@tearleads/client-sdk 0.1.63 → 0.1.64

package/workflows/containers/child/share/runtimeCurrentGroupShare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCurrentGroupShare.js","sourceRoot":"","sources":["runtimeCurrentGroupShare.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AACxG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AAEzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,UAAU,8BAA8B,CAC5C,OAAuE;IAEvE,MAAM,WAAW,GAAG,wCAAwC,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9B,MAAM,aAAa,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG,iCAAiC,CAC9C,iCAAiC,CAAC,OAAO,EAAE;QACzC,GAAG,OAAO;QACV,SAAS,EAAE;YACT,GAAG,aAAa;YAChB,GAAG,gCAAgC,CAAC,GAAG,CAAC;YACxC,+BAA+B,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;gBAChE,oEAAoE;gBACpE,2DAA2D;gBAC3D,MAAM,GAAG,CAAC,+BAA+B,EAAE,CAAC,cAAc,CAAC,CAAC;YAC9D,CAAC;SACF;KACF,CAAC,CACH,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,sBAAsB,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,WAAW,CACT;YACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;YACvD,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACjD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC;YACzC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;YACF,IAAI,CAAC,kBAAkB;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC3D,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACnD,OAAO,uBAAuB,CAAC;oBAC7B,OAAO;oBACP,KAAK;oBACL,MAAM;oBACN,sBAAsB;iBACvB,CAAC,CAAC;YACL,MAAM,YAAY,GAAG,MAAM,mCAAmC,CAAC;gBAC7D,GAAG,KAAK;gBACR,kBAAkB;gBAClB,oBAAoB,EAClB,uCAAuC,CAAC,kBAAkB,CAAC;gBAC7D,SAAS,EAAE;oBACT,eAAe,EAAE,MAAM;oBACvB,SAAS,EAAE,KAAK,CAAC,gBAAgB;oBACjC,WAAW,EAAE,OAAO;iBACrB;gBACD,wBAAwB;aACzB,CAAC,CAAC;YACH,OAAO,mCAAmC,CAAC;gBACzC,GAAG,KAAK;gBACR,kBAAkB,EAAE,kBAAkB;gBACtC,sBAAsB;gBACtB,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,YAAY,CAAC,IAAI,CAAC,OAAO,EACzB;oBACE,qCAAqC,EACnC,KAAK,CAAC,MAAM,CAAC,cAAc;iBAC9B,CACF,CACF;aACJ,CAAC,CAAC;QACL,CAAC,CACF,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  nullOnProjectionVerificationCancellation,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { inheritPrincipalHistoryProtection } from \"../../../../data/principals/principalHistoryRuntime\";\nimport { createRuntimeCurrentGroupMutation } from \"../../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport {\n  apiPrincipalPolicyPageReader,\n  apiProjectionPolicyHistoryReader,\n} from \"../../../principals/principalPolicyHistoryReader\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"../mutationSubmit\";\nimport { commitCurrentShareGrant } from \"./currentShareGrantMutation\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./index\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\n/** Current evidence covers planning, any compound grant mint, and acknowledgement. */\nexport function createRuntimeCurrentGroupShare(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n): typeof shareRemoteContainerWithGroup | undefined {\n  const readCurrent = createRuntimeCurrentSharePrincipalPolicy(runtime);\n  const api = runtime.apiClient;\n  const historyReader = apiPrincipalPolicyPageReader(api);\n  if (!readCurrent || !historyReader) return undefined;\n  const mutate = createRuntimeCurrentGroupMutation(\n    inheritPrincipalHistoryProtection(runtime, {\n      ...runtime,\n      apiClient: {\n        ...historyReader,\n        ...apiProjectionPolicyHistoryReader(api),\n        recoverPendingPrincipalMutation: async (organizationId: string) => {\n          // Built-in clients supply journal recovery; standalone hosts retain\n          // responsibility for transport and exact-outcome recovery.\n          await api.recoverPendingPrincipalMutation?.(organizationId);\n        },\n      },\n    }),\n  );\n  if (!mutate) throw new Error(\"Current group mutation custody is unavailable\");\n  return async (input) => {\n    if (input.stillCurrent?.() === false) return null;\n    const recitationStillCurrent = input.stillCurrent ?? (() => true);\n    return nullOnProjectionVerificationCancellation(() =>\n      readCurrent(\n        {\n          expectedGroupName: input.expectedGroupName ?? undefined,\n          groupId: input.recipientGroupId,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        },\n        async ({ policy, checkpointPolicies, stillCurrent }) => {\n          const share = { ...input, stillCurrent };\n          const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n            input.resolveProjectionUserKey,\n            \"Remote container share\",\n          );\n          const previousProjection = await resolveShareProjection(\n            share,\n            resolveProjectionUserKey,\n          );\n          if (!previousProjection) return null;\n          const grant = policy.grants.find(\n            (candidate) => candidate.containerId === input.containerId,\n          );\n          if (!grant || grant.accessLevel !== input.accessLevel)\n            return commitCurrentShareGrant({\n              runtime,\n              share,\n              mutate,\n              recitationStillCurrent,\n            });\n          const materialized = await buildMaterializedContainerSharePlan({\n            ...share,\n            previousProjection,\n            principalPolicyCache:\n              principalPolicyCacheForVerifiedPolicies(checkpointPolicies),\n            recipient: {\n              principalPolicy: policy,\n              subjectId: input.recipientGroupId,\n              subjectType: \"group\",\n            },\n            resolveProjectionUserKey,\n          });\n          return submitAcknowledgedContainerMutation({\n            ...share,\n            recitationPolicies: checkpointPolicies,\n            recitationStillCurrent,\n            containerKey: materialized.containerKey,\n            plan: materialized.plan,\n            submit: () =>\n              submitPlainContainerMutation(() =>\n                input.apiClient.shareContainer(\n                  input.containerId,\n                  materialized.plan.request,\n                  {\n                    expectedPaymentRequiredOrganizationId:\n                      input.author.organizationId,\n                  },\n                ),\n              ),\n          });\n        },\n      ),\n    );\n  };\n}\n"]}

package/workflows/containers/child/{shareAncestorRepair.js → share/shareAncestorRepair.js}

