@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/containers/child/share/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,sCAAsC,EACtC,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AAGpG,OAAO,EACL,kCAAkC,GAEnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,sEAAsE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAAE,+CAA+C,EAAE,MAAM,8EAA8E,CAAC;AAC/I,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAE5B,qCAAqC,GACtC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,oCAAqC,SAAQ,KAAK;CAAG;AAE3D,KAAK,UAAU,8BAA8B,CAC3C,KAAgE;IAEhE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,mCAAmC,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAgB1C;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,SAAS,EAAE;YACT,+BAA+B,EAAE,iBAAiB,CAAC,sBAAsB;YACzE,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,WAAW,EAAE,MAAM;SACpB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;AACL,CAAC;AAqCD,SAAS,gCAAgC,CACvC,KAEkB;IAElB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAIhD;IACC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,+CAA+C,CAAC;QACrD,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACxD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,UAAU,CAAC,gBAAgB;QACpC,UAAU;QACV,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAOrC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACxE,6BAA6B,EAC3B,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACrE,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CACvE,KAAK,CAAC,SAAS,CAChB;KACF,CAAC;IACF,IAAI,cAIS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;YAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,GAAG,EAAE;gBACpB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;oBACrC,MAAM,IAAI,oCAAoC,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,yBAAyB,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;gBACjE,cAAc,GAAG,MAAM,iCAAiC,CAAC;oBACvD,aAAa;oBACb,UAAU;oBACV,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,oCAAoC;YACrD,sCAAsC,CAAC,KAAK,CAAC,EAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnD,MAAM,WAAW,GAAG,cAAc,EAAE,KAAK,CAAC,SAAS,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,CAAC;IACF,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,UAAU,GACd,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,IACE,CAAC,UAAU;QACX,CAAC,QAAQ;QACT,CAAC,gCAAgC,CAAC,UAAU,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,iBAAgC;IAC5D,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAqC;IACjE,OAAO,qCAAqC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;QACvD,iBAAiB,EACf,KAAK,CAAC,iBAAiB;YACvB,yBAAyB,CAAC;gBACxB,GAAG,KAAK;gBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,uBAAuB,EAAE,oCAAoC,CAAC;oBAC5D,GAAG,KAAK;oBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;iBACjD,CAAC;aACH,CAAC,CAAC,QAAQ;QACb,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAqC;IAErC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACrD,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,uBAAuB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,uBAAuB,EACvB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,oBAAoB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9C,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,uCAAuC,CAC3D,uBAAuB,CAAC,kBAAkB,CAC3C;QACD,kBAAkB;QAClB,SAAS,EAAE;YACT,eAAe,EAAE,uBAAuB,CAAC,MAAM;YAC/C,SAAS,EAAE,KAAK,CAAC,gBAAgB;YACjC,WAAW,EAAE,OAAO;SACrB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;QACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,uBAAuB,CAAC,kBAAkB;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,sDAAsD;IACtD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,uBAAuB,CAAC,MAAM,EAC9B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerShareApi,\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicyPersistence\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../../../data/trustedUserIdentity\";\nimport { createGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"../../../organizations/groupMetadata/groupMetadataContainerAuthority\";\nimport { setOrganizationGroupContainerGrant } from \"../../../organizations/principalPolicy\";\nimport type { GroupPolicyNameReader } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport { preparePrincipalContainerRematerializationBatch } from \"../../../organizations/rematerialization/principalContainerRematerialization\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"../mutationSubmit\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport {\n  advanceVerifiedSharePolicies,\n  type ContainerManagedPrincipalShareApi,\n  loadVerifiedGroupSharePrincipalPolicy,\n} from \"./sharePrincipalPolicy\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\nclass ContainerShareGenerationExpiredError extends Error {}\n\nasync function buildCurrentContainerSharePlan(\n  input: Parameters<typeof buildMaterializedContainerSharePlan>[0],\n): Promise<MaterializedContainerSharePlan | null> {\n  return nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerSharePlan(input),\n  );\n}\n\nexport async function shareRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const recipientIdentity = await resolveTrustedUserIdentity(\n    input.recipientUserId,\n  );\n  if (!recipientIdentity || input.stillCurrent?.() === false) {\n    return null;\n  }\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    recipient: {\n      recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,\n      subjectId: input.recipientUserId,\n      subjectType: \"user\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n}\n\ninterface RemoteContainerGroupShareInput {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerManagedPrincipalShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /**\n   * The display name the user chose the group by, checked against the name\n   * committed in the verified group policy so a relabeled read-model row\n   * cannot redirect the share onto another group. `null` is reserved for the\n   * grant-preserving re-wrap: a share that would mint a new grant without a\n   * name is refused.\n   */\n  expectedGroupName: string | null;\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\ninterface RemoteContainerGroupShareResult {\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n}\n\nfunction isMaterializedContainerSharePlan(\n  value: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >[\"plans\"][number],\n): value is MaterializedContainerSharePlan {\n  return value.plan.body.eventType === \"container.grant\";\n}\n\nasync function prepareMissingGroupGrantMutations(input: {\n  currentPolicy: PrincipalPolicyBundleResponse;\n  nextPolicy: VerifiedPrincipalPolicy;\n  shareInput: RemoteContainerGroupShareInput;\n}) {\n  const { currentPolicy, nextPolicy, shareInput } = input;\n  return preparePrincipalContainerRematerializationBatch({\n    reportSecurityIncident: shareInput.reportSecurityIncident,\n    apiClient: shareInput.apiClient,\n    author: shareInput.author,\n    execSql: shareInput.execSql,\n    grants: [\n      ...new Map(\n        [...currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: shareInput.recipientGroupId,\n    nextPolicy,\n    resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,\n    stillCurrent: shareInput.stillCurrent,\n    targetSecretKey: shareInput.targetSecretKey,\n    warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,\n  });\n}\n\nasync function commitMissingGroupGrantPolicy(\n  input: RemoteContainerGroupShareInput,\n): Promise<{\n  preparedTarget: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >;\n  storedPolicy: Awaited<ReturnType<typeof setOrganizationGroupContainerGrant>>;\n} | null> {\n  const signingKeyPair = input.signingKeyPair;\n  if (!signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  const policyApi = {\n    recoverPendingPrincipalMutation:\n      input.apiClient.recoverPendingPrincipalMutation?.bind(input.apiClient),\n    commitOrganizationGroupPolicy:\n      input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),\n    getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(\n      input.apiClient,\n    ),\n  };\n  let preparedTarget:\n    | Awaited<\n        ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n      >\n    | undefined;\n  try {\n    const storedPolicy = await setOrganizationGroupContainerGrant({\n      accessLevel: input.accessLevel,\n      apiClient: policyApi,\n      assertCanCommit: () => {\n        if (input.stillCurrent?.