npm - @tearleads/client-sdk - Versions diffs - 0.1.63 → 0.1.64 - Mend

@tearleads/client-sdk 0.1.63 → 0.1.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (616) hide show

package/workflows/containers/child/{create.js → create/index.js} RENAMED Viewed

@@ -1,18 +1,18 @@
-import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, deriveContainerKekWrappingPublicKey, } from "../../../internal/crypto/index.js";
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { assertContainerChildPathFits } from "../../../data/containers/shared/containerPathLimits.js";
-import { buildContainerCreateBody, buildContainerCreateKeyEpoch, buildParentRecipientTargets, deriveContainerCreateManifest, resolveContainerKekEpochId, signContainerCreateEvent, } from "../../../data/containers/shared/events.js";
-import { acknowledgeContainerMutation } from "../../../data/containers/shared/mutationAcknowledgement.js";
-import { containerManifestRef, getParentCreateContext, readContainerState, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, } from "../../../data/containers/shared/projection.js";
-import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { projectionVerificationOptions, } from "../../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
-import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
-import { PrincipalPolicyRepairBudget } from "../../principals/policyRepairBudget.js";
+import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, deriveContainerKekWrappingPublicKey, } from "../../../../internal/crypto/index.js";
+import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
+import { assertContainerChildPathFits } from "../../../../data/containers/shared/containerPathLimits.js";
+import { buildContainerCreateBody, buildContainerCreateKeyEpoch, buildParentRecipientTargets, deriveContainerCreateManifest, resolveContainerKekEpochId, signContainerCreateEvent, } from "../../../../data/containers/shared/events.js";
+import { acknowledgeContainerMutation } from "../../../../data/containers/shared/mutationAcknowledgement.js";
+import { containerManifestRef, getParentCreateContext, readContainerState, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, } from "../../../../data/containers/shared/projection.js";
+import { assertContainerKekPathCurrent } from "../../../../data/documents/shared/containerKekCurrency.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions, } from "../../../../data/documents/shared/types.js";
+import { readCanonicalRecord } from "../../../../data/keying/canonicalJson.js";
+import { collectContainerWriterProjectionPrincipalPolicies, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
+import { PrincipalPolicyRepairBudget } from "../../../principals/policyRepairBudget.js";
+import { containerMutationRequestCore } from "../mutationRequestCore.js";
+import { requireUnwrappedKek } from "../rotation/rotationContext.js";
 import { repairContainerCreateFailure, submitRemoteContainerCreate, } from "./createSubmission.js";
-import { containerMutationRequestCore } from "./mutationRequestCore.js";
-import { requireUnwrappedKek } from "./rotationContext.js";
 function assertContainerCreatePlanInput(input) {
     if (input.containerKey.byteLength !== 32) {
         throw new Error("Container KEK material must be 32 bytes");
@@ -332,4 +332,4 @@ export async function createRemoteContainer(input) {
         ? outcome.result
         : null;
 }
-//# sourceMappingURL=create.js.map
+//# sourceMappingURL=index.js.map

package/workflows/containers/child/create/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAC;AAC1G,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,+CAA+C,CAAC;AASvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAK5E,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EACrB,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,KAAK,EAAE,WAAW;gBAClB,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;gBAC/C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerCreateAccessEventBody,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../../data/containers/shared/containerPathLimits\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n buildParentRecipientTargets,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n containerManifestRef,\n getParentCreateContext,\n readContainerState,\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToParent,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n BuildContainerCreatePlanInput,\n ContainerCreatePlan,\n ContainerCreatePlanContext,\n ContainerMutationAuthor,\n CreateRemoteContainerResult,\n MaterializedContainerCreatePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport {\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n nullOnProjectionVerificationCancellation,\n requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../../principals/policyRepairBudget\";\nimport { containerMutationRequestCore } from \"../mutationRequestCore\";\nimport { requireUnwrappedKek } from \"../rotation/rotationContext\";\nimport {\n type ContainerCreateRepairState,\n type RemoteContainerCreateInput,\n repairContainerCreateFailure,\n submitRemoteContainerCreate,\n} from \"./createSubmission\";\n\nfunction assertContainerCreatePlanInput(input: {\n containerKey: Uint8Array;\n}): void {\n if (input.containerKey.byteLength !== 32) {\n throw new Error(\"Container KEK material must be 32 bytes\");\n }\n // The child container's organization is derived from the parent projection\n // (see buildContainerCreatePlan), so it always matches the parent by\n // construction — a member writing under another org's shared root is the\n // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse;\n parentProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"create\", {\n ...input,\n userRecipientKeys: [],\n }),\n previousManifestRef: null,\n parentContainerPathRefs:\n input.parentProjection.path.map(containerManifestRef),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecord(\n input.parentKek,\n \"Container create parent KEK state\",\n ),\n };\n}\n\nasync function resolveContainerCreatePlanContext(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n assertContainerCreatePlanInput(input);\n assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n const containerId = input.containerId ?? crypto.randomUUID();\n\n return {\n ...input,\n containerId,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: await resolveContainerKekEpochId({\n containerId,\n keyEpoch: 1,\n keyMaterial: input.containerKey,\n override: input.containerKeyEpochId,\n }),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parent: getParentCreateContext(input.parentProjection),\n signedAt: input.signedAt ?? new Date().toISOString(),\n };\n}\n\nfunction buildChildContainerCreateBody(\n context: ContainerCreatePlanContext,\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: context.systemSlot ?? null,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId: context.parentProjection.containerId,\n parentManifestHash: context.parent.manifest.manifestHash,\n });\n if (!managedGrant) {\n return baseBody;\n }\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: managedGrant.accessLevel,\n subjectId: managedGrant.principalHead.principalId,\n subjectType: managedGrant.principalHead.principalType,\n },\n ],\n referencedPrincipalHeads: [managedGrant.principalHead],\n };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n context: ContainerCreatePlanContext;\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n manifestHash: string;\n}): Promise<{\n recipientTargets: ContainerKekRecipientTarget[];\n wraps: ContainerKeyWrap[];\n}> {\n const { context, managedGrant, manifestHash } = input;\n const parentPublicKey = readContainerState(\n context.parent.manifest,\n ).containerKeyPublicKey;\n if (!parentPublicKey)\n throw new Error(\"Container parent wrapping public key is missing\");\n const parentWrap = await wrapContainerKeyToParent({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n parentKek: context.parent.kek,\n parentPublicKey,\n });\n const parentTargets = buildParentRecipientTargets(context.parent.kek);\n if (!managedGrant) {\n return { recipientTargets: parentTargets, wraps: [parentWrap] };\n }\n const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n principalEncapsulationPublicKey:\n managedGrant.principalEncapsulationPublicKey,\n principalHead: managedGrant.principalHead,\n });\n return {\n recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n wraps: [parentWrap, managedRecipient.wrap],\n };\n}\n\nexport async function buildContainerCreatePlan(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n const context = await resolveContainerCreatePlanContext(input);\n const parentContainerId = context.parentProjection.containerId;\n const parentManifestHash = context.parent.manifest.manifestHash;\n const managedGrant = input.managedPrincipalGrant;\n const body = buildChildContainerCreateBody(context, managedGrant);\n // The new container belongs to the parent's organization, not the author's.\n // A member writing under another org's shared root mints a container owned by\n // that org; the author only supplies the signer identity.\n const organizationId = context.parentProjection.organizationId;\n const { event, eventHash } = await signContainerCreateEvent({\n author: context.author,\n body,\n containerId: context.containerId,\n eventId: context.eventId,\n organizationId,\n parentPath: context.parentProjection.path,\n signedAt: context.signedAt,\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: context.systemSlot ?? null,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n directGrants: body.directGrants,\n eventHash,\n metadataDocumentId: context.metadataDocumentId,\n organizationId,\n parentContainerId,\n parentManifestHash,\n referencedPrincipalHeads: body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n });\n const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n context,\n managedGrant,\n manifestHash,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n return {\n body,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId,\n parentManifestHash,\n recipientTargets,\n request: buildContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n parentKek: context.parent.kek,\n parentProjection: context.parentProjection,\n principalPolicies: context.principalPolicies ?? [],\n wraps,\n }),\n state,\n wraps,\n };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n input: {\n author: ContainerMutationAuthor;\n containerId?: string | undefined;\n containerKey?: Uint8Array | undefined;\n containerKeyEpochId?: string | undefined;\n eventId?: string | undefined;\n execSql?: ExecSql | undefined;\n managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n metadataDocumentId?: string | undefined;\n systemSlot?: string | null | undefined;\n parentProjection: ContainerWriterProjectionResponse;\n parentSecretKey: Uint8Array;\n signedAt?: string | undefined;\n // Fetches the parent path's referenced principal policies on demand when\n // they are not cached locally — lets a member create under another org's\n // shared root without having first hydrated that org's group policy.\n warmReferencedPrincipalPolicies?:\n | ReferencedPrincipalPolicyWarmer\n | undefined;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n const containerKey =\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n const parentKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.parentProjection,\n secretKey: input.parentSecretKey,\n ...projectionVerificationOptions(input),\n });\n const parent = getParentCreateContext(input.parentProjection);\n requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n // Checked on the path verification just accepted, never on the raw response.\n assertContainerChildPathFits(input.parentProjection.path);\n const principalPolicies = input.resolveProjectionUserKey\n ? await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.parentProjection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n })\n : [];\n if (input.resolveProjectionUserKey) {\n assertContainerAuthorAccess({\n author: {\n ...input.author,\n organizationId: input.parentProjection.organizationId,\n },\n projection: input.parentProjection,\n principalPolicies,\n minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n });\n }\n const plan = await buildContainerCreatePlan({\n author: input.author,\n containerId: input.containerId,\n containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n eventId: input.eventId,\n managedPrincipalGrant: input.managedPrincipalGrant,\n metadataDocumentId: input.metadataDocumentId,\n systemSlot: input.systemSlot,\n parentProjection: input.parentProjection,\n principalPolicies,\n signedAt: input.signedAt,\n });\n\n return {\n containerKey,\n plan,\n };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n readonly containerId: string;\n readonly containerKey: Uint8Array;\n readonly eventId: string;\n readonly metadataDocumentId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly request: RemoteContainerCreateInput;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly signedAt: string;\n}): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} | null> {\n let parentProjection = input.parentProjection;\n const repairState: ContainerCreateRepairState = {\n didRepairStaleParent: false,\n policyRepairs: new PrincipalPolicyRepairBudget(),\n };\n for (;;) {\n const materializedPlan = await buildMaterializedContainerCreatePlan({\n author: input.request.author,\n containerId: input.containerId,\n containerKey: input.containerKey,\n containerKeyEpochId: input.request.containerKeyEpochId,\n eventId: input.eventId,\n execSql: input.request.execSql,\n metadataDocumentId: input.metadataDocumentId,\n parentProjection,\n parentSecretKey: input.request.parentSecretKey,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.request.stillCurrent,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n });\n const submitted = await submitRemoteContainerCreate({\n apiClient: input.request.apiClient,\n plan: materializedPlan.plan,\n stillCurrent: input.request.stillCurrent,\n });\n if (!submitted) return null;\n if (!submitted.ok) {\n const repair = await repairContainerCreateFailure({\n apiClient: input.request.apiClient,\n failure: submitted,\n parentContainerId: input.request.parentContainerId,\n parentProjection,\n state: repairState,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n stillCurrent: input.request.stillCurrent,\n });\n if (repair.kind === \"retry\") {\n parentProjection = repair.parentProjection;\n continue;\n }\n if (repair.kind === \"unavailable\") {\n return null;\n }\n submitted.report();\n return null;\n }\n const acknowledged = await acknowledgeContainerMutation({\n execSql: input.request.execSql,\n plan: materializedPlan.plan,\n response: submitted.response,\n stillCurrent: input.request.stillCurrent,\n });\n return {\n acknowledged,\n result: {\n containerKey: materializedPlan.containerKey,\n containerId: submitted.response.containerId,\n metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n plan: materializedPlan.plan,\n response: submitted.response,\n },\n };\n }\n}\n\nasync function createRemoteContainerOutcome(\n input: RemoteContainerCreateInput,\n): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} | null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container create\",\n );\n const parentProjection =\n input.parentProjection ??\n (await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n ));\n if (!parentProjection) {\n return null;\n }\n return nullOnProjectionVerificationCancellation(() =>\n createRemoteContainerWithRepairs({\n containerId: input.containerId ?? crypto.randomUUID(),\n containerKey:\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parentProjection,\n request: input,\n resolveProjectionUserKey,\n signedAt: input.signedAt ?? new Date().toISOString(),\n }),\n );\n}\n\nexport async function createRemoteContainer(\n input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult | null> {\n const outcome = await createRemoteContainerOutcome(input);\n return outcome?.acknowledged && input.stillCurrent?.() !== false\n ? outcome.result\n : null;\n}\n"]}