@@ -1,7 +1,7 @@
-import { ContainerAuthorAccessError } from "../../../data/containers/shared/authorAccess.js";
-import { ContainerKekRepairInaccessibleError } from "../../../data/documents/shared/containerKekCurrency.js";
-import { ContainerKekTargetUnreachableError } from "../../../data/documents/shared/containerKekPath.js";
-import { rekeyRemoteContainer } from "./rekeyRemote.js";
+import { ContainerAuthorAccessError } from "../../../../data/containers/shared/authorAccess.js";
+import { ContainerKekRepairInaccessibleError } from "../../../../data/documents/shared/containerKekCurrency.js";
+import { ContainerKekTargetUnreachableError } from "../../../../data/documents/shared/containerKekPath.js";
+import { rekeyRemoteContainer } from "../rekey/rekeyRemote.js";
 function carriesDirectGrant(projection) {
     const directGrants = Reflect.get(Object(projection.path.at(-1)?.state), "directGrants");
     return Array.isArray(directGrants) && directGrants.length > 0;

package/workflows/containers/child/share/shareAncestorRepair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareAncestorRepair.js","sourceRoot":"","sources":["shareAncestorRepair.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAM7F,OAAO,EAAE,mCAAmC,EAAE,MAAM,wDAAwD,CAAC;AAC7G,OAAO,EAAE,kCAAkC,EAAE,MAAM,oDAAoD,CAAC;AAOxG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,SAAS,kBAAkB,CACzB,UAA6C;IAE7C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EACrC,cAAc,CACf,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,oFAAoF;AACpF,SAAS,iBAAiB,CACxB,UAA6C;IAE7C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IACE,GAAG;YACH,GAAG,CAAC,yBAAyB,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,mBAAmB,EACtE,CAAC;YACD,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAYpD;IACC,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IACjE,IAAI,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAC1C,yEAAyE;IACzE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC7C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,aAAa,GACjB,YAAY,KAAK,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,SAAS,EAAE;gBACT,4BAA4B,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5C,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC;gBAC3D,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;gBACtE,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;gBACpD,GAAG,CAAC,oBAAoB;oBACtB,CAAC,CAAC,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;oBACtE,CAAC,CAAC,EAAE,CAAC;aACR;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,YAAY;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,MAAM,UAAU,GACd,KAAK,YAAY,0BAA0B;gBAC3C,KAAK,YAAY,kCAAkC,CAAC;YACtD,IAAI,UAAU,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC;YAC7C,MAAM,UAAU;gBACd,CAAC,CAAC,IAAI,mCAAmC,CAAC,YAAY,CAAC;gBACvD,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAClE,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { ContainerAuthorAccessError } from \"../../../../data/containers/shared/authorAccess\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  ContainerShareApi,\n} from \"../../../../data/containers/shared/types\";\nimport { ContainerKekRepairInaccessibleError } from \"../../../../data/documents/shared/containerKekCurrency\";\nimport { ContainerKekTargetUnreachableError } from \"../../../../data/documents/shared/containerKekPath\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { rekeyRemoteContainer } from \"../rekey/rekeyRemote\";\n\nfunction carriesDirectGrant(\n  projection: ContainerWriterProjectionResponse,\n): boolean {\n  const directGrants = Reflect.get(\n    Object(projection.path.at(-1)?.state),\n    \"directGrants\",\n  );\n  return Array.isArray(directGrants) && directGrants.length > 0;\n}\n\n/** The first level on the path, the container included, pinning a retired epoch. */\nfunction firstStaleLevelId(\n  projection: ContainerWriterProjectionResponse,\n): string | null {\n  const keks = projection.containerKeks;\n  for (let index = 1; index < keks.length; index += 1) {\n    const kek = keks[index];\n    if (\n      kek &&\n      kek.parentContainerKeyEpochId !== keks[index - 1]?.containerKeyEpochId\n    ) {\n      return kek.containerId;\n    }\n  }\n  return null;\n}\n\n/**\n * Repair a stale path down to and including a container before granting on it\n * (#2340).\n *\n * A chain with no grant beneath it may sit lazily stale after an ancestor\n * rotation, since nobody's writes depend on it. The first grant changes that:\n * its grantee could never re-key the levels above its container, so the server\n * refuses a first grant below a stale chain. The container's own edge must be\n * current too, because a grant cites the parent's current epoch and the\n * container's key epoch has to pin it. The sharer administers the container\n * through a grant at or above it, and the levels above that grant are already\n * current, so every stale level here is one the sharer can re-key. These\n * repairs are standalone and need not be atomic with the grant: a repair never\n * strands anyone.\n *\n * Every share does this, not only a first grant, which is all the server\n * insists on. A container that already carries a grant is stale only past the\n * carried-rekey cap, and its grantees are then parked behind exactly these\n * levels; the sharer is already here and able.\n */\nexport async function projectionWithCurrentAncestors(input: {\n  apiClient: ContainerShareApi &\n    Partial<Pick<ContainerRekeyApi, \"rekeyContainer\" | \"rekeyContainerResult\">>;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  execSql: ExecSql;\n  previousProjection: ContainerWriterProjectionResponse;\n  reportSecurityIncident: SecurityIncidentReporter;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<ContainerWriterProjectionResponse | null> {\n  const { rekeyContainer, rekeyContainerResult } = input.apiClient;\n  let projection = input.previousProjection;\n  // Each round repairs one level, and a path has a bounded number of them.\n  for (let round = 0; round < projection.containerKeks.length; round += 1) {\n    const staleLevelId = firstStaleLevelId(projection);\n    if (staleLevelId === null) return projection;\n    if (!rekeyContainer) {\n      // Not a repair someone else owes: the adapter simply cannot make one.\n      throw new Error(\n        \"Container share must re-key a stale path, which needs rekeyContainer\",\n      );\n    }\n    // This sharer may be unable to re-key a level above a container that\n    // already carries a grant, stale past the carried-rekey cap. The server\n    // asks a current chain only of a first grant, so it decides rather than\n    // this blocking a grant it would accept.\n    const serverDecides =\n      staleLevelId !== input.containerId && carriesDirectGrant(projection);\n    const repaired = await rekeyRemoteContainer({\n      apiClient: {\n        getContainerWriterProjection: (containerId) =>\n          input.apiClient.getContainerWriterProjection(containerId),\n        reciteContainer: (...args) => input.apiClient.reciteContainer(...args),\n        rekeyContainer: rekeyContainer.bind(input.apiClient),\n        ...(rekeyContainerResult\n          ? { rekeyContainerResult: rekeyContainerResult.bind(input.apiClient) }\n          : {}),\n      },\n      author: input.author,\n      containerId: staleLevelId,\n      execSql: input.execSql,\n      reportSecurityIncident: input.reportSecurityIncident,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      targetSecretKey: input.targetSecretKey,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }).catch((error: unknown) => {\n      const outOfReach =\n        error instanceof ContainerAuthorAccessError ||\n        error instanceof ContainerKekTargetUnreachableError;\n      if (outOfReach && serverDecides) return null;\n      throw outOfReach\n        ? new ContainerKekRepairInaccessibleError(staleLevelId)\n        : error;\n    });\n    if (input.stillCurrent?.() === false) return null;\n    if (!repaired) return serverDecides ? projection : null;\n    const refreshed = await input.apiClient.getContainerWriterProjection(\n      input.containerId,\n    );\n    if (!refreshed) return null;\n    projection = refreshed;\n  }\n  return firstStaleLevelId(projection) === null ? projection : null;\n}\n"]}

