npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.64 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1588) hide show

package/workflows/containers/child/rekey/rekeyProjection.js ADDED Viewed

@@ -0,0 +1,151 @@
+import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, } from "../../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString, readCanonicalRecord, readCanonicalRecords, } from "../../../../data/keying/canonicalJson.js";
+import { mergeProjectionPolicyEvidence } from "../../../../data/keyingProjectionVerification/principalPolicy/mergeProjectionPolicyEvidence.js";
+const speculativeProjections = new WeakSet();
+export function isSpeculativeContainerWriterProjection(projection) {
+    return speculativeProjections.has(projection);
+}
+function recipientTargets(plan) {
+    return plan.wraps
+        .map((wrap) => ({
+        recipientId: wrap.recipientId,
+        recipientKeyEpochId: wrap.recipientKeyEpochId,
+        recipientKeyFingerprint: wrap.recipientKeyFingerprint,
+        recipientKind: wrap.recipientKind,
+    }))
+        .sort((left, right) => canonicalKeyingJsonString(left, "Container rekey recipient").localeCompare(canonicalKeyingJsonString(right, "Container rekey recipient")));
+}
+/**
+ * The projection a rotation will leave behind, before the server has accepted
+ * it. `ancestors` is the path above the container afterwards: unchanged for a
+ * rekey or revoke, the destination parent's path for a move.
+ */
+export async function containerWriterProjectionFromRotationPlan(input) {
+    const { plan } = input;
+    const previousManifest = input.previousProjection.path.at(-1);
+    const previousKek = input.previousProjection.containerKeks.at(-1);
+    if (!previousManifest ||
+        !previousKek ||
+        previousManifest.manifestHash !== plan.previousManifest.manifestHash ||
+        previousKek.containerId !== plan.containerId) {
+        throw new Error("Container rekey projection predecessor mismatch");
+    }
+    const targets = recipientTargets(plan);
+    const nextManifest = {
+        event: {
+            body: readCanonicalRecord(plan.body, "Container rekey body"),
+            event: readCanonicalRecord(plan.event, "Container rekey event"),
+            eventHash: plan.eventHash,
+        },
+        manifest: readCanonicalRecord(plan.manifest, "Container rekey manifest"),
+        manifestHash: plan.manifestHash,
+        state: readCanonicalRecord(plan.state, "Container rekey state"),
+    };
+    const nextKek = {
+        accessManifestHash: plan.manifestHash,
+        containerId: plan.containerId,
+        containerKeyEpoch: plan.keyEpoch.keyEpoch,
+        containerKeyEpochId: plan.containerKeyEpochId,
+        containerManifestHistory: [
+            previousManifest,
+            ...previousKek.containerManifestHistory,
+        ],
+        keyEpoch: readCanonicalRecord(plan.keyEpoch, "Container rekey key epoch"),
+        keyEpochHash: await computeContainerKeyEpochHash(plan.keyEpoch),
+        keyring: { ...plan.keyring },
+        keyTargetHash: await computeContainerKekRecipientTargetHash(targets),
+        parentContainerKeyEpochId: plan.keyEpoch.parentContainerKeyEpochId,
+        recipientTargets: readCanonicalRecords(targets, "Container rekey recipient targets"),
+        wraps: readCanonicalRecords(plan.wraps, "Container rekey wraps"),
+    };
+    const ancestors = input.ancestors ?? {
+        containerKeks: input.previousProjection.containerKeks.slice(0, -1),
+        path: input.previousProjection.path.slice(0, -1),
+    };
+    const projection = {
+        ...input.previousProjection,
+        policyEvidence: mergeProjectionPolicyEvidence([
+            input.previousProjection.policyEvidence,
+            ...(input.ancestors ? [input.ancestors.policyEvidence] : []),
+        ]),
+        path: [...ancestors.path, nextManifest],
+        containerKeks: [...ancestors.containerKeks, nextKek],
+    };
+    speculativeProjections.add(projection);
+    return projection;
+}
+export function containerWriterProjectionFromRekeyPlan(input) {
+    return containerWriterProjectionFromRotationPlan({
+        plan: input.materializedPlan.plan,
+        previousProjection: input.previousProjection,
+    });
+}
+/**
+ * A descendant's served projection, re-rooted on rotations the server has not
+ * accepted yet: `rotated` replaces the path down to and including its own
+ * container. Null when the descendant does not sit below that container.
+ */
+export function rebaseContainerWriterProjection(descendant, rotated) {
+    const rotatedId = rotated.containerKeks.at(-1)?.containerId;
+    const index = descendant.containerKeks.findIndex((kek) => kek.containerId === rotatedId);
+    if (rotatedId === undefined || index < 0)
+        return null;
+    if (index === descendant.containerKeks.length - 1)
+        return null;
+    const projection = {
+        ...descendant,
+        policyEvidence: mergeProjectionPolicyEvidence([
+            descendant.policyEvidence,
+            rotated.policyEvidence,
+        ]),
+        path: [...rotated.path, ...descendant.path.slice(index + 1)],
+        containerKeks: [
+            ...rotated.containerKeks,
+            ...descendant.containerKeks.slice(index + 1),
+        ],
+    };
+    speculativeProjections.add(projection);
+    return projection;
+}
+/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */
+export async function containerWriterProjectionFromSharePlan(input) {
+    const { plan, previousProjection } = input;
+    const previous = previousProjection.path.at(-1);
+    const kek = previousProjection.containerKeks.at(-1);
+    if (!previous ||
+        !kek ||
+        previous.manifestHash !== plan.previousManifest.manifestHash ||
+        kek.containerId !== plan.containerId)
+        throw new Error("Container grant projection predecessor mismatch");
+    const targets = recipientTargets({ wraps: plan.wraps });
+    const projection = {
+        ...previousProjection,
+        path: [
+            ...previousProjection.path.slice(0, -1),
+            {
+                event: {
+                    body: readCanonicalRecord(plan.body, "Container grant body"),
+                    event: readCanonicalRecord(plan.event, "Container grant event"),
+                    eventHash: plan.eventHash,
+                },
+                manifest: readCanonicalRecord(plan.manifest, "Container grant manifest"),
+                manifestHash: plan.manifestHash,
+                state: readCanonicalRecord(plan.state, "Container grant state"),
+            },
+        ],
+        containerKeks: [
+            ...previousProjection.containerKeks.slice(0, -1),
+            {
+                ...kek,
+                accessManifestHash: plan.manifestHash,
+                containerManifestHistory: [previous, ...kek.containerManifestHistory],
+                keyTargetHash: await computeContainerKekRecipientTargetHash(targets),
+                recipientTargets: readCanonicalRecords(targets, "Container grant targets"),
+                wraps: readCanonicalRecords(plan.wraps, "Container grant wraps"),
+            },
+        ],
+    };
+    speculativeProjections.add(projection);
+    return projection;
+}
+//# sourceMappingURL=rekeyProjection.js.map