() === false) {\n          throw new ContainerShareGenerationExpiredError();\n        }\n      },\n      containerId: input.containerId,\n      execSql: input.execSql,\n      groupId: input.recipientGroupId,\n      organizationId: input.author.organizationId,\n      prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {\n        preparedTarget = await prepareMissingGroupGrantMutations({\n          currentPolicy,\n          nextPolicy,\n          shareInput: input,\n        });\n        return preparedTarget;\n      },\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n      signerUserId: input.author.signerUserId,\n      signingFingerprint: input.author.signerKeyFingerprint,\n      signingKeyPair,\n    });\n    if (!preparedTarget) {\n      throw new Error(\"Container group share preparation is incomplete\");\n    }\n    return { preparedTarget, storedPolicy };\n  } catch (error) {\n    if (\n      error instanceof ContainerShareGenerationExpiredError ||\n      isProjectionVerificationCancelledError(error)\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n\nasync function commitMissingGroupGrant(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (!input.signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n  const committed = await commitMissingGroupGrantPolicy(input);\n  if (!committed) return null;\n  const { preparedTarget, storedPolicy } = committed;\n  const targetIndex = preparedTarget?.plans.findIndex(\n    (planned) => planned.plan.containerId === input.containerId,\n  );\n  const response =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : storedPolicy.containerMutations[targetIndex];\n  const targetPlan =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : preparedTarget?.plans[targetIndex];\n  if (\n    !targetPlan ||\n    !response ||\n    !isMaterializedContainerSharePlan(targetPlan)\n  ) {\n    throw new Error(\"Container group share acknowledgement is incomplete\");\n  }\n  return {\n    containerKey: targetPlan.containerKey,\n    plan: targetPlan.plan,\n    response,\n  };\n}\n\n// Only a re-wrap of an existing signed grant may run without the chosen name;\n// minting a grant is exactly the operation the name binding protects.\nfunction assertGrantMintNamed(expectedGroupName: string | null): void {\n  if (expectedGroupName === null) {\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  }\n}\n\nfunction loadShareGroupPolicy(input: RemoteContainerGroupShareInput) {\n  return loadVerifiedGroupSharePrincipalPolicy({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedGroupName: input.expectedGroupName ?? undefined,\n    readEncryptedName:\n      input.readEncryptedName ??\n      createGroupMetadataAccess({\n        ...input,\n        organizationId: input.author.organizationId,\n        verifyMetadataContainer: createGroupMetadataContainerVerifier({\n          ...input,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        }),\n      }).readName,\n    groupId: input.recipientGroupId,\n    organizationId: input.author.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function shareRemoteContainerWithGroup(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  await input.apiClient.recoverPendingPrincipalMutation?.(\n    input.author.organizationId,\n  );\n  if (input.stillCurrent?.() === false) return null;\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n  const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);\n  if (input.stillCurrent?.() === false) return null;\n  await advanceVerifiedSharePolicies(\n    input.execSql,\n    verifiedPrincipalPolicy,\n    input.stillCurrent,\n  );\n  if (input.stillCurrent?.() === false) return null;\n\n  const signedGrant = verifiedPrincipalPolicy.policy.grants.find(\n    (grant) => grant.containerId === input.containerId,\n  );\n  if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {\n    assertGrantMintNamed(input.expectedGroupName);\n    return commitMissingGroupGrant(input);\n  }\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    principalPolicyCache: principalPolicyCacheForVerifiedPolicies(\n      verifiedPrincipalPolicy.checkpointPolicies,\n    ),\n    previousProjection,\n    recipient: {\n      principalPolicy: verifiedPrincipalPolicy.policy,\n      subjectId: input.recipientGroupId,\n      subjectType: \"group\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  const result = await submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n  if (!result) return null;\n\n  // Keep the previously cached group epoch available until the old container\n  // wrap has been unwrapped and the replacement has committed. Root has no\n  // parent fallback, so caching the rotated policy any earlier destroys the\n  // only local path to the KEK that must be re-wrapped.\n  if (input.stillCurrent?.() !== false) {\n    await savePrincipalPolicyBundle(\n      input.execSql,\n      verifiedPrincipalPolicy.bundle,\n      new Date().toISOString(),\n      input.author.organizationId,\n      { stillCurrent: input.stillCurrent },\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n\n  return result;\n}\n"]}

package/workflows/containers/child/share/runtimeCurrentGroupShare.js

@@ -0,0 +1,79 @@
+import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
+import { principalPolicyCacheForVerifiedPolicies } from "../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
+import { inheritPrincipalHistoryProtection } from "../../../../data/principals/principalHistoryRuntime.js";
+import { createRuntimeCurrentGroupMutation } from "../../../organizations/principalMutations/runtimeCurrentGroupMutation.js";
+import { apiPrincipalPolicyPageReader, apiProjectionPolicyHistoryReader, } from "../../../principals/principalPolicyHistoryReader.js";
+import { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "../mutationSubmit.js";
+import { commitCurrentShareGrant } from "./currentShareGrantMutation.js";
+import { createRuntimeCurrentSharePrincipalPolicy } from "./currentSharePrincipalPolicy.js";
+import { buildMaterializedContainerSharePlan } from "./shareMaterialization.js";
+import { resolveShareProjection } from "./shareProjection.js";
+/** Current evidence covers planning, any compound grant mint, and acknowledgement. */
+export function createRuntimeCurrentGroupShare(runtime) {
+    const readCurrent = createRuntimeCurrentSharePrincipalPolicy(runtime);
+    const api = runtime.apiClient;
+    const historyReader = apiPrincipalPolicyPageReader(api);
+    if (!readCurrent || !historyReader)
+        return undefined;
+    const mutate = createRuntimeCurrentGroupMutation(inheritPrincipalHistoryProtection(runtime, {
+        ...runtime,
+        apiClient: {
+            ...historyReader,
+            ...apiProjectionPolicyHistoryReader(api),
+            recoverPendingPrincipalMutation: async (organizationId) => {
+                // Built-in clients supply journal recovery; standalone hosts retain
+                // responsibility for transport and exact-outcome recovery.
