDeepestAncestor(served, speculativePaths) {
+    let deepest = null;
+    let deepestIndex = -1;
+    for (const speculative of speculativePaths) {
+        const containerId = speculative.containerKeks.at(-1)?.containerId;
+        if (containerId === served.containerId)
+            continue;
+        const index = served.containerKeks.findIndex((kek) => kek.containerId === containerId);
+        if (index > deepestIndex) {
+            deepest = speculative;
+            deepestIndex = index;
+        }
+    }
+    if (!deepest)
+        return null;
+    const projection = rebaseContainerWriterProjection(served, deepest);
+    return projection ? { ancestor: deepest, projection } : null;
+}
+/**
+ * Sign one carried rekey against the path its batch will leave behind. The
+ * served projection is fetched by the caller; here it is verified, must sit
+ * below one of the rotated containers and in that container's organization,
+ * and is signed only if this signer holds its key and write access — which a
+ * member able to rotate the ancestor always does, since both inherit downward.
+ */
+export async function planCarriedDescendantRekey(input) {
+    // Pin the served head before signing beyond it. The batch is acknowledged
+    // against the latest durable pin, and a carried rekey is always past epoch
+    // 1, so a device that never pinned this container would otherwise reject
+    // its own batch after the server had committed it.
+    await verifyContainerWriterProjection({
+        execSql: input.execSql,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.served,
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    const rebased = rebaseOnDeepestAncestor(input.served, input.rotated);
+    if (!rebased) {
+        throw new Error("Carried descendant rekey is not below the rotated container");
+    }
+    // A batch locks whatever organizations it names, so the server holds each
+    // to the rule on its own; a carried rekey belongs to the rotation it rides.
+    if (input.served.organizationId !== rebased.ancestor.organizationId) {
+        throw new Error("Carried descendant rekey is outside the rotated container's organization");
+    }
+    return buildMaterializedContainerRekeyPlan({
+        author: {
+            ...input.author,
+            organizationId: rebased.ancestor.organizationId,
+        },
+        execSql: input.execSql,
+        knownContainerKeks: input.knownContainerKeks,
+        // Nothing here is acknowledged yet: pins move only with the batch.
+        persistVerificationCheckpoints: false,
+        previousProjection: rebased.projection,
+        principalPolicyCache: input.principalPolicyCache,
+        replacementPrincipalPolicy: input.replacementPrincipalPolicy
+            ? await selectReplacementPrincipalPolicyReferences({
+                policy: input.replacementPrincipalPolicy,
+                projection: rebased.projection,
+                principalPolicyCache: input.principalPolicyCache,
+                resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,
+            })
+            : undefined,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+}
+/**
+ * Sign the descendant rekeys a rotation must commit with (#2340). The server
+ * refuses a rotation that would leave a level above a directly granted
+ * container pinned to a retired epoch, because the grantee could never re-key
+ * that level itself and its writes would wait on another device. It names the
+ * levels; this signs them, parent-first, each against the path the batch will
+ * leave behind rather than the one currently served.
+ *
+ * `requiredContainerIds` is a hint, never an authority: each container is
+ * fetched and verified here, and refused unless it sits below a rotation.
+ */
+export async function planCarriedDescendantRekeys(input) {
+    const plans = [];
+    const speculativePaths = [...input.rotated];
+    const knownContainerKeks = new Map(input.knownContainerKeks);
+    const planned = new Set();
+    for (const containerId of input.requiredContainerIds) {
+        if (plans.length >= MAX_ROTATION_CONTAINER_REKEYS)
+            break;
+        if (planned.has(containerId))
+            continue;
+        const served = await input.apiClient.getContainerWriterProjection(containerId);
+        if (!served) {
+            throw new Error("Carried descendant rekey projection is unavailable");
+        }
+        if (served.containerId !== containerId) {
+            throw new Error("Carried descendant rekey targets another container");
+        }
+        const plan = await planCarriedDescendantRekey({
+            ...input,
+            knownContainerKeks,
+            rotated: speculativePaths,
+            served,
+        });
+        planned.add(containerId);
+        plans.push(plan);
+        speculativePaths.push(plan.writerProjection);
+        knownContainerKeks.set(plan.plan.containerKeyEpochId, plan.containerKey);
+    }
+    return plans;
+}
+//# sourceMappingURL=carriedDescendantRekeys.js.map

package/workflows/containers/child/rekey/carriedDescendantRekeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carriedDescendantRekeys.js","sourceRoot":"","sources":["carriedDescendantRekeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAM3E,OAAO,EAIL,+BAA+B,GAChC,MAAM,+CAA+C,CAAC;AAIvD,OAAO,EAAE,0CAA0C,EAAE,MAAM,kDAAkD,CAAC;AAC9G,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAuCpE;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyC,EACzC,gBAA4C;IAK5C,IAAI,OAAO,GAA2B,IAAI,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,MAAM,WAAW,IAAI,gBAAgB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAClE,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,WAAW,CACzC,CAAC;QACF,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,OAAO,GAAG,WAAW,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,+BAA+B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAGC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc;SAChD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mEAAmE;QACnE,8BAA8B,EAAE,KAAK;QACrC,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC1D,CAAC,CAAC,MAAM,0CAA0C,CAAC;gBAC/C,MAAM,EAAE,KAAK,CAAC,0BAA0B;gBACxC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;aACxC,CAAC;YACJ,CAAC,CAAC,SAAS;QACb,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAIC;IAED,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAsB,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B;YAAE,MAAM;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS;QACvC,MAAM,MAAM,GACV,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;YAC5C,GAAG,KAAK;YACR,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  MaterializedContainerRekeyPlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  verifyContainerWriterProjection,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { selectReplacementPrincipalPolicyReferences } from \"../rotation/replacementPrincipalPolicyReferences\";\nimport { buildMaterializedContainerRekeyPlan } from \"./index\";\nimport { rebaseContainerWriterProjection } from \"./rekeyProjection\";\n\n/** What a rotation needs in hand to sign the descendant rekeys it must carry. */\nexport interface CarriedRekeyPlanningInput {\n  readonly apiClient: Pick<ContainerRekeyApi, \"getContainerWriterProjection\">;\n  readonly author: ContainerMutationAuthor;\n  readonly execSql: ExecSql;\n  /**\n   * Keys the batch minted and has yet to commit, by epoch id. A rotation's\n   * successor is wrapped to recipients at heads the batch itself commits, so\n   * no wrap on a re-rooted path opens it for the signer before then; the key\n   * the signer just minted does, and its keyring then opens what sits below.\n   */\n  readonly knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /**\n   * Verified policies the batch itself commits, which the rebased paths cite\n   * before any store holds them; and the one each carried rekey cites anew.\n   */\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly targetSecretKey: Uint8Array;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/** A rotated container's own path once its batch is accepted. */\nexport type SpeculativePath = Pick<\n  ContainerWriterProjectionResponse,\n  \"containerKeks\" | \"organizationId\" | \"path\" | \"policyEvidence\"\n>;\n\n/**\n * Re-root a served projection on the deepest not-yet-accepted proper ancestor\n * among `speculativePaths`. Each carried plan's own path was built the same\n * way, so the deepest one already holds every speculative level above it. The\n * container's own path, when the batch rotates it too, is not an ancestor: the\n * caller is re-planning that rotation, and it extends what sits above.\n */\nexport function rebaseOnDeepestAncestor(\n  served: ContainerWriterProjectionResponse,\n  speculativePaths: readonly SpeculativePath[],\n): {\n  ancestor: SpeculativePath;\n  projection: ContainerWriterProjectionResponse;\n} | null {\n  let deepest: SpeculativePath | null = null;\n  let deepestIndex = -1;\n  for (const speculative of speculativePaths) {\n    const containerId = speculative.containerKeks.at(-1)?.containerId;\n    if (containerId === served.containerId) continue;\n    const index = served.containerKeks.findIndex(\n      (kek) => kek.containerId === containerId,\n    );\n    if (index > deepestIndex) {\n      deepest = speculative;\n      deepestIndex = index;\n    }\n  }\n  if (!deepest) return null;\n  const projection = rebaseContainerWriterProjection(served, deepest);\n  return projection ? { ancestor: deepest, projection } : null;\n}\n\n/**\n * Sign one carried rekey against the path its batch will leave behind. The\n * served projection is fetched by the caller; here it is verified, must sit\n * below one of the rotated containers and in that container's organization,\n * and is signed only if this signer holds its key and write access — which a\n * member able to rotate the ancestor always does, since both inherit downward.\n */\nexport async function planCarriedDescendantRekey(\n  input: CarriedRekeyPlanningInput & {\n    readonly rotated: readonly SpeculativePath[];\n    readonly served: ContainerWriterProjectionResponse;\n  },\n): Promise<MaterializedContainerRekeyPlan> {\n  // Pin the served head before signing beyond it. The batch is acknowledged\n  // against the latest durable pin, and a carried rekey is always past epoch\n  // 1, so a device that never pinned this container would otherwise reject\n  // its own batch after the server had committed it.\n  await verifyContainerWriterProjection({\n    execSql: input.execSql,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.served,\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const rebased = rebaseOnDeepestAncestor(input.served, input.rotated);\n  if (!rebased) {\n    throw new Error(\n      \"Carried descendant rekey is not below the rotated container\",\n    );\n  }\n  // A batch locks whatever organizations it names, so the server holds each\n  // to the rule on its own; a carried rekey belongs to the rotation it rides.\n  if (input.served.organizationId !== rebased.ancestor.organizationId) {\n    throw new Error(\n      \"Carried descendant rekey is outside the rotated container's organization\",\n    );\n  }\n  return buildMaterializedContainerRekeyPlan({\n    author: {\n      ...input.author,\n      organizationId: rebased.ancestor.organizationId,\n    },\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    // Nothing here is acknowledged yet: pins move only with the batch.\n    persistVerificationCheckpoints: false,\n    previousProjection: rebased.projection,\n    principalPolicyCache: input.principalPolicyCache,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy\n      ? await selectReplacementPrincipalPolicyReferences({\n          policy: input.replacementPrincipalPolicy,\n          projection: rebased.projection,\n          principalPolicyCache: input.principalPolicyCache,\n          resolveAuthoredPolicyReferences:\n            input.resolveAuthoredPolicyReferences,\n        })\n      : undefined,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n\n/**\n * Sign the descendant rekeys a rotation must commit with (#2340). The server\n * refuses a rotation that would leave a level above a directly granted\n * container pinned to a retired epoch, because the grantee could never re-key\n * that level itself and its writes would wait on another device. It names the\n * levels; this signs them, parent-first, each against the path the batch will\n * leave behind rather than the one currently served.