@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/containers/child/share/sharePlanCore.js

@@ -0,0 +1,191 @@
+import { computeAccessManifestHash, deriveContainerAccessManifest, } from "../../../../internal/crypto/index.js";
+import { uniquePrincipalPolicies } from "../../../../data/containers/shared/principalPolicies.js";
+import { asContainerManifestBundle, containerManifestRef, getParentKekForTarget, readContainerState, } from "../../../../data/containers/shared/projection.js";
+import { readContainerKekRecipientTargets, readContainerKeyEpoch, } from "../../../../data/containers/shared/readers.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../../data/keyingProjectionVerification/index.js";
+import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "../mutationRequestCore.js";
+function grantKey(grant) {
+    return `${grant.subjectType}:${grant.subjectId}`;
+}
+function upsertContainerGrant(grants, grant) {
+    return [
+        ...grants.filter((existingGrant) => grantKey(existingGrant) !== grantKey(grant)),
+        grant,
+    ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));
+}
+function referencedPrincipalKey(reference) {
+    return `${reference.principalType}:${reference.principalId}`;
+}
+export function referencedPrincipalHeadFromPolicy(policy) {
+    if (policy.principalType !== "group") {
+        throw new Error("Container grants can reference only group policies");
+    }
+    return {
+        principalType: "group",
+        principalId: policy.principalId,
+        version: policy.version,
+        keyEpoch: policy.keyEpoch,
+        stateHash: policy.stateHash,
+        keyFingerprint: policy.state.keyFingerprint,
+    };
+}
+function upsertReferencedPrincipalHead(references, reference) {
+    return [
+        ...references.filter((existingReference) => referencedPrincipalKey(existingReference) !==
+            referencedPrincipalKey(reference)),
+        reference,
+    ].sort((left, right) => referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)));
+}
+/**
+ * The previous manifest's referenced principal heads with the replacement
+ * policy's head upserted in place of any stale head for the same principal.
+ * A rekey substitutes references and never adds one: a manifest may reference
+ * only principals it grants, so a replacement for one it does not grant —
+ * a carried rekey below the container the policy is granted on — is left out.
+ */
+export function refreshedPrincipalReferences(input) {
+    const replacement = input.replacementPrincipalPolicy;
+    if (!replacement ||
+        !input.previousState.directGrants.some((grant) => grant.subjectType === replacement.principalType &&
+            grant.subjectId === replacement.principalId)) {
+        return [...input.previousState.referencedPrincipalHeads];
+    }
+    return upsertReferencedPrincipalHead(input.previousState.referencedPrincipalHeads, referencedPrincipalHeadFromPolicy(replacement));
+}
+/**
+ * The previous policies with the replacement policy substituted for any
+ * existing policy of the same principal identity.
+ */
+export function refreshedPrincipalPolicies(input) {
+    const replacement = input.replacementPrincipalPolicy;
+    if (!replacement) {
+        return uniquePrincipalPolicies(input.previousPolicies);
+    }
+    return uniquePrincipalPolicies([
+        ...input.previousPolicies.filter((policy) => policy.principalType !== replacement.principalType ||
+            policy.principalId !== replacement.principalId),
+        replacement,
+    ]);
+}
+export async function deriveContainerShareManifest(input) {
+    const previousState = readContainerState(input.previousManifest);
+    const state = {
+        ...previousState,
+        epoch: previousState.epoch + 1,
+        previousManifestHash: input.previousManifest.manifestHash,
+        eventHash: input.eventHash,
+        directGrants: upsertContainerGrant(previousState.directGrants, input.grant),
+        referencedPrincipalHeads: input.referencedPrincipalHead
+            ? upsertReferencedPrincipalHead(previousState.referencedPrincipalHeads, input.referencedPrincipalHead)
+            : previousState.referencedPrincipalHeads,
+    };
+    const manifest = await deriveContainerAccessManifest(state);
+    return {
+        manifest,
+        manifestHash: await computeAccessManifestHash(manifest),
+        state,
+    };
+}
+function buildContainerShareRequest(input) {
+    return {
+        ...containerMutationRequestCore("share", input),
+        ...previousPathRequestFields(input.previousManifest, input.previousProjection),
+        containerManifestHistoryRefs: input.containerManifestHistory.map(containerManifestRef),
+        predecessorBridge: null,
+        keyring: null,
+        parentKekState: readCanonicalRecordOrNull(input.parentKek, "Container share parent KEK state"),
+    };
+}
+export function replaceContainerWrap(wraps, nextWrap) {
+    return [
+        ...wraps.filter((wrap) => !(wrap.recipientKind === nextWrap.recipientKind &&
+            wrap.recipientId === nextWrap.recipientId)),
+        nextWrap,
+    ];
+}
+export function shareManifestHistory(input) {