package/workflows/containers/child/{shareMaterialization.d.ts → share/shareMaterialization.d.ts}

@@ -1,8 +1,8 @@
-import type { ContainerAccessLevel } from "../../../internal/crypto/index.js";
-import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerMutationAuthor, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
-import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { ContainerAccessLevel } from "../../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, MaterializedContainerSharePlan } from "../../../../data/containers/shared/types.js";
+import type { PrincipalPolicyCache, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
 import { type ContainerShareRecipient } from "./sharePlanCore.js";
 interface BuildMaterializedContainerSharePlanInput {
     accessLevel: ContainerAccessLevel;

package/workflows/containers/child/{shareMaterialization.js → share/shareMaterialization.js}

@@ -1,10 +1,10 @@
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { signContainerMutationEvent } from "../../../data/containers/shared/events.js";
-import { asContainerManifestBundle, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToRootUser, } from "../../../data/containers/shared/projection.js";
-import { readContainerKeyWraps } from "../../../data/containers/shared/readers.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
-import { requireUnwrappedKek } from "./rotationContext.js";
+import { assertContainerAuthorAccess } from "../../../../data/containers/shared/authorAccess.js";
+import { signContainerMutationEvent } from "../../../../data/containers/shared/events.js";
+import { asContainerManifestBundle, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToRootUser, } from "../../../../data/containers/shared/projection.js";
+import { readContainerKeyWraps } from "../../../../data/containers/shared/readers.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { projectionVerificationOptions } from "../../../../data/documents/shared/types.js";
+import { requireUnwrappedKek } from "../rotation/rotationContext.js";
 import { buildContainerSharePlanResult, collectContainerSharePrincipalPolicies, collectShareUserRecipientKeys, deriveContainerShareManifest, referencedPrincipalHeadFromPolicy, replaceContainerWrap, shareManifestHistory, } from "./sharePlanCore.js";
 async function materializeRecipientWrap(input) {
     if (input.recipient.subjectType === "user") {