\n *\n * `requiredContainerIds` is a hint, never an authority: each container is\n * fetched and verified here, and refused unless it sits below a rotation.\n */\nexport async function planCarriedDescendantRekeys(\n  input: CarriedRekeyPlanningInput & {\n    readonly requiredContainerIds: readonly string[];\n    /** Each rotated container's own path once the batch is accepted. */\n    readonly rotated: readonly SpeculativePath[];\n  },\n): Promise<MaterializedContainerRekeyPlan[]> {\n  const plans: MaterializedContainerRekeyPlan[] = [];\n  const speculativePaths: SpeculativePath[] = [...input.rotated];\n  const knownContainerKeks = new Map(input.knownContainerKeks);\n  const planned = new Set<string>();\n  for (const containerId of input.requiredContainerIds) {\n    if (plans.length >= MAX_ROTATION_CONTAINER_REKEYS) break;\n    if (planned.has(containerId)) continue;\n    const served =\n      await input.apiClient.getContainerWriterProjection(containerId);\n    if (!served) {\n      throw new Error(\"Carried descendant rekey projection is unavailable\");\n    }\n    if (served.containerId !== containerId) {\n      throw new Error(\"Carried descendant rekey targets another container\");\n    }\n    const plan = await planCarriedDescendantRekey({\n      ...input,\n      knownContainerKeks,\n      rotated: speculativePaths,\n      served,\n    });\n    planned.add(containerId);\n    plans.push(plan);\n    speculativePaths.push(plan.writerProjection);\n    knownContainerKeks.set(plan.plan.containerKeyEpochId, plan.containerKey);\n  }\n  return plans;\n}\n"]}

package/workflows/containers/child/rekey/index.d.ts

@@ -0,0 +1,32 @@
+import type { ContainerKekKeyringEntry } from "../../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, MaterializedContainerRekeyPlan } from "../../../../data/containers/shared/types.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { PrincipalPolicyCurrentEvidence } from "../../../../data/principals/principalPolicyEvidence.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+/**
+ * An explicit container KEK rotation with no membership change. Doubles as
+ * the repair operation: passing `keyringEntriesOverride` seals a keyring
+ * rebuilt from the bridge log instead of re-opening the served one, so a
+ * poisoned snapshot is replaced by ground truth.
+ */
+interface RekeyPlanInput {
+    author: ContainerMutationAuthor;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;
+    /** Keys a batch minted above this container and has yet to commit. */
+    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    persistVerificationCheckpoints?: boolean | undefined;
+    previousProjection: ContainerWriterProjectionResponse;
+    /** Verified policies the path may cite before they are stored locally. */
+    principalPolicyCache?: PrincipalPolicyCache | undefined;
+    replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+export declare function buildMaterializedContainerRekeyPlan(input: RekeyPlanInput): Promise<MaterializedContainerRekeyPlan>;
+export {};

package/workflows/containers/child/rekey/index.js

@@ -0,0 +1,227 @@
+import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, createContainerKekPredecessorBridge, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, sealContainerKekKeyring, } from "../../../../internal/crypto/index.js";
+import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
+import { buildContainerCreateKeyEpoch, resolveContainerKekEpochId, signContainerMutationEvent, } from "../../../../data/containers/shared/events.js";
+import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../../data/containers/shared/projection.js";
+import { readCanonicalRecord } from "../../../../data/keying/canonicalJson.js";
+import { requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
+import { sealRotationKeyring, verifyKeyringEntriesForSeal, } from "../move/moveRotation.js";
+import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "../mutationRequestCore.js";
+import { resolveRotationContext, } from "../rotation/rotationContext.js";
+import { collectContainerRevokePrincipalPolicies } from "../rotation/rotationPrincipalPolicies.js";
+import { buildContainerRotationWraps } from "../rotation/rotationWraps.js";
+import { refreshedPrincipalPolicies, refreshedPrincipalReferences, } from "../share/sharePlanCore.js";
+import { assertOverrideMatchesSignedLineage } from "./keyringOverrideLineage.js";
+import { containerWriterProjectionFromRekeyPlan, isSpeculativeContainerWriterProjection, } from "./rekeyProjection.js";
+async function buildRekeyRotationArtifacts(input) {
+    const containerKeyEpochId = await resolveContainerKekEpochId({
+        containerId: input.previousContainerId,
+        keyEpoch: input.nextContainerKeyEpoch,
+        keyMaterial: input.containerKey,
+    });
+    const predecessorBridge = await createContainerKekPredecessorBridge({
+        containerId: input.previousContainerId,
+        predecessorContainerKey: input.predecessorContainerKey,
+        predecessorContainerKeyEpochId: input.target.kek.containerKeyEpochId,
+        successorContainerKey: input.containerKey,
+        successorContainerKeyEpochId: containerKeyEpochId,
+    });
+    if (input.keyringEntriesOverride) {
+        // A rebuilt override still has to agree with the epochs the projection's
+        // signed history commits to; otherwise a repair could seal a forgery.
+        // Exact match first, for distinct errors; the seal check below then adds
+        // only the per-entry material check for an override.