package/workflows/containers/child/rekey/rekeyProjection.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"rekeyProjection.js","sourceRoot":"","sources":["rekeyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,6BAA6B,EAAE,MAAM,6FAA6F,CAAC;AAE5I,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEhF,MAAM,UAAU,sCAAsC,CACpD,UAA6C;IAE7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAqBD,SAAS,gBAAgB,CACvB,IAA0C;IAE1C,OAAO,IAAI,CAAC,KAAK;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,yBAAyB,CACvB,IAAI,EACJ,2BAA2B,CAC5B,CAAC,aAAa,CACb,yBAAyB,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAC9D,CACF,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAO/D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IACE,CAAC,gBAAgB;QACjB,CAAC,WAAW;QACZ,gBAAgB,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QACpE,WAAW,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG;QACnB,KAAK,EAAE;YACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;YAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;YAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC;QACxE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KAChE,CAAC;IACF,MAAM,OAAO,GAAG;QACd,kBAAkB,EAAE,IAAI,CAAC,YAAY;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,wBAAwB,EAAE;YACxB,gBAAgB;YAChB,GAAG,WAAW,CAAC,wBAAwB;SACxC;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC;QACzE,YAAY,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/D,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;QACpE,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,yBAAyB;QAClE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,mCAAmC,CACpC;QACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KACjE,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI;QACnC,aAAa,EAAE,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;KACjD,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,KAAK,CAAC,kBAAkB;QAC3B,cAAc,EAAE,6BAA6B,CAAC;YAC5C,KAAK,CAAC,kBAAkB,CAAC,cAAc;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;QACvC,aAAa,EAAE,CAAC,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC;KACrD,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,yCAAyC,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI;QACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAA6C,EAC7C,OAGC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAC9C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CACvC,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,UAAU,GAAG;QACjB,GAAG,UAAU;QACb,cAAc,EAAE,6BAA6B,CAAC;YAC5C,UAAU,CAAC,cAAc;YACzB,OAAO,CAAC,cAAc;SACvB,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5D,aAAa,EAAE;YACb,GAAG,OAAO,CAAC,aAAa;YACxB,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAC7C;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAG5D;IACC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IACE,CAAC,QAAQ;QACT,CAAC,GAAG;QACJ,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QAC5D,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAEpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG;QACjB,GAAG,kBAAkB;QACrB,IAAI,EAAE;YACJ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD;gBACE,GAAG,GAAG;gBACN,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,wBAAwB,CAAC;gBACrE,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;gBACpE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,yBAAyB,CAC1B;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n type ContainerKekRecipientTarget,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type {\n MaterializedContainerRekeyPlan,\n MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n canonicalKeyingJsonString,\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../../data/keying/canonicalJson\";\nimport { mergeProjectionPolicyEvidence } from \"../../../../data/keyingProjectionVerification/principalPolicy/mergeProjectionPolicyEvidence\";\n\nconst speculativeProjections = new WeakSet<ContainerWriterProjectionResponse>();\n\nexport function isSpeculativeContainerWriterProjection(\n projection: ContainerWriterProjectionResponse,\n): boolean {\n return speculativeProjections.has(projection);\n}\n\n/**\n * What any rotation plan (rekey, revoke, move) holds in common: enough to say\n * what its container's path entry will be once the server accepts it.\n */\nexport interface RotationPlanArtifacts {\n readonly body: object;\n readonly containerId: string;\n readonly containerKeyEpochId: string;\n readonly event: MaterializedContainerRekeyPlan[\"plan\"][\"event\"];\n readonly eventHash: string;\n readonly keyEpoch: MaterializedContainerRekeyPlan[\"plan\"][\"keyEpoch\"];\n readonly manifest: MaterializedContainerRekeyPlan[\"plan\"][\"manifest\"];\n readonly manifestHash: string;\n readonly previousManifest: MaterializedContainerRekeyPlan[\"plan\"][\"previousManifest\"];\n readonly keyring: MaterializedContainerRekeyPlan[\"plan\"][\"keyring\"];\n readonly state: MaterializedContainerRekeyPlan[\"plan\"][\"state\"];\n readonly wraps: MaterializedContainerRekeyPlan[\"plan\"][\"wraps\"];\n}\n\nfunction recipientTargets(\n plan: Pick<RotationPlanArtifacts, \"wraps\">,\n): ContainerKekRecipientTarget[] {\n return plan.wraps\n .map((wrap) => ({\n recipientId: wrap.recipientId,\n recipientKeyEpochId: wrap.recipientKeyEpochId,\n recipientKeyFingerprint: wrap.recipientKeyFingerprint,\n recipientKind: wrap.recipientKind,\n }))\n .sort((left, right) =>\n canonicalKeyingJsonString(\n left,\n \"Container rekey recipient\",\n ).localeCompare(\n canonicalKeyingJsonString(right, \"Container rekey recipient\"),\n ),\n );\n}\n\n/**\n * The projection a rotation will leave behind, before the server has accepted\n * it. `ancestors` is the path above the container afterwards: unchanged for a\n * rekey or revoke, the destination parent's path for a move.\n */\nexport async function containerWriterProjectionFromRotationPlan(input: {\n ancestors?: Pick<\n ContainerWriterProjectionResponse,\n \"containerKeks\" | \"path\" | \"policyEvidence\"\n >;\n plan: RotationPlanArtifacts;\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n const { plan } = input;\n const previousManifest = input.previousProjection.path.at(-1);\n const previousKek = input.previousProjection.containerKeks.at(-1);\n if (\n !previousManifest ||\n !previousKek ||\n previousManifest.manifestHash !== plan.previousManifest.manifestHash ||\n previousKek.containerId !== plan.containerId\n ) {\n throw new Error(\"Container rekey projection predecessor mismatch\");\n }\n const targets = recipientTargets(plan);\n const nextManifest = {\n event: {\n body: readCanonicalRecord(plan.body, \"Container rekey body\"),\n event: readCanonicalRecord(plan.event, \"Container rekey event\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(plan.manifest, \"Container rekey manifest\"),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container rekey state\"),\n };\n const nextKek = {\n accessManifestHash: plan.manifestHash,\n containerId: plan.containerId,\n containerKeyEpoch: plan.keyEpoch.keyEpoch,\n containerKeyEpochId: plan.containerKeyEpochId,\n containerManifestHistory: [\n previousManifest,\n ...previousKek.containerManifestHistory,\n ],\n keyEpoch: readCanonicalRecord(plan.keyEpoch, \"Container rekey key epoch\"),\n keyEpochHash: await computeContainerKeyEpochHash(plan.keyEpoch),\n keyring: { ...plan.keyring },\n keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n parentContainerKeyEpochId: plan.keyEpoch.parentContainerKeyEpochId,\n recipientTargets: readCanonicalRecords(\n targets,\n \"Container rekey recipient targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container rekey wraps\"),\n };\n const ancestors = input.ancestors ?? {\n containerKeks: input.previousProjection.containerKeks.slice(0, -1),\n path: input.previousProjection.path.slice(0, -1),\n };\n const projection = {\n ...input.previousProjection,\n policyEvidence: mergeProjectionPolicyEvidence([\n input.previousProjection.policyEvidence,\n ...(input.ancestors ? [input.ancestors.policyEvidence] : []),\n ]),\n path: [...ancestors.path, nextManifest],\n containerKeks: [...ancestors.containerKeks, nextKek],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n\nexport function containerWriterProjectionFromRekeyPlan(input: {\n materializedPlan: Pick<\n MaterializedContainerRekeyPlan,\n \"containerKey\" | \"plan\"\n >;\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n return containerWriterProjectionFromRotationPlan({\n plan: input.materializedPlan.plan,\n previousProjection: input.previousProjection,\n });\n}\n\n/**\n * A descendant's served projection, re-rooted on rotations the server has not\n * accepted yet: `rotated` replaces the path down to and including its own\n * container. Null when the descendant does not sit below that container.\n */\nexport function rebaseContainerWriterProjection(\n descendant: ContainerWriterProjectionResponse,\n rotated: Pick<\n ContainerWriterProjectionResponse,\n \"containerKeks\" | \"path\" | \"policyEvidence\"\n >,\n): ContainerWriterProjectionResponse | null {\n const rotatedId = rotated.containerKeks.at(-1)?.containerId;\n const index = descendant.containerKeks.findIndex(\n (kek) => kek.containerId === rotatedId,\n );\n if (rotatedId === undefined || index < 0) return null;\n if (index === descendant.containerKeks.length - 1) return null;\n const projection = {\n ...descendant,\n policyEvidence: mergeProjectionPolicyEvidence([\n descendant.policyEvidence,\n rotated.policyEvidence,\n ]),\n path: [...rotated.path, ...descendant.path.slice(index + 1)],\n containerKeks: [\n ...rotated.containerKeks,\n ...descendant.containerKeks.slice(index + 1),\n ],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n\n/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */\nexport async function containerWriterProjectionFromSharePlan(input: {\n plan: MaterializedContainerSharePlan[\"plan\"];\n previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n const { plan, previousProjection } = input;\n const previous = previousProjection.path.at(-1);\n const kek = previousProjection.containerKeks.at(-1);\n if (\n !previous ||\n !kek ||\n previous.manifestHash !== plan.previousManifest.manifestHash ||\n kek.containerId !== plan.containerId\n )\n throw new Error(\"Container grant projection predecessor mismatch\");\n const targets = recipientTargets({ wraps: plan.wraps });\n const projection = {\n ...previousProjection,\n path: [\n ...previousProjection.path.slice(0, -1),\n {\n event: {\n body: readCanonicalRecord(plan.body, \"Container grant body\"),\n event: readCanonicalRecord(plan.event, \"Container grant event\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(\n plan.manifest,\n \"Container grant manifest\",\n ),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container grant state\"),\n },\n ],\n containerKeks: [\n ...previousProjection.containerKeks.slice(0, -1),\n {\n ...kek,\n accessManifestHash: plan.manifestHash,\n containerManifestHistory: [previous, ...kek.containerManifestHistory],\n keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n recipientTargets: readCanonicalRecords(\n targets,\n \"Container grant targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container grant wraps\"),\n },\n ],\n };\n speculativeProjections.add(projection);\n return projection;\n}\n"]}