package/workflows/containers/child/share/shareMaterialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareMaterialization.js","sourceRoot":"","sources":["shareMaterialization.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAOxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,6BAA6B,EAE7B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,KAAK,UAAU,wBAAwB,CAAC,KAOvC;IAKC,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC;YACtD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B;YACjD,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,cAAc,CAAC,eAAe;YAC/C,iBAAiB,EAAE,6BAA6B,CAAC;gBAC/C,mBAAmB,EAAE,cAAc,CAAC,gBAAgB;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YACF,IAAI,EAAE,cAAc,CAAC,IAAI;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,sBAAsB;QAC9D,aAAa,EAAE,iCAAiC,CAC9C,KAAK,CAAC,SAAS,CAAC,eAAe,CAChC;KACF,CAAC,CAAC;IACH,OAAO;QACL,eAAe,EAAE,cAAc,CAAC,eAAe;QAC/C,iBAAiB,EAAE,6BAA6B,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,EAAE,cAAc,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAoBD,KAAK,UAAU,oBAAoB,CAAC,KAQnC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAyB;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;QACpC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;KACzC,CAAC;IACF,MAAM,uBAAuB,GAC3B,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;QACpC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,KAAK;QACL,uBAAuB;KACxB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,YAAY;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,4BAA4B,CAAC;QAC5D,SAAS;QACT,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,cAAc;QACtC,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,KAAK;QACL,SAAS;QACT,KAAK;QACL,aAAa;QACb,GAAG,kBAAkB;KACtB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAA+C;IAE/C,MAAM,iBAAiB,GAAG,MAAM,sCAAsC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA+C;IAE/C,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,EACJ,IAAI,EACJ,KAAK,EACL,SAAS,EACT,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,KAAK,GACN,GAAG,MAAM,oBAAoB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAChD,MAAM,wBAAwB,CAAC;QAC7B,YAAY;QACZ,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACnD,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;KACtB,CAAC,CAAC;IACL,MAAM,aAAa,GAAG,qBAAqB,CACzC,MAAM,CAAC,GAAG,CAAC,KAAK,EAChB,gCAAgC,CACjC,CAAC;IAEF,OAAO,6BAA6B,CAAC;QACnC,IAAI;QACJ,wBAAwB,EAAE,oBAAoB,CAAC;YAC7C,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;SAChC,CAAC;QACF,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,KAAK;QACL,SAAS;QACT,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,eAAe;QACf,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,iBAAiB;QACjB,KAAK,EAAE,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerKekRecipientTarget,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../../data/containers/shared/authorAccess\";\nimport { signContainerMutationEvent } from \"../../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  getTargetContainerContext,\n  readContainerState,\n  uniqueSortedManifestHashes,\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToRootUser,\n} from \"../../../../data/containers/shared/projection\";\nimport { readContainerKeyWraps } from \"../../../../data/containers/shared/readers\";\nimport type {\n  ContainerMutationAuthor,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../../data/documents/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { requireUnwrappedKek } from \"../rotation/rotationContext\";\nimport {\n  buildContainerSharePlanResult,\n  type ContainerShareRecipient,\n  collectContainerSharePrincipalPolicies,\n  collectShareUserRecipientKeys,\n  deriveContainerShareManifest,\n  referencedPrincipalHeadFromPolicy,\n  replaceContainerWrap,\n  shareManifestHistory,\n} from \"./sharePlanCore\";\n\nasync function materializeRecipientWrap(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  recipient: ContainerShareRecipient;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): Promise<{\n  recipientTarget: ContainerKekRecipientTarget;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wrap: ContainerKeyWrap;\n}> {\n  if (input.recipient.subjectType === \"user\") {\n    const shareRecipient = await wrapContainerKeyToRootUser({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      recipientEncapsulationPublicKey:\n        input.recipient.recipientEncapsulationPublicKey,\n      userId: input.recipient.subjectId,\n    });\n    return {\n      recipientTarget: shareRecipient.recipientTarget,\n      userRecipientKeys: collectShareUserRecipientKeys({\n        newUserRecipientKey: shareRecipient.userRecipientKey,\n        state: input.state,\n        targetKek: input.targetKek,\n      }),\n      wrap: shareRecipient.wrap,\n    };\n  }\n\n  const shareRecipient = await wrapContainerKeyToManagedPrincipal({\n    containerKey: input.containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    manifestHash: input.manifestHash,\n    principalEncapsulationPublicKey:\n      input.recipient.principalPolicy.state.encapsulationPublicKey,\n    principalHead: referencedPrincipalHeadFromPolicy(\n      input.recipient.principalPolicy,\n    ),\n  });\n  return {\n    recipientTarget: shareRecipient.recipientTarget,\n    userRecipientKeys: collectShareUserRecipientKeys({\n      state: input.state,\n      targetKek: input.targetKek,\n    }),\n    wrap: shareRecipient.wrap,\n  };\n}\n\ninterface BuildMaterializedContainerSharePlanInput {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /** False for a projection re-rooted on rotations not yet acknowledged. */\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nasync function buildShareTransition(input: {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  signedAt?: string | undefined;\n  targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}) {\n  const previousState = readContainerState(input.targetManifest);\n  if (previousState.organizationId !== input.author.organizationId) {\n    throw new Error(\"Container share author organization mismatch\");\n  }\n  const grant: ContainerDirectGrant = {\n    accessLevel: input.accessLevel,\n    subjectId: input.recipient.subjectId,\n    subjectType: input.recipient.subjectType,\n  };\n  const referencedPrincipalHead =\n    input.recipient.subjectType === \"user\"\n      ? null\n      : referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy);\n  const body: ContainerGrantAccessEventBody = {\n    eventType: \"container.grant\",\n    containerKeyEpochId: previousState.containerKeyEpochId,\n    containerKeyPublicKey: previousState.containerKeyPublicKey,\n    grant,\n    referencedPrincipalHead,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.targetManifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const manifestTransition = await deriveContainerShareManifest({\n    eventHash,\n    grant,\n    previousManifest: input.targetManifest,\n    referencedPrincipalHead,\n  });\n  return {\n    body,\n    event,\n    eventHash,\n    grant,\n    previousState,\n    ...manifestTransition,\n  };\n}\n\nasync function collectAuthorizedSharePolicies(\n  input: BuildMaterializedContainerSharePlanInput,\n) {\n  const principalPolicies = await collectContainerSharePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    previousProjection: input.previousProjection,\n    ...(input.recipient.subjectType === \"user\"\n      ? {}\n      : { recipientPolicy: input.recipient.principalPolicy }),\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  return principalPolicies;\n}\n\nexport async function buildMaterializedContainerSharePlan(\n  input: BuildMaterializedContainerSharePlanInput,\n): Promise<MaterializedContainerSharePlan> {\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const principalPolicies = await collectAuthorizedSharePolicies(input);\n  const target = getTargetContainerContext(input.previousProjection);\n  const {\n    body,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousState,\n    state,\n  } = await buildShareTransition({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    previousProjection: input.previousProjection,\n    recipient: input.recipient,\n    signedAt: input.signedAt,\n    targetManifest: target.manifest,\n  });\n  const containerKey = requireUnwrappedKek(\n    keksByEpochId,\n    target.kek,\n    \"Container share target\",\n  );\n  const { recipientTarget, userRecipientKeys, wrap } =\n    await materializeRecipientWrap({\n      containerKey,\n      containerKeyEpochId: target.kek.containerKeyEpochId,\n      manifestHash,\n      recipient: input.recipient,\n      state,\n      targetKek: target.kek,\n    });\n  const previousWraps = readContainerKeyWraps(\n    target.kek.wraps,\n    \"Container share previous wraps\",\n  );\n\n  return buildContainerSharePlanResult({\n    body,\n    containerManifestHistory: shareManifestHistory({\n      containerId: previousState.containerId,\n      targetKek: target.kek,\n      targetManifest: target.manifest,\n    }),\n    containerKey,\n    containerId: previousState.containerId,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies,\n    recipientTarget,\n    state,\n    targetKek: target.kek,\n    userRecipientKeys,\n    wraps: replaceContainerWrap(previousWraps, wrap),\n  });\n}\n"]}

package/workflows/containers/child/{sharePlanCore.d.ts → share/sharePlanCore.d.ts}

@@ -1,10 +1,10 @@
-import { type AccessEvent, type AccessManifest, type ContainerAccessManifestState, type ContainerDirectGrant, type ContainerGrantAccessEventBody, type ContainerGrantPrincipalHead, type ContainerKekRecipientTarget, type ContainerKeyWrap, type ContainerUserRecipientKey } from "../../../internal/crypto/index.js";
-import type { AccessManifestBundleWire } from "../../../internal/validators/request/index.js";
-import type { ContainerKekResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerSharePlan, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
-import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { PrincipalPolicyCurrentEvidence } from "../../../data/principals/principalPolicyEvidence.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { type AccessEvent, type AccessManifest, type ContainerAccessManifestState, type ContainerDirectGrant, type ContainerGrantAccessEventBody, type ContainerGrantPrincipalHead, type ContainerKekRecipientTarget, type ContainerKeyWrap, type ContainerUserRecipientKey } from "../../../../internal/crypto/index.js";
+import type { AccessManifestBundleWire } from "../../../../internal/validators/request/index.js";
+import type { ContainerKekResponse, ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerSharePlan, MaterializedContainerSharePlan } from "../../../../data/containers/shared/types.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { PrincipalPolicyCurrentEvidence } from "../../../../data/principals/principalPolicyEvidence.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
 export type ContainerShareRecipient = {
     readonly recipientEncapsulationPublicKey: Uint8Array;
     readonly subjectId: string;