+        assertOverrideMatchesSignedLineage(input.keyringEntriesOverride, input.target.signedEpochIds);
+        await verifyKeyringEntriesForSeal(input.previousContainerId, input.keyringEntriesOverride, input.target.signedEpochIds);
+    }
+    const keyring = input.keyringEntriesOverride
+        ? await sealContainerKekKeyring({
+            containerId: input.previousContainerId,
+            entries: [
+                ...input.keyringEntriesOverride,
+                {
+                    containerKeyEpochId: input.target.kek.containerKeyEpochId,
+                    keyMaterial: input.predecessorContainerKey,
+                },
+            ],
+            keyEpoch: input.nextContainerKeyEpoch,
+            successorContainerKey: input.containerKey,
+            successorContainerKeyEpochId: containerKeyEpochId,
+        })
+        : await sealRotationKeyring({
+            containerId: input.previousContainerId,
+            currentKek: input.target.kek,
+            currentKeyMaterial: input.predecessorContainerKey,
+            keyEpoch: input.nextContainerKeyEpoch,
+            signedEpochIds: input.target.signedEpochIds,
+            successorContainerKey: input.containerKey,
+            successorContainerKeyEpochId: containerKeyEpochId,
+        });
+    return { containerKeyEpochId, keyring, predecessorBridge };
+}
+async function deriveRekeyManifestArtifacts(input) {
+    const body = {
+        eventType: "container.rekey",
+        parentManifestHash: input.previousProjection.path.at(-2)?.manifestHash ?? null,
+        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
+            containerId: input.previousState.containerId,
+            keyMaterial: input.containerKey,
+        }),
+        containerKeyEpochId: input.containerKeyEpochId,
+        keyringHash: await computeContainerKekKeyringHash(input.keyring),
+        predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(input.predecessorBridge),
+        referencedPrincipalHeads: [...input.referencedPrincipalHeads],
+    };
+    const { event, eventHash } = await signContainerMutationEvent({
+        author: input.author,
+        body,
+        containerId: input.previousState.containerId,
+        dependencyManifestHashes: uniqueSortedManifestHashes(input.previousProjection.path),
+        eventId: input.eventId ?? crypto.randomUUID(),
+        previousManifestHash: input.target.manifest.manifestHash,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    });
+    const state = {
+        ...input.previousState,
+        parentManifestHash: body.parentManifestHash,
+        containerKeyPublicKey: body.containerKeyPublicKey,
+        epoch: input.previousState.epoch + 1,
+        previousManifestHash: input.target.manifest.manifestHash,
+        eventHash,
+        containerKeyEpochId: input.containerKeyEpochId,
+        referencedPrincipalHeads: [...input.referencedPrincipalHeads],
+    };
+    const manifest = await deriveContainerAccessManifest(state);
+    const manifestHash = await computeAccessManifestHash(manifest);
+    const keyEpoch = buildContainerCreateKeyEpoch({
+        containerId: input.previousState.containerId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        eventHash,
+        keyEpoch: input.target.kek.containerKeyEpoch + 1,
+        manifestHash,
+        parentContainerKeyEpochId: input.parentKek?.containerKeyEpochId ?? null,
+    });
+    return { body, event, eventHash, keyEpoch, manifest, manifestHash, state };
+}
+function speculativeSafeRekeyInput(input) {
+    return isSpeculativeContainerWriterProjection(input.previousProjection)
+        ? { ...input, persistVerificationCheckpoints: false }
+        : input;
+}
+async function collectRekeyPrincipalPolicies(input, resolveUserKey) {
+    const previousPolicies = await collectContainerRevokePrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        previousProjection: input.previousProjection,
+        principalPolicyCache: input.principalPolicyCache,
+        resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    const principalPolicies = refreshedPrincipalPolicies({
+        previousPolicies,
+        replacementPrincipalPolicy: input.replacementPrincipalPolicy,
+    });
+    assertContainerAuthorAccess({
+        author: input.author,
+        projection: input.previousProjection,
+        principalPolicies,
+        minimumAccess: "write",
+    });
+    return principalPolicies;
+}
+export async function buildMaterializedContainerRekeyPlan(input) {
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container rekey");
+    const planningInput = speculativeSafeRekeyInput(input);
+    const containerKey = crypto.getRandomValues(new Uint8Array(32));
+    const { parentKek, parentPublicKey, predecessorContainerKey, previousState, target, } = await resolveRotationContext(planningInput, "rekey");
+    const { containerKeyEpochId, keyring, predecessorBridge } = await buildRekeyRotationArtifacts({
+        containerKey,
+        keyringEntriesOverride: input.keyringEntriesOverride,
+        nextContainerKeyEpoch: target.kek.containerKeyEpoch + 1,
+        predecessorContainerKey,
+        previousContainerId: previousState.containerId,
+        target,
+    });
+    const principalPolicies = await collectRekeyPrincipalPolicies(planningInput, resolveProjectionUserKey);
+    const referencedPrincipalHeads = refreshedPrincipalReferences({
+        previousState,
+        replacementPrincipalPolicy: input.replacementPrincipalPolicy,
+    });
+    const { body, event, eventHash, keyEpoch, manifest, manifestHash, state } = await deriveRekeyManifestArtifacts({
+        containerKey,
+        author: input.author,
+        containerKeyEpochId,
+        eventId: input.eventId,
+        keyring,
+        parentKek,
+        predecessorBridge,
+        previousProjection: input.previousProjection,
+        previousState,
+        referencedPrincipalHeads,
