@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/containers/child/rotation/rotationWraps.js

@@ -0,0 +1,85 @@
+import { wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, wrapContainerKeyToRootUser, } from "../../../../data/containers/shared/projection.js";
+function findPrincipalPolicy(input) {
+    const policy = input.principalPolicies.find((candidate) => candidate.principalType === input.reference.principalType &&
+        candidate.principalId === input.reference.principalId &&
+        candidate.version === input.reference.version &&
+        candidate.keyEpoch === input.reference.keyEpoch &&
+        candidate.stateHash === input.reference.stateHash);
+    if (!policy) {
+        // Invariant, not a recoverable state: the API commits a container head
+        // only when every referenced group head equals the group's current state
+        // (packages/api groupReferenceHeads.ts), and a group change that would
+        // leave a grant stale is refused unless it rematerializes that container
+        // in the same transaction (principalContainerRematerialization.ts). A
+        // verified projection therefore always carries the policy its manifest
+        // references; a miss means the caller resolved policies for a different
+        // head than the manifest it is rotating.
+        throw new Error(`${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`);
+    }
+    return policy;
+}
+function referenceForManagedGrant(input) {
+    const reference = input.state.referencedPrincipalHeads.find((candidate) => candidate.principalType === input.grant.subjectType &&
+        candidate.principalId === input.grant.subjectId);
+    if (reference?.principalType !== "group") {
+        throw new Error(`${input.operationLabel} referenced principal head is missing`);
+    }
+    return { ...reference, principalType: "group" };
+}
+export async function buildContainerRotationWraps(input) {
+    const userRecipientKeys = [];
+    const wraps = [];
+    if (input.parentKek) {
+        if (!input.parentPublicKey) {
+            throw new Error(`${input.operationLabel} parent wrapping public key is missing`);
+        }
+        wraps.push(await wrapContainerKeyToParent({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            parentKek: input.parentKek,
+            parentPublicKey: input.parentPublicKey,
+        }));
+    }
+    for (const grant of input.state.directGrants) {
+        if (grant.subjectType === "user") {
+            const userKey = await input.resolveUserKey(grant.subjectId);
+            if (!userKey) {
+                throw new Error(`${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`);
+            }
+            const recipient = await wrapContainerKeyToRootUser({
+                containerKey: input.containerKey,
+                containerKeyEpochId: input.containerKeyEpochId,
+                manifestHash: input.manifestHash,
+                recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,
+                userId: grant.subjectId,
+            });
+            userRecipientKeys.push(recipient.userRecipientKey);
+            wraps.push(recipient.wrap);
+            continue;
+        }
+        const reference = referenceForManagedGrant({
+            grant,
+            operationLabel: input.operationLabel,
+            state: input.state,
+        });
+        const policy = findPrincipalPolicy({
+            operationLabel: input.operationLabel,
+            principalPolicies: input.principalPolicies,
+            reference,
+        });
+        const recipient = await wrapContainerKeyToManagedPrincipal({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,
+            principalHead: reference,
+        });
+        wraps.push(recipient.wrap);
+    }
+    return {
+        userRecipientKeys: userRecipientKeys.sort((left, right) => left.userId.localeCompare(right.userId)),
+        wraps: wraps.sort((left, right) => `${left.recipientKind}:${left.recipientId}`.localeCompare(`${right.recipientKind}:${right.recipientId}`)),
+    };
+}
+//# sourceMappingURL=rotationWraps.js.map

package/workflows/containers/child/rotation/rotationWraps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotationWraps.js","sourceRoot":"","sources":["rotationWraps.ts"],"names":[],"mappings":"AASA,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AAIvD,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CACzC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa;QACzD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW;QACrD,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO;QAC7C,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC,QAAQ;QAC/C,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CACpD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,eAAe,KAAK,CAAC,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,SAAS,CAAC,OAAO,eAAe,KAAK,CAAC,SAAS,CAAC,QAAQ,sHAAsH,CACtS,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAIjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACzD,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QACnD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAClD,CAAC;IACF,IAAI,SAAS,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,uCAAuC,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAUjD;IAIC,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,wCAAwC,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,MAAM,wBAAwB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,mDAAmD,KAAK,CAAC,SAAS,EAAE,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;gBACjD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,OAAO,CAAC,sBAAsB;gBAC/D,MAAM,EAAE,KAAK,CAAC,SAAS;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;YACpE,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC;QACD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,CACvD,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAC9C,CACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantPrincipalHead,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n  wrapContainerKeyToRootUser,\n} from \"../../../../data/containers/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\n\nfunction findPrincipalPolicy(input: {\n  operationLabel: string;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  reference: ReferencedPrincipalHead;\n}): PrincipalPolicyCurrentEvidence {\n  const policy = input.principalPolicies.find(\n    (candidate) =>\n      candidate.principalType === input.reference.principalType &&\n      candidate.principalId === input.reference.principalId &&\n      candidate.version === input.reference.version &&\n      candidate.keyEpoch === input.reference.keyEpoch &&\n      candidate.stateHash === input.reference.stateHash,\n  );\n  if (!policy) {\n    // Invariant, not a recoverable state: the API commits a container head\n    // only when every referenced group head equals the group's current state\n    // (packages/api groupReferenceHeads.ts), and a group change that would\n    // leave a grant stale is refused unless it rematerializes that container\n    // in the same transaction (principalContainerRematerialization.ts). A\n    // verified projection therefore always carries the policy its manifest\n    // references; a miss means the caller resolved policies for a different\n    // head than the manifest it is rotating.\n    throw new Error(\n      `${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`,\n    );\n  }\n  return policy;\n}\n\nfunction referenceForManagedGrant(input: {\n  grant: ContainerDirectGrant;\n  operationLabel: string;\n  state: ContainerAccessManifestState;\n}): ContainerGrantPrincipalHead {\n  const reference = input.state.referencedPrincipalHeads.find(\n    (candidate) =>\n      candidate.principalType === input.grant.subjectType &&\n      candidate.principalId === input.grant.subjectId,\n  );\n  if (reference?.principalType !== \"group\") {\n    throw new Error(\n      `${input.operationLabel} referenced principal head is missing`,\n    );\n  }\n  return { ...reference, principalType: \"group\" };\n}\n\nexport async function buildContainerRotationWraps(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  operationLabel: string;\n  parentKek: ContainerKekResponse | null;\n  parentPublicKey: string | null;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  state: ContainerAccessManifestState;\n}): Promise<{\n  readonly userRecipientKeys: ContainerUserRecipientKey[];\n  readonly wraps: ContainerKeyWrap[];\n}> {\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n  const wraps: ContainerKeyWrap[] = [];\n  if (input.parentKek) {\n    if (!input.parentPublicKey) {\n      throw new Error(\n        `${input.operationLabel} parent wrapping public key is missing`,\n      );\n    }\n    wraps.push(\n      await wrapContainerKeyToParent({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        parentKek: input.parentKek,\n        parentPublicKey: input.parentPublicKey,\n      }),\n    );\n  }\n\n  for (const grant of input.state.directGrants) {\n    if (grant.subjectType === \"user\") {\n      const userKey = await input.resolveUserKey(grant.subjectId);\n      if (!userKey) {\n        throw new Error(\n          `${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`,\n        );\n      }\n      const recipient = await wrapContainerKeyToRootUser({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,\n        userId: grant.subjectId,\n      });\n      userRecipientKeys.push(recipient.userRecipientKey);\n      wraps.push(recipient.wrap);\n      continue;\n    }\n\n    const reference = referenceForManagedGrant({\n      grant,\n      operationLabel: input.operationLabel,\n      state: input.state,\n    });\n    const policy = findPrincipalPolicy({\n      operationLabel: input.operationLabel,\n      principalPolicies: input.principalPolicies,\n      reference,\n    });\n    const recipient = await wrapContainerKeyToManagedPrincipal({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,\n      principalHead: reference,\n    });\n    wraps.push(recipient.wrap);\n  }\n\n  return {\n    userRecipientKeys: userRecipientKeys.sort((left, right) =>\n      left.userId.localeCompare(right.userId),\n    ),\n    wraps: wraps.sort((left, right) =>\n      `${left.recipientKind}:${left.recipientId}`.localeCompare(\n        `${right.recipientKind}:${right.recipientId}`,\n      ),\n    ),\n  };\n}\n"]}

package/workflows/containers/child/share/currentShareGrantMutation.js

@@ -0,0 +1,82 @@
+import { assertProjectionVerificationCurrent } from "../../../../data/keyingProjectionVerification/types.js";
+import { createRuntimeGroupMetadataAccess } from "../../../organizations/groupMetadata/groupMetadataRuntime.js";
+import { commitCurrentGroupPolicyMutation } from "../../../organizations/groupPolicy/commitCurrentGroupPolicyMutation.js";
+import { buildSetGroupContainerGrantPolicyRequest } from "../../../organizations/groupPolicy/groupPolicyRequests.js";
+import { groupPolicyNameMismatch } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { preparePrincipalContainerRematerializationBatch, } from "../../../organizations/rematerialization/principalContainerRematerialization.js";
+import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
+/** Fresh mutation authority rechecks the chosen name before authoring a grant. */
+export async function commitCurrentShareGrant(input) {
+    const share = input.share;
+    const expectedName = share.expectedGroupName;
+    if (expectedName === null)
+        throw new Error("Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it");
+    const signingKeyPair = share.signingKeyPair;
+    if (!signingKeyPair)
+        throw new Error("Container group share requires principal policy signing context");
+    return input.mutate({
+        groupId: share.recipientGroupId,
+        organizationId: share.author.organizationId,
+        signerUserId: share.author.signerUserId,
+        stillCurrent: share.stillCurrent ?? (() => true),
+    }, async (context) => {
+        await assertCurrentShareGrantName(input.runtime, share, context, expectedName);
+        const request = await buildSetGroupContainerGrantPolicyRequest({
+            ...context,
+            accessLevel: share.accessLevel,
+            containerId: share.containerId,
+            signerUserId: share.author.signerUserId,
+            signingFingerprint: share.author.signerKeyFingerprint,
+            signingKeyPair,
+        });
+        const prepared = {};
+        const response = await commitCurrentGroupPolicyMutation({
+            apiClient: share.apiClient,
+            context,