package/workflows/containers/child/rekey/rekeyRemote.d.ts ADDED Viewed

@@ -0,0 +1,24 @@
+import type { ContainerKekKeyringEntry } from "../../../../internal/crypto/index.js";
+import type { ContainerRotationResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, ContainerRekeyApi, ContainerRekeyPlan } from "../../../../data/containers/shared/types.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+export declare function rekeyRemoteContainer(input: {
+    reportSecurityIncident: SecurityIncidentReporter;
+    apiClient: ContainerRekeyApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<{
+    containerKey: Uint8Array;
+    plan: ContainerRekeyPlan;
+    response: ContainerRotationResponse;
+} | null>;

package/workflows/containers/child/rekey/rekeyRemote.js ADDED Viewed

@@ -0,0 +1,64 @@
+import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "../mutationSubmit.js";
+import { buildMaterializedContainerRekeyPlan } from "./index.js";
+export async function rekeyRemoteContainer(input) {
+    const previousProjection = await input.apiClient.getContainerWriterProjection(input.containerId);
+    if (!previousProjection) {
+        return null;
+    }
+    const materializedPlan = await buildMaterializedContainerRekeyPlan({
+        author: input.author,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        keyringEntriesOverride: input.keyringEntriesOverride,
+        previousProjection,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    return submitAcknowledgedContainerMutation({
+        reportSecurityIncident: input.reportSecurityIncident,
+        recitationPolicies: [],
+        apiClient: input.apiClient,
+        author: input.author,
+        carriedRekeys: {
+            planning: {
+                apiClient: input.apiClient,
+                author: input.author,
+                execSql: input.execSql,
+                knownContainerKeks: new Map([
+                    [
+                        materializedPlan.plan.containerKeyEpochId,
+                        materializedPlan.containerKey,
+                    ],
+                ]),
+                resolveProjectionUserKey: input.resolveProjectionUserKey,
+                stillCurrent: input.stillCurrent,
+                targetSecretKey: input.targetSecretKey,
+                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+            },
+            rotated: async () => materializedPlan.writerProjection,
+        },
+        containerKey: materializedPlan.containerKey,
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+        submit: (carried) => {
+            const request = carried.length
+                ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }
+                : materializedPlan.plan.request;
+            const options = {
+                expectedPaymentRequiredOrganizationId: input.author.organizationId,
+            };
+            const { rekeyContainerResult } = input.apiClient;
+            return submitContainerRotation({
+                plain: () => input.apiClient.rekeyContainer(input.containerId, request, options),
+                result: rekeyContainerResult
+                    ? () => rekeyContainerResult.call(input.apiClient, input.containerId, request, { ...options, reportErrors: false })
+                    : undefined,
+            });
+        },
+    });
+}
+//# sourceMappingURL=rekeyRemote.js.map