+        signedAt: input.signedAt,
+        target,
+    });
+    const { userRecipientKeys, wraps } = await buildContainerRotationWraps({
+        containerKey,
+        containerKeyEpochId,
+        manifestHash,
+        operationLabel: "Container rekey",
+        parentKek,
+        parentPublicKey,
+        principalPolicies,
+        resolveUserKey: resolveProjectionUserKey,
+        state,
+    });
+    const plan = buildContainerRekeyPlan({
+        body,
+        containerId: previousState.containerId,
+        containerKeyEpochId,
+        event,
+        eventHash,
+        keyEpoch,
+        keyring,
+        manifest,
+        manifestHash,
+        parentKek,
+        predecessorBridge,
+        previousManifest: asContainerManifestBundle(target.manifest),
+        previousProjection: input.previousProjection,
+        principalPolicies,
+        state,
+        userRecipientKeys,
+        wraps,
+    });
+    const materializedPlan = { containerKey, plan };
+    return {
+        ...materializedPlan,
+        writerProjection: await containerWriterProjectionFromRekeyPlan({
+            materializedPlan,
+            previousProjection: input.previousProjection,
+        }),
+    };
+}
+function buildContainerRekeyPlan(input) {
+    return {
+        body: input.body,
+        containerId: input.containerId,
+        containerKeyEpochId: input.containerKeyEpochId,
+        event: input.event,
+        eventHash: input.eventHash,
+        keyEpoch: input.keyEpoch,
+        keyring: input.keyring,
+        manifest: input.manifest,
+        manifestHash: input.manifestHash,
+        previousManifest: input.previousManifest,
+        request: {
+            ...containerMutationRequestCore("rekey", input),
+            ...previousPathRequestFields(input.previousManifest, input.previousProjection),
+            predecessorBridge: readCanonicalRecord(input.predecessorBridge, "Container rekey predecessor bridge"),
+            keyring: readCanonicalRecord(input.keyring, "Container rekey keyring"),
+            parentKekState: readCanonicalRecordOrNull(input.parentKek, "Container rekey parent KEK state"),
+        },
+        state: input.state,
+        userRecipientKeys: input.userRecipientKeys,
+        wraps: input.wraps,
+    };
+}
+//# sourceMappingURL=index.js.map

package/workflows/containers/child/rekey/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,yBAAyB,EAIzB,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AAMvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAIL,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAE3B,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IAOC,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,WAAW,EAAE,KAAK,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,KAAK,CAAC,YAAY;QACzC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,qDAAqD;QACrD,kCAAkC,CAChC,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;QACF,MAAM,2BAA2B,CAC/B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAwB,KAAK,CAAC,sBAAsB;QAC/D,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,sBAAsB;gBAC/B;oBACE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;oBACzD,WAAW,EAAE,KAAK,CAAC,uBAAuB;iBAC3C;aACF;YACD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC;QACJ,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;YACjD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC,CAAC;IACP,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAe3C;IACC,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,aAAa;QACtB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC;QACpC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,SAAS;QACT,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY;QACZ,yBAAyB,EAAE,KAAK,CAAC,SAAS,EAAE,mBAAmB,IAAI,IAAI;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AA2BD,SAAS,yBAAyB,CAAC,KAAqB;IACtD,OAAO,sCAAsC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACrE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE;QACrD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqB,EACrB,cAAyC;IAEzC,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;QACnD,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqB;IAErB,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACvD,MAAM,2BAA2B,CAAC;QAChC,YAAY;QACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QACvD,uBAAuB;QACvB,mBAAmB,EAAE,aAAa,CAAC,WAAW;QAC9C,MAAM;KACP,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAC3D,aAAa,EACb,wBAAwB,CACzB,CAAC;IAEF,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;QAC5D,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACvE,MAAM,4BAA4B,CAAC;QACjC,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,SAAS;QACT,iBAAiB;QACjB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,aAAa;QACb,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,iBAAiB;QACjC,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO;QACL,GAAG,gBAAgB;QACnB,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;YAC7D,gBAAgB;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAoBhC;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE;YACP,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;YAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;YACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,oCAAoC,CACrC;YACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;YACtE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;SACF;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerGrantPrincipalHead,\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerRekeyAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n  computeAccessManifestHash,\n  computeContainerKekKeyringHash,\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  deriveContainerAccessManifest,\n  deriveContainerKekWrappingPublicKey,\n  sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport {\n  buildContainerCreateKeyEpoch,\n  resolveContainerKekEpochId,\n  signContainerMutationEvent,\n} from \"../../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  type getParentKekForTarget,\n  type getTargetContainerContext,\n  type readContainerState,\n  uniqueSortedManifestHashes,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyPlan,\n  MaterializedContainerRekeyPlan,\n} from \"../../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  sealRotationKeyring,\n  verifyKeyringEntriesForSeal,\n} from \"../move/moveRotation\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"../mutationRequestCore\";\nimport {\n  resolveRotationContext,\n  type SignedRotationTarget,\n} from \"../rotation/rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"../rotation/rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"../rotation/rotationWraps\";\nimport {\n  refreshedPrincipalPolicies,\n  refreshedPrincipalReferences,\n} from \"../share/sharePlanCore\";\nimport { assertOverrideMatchesSignedLineage } from \"./keyringOverrideLineage\";\nimport {\n  containerWriterProjectionFromRekeyPlan,\n  isSpeculativeContainerWriterProjection,\n} from \"./rekeyProjection\";\n\nasync function buildRekeyRotationArtifacts(input: {\n  containerKey: Uint8Array;\n  keyringEntriesOverride: readonly ContainerKekKeyringEntry[] | undefined;\n  nextContainerKeyEpoch: number;\n  predecessorContainerKey: Uint8Array;\n  previousContainerId: string;\n  target: SignedRotationTarget;\n}): Promise<{\n  containerKeyEpochId: string;\n  keyring: ContainerKekKeyring;\n  predecessorBridge: Awaited<\n    ReturnType<typeof createContainerKekPredecessorBridge>\n  >;\n}> {\n  const containerKeyEpochId = await resolveContainerKekEpochId({\n    containerId: input.previousContainerId,\n    keyEpoch: input.nextContainerKeyEpoch,\n    keyMaterial: input.containerKey,\n  });\n  const predecessorBridge = await createContainerKekPredecessorBridge({\n    containerId: input.previousContainerId,\n    predecessorContainerKey: input.predecessorContainerKey,\n    predecessorContainerKeyEpochId: input.target.kek.containerKeyEpochId,\n    successorContainerKey: input.containerKey,\n    successorContainerKeyEpochId: containerKeyEpochId,\n  });\n  if (input.keyringEntriesOverride) {\n    // A rebuilt override still has to agree with the epochs the projection's\n    // signed history commits to; otherwise a repair could seal a forgery.\n    // Exact match first, for distinct errors; the seal check below then adds\n    // only the per-entry material check for an override.\n    assertOverrideMatchesSignedLineage(\n      input.keyringEntriesOverride,\n      input.target.signedEpochIds,\n    );\n    await verifyKeyringEntriesForSeal(\n      input.previousContainerId,\n      input.keyringEntriesOverride,\n      input.target.signedEpochIds,\n    );\n  }\n  const keyring: ContainerKekKeyring = input.keyringEntriesOverride\n    ? await sealContainerKekKeyring({\n        containerId: input.previousContainerId,\n        entries: [\n          ...input.keyringEntriesOverride,\n          {\n            containerKeyEpochId: input.target.kek.containerKeyEpochId,\n            keyMaterial: input.predecessorContainerKey,\n          },\n        ],\n        keyEpoch: input.nextContainerKeyEpoch,\n        successorContainerKey: input.containerKey,\n        successorContainerKeyEpochId: containerKeyEpochId,\n      })\n    : await sealRotationKeyring({\n        containerId: input.previousContainerId,\n        currentKek: input.target.kek,\n        currentKeyMaterial: input.predecessorContainerKey,\n        keyEpoch: input.nextContainerKeyEpoch,\n        signedEpochIds: input.target.signedEpochIds,\n        successorContainerKey: input.containerKey,\n        successorContainerKeyEpochId: containerKeyEpochId,\n      });\n  return { containerKeyEpochId, keyring, predecessorBridge };\n}\n\nasync function deriveRekeyManifestArtifacts(input: {\n  containerKey: Uint8Array;\n  author: ContainerMutationAuthor;\n  containerKeyEpochId: string;\n  eventId: string | undefined;\n  keyring: ContainerKekKeyring;\n  parentKek: ReturnType<typeof getParentKekForTarget>;\n  predecessorBridge: Awaited<\n    ReturnType<typeof createContainerKekPredecessorBridge>\n  >;\n  previousProjection: ContainerWriterProjectionResponse;\n  previousState: ReturnType<typeof readContainerState>;\n  referencedPrincipalHeads: readonly ContainerGrantPrincipalHead[];\n  signedAt: string | undefined;\n  target: ReturnType<typeof getTargetContainerContext>;\n}) {\n  const body: ContainerRekeyAccessEventBody = {\n    eventType: \"container.rekey\",\n    parentManifestHash:\n      input.previousProjection.path.at(-2)?.manifestHash ?? null,\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: input.previousState.containerId,\n      keyMaterial: input.containerKey,\n    }),\n    containerKeyEpochId: input.containerKeyEpochId,\n    keyringHash: await computeContainerKekKeyringHash(input.keyring),\n    predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n      input.predecessorBridge,\n    ),\n    referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: input.previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.target.manifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const state = {\n    ...input.previousState,\n    parentManifestHash: body.parentManifestHash,\n    containerKeyPublicKey: body.containerKeyPublicKey,\n    epoch: input.previousState.epoch + 1,\n    previousManifestHash: input.target.manifest.manifestHash,\n    eventHash,\n    containerKeyEpochId: input.containerKeyEpochId,\n    referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: input.previousState.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventHash,\n    keyEpoch: input.target.kek.containerKeyEpoch + 1,\n    manifestHash,\n    parentContainerKeyEpochId: input.parentKek?.containerKeyEpochId ?? null,\n  });\n  return { body, event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\n/**\n * An explicit container KEK rotation with no membership change. Doubles as\n * the repair operation: passing `keyringEntriesOverride` seals a keyring\n * rebuilt from the bridge log instead of re-opening the served one, so a\n * poisoned snapshot is replaced by ground truth.