+            groupId: share.recipientGroupId,
+            organizationId: share.author.organizationId,
+            request,
+            signerUserId: share.author.signerUserId,
+            signingFingerprint: share.author.signerKeyFingerprint,
+            signingKeyPair,
+            resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,
+            prepareContainerMutations: async (nextPolicy) => {
+                prepared.batch = await prepareCurrentShareGrantBatch(share, context, nextPolicy, input.recitationStillCurrent);
+                return prepared.batch;
+            },
+        });
+        const index = prepared.batch?.plans.findIndex((planned) => planned.plan.containerId === share.containerId) ?? -1;
+        const plan = prepared.batch?.plans[index];
+        const acknowledgement = response.containerMutations[index];
+        if (!plan || !acknowledgement || !isSharePlan(plan))
+            throw new Error("Container group share acknowledgement is incomplete");
+        return {
+            containerKey: plan.containerKey,
+            plan: plan.plan,
+            response: acknowledgement,
+        };
+    });
+}
+function isSharePlan(plan) {
+    return plan.plan.body.eventType === "container.grant";
+}
+async function assertCurrentShareGrantName(runtime, share, context, expectedName) {
+    const mismatch = await groupPolicyNameMismatch(context.currentPolicy, expectedName, createRuntimeGroupMetadataAccess(runtime, share.author.organizationId, context.stillCurrent, context.verifyMetadataContainer).readName);
+    if (mismatch)
+        throw new GroupShareNameMismatchError("Container share group name does not match the signed group policy");
+    assertProjectionVerificationCurrent(context.stillCurrent);
+}
+function prepareCurrentShareGrantBatch(share, context, nextPolicy, recitationStillCurrent) {
+    return preparePrincipalContainerRematerializationBatch({
+        ...share,
+        grants: [
+            ...new Map([...context.currentPolicy.currentGrants, ...nextPolicy.grants].map((grant) => [grant.containerId, grant])).values(),
+        ],
+        groupId: share.recipientGroupId,
+        nextPolicy,
+        resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,
+        stillCurrent: context.stillCurrent,
+        recitationStillCurrent,
+    });
+}
+//# sourceMappingURL=currentShareGrantMutation.js.map

package/workflows/containers/child/share/currentShareGrantMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentShareGrantMutation.js","sourceRoot":"","sources":["currentShareGrantMutation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,wCAAwC,EAAE,MAAM,wDAAwD,CAAC;AAKlH,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAEL,+CAA+C,GAChD,MAAM,8EAA8E,CAAC;AAGtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,YAAY,KAAK,IAAI;QACvB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CACjB;QACE,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,2BAA2B,CAC/B,KAAK,CAAC,OAAO,EACb,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC7D,GAAG,OAAO;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAEV,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;YACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,CAAC,KAAK,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,OAAO,EACP,UAAU,EACV,KAAK,CAAC,sBAAsB,CAC7B,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,IAAI,CAAC,CAAC,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAuE;IAEvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAuE,EACvE,KAA0D,EAC1D,OAA2C,EAC3C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,aAAa,EACrB,YAAY,EACZ,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA0D,EAC1D,OAA2C,EAC3C,UAEkB,EAClB,sBAAsC;IAEtC,OAAO,+CAA+C,CAAC;QACrD,GAAG,KAAK;QACR,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,UAAU;QACV,+BAA+B,EAAE,OAAO,CAAC,+BAA+B;QACxE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { MaterializedContainerSharePlan } from \"../../../../data/containers/shared/types\";\nimport { assertProjectionVerificationCurrent } from \"../../../../data/keyingProjectionVerification/types\";\nimport { createRuntimeGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { commitCurrentGroupPolicyMutation } from \"../../../organizations/groupPolicy/commitCurrentGroupPolicyMutation\";\nimport { buildSetGroupContainerGrantPolicyRequest } from \"../../../organizations/groupPolicy/groupPolicyRequests\";\nimport type {\n  createRuntimeCurrentGroupMutation,\n  RuntimeCurrentGroupMutationContext,\n} from \"../../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport { groupPolicyNameMismatch } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../../organizations/rematerialization/principalContainerRematerialization\";\nimport type { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./index\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\n/** Fresh mutation authority rechecks the chosen name before authoring a grant. */\nexport async function commitCurrentShareGrant(input: {\n  readonly runtime: Parameters<\n    typeof createRuntimeCurrentSharePrincipalPolicy\n  >[0];\n  readonly share: Parameters<typeof shareRemoteContainerWithGroup>[0];\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly mutate: NonNullable<\n    ReturnType<typeof createRuntimeCurrentGroupMutation>\n  >;\n}): ReturnType<typeof shareRemoteContainerWithGroup> {\n  const share = input.share;\n  const expectedName = share.expectedGroupName;\n  if (expectedName === null)\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  const signingKeyPair = share.signingKeyPair;\n  if (!signingKeyPair)\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  return input.mutate(\n    {\n      groupId: share.recipientGroupId,\n      organizationId: share.author.organizationId,\n      signerUserId: share.author.signerUserId,\n      stillCurrent: share.stillCurrent ?? (() => true),\n    },\n    async (context) => {\n      await assertCurrentShareGrantName(\n        input.runtime,\n        share,\n        context,\n        expectedName,\n      );\n      const request = await buildSetGroupContainerGrantPolicyRequest({\n        ...context,\n        accessLevel: share.accessLevel,\n        containerId: share.containerId,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n      });\n      