package/workflows/containers/child/{sharePlanCore.js → share/sharePlanCore.js}

@@ -1,9 +1,9 @@
-import { computeAccessManifestHash, deriveContainerAccessManifest, } from "../../../internal/crypto/index.js";
-import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
-import { asContainerManifestBundle, containerManifestRef, getParentKekForTarget, readContainerState, } from "../../../data/containers/shared/projection.js";
-import { readContainerKekRecipientTargets, readContainerKeyEpoch, } from "../../../data/containers/shared/readers.js";
-import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
-import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
+import { computeAccessManifestHash, deriveContainerAccessManifest, } from "../../../../internal/crypto/index.js";
+import { uniquePrincipalPolicies } from "../../../../data/containers/shared/principalPolicies.js";
+import { asContainerManifestBundle, containerManifestRef, getParentKekForTarget, readContainerState, } from "../../../../data/containers/shared/projection.js";
+import { readContainerKekRecipientTargets, readContainerKeyEpoch, } from "../../../../data/containers/shared/readers.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../../data/keyingProjectionVerification/index.js";
+import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "../mutationRequestCore.js";
 function grantKey(grant) {
     return `${grant.subjectType}:${grant.subjectId}`;
 }

package/workflows/containers/child/share/sharePlanCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EACL,iDAAiD,GAIlD,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAchC,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,4BAA4B,EAC1B,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC1D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerAccessManifestState,\n  type ContainerDirectGrant,\n  type ContainerGrantAccessEventBody,\n  type ContainerGrantPrincipalHead,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  type ContainerUserRecipientKey,\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../../data/containers/shared/principalPolicies\";\nimport {\n  asContainerManifestBundle,\n  containerManifestRef,\n  getParentKekForTarget,\n  readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport {\n  readContainerKekRecipientTargets,\n  readContainerKeyEpoch,\n} from \"../../../../data/containers/shared/readers\";\nimport type {\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"../mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n  | {\n      readonly recipientEncapsulationPublicKey: Uint8Array;\n      readonly subjectId: string;\n      readonly subjectType: \"user\";\n    }\n  | {\n      readonly principalPolicy: PrincipalPolicyCurrentEvidence;\n      readonly subjectId: string;\n      readonly subjectType: \"group\";\n    };\n\nfunction grantKey(\n  grant: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n): string {\n  return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n  grants: readonly ContainerDirectGrant[],\n  grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n  return [\n    ...grants.filter(\n      (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n    ),\n    grant,\n  ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n  readonly principalId: string;\n  readonly principalType: \"group\";\n}): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n  policy: PrincipalPolicyCurrentEvidence,\n): ContainerGrantPrincipalHead {\n  if (policy.principalType !== \"group\") {\n    throw new Error(\"Container grants can reference only group policies\");\n  }\n  return {\n    principalType: \"group\",\n    principalId: policy.principalId,\n    version: policy.version,\n    keyEpoch: policy.keyEpoch,\n    stateHash: policy.stateHash,\n    keyFingerprint: policy.state.keyFingerprint,\n  };\n}\n\nfunction upsertReferencedPrincipalHead(\n  references: readonly ContainerGrantPrincipalHead[],\n  reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n  return [\n    ...references.filter(\n      (existingReference) =>\n        referencedPrincipalKey(existingReference) !==\n        referencedPrincipalKey(reference),\n    ),\n    reference,\n  ].sort((left, right) =>\n    referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n  );\n}\n\n/**\n * The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n */\nexport function refreshedPrincipalReferences(input: {\n  readonly previousState: ContainerAccessManifestState;\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): ContainerGrantPrincipalHead[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (\n    !replacement ||\n    !input.previousState.directGrants.some(\n      (grant) =>\n        grant.subjectType === replacement.principalType &&\n        grant.subjectId === replacement.principalId,\n    )\n  ) {\n    return [...input.previousState.referencedPrincipalHeads];\n  }\n  return upsertReferencedPrincipalHead(\n    input.previousState.referencedPrincipalHeads,\n    referencedPrincipalHeadFromPolicy(replacement),\n  );\n}\n\n/**\n * The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n  readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): PrincipalPolicyCurrentEvidence[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (!replacement) {\n    return uniquePrincipalPolicies(input.previousPolicies);\n  }\n  return uniquePrincipalPolicies([\n    ...input.previousPolicies.filter(\n      (policy) =>\n        policy.principalType !== replacement.principalType ||\n        policy.principalId !== replacement.principalId,\n    ),\n    replacement,\n  ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  referencedPrincipalHead: ContainerGrantPrincipalHead | null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n    referencedPrincipalHeads: input.referencedPrincipalHead\n      ? upsertReferencedPrincipalHead(\n          previousState.referencedPrincipalHeads,\n          input.referencedPrincipalHead,\n        )\n      : previousState.referencedPrincipalHeads,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nfunction buildContainerShareRequest(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"share\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    containerManifestHistoryRefs:\n      input.containerManifestHistory.map(containerManifestRef),\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container share parent KEK state\",\n    ),\n  };\n}\n\nexport function replaceContainerWrap(\n  wraps: readonly ContainerKeyWrap[],\n  nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n  return [\n    ...wraps.filter(\n      (wrap) =>\n        !(\n          wrap.recipientKind === nextWrap.recipientKind &&\n          wrap.recipientId === nextWrap.recipientId\n        ),\n    ),\n    nextWrap,\n  ];\n}\n\nexport function shareManifestHistory(input: {\n  readonly containerId: string;\n  readonly targetKek: ContainerKekResponse;\n  readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n  const byHash = new Map<string, AccessManifestBundleWire>();\n  for (const bundle of [\n    input.targetManifest,\n    ...input.targetKek.containerManifestHistory,\n  ]) {\n    if (\n      readContainerState(bundle).containerId === input.containerId &&\n      !byHash.has(bundle.manifestHash)\n    ) {\n      byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n    }\n  }\n  return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  containerId: string;\n  containerKey: Uint8Array;\n  event: AccessEvent;\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  recipientTarget: ContainerKekRecipientTarget;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n  const keyEpoch = readContainerKeyEpoch(\n    input.targetKek.keyEpoch,\n    \"Container share key epoch\",\n  );\n  const plan: ContainerSharePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    event: input.event,\n    eventHash: input.eventHash,\n    grant: input.grant,\n    keyEpoch,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousKeyring: readCanonicalRecordOrNull(\n      input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n      \"Container share previous keyring\",\n    ),\n    previousManifest: input.previousManifest,\n    recipientTarget: input.recipientTarget,\n    request: buildContainerShareRequest({\n      body: input.body,\n      containerManifestHistory: input.containerManifestHistory,\n      event: input.event,\n      keyEpoch,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: getParentKekForTarget(input.previousProjection),\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n  newUserRecipientKey?: ContainerUserRecipientKey | undefined;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n  const directUserIds = new Set(\n    input.state.directGrants.flatMap((grant) =>\n      grant.subjectType === \"user\" ? [grant.subjectId] : [],\n    ),\n  );\n  const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n  for (const target of readContainerKekRecipientTargets(\n    input.targetKek.recipientTargets,\n    \"Container share target KEK recipient targets\",\n  )) {\n    if (\n      target.recipientKind !== \"user\" ||\n      !directUserIds.has(target.recipientId)\n    ) {\n      continue;\n    }\n    userRecipientKeyByUserId.set(target.recipientId, {\n      userId: target.recipientId,\n      recipientKeyEpochId: target.recipientKeyEpochId,\n      recipientKeyFingerprint: target.recipientKeyFingerprint,\n    });\n  }\n\n  if (input.newUserRecipientKey) {\n    userRecipientKeyByUserId.set(\n      input.newUserRecipientKey.userId,\n      input.newUserRecipientKey,\n    );\n  }\n\n  const missingUserId = [...directUserIds].find(\n    (userId) => !userRecipientKeyByUserId.has(userId),\n  );\n  if (missingUserId) {\n    throw new Error(\n      `Container share recipient key is missing for direct user grant ${missingUserId}`,\n    );\n  }\n\n  return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n    left.userId.localeCompare(right.userId),\n  );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const previousPolicies =\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  return refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.recipientPolicy,\n  });\n}\n"]}