package/workflows/containers/child/{move.d.ts → move/index.d.ts} RENAMED Viewed

@@ -1,8 +1,8 @@
-import type { ContainerRotationResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerMoveApi, ContainerMovePlan, ContainerMutationAuthor } from "../../../data/containers/shared/types.js";
-import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { ContainerRotationResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMoveApi, ContainerMovePlan, ContainerMutationAuthor } from "../../../../data/containers/shared/types.js";
+import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
 export declare function moveRemoteContainer(input: {
     reportSecurityIncident: SecurityIncidentReporter;
     apiClient: ContainerMoveApi;

package/workflows/containers/child/{move.js → move/index.js} RENAMED Viewed

@@ -1,16 +1,16 @@
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { assertContainerChildPathFits } from "../../../data/containers/shared/containerPathLimits.js";
-import { asContainerManifestBundle, containerManifestRef, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
-import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
-import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
+import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
+import { assertContainerChildPathFits } from "../../../../data/containers/shared/containerPathLimits.js";
+import { asContainerManifestBundle, containerManifestRef, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, } from "../../../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../../data/documents/shared/types.js";
+import { readCanonicalRecord } from "../../../../data/keying/canonicalJson.js";
+import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
+import { containerMutationRequestCore, previousPathRequestFields, } from "../mutationRequestCore.js";
+import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "../mutationSubmit.js";
+import { containerWriterProjectionFromRotationPlan } from "../rekey/rekeyProjection.js";
+import { requireUnwrappedKek, signedRotationTarget, } from "../rotation/rotationContext.js";
 import { buildMoveRotationWithBody, deriveMoveManifestArtifacts, } from "./moveArtifacts.js";
 import { buildContainerMoveWraps, collectContainerMovePrincipalPolicies, } from "./moveWraps.js";
-import { containerMutationRequestCore, previousPathRequestFields, } from "./mutationRequestCore.js";
-import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "./mutationSubmit.js";
-import { containerWriterProjectionFromRotationPlan } from "./rekeyProjection.js";
-import { requireUnwrappedKek, signedRotationTarget, } from "./rotationContext.js";
 function buildContainerMoveRequest(input) {
     return {
         ...containerMutationRequestCore("move", input),
@@ -265,4 +265,4 @@ export async function moveRemoteContainer(input) {
         },
     });
 }
-//# sourceMappingURL=move.js.map
+//# sourceMappingURL=index.js.map

package/workflows/containers/child/move/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AAQvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAIvD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EACL,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,qCAAqC,GACtC,MAAM,aAAa,CAAC;AAErB,SAAS,yBAAyB,CAAC,KAelC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,MAAM,EAAE,KAAK,CAAC;QAC9C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,kCAAkC,EAChC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClE,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,mCAAmC,CACpC;QACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC;QACrE,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,oBAAoB,EAC1B,6CAA6C,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAQtC;IAKC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,uBAAuB,CACxB,CAAC;IAEF,MAAM,wBAAwB,GAAG,MAAM,sBAAsB,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,CAAC,2BAA2B,CAClC,CAAC;IACF,mBAAmB,CACjB,wBAAwB,EACxB,iBAAiB,CAAC,GAAG,EACrB,mCAAmC,CACpC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,gCAAgC,CAAC,KAIzC;IACC,IAAI,KAAK,CAAC,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9E,gCAAgC,CAAC;QAC/B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,qCAAqC,CAAC,KAG9C;IACC,OAAO;QACL,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5D,GAAG,0BAA0B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAoBrC;IACC,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,yBAAyB,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;YAC9D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAWD,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAErC,MAAM,iBAAiB,GAAG,MAAM,qCAAqC,CAAC;QACpE,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,wBAAwB;KAC/C,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,2BAA2B;QAC7C,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,KAAqC;IAErC,MAAM,EACJ,YAAY,EAAE,uBAAuB,EACrC,iBAAiB,EACjB,MAAM,GACP,GAAG,MAAM,uBAAuB,CAAC;QAChC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,uBAAuB,CAAC;QAClE,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QACjD,iBAAiB;QACjB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,mBAAmB,EACnB,OAAO,EACP,iBAAiB,GAClB,GAAG,MAAM,yBAAyB,CAAC;QAClC,iBAAiB;QACjB,gBAAgB;QAChB,QAAQ,EAAE,KAAK,CAAC,mBAAmB;QACnC,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,2BAA2B,CAAC;QAChC,IAAI;QACJ,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,wBAAwB,EAAE,qCAAqC,CAAC,KAAK,CAAC;YACtE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;QACD,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACjE,iBAAiB;QACjB,YAAY;QACZ,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IAEH,OAAO,4BAA4B,CAAC;QAClC,IAAI;QACJ,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;QAC3C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAazC;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,uBAAuB,CACxB,CAAC;IACF,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1E,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/D,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC1C,KAAK,CAAC,4BAA4B,CACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,wCAAwC,CAAC,GAAG,EAAE,CAC3E,kCAAkC,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,2BAA2B;QAC3B,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,wBAAwB;gBAClD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,GAAG,EAAE,CACZ,yCAAyC,CAAC;gBACxC,SAAS,EAAE,2BAA2B;gBACtC,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,kBAAkB;aACnB,CAAC;SACL;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAChD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACpE,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,GAAG,EAAE,CACH,mBAAmB,CAAC,IAAI,CACtB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerUserRecipientKey,\n VerifiedContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerRotationResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../../data/containers/shared/containerPathLimits\";\nimport {\n asContainerManifestBundle,\n containerManifestRef,\n getTargetContainerContext,\n readContainerState,\n uniqueSortedManifestHashes,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n BuildMaterializedContainerMovePlanInput,\n ContainerMoveApi,\n ContainerMovePlan,\n ContainerMutationAuthor,\n MaterializedContainerMovePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport {\n nullOnProjectionVerificationCancellation,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n} from \"../mutationRequestCore\";\nimport {\n submitAcknowledgedContainerMutation,\n submitContainerRotation,\n} from \"../mutationSubmit\";\nimport { containerWriterProjectionFromRotationPlan } from \"../rekey/rekeyProjection\";\nimport {\n requireUnwrappedKek,\n type SignedRotationTarget,\n signedRotationTarget,\n} from \"../rotation/rotationContext\";\nimport {\n buildMoveRotationWithBody,\n deriveMoveManifestArtifacts,\n} from \"./moveArtifacts\";\nimport {\n buildContainerMoveWraps,\n collectContainerMovePrincipalPolicies,\n} from \"./moveWraps\";\n\nfunction buildContainerMoveRequest(input: {\n body: ContainerMoveAccessEventBody;\n destinationParentKek: ContainerKekResponse;\n destinationParentProjection: ContainerWriterProjectionResponse;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n predecessorBridge: ContainerKekPredecessorBridge;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"move\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n destinationParentContainerPathRefs:\n input.destinationParentProjection.path.map(containerManifestRef),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container move predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container move keyring\"),\n parentKekState: readCanonicalRecord(\n input.destinationParentKek,\n \"Container move destination parent KEK state\",\n ),\n };\n}\n\nasync function unwrapMoveContainerKeys(input: {\n destinationParentProjection: ContainerWriterProjectionResponse;\n execSql: ExecSql;\n previousProjection: ContainerWriterProjectionResponse;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) | undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n containerKey: Uint8Array;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n source: SignedRotationTarget;\n}> {\n const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n const keksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.previousProjection,\n secretKey: input.targetSecretKey,\n verifiedByHash,\n ...projectionVerificationOptions(input),\n });\n const source = signedRotationTarget(input.previousProjection, verifiedByHash);\n const containerKey = requireUnwrappedKek(\n keksByEpochId,\n source.kek,\n \"Container move source\",\n );\n\n const destinationKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.destinationParentProjection,\n secretKey: input.targetSecretKey,\n ...projectionVerificationOptions(input),\n });\n const destinationParent = getTargetContainerContext(\n input.destinationParentProjection,\n );\n requireUnwrappedKek(\n destinationKeksByEpochId,\n destinationParent.kek,\n \"Container move destination parent\",\n );\n\n return { containerKey, destinationParent, source };\n}\n\nfunction assertContainerMoveOrganizations(input: {\n authorOrganizationId: string;\n destinationState: ContainerAccessManifestState;\n previousState: ContainerAccessManifestState;\n}): void {\n if (input.previousState.organizationId !== input.authorOrganizationId) {\n throw new Error(\"Container move author organization mismatch\");\n }\n if (input.destinationState.organizationId !== input.authorOrganizationId) {\n throw new Error(\"Container move destination organization mismatch\");\n }\n}\n\nfunction readContainerMoveStates(input: {\n authorOrganizationId: string;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n source: ReturnType<typeof getTargetContainerContext>;\n}) {\n const previousState = readContainerState(input.source.manifest);\n const destinationState = readContainerState(input.destinationParent.manifest);\n assertContainerMoveOrganizations({\n authorOrganizationId: input.authorOrganizationId,\n destinationState,\n previousState,\n });\n return { destinationState, previousState };\n}\n\nfunction containerMoveDependencyManifestHashes(input: {\n destinationParentProjection: ContainerWriterProjectionResponse;\n previousProjection: ContainerWriterProjectionResponse;\n}): string[] {\n return [\n ...uniqueSortedManifestHashes(input.previousProjection.path),\n ...uniqueSortedManifestHashes(input.destinationParentProjection.path),\n ];\n}\n\nfunction buildContainerMovePlanResult(input: {\n body: ContainerMoveAccessEventBody;\n containerId: string;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n destinationParentKek: ContainerKekResponse;\n destinationParentProjection: ContainerWriterProjectionResponse;\n event: AccessEvent;\n eventHash: string;\n keyEpoch: ContainerKeyEpoch;\n keyring: ContainerKekKeyring;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n predecessorBridge: ContainerKekPredecessorBridge;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerAccessManifestState;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerMovePlan {\n const plan: ContainerMovePlan = {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: buildContainerMoveRequest({\n body: input.body,\n destinationParentKek: input.destinationParentKek,\n destinationParentProjection: input.destinationParentProjection,\n event: input.event,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n predecessorBridge: input.predecessorBridge,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\ntype MaterializedContainerMoveInput =\n BuildMaterializedContainerMovePlanInput & {\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) | undefined;\n warmReferencedPrincipalPolicies?:\n | ReferencedPrincipalPolicyWarmer\n | undefined;\n };\n\nasync function collectAuthorizedMovePolicies(\n input: MaterializedContainerMoveInput,\n) {\n const principalPolicies = await collectContainerMovePrincipalPolicies({\n ...input,\n resolveUserKey: input.resolveProjectionUserKey,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"admin\",\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.destinationParentProjection,\n principalPolicies,\n minimumAccess: \"write\",\n });\n return principalPolicies;\n}\n\nasync function buildMaterializedContainerMovePlan(\n input: MaterializedContainerMoveInput,\n): Promise<MaterializedContainerMovePlan> {\n const {\n containerKey: predecessorContainerKey,\n destinationParent,\n source,\n } = await unwrapMoveContainerKeys({\n destinationParentProjection: input.destinationParentProjection,\n execSql: input.execSql,\n previousProjection: input.previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n // Only a verified path is a final depth refusal; a padded unverified path\n // must fail verification (an incident), never look like an honest refusal.\n assertContainerChildPathFits(input.destinationParentProjection.path);\n const { destinationState, previousState } = readContainerMoveStates({\n authorOrganizationId: input.author.organizationId,\n destinationParent,\n source,\n });\n const principalPolicies = await collectAuthorizedMovePolicies(input);\n const {\n body,\n containerKey,\n containerKeyEpochId,\n keyring,\n predecessorBridge,\n } = await buildMoveRotationWithBody({\n destinationParent,\n destinationState,\n override: input.containerKeyEpochId,\n predecessorContainerKey,\n previousState,\n source,\n });\n const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveMoveManifestArtifacts({\n body,\n containerKeyEpochId,\n destinationParent,\n previousState,\n signing: {\n author: input.author,\n dependencyManifestHashes: containerMoveDependencyManifestHashes(input),\n eventId: input.eventId,\n signedAt: input.signedAt,\n },\n source,\n });\n const { userRecipientKeys, wraps } = await buildContainerMoveWraps({\n principalPolicies,\n containerKey,\n containerKeyEpochId,\n destinationParentKek: destinationParent.kek,\n destinationParentProjection: input.destinationParentProjection,\n execSql: input.execSql,\n manifestHash,\n previousProjection: input.previousProjection,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n state,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n\n return buildContainerMovePlanResult({\n body,\n containerKey,\n containerId: previousState.containerId,\n containerKeyEpochId,\n destinationParentKek: destinationParent.kek,\n destinationParentProjection: input.destinationParentProjection,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n previousManifest: asContainerManifestBundle(source.manifest),\n previousProjection: input.previousProjection,\n predecessorBridge,\n principalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n}\n\nexport async function moveRemoteContainer(input: {\n reportSecurityIncident: SecurityIncidentReporter;\n apiClient: ContainerMoveApi;\n author: ContainerMutationAuthor;\n containerId: string;\n destinationParentContainerId: string;\n eventId?: string | undefined;\n execSql: ExecSql;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string | undefined;\n stillCurrent?: (() => boolean) | undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n containerKey: Uint8Array;\n plan: ContainerMovePlan;\n response: ContainerRotationResponse;\n} | null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container move\",\n );\n const [previousProjection, destinationParentProjection] = await Promise.all([\n input.apiClient.getContainerWriterProjection(input.containerId),\n input.apiClient.getContainerWriterProjection(\n input.destinationParentContainerId,\n ),\n ]);\n if (!previousProjection || !destinationParentProjection) {\n return null;\n }\n\n const materializedPlan = await nullOnProjectionVerificationCancellation(() =>\n buildMaterializedContainerMovePlan({\n author: input.author,\n eventId: input.eventId,\n execSql: input.execSql,\n previousProjection,\n destinationParentProjection,\n resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n }),\n );\n if (!materializedPlan) return null;\n return submitAcknowledgedContainerMutation({\n reportSecurityIncident: input.reportSecurityIncident,\n recitationPolicies: [],\n apiClient: input.apiClient,\n author: input.author,\n carriedRekeys: {\n planning: {\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n knownContainerKeks: new Map([\n [\n materializedPlan.plan.containerKeyEpochId,\n materializedPlan.containerKey,\n ],\n ]),\n resolveProjectionUserKey: resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n },\n rotated: () =>\n containerWriterProjectionFromRotationPlan({\n ancestors: destinationParentProjection,\n plan: materializedPlan.plan,\n previousProjection,\n }),\n },\n containerKey: materializedPlan.containerKey,\n execSql: input.execSql,\n plan: materializedPlan.plan,\n stillCurrent: input.stillCurrent,\n submit: (carried) => {\n const request = carried.length\n ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n : materializedPlan.plan.request;\n const options = {\n expectedPaymentRequiredOrganizationId: input.author.organizationId,\n };\n const { moveContainerResult } = input.apiClient;\n return submitContainerRotation({\n plain: () =>\n input.apiClient.moveContainer(input.containerId, request, options),\n result: moveContainerResult\n ? () =>\n moveContainerResult.call(\n input.apiClient,\n input.containerId,\n request,\n { ...options, reportErrors: false },\n )\n : undefined,\n });\n },\n });\n}\n"]}