const prepared: {\n        batch?: PreparedPrincipalContainerRematerializationBatch;\n      } = {};\n      const response = await commitCurrentGroupPolicyMutation({\n        apiClient: share.apiClient,\n        context,\n        groupId: share.recipientGroupId,\n        organizationId: share.author.organizationId,\n        request,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n        resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,\n        prepareContainerMutations: async (nextPolicy) => {\n          prepared.batch = await prepareCurrentShareGrantBatch(\n            share,\n            context,\n            nextPolicy,\n            input.recitationStillCurrent,\n          );\n          return prepared.batch;\n        },\n      });\n      const index =\n        prepared.batch?.plans.findIndex(\n          (planned) => planned.plan.containerId === share.containerId,\n        ) ?? -1;\n      const plan = prepared.batch?.plans[index];\n      const acknowledgement = response.containerMutations[index];\n      if (!plan || !acknowledgement || !isSharePlan(plan))\n        throw new Error(\"Container group share acknowledgement is incomplete\");\n      return {\n        containerKey: plan.containerKey,\n        plan: plan.plan,\n        response: acknowledgement,\n      };\n    },\n  );\n}\n\nfunction isSharePlan(\n  plan: PreparedPrincipalContainerRematerializationBatch[\"plans\"][number],\n): plan is MaterializedContainerSharePlan {\n  return plan.plan.body.eventType === \"container.grant\";\n}\n\nasync function assertCurrentShareGrantName(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  expectedName: string,\n) {\n  const mismatch = await groupPolicyNameMismatch(\n    context.currentPolicy,\n    expectedName,\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      share.author.organizationId,\n      context.stillCurrent,\n      context.verifyMetadataContainer,\n    ).readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n}\n\nfunction prepareCurrentShareGrantBatch(\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  nextPolicy: Parameters<\n    typeof preparePrincipalContainerRematerializationBatch\n  >[0][\"nextPolicy\"],\n  recitationStillCurrent?: () => boolean,\n) {\n  return preparePrincipalContainerRematerializationBatch({\n    ...share,\n    grants: [\n      ...new Map(\n        [...context.currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: share.recipientGroupId,\n    nextPolicy,\n    resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,\n    stillCurrent: context.stillCurrent,\n    recitationStillCurrent,\n  });\n}\n"]}

package/workflows/containers/child/share/currentSharePrincipalPolicy.js

@@ -0,0 +1,83 @@
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { principalHeadMatchesReference } from "../../../../data/principals/organizationAuthorityDescriptor.js";
+import { loadCurrentOrganizationAuthority } from "../../../organizations/currentOrganizationAuthority.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../../organizations/groupMetadata/currentGroupMetadataAuthority.js";
+import { assertGroupMetadataBinding } from "../../../organizations/groupMetadata/groupMetadataBinding.js";
+import { createRuntimeGroupMetadataAccess } from "../../../organizations/groupMetadata/groupMetadataRuntime.js";
+import { createCurrentPrincipalMutationLease } from "../../../organizations/principalMutations/currentPrincipalMutationLease.js";
+import { groupPolicyNameMismatch, } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
+/** A share read need not be a group administrator; minting a grant checks that separately. */
+export function createRuntimeCurrentSharePrincipalPolicy(runtime) {
+    const lease = createCurrentPrincipalMutationLease(runtime);
+    if (!lease)
+        return undefined;
+    return async (input, work) => {
+        input = {
+            ...input,
+            expectedGroupHead: input.expectedGroupHead
+                ? { ...input.expectedGroupHead }
+                : undefined,
+        };
+        return lease(input.stillCurrent, async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {
+            await runtime.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
+            assertProjectionVerificationCurrent(leaseCurrent);
+            const authority = await loadCurrentOrganizationAuthority({
+                execSql: runtime.infra.execSql,
+                organizationId: input.organizationId,
+                resolveCurrentPolicy,
+                stillCurrent: leaseCurrent,
+            });
+            const group = await authority.readGroup(input.groupId);
+            const stillCurrent = () => leaseCurrent() && authority.stillCurrent() && group.stillCurrent();
+            assertProjectionVerificationCurrent(stillCurrent);
+            if (input.expectedGroupHead &&
+                !principalHeadMatchesReference(group.policy.state, input.expectedGroupHead))
+                throw new KeyingVerificationError("object_mismatch", "Container share expected group head conflicts with the signed organization directory");
+            assertGroupMetadataBinding(group.current, authority.descriptor);
+            await assertCurrentShareName({
+                runtime,
+                input,
+                authority,
+                group,
+                stillCurrent,
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            const checkpointPolicies = [...group.dependencies, group.policy];
+            await advanceKeyingCheckpointsAtomically({
+                access: [],
+                execSql: runtime.infra.execSql,
+                organizationId: input.organizationId,
+                policies: checkpointPolicies,
+                stillCurrent,
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            const result = await work({
+                current: group.current,
+                policy: group.policy,
+                checkpointPolicies,
+                stillCurrent,
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            return result;
+        });
+    };
+}
+async function assertCurrentShareName({ runtime, input, authority, group, stillCurrent, }) {
+    if (input.expectedGroupName === undefined)
+        return;
+    const readName = input.readEncryptedName ??