package/workflows/containers/child/{sharePrincipalPolicy.d.ts → share/sharePrincipalPolicy.d.ts}

@@ -1,12 +1,12 @@
-import type { ApiClient } from "../../../internal/api-client/index.js";
-import { KeyingVerificationError, type ReferencedPrincipalHead, type VerifiedPrincipalPolicy } from "../../../internal/crypto/index.js";
-import type { CommitOrganizationGroupPolicyRequest } from "../../../internal/validators/request/index.js";
-import type { CommitOrganizationGroupPolicyResponse, PrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerShareApi } from "../../../data/containers/shared/types.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
-import { type GroupPolicyNameReader } from "../../organizations/principalPolicy/principalPolicyRequest.js";
-import type { CurrentPrincipalPolicyReader } from "../../principals/currentPrincipalPolicyReader.js";
+import type { ApiClient } from "../../../../internal/api-client/index.js";
+import { KeyingVerificationError, type ReferencedPrincipalHead, type VerifiedPrincipalPolicy } from "../../../../internal/crypto/index.js";
+import type { CommitOrganizationGroupPolicyRequest } from "../../../../internal/validators/request/index.js";
+import type { CommitOrganizationGroupPolicyResponse, PrincipalPolicyBundleResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerShareApi } from "../../../../data/containers/shared/types.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../../data/trustedUserIdentity/index.js";
+import { type GroupPolicyNameReader } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import type { CurrentPrincipalPolicyReader } from "../../../principals/currentPrincipalPolicyReader.js";
 export interface ContainerManagedPrincipalShareApi extends ContainerShareApi, CurrentPrincipalPolicyReader, Pick<ApiClient, "evictContainerWriterProjection" | "getContainerWriterProjectionResult"> {
     readonly recoverPendingPrincipalMutation?: ((organizationId: string) => Promise<void>) | undefined;
     commitOrganizationGroupPolicy: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest) => Promise<CommitOrganizationGroupPolicyResponse | null>;

package/workflows/containers/child/{sharePrincipalPolicy.js → share/sharePrincipalPolicy.js}

@@ -1,16 +1,16 @@
-import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
-import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
-import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
-import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
-import { savePrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
-import { loadPrincipalPolicyBundleForReference } from "../../../data/persistence/principalPolicyReferencePersistence.js";
-import { retainVerifiedPrincipalPolicyBundle } from "../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
-import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../data/principals/organizationAuthorityDescriptor.js";
-import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../../data/principals/principalPolicyAdminSigners.js";
-import { assertGroupMetadataBinding } from "../../organizations/groupMetadata/groupMetadataBinding.js";
-import { groupPolicyNameMismatch, } from "../../organizations/principalPolicy/principalPolicyRequest.js";
-import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../principals/externalAdminPolicy.js";
-import { collectPrincipalPolicySignerPublicKeys, } from "../../principals/policyVerification.js";
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../../data/keyingProjectionVerification/error.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../../data/persistence/keyingCheckpointPersistence.js";
+import { savePrincipalPolicyBundle } from "../../../../data/persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../../data/persistence/principalPolicyReferencePersistence.js";
+import { retainVerifiedPrincipalPolicyBundle } from "../../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
+import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "../../../organizations/groupMetadata/groupMetadataBinding.js";
+import { groupPolicyNameMismatch, } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../../principals/externalAdminPolicy.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../../../principals/policyVerification.js";
 async function retainVerifiedSharePolicies(input) {
     const retainedAt = new Date().toISOString();
     if (input.organizationPolicy) {