+    const byHash = new Map();
+    for (const bundle of [
+        input.targetManifest,
+        ...input.targetKek.containerManifestHistory,
+    ]) {
+        if (readContainerState(bundle).containerId === input.containerId &&
+            !byHash.has(bundle.manifestHash)) {
+            byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));
+        }
+    }
+    return [...byHash.values()];
+}
+export function buildContainerSharePlanResult(input) {
+    const keyEpoch = readContainerKeyEpoch(input.targetKek.keyEpoch, "Container share key epoch");
+    const plan = {
+        body: input.body,
+        containerId: input.containerId,
+        event: input.event,
+        eventHash: input.eventHash,
+        grant: input.grant,
+        keyEpoch,
+        manifest: input.manifest,
+        manifestHash: input.manifestHash,
+        previousKeyring: readCanonicalRecordOrNull(input.previousProjection.containerKeks.at(-1)?.keyring ?? null, "Container share previous keyring"),
+        previousManifest: input.previousManifest,
+        recipientTarget: input.recipientTarget,
+        request: buildContainerShareRequest({
+            body: input.body,
+            containerManifestHistory: input.containerManifestHistory,
+            event: input.event,
+            keyEpoch,
+            manifest: input.manifest,
+            manifestHash: input.manifestHash,
+            parentKek: getParentKekForTarget(input.previousProjection),
+            previousManifest: input.previousManifest,
+            previousProjection: input.previousProjection,
+            principalPolicies: input.principalPolicies,
+            userRecipientKeys: input.userRecipientKeys,
+            wraps: input.wraps,
+        }),
+        state: input.state,
+        userRecipientKeys: input.userRecipientKeys,
+        wraps: input.wraps,
+    };
+    return { containerKey: input.containerKey, plan };
+}
+export function collectShareUserRecipientKeys(input) {
+    const directUserIds = new Set(input.state.directGrants.flatMap((grant) => grant.subjectType === "user" ? [grant.subjectId] : []));
+    const userRecipientKeyByUserId = new Map();
+    for (const target of readContainerKekRecipientTargets(input.targetKek.recipientTargets, "Container share target KEK recipient targets")) {
+        if (target.recipientKind !== "user" ||
+            !directUserIds.has(target.recipientId)) {
+            continue;
+        }
+        userRecipientKeyByUserId.set(target.recipientId, {
+            userId: target.recipientId,
+            recipientKeyEpochId: target.recipientKeyEpochId,
+            recipientKeyFingerprint: target.recipientKeyFingerprint,
+        });
+    }
+    if (input.newUserRecipientKey) {
+        userRecipientKeyByUserId.set(input.newUserRecipientKey.userId, input.newUserRecipientKey);
+    }
+    const missingUserId = [...directUserIds].find((userId) => !userRecipientKeyByUserId.has(userId));
+    if (missingUserId) {
+        throw new Error(`Container share recipient key is missing for direct user grant ${missingUserId}`);
+    }
+    return [...userRecipientKeyByUserId.values()].sort((left, right) => left.userId.localeCompare(right.userId));
+}
+export async function collectContainerSharePrincipalPolicies(input) {
+    const previousPolicies = await collectContainerWriterProjectionPrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        resolveUserKey: input.resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+    return refreshedPrincipalPolicies({
+        previousPolicies,
+        replacementPrincipalPolicy: input.recipientPolicy,
+    });
+}
+//# sourceMappingURL=sharePlanCore.js.map

package/workflows/containers/child/share/sharePlanCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EACL,iDAAiD,GAIlD,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAchC,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,4BAA4B,EAC1B,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC1D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerAccessManifestState,\n  type ContainerDirectGrant,\n  type ContainerGrantAccessEventBody,\n  type ContainerGrantPrincipalHead,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  type ContainerUserRecipientKey,\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../../data/containers/shared/principalPolicies\";\nimport {\n  asContainerManifestBundle,\n  containerManifestRef,\n  getParentKekForTarget,\n  readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport {\n  readContainerKekRecipientTargets,\n  readContainerKeyEpoch,\n} from \"../../../../data/containers/shared/readers\";\nimport type {\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"../mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n  | {\n      readonly recipientEncapsulationPublicKey: Uint8Array;\n      readonly subjectId: string;\n      readonly subjectType: \"user\";\n    }\n  | {\n      readonly principalPolicy: PrincipalPolicyCurrentEvidence;\n      readonly subjectId: string;\n      readonly subjectType: \"group\";\n    };\n\nfunction grantKey(\n  grant: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n): string {\n  return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n  grants: readonly ContainerDirectGrant[],\n  grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n  return [\n    ...grants.filter(\n      (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n    ),\n    grant,\n  ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n  readonly principalId: string;\n  readonly principalType: \"group\";\n}): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n  policy: PrincipalPolicyCurrentEvidence,\n): ContainerGrantPrincipalHead {\n  if (policy.principalType !