+                await api.recoverPendingPrincipalMutation?.(organizationId);
+            },
+        },
+    }));
+    if (!mutate)
+        throw new Error("Current group mutation custody is unavailable");
+    return async (input) => {
+        if (input.stillCurrent?.() === false)
+            return null;
+        const recitationStillCurrent = input.stillCurrent ?? (() => true);
+        return nullOnProjectionVerificationCancellation(() => readCurrent({
+            expectedGroupName: input.expectedGroupName ?? undefined,
+            groupId: input.recipientGroupId,
+            organizationId: input.author.organizationId,
+            stillCurrent: input.stillCurrent ?? (() => true),
+        }, async ({ policy, checkpointPolicies, stillCurrent }) => {
+            const share = { ...input, stillCurrent };
+            const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container share");
+            const previousProjection = await resolveShareProjection(share, resolveProjectionUserKey);
+            if (!previousProjection)
+                return null;
+            const grant = policy.grants.find((candidate) => candidate.containerId === input.containerId);
+            if (!grant || grant.accessLevel !== input.accessLevel)
+                return commitCurrentShareGrant({
+                    runtime,
+                    share,
+                    mutate,
+                    recitationStillCurrent,
+                });
+            const materialized = await buildMaterializedContainerSharePlan({
+                ...share,
+                previousProjection,
+                principalPolicyCache: principalPolicyCacheForVerifiedPolicies(checkpointPolicies),
+                recipient: {
+                    principalPolicy: policy,
+                    subjectId: input.recipientGroupId,
+                    subjectType: "group",
+                },
+                resolveProjectionUserKey,
+            });
+            return submitAcknowledgedContainerMutation({
+                ...share,
+                recitationPolicies: checkpointPolicies,
+                recitationStillCurrent,
+                containerKey: materialized.containerKey,
+                plan: materialized.plan,
+                submit: () => submitPlainContainerMutation(() => input.apiClient.shareContainer(input.containerId, materialized.plan.request, {
+                    expectedPaymentRequiredOrganizationId: input.author.organizationId,
+                })),
+            });
+        }));
+    };
+}
+//# sourceMappingURL=runtimeCurrentGroupShare.js.map

package/workflows/containers/child/share/runtimeCurrentGroupShare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCurrentGroupShare.js","sourceRoot":"","sources":["runtimeCurrentGroupShare.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AACxG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AAEzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,UAAU,8BAA8B,CAC5C,OAAuE;IAEvE,MAAM,WAAW,GAAG,wCAAwC,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9B,MAAM,aAAa,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG,iCAAiC,CAC9C,iCAAiC,CAAC,OAAO,EAAE;QACzC,GAAG,OAAO;QACV,SAAS,EAAE;YACT,GAAG,aAAa;YAChB,GAAG,gCAAgC,CAAC,GAAG,CAAC;YACxC,+BAA+B,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;gBAChE,oEAAoE;gBACpE,2DAA2D;gBAC3D,MAAM,GAAG,CAAC,+BAA+B,EAAE,CAAC,cAAc,CAAC,CAAC;YAC9D,CAAC;SACF;KACF,CAAC,CACH,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,sBAAsB,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,WAAW,CACT;YACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;YACvD,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACjD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC;YACzC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;YACF,IAAI,CAAC,kBAAkB;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC3D,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACnD,OAAO,uBAAuB,CAAC;oBAC7B,OAAO;oBACP,KAAK;oBACL,MAAM;oBACN,sBAAsB;iBACvB,CAAC,CAAC;YACL,MAAM,YAAY,GAAG,MAAM,mCAAmC,CAAC;gBAC7D,GAAG,KAAK;gBACR,kBAAkB;gBAClB,oBAAoB,EAClB,uCAAuC,CAAC,kBAAkB,CAAC;gBAC7D,SAAS,EAAE;oBACT,eAAe,EAAE,MAAM;oBACvB,SAAS,EAAE,KAAK,CAAC,gBAAgB;oBACjC,WAAW,EAAE,OAAO;iBACrB;gBACD,wBAAwB;aACzB,CAAC,CAAC;YACH,OAAO,mCAAmC,CAAC;gBACzC,GAAG,KAAK;gBACR,kBAAkB,EAAE,kBAAkB;gBACtC,sBAAsB;gBACtB,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,YAAY,CAAC,IAAI,CAAC,OAAO,EACzB;oBACE,qCAAqC,EACnC,KAAK,CAAC,MAAM,CAAC,cAAc;iBAC9B,CACF,CACF;aACJ,CAAC,CAAC;QACL,CAAC,CACF,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  nullOnProjectionVerificationCancellation,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { inheritPrincipalHistoryProtection } from \"../../../../data/principals/principalHistoryRuntime\";\nimport { createRuntimeCurrentGroupMutation } from \"../../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport {\n  apiPrincipalPolicyPageReader,\n  apiProjectionPolicyHistoryReader,\n} from \"../../../principals/principalPolicyHistoryReader\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"../mutationSubmit\";\nimport { commitCurrentShareGrant } from \"./currentShareGrantMutation\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./index\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\n/** Current evidence covers planning, any compound grant mint, and acknowledgement. */\nexport function createRuntimeCurrentGroupShare(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n): typeof shareRemoteContainerWithGroup | undefined {\n  const readCurrent = createRuntimeCurrentSharePrincipalPolicy(runtime);\n  const api = runtime.apiClient;\n  const historyReader = apiPrincipalPolicyPageReader(api);\n  if (!readCurrent || !historyReader) return undefined;\n  const mutate = createRuntimeCurrentGroupMutation(\n    inheritPrincipalHistoryProtection(runtime, {\n      ...runtime,\n      apiClient: {\n        ...historyReader,\n        ...apiProjectionPolicyHistoryReader(api),\n        recoverPendingPrincipalMutation: async (organizationId: string) => {\n          // Built-in clients supply journal recovery; standalone hosts retain\n          // responsibility for transport and exact-outcome recovery.\n          await api.recoverPendingPrincipalMutation?.(organizationId);\n        },\n      },\n    }),\n  );\n  if (!mutate) throw new Error(\"Current group mutation custody is unavailable\");\n  return async (input) => {\n    if (input.stillCurrent?.() === false) return null;\n    const recitationStillCurrent = input.stillCurrent ?? (() => true);\n    return nullOnProjectionVerificationCancellation(() =>\n      readCurrent(\n        {\n          expectedGroupName: input.expectedGroupName ?? undefined,\n          groupId: input.recipientGroupId,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        },\n        async ({ policy, checkpointPolicies, stillCurrent }) => {\n          const share = { ...input, stillCurrent };\n          const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n            input.resolveProjectionUserKey,\n            \"Remote container share\",\n          );\n          const previousProjection = await resolveShareProjection(\n            share,\n            resolveProjectionUserKey,\n          );\n          if (!previousProjection) return null;\n          const grant = policy.grants.find(\n            (candidate) => candidate.containerId === input.containerId,\n          );\n          if (!grant || grant.accessLevel !