package/workflows/containers/child/{moveArtifacts.js → move/moveArtifacts.js} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, } from "../../../internal/crypto/index.js";
-import { buildContainerCreateKeyEpoch, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
-import { readContainerState, } from "../../../data/containers/shared/projection.js";
+import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, } from "../../../../internal/crypto/index.js";
+import { buildContainerCreateKeyEpoch, signContainerMutationEvent, } from "../../../../data/containers/shared/events.js";
+import { readContainerState, } from "../../../../data/containers/shared/projection.js";
 import { buildContainerRotationArtifacts } from "./moveRotation.js";
 async function deriveContainerMoveManifest(input) {
     const previousState = readContainerState(input.previousManifest);

package/workflows/containers/child/move/moveArtifacts.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"moveArtifacts.js","sourceRoot":"","sources":["moveArtifacts.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAEL,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AAMvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAEjE,KAAK,UAAU,2BAA2B,CAAC,KAM1C;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,gBAAgB,CAAC,WAAW;QAC/C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,YAAY;QACxD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,OAAO;QACL,SAAS,EAAE,gBAAgB;QAC3B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;KACF,CAAC;AACJ,CAAC;AASD,SAAS,sBAAsB,CAAC,KAK/B;IACC,OAAO,0BAA0B,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,wBAAwB;QAChE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW;QAClE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,yBAAyB,EAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;QAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;QACjD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC;QAC7C,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,QAAQ,CAAC,YAAY;SACnC,CAAC;QACF,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC,WAAW;QACrD,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY;QACjE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAOjD;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,sBAAsB,CAAC;QACxD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QAC1E,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ;QACnD,SAAS;QACT,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;KACxC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS;QACT,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC","sourcesContent":["import type {\n ContainerAccessManifestState,\n ContainerKekKeyring,\n ContainerKekPredecessorBridge,\n ContainerMoveAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n computeAccessManifestHash,\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n deriveContainerAccessManifest,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n buildContainerCreateKeyEpoch,\n signContainerMutationEvent,\n} from \"../../../../data/containers/shared/events\";\nimport {\n type getTargetContainerContext,\n readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n ContainerMovePlan,\n ContainerMutationAuthor,\n} from \"../../../../data/containers/shared/types\";\nimport type { SignedRotationTarget } from \"../rotation/rotationContext\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\n\nasync function deriveContainerMoveManifest(input: {\n containerKeyEpochId: string;\n containerKeyPublicKey: string | null;\n destinationParent: ContainerWriterProjectionResponse[\"path\"][number];\n eventHash: string;\n previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): Promise<Pick<ContainerMovePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n const previousState = readContainerState(input.previousManifest);\n const destinationState = readContainerState(input.destinationParent);\n const state: ContainerAccessManifestState = {\n ...previousState,\n epoch: previousState.epoch + 1,\n previousManifestHash: input.previousManifest.manifestHash,\n eventHash: input.eventHash,\n parentContainerId: destinationState.containerId,\n parentManifestHash: input.destinationParent.manifestHash,\n containerKeyEpochId: input.containerKeyEpochId,\n containerKeyPublicKey: input.containerKeyPublicKey,\n };\n const manifest = await deriveContainerAccessManifest(state);\n\n return {\n manifest,\n manifestHash: await computeAccessManifestHash(manifest),\n state,\n };\n}\n\nasync function buildContainerMoveEventBody(input: {\n containerKeyEpochId: string;\n containerKeyPublicKey: string | null;\n keyring: ContainerKekKeyring;\n parentContainerId: string;\n parentManifestHash: string;\n predecessorBridge: ContainerKekPredecessorBridge;\n}): Promise<ContainerMoveAccessEventBody> {\n return {\n eventType: \"container.move\",\n parentContainerId: input.parentContainerId,\n parentManifestHash: input.parentManifestHash,\n containerKeyEpochId: input.containerKeyEpochId,\n containerKeyPublicKey: input.containerKeyPublicKey,\n keyringHash: await computeContainerKekKeyringHash(input.keyring),\n predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n input.predecessorBridge,\n ),\n };\n}\n\ninterface MoveSigningContext {\n author: ContainerMutationAuthor;\n dependencyManifestHashes: readonly string[];\n eventId: string | undefined;\n signedAt: string | undefined;\n}\n\nfunction signContainerMoveEvent(input: {\n body: ContainerMoveAccessEventBody;\n containerId: string;\n signing: MoveSigningContext;\n source: ReturnType<typeof getTargetContainerContext>;\n}) {\n return signContainerMutationEvent({\n author: input.signing.author,\n body: input.body,\n containerId: input.containerId,\n dependencyManifestHashes: input.signing.dependencyManifestHashes,\n eventId: input.signing.eventId ?? crypto.randomUUID(),\n previousManifestHash: input.source.manifest.manifestHash,\n signedAt: input.signing.signedAt ?? new Date().toISOString(),\n });\n}\n\nfunction buildMoveKeyEpoch(input: {\n containerKeyEpochId: string;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n eventHash: string;\n manifestHash: string;\n source: ReturnType<typeof getTargetContainerContext>;\n}) {\n return buildContainerCreateKeyEpoch({\n containerId: readContainerState(input.source.manifest).containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n eventHash: input.eventHash,\n keyEpoch: input.source.kek.containerKeyEpoch + 1,\n manifestHash: input.manifestHash,\n parentContainerKeyEpochId: input.destinationParent.kek.containerKeyEpochId,\n });\n}\n\nexport async function buildMoveRotationWithBody(input: {\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n destinationState: ContainerAccessManifestState;\n override: string | undefined;\n predecessorContainerKey: Uint8Array;\n previousState: ContainerAccessManifestState;\n source: SignedRotationTarget;\n}) {\n const rotation = await buildContainerRotationArtifacts({\n containerId: input.previousState.containerId,\n currentKek: input.source.kek,\n currentKeyMaterial: input.predecessorContainerKey,\n keyEpoch: input.source.kek.containerKeyEpoch + 1,\n override: input.override,\n signedEpochIds: input.source.signedEpochIds,\n });\n const body = await buildContainerMoveEventBody({\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: input.previousState.containerId,\n keyMaterial: rotation.containerKey,\n }),\n containerKeyEpochId: rotation.containerKeyEpochId,\n keyring: rotation.keyring,\n parentContainerId: input.destinationState.containerId,\n parentManifestHash: input.destinationParent.manifest.manifestHash,\n predecessorBridge: rotation.predecessorBridge,\n });\n return { ...rotation, body };\n}\n\nexport async function deriveMoveManifestArtifacts(input: {\n body: ContainerMoveAccessEventBody;\n containerKeyEpochId: string;\n destinationParent: ReturnType<typeof getTargetContainerContext>;\n previousState: ContainerAccessManifestState;\n signing: MoveSigningContext;\n source: ReturnType<typeof getTargetContainerContext>;\n}) {\n const { event, eventHash } = await signContainerMoveEvent({\n body: input.body,\n containerId: input.previousState.containerId,\n signing: input.signing,\n source: input.source,\n });\n const { manifest, manifestHash, state } = await deriveContainerMoveManifest({\n containerKeyPublicKey: input.body.containerKeyPublicKey,\n containerKeyEpochId: input.containerKeyEpochId,\n destinationParent: input.destinationParent.manifest,\n eventHash,\n previousManifest: input.source.manifest,\n });\n const keyEpoch = buildMoveKeyEpoch({\n containerKeyEpochId: input.containerKeyEpochId,\n destinationParent: input.destinationParent,\n eventHash,\n manifestHash,\n source: input.source,\n });\n return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n"]}