== \"group\") {\n    throw new Error(\"Container grants can reference only group policies\");\n  }\n  return {\n    principalType: \"group\",\n    principalId: policy.principalId,\n    version: policy.version,\n    keyEpoch: policy.keyEpoch,\n    stateHash: policy.stateHash,\n    keyFingerprint: policy.state.keyFingerprint,\n  };\n}\n\nfunction upsertReferencedPrincipalHead(\n  references: readonly ContainerGrantPrincipalHead[],\n  reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n  return [\n    ...references.filter(\n      (existingReference) =>\n        referencedPrincipalKey(existingReference) !==\n        referencedPrincipalKey(reference),\n    ),\n    reference,\n  ].sort((left, right) =>\n    referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n  );\n}\n\n/**\n * The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n */\nexport function refreshedPrincipalReferences(input: {\n  readonly previousState: ContainerAccessManifestState;\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): ContainerGrantPrincipalHead[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (\n    !replacement ||\n    !input.previousState.directGrants.some(\n      (grant) =>\n        grant.subjectType === replacement.principalType &&\n        grant.subjectId === replacement.principalId,\n    )\n  ) {\n    return [...input.previousState.referencedPrincipalHeads];\n  }\n  return upsertReferencedPrincipalHead(\n    input.previousState.referencedPrincipalHeads,\n    referencedPrincipalHeadFromPolicy(replacement),\n  );\n}\n\n/**\n * The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n  readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): PrincipalPolicyCurrentEvidence[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (!replacement) {\n    return uniquePrincipalPolicies(input.previousPolicies);\n  }\n  return uniquePrincipalPolicies([\n    ...input.previousPolicies.filter(\n      (policy) =>\n        policy.principalType !== replacement.principalType ||\n        policy.principalId !== replacement.principalId,\n    ),\n    replacement,\n  ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  referencedPrincipalHead: ContainerGrantPrincipalHead | null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n    referencedPrincipalHeads: input.referencedPrincipalHead\n      ? upsertReferencedPrincipalHead(\n          previousState.referencedPrincipalHeads,\n          input.referencedPrincipalHead,\n        )\n      : previousState.referencedPrincipalHeads,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nfunction buildContainerShareRequest(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"share\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    containerManifestHistoryRefs:\n      input.containerManifestHistory.map(containerManifestRef),\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container share parent KEK state\",\n    ),\n  };\n}\n\nexport function replaceContainerWrap(\n  wraps: readonly ContainerKeyWrap[],\n  nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n  return [\n    ...wraps.filter(\n      (wrap) =>\n        !(\n          wrap.recipientKind === nextWrap.recipientKind &&\n          wrap.recipientId === nextWrap.recipientId\n        ),\n    ),\n    nextWrap,\n  ];\n}\n\nexport function shareManifestHistory(input: {\n  readonly containerId: string;\n  readonly targetKek: ContainerKekResponse;\n  readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n  const byHash = new Map<string, AccessManifestBundleWire>();\n  for (const bundle of [\n    input.targetManifest,\n    ...input.targetKek.containerManifestHistory,\n  ]) {\n    if (\n      readContainerState(bundle).containerId === input.containerId &&\n      !byHash.has(bundle.manifestHash)\n    ) {\n      byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n    }\n  }\n  return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  containerId: string;\n  containerKey: Uint8Array;\n  event: AccessEvent;\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  recipientTarget: ContainerKekRecipientTarget;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n  const keyEpoch = readContainerKeyEpoch(\n    input.targetKek.keyEpoch,\n    \"Container share key epoch\",\n  );\n  const plan: ContainerSharePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    event: input.event,\n    eventHash: input.eventHash,\n    grant: input.grant,\n    keyEpoch,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousKeyring: readCanonicalRecordOrNull(\n      input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n      \"Container share previous keyring\",\n    ),\n    previousManifest: input.previousManifest,\n    recipientTarget: input.recipientTarget,\n    request: buildContainerShareRequest({\n      body: input.body,\n      containerManifestHistory: input.containerManifestHistory,\n      event: input.event,\n      keyEpoch,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: getParentKekForTarget(input.previousProjection),\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n  newUserRecipientKey?: ContainerUserRecipientKey | undefined;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n  const directUserIds = new Set(\n    input.state.directGrants.flatMap((grant) =>\n      grant.subjectType === \"user\" ? [grant.subjectId] : [],\n    ),\n  );\n  const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n  for (const target of readContainerKekRecipientTargets(\n    input.targetKek.recipientTargets,\n    \"Container share target KEK recipient targets\",\n  )) {\n    if (\n      target.recipientKind !== \"user\" ||\n      !directUserIds.has(target.recipientId)\n    ) {\n      continue;\n    }\n    userRecipientKeyByUserId.set(target.recipientId, {\n      userId: target.recipientId,\n      recipientKeyEpochId: target.recipientKeyEpochId,\n      recipientKeyFingerprint: target.recipientKeyFingerprint,\n    });\n  }\n\n  if (input.newUserRecipientKey) {\n    userRecipientKeyByUserId.set(\n      input.newUserRecipientKey.userId,\n      input.newUserRecipientKey,\n    );\n  }\n\n  const missingUserId = [...directUserIds].find(\n    (userId) => !userRecipientKeyByUserId.has(userId),\n  );\n  if (missingUserId) {\n    throw new Error(\n      `Container share recipient key is missing for direct user grant ${missingUserId}`,\n    );\n  }\n\n  return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n    left.userId.localeCompare(right.userId),\n  );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const previousPolicies =\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  return refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.recipientPolicy,\n  });\n}\n"]}

package/workflows/containers/child/share/sharePrincipalPolicy.d.ts

@@ -0,0 +1,51 @@
+import type { ApiClient } from "../../../../internal/api-client/index.js";
+import { KeyingVerificationError, type ReferencedPrincipalHead, type VerifiedPrincipalPolicy } from "../../../../internal/crypto/index.js";
+import type { CommitOrganizationGroupPolicyRequest } from "../../../../internal/validators/request/index.js";
+import type { CommitOrganizationGroupPolicyResponse, PrincipalPolicyBundleResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerShareApi } from "../../../../data/containers/shared/types.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../../data/trustedUserIdentity/index.js";
+import { type GroupPolicyNameReader } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import type { CurrentPrincipalPolicyReader } from "../../../principals/currentPrincipalPolicyReader.js";
+export interface ContainerManagedPrincipalShareApi extends ContainerShareApi, CurrentPrincipalPolicyReader, Pick<ApiClient, "evictContainerWriterProjection" | "getContainerWriterProjectionResult"> {
+    readonly recoverPendingPrincipalMutation?: ((organizationId: string) => Promise<void>) | undefined;
+    commitOrganizationGroupPolicy: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest) => Promise<CommitOrganizationGroupPolicyResponse | null>;
+}
+export interface VerifiedSharePrincipalPolicy {
+    readonly bundle: PrincipalPolicyBundleResponse;
+    readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];
+    readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];
+    readonly organizationId: string;
+    readonly policy: VerifiedPrincipalPolicy;
+}
+/**
+ * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call
+ * deferred: advances the keying checkpoints for the verified policies and
+ * caches the dependency bundles they were verified against.
+ */
+export declare function advanceVerifiedSharePolicies(execSql: ExecSql, verified: Pick<VerifiedSharePrincipalPolicy, "checkpointPolicies" | "dependencyBundles" | "organizationId">, stillCurrent?: (() => boolean) | undefined): Promise<void>;
+/**
+ * The chosen group label does not match the name in the group's verified
+ * policy. A KeyingVerificationError (so it is reported as an incident), with
+ * its own class so a caller can tell this refusal from every other
+ * `object_mismatch` and say what happened.
+ */
+export declare class GroupShareNameMismatchError extends KeyingVerificationError {
+    constructor(message: string);
+}
+export declare function loadVerifiedGroupSharePrincipalPolicy(input: {
+    readEncryptedName?: GroupPolicyNameReader | undefined;
+    apiClient: ContainerManagedPrincipalShareApi;
+    execSql: ExecSql;
+    expectedGroupHead?: ReferencedPrincipalHead | undefined;
+    /**
+     * The display name the user chose the group by. The read model that labels
+     * groups is a server projection; only the name committed in the signed
+     * group payload can confirm the share lands on the group the user saw.