== input.accessLevel)\n            return commitCurrentShareGrant({\n              runtime,\n              share,\n              mutate,\n              recitationStillCurrent,\n            });\n          const materialized = await buildMaterializedContainerSharePlan({\n            ...share,\n            previousProjection,\n            principalPolicyCache:\n              principalPolicyCacheForVerifiedPolicies(checkpointPolicies),\n            recipient: {\n              principalPolicy: policy,\n              subjectId: input.recipientGroupId,\n              subjectType: \"group\",\n            },\n            resolveProjectionUserKey,\n          });\n          return submitAcknowledgedContainerMutation({\n            ...share,\n            recitationPolicies: checkpointPolicies,\n            recitationStillCurrent,\n            containerKey: materialized.containerKey,\n            plan: materialized.plan,\n            submit: () =>\n              submitPlainContainerMutation(() =>\n                input.apiClient.shareContainer(\n                  input.containerId,\n                  materialized.plan.request,\n                  {\n                    expectedPaymentRequiredOrganizationId:\n                      input.author.organizationId,\n                  },\n                ),\n              ),\n          });\n        },\n      ),\n    );\n  };\n}\n"]}

package/workflows/containers/child/share/shareAncestorRepair.js

@@ -0,0 +1,95 @@
+import { ContainerAuthorAccessError } from "../../../../data/containers/shared/authorAccess.js";
+import { ContainerKekRepairInaccessibleError } from "../../../../data/documents/shared/containerKekCurrency.js";
+import { ContainerKekTargetUnreachableError } from "../../../../data/documents/shared/containerKekPath.js";
+import { rekeyRemoteContainer } from "../rekey/rekeyRemote.js";
+function carriesDirectGrant(projection) {
+    const directGrants = Reflect.get(Object(projection.path.at(-1)?.state), "directGrants");
+    return Array.isArray(directGrants) && directGrants.length > 0;
+}
+/** The first level on the path, the container included, pinning a retired epoch. */
+function firstStaleLevelId(projection) {
+    const keks = projection.containerKeks;
+    for (let index = 1; index < keks.length; index += 1) {
+        const kek = keks[index];
+        if (kek &&
+            kek.parentContainerKeyEpochId !== keks[index - 1]?.containerKeyEpochId) {
+            return kek.containerId;
+        }
+    }
+    return null;
+}
+/**
+ * Repair a stale path down to and including a container before granting on it
+ * (#2340).
+ *
+ * A chain with no grant beneath it may sit lazily stale after an ancestor
+ * rotation, since nobody's writes depend on it. The first grant changes that:
+ * its grantee could never re-key the levels above its container, so the server
+ * refuses a first grant below a stale chain. The container's own edge must be
+ * current too, because a grant cites the parent's current epoch and the
+ * container's key epoch has to pin it. The sharer administers the container
+ * through a grant at or above it, and the levels above that grant are already
+ * current, so every stale level here is one the sharer can re-key. These
+ * repairs are standalone and need not be atomic with the grant: a repair never
+ * strands anyone.
+ *
+ * Every share does this, not only a first grant, which is all the server
+ * insists on. A container that already carries a grant is stale only past the
+ * carried-rekey cap, and its grantees are then parked behind exactly these
+ * levels; the sharer is already here and able.
+ */
+export async function projectionWithCurrentAncestors(input) {
+    const { rekeyContainer, rekeyContainerResult } = input.apiClient;
+    let projection = input.previousProjection;
+    // Each round repairs one level, and a path has a bounded number of them.
+    for (let round = 0; round < projection.containerKeks.length; round += 1) {
+        const staleLevelId = firstStaleLevelId(projection);
+        if (staleLevelId === null)
+            return projection;
+        if (!rekeyContainer) {
+            // Not a repair someone else owes: the adapter simply cannot make one.
+            throw new Error("Container share must re-key a stale path, which needs rekeyContainer");
+        }
+        // This sharer may be unable to re-key a level above a container that
+        // already carries a grant, stale past the carried-rekey cap. The server
+        // asks a current chain only of a first grant, so it decides rather than
+        // this blocking a grant it would accept.
+        const serverDecides = staleLevelId !== input.containerId && carriesDirectGrant(projection);
+        const repaired = await rekeyRemoteContainer({
+            apiClient: {
+                getContainerWriterProjection: (containerId) => input.apiClient.getContainerWriterProjection(containerId),
+                reciteContainer: (...args) => input.apiClient.reciteContainer(...args),
+                rekeyContainer: rekeyContainer.bind(input.apiClient),
+                ...(rekeyContainerResult
+                    ? { rekeyContainerResult: rekeyContainerResult.bind(input.apiClient) }
+                    : {}),
+            },
+            author: input.author,
+            containerId: staleLevelId,
+            execSql: input.execSql,
+            reportSecurityIncident: input.reportSecurityIncident,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            stillCurrent: input.stillCurrent,
+            targetSecretKey: input.targetSecretKey,
+            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+        }).catch((error) => {
+            const outOfReach = error instanceof ContainerAuthorAccessError ||
+                error instanceof ContainerKekTargetUnreachableError;
+            if (outOfReach && serverDecides)
+                return null;
+            throw outOfReach
+                ? new ContainerKekRepairInaccessibleError(staleLevelId)
+                : error;
+        });
+        if (input.stillCurrent?.() === false)
+            return null;
+        if (!repaired)
+            return serverDecides ? projection : null;
+        const refreshed = await input.apiClient.getContainerWriterProjection(input.containerId);
+        if (!refreshed)
+            return null;
+        projection = refreshed;
+    }
+    return firstStaleLevelId(projection) === null ? projection : null;
+}
+//# sourceMappingURL=shareAncestorRepair.js.map