package/workflows/containers/child/rekey/rekeyRemote.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"rekeyRemote.js","sourceRoot":"","sources":["rekeyRemote.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAa1C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,mCAAmC,CAAC;QACjE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB;QAClB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,gBAAgB;SACvD;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YACjD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACrE,MAAM,EAAE,oBAAoB;oBAC1B,CAAC,CAAC,GAAG,EAAE,CACH,oBAAoB,CAAC,IAAI,CACvB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerKekKeyringEntry } from \"@tearleads/crypto\";\nimport type { ContainerRotationResponse } from \"@tearleads/validators/response\";\nimport type {\n ContainerMutationAuthor,\n ContainerRekeyApi,\n ContainerRekeyPlan,\n} from \"../../../../data/containers/shared/types\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"../mutationSubmit\";\nimport { buildMaterializedContainerRekeyPlan } from \"./index\";\n\nexport async function rekeyRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerRekeyApi;\n author: ContainerMutationAuthor;\n containerId: string;\n eventId?: string | undefined;\n execSql: ExecSql;\n keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string | undefined;\n stillCurrent?: (() => boolean) | undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerRekeyPlan;\n response: ContainerRotationResponse;\n} | null> {\n const previousProjection = await input.apiClient.getContainerWriterProjection(\n input.containerId,\n );\n if (!previousProjection) {\n return null;\n }\n\n const materializedPlan = await buildMaterializedContainerRekeyPlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n keyringEntriesOverride: input.keyringEntriesOverride,\n previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: async () => materializedPlan.writerProjection,\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { rekeyContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.rekeyContainer(input.containerId, request, options),\n result: rekeyContainerResult\n ? () =>\n rekeyContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}

package/workflows/containers/child/revoke.js CHANGED Viewed

@@ -4,14 +4,14 @@ import { buildContainerCreateKeyEpoch, signContainerMutationEvent, } from "../..
 import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
 import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
 import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
-import { buildContainerRotationArtifacts } from "./moveRotation.js";
+import { buildContainerRotationArtifacts } from "./move/moveRotation.js";
 import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
 import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "./mutationSubmit.js";
-import { containerWriterProjectionFromRotationPlan } from "./rekeyProjection.js";
+import { containerWriterProjectionFromRotationPlan } from "./rekey/rekeyProjection.js";
 import { deriveContainerRevokeManifest, } from "./revokeManifest.js";
-import { resolveRotationContext } from "./rotationContext.js";
-import { collectContainerRevokePrincipalPolicies } from "./rotationPrincipalPolicies.js";
-import { buildContainerRotationWraps } from "./rotationWraps.js";
+import { resolveRotationContext } from "./rotation/rotationContext.js";
+import { collectContainerRevokePrincipalPolicies } from "./rotation/rotationPrincipalPolicies.js";
+import { buildContainerRotationWraps } from "./rotation/rotationWraps.js";
 function buildContainerRevokeRequest(input) {
     return {
         ...containerMutationRequestCore("revoke", input),