+        createRuntimeGroupMetadataAccess(runtime, input.organizationId, stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent,
+        })).readName;
+    const mismatch = await groupPolicyNameMismatch(group.current, input.expectedGroupName, readName);
+    if (mismatch)
+        throw new GroupShareNameMismatchError(mismatch === "forbidden_characters"
+            ? "Container share group name contains control or format characters"
+            : "Container share group name does not match the signed group policy");
+}
+//# sourceMappingURL=currentSharePrincipalPolicy.js.map

package/workflows/containers/child/share/currentSharePrincipalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentSharePrincipalPolicy.js","sourceRoot":"","sources":["currentSharePrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AACrH,OAAO,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC5G,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,EAAE,mDAAmD,EAAE,MAAM,oEAAoE,CAAC;AACzI,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,mCAAmC,EAAE,MAAM,yEAAyE,CAAC;AAE9H,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAoCrE,8FAA8F;AAC9F,MAAM,UAAU,wCAAwC,CACtD,OAA4B;IAE5B,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAwB,EACxB,IAAyD,EAC7C,EAAE;QACd,KAAK,GAAG;YACN,GAAG,KAAK;YACR,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBACxC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE;gBAChC,CAAC,CAAC,SAAS;SACd,CAAC;QACF,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;YAC7D,MAAM,OAAO,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACvD,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;gBACvD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,oBAAoB;gBACpB,YAAY,EAAE,YAAY;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrE,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,CAAC,iBAAiB;gBACvB,CAAC,6BAA6B,CAC5B,KAAK,CAAC,MAAM,CAAC,KAAK,EAClB,KAAK,CAAC,iBAAiB,CACxB;gBAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sFAAsF,CACvF,CAAC;YACJ,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,KAAK;gBACL,SAAS;gBACT,KAAK;gBACL,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,kBAAkB,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,kCAAkC,CAAC;gBACvC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,kBAAkB;gBAClB,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,SAAS,EACT,KAAK,EACL,YAAY,GAOb;IACC,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,iBAAiB;QACvB,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,YAAY,EACZ,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC,CACH,CAAC,QAAQ,CAAC;IACb,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,QAAQ,KAAK,sBAAsB;YACjC,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,mEAAmE,CACxE,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalHeadMatchesReference } from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"../../../organizations/currentOrganizationAuthority\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../../organizations/groupMetadata/currentGroupMetadataAuthority\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport { createRuntimeGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createCurrentPrincipalMutationLease } from \"../../../organizations/principalMutations/currentPrincipalMutationLease\";\nimport type { PrincipalMutationRecoveryApi } from \"../../../organizations/principalMutations/principalMutationJournalManagement\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\ntype CurrentShareRuntime = Parameters<\n  typeof createRuntimeGroupMetadataAccess\n>[0] &\n  Parameters<typeof createCurrentPrincipalMutationLease>[0] & {\n    readonly apiClient: {\n      readonly recoverPendingPrincipalMutation?:\n        | PrincipalMutationRecoveryApi[\"recoverPendingPrincipalMutation\"]\n        | undefined;\n    };\n  };\n\ninterface CurrentShareInput {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  readonly expectedGroupName?: string | undefined;\n  /** Trusted internal reader; it must authenticate the signed metadata container. */\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly stillCurrent: () => boolean;\n}\n\ntype CurrentGroup = Awaited<\n  ReturnType<\n    Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>[\"readGroup\"]\n  >\n>;\n\nexport interface CurrentSharePrincipalPolicy {\n  readonly current: CurrentGroup[\"current\"];\n  readonly policy: CurrentGroup[\"policy\"];\n  readonly checkpointPolicies: readonly CurrentGroup[\"policy\"][];\n  readonly stillCurrent: () => boolean;\n}\n\n/** A share read need not be a group administrator; minting a grant checks that separately. */\nexport function createRuntimeCurrentSharePrincipalPolicy(\n  runtime: CurrentShareRuntime,\n) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: CurrentShareInput,\n    work: (policy: CurrentSharePrincipalPolicy) => Promise<T>,\n  ): Promise<T> => {\n    input = {\n      ...input,\n      expectedGroupHead: input.expectedGroupHead\n        ? { ...input.expectedGroupHead }\n        : undefined,\n    };\n    return lease(\n      input.stillCurrent,\n      async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {\n        await runtime.apiClient.recoverPendingPrincipalMutation?.