+     */
+    expectedGroupName?: string | undefined;
+    groupId: string;
+    organizationId: string;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    stillCurrent?: (() => boolean) | undefined;
+}): Promise<VerifiedSharePrincipalPolicy>;

package/workflows/containers/child/share/sharePrincipalPolicy.js

@@ -0,0 +1,194 @@
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../../data/keyingProjectionVerification/error.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../../data/persistence/keyingCheckpointPersistence.js";
+import { savePrincipalPolicyBundle } from "../../../../data/persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../../data/persistence/principalPolicyReferencePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "../../../organizations/groupMetadata/groupMetadataBinding.js";
+import { groupPolicyNameMismatch, } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../../principals/externalAdminPolicy.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../../../principals/policyVerification.js";
+async function retainVerifiedSharePolicies(input) {
+    const retainedAt = new Date().toISOString();
+    if (input.organizationPolicy) {
+        for (const entry of externalAdminPolicyPersistenceEntries(input.organizationPolicy)) {
+            await retainVerifiedPrincipalPolicyBundle({
+                ...entry,
+                execSql: input.execSql,
+                organizationId: input.organizationId,
+                stillCurrent: input.stillCurrent,
+                updatedAt: retainedAt,
+            });
+        }
+    }
+    await retainVerifiedPrincipalPolicyBundle({
+        bundle: input.bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        policy: input.policy,
+        stillCurrent: input.stillCurrent,
+        updatedAt: retainedAt,
+    });
+    return [
+        ...(input.organizationPolicy
+            ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map((entry) => entry.policy)
+            : []),
+        input.policy,
+    ];
+}
+/**
+ * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call
+ * deferred: advances the keying checkpoints for the verified policies and
+ * caches the dependency bundles they were verified against.
+ */
+export async function advanceVerifiedSharePolicies(execSql, verified, stillCurrent) {
+    await advanceKeyingCheckpointsAtomically({
+        access: [],
+        execSql,
+        organizationId: verified.organizationId,
+        policies: verified.checkpointPolicies,
+        stillCurrent,
+    });
+    if (stillCurrent?.() === false)
+        return;
+    for (const bundle of verified.dependencyBundles) {
+        await savePrincipalPolicyBundle(execSql, bundle, new Date().toISOString(), verified.organizationId, { stillCurrent });
+        if (stillCurrent?.() === false)
+            return;
+    }
+}
+function assertGroupPolicyTarget(bundle, groupId) {
+    if (bundle.currentState.principalType !== "group" ||
+        bundle.currentState.principalId !== groupId) {
+        throw new Error("Container share principal policy target mismatch");
+    }
+}
+function signerPublicKeyLoadErrorMessage(code) {
+    switch (code) {
+        case "fingerprint-mismatch":
+            return "principal policy signer key fingerprint mismatch";
+        case "not-found":
+            return "principal policy signer key could not be loaded";
+    }
+}
+async function loadGroupSharePolicyBundle(input) {
+    if (input.expectedGroupHead &&
+        (input.expectedGroupHead.principalType !== "group" ||
+            input.expectedGroupHead.principalId !== input.groupId)) {
+        throw new Error("Container share expected group policy target mismatch");
+    }
+    const bundleFromCache = input.expectedGroupHead
+        ? await loadPrincipalPolicyBundleForReference(input.execSql, input.expectedGroupHead, input.localCheckpoint)
+        : null;
+    let bundle = bundleFromCache;
+    bundle ??= await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
+    if (!bundle) {
+        throw new Error("Container share principal policy could not be loaded");
+    }
+    assertGroupPolicyTarget(bundle, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), input.expectedGroupHead)) {
+        throw new Error("Container share group policy does not match the signed organization directory");
+    }
+    return bundle;
+}
+/**
+ * The chosen group label does not match the name in the group's verified
+ * policy. A KeyingVerificationError (so it is reported as an incident), with
+ * its own class so a caller can tell this refusal from every other
+ * `object_mismatch` and say what happened.
+ */
+export class GroupShareNameMismatchError extends KeyingVerificationError {
+    constructor(message) {
+        super("object_mismatch", message);
+        this.name = "GroupShareNameMismatchError";
+    }
+}
+/**
+ * The share picker labels groups from the organization read model, which a
+ * compromised server can relabel, so the name the user chose must equal the
+ * name committed in the target's verified policy. Names compare by their
+ * canonical key so look-alike spellings count as the same name. Uniqueness of
+ * signed names within an organization is enforced where names enter — group
+ * creation verifies every group in the signed directory — so a single
+ * verified match identifies the group.