package/workflows/containers/child/share/shareAncestorRepair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareAncestorRepair.js","sourceRoot":"","sources":["shareAncestorRepair.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAM7F,OAAO,EAAE,mCAAmC,EAAE,MAAM,wDAAwD,CAAC;AAC7G,OAAO,EAAE,kCAAkC,EAAE,MAAM,oDAAoD,CAAC;AAOxG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,SAAS,kBAAkB,CACzB,UAA6C;IAE7C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EACrC,cAAc,CACf,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,oFAAoF;AACpF,SAAS,iBAAiB,CACxB,UAA6C;IAE7C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IACE,GAAG;YACH,GAAG,CAAC,yBAAyB,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,mBAAmB,EACtE,CAAC;YACD,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAYpD;IACC,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IACjE,IAAI,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAC1C,yEAAyE;IACzE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC7C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,aAAa,GACjB,YAAY,KAAK,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,SAAS,EAAE;gBACT,4BAA4B,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5C,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC;gBAC3D,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;gBACtE,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;gBACpD,GAAG,CAAC,oBAAoB;oBACtB,CAAC,CAAC,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;oBACtE,CAAC,CAAC,EAAE,CAAC;aACR;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,YAAY;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,MAAM,UAAU,GACd,KAAK,YAAY,0BAA0B;gBAC3C,KAAK,YAAY,kCAAkC,CAAC;YACtD,IAAI,UAAU,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC;YAC7C,MAAM,UAAU;gBACd,CAAC,CAAC,IAAI,mCAAmC,CAAC,YAAY,CAAC;gBACvD,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAClE,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { ContainerAuthorAccessError } from \"../../../../data/containers/shared/authorAccess\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  ContainerShareApi,\n} from \"../../../../data/containers/shared/types\";\nimport { ContainerKekRepairInaccessibleError } from \"../../../../data/documents/shared/containerKekCurrency\";\nimport { ContainerKekTargetUnreachableError } from \"../../../../data/documents/shared/containerKekPath\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { rekeyRemoteContainer } from \"../rekey/rekeyRemote\";\n\nfunction carriesDirectGrant(\n  projection: ContainerWriterProjectionResponse,\n): boolean {\n  const directGrants = Reflect.get(\n    Object(projection.path.at(-1)?.state),\n    \"directGrants\",\n  );\n  return Array.isArray(directGrants) && directGrants.length > 0;\n}\n\n/** The first level on the path, the container included, pinning a retired epoch. */\nfunction firstStaleLevelId(\n  projection: ContainerWriterProjectionResponse,\n): string | null {\n  const keks = projection.containerKeks;\n  for (let index = 1; index < keks.length; index += 1) {\n    const kek = keks[index];\n    if (\n      kek &&\n      kek.parentContainerKeyEpochId !== keks[index - 1]?.containerKeyEpochId\n    ) {\n      return kek.containerId;\n    }\n  }\n  return null;\n}\n\n/**\n * Repair a stale path down to and including a container before granting on it\n * (#2340).\n *\n * A chain with no grant beneath it may sit lazily stale after an ancestor\n * rotation, since nobody's writes depend on it. The first grant changes that:\n * its grantee could never re-key the levels above its container, so the server\n * refuses a first grant below a stale chain. The container's own edge must be\n * current too, because a grant cites the parent's current epoch and the\n * container's key epoch has to pin it. The sharer administers the container\n * through a grant at or above it, and the levels above that grant are already\n * current, so every stale level here is one the sharer can re-key. These\n * repairs are standalone and need not be atomic with the grant: a repair never\n * strands anyone.\n *\n * Every share does this, not only a first grant, which is all the server\n * insists on. A container that already carries a grant is stale only past the\n * carried-rekey cap, and its grantees are then parked behind exactly these\n * levels; the sharer is already here and able.\n */\nexport async function projectionWithCurrentAncestors(input: {\n  apiClient: ContainerShareApi &\n    Partial<Pick<ContainerRekeyApi, \"rekeyContainer\" | \"rekeyContainerResult\">>;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  execSql: ExecSql;\n  previousProjection: ContainerWriterProjectionResponse;\n  reportSecurityIncident: SecurityIncidentReporter;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<ContainerWriterProjectionResponse | null> {\n  const { rekeyContainer, rekeyContainerResult } = input.apiClient;\n  let projection = input.previousProjection;\n  // Each round repairs one level, and a path has a bounded number of them.\n  for (let round = 0; round < projection.containerKeks.length; round += 1) {\n    const staleLevelId = firstStaleLevelId(projection);\n    if (staleLevelId === null) return projection;\n    if (!rekeyContainer) {\n      // Not a repair someone else owes: the adapter simply cannot make one.\n      throw new Error(\n        \"Container share must re-key a stale path, which needs rekeyContainer\",\n      );\n    }\n    // This sharer may be unable to re-key a level above a container that\n    // already carries a grant, stale past the carried-rekey cap. The server\n    // asks a current chain only of a first grant, so it decides rather than\n    // this blocking a grant it would accept.\n    const serverDecides =\n      staleLevelId !== input.containerId && carriesDirectGrant(projection);\n    const repaired = await rekeyRemoteContainer({\n      apiClient: {\n        getContainerWriterProjection: (containerId) =>\n          input.apiClient.getContainerWriterProjection(containerId),\n        reciteContainer: (...args) => input.apiClient.reciteContainer(...args),\n        rekeyContainer: rekeyContainer.bind(input.apiClient),\n        ...(rekeyContainerResult\n          ? { rekeyContainerResult: rekeyContainerResult.bind(input.apiClient) }\n          : {}),\n      },\n      author: input.author,\n      containerId: staleLevelId,\n      execSql: input.execSql,\n      reportSecurityIncident: input.reportSecurityIncident,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      targetSecretKey: input.targetSecretKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }).catch((error: unknown) => {\n      const outOfReach =\n        error instanceof ContainerAuthorAccessError ||\n        error instanceof ContainerKekTargetUnreachableError;\n      if (outOfReach && serverDecides) return null;\n      throw outOfReach\n        ? new ContainerKekRepairInaccessibleError(staleLevelId)\n        : error;\n    });\n    if (input.stillCurrent?.() === false) return null;\n    if (!repaired) return serverDecides ? projection : null;\n    const refreshed = await input.apiClient.getContainerWriterProjection(\n      input.containerId,\n    );\n    if (!refreshed) return null;\n    projection = refreshed;\n  }\n  return firstStaleLevelId(projection) === null ? projection : null;\n}\n"]}

package/workflows/containers/child/share/shareMaterialization.d.ts

@@ -0,0 +1,25 @@
+import type { ContainerAccessLevel } from "../../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, MaterializedContainerSharePlan } from "../../../../data/containers/shared/types.js";