package/workflows/containers/child/{moveRotation.js → move/moveRotation.js} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { createContainerKekPredecessorBridge, KeyingVerificationError, normalizeContainerKekKeyring, openContainerKekKeyring, sealContainerKekKeyring, } from "../../../internal/crypto/index.js";
-import { resolveContainerKekEpochId } from "../../../data/containers/shared/events.js";
-import { verifyContainerKekEntries } from "../../../data/documents/shared/containerKekEntryVerification.js";
+import { createContainerKekPredecessorBridge, KeyingVerificationError, normalizeContainerKekKeyring, openContainerKekKeyring, sealContainerKekKeyring, } from "../../../../internal/crypto/index.js";
+import { resolveContainerKekEpochId } from "../../../../data/containers/shared/events.js";
+import { verifyContainerKekEntries } from "../../../../data/documents/shared/containerKekEntryVerification.js";
 /**
  * A rotation must never launder history it did not verify: an
  * authenticated-but-poisoned keyring (sealed by a prior authorized writer

package/workflows/containers/child/move/moveRotation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"moveRotation.js","sourceRoot":"","sources":["moveRotation.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AAE5G;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAA4C;AAC5C;;;;;;GAMG;AACH,cAAmC;IAEnC,MAAM,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO;QAC9C,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB;YAC5C,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/D,qBAAqB,EAAE,KAAK,CAAC,kBAAkB;SAChD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,2BAA2B,CAC/B,KAAK,CAAC,WAAW,EACjB,eAAe,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,OAAO,uBAAuB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE;YACP,GAAG,eAAe;YAClB;gBACE,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;gBACzD,WAAW,EAAE,KAAK,CAAC,kBAAkB;aACtC;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAOrD;IAMC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,uBAAuB,EAAE,KAAK,CAAC,kBAAkB;QACjD,8BAA8B,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type {\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n} from \"@tearleads/crypto\";\nimport {\n createContainerKekPredecessorBridge,\n KeyingVerificationError,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport { resolveContainerKekEpochId } from \"../../../../data/containers/shared/events\";\nimport { verifyContainerKekEntries } from \"../../../../data/documents/shared/containerKekEntryVerification\";\n\n/**\n * A rotation must never launder history it did not verify: an\n * authenticated-but-poisoned keyring (sealed by a prior authorized writer\n * with wrong material) would otherwise be re-signed under the honest\n * rotator's event. Every entry is checked against the material-id its\n * ordinal commits to before it is sealed forward; entry i is key epoch\n * i + 1.\n */\nexport async function verifyKeyringEntriesForSeal(\n containerId: string,\n entries: readonly ContainerKekKeyringEntry[],\n /**\n * The epoch ids the KEK's signed history commits to, wherever the\n * projection served it (`signedHistoryEpochIds`). A self-consistent forgery\n * passes the material check but cannot also make a real id disappear, so an\n * honest rotation never re-signs one. The KEK's own served history alone is\n * not enough: a server can serve it under another KEK (#2365 finding 32).\n */\n signedEpochIds: ReadonlySet<string>,\n): Promise<void> {\n await verifyContainerKekEntries(containerId, entries);\n const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));\n for (const historicalId of signedEpochIds) {\n if (!entryIds.has(historicalId)) {\n // Classified like the reader's and the override's refusal of it.\n throw new KeyingVerificationError(\n \"missing_dependency\",\n \"Container KEK keyring omits an epoch its manifest history commits to\",\n );\n }\n }\n}\n\n/**\n * Re-seals the container's key history for a rotation: the previous\n * keyring's entries plus the retiring key, under the new epoch's key. One\n * decrypt and one seal regardless of container age.\n */\nexport async function sealRotationKeyring(input: {\n containerId: string;\n currentKek: ContainerKekResponse;\n currentKeyMaterial: Uint8Array;\n keyEpoch: number;\n signedEpochIds: ReadonlySet<string>;\n successorContainerKey: Uint8Array;\n successorContainerKeyEpochId: string;\n}): Promise<ContainerKekKeyring> {\n const previousEntries = input.currentKek.keyring\n ? await openContainerKekKeyring({\n keyEpoch: input.currentKek.containerKeyEpoch,\n keyring: normalizeContainerKekKeyring(input.currentKek.keyring),\n successorContainerKey: input.currentKeyMaterial,\n })\n : [];\n await verifyKeyringEntriesForSeal(\n input.containerId,\n previousEntries,\n input.signedEpochIds,\n );\n return sealContainerKekKeyring({\n containerId: input.containerId,\n entries: [\n ...previousEntries,\n {\n containerKeyEpochId: input.currentKek.containerKeyEpochId,\n keyMaterial: input.currentKeyMaterial,\n },\n ],\n keyEpoch: input.keyEpoch,\n successorContainerKey: input.successorContainerKey,\n successorContainerKeyEpochId: input.successorContainerKeyEpochId,\n });\n}\n\n/**\n * Mints one container KEK rotation: fresh entropy for the new epoch, the\n * write-once bridge to the retiring epoch, and the re-sealed keyring.\n */\nexport async function buildContainerRotationArtifacts(input: {\n containerId: string;\n currentKek: ContainerKekResponse;\n currentKeyMaterial: Uint8Array;\n keyEpoch: number;\n override?: string | undefined;\n signedEpochIds: ReadonlySet<string>;\n}): Promise<{\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n keyring: ContainerKekKeyring;\n predecessorBridge: ContainerKekPredecessorBridge;\n}> {\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.containerId,\n keyEpoch: input.keyEpoch,\n keyMaterial: containerKey,\n override: input.override,\n });\n const predecessorBridge = await createContainerKekPredecessorBridge({\n containerId: input.containerId,\n predecessorContainerKey: input.currentKeyMaterial,\n predecessorContainerKeyEpochId: input.currentKek.containerKeyEpochId,\n successorContainerKey: containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n const keyring = await sealRotationKeyring({\n containerId: input.containerId,\n currentKek: input.currentKek,\n currentKeyMaterial: input.currentKeyMaterial,\n keyEpoch: input.keyEpoch,\n signedEpochIds: input.signedEpochIds,\n successorContainerKey: containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n return { containerKey, containerKeyEpochId, keyring, predecessorBridge };\n}\n"]}

package/workflows/containers/child/{moveWraps.js → move/moveWraps.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
-import { readContainerState } from "../../../data/containers/shared/projection.js";
-import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
-import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
-import { buildContainerRotationWraps } from "./rotationWraps.js";
+import { uniquePrincipalPolicies } from "../../../../data/containers/shared/principalPolicies.js";
+import { readContainerState } from "../../../../data/containers/shared/projection.js";
+import { assertContainerKekPathCurrent } from "../../../../data/documents/shared/containerKekCurrency.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../../data/keyingProjectionVerification/index.js";
+import { buildContainerRotationWraps } from "../rotation/rotationWraps.js";
 export async function collectContainerMovePrincipalPolicies(input) {
     const [sourcePolicies, destinationParentPolicies] = await Promise.all([
         collectContainerWriterProjectionPrincipalPolicies({

package/workflows/containers/child/move/moveWraps.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"moveWraps.js","sourceRoot":"","sources":["moveWraps.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EACL,iDAAiD,GAGlD,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAO3D;IACC,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,iDAAiD,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACF,iDAAiD,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,2BAA2B;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;KACH,CAAC,CAAC;IACH,OAAO,uBAAuB,CAAC;QAC7B,GAAG,cAAc;QACjB,GAAG,yBAAyB;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAa7C;IACC,6BAA6B,CAC3B,KAAK,CAAC,2BAA2B,CAAC,aAAa,CAChD,CAAC;IACF,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClD,MAAM,cAAc,GAAG,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,OAAO;QACL,iBAAiB;QACjB,GAAG,CAAC,MAAM,2BAA2B,CAAC;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,gBAAgB;YAChC,SAAS,EAAE,KAAK,CAAC,oBAAoB;YACrC,eAAe,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC,qBAAqB;YACzE,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerAccessManifestState } from \"@tearleads/crypto\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../../data/containers/shared/principalPolicies\";\nimport { readContainerState } from \"../../../../data/containers/shared/projection\";\nimport { assertContainerKekPathCurrent } from \"../../../../data/documents/shared/containerKekCurrency\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationWraps } from \"../rotation/rotationWraps\";\n\nexport async function collectContainerMovePrincipalPolicies(input: {\n destinationParentProjection: ContainerWriterProjectionResponse;\n execSql: ExecSql;\n previousProjection: ContainerWriterProjectionResponse;\n resolveUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) | undefined;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n const [sourcePolicies, destinationParentPolicies] = await Promise.all([\n collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.previousProjection,\n resolveUserKey: input.resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n }),\n collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.destinationParentProjection,\n resolveUserKey: input.resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n }),\n ]);\n return uniquePrincipalPolicies([\n ...sourcePolicies,\n ...destinationParentPolicies,\n ]);\n}\n\nexport async function buildContainerMoveWraps(input: {\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n destinationParentKek: ContainerKekResponse;\n destinationParentProjection: ContainerWriterProjectionResponse;\n execSql: ExecSql;\n manifestHash: string;\n previousProjection: ContainerWriterProjectionResponse;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n state: ContainerAccessManifestState;\n stillCurrent?: (() => boolean) | undefined;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}) {\n assertContainerKekPathCurrent(\n input.destinationParentProjection.containerKeks,\n );\n const principalPolicies = input.principalPolicies;\n const parentManifest = input.destinationParentProjection.path.at(-1);\n if (!parentManifest)\n throw new Error(\"Container move destination parent is missing\");\n return {\n principalPolicies,\n ...(await buildContainerRotationWraps({\n containerKey: input.containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n manifestHash: input.manifestHash,\n operationLabel: \"Container move\",\n parentKek: input.destinationParentKek,\n parentPublicKey: readContainerState(parentManifest).containerKeyPublicKey,\n principalPolicies,\n resolveUserKey: input.resolveProjectionUserKey,\n state: input.state,\n })),\n };\n}\n"]}