+ */
+async function assertShareGroupName(input) {
+    // The label comes from the untrusted read model. Signed names never carry
+    // an invisible code point, so a label that does is a look-alike that would
+    // only match after canonicalization strips it; refuse it outright.
+    const mismatch = await groupPolicyNameMismatch(input.bundle, input.expectedGroupName, input.readEncryptedName);
+    if (mismatch === "forbidden_characters") {
+        throw new GroupShareNameMismatchError("Container share group name contains control or format characters");
+    }
+    if (mismatch === "name_mismatch") {
+        throw new GroupShareNameMismatchError("Container share group name does not match the signed group policy");
+    }
+}
+export async function loadVerifiedGroupSharePrincipalPolicy(input) {
+    const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({
+        currentPolicyReader: input.apiClient,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
+    });
+    if (!organizationAdminPolicy) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const committedGroupHead = requireOrganizationGroupHead(organizationAdminPolicy.descriptor, input.groupId);
+    if (input.expectedGroupHead &&
+        !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)) {
+        throw new Error("Container share expected group head conflicts with the signed organization directory");
+    }
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", input.groupId);
+    const bundle = await loadGroupSharePolicyBundle({
+        ...input,
+        expectedGroupHead: committedGroupHead,
+        localCheckpoint,
+    });
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));
+    }
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle,
+        expectedReference: committedGroupHead,
+        loadExternalAuthority: async () => organizationAdminPolicy.externalAuthority,
+        localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Container share principal policy verification failed");
+    }
+    assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);
+    if (input.expectedGroupName !== undefined) {
+        await assertShareGroupName({
+            readEncryptedName: input.readEncryptedName,
+            bundle,
+            expectedGroupName: input.expectedGroupName,
+        });
+    }
+    const checkpointPolicies = await retainVerifiedSharePolicies({
+        bundle,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        organizationPolicy: organizationAdminPolicy,
+        policy: verified.value,
+        stillCurrent: input.stillCurrent,
+    });
+    return {
+        bundle,
+        checkpointPolicies,
+        dependencyBundles: externalAdminPolicyPersistenceEntries(organizationAdminPolicy).map((entry) => entry.bundle),
+        organizationId: input.organizationId,
+        policy: verified.value,
+    };
+}
+//# sourceMappingURL=sharePrincipalPolicy.js.map

package/workflows/containers/child/share/sharePrincipalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePrincipalPolicy.js","sourceRoot":"","sources":["sharePrincipalPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AACrH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kEAAkE,CAAC;AACzH,OAAO,EAAE,mCAAmC,EAAE,MAAM,0EAA0E,CAAC;AAC/H,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sCAAsC,GAEvC,MAAM,wCAAwC,CAAC;AA2BhD,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,qCAAqC,CACvD,KAAK,CAAC,kBAAkB,CACzB,EAAE,CAAC;YACF,MAAM,mCAAmC,CAAC;gBACxC,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACxB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,QAGC,EACD,YAA0C;IAE1C,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;QACrC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,CAAC,cAAc,EACvB,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAqC,EACrC,OAAe;IAEf,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC7C,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,iDAAiD,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;YAChD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,qCAAqC,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,eAAe,CACtB;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CACxD,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,iBAAiB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,uBAAuB;IACtE,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAe3D;IACC,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,uBAAuB,CAAC,UAAU,EAClC,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,KAAK;QACR,iBAAiB,EAAE,kBAAkB;QACrC,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,kBAAkB;QACrC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAChC,uBAAuB,CAAC,iBAAiB;QAC3C,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,oBAAoB,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,uBAAuB;QAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,kBAAkB;QAClB,iBAAiB,EAAE,qCAAqC,CACtD,uBAAuB,CACxB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerShareApi } from \"../../../../data/containers/shared/types\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../../data/keyingProjectionVerification/error\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../../data/persistence/keyingCheckpointPersistence\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../../data/trustedUserIdentity\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport type { CurrentPrincipalPolicyReader } from \"../../../principals/currentPrincipalPolicyReader\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../../principals/externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../../principals/policyVerification\";\n\nexport interface ContainerManagedPrincipalShareApi\n  extends ContainerShareApi,\n    CurrentPrincipalPolicyReader,\n    Pick<\n      ApiClient,\n      \"evictContainerWriterProjection\" | \"getContainerWriterProjectionResult\"\n    > {\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n}\n\nexport interface VerifiedSharePrincipalPolicy {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nasync function retainVerifiedSharePolicies(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  execSql: ExecSql;\n  organizationId: string;\n  organizationPolicy: VerifiedExternalAdminPolicy | null;\n  policy: VerifiedPrincipalPolicy;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const retainedAt = new Date().toISOString();\n  if (input.organizationPolicy) {\n    for (const entry of externalAdminPolicyPersistenceEntries(\n      input.organizationPolicy,\n    )) {\n      await retainVerifiedPrincipalPolicyBundle({\n        ...entry,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        stillCurrent: input.stillCurrent,\n        updatedAt: retainedAt,\n      });\n    }\n  }\n  await retainVerifiedPrincipalPolicyBundle({\n    bundle: input.bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policy: input.policy,\n    stillCurrent: input.stillCurrent,\n    updatedAt: retainedAt,\n  });\n  return [\n    ...(input.organizationPolicy\n      ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map(\n          (entry) => entry.policy,\n        )\n      : []),\n    input.policy,\n  ];\n}\n\n/**\n * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call\n * deferred: advances the keying checkpoints for the verified policies and\n * caches the dependency bundles they were verified against.\n */\nexport async function advanceVerifiedSharePolicies(\n  execSql: ExecSql,\n  verified: Pick<\n    VerifiedSharePrincipalPolicy,\n    \"checkpointPolicies\" | \"dependencyBundles\" | \"organizationId\"\n  >,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql,\n    organizationId: verified.organizationId,\n    policies: verified.checkpointPolicies,\n    stillCurrent,\n  });\n  if (stillCurrent?.() === false) return;\n  for (const bundle of verified.dependencyBundles) {\n    await savePrincipalPolicyBundle(\n      execSql,\n      bundle,\n      new Date().toISOString(),\n      verified.organizationId,\n      { stillCurrent },\n    );\n    if (stillCurrent?.() === false) return;\n  }\n}\n\nfunction assertGroupPolicyTarget(\n  bundle: PrincipalPolicyBundleResponse,\n  groupId: string,\n): void {\n  if (\n    bundle.currentState.principalType !== \"group\" ||\n    bundle.currentState.principalId !== groupId\n  ) {\n    throw new Error(\"Container share principal policy target mismatch\");\n  }\n}\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"principal policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"principal policy signer key could not be loaded\";\n  }\n}\n\nasync function loadGroupSharePolicyBundle(input: {\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  groupId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<PrincipalPolicyBundleResponse> {\n  if (\n    input.expectedGroupHead &&\n    (input.expectedGroupHead.principalType !== \"group\" ||\n      input.expectedGroupHead.principalId !== input.groupId)\n  ) {\n    throw new Error(\"Container share expected group policy target mismatch\");\n  }\n  const bundleFromCache = input.expectedGroupHead\n    ? await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        input.expectedGroupHead,\n        input.localCheckpoint,\n      )\n    : null;\n  let bundle = bundleFromCache;\n  bundle ??= await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n  if (!bundle) {\n    throw new Error(\"Container share principal policy could not be loaded\");\n  }\n  assertGroupPolicyTarget(bundle, input.groupId);\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedGroupHead,\n    )\n  ) {\n    throw new Error(\n      \"Container share group policy does not match the signed organization directory\",\n    );\n  }\n  return bundle;\n}\n\n/**\n * The chosen group label does not match the name in the group's verified\n * policy. A KeyingVerificationError (so it is reported as an incident), with\n * its own class so a caller can tell this refusal from every other\n * `object_mismatch` and say what happened.\n */\nexport class GroupShareNameMismatchError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"object_mismatch\", message);\n    this.name = \"GroupShareNameMismatchError\";\n  }\n}\n\n/**\n * The share picker labels groups from the organization read model, which a\n * compromised server can relabel, so the name the user chose must equal the\n * name committed in the target's verified policy. Names compare by their\n * canonical key so look-alike spellings count as the same name. Uniqueness of\n * signed names within an organization is enforced where names enter — group\n * creation verifies every group in the signed directory — so a single\n * verified match identifies the group.\n */\nasync function assertShareGroupName(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  bundle: PrincipalPolicyBundleResponse;\n  expectedGroupName: string;\n}): Promise<void> {\n  // The label comes from the untrusted read model. Signed names never carry\n  // an invisible code point, so a label that does is a look-alike that would\n  // only match after canonicalization strips it; refuse it outright.\n  const mismatch = await groupPolicyNameMismatch(\n    input.bundle,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  if (mismatch === \"forbidden_characters\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name contains control or format characters\",\n    );\n  }\n  if (mismatch === \"name_mismatch\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  }\n}\n\nexport async function loadVerifiedGroupSharePrincipalPolicy(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  /**\n   * The display name the user chose the group by. The read model that labels\n   * groups is a server projection; only the name committed in the signed\n   * group payload can confirm the share lands on the group the user saw.