\n */\ninterface RekeyPlanInput {\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;\n  /** Keys a batch minted above this container and has yet to commit. */\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  /** Verified policies the path may cite before they are stored locally. */\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nfunction speculativeSafeRekeyInput(input: RekeyPlanInput): RekeyPlanInput {\n  return isSpeculativeContainerWriterProjection(input.previousProjection)\n    ? { ...input, persistVerificationCheckpoints: false }\n    : input;\n}\n\nasync function collectRekeyPrincipalPolicies(\n  input: RekeyPlanInput,\n  resolveUserKey: ProjectionUserKeyResolver,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const previousPolicies = await collectContainerRevokePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    previousProjection: input.previousProjection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const principalPolicies = refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"write\",\n  });\n  return principalPolicies;\n}\n\nexport async function buildMaterializedContainerRekeyPlan(\n  input: RekeyPlanInput,\n): Promise<MaterializedContainerRekeyPlan> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container rekey\",\n  );\n  const planningInput = speculativeSafeRekeyInput(input);\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  } = await resolveRotationContext(planningInput, \"rekey\");\n  const { containerKeyEpochId, keyring, predecessorBridge } =\n    await buildRekeyRotationArtifacts({\n      containerKey,\n      keyringEntriesOverride: input.keyringEntriesOverride,\n      nextContainerKeyEpoch: target.kek.containerKeyEpoch + 1,\n      predecessorContainerKey,\n      previousContainerId: previousState.containerId,\n      target,\n    });\n  const principalPolicies = await collectRekeyPrincipalPolicies(\n    planningInput,\n    resolveProjectionUserKey,\n  );\n\n  const referencedPrincipalHeads = refreshedPrincipalReferences({\n    previousState,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n  });\n  const { body, event, eventHash, keyEpoch, manifest, manifestHash, state } =\n    await deriveRekeyManifestArtifacts({\n      containerKey,\n      author: input.author,\n      containerKeyEpochId,\n      eventId: input.eventId,\n      keyring,\n      parentKek,\n      predecessorBridge,\n      previousProjection: input.previousProjection,\n      previousState,\n      referencedPrincipalHeads,\n      signedAt: input.signedAt,\n      target,\n    });\n  const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n    containerKey,\n    containerKeyEpochId,\n    manifestHash,\n    operationLabel: \"Container rekey\",\n    parentKek,\n    parentPublicKey,\n    principalPolicies,\n    resolveUserKey: resolveProjectionUserKey,\n    state,\n  });\n\n  const plan = buildContainerRekeyPlan({\n    body,\n    containerId: previousState.containerId,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyring,\n    manifest,\n    manifestHash,\n    parentKek,\n    predecessorBridge,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies,\n    state,\n    userRecipientKeys,\n    wraps,\n  });\n  const materializedPlan = { containerKey, plan };\n  return {\n    ...materializedPlan,\n    writerProjection: await containerWriterProjectionFromRekeyPlan({\n      materializedPlan,\n      previousProjection: input.previousProjection,\n    }),\n  };\n}\n\nfunction buildContainerRekeyPlan(input: {\n  body: ContainerRekeyAccessEventBody;\n  containerId: string;\n  containerKeyEpochId: string;\n  event: ContainerRekeyPlan[\"event\"];\n  eventHash: string;\n  keyEpoch: ContainerRekeyPlan[\"keyEpoch\"];\n  keyring: ContainerKekKeyring;\n  manifest: ContainerRekeyPlan[\"manifest\"];\n  manifestHash: string;\n  parentKek: ReturnType<typeof getParentKekForTarget>;\n  predecessorBridge: Awaited<\n    ReturnType<typeof createContainerKekPredecessorBridge>\n  >;\n  previousManifest: ContainerRekeyPlan[\"previousManifest\"];\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  state: ContainerRekeyPlan[\"state\"];\n  userRecipientKeys: ContainerRekeyPlan[\"userRecipientKeys\"];\n  wraps: ContainerRekeyPlan[\"wraps\"];\n}): ContainerRekeyPlan {\n  return {\n    body: input.body,\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    event: input.event,\n    eventHash: input.eventHash,\n    keyEpoch: input.keyEpoch,\n    keyring: input.keyring,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousManifest: input.previousManifest,\n    request: {\n      ...containerMutationRequestCore(\"rekey\", input),\n      ...previousPathRequestFields(\n        input.previousManifest,\n        input.previousProjection,\n      ),\n      predecessorBridge: readCanonicalRecord(\n        input.predecessorBridge,\n        \"Container rekey predecessor bridge\",\n      ),\n      keyring: readCanonicalRecord(input.keyring, \"Container rekey keyring\"),\n      parentKekState: readCanonicalRecordOrNull(\n        input.parentKek,\n        \"Container rekey parent KEK state\",\n      ),\n    },\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n}\n"]}

package/workflows/containers/child/rekey/keyringOverrideLineage.d.ts

@@ -0,0 +1,22 @@
+import { type ContainerKekKeyringEntry } from "../../../../internal/crypto/index.js";
+/**
+ * A rebuilt keyring override that omits an epoch the container's signed
+ * lineage names. That is what a rebuild made before a concurrent rotation
+ * looks like, so it is not tampering: rebuild from the current log and retry.
+ * It is deliberately not a `KeyingVerificationError`, which callers may read
+ * as tampering, unlike an epoch outside the lineage, which no honest rebuild
+ * names.