package/workflows/containers/child/mutationSubmit.js CHANGED Viewed

@@ -3,8 +3,8 @@ import { ContainerPathTooDeepError } from "../../../data/containers/shared/conta
 import { rememberVerifiedContainerHeads } from "../../../data/containers/shared/heldContainerHeads.js";
 import { acknowledgeContainerMutation, acknowledgeContainerMutationBatch, } from "../../../data/containers/shared/mutationAcknowledgement.js";
 import { isContainerPathTooDeepFailure } from "../../../data/containers/shared/mutationFailures.js";
-import { planCarriedDescendantRekeys, } from "./carriedDescendantRekeys.js";
 import { scheduleHeldDescendantRecitations } from "./recite.js";
+import { planCarriedDescendantRekeys, } from "./rekey/carriedDescendantRekeys.js";
 /** A mutation with no status-bearing variant: a share mints nothing to carry. */
 export async function submitPlainContainerMutation(plain) {
     const data = await plain();

package/workflows/containers/child/mutationSubmit.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mutationSubmit.js","sourceRoot":"","sources":["mutationSubmit.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,GAE/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAUjG,OAAO,EAEL,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAa7D,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAsD;IAEtD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAG7C;IACC,OAAO,KAAK,CAAC,MAAM;QACjB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE;QAChB,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IAIC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,IACE,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;QACvE,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM;QACpC,CAAC,KAAK,CAAC,aAAa,EACpB,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ;QAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAC1E,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,qBAAqB,CAC3B,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACjE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAEvD,KAgBD;IAKC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACzB,qEAAqE;QACrE,IAAI,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC;YACjD,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAEvC,MAAM,YAAY,GAChB,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,MAAM,4BAA4B,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;QACJ,CAAC,CAAC,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,iCAAiC,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC5D,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;IACT,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnE,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,KAAK,CAAC,kBAAkB;SACnC,CAAC,CAAC;QACH,iCAAiC,CAAC;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sEAAsE;YACtE,uEAAuE;YACvE,yDAAyD;YACzD,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,YAAY;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport {\n CONTAINER_MUTATION_ERROR_CODES,\n type ContainerRotationResponse,\n} from \"@tearleads/validators/response\";\nimport { ContainerPathTooDeepError } from \"../../../data/containers/shared/containerPathLimits\";\nimport { rememberVerifiedContainerHeads } from \"../../../data/containers/shared/heldContainerHeads\";\nimport {\n acknowledgeContainerMutation,\n acknowledgeContainerMutationBatch,\n} from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { isContainerPathTooDeepFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type {\n ContainerMutationAuthor,\n ContainerRotationResult,\n MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n type CarriedRekeyPlanningInput,\n planCarriedDescendantRekeys,\n type SpeculativePath,\n} from \"./carriedDescendantRekeys\";\nimport { scheduleHeldDescendantRecitations } from \"./recite\";\n\n/*\n Supplied by mutations that mint a new key epoch (rekey, revoke, move). The\n * server refuses one that would strand a level above a directly granted\n * container, and names the descendant rekeys it must carry instead (#2340).\n /\nexport interface CarriedRekeys {\n readonly planning: CarriedRekeyPlanningInput;\n /* The rotated container's own path once the rotation is accepted. /\n readonly rotated: () => Promise<SpeculativePath>;\n}\n\n/* A mutation with no status-bearing variant: a share mints nothing to carry. /\nexport async function submitPlainContainerMutation(\n plain: () => Promise<ContainerRotationResponse \| null>,\n): Promise<ContainerRotationResult> {\n const data = await plain();\n return data ? { data, ok: true } : { ok: false, status: null };\n}\n\n/\n Adapt a rotation endpoint pair to one status-bearing call. An adapter with\n * only the plain method still rotates; it just cannot learn what to carry, so a\n * rotation that needs descendants fails as any other refusal does.\n /\nexport async function submitContainerRotation(input: {\n plain: () => Promise<ContainerRotationResponse \| null>;\n result: (() => Promise<ContainerRotationResult>) \| undefined;\n}): Promise<ContainerRotationResult> {\n return input.result\n ? input.result()\n : submitPlainContainerMutation(input.plain);\n}\n\n/\n Submit a rotation; if the server refuses it for stranding a level above a\n * directly granted container, sign the descendant rekeys it names and resubmit\n * once with them carried. The refused attempt rolled back whole, so the signed\n * rotation still extends the current head and only the descendants need\n * signing. A second refusal means the tree moved underneath, and the caller's\n * own retry starts from a fresh projection.\n /\nexport async function submitRotationCarryingDescendants(input: {\n carriedRekeys?: CarriedRekeys \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n submit: (\n carried: readonly ContainerMutationRequest[],\n ) => Promise<ContainerRotationResult>;\n}): Promise<{\n carriedPlans: MaterializedContainerRekeyPlan[];\n result: ContainerRotationResult;\n}> {\n const result = await input.submit([]);\n if (\n result.ok \|\|\n result.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired \|\|\n !result.requiredContainerIds?.length \|\|\n !input.carriedRekeys\n ) {\n return { carriedPlans: [], result: reportTerminalRefusal(result) };\n }\n // Answerable, so not an error: callers submit with `reportErrors: false` and\n // only the refusal that ends the attempt is surfaced.\n const carriedPlans = await planCarriedDescendantRekeys({\n ...input.carriedRekeys.planning,\n requiredContainerIds: result.requiredContainerIds,\n rotated: [await input.carriedRekeys.rotated()],\n });\n // Superseded mid-flight: hand back the refusal unreported, since the caller\n // discards it and the generation that owned this attempt is gone.\n if (input.stillCurrent?.() === false) return { carriedPlans: [], result };\n return {\n carriedPlans,\n result: reportTerminalRefusal(\n await input.submit(carriedPlans.map(({ plan }) => plan.request)),\n ),\n };\n}\n\nfunction reportTerminalRefusal(\n result: ContainerRotationResult,\n): ContainerRotationResult {\n if (!result.ok) result.report?.();\n return result;\n}\n\n/\n Submit and acknowledge remote share/rekey/revoke/move plans before scheduling\n * opportunistic descendant re-citations. Create separately handles its lost\n * response conflict; group share caches the rotated policy after this tail.\n /\nexport async function submitAcknowledgedContainerMutation<\n TPlan extends Parameters<typeof acknowledgeContainerMutation>[0][\"plan\"],\n>(input: {\n apiClient: ContainerReciteApi;\n author: ContainerMutationAuthor;\n /* Present exactly when the plan minted a new key epoch. /\n carriedRekeys?: CarriedRekeys \| undefined;\n containerKey: Uint8Array;\n execSql: ExecSql;\n plan: TPlan;\n recitationPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n /* Session lifetime for best-effort work after durable acknowledgement. */\n recitationStillCurrent?: (() => boolean) \| undefined;\n reportSecurityIncident: SecurityIncidentReporter;\n stillCurrent?: (() => boolean) \| undefined;\n submit: (\n carried: readonly ContainerMutationRequest[],\n ) => Promise<ContainerRotationResult>;\n}): Promise<{\n containerKey: Uint8Array;\n plan: TPlan;\n response: ContainerRotationResponse;\n} \| null> {\n if (input.stillCurrent?.() === false) return null;\n const submitted = await submitRotationCarryingDescendants(input);\n if (!submitted.result.ok) {\n // Final, unlike the other refusals: a queued move must not retry it.\n if (isContainerPathTooDeepFailure(submitted.result))\n throw new ContainerPathTooDeepError();\n return null;\n }\n const { carriedPlans } = submitted;\n const response = submitted.result.data;\n\n const acknowledged =\n carriedPlans.length === 0\n ? await acknowledgeContainerMutation({\n execSql: input.execSql,\n plan: input.plan,\n response,\n stillCurrent: input.stillCurrent,\n })\n : // The rotation and what it carried committed together, so their pins\n // advance together: a missing acknowledgement refuses the whole batch.\n await acknowledgeContainerMutationBatch({\n execSql: input.execSql,\n plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n responses: [response, ...(response.containerRekeys ?? [])],\n stillCurrent: input.stillCurrent,\n });\n if (!acknowledged \|\| input.stillCurrent?.() === false) return null;\n\n try {\n rememberVerifiedContainerHeads({\n execSql: input.execSql,\n organizationId: input.author.organizationId,\n heads: [],\n policies: input.recitationPolicies,\n });\n scheduleHeldDescendantRecitations({\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n // `plans` are the containers whose descendants get re-cited; they are\n // never re-cited themselves. A carried rekey already cites the current\n // path, so listing it here spares its recitation budget.\n plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n reportSecurityIncident: input.reportSecurityIncident,\n stillCurrent: input.recitationStillCurrent ?? input.stillCurrent,\n });\n } catch {\n // Optional cache population cannot change an acknowledged mutation result.\n }\n return {\n containerKey: input.containerKey,\n plan: input.plan,\n response,\n };\n}\n"]}