package/workflows/containers/child/revoke.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"revoke.js","sourceRoot":"","sources":["revoke.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEL,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,SAAS,2BAA2B,CAAC,KAcpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC;QAChD,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,qCAAqC,CACtC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACvE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAmBvC;IACC,MAAM,IAAI,GAAwB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,gKAAgK;AAChK,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAkB1D;IACC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,MAAM,uCAAuC,CAAC;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACrE,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,kBAAkB,EAAE,uBAAuB;QAC3C,QAAQ,EAAE,qBAAqB;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACL,MAAM,IAAI,GAAmC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,mBAAmB;QACnB,WAAW,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;QAC1D,qBAAqB,EACnB,MAAM,wCAAwC,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,mBAAmB;QACnB,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,qBAAqB;QAC/B,YAAY;QACZ,yBAAyB,EAAE,SAAS,EAAE,mBAAmB,IAAI,IAAI;KAClE,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IACE,0BAA0B;QAC1B,CAAC,0BAA0B,CAAC,aAAa;YACvC,KAAK,CAAC,cAAc,CAAC,WAAW;YAChC,0BAA0B,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,wBAAwB,GAAG,0BAA0B;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CACtB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;YACjE,MAAM,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW,CAChE;QACH,CAAC,CAAC,iBAAiB,CAAC;IACtB,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,kBAAkB;QAClC,SAAS;QACT,eAAe;QACf,iBAAiB,EAAE,wBAAwB;QAC3C,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;QACpC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY;QACZ,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,wBAAwB;QAC3C,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAa3C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAClD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACtE,MAAM,EAAE,qBAAqB;oBAC3B,CAAC,CAAC,GAAG,EAAE,CACH,qBAAqB,CAAC,IAAI,CACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerRotationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n buildContainerCreateKeyEpoch,\n signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n asContainerManifestBundle,\n uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerMutationAuthor,\n ContainerRevokeApi,\n ContainerRevokePlan,\n MaterializedContainerRevokePlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekeyProjection\";\nimport {\n type ContainerRevokeSubject,\n deriveContainerRevokeManifest,\n} from \"./revokeManifest\";\nimport { resolveRotationContext } from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\n\nfunction buildContainerRevokeRequest(input: {\n body: ContainerRevokeAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"revoke\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container revoke predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container revoke keyring\"),\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container revoke parent KEK state\",\n ),\n };\n}\n\nfunction buildContainerRevokePlanResult(input: {\n body: ContainerRevokeAccessEventBody;\n containerId: string;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n event: AccessEvent;\n eventHash: string;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerAccessManifestState;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerRevokePlan {\n const plan: ContainerRevokePlan = {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: buildContainerRevokeRequest({\n body: input.body,\n event: input.event,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n parentKek: input.parentKek,\n predecessorBridge: input.predecessorBridge,\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\n// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.\nexport async function buildMaterializedContainerRevokePlan(input: {\n author: ContainerMutationAuthor;\n eventId?: string \| undefined;\n execSql: ExecSql;\n /** Keys a batch minted above this container and has yet to commit. /\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n /* False for a projection re-rooted on rotations not yet acknowledged. /\n persistVerificationCheckpoints?: boolean \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /* Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<MaterializedContainerRevokePlan> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container revoke\",\n );\n const {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n } = await resolveRotationContext(input, \"revoke\");\n const principalPolicies = await collectContainerRevokePrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n previousProjection: input.previousProjection,\n principalPolicyCache: input.principalPolicyCache,\n resolveUserKey: resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"admin\",\n });\n const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;\n const { containerKey, containerKeyEpochId, keyring, predecessorBridge } =\n await buildContainerRotationArtifacts({\n containerId: previousState.containerId,\n currentKek: target.kek,\n currentKeyMaterial: predecessorContainerKey,\n keyEpoch: nextContainerKeyEpoch,\n signedEpochIds: target.signedEpochIds,\n });\n const body: ContainerRevokeAccessEventBody = {\n eventType: \"container.revoke\",\n parentManifestHash:\n input.previousProjection.path.at(-2)?.manifestHash ?? null,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: previousState.containerId,\n keyMaterial: containerKey,\n }),\n containerKeyEpochId,\n keyringHash: await computeContainerKekKeyringHash(keyring),\n predecessorBridgeHash:\n await computeContainerKekPredecessorBridgeHash(predecessorBridge),\n subjectId: input.revokedSubject.subjectId,\n subjectType: input.revokedSubject.subjectType,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previousState.containerId,\n dependencyManifestHashes: uniqueSortedManifestHashes(\n input.previousProjection.path,\n ),\n eventId: input.eventId ?? crypto.randomUUID(),\n previousManifestHash: target.manifest.manifestHash,\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const { manifest, manifestHash, state } = await deriveContainerRevokeManifest(\n {\n containerKeyPublicKey: body.containerKeyPublicKey,\n parentManifestHash: body.parentManifestHash,\n containerKeyEpochId,\n eventHash,\n previousManifest: target.manifest,\n revokedSubject: input.revokedSubject,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: previousState.containerId,\n containerKeyEpochId,\n eventHash,\n keyEpoch: nextContainerKeyEpoch,\n manifestHash,\n parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,\n });\n\n const replacementPrincipalPolicy = input.replacementPrincipalPolicy;\n if (\n replacementPrincipalPolicy &&\n (replacementPrincipalPolicy.principalType !==\n input.revokedSubject.subjectType \|\|\n replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)\n ) {\n throw new Error(\"Container revoke replacement principal does not match\");\n }\n const currentPrincipalPolicies = replacementPrincipalPolicy\n ? principalPolicies.filter(\n (policy) =>\n policy.principalType !== replacementPrincipalPolicy.principalType \|\|\n policy.principalId !== replacementPrincipalPolicy.principalId,\n )\n : principalPolicies;\n const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n containerKey,\n containerKeyEpochId,\n manifestHash,\n operationLabel: \"Container revoke\",\n parentKek,\n parentPublicKey,\n principalPolicies: currentPrincipalPolicies,\n resolveUserKey: resolveProjectionUserKey,\n state,\n });\n\n return buildContainerRevokePlanResult({\n body,\n containerId: previousState.containerId,\n containerKey,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n parentKek,\n predecessorBridge,\n previousManifest: asContainerManifestBundle(target.manifest),\n previousProjection: input.previousProjection,\n principalPolicies: currentPrincipalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n}\n\nexport async function revokeRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerRevokeApi;\n author: ContainerMutationAuthor;\n containerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerRevokePlan;\n response: ContainerRotationResponse;\n} \| null> {\n const previousProjection = await input.apiClient.getContainerWriterProjection(\n input.containerId,\n );\n if (!previousProjection) {\n return null;\n }\n\n const materializedPlan = await buildMaterializedContainerRevokePlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n previousProjection,\n revokedSubject: input.revokedSubject,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: () =>\n containerWriterProjectionFromRotationPlan({\n plan: materializedPlan.plan,\n previousProjection,\n }),\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { revokeContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.revokeContainer(input.containerId, request, options),\n result: revokeContainerResult\n ? () =>\n revokeContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}