package/workflows/containers/child/share/sharePrincipalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharePrincipalPolicy.js","sourceRoot":"","sources":["sharePrincipalPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AACrH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,qCAAqC,EAAE,MAAM,kEAAkE,CAAC;AACzH,OAAO,EAAE,mCAAmC,EAAE,MAAM,0EAA0E,CAAC;AAC/H,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sCAAsC,GAEvC,MAAM,wCAAwC,CAAC;AA2BhD,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,qCAAqC,CACvD,KAAK,CAAC,kBAAkB,CACzB,EAAE,CAAC;YACF,MAAM,mCAAmC,CAAC;gBACxC,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACxB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,QAGC,EACD,YAA0C;IAE1C,MAAM,kCAAkC,CAAC;QACvC,MAAM,EAAE,EAAE;QACV,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;QACrC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,EACN,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,CAAC,cAAc,EACvB,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAqC,EACrC,OAAe;IAEf,IACE,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;QAC7C,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,iDAAiD,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;YAChD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,qCAAqC,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,eAAe,CACtB;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CACxD,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,KAAK,CAAC,iBAAiB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,uBAAuB;IACtE,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAe3D;IACC,MAAM,uBAAuB,GAAG,MAAM,mCAAmC,CAAC;QACxE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,kBAAkB,GAAG,4BAA4B,CACrD,uBAAuB,CAAC,UAAU,EAClC,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,KAAK,CAAC,iBAAiB;QACvB,CAAC,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,KAAK;QACR,iBAAiB,EAAE,kBAAkB;QACrC,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,kBAAkB;QACrC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAChC,uBAAuB,CAAC,iBAAiB;QAC3C,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,oBAAoB,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,uBAAuB;QAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,kBAAkB;QAClB,iBAAiB,EAAE,qCAAqC,CACtD,uBAAuB,CACxB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { CommitOrganizationGroupPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type { ContainerShareApi } from \"../../../../data/containers/shared/types\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../../data/keyingProjectionVerification/error\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../../data/persistence/keyingCheckpointPersistence\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../../data/trustedUserIdentity\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport type { CurrentPrincipalPolicyReader } from \"../../../principals/currentPrincipalPolicyReader\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../../principals/externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../../principals/policyVerification\";\n\nexport interface ContainerManagedPrincipalShareApi\n  extends ContainerShareApi,\n    CurrentPrincipalPolicyReader,\n    Pick<\n      ApiClient,\n      \"evictContainerWriterProjection\" | \"getContainerWriterProjectionResult\"\n    > {\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n}\n\nexport interface VerifiedSharePrincipalPolicy {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];\n  readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];\n  readonly organizationId: string;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\nasync function retainVerifiedSharePolicies(input: {\n  bundle: PrincipalPolicyBundleResponse;\n  execSql: ExecSql;\n  organizationId: string;\n  organizationPolicy: VerifiedExternalAdminPolicy | null;\n  policy: VerifiedPrincipalPolicy;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const retainedAt = new Date().toISOString();\n  if (input.organizationPolicy) {\n    for (const entry of externalAdminPolicyPersistenceEntries(\n      input.organizationPolicy,\n    )) {\n      await retainVerifiedPrincipalPolicyBundle({\n        ...entry,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        stillCurrent: input.stillCurrent,\n        updatedAt: retainedAt,\n      });\n    }\n  }\n  await retainVerifiedPrincipalPolicyBundle({\n    bundle: input.bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    policy: input.policy,\n    stillCurrent: input.stillCurrent,\n    updatedAt: retainedAt,\n  });\n  return [\n    ...(input.organizationPolicy\n      ? externalAdminPolicyPersistenceEntries(input.organizationPolicy).map(\n          (entry) => entry.policy,\n        )\n      : []),\n    input.policy,\n  ];\n}\n\n/**\n * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call\n * deferred: advances the keying checkpoints for the verified policies and\n * caches the dependency bundles they were verified against.\n */\nexport async function advanceVerifiedSharePolicies(\n  execSql: ExecSql,\n  verified: Pick<\n    VerifiedSharePrincipalPolicy,\n    \"checkpointPolicies\" | \"dependencyBundles\" | \"organizationId\"\n  >,\n  stillCurrent?: (() => boolean) | undefined,\n): Promise<void> {\n  await advanceKeyingCheckpointsAtomically({\n    access: [],\n    execSql,\n    organizationId: verified.organizationId,\n    policies: verified.checkpointPolicies,\n    stillCurrent,\n  });\n  if (stillCurrent?.() === false) return;\n  for (const bundle of verified.dependencyBundles) {\n    await savePrincipalPolicyBundle(\n      execSql,\n      bundle,\n      new Date().toISOString(),\n      verified.organizationId,\n      { stillCurrent },\n    );\n    if (stillCurrent?.() === false) return;\n  }\n}\n\nfunction assertGroupPolicyTarget(\n  bundle: PrincipalPolicyBundleResponse,\n  groupId: string,\n): void {\n  if (\n    bundle.currentState.principalType !== \"group\" ||\n    bundle.currentState.principalId !== groupId\n  ) {\n    throw new Error(\"Container share principal policy target mismatch\");\n  }\n}\n\nfunction signerPublicKeyLoadErrorMessage(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return \"principal policy signer key fingerprint mismatch\";\n    case \"not-found\":\n      return \"principal policy signer key could not be loaded\";\n  }\n}\n\nasync function loadGroupSharePolicyBundle(input: {\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  groupId: string;\n  localCheckpoint: PrincipalPolicyCheckpoint | null;\n}): Promise<PrincipalPolicyBundleResponse> {\n  if (\n    input.expectedGroupHead &&\n    (input.expectedGroupHead.principalType !== \"group\" ||\n      input.expectedGroupHead.principalId !== input.groupId)\n  ) {\n    throw new Error(\"Container share expected group policy target mismatch\");\n  }\n  const bundleFromCache = input.expectedGroupHead\n    ? await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        input.expectedGroupHead,\n        input.localCheckpoint,\n      )\n    : null;\n  let bundle = bundleFromCache;\n  bundle ??= await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n  if (!bundle) {\n    throw new Error(\"Container share principal policy could not be loaded\");\n  }\n  assertGroupPolicyTarget(bundle, input.groupId);\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      input.expectedGroupHead,\n    )\n  ) {\n    throw new Error(\n      \"Container share group policy does not match the signed organization directory\",\n    );\n  }\n  return bundle;\n}\n\n/**\n * The chosen group label does not match the name in the group's verified\n * policy. A KeyingVerificationError (so it is reported as an incident), with\n * its own class so a caller can tell this refusal from every other\n * `object_mismatch` and say what happened.\n */\nexport class GroupShareNameMismatchError extends KeyingVerificationError {\n  constructor(message: string) {\n    super(\"object_mismatch\", message);\n    this.name = \"GroupShareNameMismatchError\";\n  }\n}\n\n/**\n * The share picker labels groups from the organization read model, which a\n * compromised server can relabel, so the name the user chose must equal the\n * name committed in the target's verified policy. Names compare by their\n * canonical key so look-alike spellings count as the same name. Uniqueness of\n * signed names within an organization is enforced where names enter — group\n * creation verifies every group in the signed directory — so a single\n * verified match identifies the group.\n */\nasync function assertShareGroupName(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  bundle: PrincipalPolicyBundleResponse;\n  expectedGroupName: string;\n}): Promise<void> {\n  // The label comes from the untrusted read model. Signed names never carry\n  // an invisible code point, so a label that does is a look-alike that would\n  // only match after canonicalization strips it; refuse it outright.\n  const mismatch = await groupPolicyNameMismatch(\n    input.bundle,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  if (mismatch === \"forbidden_characters\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name contains control or format characters\",\n    );\n  }\n  if (mismatch === \"name_mismatch\") {\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  }\n}\n\nexport async function loadVerifiedGroupSharePrincipalPolicy(input: {\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  apiClient: ContainerManagedPrincipalShareApi;\n  execSql: ExecSql;\n  expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  /**\n   * The display name the user chose the group by. The read model that labels\n   * groups is a server projection; only the name committed in the signed\n   * group payload can confirm the share lands on the group the user saw.\n   */\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedSharePrincipalPolicy> {\n  const organizationAdminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!organizationAdminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const committedGroupHead = requireOrganizationGroupHead(\n    organizationAdminPolicy.descriptor,\n    input.groupId,\n  );\n  if (\n    input.expectedGroupHead &&\n    !principalHeadMatchesReference(input.expectedGroupHead, committedGroupHead)\n  ) {\n    throw new Error(\n      \"Container share expected group head conflicts with the signed organization directory\",\n    );\n  }\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    input.groupId,\n  );\n  const bundle = await loadGroupSharePolicyBundle({\n    ...input,\n    expectedGroupHead: committedGroupHead,\n    localCheckpoint,\n  });\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n  }\n\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: committedGroupHead,\n      loadExternalAuthority: async () =>\n        organizationAdminPolicy.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Container share principal policy verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, organizationAdminPolicy.descriptor);\n  if (input.expectedGroupName !== undefined) {\n    await assertShareGroupName({\n      readEncryptedName: input.readEncryptedName,\n      bundle,\n      expectedGroupName: input.expectedGroupName,\n    });\n  }\n\n  const checkpointPolicies = await retainVerifiedSharePolicies({\n    bundle,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    organizationPolicy: organizationAdminPolicy,\n    policy: verified.value,\n    stillCurrent: input.stillCurrent,\n  });\n  return {\n    bundle,\n    checkpointPolicies,\n    dependencyBundles: externalAdminPolicyPersistenceEntries(\n      organizationAdminPolicy,\n    ).map((entry) => entry.bundle),\n    organizationId: input.organizationId,\n    policy: verified.value,\n  };\n}\n"]}