1	+ {"version":3,"file":"mutationSubmit.js","sourceRoot":"","sources":["mutationSubmit.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,GAE/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAUjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAEL,2BAA2B,GAE5B,MAAM,iCAAiC,CAAC;AAazC,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAsD;IAEtD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAG7C;IACC,OAAO,KAAK,CAAC,MAAM;QACjB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE;QAChB,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IAIC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,IACE,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;QACvE,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM;QACpC,CAAC,KAAK,CAAC,aAAa,EACpB,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ;QAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAC1E,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,qBAAqB,CAC3B,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACjE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAEvD,KAgBD;IAKC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACzB,qEAAqE;QACrE,IAAI,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC;YACjD,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAEvC,MAAM,YAAY,GAChB,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,MAAM,4BAA4B,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;QACJ,CAAC,CAAC,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,iCAAiC,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC5D,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;IACT,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnE,IAAI,CAAC;QACH,8BAA8B,CAAC;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,KAAK,CAAC,kBAAkB;SACnC,CAAC,CAAC;QACH,iCAAiC,CAAC;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sEAAsE;YACtE,uEAAuE;YACvE,yDAAyD;YACzD,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,YAAY,EAAE,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,YAAY;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport {\n CONTAINER_MUTATION_ERROR_CODES,\n type ContainerRotationResponse,\n} from \"@tearleads/validators/response\";\nimport { ContainerPathTooDeepError } from \"../../../data/containers/shared/containerPathLimits\";\nimport { rememberVerifiedContainerHeads } from \"../../../data/containers/shared/heldContainerHeads\";\nimport {\n acknowledgeContainerMutation,\n acknowledgeContainerMutationBatch,\n} from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport { isContainerPathTooDeepFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ContainerReciteApi } from \"../../../data/containers/shared/reciteApi\";\nimport type {\n ContainerMutationAuthor,\n ContainerRotationResult,\n MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { scheduleHeldDescendantRecitations } from \"./recite\";\nimport {\n type CarriedRekeyPlanningInput,\n planCarriedDescendantRekeys,\n type SpeculativePath,\n} from \"./rekey/carriedDescendantRekeys\";\n\n/*\n Supplied by mutations that mint a new key epoch (rekey, revoke, move). The\n * server refuses one that would strand a level above a directly granted\n * container, and names the descendant rekeys it must carry instead (#2340).\n /\nexport interface CarriedRekeys {\n readonly planning: CarriedRekeyPlanningInput;\n /* The rotated container's own path once the rotation is accepted. /\n readonly rotated: () => Promise<SpeculativePath>;\n}\n\n/* A mutation with no status-bearing variant: a share mints nothing to carry. /\nexport async function submitPlainContainerMutation(\n plain: () => Promise<ContainerRotationResponse \| null>,\n): Promise<ContainerRotationResult> {\n const data = await plain();\n return data ? { data, ok: true } : { ok: false, status: null };\n}\n\n/\n Adapt a rotation endpoint pair to one status-bearing call. An adapter with\n * only the plain method still rotates; it just cannot learn what to carry, so a\n * rotation that needs descendants fails as any other refusal does.\n /\nexport async function submitContainerRotation(input: {\n plain: () => Promise<ContainerRotationResponse \| null>;\n result: (() => Promise<ContainerRotationResult>) \| undefined;\n}): Promise<ContainerRotationResult> {\n return input.result\n ? input.result()\n : submitPlainContainerMutation(input.plain);\n}\n\n/\n Submit a rotation; if the server refuses it for stranding a level above a\n * directly granted container, sign the descendant rekeys it names and resubmit\n * once with them carried. The refused attempt rolled back whole, so the signed\n * rotation still extends the current head and only the descendants need\n * signing. A second refusal means the tree moved underneath, and the caller's\n * own retry starts from a fresh projection.\n /\nexport async function submitRotationCarryingDescendants(input: {\n carriedRekeys?: CarriedRekeys \| undefined;\n stillCurrent?: (() => boolean) \| undefined;\n submit: (\n carried: readonly ContainerMutationRequest[],\n ) => Promise<ContainerRotationResult>;\n}): Promise<{\n carriedPlans: MaterializedContainerRekeyPlan[];\n result: ContainerRotationResult;\n}> {\n const result = await input.submit([]);\n if (\n result.ok \|\|\n result.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired \|\|\n !result.requiredContainerIds?.length \|\|\n !input.carriedRekeys\n ) {\n return { carriedPlans: [], result: reportTerminalRefusal(result) };\n }\n // Answerable, so not an error: callers submit with `reportErrors: false` and\n // only the refusal that ends the attempt is surfaced.\n const carriedPlans = await planCarriedDescendantRekeys({\n ...input.carriedRekeys.planning,\n requiredContainerIds: result.requiredContainerIds,\n rotated: [await input.carriedRekeys.rotated()],\n });\n // Superseded mid-flight: hand back the refusal unreported, since the caller\n // discards it and the generation that owned this attempt is gone.\n if (input.stillCurrent?.() === false) return { carriedPlans: [], result };\n return {\n carriedPlans,\n result: reportTerminalRefusal(\n await input.submit(carriedPlans.map(({ plan }) => plan.request)),\n ),\n };\n}\n\nfunction reportTerminalRefusal(\n result: ContainerRotationResult,\n): ContainerRotationResult {\n if (!result.ok) result.report?.();\n return result;\n}\n\n/\n Submit and acknowledge remote share/rekey/revoke/move plans before scheduling\n * opportunistic descendant re-citations. Create separately handles its lost\n * response conflict; group share caches the rotated policy after this tail.\n /\nexport async function submitAcknowledgedContainerMutation<\n TPlan extends Parameters<typeof acknowledgeContainerMutation>[0][\"plan\"],\n>(input: {\n apiClient: ContainerReciteApi;\n author: ContainerMutationAuthor;\n /* Present exactly when the plan minted a new key epoch. /\n carriedRekeys?: CarriedRekeys \| undefined;\n containerKey: Uint8Array;\n execSql: ExecSql;\n plan: TPlan;\n recitationPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n /* Session lifetime for best-effort work after durable acknowledgement. */\n recitationStillCurrent?: (() => boolean) \| undefined;\n reportSecurityIncident: SecurityIncidentReporter;\n stillCurrent?: (() => boolean) \| undefined;\n submit: (\n carried: readonly ContainerMutationRequest[],\n ) => Promise<ContainerRotationResult>;\n}): Promise<{\n containerKey: Uint8Array;\n plan: TPlan;\n response: ContainerRotationResponse;\n} \| null> {\n if (input.stillCurrent?.() === false) return null;\n const submitted = await submitRotationCarryingDescendants(input);\n if (!submitted.result.ok) {\n // Final, unlike the other refusals: a queued move must not retry it.\n if (isContainerPathTooDeepFailure(submitted.result))\n throw new ContainerPathTooDeepError();\n return null;\n }\n const { carriedPlans } = submitted;\n const response = submitted.result.data;\n\n const acknowledged =\n carriedPlans.length === 0\n ? await acknowledgeContainerMutation({\n execSql: input.execSql,\n plan: input.plan,\n response,\n stillCurrent: input.stillCurrent,\n })\n : // The rotation and what it carried committed together, so their pins\n // advance together: a missing acknowledgement refuses the whole batch.\n await acknowledgeContainerMutationBatch({\n execSql: input.execSql,\n plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n responses: [response, ...(response.containerRekeys ?? [])],\n stillCurrent: input.stillCurrent,\n });\n if (!acknowledged \|\| input.stillCurrent?.() === false) return null;\n\n try {\n rememberVerifiedContainerHeads({\n execSql: input.execSql,\n organizationId: input.author.organizationId,\n heads: [],\n policies: input.recitationPolicies,\n });\n scheduleHeldDescendantRecitations({\n apiClient: input.apiClient,\n author: input.author,\n execSql: input.execSql,\n // `plans` are the containers whose descendants get re-cited; they are\n // never re-cited themselves. A carried rekey already cites the current\n // path, so listing it here spares its recitation budget.\n plans: [input.plan, ...carriedPlans.map(({ plan }) => plan)],\n reportSecurityIncident: input.reportSecurityIncident,\n stillCurrent: input.recitationStillCurrent ?? input.stillCurrent,\n });\n } catch {\n // Optional cache population cannot change an acknowledged mutation result.\n }\n return {\n containerKey: input.containerKey,\n plan: input.plan,\n response,\n };\n}\n"]}