\n   */\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedSharePrincipalPolicy> {\n  const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!organizationAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const committedGroupHead = requireOrganizationGroupHead(\n    organizationAdminPolicy.descriptor,\n    input.groupId,\n  );\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)\n  ) {\n    throw new Error(\n      \"Container share expected group head conflicts with the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.groupId,\n  );\n  const bundle = await loadGroupSharePolicyBundle({\n    ...input,\n    expectedGroupHead: committedGroupHead,\n    localCheckpoint,\n  });\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: committedGroupHead,\n      loadExternalAuthority: async () =>\n        organizationAdminPolicy.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Container share principal policy verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);\n  if (input.expectedGroupName !== undefined) {\n    await assertShareGroupName({\n      readEncryptedName: input.readEncryptedName,\n      bundle,\n      expectedGroupName: input.expectedGroupName,\n    });\n  }\n\n  const checkpointPolicies = await retainVerifiedSharePolicies({\n    bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    organizationPolicy: organizationAdminPolicy,\n    policy: verified.value,\n    stillCurrent: input.stillCurrent,\n  });\n  return {\n    bundle,\n    checkpointPolicies,\n    dependencyBundles: externalAdminPolicyPersistenceEntries(\n      organizationAdminPolicy,\n    ).map((entry) => entry.bundle),\n    organizationId: input.organizationId,\n    policy: verified.value,\n  };\n}\n"]}

package/workflows/containers/child/share/shareProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareProjection.js","sourceRoot":"","sources":["shareProjection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAEvE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAG0E,EAC1E,wBAAmD;IAEnD,MAAM,gBAAgB,GACpB,KAAK,CAAC,kBAAkB;QACxB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAAC;QAC9D,GAAG,KAAK;QACR,kBAAkB,EAAE,gBAAgB;QACpC,wBAAwB;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACtE,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { projectionWithCurrentAncestors } from \"./shareAncestorRepair\";\n\n/** The container's projection, with any lazily stale chain above it repaired. */\nexport async function resolveShareProjection(\n  input: Omit<\n    Parameters<typeof projectionWithCurrentAncestors>[0],\n    \"previousProjection\" | \"resolveProjectionUserKey\"\n  > & { previousProjection?: ContainerWriterProjectionResponse | undefined },\n  resolveProjectionUserKey: ProjectionUserKeyResolver,\n): Promise<ContainerWriterProjectionResponse | null> {\n  const servedProjection =\n    input.previousProjection ??\n    (await input.apiClient.getContainerWriterProjection(input.containerId));\n  if (!servedProjection || input.stillCurrent?.() === false) return null;\n  const previousProjection = await projectionWithCurrentAncestors({\n    ...input,\n    previousProjection: servedProjection,\n    resolveProjectionUserKey,\n  });\n  return input.stillCurrent?.() === false ? null : previousProjection;\n}\n"]}

package/workflows/containers/index.d.ts

@@ -6,17 +6,17 @@ export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, }
 export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "../../data/documents/shared/keyringRebuild.js";
 export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWrapUnavailableReason, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
-export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
-export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
-export { moveRemoteContainer } from "./child/move.js";
-export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
-export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
-export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
+export { moveRemoteContainer } from "./child/move/index.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
+export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
-export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
-export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { type ContainerWriteRefusal, classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js

@@ -9,18 +9,18 @@ export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEnt
 // A share's projection verification can be cancelled by a newer generation
 // underneath the caller; hosts filter that outcome from their own reporting.
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
-export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
+export { moveRemoteContainer } from "./child/move/index.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
 // A rebuilt keyring override that a concurrent rotation outdated: rebuild it.
-export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
-export { moveRemoteContainer } from "./child/move.js";
-export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
-export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
-export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
-export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
-export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,sCAAsC,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/keyringOverrideLineage\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/rekey/keyringOverrideLineage\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekey/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekey/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/share/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/share/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/share/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}