+import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+import { type ContainerShareRecipient } from "./sharePlanCore.js";
+interface BuildMaterializedContainerSharePlanInput {
+    accessLevel: ContainerAccessLevel;
+    author: ContainerMutationAuthor;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    /** False for a projection re-rooted on rotations not yet acknowledged. */
+    persistVerificationCheckpoints?: boolean | undefined;
+    principalPolicyCache?: PrincipalPolicyCache | undefined;
+    previousProjection: ContainerWriterProjectionResponse;
+    recipient: ContainerShareRecipient;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+export declare function buildMaterializedContainerSharePlan(input: BuildMaterializedContainerSharePlanInput): Promise<MaterializedContainerSharePlan>;
+export {};

package/workflows/containers/child/share/shareMaterialization.js

@@ -0,0 +1,164 @@
+import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
+import { signContainerMutationEvent } from "../../../../data/containers/shared/events.js";
+import { asContainerManifestBundle, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToRootUser, } from "../../../../data/containers/shared/projection.js";
+import { readContainerKeyWraps } from "../../../../data/containers/shared/readers.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../../data/documents/shared/types.js";
+import { requireUnwrappedKek } from "../rotation/rotationContext.js";
+import { buildContainerSharePlanResult, collectContainerSharePrincipalPolicies, collectShareUserRecipientKeys, deriveContainerShareManifest, referencedPrincipalHeadFromPolicy, replaceContainerWrap, shareManifestHistory, } from "./sharePlanCore.js";
+async function materializeRecipientWrap(input) {
+    if (input.recipient.subjectType === "user") {
+        const shareRecipient = await wrapContainerKeyToRootUser({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            recipientEncapsulationPublicKey: input.recipient.recipientEncapsulationPublicKey,
+            userId: input.recipient.subjectId,
+        });
+        return {
+            recipientTarget: shareRecipient.recipientTarget,
+            userRecipientKeys: collectShareUserRecipientKeys({
+                newUserRecipientKey: shareRecipient.userRecipientKey,
+                state: input.state,
+                targetKek: input.targetKek,
+            }),
+            wrap: shareRecipient.wrap,
+        };
+    }
+    const shareRecipient = await wrapContainerKeyToManagedPrincipal({
+        containerKey: input.containerKey,
+        containerKeyEpochId: input.containerKeyEpochId,
+        manifestHash: input.manifestHash,
+        principalEncapsulationPublicKey: input.recipient.principalPolicy.state.encapsulationPublicKey,
+        principalHead: referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy),
+    });
+    return {
+        recipientTarget: shareRecipient.recipientTarget,
+        userRecipientKeys: collectShareUserRecipientKeys({
+            state: input.state,
+            targetKek: input.targetKek,
+        }),
+        wrap: shareRecipient.wrap,
+    };
+}
+async function buildShareTransition(input) {
+    const previousState = readContainerState(input.targetManifest);
+    if (previousState.organizationId !== input.author.organizationId) {
+        throw new Error("Container share author organization mismatch");
+    }
+    const grant = {
+        accessLevel: input.accessLevel,
+        subjectId: input.recipient.subjectId,
+        subjectType: input.recipient.subjectType,
+    };
+    const referencedPrincipalHead = input.recipient.subjectType === "user"
+        ? null
+        : referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy);
+    const body = {
+        eventType: "container.grant",
+        containerKeyEpochId: previousState.containerKeyEpochId,
+        containerKeyPublicKey: previousState.containerKeyPublicKey,
+        grant,
+        referencedPrincipalHead,
+    };
+    const { event, eventHash } = await signContainerMutationEvent({
+        author: input.author,
+        body,
+        containerId: previousState.containerId,
+        dependencyManifestHashes: uniqueSortedManifestHashes(input.previousProjection.path),
+        eventId: input.eventId ?? crypto.randomUUID(),
+        previousManifestHash: input.targetManifest.manifestHash,
+        signedAt: input.signedAt ?? new Date().toISOString(),
+    });
+    const manifestTransition = await deriveContainerShareManifest({
+        eventHash,
+        grant,
+        previousManifest: input.targetManifest,
+        referencedPrincipalHead,
+    });
+    return {
+        body,
+        event,
+        eventHash,
+        grant,
+        previousState,
+        ...manifestTransition,
+    };
+}
+async function collectAuthorizedSharePolicies(input) {
+    const principalPolicies = await collectContainerSharePrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        previousProjection: input.previousProjection,
+        ...(input.recipient.subjectType === "user"
+            ? {}
+            : { recipientPolicy: input.recipient.principalPolicy }),
+        resolveUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    assertContainerAuthorAccess({
+        author: input.author,
+        projection: input.previousProjection,
+        principalPolicies,
+        minimumAccess: "admin",
+    });
+    return principalPolicies;
+}
+export async function buildMaterializedContainerSharePlan(input) {
+    const keksByEpochId = await unwrapContainerKekPath({
+        execSql: input.execSql,
+        knownContainerKeks: input.knownContainerKeks,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        secretKey: input.targetSecretKey,
+        ...projectionVerificationOptions(input),
+    });
+    const principalPolicies = await collectAuthorizedSharePolicies(input);
+    const target = getTargetContainerContext(input.previousProjection);
+    const { body, event, eventHash, grant, manifest, manifestHash, previousState, state, } = await buildShareTransition({
+        accessLevel: input.accessLevel,
+        author: input.author,
+        eventId: input.eventId,
+        previousProjection: input.previousProjection,
+        recipient: input.recipient,
+        signedAt: input.signedAt,
+        targetManifest: target.manifest,
+    });
+    const containerKey = requireUnwrappedKek(keksByEpochId, target.kek, "Container share target");
+    const { recipientTarget, userRecipientKeys, wrap } = await materializeRecipientWrap({
+        containerKey,
+        containerKeyEpochId: target.kek.containerKeyEpochId,
+        manifestHash,
+        recipient: input.recipient,
+        state,
+        targetKek: target.kek,
+    });
+    const previousWraps = readContainerKeyWraps(target.kek.wraps, "Container share previous wraps");
+    return buildContainerSharePlanResult({
+        body,
+        containerManifestHistory: shareManifestHistory({
+            containerId: previousState.containerId,
+            targetKek: target.kek,
+            targetManifest: target.manifest,
+        }),
+        containerKey,