package/workflows/containers/child/{carriedDescendantRekeys.js → rekey/carriedDescendantRekeys.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../internal/validators/util/index.js";
-import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
-import { buildMaterializedContainerRekeyPlan } from "./rekey.js";
+import { MAX_ROTATION_CONTAINER_REKEYS } from "../../../../internal/validators/util/index.js";
+import { verifyContainerWriterProjection, } from "../../../../data/keyingProjectionVerification/index.js";
+import { selectReplacementPrincipalPolicyReferences } from "../rotation/replacementPrincipalPolicyReferences.js";
+import { buildMaterializedContainerRekeyPlan } from "./index.js";
 import { rebaseContainerWriterProjection } from "./rekeyProjection.js";
-import { selectReplacementPrincipalPolicyReferences } from "./replacementPrincipalPolicyReferences.js";
 /**
  * Re-root a served projection on the deepest not-yet-accepted proper ancestor
  * among `speculativePaths`. Each carried plan's own path was built the same

package/workflows/containers/child/rekey/carriedDescendantRekeys.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"carriedDescendantRekeys.js","sourceRoot":"","sources":["carriedDescendantRekeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAM3E,OAAO,EAIL,+BAA+B,GAChC,MAAM,+CAA+C,CAAC;AAIvD,OAAO,EAAE,0CAA0C,EAAE,MAAM,kDAAkD,CAAC;AAC9G,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAuCpE;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyC,EACzC,gBAA4C;IAK5C,IAAI,OAAO,GAA2B,IAAI,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,MAAM,WAAW,IAAI,gBAAgB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAClE,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,WAAW,CACzC,CAAC;QACF,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,OAAO,GAAG,WAAW,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,+BAA+B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAGC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,+BAA+B,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,mCAAmC,CAAC;QACzC,MAAM,EAAE;YACN,GAAG,KAAK,CAAC,MAAM;YACf,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc;SAChD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mEAAmE;QACnE,8BAA8B,EAAE,KAAK;QACrC,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC1D,CAAC,CAAC,MAAM,0CAA0C,CAAC;gBAC/C,MAAM,EAAE,KAAK,CAAC,0BAA0B;gBACxC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,+BAA+B,EAC7B,KAAK,CAAC,+BAA+B;aACxC,CAAC;YACJ,CAAC,CAAC,SAAS;QACb,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAIC;IAED,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAsB,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B;YAAE,MAAM;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS;QACvC,MAAM,MAAM,GACV,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;YAC5C,GAAG,KAAK;YACR,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { MAX_ROTATION_CONTAINER_REKEYS } from \"@tearleads/validators/util\";\nimport type {\n ContainerMutationAuthor,\n ContainerRekeyApi,\n MaterializedContainerRekeyPlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n verifyContainerWriterProjection,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { selectReplacementPrincipalPolicyReferences } from \"../rotation/replacementPrincipalPolicyReferences\";\nimport { buildMaterializedContainerRekeyPlan } from \"./index\";\nimport { rebaseContainerWriterProjection } from \"./rekeyProjection\";\n\n/** What a rotation needs in hand to sign the descendant rekeys it must carry. */\nexport interface CarriedRekeyPlanningInput {\n readonly apiClient: Pick<ContainerRekeyApi, \"getContainerWriterProjection\">;\n readonly author: ContainerMutationAuthor;\n readonly execSql: ExecSql;\n /**\n * Keys the batch minted and has yet to commit, by epoch id. A rotation's\n * successor is wrapped to recipients at heads the batch itself commits, so\n * no wrap on a re-rooted path opens it for the signer before then; the key\n * the signer just minted does, and its keyring then opens what sits below.\n */\n readonly knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n /**\n * Verified policies the batch itself commits, which the rebased paths cite\n * before any store holds them; and the one each carried rekey cites anew.\n */\n readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n readonly replacementPrincipalPolicy?:\n | PrincipalPolicyCurrentEvidence\n | undefined;\n readonly resolveAuthoredPolicyReferences?:\n | CurrentPolicyReferenceResolver\n | undefined;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly stillCurrent?: (() => boolean) | undefined;\n readonly targetSecretKey: Uint8Array;\n readonly warmReferencedPrincipalPolicies?:\n | ReferencedPrincipalPolicyWarmer\n | undefined;\n}\n\n/** A rotated container's own path once its batch is accepted. */\nexport type SpeculativePath = Pick<\n ContainerWriterProjectionResponse,\n \"containerKeks\" | \"organizationId\" | \"path\" | \"policyEvidence\"\n>;\n\n/**\n * Re-root a served projection on the deepest not-yet-accepted proper ancestor\n * among `speculativePaths`. Each carried plan's own path was built the same\n * way, so the deepest one already holds every speculative level above it. The\n * container's own path, when the batch rotates it too, is not an ancestor: the\n * caller is re-planning that rotation, and it extends what sits above.\n */\nexport function rebaseOnDeepestAncestor(\n served: ContainerWriterProjectionResponse,\n speculativePaths: readonly SpeculativePath[],\n): {\n ancestor: SpeculativePath;\n projection: ContainerWriterProjectionResponse;\n} | null {\n let deepest: SpeculativePath | null = null;\n let deepestIndex = -1;\n for (const speculative of speculativePaths) {\n const containerId = speculative.containerKeks.at(-1)?.containerId;\n if (containerId === served.containerId) continue;\n const index = served.containerKeks.findIndex(\n (kek) => kek.containerId === containerId,\n );\n if (index > deepestIndex) {\n deepest = speculative;\n deepestIndex = index;\n }\n }\n if (!deepest) return null;\n const projection = rebaseContainerWriterProjection(served, deepest);\n return projection ? { ancestor: deepest, projection } : null;\n}\n\n/**\n * Sign one carried rekey against the path its batch will leave behind. The\n * served projection is fetched by the caller; here it is verified, must sit\n * below one of the rotated containers and in that container's organization,\n * and is signed only if this signer holds its key and write access — which a\n * member able to rotate the ancestor always does, since both inherit downward.\n */\nexport async function planCarriedDescendantRekey(\n input: CarriedRekeyPlanningInput & {\n readonly rotated: readonly SpeculativePath[];\n readonly served: ContainerWriterProjectionResponse;\n },\n): Promise<MaterializedContainerRekeyPlan> {\n // Pin the served head before signing beyond it. The batch is acknowledged\n // against the latest durable pin, and a carried rekey is always past epoch\n // 1, so a device that never pinned this container would otherwise reject\n // its own batch after the server had committed it.\n await verifyContainerWriterProjection({\n execSql: input.execSql,\n principalPolicyCache: input.principalPolicyCache,\n projection: input.served,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n const rebased = rebaseOnDeepestAncestor(input.served, input.rotated);\n if (!rebased) {\n throw new Error(\n \"Carried descendant rekey is not below the rotated container\",\n );\n }\n // A batch locks whatever organizations it names, so the server holds each\n // to the rule on its own; a carried rekey belongs to the rotation it rides.\n if (input.served.organizationId !== rebased.ancestor.organizationId) {\n throw new Error(\n \"Carried descendant rekey is outside the rotated container's organization\",\n );\n }\n return buildMaterializedContainerRekeyPlan({\n author: {\n ...input.author,\n organizationId: rebased.ancestor.organizationId,\n },\n execSql: input.execSql,\n knownContainerKeks: input.knownContainerKeks,\n // Nothing here is acknowledged yet: pins move only with the batch.\n persistVerificationCheckpoints: false,\n previousProjection: rebased.projection,\n principalPolicyCache: input.principalPolicyCache,\n replacementPrincipalPolicy: input.replacementPrincipalPolicy\n ? await selectReplacementPrincipalPolicyReferences({\n policy: input.replacementPrincipalPolicy,\n projection: rebased.projection,\n principalPolicyCache: input.principalPolicyCache,\n resolveAuthoredPolicyReferences:\n input.resolveAuthoredPolicyReferences,\n })\n : undefined,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n targetSecretKey: input.targetSecretKey,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n}\n\n/**\n * Sign the descendant rekeys a rotation must commit with (#2340). The server\n * refuses a rotation that would leave a level above a directly granted\n * container pinned to a retired epoch, because the grantee could never re-key\n * that level itself and its writes would wait on another device. It names the\n * levels; this signs them, parent-first, each against the path the batch will\n * leave behind rather than the one currently served.\n *\n * `requiredContainerIds` is a hint, never an authority: each container is\n * fetched and verified here, and refused unless it sits below a rotation.\n */\nexport async function planCarriedDescendantRekeys(\n input: CarriedRekeyPlanningInput & {\n readonly requiredContainerIds: readonly string[];\n /** Each rotated container's own path once the batch is accepted. */\n readonly rotated: readonly SpeculativePath[];\n },\n): Promise<MaterializedContainerRekeyPlan[]> {\n const plans: MaterializedContainerRekeyPlan[] = [];\n const speculativePaths: SpeculativePath[] = [...input.rotated];\n const knownContainerKeks = new Map(input.knownContainerKeks);\n const planned = new Set<string>();\n for (const containerId of input.requiredContainerIds) {\n if (plans.length >= MAX_ROTATION_CONTAINER_REKEYS) break;\n if (planned.has(containerId)) continue;\n const served =\n await input.apiClient.getContainerWriterProjection(containerId);\n if (!served) {\n throw new Error(\"Carried descendant rekey projection is unavailable\");\n }\n if (served.containerId !== containerId) {\n throw new Error(\"Carried descendant rekey targets another container\");\n }\n const plan = await planCarriedDescendantRekey({\n ...input,\n knownContainerKeks,\n rotated: speculativePaths,\n served,\n });\n planned.add(containerId);\n plans.push(plan);\n speculativePaths.push(plan.writerProjection);\n knownContainerKeks.set(plan.plan.containerKeyEpochId, plan.containerKey);\n }\n return plans;\n}\n"]}

package/workflows/containers/child/{rekey.d.ts → rekey/index.d.ts} RENAMED Viewed

@@ -1,9 +1,9 @@
-import type { ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
-import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerMutationAuthor, MaterializedContainerRekeyPlan } from "../../../data/containers/shared/types.js";
-import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { PrincipalPolicyCurrentEvidence } from "../../../data/principals/principalPolicyEvidence.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { ContainerKekKeyringEntry } from "../../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, MaterializedContainerRekeyPlan } from "../../../../data/containers/shared/types.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { PrincipalPolicyCurrentEvidence } from "../../../../data/principals/principalPolicyEvidence.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
 /**
  * An explicit container KEK rotation with no membership change. Doubles as
  * the repair operation: passing `keyringEntriesOverride` seals a keyring

package/workflows/containers/child/{rekey.js → rekey/index.js} RENAMED Viewed

@@ -1,17 +1,17 @@
-import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, createContainerKekPredecessorBridge, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, sealContainerKekKeyring, } from "../../../internal/crypto/index.js";
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { buildContainerCreateKeyEpoch, resolveContainerKekEpochId, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
-import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
-import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
-import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
+import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, createContainerKekPredecessorBridge, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, sealContainerKekKeyring, } from "../../../../internal/crypto/index.js";
+import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
+import { buildContainerCreateKeyEpoch, resolveContainerKekEpochId, signContainerMutationEvent, } from "../../../../data/containers/shared/events.js";
+import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../../data/containers/shared/projection.js";
+import { readCanonicalRecord } from "../../../../data/keying/canonicalJson.js";
+import { requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
+import { sealRotationKeyring, verifyKeyringEntriesForSeal, } from "../move/moveRotation.js";
+import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "../mutationRequestCore.js";
+import { resolveRotationContext, } from "../rotation/rotationContext.js";
+import { collectContainerRevokePrincipalPolicies } from "../rotation/rotationPrincipalPolicies.js";
+import { buildContainerRotationWraps } from "../rotation/rotationWraps.js";
+import { refreshedPrincipalPolicies, refreshedPrincipalReferences, } from "../share/sharePlanCore.js";
 import { assertOverrideMatchesSignedLineage } from "./keyringOverrideLineage.js";
-import { sealRotationKeyring, verifyKeyringEntriesForSeal, } from "./moveRotation.js";
-import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
 import { containerWriterProjectionFromRekeyPlan, isSpeculativeContainerWriterProjection, } from "./rekeyProjection.js";
-import { resolveRotationContext, } from "./rotationContext.js";
-import { collectContainerRevokePrincipalPolicies } from "./rotationPrincipalPolicies.js";
-import { buildContainerRotationWraps } from "./rotationWraps.js";
-import { refreshedPrincipalPolicies, refreshedPrincipalReferences, } from "./sharePlanCore.js";
 async function buildRekeyRotationArtifacts(input) {
     const containerKeyEpochId = await resolveContainerKekEpochId({
         containerId: input.previousContainerId,
@@ -224,4 +224,4 @@ function buildContainerRekeyPlan(input) {
         wraps: input.wraps,
     };
 }
-//# sourceMappingURL=rekey.js.map
+//# sourceMappingURL=index.js.map