(\n          input.organizationId,\n        );\n        assertProjectionVerificationCurrent(leaseCurrent);\n        const authority = await loadCurrentOrganizationAuthority({\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          resolveCurrentPolicy,\n          stillCurrent: leaseCurrent,\n        });\n        const group = await authority.readGroup(input.groupId);\n        const stillCurrent = () =>\n          leaseCurrent() && authority.stillCurrent() && group.stillCurrent();\n        assertProjectionVerificationCurrent(stillCurrent);\n        if (\n          input.expectedGroupHead &&\n          !principalHeadMatchesReference(\n            group.policy.state,\n            input.expectedGroupHead,\n          )\n        )\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Container share expected group head conflicts with the signed organization directory\",\n          );\n        assertGroupMetadataBinding(group.current, authority.descriptor);\n        await assertCurrentShareName({\n          runtime,\n          input,\n          authority,\n          group,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const checkpointPolicies = [...group.dependencies, group.policy];\n        await advanceKeyingCheckpointsAtomically({\n          access: [],\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          policies: checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const result = await work({\n          current: group.current,\n          policy: group.policy,\n          checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        return result;\n      },\n    );\n  };\n}\n\nasync function assertCurrentShareName({\n  runtime,\n  input,\n  authority,\n  group,\n  stillCurrent,\n}: {\n  runtime: CurrentShareRuntime;\n  input: CurrentShareInput;\n  authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>;\n  group: CurrentGroup;\n  stillCurrent: () => boolean;\n}) {\n  if (input.expectedGroupName === undefined) return;\n  const readName =\n    input.readEncryptedName ??\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      input.organizationId,\n      stillCurrent,\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    ).readName;\n  const mismatch = await groupPolicyNameMismatch(\n    group.current,\n    input.expectedGroupName,\n    readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      mismatch === \"forbidden_characters\"\n        ? \"Container share group name contains control or format characters\"\n        : \"Container share group name does not match the signed group policy\",\n    );\n}\n"]}

package/workflows/containers/child/share/index.d.ts

@@ -0,0 +1,65 @@
+import type { ContainerAccessLevel, SigningKeyPair } from "../../../../internal/crypto/index.js";
+import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, ContainerShareApi, ContainerSharePlan } from "../../../../data/containers/shared/types.js";
+import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+import { type TrustedUserIdentityResolver } from "../../../../data/trustedUserIdentity/index.js";
+import type { GroupPolicyNameReader } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { type ContainerManagedPrincipalShareApi } from "./sharePrincipalPolicy.js";
+export declare function shareRemoteContainer(input: {
+    reportSecurityIncident: SecurityIncidentReporter;
+    accessLevel: ContainerAccessLevel;
+    apiClient: ContainerShareApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    previousProjection?: ContainerWriterProjectionResponse | undefined;
+    recipientUserId: string;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<{
+    containerKey: Uint8Array;
+    plan: ContainerSharePlan;
+    response: ContainerMutationResponse;
+} | null>;
+interface RemoteContainerGroupShareInput {
+    reportSecurityIncident: SecurityIncidentReporter;
+    accessLevel: ContainerAccessLevel;
+    apiClient: ContainerManagedPrincipalShareApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    /**
+     * The display name the user chose the group by, checked against the name
+     * committed in the verified group policy so a relabeled read-model row
+     * cannot redirect the share onto another group. `null` is reserved for the
+     * grant-preserving re-wrap: a share that would mint a new grant without a
+     * name is refused.