1	+ {"version":3,"file":"revoke.js","sourceRoot":"","sources":["revoke.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAIpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yCAAyC,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAEvE,SAAS,2BAA2B,CAAC,KAcpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC;QAChD,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,qCAAqC,CACtC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACvE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAmBvC;IACC,MAAM,IAAI,GAAwB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,gKAAgK;AAChK,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAkB1D;IACC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,MAAM,uCAAuC,CAAC;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACrE,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,MAAM,CAAC,GAAG;QACtB,kBAAkB,EAAE,uBAAuB;QAC3C,QAAQ,EAAE,qBAAqB;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACL,MAAM,IAAI,GAAmC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,mBAAmB;QACnB,WAAW,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;QAC1D,qBAAqB,EACnB,MAAM,wCAAwC,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS;QACzC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,mBAAmB;QACnB,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,SAAS;QACT,QAAQ,EAAE,qBAAqB;QAC/B,YAAY;QACZ,yBAAyB,EAAE,SAAS,EAAE,mBAAmB,IAAI,IAAI;KAClE,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACpE,IACE,0BAA0B;QAC1B,CAAC,0BAA0B,CAAC,aAAa;YACvC,KAAK,CAAC,cAAc,CAAC,WAAW;YAChC,0BAA0B,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,wBAAwB,GAAG,0BAA0B;QACzD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CACtB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;YACjE,MAAM,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW,CAChE;QACH,CAAC,CAAC,iBAAiB,CAAC;IACtB,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,kBAAkB;QAClC,SAAS;QACT,eAAe;QACf,iBAAiB,EAAE,wBAAwB;QAC3C,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;QACpC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY;QACZ,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,wBAAwB;QAC3C,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAa3C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAClD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACtE,MAAM,EAAE,qBAAqB;oBAC3B,CAAC,CAAC,GAAG,EAAE,CACH,qBAAqB,CAAC,IAAI,CACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerRotationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n buildContainerCreateKeyEpoch,\n signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n asContainerManifestBundle,\n uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerMutationAuthor,\n ContainerRevokeApi,\n ContainerRevokePlan,\n MaterializedContainerRevokePlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationArtifacts } from \"./move/moveRotation\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"./rekey/rekeyProjection\";\nimport {\n type ContainerRevokeSubject,\n deriveContainerRevokeManifest,\n} from \"./revokeManifest\";\nimport { resolveRotationContext } from \"./rotation/rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotation/rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotation/rotationWraps\";\n\nfunction buildContainerRevokeRequest(input: {\n body: ContainerRevokeAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"revoke\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container revoke predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container revoke keyring\"),\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container revoke parent KEK state\",\n ),\n };\n}\n\nfunction buildContainerRevokePlanResult(input: {\n body: ContainerRevokeAccessEventBody;\n containerId: string;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n event: AccessEvent;\n eventHash: string;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n predecessorBridge: ContainerKekPredecessorBridge;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerAccessManifestState;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerRevokePlan {\n const plan: ContainerRevokePlan = {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: buildContainerRevokeRequest({\n body: input.body,\n event: input.event,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n parentKek: input.parentKek,\n predecessorBridge: input.predecessorBridge,\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\n// biome-ignore lint/complexity/noExcessiveLinesPerFunction: Revoke planning has to keep the manifest, KEK, wraps, and signed event in one auditable transition.\nexport async function buildMaterializedContainerRevokePlan(input: {\n author: ContainerMutationAuthor;\n eventId?: string \| undefined;\n execSql: ExecSql;\n /** Keys a batch minted above this container and has yet to commit. /\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> \| undefined;\n /* False for a projection re-rooted on rotations not yet acknowledged. /\n persistVerificationCheckpoints?: boolean \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /* Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<MaterializedContainerRevokePlan> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container revoke\",\n );\n const {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n } = await resolveRotationContext(input, \"revoke\");\n const principalPolicies = await collectContainerRevokePrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n previousProjection: input.previousProjection,\n principalPolicyCache: input.principalPolicyCache,\n resolveUserKey: resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"admin\",\n });\n const nextContainerKeyEpoch = target.kek.containerKeyEpoch + 1;\n const { containerKey, containerKeyEpochId, keyring, predecessorBridge } =\n await buildContainerRotationArtifacts({\n containerId: previousState.containerId,\n currentKek: target.kek,\n currentKeyMaterial: predecessorContainerKey,\n keyEpoch: nextContainerKeyEpoch,\n signedEpochIds: target.signedEpochIds,\n });\n const body: ContainerRevokeAccessEventBody = {\n eventType: \"container.revoke\",\n parentManifestHash:\n input.previousProjection.path.at(-2)?.manifestHash ?? null,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: previousState.containerId,\n keyMaterial: containerKey,\n }),\n containerKeyEpochId,\n keyringHash: await computeContainerKekKeyringHash(keyring),\n predecessorBridgeHash:\n await computeContainerKekPredecessorBridgeHash(predecessorBridge),\n subjectId: input.revokedSubject.subjectId,\n subjectType: input.revokedSubject.subjectType,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previousState.containerId,\n dependencyManifestHashes: uniqueSortedManifestHashes(\n input.previousProjection.path,\n ),\n eventId: input.eventId ?? crypto.randomUUID(),\n previousManifestHash: target.manifest.manifestHash,\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const { manifest, manifestHash, state } = await deriveContainerRevokeManifest(\n {\n containerKeyPublicKey: body.containerKeyPublicKey,\n parentManifestHash: body.parentManifestHash,\n containerKeyEpochId,\n eventHash,\n previousManifest: target.manifest,\n revokedSubject: input.revokedSubject,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: previousState.containerId,\n containerKeyEpochId,\n eventHash,\n keyEpoch: nextContainerKeyEpoch,\n manifestHash,\n parentContainerKeyEpochId: parentKek?.containerKeyEpochId ?? null,\n });\n\n const replacementPrincipalPolicy = input.replacementPrincipalPolicy;\n if (\n replacementPrincipalPolicy &&\n (replacementPrincipalPolicy.principalType !==\n input.revokedSubject.subjectType \|\|\n replacementPrincipalPolicy.principalId !== input.revokedSubject.subjectId)\n ) {\n throw new Error(\"Container revoke replacement principal does not match\");\n }\n const currentPrincipalPolicies = replacementPrincipalPolicy\n ? principalPolicies.filter(\n (policy) =>\n policy.principalType !== replacementPrincipalPolicy.principalType \|\|\n policy.principalId !== replacementPrincipalPolicy.principalId,\n )\n : principalPolicies;\n const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n containerKey,\n containerKeyEpochId,\n manifestHash,\n operationLabel: \"Container revoke\",\n parentKek,\n parentPublicKey,\n principalPolicies: currentPrincipalPolicies,\n resolveUserKey: resolveProjectionUserKey,\n state,\n });\n\n return buildContainerRevokePlanResult({\n body,\n containerId: previousState.containerId,\n containerKey,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n parentKek,\n predecessorBridge,\n previousManifest: asContainerManifestBundle(target.manifest),\n previousProjection: input.previousProjection,\n principalPolicies: currentPrincipalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n}\n\nexport async function revokeRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerRevokeApi;\n author: ContainerMutationAuthor;\n containerId: string;\n eventId?: string \| undefined;\n execSql: ExecSql;\n revokedSubject: ContainerRevokeSubject;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerRevokePlan;\n response: ContainerRotationResponse;\n} \| null> {\n const previousProjection = await input.apiClient.getContainerWriterProjection(\n input.containerId,\n );\n if (!previousProjection) {\n return null;\n }\n\n const materializedPlan = await buildMaterializedContainerRevokePlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n previousProjection,\n revokedSubject: input.revokedSubject,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: () =>\n containerWriterProjectionFromRotationPlan({\n plan: materializedPlan.plan,\n previousProjection,\n }),\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { revokeContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.revokeContainer(input.containerId, request, options),\n result: revokeContainerResult\n ? () =>\n revokeContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}