+        containerId: previousState.containerId,
+        event,
+        eventHash,
+        grant,
+        manifest,
+        manifestHash,
+        previousManifest: asContainerManifestBundle(target.manifest),
+        previousProjection: input.previousProjection,
+        principalPolicies,
+        recipientTarget,
+        state,
+        targetKek: target.kek,
+        userRecipientKeys,
+        wraps: replaceContainerWrap(previousWraps, wrap),
+    });
+}
+//# sourceMappingURL=shareMaterialization.js.map

package/workflows/containers/child/share/shareMaterialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareMaterialization.js","sourceRoot":"","sources":["shareMaterialization.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAOxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,6BAA6B,EAE7B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,KAAK,UAAU,wBAAwB,CAAC,KAOvC;IAKC,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC;YACtD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B;YACjD,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,cAAc,CAAC,eAAe;YAC/C,iBAAiB,EAAE,6BAA6B,CAAC;gBAC/C,mBAAmB,EAAE,cAAc,CAAC,gBAAgB;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YACF,IAAI,EAAE,cAAc,CAAC,IAAI;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,sBAAsB;QAC9D,aAAa,EAAE,iCAAiC,CAC9C,KAAK,CAAC,SAAS,CAAC,eAAe,CAChC;KACF,CAAC,CAAC;IACH,OAAO;QACL,eAAe,EAAE,cAAc,CAAC,eAAe;QAC/C,iBAAiB,EAAE,6BAA6B,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,EAAE,cAAc,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAoBD,KAAK,UAAU,oBAAoB,CAAC,KAQnC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAyB;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;QACpC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;KACzC,CAAC;IACF,MAAM,uBAAuB,GAC3B,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;QACpC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,KAAK;QACL,uBAAuB;KACxB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,YAAY;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,4BAA4B,CAAC;QAC5D,SAAS;QACT,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,cAAc;QACtC,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,KAAK;QACL,SAAS;QACT,KAAK;QACL,aAAa;QACb,GAAG,kBAAkB;KACtB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAA+C;IAE/C,MAAM,iBAAiB,GAAG,MAAM,sCAAsC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA+C;IAE/C,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,EACJ,IAAI,EACJ,KAAK,EACL,SAAS,EACT,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,KAAK,GACN,GAAG,MAAM,oBAAoB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAChD,MAAM,wBAAwB,CAAC;QAC7B,YAAY;QACZ,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACnD,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;KACtB,CAAC,CAAC;IACL,MAAM,aAAa,GAAG,qBAAqB,CACzC,MAAM,CAAC,GAAG,CAAC,KAAK,EAChB,gCAAgC,CACjC,CAAC;IAEF,OAAO,6BAA6B,CAAC;QACnC,IAAI;QACJ,wBAAwB,EAAE,oBAAoB,CAAC;YAC7C,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;SAChC,CAAC;QACF,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,KAAK;QACL,SAAS;QACT,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,eAAe;QACf,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,iBAAiB;QACjB,KAAK,EAAE,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerKekRecipientTarget,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { signContainerMutationEvent } from \"../../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  getTargetContainerContext,\n  readContainerState,\n  uniqueSortedManifestHashes,\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToRootUser,\n} from \"../../../../data/containers/shared/projection\";\nimport { readContainerKeyWraps } from \"../../../../data/containers/shared/readers\";\nimport type {\n  ContainerMutationAuthor,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../../data/documents/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { requireUnwrappedKek } from \"../rotation/rotationContext\";\nimport {\n  buildContainerSharePlanResult,\n  type ContainerShareRecipient,\n  collectContainerSharePrincipalPolicies,\n  collectShareUserRecipientKeys,\n  deriveContainerShareManifest,\n  referencedPrincipalHeadFromPolicy,\n  replaceContainerWrap,\n  shareManifestHistory,\n} from \"./sharePlanCore\";\n\nasync function materializeRecipientWrap(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  recipient: ContainerShareRecipient;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): Promise<{\n  recipientTarget: ContainerKekRecipientTarget;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wrap: ContainerKeyWrap;\n}> {\n  if (input.recipient.subjectType === \"user\") {\n    const shareRecipient = await wrapContainerKeyToRootUser({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      recipientEncapsulationPublicKey:\n        input.recipient.recipientEncapsulationPublicKey,\n      userId: input.recipient.subjectId,\n    });\n    return {\n      recipientTarget: shareRecipient.recipientTarget,\n      userRecipientKeys: collectShareUserRecipientKeys({\n        newUserRecipientKey: shareRecipient.userRecipientKey,\n        state: input.state,\n        targetKek: input.targetKek,\n      }),\n      wrap: shareRecipient.wrap,\n    };\n  }\n\n  const shareRecipient = await wrapContainerKeyToManagedPrincipal({\n    containerKey: input.containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    manifestHash: input.manifestHash,\n    principalEncapsulationPublicKey:\n      input.recipient.principalPolicy.state.encapsulationPublicKey,\n    principalHead: referencedPrincipalHeadFromPolicy(\n      input.recipient.principalPolicy,\n    ),\n  });\n  return {\n    recipientTarget: shareRecipient.recipientTarget,\n    userRecipientKeys: collectShareUserRecipientKeys({\n      state: input.state,\n      targetKek: input.targetKek,\n    }),\n    wrap: shareRecipient.wrap,\n  };\n}\n\ninterface BuildMaterializedContainerSharePlanInput {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /** False for a projection re-rooted on rotations not yet acknowledged. */\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nasync function buildShareTransition(input: {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  signedAt?: string | undefined;\n  targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}) {\n  const previousState = readContainerState(input.targetManifest);\n  if (previousState.organizationId !== input.author.organizationId) {\n    throw new Error(\"Container share author organization mismatch\");\n  }\n  const grant: ContainerDirectGrant = {\n    accessLevel: input.accessLevel,\n    subjectId: input.recipient.subjectId,\n    subjectType: input.recipient.subjectType,\n  };\n  const referencedPrincipalHead =\n    input.recipient.subjectType === \"user\"\n      ? null\n      : referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy);\n  const body: ContainerGrantAccessEventBody = {\n    eventType: \"container.grant\",\n    containerKeyEpochId: previousState.containerKeyEpochId,\n    containerKeyPublicKey: previousState.containerKeyPublicKey,\n    grant,\n    referencedPrincipalHead,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.targetManifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const manifestTransition = await deriveContainerShareManifest({\n    eventHash,\n    grant,\n    previousManifest: input.targetManifest,\n    referencedPrincipalHead,\n  });\n  return {\n    body,\n    event,\n    eventHash,\n    grant,\n    previousState,\n    ...manifestTransition,\n  };\n}\n\nasync function collectAuthorizedSharePolicies(\n  input: BuildMaterializedContainerSharePlanInput,\n) {\n  const principalPolicies = await collectContainerSharePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    previousProjection: input.previousProjection,\n    ...