+ */
+export declare class ContainerKeyringOverrideStaleError extends Error {
+    constructor();
+}
+/**
+ * A rebuilt keyring override is sealed forward under this device's signature,
+ * so it must name exactly the epochs the container's signed lineage commits to
+ * (#2365 finding 32). `signedEpochIds` is that lineage as the rotation's own
+ * verification walked it, wherever the projection served it: the target KEK's
+ * own served history is not enough, since a server can serve the target's
+ * older manifests under its parent's KEK, letting an invented id over
+ * server-chosen material take the real epoch's ordinal.
+ */
+export declare function assertOverrideMatchesSignedLineage(entries: readonly ContainerKekKeyringEntry[], signedEpochIds: ReadonlySet<string>): void;

package/workflows/containers/child/rekey/keyringOverrideLineage.js

@@ -0,0 +1,39 @@
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+const LABEL = "Container rekey keyring override";
+/**
+ * A rebuilt keyring override that omits an epoch the container's signed
+ * lineage names. That is what a rebuild made before a concurrent rotation
+ * looks like, so it is not tampering: rebuild from the current log and retry.
+ * It is deliberately not a `KeyingVerificationError`, which callers may read
+ * as tampering, unlike an epoch outside the lineage, which no honest rebuild
+ * names.
+ */
+export class ContainerKeyringOverrideStaleError extends Error {
+    constructor() {
+        super(`${LABEL} omits an epoch the container's signed lineage names; rebuild it from the current log`);
+        this.name = "ContainerKeyringOverrideStaleError";
+    }
+}
+/**
+ * A rebuilt keyring override is sealed forward under this device's signature,
+ * so it must name exactly the epochs the container's signed lineage commits to
+ * (#2365 finding 32). `signedEpochIds` is that lineage as the rotation's own
+ * verification walked it, wherever the projection served it: the target KEK's
+ * own served history is not enough, since a server can serve the target's
+ * older manifests under its parent's KEK, letting an invented id over
+ * server-chosen material take the real epoch's ordinal.
+ */
+export function assertOverrideMatchesSignedLineage(entries, signedEpochIds) {
+    const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));
+    for (const epochId of entryIds) {
+        if (!signedEpochIds.has(epochId)) {
+            throw new KeyingVerificationError("object_mismatch", `${LABEL} names an epoch outside the container's signed lineage`);
+        }
+    }
+    for (const epochId of signedEpochIds) {
+        if (!entryIds.has(epochId)) {
+            throw new ContainerKeyringOverrideStaleError();
+        }
+    }
+}
+//# sourceMappingURL=keyringOverrideLineage.js.map

package/workflows/containers/child/rekey/rekeyProjection.d.ts

@@ -0,0 +1,46 @@
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { MaterializedContainerRekeyPlan, MaterializedContainerSharePlan } from "../../../../data/containers/shared/types.js";
+export declare function isSpeculativeContainerWriterProjection(projection: ContainerWriterProjectionResponse): boolean;
+/**
+ * What any rotation plan (rekey, revoke, move) holds in common: enough to say
+ * what its container's path entry will be once the server accepts it.
+ */
+export interface RotationPlanArtifacts {
+    readonly body: object;
+    readonly containerId: string;
+    readonly containerKeyEpochId: string;
+    readonly event: MaterializedContainerRekeyPlan["plan"]["event"];
+    readonly eventHash: string;
+    readonly keyEpoch: MaterializedContainerRekeyPlan["plan"]["keyEpoch"];
+    readonly manifest: MaterializedContainerRekeyPlan["plan"]["manifest"];
+    readonly manifestHash: string;
+    readonly previousManifest: MaterializedContainerRekeyPlan["plan"]["previousManifest"];
+    readonly keyring: MaterializedContainerRekeyPlan["plan"]["keyring"];
+    readonly state: MaterializedContainerRekeyPlan["plan"]["state"];
+    readonly wraps: MaterializedContainerRekeyPlan["plan"]["wraps"];
+}
+/**
+ * The projection a rotation will leave behind, before the server has accepted
+ * it. `ancestors` is the path above the container afterwards: unchanged for a
+ * rekey or revoke, the destination parent's path for a move.
+ */
+export declare function containerWriterProjectionFromRotationPlan(input: {
+    ancestors?: Pick<ContainerWriterProjectionResponse, "containerKeks" | "path" | "policyEvidence">;
+    plan: RotationPlanArtifacts;
+    previousProjection: ContainerWriterProjectionResponse;
+}): Promise<ContainerWriterProjectionResponse>;
+export declare function containerWriterProjectionFromRekeyPlan(input: {
+    materializedPlan: Pick<MaterializedContainerRekeyPlan, "containerKey" | "plan">;
+    previousProjection: ContainerWriterProjectionResponse;
+}): Promise<ContainerWriterProjectionResponse>;
+/**
+ * A descendant's served projection, re-rooted on rotations the server has not
+ * accepted yet: `rotated` replaces the path down to and including its own
+ * container. Null when the descendant does not sit below that container.
+ */
+export declare function rebaseContainerWriterProjection(descendant: ContainerWriterProjectionResponse, rotated: Pick<ContainerWriterProjectionResponse, "containerKeks" | "path" | "policyEvidence">): ContainerWriterProjectionResponse | null;
+/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */
+export declare function containerWriterProjectionFromSharePlan(input: {
+    plan: MaterializedContainerSharePlan["plan"];
+    previousProjection: ContainerWriterProjectionResponse;
+}): Promise<ContainerWriterProjectionResponse>;