package/workflows/containers/child/rotation/replacementPrincipalPolicyReferences.js ADDED Viewed

@@ -0,0 +1,19 @@
+import { readContainerState } from "../../../../data/containers/shared/projection.js";
+import { dedupeReferencedPrincipalStates, referencedPrincipalPolicyKey, } from "../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
+/** Current membership with only the historical group citations this path uses. */
+export async function selectReplacementPrincipalPolicyReferences(input) {
+    if (!("retainedHistory" in input.policy) ||
+        !input.resolveAuthoredPolicyReferences)
+        return input.policy;
+    const references = dedupeReferencedPrincipalStates(input.projection.path
+        .flatMap((manifest) => readContainerState(manifest).referencedPrincipalHeads)
+        .filter((reference) => reference.principalType === input.policy.principalType &&
+        reference.principalId === input.policy.principalId));
+    const selected = await input.resolveAuthoredPolicyReferences(input.policy, references);
+    // Planning is sequential: each path selects its own citations before use.
+    // Only speculative successor citations use this cache entry. Served historical
+    // references still resolve to acknowledged policies and cannot pin our new head.
+    input.principalPolicyCache?.set(referencedPrincipalPolicyKey(selected.state), selected);
+    return selected;
+}
+//# sourceMappingURL=replacementPrincipalPolicyReferences.js.map

package/workflows/containers/child/rotation/replacementPrincipalPolicyReferences.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"replacementPrincipalPolicyReferences.js","sourceRoot":"","sources":["replacementPrincipalPolicyReferences.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAEnF,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,oFAAoF,CAAC;AAI5F,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAOhE;IACC,IACE,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM,CAAC;QACpC,CAAC,KAAK,CAAC,+BAA+B;QAEtC,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,+BAA+B,CAChD,KAAK,CAAC,UAAU,CAAC,IAAI;SAClB,OAAO,CACN,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,wBAAwB,CACpE;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,MAAM,CAAC,aAAa;QACtD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CACrD,CACJ,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+BAA+B,CAC1D,KAAK,CAAC,MAAM,EACZ,UAAU,CACX,CAAC;IACF,0EAA0E;IAC1E,+EAA+E;IAC/E,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAC7B,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5C,QAAQ,CACT,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { readContainerState } from \"../../../../data/containers/shared/projection\";\nimport type { PrincipalPolicyCache } from \"../../../../data/keyingProjectionVerification\";\nimport {\n dedupeReferencedPrincipalStates,\n referencedPrincipalPolicyKey,\n} from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\n\n/** Current membership with only the historical group citations this path uses. */\nexport async function selectReplacementPrincipalPolicyReferences(input: {\n readonly policy: PrincipalPolicyCurrentEvidence;\n readonly projection: ContainerWriterProjectionResponse;\n readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n readonly resolveAuthoredPolicyReferences?:\n | CurrentPolicyReferenceResolver\n | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n if (\n !(\"retainedHistory\" in input.policy) ||\n !input.resolveAuthoredPolicyReferences\n )\n return input.policy;\n const references = dedupeReferencedPrincipalStates(\n input.projection.path\n .flatMap(\n (manifest) => readContainerState(manifest).referencedPrincipalHeads,\n )\n .filter(\n (reference) =>\n reference.principalType === input.policy.principalType &&\n reference.principalId === input.policy.principalId,\n ),\n );\n const selected = await input.resolveAuthoredPolicyReferences(\n input.policy,\n references,\n );\n // Planning is sequential: each path selects its own citations before use.\n // Only speculative successor citations use this cache entry. Served historical\n // references still resolve to acknowledged policies and cannot pin our new head.\n input.principalPolicyCache?.set(\n referencedPrincipalPolicyKey(selected.state),\n selected,\n );\n return selected;\n}\n"]}

package/workflows/containers/child/rotation/rotationContext.js ADDED Viewed

@@ -0,0 +1,64 @@
+import { getParentKekForTarget, getParentWrappingPublicKey, getTargetContainerContext, readContainerState, } from "../../../../data/containers/shared/projection.js";
+import { assertContainerKekPathCurrent } from "../../../../data/documents/shared/containerKekCurrency.js";
+import { signedHistoryEpochIds } from "../../../../data/documents/shared/containerKekPathHistory.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../../data/documents/shared/types.js";
+/**
+ * The projection's target with its signed lineage ids, read from the manifests
+ * this rotation's own verification recorded. Every rotation that re-seals a
+ * keyring builds its target here, so none can skip the anchor.
+ */
+export function signedRotationTarget(projection, verifiedByHash) {
+    const target = getTargetContainerContext(projection);
+    return {
+        ...target,
+        signedEpochIds: signedHistoryEpochIds({
+            headManifestHash: target.manifest.manifestHash,
+            kek: target.kek,
+            verifiedByHash,
+        }),
+    };
+}
+export function requireUnwrappedKek(keksByEpochId, kek, label) {
+    const keyMaterial = keksByEpochId.get(kek.containerKeyEpochId);
+    if (!keyMaterial) {
+        throw new Error(`${label} KEK could not be unwrapped`);
+    }
+    return keyMaterial;
+}
+/**
+ * The shared rotation prologue for rekey and revoke: unwrap the projection's
+ * KEK path, require the predecessor key, check the author's organization, and
+ * surface the authenticated parent public key when one exists.
+ */
+export async function resolveRotationContext(input, operationLabel) {
+    // The target may need repair, but wrapping its successor requires a current parent prefix.
+    assertContainerKekPathCurrent(input.previousProjection.containerKeks.slice(0, -1));
+    const verifiedByHash = new Map();
+    const keksByEpochId = await unwrapContainerKekPath({
+        execSql: input.execSql,
+        knownContainerKeks: input.knownContainerKeks,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        secretKey: input.targetSecretKey,
+        verifiedByHash,
+        ...projectionVerificationOptions(input),
+    });
+    const target = signedRotationTarget(input.previousProjection, verifiedByHash);
+    const predecessorContainerKey = requireUnwrappedKek(keksByEpochId, target.kek, `Container ${operationLabel} predecessor`);
+    const previousState = readContainerState(target.manifest);
+    if (previousState.organizationId !== input.author.organizationId) {
+        throw new Error(`Container ${operationLabel} author organization mismatch`);
+    }
+    const parentKek = getParentKekForTarget(input.previousProjection);
+    const parentPublicKey = getParentWrappingPublicKey(input.previousProjection);
+    return {
+        parentKek,
+        parentPublicKey,
+        predecessorContainerKey,
+        previousState,
+        target,
+    };
+}
+//# sourceMappingURL=rotationContext.js.map