+     */
+    expectedGroupName: string | null;
+    readEncryptedName?: GroupPolicyNameReader | undefined;
+    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    previousProjection?: ContainerWriterProjectionResponse | undefined;
+    recipientGroupId: string;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    signedAt?: string | undefined;
+    signingKeyPair?: SigningKeyPair | null | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+interface RemoteContainerGroupShareResult {
+    containerKey: Uint8Array;
+    plan: ContainerSharePlan;
+    response: ContainerMutationResponse;
+}
+export declare function shareRemoteContainerWithGroup(input: RemoteContainerGroupShareInput): Promise<RemoteContainerGroupShareResult | null>;
+export {};

package/workflows/containers/child/share/index.js

@@ -0,0 +1,256 @@
+import { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
+import { principalPolicyCacheForVerifiedPolicies } from "../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
+import { savePrincipalPolicyBundle } from "../../../../data/persistence/principalPolicyPersistence.js";
+import { requireTrustedUserIdentityResolver, } from "../../../../data/trustedUserIdentity/index.js";
+import { createGroupMetadataAccess } from "../../../organizations/groupMetadata/groupMetadataAccess.js";
+import { createGroupMetadataContainerVerifier } from "../../../organizations/groupMetadata/groupMetadataContainerAuthority.js";
+import { setOrganizationGroupContainerGrant } from "../../../organizations/principalPolicy/index.js";
+import { preparePrincipalContainerRematerializationBatch } from "../../../organizations/rematerialization/principalContainerRematerialization.js";
+import { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "../mutationSubmit.js";
+import { buildMaterializedContainerSharePlan } from "./shareMaterialization.js";
+import { advanceVerifiedSharePolicies, loadVerifiedGroupSharePrincipalPolicy, } from "./sharePrincipalPolicy.js";
+import { resolveShareProjection } from "./shareProjection.js";
+class ContainerShareGenerationExpiredError extends Error {
+}
+async function buildCurrentContainerSharePlan(input) {
+    return nullOnProjectionVerificationCancellation(() => buildMaterializedContainerSharePlan(input));
+}
+export async function shareRemoteContainer(input) {
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container share");
+    const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(input.resolveTrustedUserIdentity);
+    const recipientIdentity = await resolveTrustedUserIdentity(input.recipientUserId);
+    if (!recipientIdentity || input.stillCurrent?.() === false) {
+        return null;
+    }
+    const previousProjection = await resolveShareProjection(input, resolveProjectionUserKey);
+    if (!previousProjection)
+        return null;
+    const materializedPlan = await buildCurrentContainerSharePlan({
+        accessLevel: input.accessLevel,
+        author: input.author,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        previousProjection,
+        recipient: {
+            recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,
+            subjectId: input.recipientUserId,
+            subjectType: "user",
+        },
+        resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (!materializedPlan)
+        return null;
+    return submitAcknowledgedContainerMutation({
+        reportSecurityIncident: input.reportSecurityIncident,
+        recitationPolicies: [],
+        apiClient: input.apiClient,
+        author: input.author,
+        containerKey: materializedPlan.containerKey,
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+        submit: () => submitPlainContainerMutation(() => input.apiClient.shareContainer(input.containerId, materializedPlan.plan.request, {
+            expectedPaymentRequiredOrganizationId: input.author.organizationId,
+        })),
+    });
+}
+function isMaterializedContainerSharePlan(value) {
+    return value.plan.body.eventType === "container.grant";
+}
+async function prepareMissingGroupGrantMutations(input) {
+    const { currentPolicy, nextPolicy, shareInput } = input;
+    return preparePrincipalContainerRematerializationBatch({
+        reportSecurityIncident: shareInput.reportSecurityIncident,
+        apiClient: shareInput.apiClient,
+        author: shareInput.author,
+        execSql: shareInput.execSql,
+        grants: [
+            ...new Map([...currentPolicy.currentGrants, ...nextPolicy.grants].map((grant) => [grant.containerId, grant])).values(),
+        ],
+        groupId: shareInput.recipientGroupId,
+        nextPolicy,
+        resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,
+        stillCurrent: shareInput.stillCurrent,
+        targetSecretKey: shareInput.targetSecretKey,
+        warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,
+    });
+}
+async function commitMissingGroupGrantPolicy(input) {
+    const signingKeyPair = input.signingKeyPair;
+    if (!signingKeyPair) {
+        throw new Error("Container group share requires principal policy signing context");
+    }
+    const policyApi = {
+        recoverPendingPrincipalMutation: input.apiClient.recoverPendingPrincipalMutation?.bind(input.apiClient),
+        commitOrganizationGroupPolicy: input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),
+        getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(input.apiClient),
+    };
+    let preparedTarget;
+    try {
+        const storedPolicy = await setOrganizationGroupContainerGrant({
+            accessLevel: input.accessLevel,
+            apiClient: policyApi,
+            assertCanCommit: () => {
+                if (input.stillCurrent?.() === false) {
+                    throw new ContainerShareGenerationExpiredError();
+                }
+            },
+            containerId: input.containerId,
+            execSql: input.execSql,
+            groupId: input.recipientGroupId,
+            organizationId: input.author.organizationId,
+            prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {
+                preparedTarget = await prepareMissingGroupGrantMutations({
+                    currentPolicy,
+                    nextPolicy,
+                    shareInput: input,
+                });
+                return preparedTarget;
+            },
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+            signerUserId: input.author.signerUserId,
+            signingFingerprint: input.author.signerKeyFingerprint,
+            signingKeyPair,
+        });
+        if (!preparedTarget) {
+            throw new Error("Container group share preparation is incomplete");
+        }
+        return { preparedTarget, storedPolicy };
+    }
+    catch (error) {
+        if (error instanceof ContainerShareGenerationExpiredError ||
+            isProjectionVerificationCancelledError(error)) {
+            return null;
+        }
+        throw error;
+    }
+}
+async function commitMissingGroupGrant(input) {
+    if (!input.signingKeyPair) {
+        throw new Error("Container group share requires principal policy signing context");
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    const committed = await commitMissingGroupGrantPolicy(input);
+    if (!committed)
+        return null;
+    const { preparedTarget, storedPolicy } = committed;
+    const targetIndex = preparedTarget?.plans.findIndex((planned) => planned.plan.containerId === input.containerId);
+    const response = targetIndex === undefined || targetIndex < 0
+        ? undefined
+        : storedPolicy.containerMutations[targetIndex];
+    const targetPlan = targetIndex === undefined || targetIndex < 0
+        ? undefined
+        : preparedTarget?.plans[targetIndex];
+    if (!targetPlan ||
+        !response ||
+        !isMaterializedContainerSharePlan(targetPlan)) {
+        throw new Error("Container group share acknowledgement is incomplete");
+    }
+    return {
+        containerKey: targetPlan.containerKey,
+        plan: targetPlan.plan,
+        response,
+    };
+}
+// Only a re-wrap of an existing signed grant may run without the chosen name;
+// minting a grant is exactly the operation the name binding protects.