(input.recipient.subjectType === \"user\"\n      ? {}\n      : { recipientPolicy: input.recipient.principalPolicy }),\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  return principalPolicies;\n}\n\nexport async function buildMaterializedContainerSharePlan(\n  input: BuildMaterializedContainerSharePlanInput,\n): Promise<MaterializedContainerSharePlan> {\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const principalPolicies = await collectAuthorizedSharePolicies(input);\n  const target = getTargetContainerContext(input.previousProjection);\n  const {\n    body,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousState,\n    state,\n  } = await buildShareTransition({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    previousProjection: input.previousProjection,\n    recipient: input.recipient,\n    signedAt: input.signedAt,\n    targetManifest: target.manifest,\n  });\n  const containerKey = requireUnwrappedKek(\n    keksByEpochId,\n    target.kek,\n    \"Container share target\",\n  );\n  const { recipientTarget, userRecipientKeys, wrap } =\n    await materializeRecipientWrap({\n      containerKey,\n      containerKeyEpochId: target.kek.containerKeyEpochId,\n      manifestHash,\n      recipient: input.recipient,\n      state,\n      targetKek: target.kek,\n    });\n  const previousWraps = readContainerKeyWraps(\n    target.kek.wraps,\n    \"Container share previous wraps\",\n  );\n\n  return buildContainerSharePlanResult({\n    body,\n    containerManifestHistory: shareManifestHistory({\n      containerId: previousState.containerId,\n      targetKek: target.kek,\n      targetManifest: target.manifest,\n    }),\n    containerKey,\n    containerId: previousState.containerId,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies,\n    recipientTarget,\n    state,\n    targetKek: target.kek,\n    userRecipientKeys,\n    wraps: replaceContainerWrap(previousWraps, wrap),\n  });\n}\n"]}

package/workflows/containers/child/share/sharePlanCore.d.ts

@@ -0,0 +1,82 @@
+import { type AccessEvent, type AccessManifest, type ContainerAccessManifestState, type ContainerDirectGrant, type ContainerGrantAccessEventBody, type ContainerGrantPrincipalHead, type ContainerKekRecipientTarget, type ContainerKeyWrap, type ContainerUserRecipientKey } from "../../../../internal/crypto/index.js";
+import type { AccessManifestBundleWire } from "../../../../internal/validators/request/index.js";
+import type { ContainerKekResponse, ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerSharePlan, MaterializedContainerSharePlan } from "../../../../data/containers/shared/types.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { PrincipalPolicyCurrentEvidence } from "../../../../data/principals/principalPolicyEvidence.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+export type ContainerShareRecipient = {
+    readonly recipientEncapsulationPublicKey: Uint8Array;
+    readonly subjectId: string;
+    readonly subjectType: "user";
+} | {
+    readonly principalPolicy: PrincipalPolicyCurrentEvidence;
+    readonly subjectId: string;
+    readonly subjectType: "group";
+};
+export declare function referencedPrincipalHeadFromPolicy(policy: PrincipalPolicyCurrentEvidence): ContainerGrantPrincipalHead;
+/**
+ * The previous manifest's referenced principal heads with the replacement
+ * policy's head upserted in place of any stale head for the same principal.
+ * A rekey substitutes references and never adds one: a manifest may reference
+ * only principals it grants, so a replacement for one it does not grant —
+ * a carried rekey below the container the policy is granted on — is left out.
+ */
+export declare function refreshedPrincipalReferences(input: {
+    readonly previousState: ContainerAccessManifestState;
+    readonly replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
+}): ContainerGrantPrincipalHead[];
+/**
+ * The previous policies with the replacement policy substituted for any
+ * existing policy of the same principal identity.
+ */
+export declare function refreshedPrincipalPolicies(input: {
+    readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];
+    readonly replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
+}): PrincipalPolicyCurrentEvidence[];
+export declare function deriveContainerShareManifest(input: {
+    eventHash: string;
+    grant: ContainerDirectGrant;
+    previousManifest: ContainerWriterProjectionResponse["path"][number];
+    referencedPrincipalHead: ContainerGrantPrincipalHead | null;
+}): Promise<Pick<ContainerSharePlan, "manifest" | "manifestHash" | "state">>;
+export declare function replaceContainerWrap(wraps: readonly ContainerKeyWrap[], nextWrap: ContainerKeyWrap): ContainerKeyWrap[];
+export declare function shareManifestHistory(input: {
+    readonly containerId: string;
+    readonly targetKek: ContainerKekResponse;
+    readonly targetManifest: ContainerWriterProjectionResponse["path"][number];
+}): AccessManifestBundleWire[];
+export declare function buildContainerSharePlanResult(input: {
+    body: ContainerGrantAccessEventBody;
+    containerManifestHistory: readonly AccessManifestBundleWire[];
+    containerId: string;
+    containerKey: Uint8Array;
+    event: AccessEvent;
+    eventHash: string;
+    grant: ContainerDirectGrant;
+    manifest: AccessManifest;
+    manifestHash: string;
+    previousManifest: AccessManifestBundleWire;
+    previousProjection: ContainerWriterProjectionResponse;
+    principalPolicies: readonly PrincipalPolicyCurrentEvidence[];
+    recipientTarget: ContainerKekRecipientTarget;
+    state: ContainerAccessManifestState;
+    targetKek: ContainerKekResponse;
+    userRecipientKeys: ContainerUserRecipientKey[];
+    wraps: ContainerKeyWrap[];
+}): MaterializedContainerSharePlan;
+export declare function collectShareUserRecipientKeys(input: {
+    newUserRecipientKey?: ContainerUserRecipientKey | undefined;
+    state: ContainerAccessManifestState;
+    targetKek: ContainerKekResponse;
+}): ContainerUserRecipientKey[];
+export declare function collectContainerSharePrincipalPolicies(input: {
+    execSql: ExecSql;
+    persistVerificationCheckpoints?: boolean | undefined;
+    principalPolicyCache?: PrincipalPolicyCache | undefined;
+    previousProjection: ContainerWriterProjectionResponse;
+    recipientPolicy?: PrincipalPolicyCurrentEvidence | undefined;
+    resolveUserKey: ProjectionUserKeyResolver;
+    stillCurrent?: (() => boolean) | undefined;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<PrincipalPolicyCurrentEvidence[]>;