package/workflows/containers/child/rotation/rotationContext.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"rotationContext.js","sourceRoot":"","sources":["rotationContext.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAiBxF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA6C,EAC7C,cAAoE;IAEpE,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,qBAAqB,CAAC;YACpC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,cAAc;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,aAA8C,EAC9C,GAAsD,EACtD,KAAa;IAEb,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAkBC,EACD,cAAsB;IAQtB,2FAA2F;IAC3F,6BAA6B,CAC3B,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,uBAAuB,GAAG,mBAAmB,CACjD,aAAa,EACb,MAAM,CAAC,GAAG,EACV,aAAa,cAAc,cAAc,CAC1C,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,aAAa,cAAc,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7E,OAAO;QACL,SAAS;QACT,eAAe;QACf,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n getParentKekForTarget,\n getParentWrappingPublicKey,\n getTargetContainerContext,\n readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../../data/documents/shared/containerKekCurrency\";\nimport { signedHistoryEpochIds } from \"../../../../data/documents/shared/containerKekPathHistory\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../../data/documents/shared/types\";\nimport type {\n PrincipalPolicyCache,\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\n\n/**\n * A rotation's target container, with the epoch ids its verified lineage\n * names wherever the projection served it; the re-sealed keyring is anchored\n * to them (#2365 finding 32).\n */\nexport type SignedRotationTarget = ReturnType<\n typeof getTargetContainerContext\n> & { readonly signedEpochIds: ReadonlySet<string> };\n\n/**\n * The projection's target with its signed lineage ids, read from the manifests\n * this rotation's own verification recorded. Every rotation that re-seals a\n * keyring builds its target here, so none can skip the anchor.\n */\nexport function signedRotationTarget(\n projection: ContainerWriterProjectionResponse,\n verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): SignedRotationTarget {\n const target = getTargetContainerContext(projection);\n return {\n ...target,\n signedEpochIds: signedHistoryEpochIds({\n headManifestHash: target.manifest.manifestHash,\n kek: target.kek,\n verifiedByHash,\n }),\n };\n}\n\nexport function requireUnwrappedKek(\n keksByEpochId: ReadonlyMap<string, Uint8Array>,\n kek: Pick<ContainerKekResponse, \"containerKeyEpochId\">,\n label: string,\n): Uint8Array {\n const keyMaterial = keksByEpochId.get(kek.containerKeyEpochId);\n if (!keyMaterial) {\n throw new Error(`${label} KEK could not be unwrapped`);\n }\n return keyMaterial;\n}\n\n/**\n * The shared rotation prologue for rekey and revoke: unwrap the projection's\n * KEK path, require the predecessor key, check the author's organization, and\n * surface the authenticated parent public key when one exists.\n */\nexport async function resolveRotationContext(\n input: {\n author: ContainerMutationAuthor;\n execSql: ExecSql;\n /**\n * Keys of epochs the projection names that no wrap on it opens for this\n * signer yet: the ones a batch minted above and has not committed.\n */\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n persistVerificationCheckpoints?: boolean | undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /** Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache | undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) | undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?:\n | ReferencedPrincipalPolicyWarmer\n | undefined;\n },\n operationLabel: string,\n): Promise<{\n parentKek: ReturnType<typeof getParentKekForTarget>;\n parentPublicKey: string | null;\n predecessorContainerKey: Uint8Array;\n previousState: ReturnType<typeof readContainerState>;\n target: SignedRotationTarget;\n}> {\n // The target may need repair, but wrapping its successor requires a current parent prefix.\n assertContainerKekPathCurrent(\n input.previousProjection.containerKeks.slice(0, -1),\n );\n const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n const keksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n knownContainerKeks: input.knownContainerKeks,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n principalPolicyCache: input.principalPolicyCache,\n projection: input.previousProjection,\n secretKey: input.targetSecretKey,\n verifiedByHash,\n ...projectionVerificationOptions(input),\n });\n const target = signedRotationTarget(input.previousProjection, verifiedByHash);\n const predecessorContainerKey = requireUnwrappedKek(\n keksByEpochId,\n target.kek,\n `Container ${operationLabel} predecessor`,\n );\n const previousState = readContainerState(target.manifest);\n if (previousState.organizationId !== input.author.organizationId) {\n throw new Error(`Container ${operationLabel} author organization mismatch`);\n }\n\n const parentKek = getParentKekForTarget(input.previousProjection);\n const parentPublicKey = getParentWrappingPublicKey(input.previousProjection);\n return {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n };\n}\n"]}

package/workflows/containers/child/rotation/rotationPrincipalPolicies.js ADDED Viewed

@@ -0,0 +1,19 @@
+import { uniquePrincipalPolicies } from "../../../../data/containers/shared/principalPolicies.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../../data/keyingProjectionVerification/index.js";
+/**
+ * Shared by rekey and revoke. Lives apart from both: background descendant
+ * repair imports the rekey planner, and revoke schedules that repair, so
+ * declaring this in revoke would close a dependency cycle.
+ */
+export async function collectContainerRevokePrincipalPolicies(input) {
+    return uniquePrincipalPolicies(await collectContainerWriterProjectionPrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        resolveUserKey: input.resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    }));
+}
+//# sourceMappingURL=rotationPrincipalPolicies.js.map

package/workflows/containers/child/rotation/rotationPrincipalPolicies.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"rotationPrincipalPolicies.js","sourceRoot":"","sources":["rotationPrincipalPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,iDAAiD,GAIlD,MAAM,+CAA+C,CAAC;AAIvD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAQ7D;IACC,OAAO,uBAAuB,CAC5B,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../../data/containers/shared/principalPolicies\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\n\n/**\n * Shared by rekey and revoke. Lives apart from both: background descendant\n * repair imports the rekey planner, and revoke schedules that repair, so\n * declaring this in revoke would close a dependency cycle.\n */\nexport async function collectContainerRevokePrincipalPolicies(input: {\n execSql: ExecSql;\n persistVerificationCheckpoints?: boolean | undefined;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicyCache?: PrincipalPolicyCache | undefined;\n resolveUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) | undefined;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n return uniquePrincipalPolicies(\n await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n principalPolicyCache: input.principalPolicyCache,\n projection: input.previousProjection,\n resolveUserKey: input.resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n }),\n );\n}\n"]}