+function assertGrantMintNamed(expectedGroupName) {
+    if (expectedGroupName === null) {
+        throw new Error("Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it");
+    }
+}
+function loadShareGroupPolicy(input) {
+    return loadVerifiedGroupSharePrincipalPolicy({
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        expectedGroupName: input.expectedGroupName ?? undefined,
+        readEncryptedName: input.readEncryptedName ??
+            createGroupMetadataAccess({
+                ...input,
+                organizationId: input.author.organizationId,
+                verifyMetadataContainer: createGroupMetadataContainerVerifier({
+                    ...input,
+                    organizationId: input.author.organizationId,
+                    stillCurrent: input.stillCurrent ?? (() => true),
+                }),
+            }).readName,
+        groupId: input.recipientGroupId,
+        organizationId: input.author.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+}
+export async function shareRemoteContainerWithGroup(input) {
+    if (input.stillCurrent?.() === false)
+        return null;
+    await input.apiClient.recoverPendingPrincipalMutation?.(input.author.organizationId);
+    if (input.stillCurrent?.() === false)
+        return null;
+    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container share");
+    const previousProjection = await resolveShareProjection(input, resolveProjectionUserKey);
+    if (!previousProjection)
+        return null;
+    const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);
+    if (input.stillCurrent?.() === false)
+        return null;
+    await advanceVerifiedSharePolicies(input.execSql, verifiedPrincipalPolicy, input.stillCurrent);
+    if (input.stillCurrent?.() === false)
+        return null;
+    const signedGrant = verifiedPrincipalPolicy.policy.grants.find((grant) => grant.containerId === input.containerId);
+    if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {
+        assertGrantMintNamed(input.expectedGroupName);
+        return commitMissingGroupGrant(input);
+    }
+    const materializedPlan = await buildCurrentContainerSharePlan({
+        accessLevel: input.accessLevel,
+        author: input.author,
+        eventId: input.eventId,
+        execSql: input.execSql,
+        knownContainerKeks: input.knownContainerKeks,
+        principalPolicyCache: principalPolicyCacheForVerifiedPolicies(verifiedPrincipalPolicy.checkpointPolicies),
+        previousProjection,
+        recipient: {
+            principalPolicy: verifiedPrincipalPolicy.policy,
+            subjectId: input.recipientGroupId,
+            subjectType: "group",
+        },
+        resolveProjectionUserKey,
+        signedAt: input.signedAt,
+        stillCurrent: input.stillCurrent,
+        targetSecretKey: input.targetSecretKey,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    if (!materializedPlan)
+        return null;
+    const result = await submitAcknowledgedContainerMutation({
+        reportSecurityIncident: input.reportSecurityIncident,
+        recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,
+        apiClient: input.apiClient,
+        author: input.author,
+        containerKey: materializedPlan.containerKey,
+        execSql: input.execSql,
+        plan: materializedPlan.plan,
+        stillCurrent: input.stillCurrent,
+        submit: () => submitPlainContainerMutation(() => input.apiClient.shareContainer(input.containerId, materializedPlan.plan.request, {
+            expectedPaymentRequiredOrganizationId: input.author.organizationId,
+        })),
+    });
+    if (!result)
+        return null;
+    // Keep the previously cached group epoch available until the old container
+    // wrap has been unwrapped and the replacement has committed. Root has no
+    // parent fallback, so caching the rotated policy any earlier destroys the
+    // only local path to the KEK that must be re-wrapped.
+    if (input.stillCurrent?.() !== false) {
+        await savePrincipalPolicyBundle(input.execSql, verifiedPrincipalPolicy.bundle, new Date().toISOString(), input.author.organizationId, { stillCurrent: input.stillCurrent });
+    }
+    if (input.stillCurrent?.() === false)
+        return null;
+    return result;
+}
+//# sourceMappingURL=index.js.map