package/workflows/containers/child/rekey/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,yBAAyB,EAIzB,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AAMvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAIL,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAE3B,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IAOC,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,WAAW,EAAE,KAAK,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,KAAK,CAAC,YAAY;QACzC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,qDAAqD;QACrD,kCAAkC,CAChC,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;QACF,MAAM,2BAA2B,CAC/B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAwB,KAAK,CAAC,sBAAsB;QAC/D,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,sBAAsB;gBAC/B;oBACE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;oBACzD,WAAW,EAAE,KAAK,CAAC,uBAAuB;iBAC3C;aACF;YACD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC;QACJ,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;YACjD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC,CAAC;IACP,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAe3C;IACC,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,aAAa;QACtB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC;QACpC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,SAAS;QACT,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY;QACZ,yBAAyB,EAAE,KAAK,CAAC,SAAS,EAAE,mBAAmB,IAAI,IAAI;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AA2BD,SAAS,yBAAyB,CAAC,KAAqB;IACtD,OAAO,sCAAsC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACrE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE;QACrD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqB,EACrB,cAAyC;IAEzC,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;QACnD,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqB;IAErB,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACvD,MAAM,2BAA2B,CAAC;QAChC,YAAY;QACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QACvD,uBAAuB;QACvB,mBAAmB,EAAE,aAAa,CAAC,WAAW;QAC9C,MAAM;KACP,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAC3D,aAAa,EACb,wBAAwB,CACzB,CAAC;IAEF,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;QAC5D,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACvE,MAAM,4BAA4B,CAAC;QACjC,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,SAAS;QACT,iBAAiB;QACjB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,aAAa;QACb,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,iBAAiB;QACjC,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO;QACL,GAAG,gBAAgB;QACnB,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;YAC7D,gBAAgB;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAoBhC;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE;YACP,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;YAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;YACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,oCAAoC,CACrC;YACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;YACtE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;SACF;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n ContainerGrantPrincipalHead,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerRekeyAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n computeAccessManifestHash,\n computeContainerKekKeyringHash,\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n deriveContainerAccessManifest,\n deriveContainerKekWrappingPublicKey,\n sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport {\n buildContainerCreateKeyEpoch,\n resolveContainerKekEpochId,\n signContainerMutationEvent,\n} from \"../../../../data/containers/shared/events\";\nimport {\n asContainerManifestBundle,\n type getParentKekForTarget,\n type getTargetContainerContext,\n type readContainerState,\n uniqueSortedManifestHashes,\n} from \"../../../../data/containers/shared/projection\";\nimport type {\n ContainerMutationAuthor,\n ContainerRekeyPlan,\n MaterializedContainerRekeyPlan,\n} from \"../../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../../data/keying/canonicalJson\";\nimport {\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n sealRotationKeyring,\n verifyKeyringEntriesForSeal,\n} from \"../move/moveRotation\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"../mutationRequestCore\";\nimport {\n resolveRotationContext,\n type SignedRotationTarget,\n} from \"../rotation/rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"../rotation/rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"../rotation/rotationWraps\";\nimport {\n refreshedPrincipalPolicies,\n refreshedPrincipalReferences,\n} from \"../share/sharePlanCore\";\nimport { assertOverrideMatchesSignedLineage } from \"./keyringOverrideLineage\";\nimport {\n containerWriterProjectionFromRekeyPlan,\n isSpeculativeContainerWriterProjection,\n} from \"./rekeyProjection\";\n\nasync function buildRekeyRotationArtifacts(input: {\n containerKey: Uint8Array;\n keyringEntriesOverride: readonly ContainerKekKeyringEntry[] | undefined;\n nextContainerKeyEpoch: number;\n predecessorContainerKey: Uint8Array;\n previousContainerId: string;\n target: SignedRotationTarget;\n}): Promise<{\n containerKeyEpochId: string;\n keyring: ContainerKekKeyring;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n}> {\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.previousContainerId,\n keyEpoch: input.nextContainerKeyEpoch,\n keyMaterial: input.containerKey,\n });\n const predecessorBridge = await createContainerKekPredecessorBridge({\n containerId: input.previousContainerId,\n predecessorContainerKey: input.predecessorContainerKey,\n predecessorContainerKeyEpochId: input.target.kek.containerKeyEpochId,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n if (input.keyringEntriesOverride) {\n // A rebuilt override still has to agree with the epochs the projection's\n // signed history commits to; otherwise a repair could seal a forgery.\n // Exact match first, for distinct errors; the seal check below then adds\n // only the per-entry material check for an override.\n assertOverrideMatchesSignedLineage(\n input.keyringEntriesOverride,\n input.target.signedEpochIds,\n );\n await verifyKeyringEntriesForSeal(\n input.previousContainerId,\n input.keyringEntriesOverride,\n input.target.signedEpochIds,\n );\n }\n const keyring: ContainerKekKeyring = input.keyringEntriesOverride\n ? await sealContainerKekKeyring({\n containerId: input.previousContainerId,\n entries: [\n ...input.keyringEntriesOverride,\n {\n containerKeyEpochId: input.target.kek.containerKeyEpochId,\n keyMaterial: input.predecessorContainerKey,\n },\n ],\n keyEpoch: input.nextContainerKeyEpoch,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n })\n : await sealRotationKeyring({\n containerId: input.previousContainerId,\n currentKek: input.target.kek,\n currentKeyMaterial: input.predecessorContainerKey,\n keyEpoch: input.nextContainerKeyEpoch,\n signedEpochIds: input.target.signedEpochIds,\n successorContainerKey: input.containerKey,\n successorContainerKeyEpochId: containerKeyEpochId,\n });\n return { containerKeyEpochId, keyring, predecessorBridge };\n}\n\nasync function deriveRekeyManifestArtifacts(input: {\n containerKey: Uint8Array;\n author: ContainerMutationAuthor;\n containerKeyEpochId: string;\n eventId: string | undefined;\n keyring: ContainerKekKeyring;\n parentKek: ReturnType<typeof getParentKekForTarget>;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n previousProjection: ContainerWriterProjectionResponse;\n previousState: ReturnType<typeof readContainerState>;\n referencedPrincipalHeads: readonly ContainerGrantPrincipalHead[];\n signedAt: string | undefined;\n target: ReturnType<typeof getTargetContainerContext>;\n}) {\n const body: ContainerRekeyAccessEventBody = {\n eventType: \"container.rekey\",\n parentManifestHash:\n input.previousProjection.path.at(-2)?.manifestHash ?? null,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: input.previousState.containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: input.containerKeyEpochId,\n keyringHash: await computeContainerKekKeyringHash(input.keyring),\n predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n input.predecessorBridge,\n ),\n referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: input.previousState.containerId,\n dependencyManifestHashes: uniqueSortedManifestHashes(\n input.previousProjection.path,\n ),\n eventId: input.eventId ?? crypto.randomUUID(),\n previousManifestHash: input.target.manifest.manifestHash,\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const state = {\n ...input.previousState,\n parentManifestHash: body.parentManifestHash,\n containerKeyPublicKey: body.containerKeyPublicKey,\n epoch: input.previousState.epoch + 1,\n previousManifestHash: input.target.manifest.manifestHash,\n eventHash,\n containerKeyEpochId: input.containerKeyEpochId,\n referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n };\n const manifest = await deriveContainerAccessManifest(state);\n const manifestHash = await computeAccessManifestHash(manifest);\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: input.previousState.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n eventHash,\n keyEpoch: input.target.kek.containerKeyEpoch + 1,\n manifestHash,\n parentContainerKeyEpochId: input.parentKek?.containerKeyEpochId ?? null,\n });\n return { body, event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\n/**\n * An explicit container KEK rotation with no membership change. Doubles as\n * the repair operation: passing `keyringEntriesOverride` seals a keyring\n * rebuilt from the bridge log instead of re-opening the served one, so a\n * poisoned snapshot is replaced by ground truth.\n */\ninterface RekeyPlanInput {\n author: ContainerMutationAuthor;\n eventId?: string | undefined;\n execSql: ExecSql;\n keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;\n /** Keys a batch minted above this container and has yet to commit. */\n knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n persistVerificationCheckpoints?: boolean | undefined;\n previousProjection: ContainerWriterProjectionResponse;\n /** Verified policies the path may cite before they are stored locally. */\n principalPolicyCache?: PrincipalPolicyCache | undefined;\n replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n resolveProjectionUserKey: ProjectionUserKeyResolver;\n signedAt?: string | undefined;\n stillCurrent?: (() => boolean) | undefined;\n targetSecretKey: Uint8Array;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nfunction speculativeSafeRekeyInput(input: RekeyPlanInput): RekeyPlanInput {\n return isSpeculativeContainerWriterProjection(input.previousProjection)\n ? { ...input, persistVerificationCheckpoints: false }\n : input;\n}\n\nasync function collectRekeyPrincipalPolicies(\n input: RekeyPlanInput,\n resolveUserKey: ProjectionUserKeyResolver,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n const previousPolicies = await collectContainerRevokePrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n previousProjection: input.previousProjection,\n principalPolicyCache: input.principalPolicyCache,\n resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n const principalPolicies = refreshedPrincipalPolicies({\n previousPolicies,\n replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n });\n assertContainerAuthorAccess({\n author: input.author,\n projection: input.previousProjection,\n principalPolicies,\n minimumAccess: \"write\",\n });\n return principalPolicies;\n}\n\nexport async function buildMaterializedContainerRekeyPlan(\n input: RekeyPlanInput,\n): Promise<MaterializedContainerRekeyPlan> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container rekey\",\n );\n const planningInput = speculativeSafeRekeyInput(input);\n const containerKey = crypto.getRandomValues(new Uint8Array(32));\n const {\n parentKek,\n parentPublicKey,\n predecessorContainerKey,\n previousState,\n target,\n } = await resolveRotationContext(planningInput, \"rekey\");\n const { containerKeyEpochId, keyring, predecessorBridge } =\n await buildRekeyRotationArtifacts({\n containerKey,\n keyringEntriesOverride: input.keyringEntriesOverride,\n nextContainerKeyEpoch: target.kek.containerKeyEpoch + 1,\n predecessorContainerKey,\n previousContainerId: previousState.containerId,\n target,\n });\n const principalPolicies = await collectRekeyPrincipalPolicies(\n planningInput,\n resolveProjectionUserKey,\n );\n\n const referencedPrincipalHeads = refreshedPrincipalReferences({\n previousState,\n replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n });\n const { body, event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveRekeyManifestArtifacts({\n containerKey,\n author: input.author,\n containerKeyEpochId,\n eventId: input.eventId,\n keyring,\n parentKek,\n predecessorBridge,\n previousProjection: input.previousProjection,\n previousState,\n referencedPrincipalHeads,\n signedAt: input.signedAt,\n target,\n });\n const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n containerKey,\n containerKeyEpochId,\n manifestHash,\n operationLabel: \"Container rekey\",\n parentKek,\n parentPublicKey,\n principalPolicies,\n resolveUserKey: resolveProjectionUserKey,\n state,\n });\n\n const plan = buildContainerRekeyPlan({\n body,\n containerId: previousState.containerId,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyring,\n manifest,\n manifestHash,\n parentKek,\n predecessorBridge,\n previousManifest: asContainerManifestBundle(target.manifest),\n previousProjection: input.previousProjection,\n principalPolicies,\n state,\n userRecipientKeys,\n wraps,\n });\n const materializedPlan = { containerKey, plan };\n return {\n ...materializedPlan,\n writerProjection: await containerWriterProjectionFromRekeyPlan({\n materializedPlan,\n previousProjection: input.previousProjection,\n }),\n };\n}\n\nfunction buildContainerRekeyPlan(input: {\n body: ContainerRekeyAccessEventBody;\n containerId: string;\n containerKeyEpochId: string;\n event: ContainerRekeyPlan[\"event\"];\n eventHash: string;\n keyEpoch: ContainerRekeyPlan[\"keyEpoch\"];\n keyring: ContainerKekKeyring;\n manifest: ContainerRekeyPlan[\"manifest\"];\n manifestHash: string;\n parentKek: ReturnType<typeof getParentKekForTarget>;\n predecessorBridge: Awaited<\n ReturnType<typeof createContainerKekPredecessorBridge>\n >;\n previousManifest: ContainerRekeyPlan[\"previousManifest\"];\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n state: ContainerRekeyPlan[\"state\"];\n userRecipientKeys: ContainerRekeyPlan[\"userRecipientKeys\"];\n wraps: ContainerRekeyPlan[\"wraps\"];\n}): ContainerRekeyPlan {\n return {\n body: input.body,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n event: input.event,\n eventHash: input.eventHash,\n keyEpoch: input.keyEpoch,\n keyring: input.keyring,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousManifest: input.previousManifest,\n request: {\n ...containerMutationRequestCore(\"rekey\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n predecessorBridge: readCanonicalRecord(\n input.predecessorBridge,\n \"Container rekey predecessor bridge\",\n ),\n keyring: readCanonicalRecord(input.keyring, \"Container rekey keyring\"),\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container rekey parent KEK state\",\n ),\n },\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n}\n"]}

package/workflows/containers/child/{keyringOverrideLineage.d.ts → rekey/keyringOverrideLineage.d.ts} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { type ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
+import { type ContainerKekKeyringEntry } from "../../../../internal/crypto/index.js";
 /**
  * A rebuilt keyring override that omits an epoch the container's signed
  * lineage names. That is what a rebuild made before a concurrent rotation

package/workflows/containers/child/{keyringOverrideLineage.js → rekey/keyringOverrideLineage.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
 const LABEL = "Container rekey keyring override";
 /**
  * A rebuilt keyring override that omits an epoch the container's signed