package/workflows/containers/child/share/shareProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareProjection.js","sourceRoot":"","sources":["shareProjection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAEvE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAG0E,EAC1E,wBAAmD;IAEnD,MAAM,gBAAgB,GACpB,KAAK,CAAC,kBAAkB;QACxB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAAC;QAC9D,GAAG,KAAK;QACR,kBAAkB,EAAE,gBAAgB;QACpC,wBAAwB;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACtE,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { projectionWithCurrentAncestors } from \"./shareAncestorRepair\";\n\n/** The container's projection, with any lazily stale chain above it repaired. */\nexport async function resolveShareProjection(\n  input: Omit<\n    Parameters<typeof projectionWithCurrentAncestors>[0],\n    \"previousProjection\" | \"resolveProjectionUserKey\"\n  > & { previousProjection?: ContainerWriterProjectionResponse | undefined },\n  resolveProjectionUserKey: ProjectionUserKeyResolver,\n): Promise<ContainerWriterProjectionResponse | null> {\n  const servedProjection =\n    input.previousProjection ??\n    (await input.apiClient.getContainerWriterProjection(input.containerId));\n  if (!servedProjection || input.stillCurrent?.() === false) return null;\n  const previousProjection = await projectionWithCurrentAncestors({\n    ...input,\n    previousProjection: servedProjection,\n    resolveProjectionUserKey,\n  });\n  return input.stillCurrent?.() === false ? null : previousProjection;\n}\n"]}

package/workflows/containers/index.d.ts

@@ -6,17 +6,17 @@ export { ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, }
 export type { AggregatedContainerKekLog, KeyringRebuildResult, } from "../../data/documents/shared/keyringRebuild.js";
 export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWrapUnavailableReason, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, } from "../../data/documents/shared/keyringRebuild.js";
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
-export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
-export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
-export { moveRemoteContainer } from "./child/move.js";
-export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
-export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
-export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
+export { moveRemoteContainer } from "./child/move/index.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
+export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
-export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
-export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { type ContainerWriteRefusal, classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js

@@ -9,18 +9,18 @@ export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEnt
 // A share's projection verification can be cancelled by a newer generation
 // underneath the caller; hosts filter that outcome from their own reporting.
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
-export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create.js";
+export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
+export { moveRemoteContainer } from "./child/move/index.js";
+export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
 // A rebuilt keyring override that a concurrent rotation outdated: rebuild it.
-export { ContainerKeyringOverrideStaleError } from "./child/keyringOverrideLineage.js";
-export { moveRemoteContainer } from "./child/move.js";
-export { buildMaterializedContainerRekeyPlan } from "./child/rekey.js";
-export { containerWriterProjectionFromRekeyPlan } from "./child/rekeyProjection.js";
-export { rekeyRemoteContainer } from "./child/rekeyRemote.js";
+export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
+export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
+export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share.js";
-export { buildMaterializedContainerSharePlan } from "./child/shareMaterialization.js";
-export { referencedPrincipalHeadFromPolicy } from "./child/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/sharePrincipalPolicy.js";
+export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
+export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
+export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,sCAAsC,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/keyringOverrideLineage\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\nexport { moveRemoteContainer } from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/rekey/keyringOverrideLineage\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekey/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekey/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/share/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/share/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/share/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}

package/workflows/documents/linkSet/linkSetAuthority.js

@@ -2,7 +2,7 @@ import { assertContainerAuthorAccess, ContainerAuthorAccessError, } from "../../
 import { readLinkedContainerIdsFromDocumentManifest } from "../../../data/documents/shared/projection.js";
 import { resolveProjectionVerifier, } from "../../../data/documents/shared/types.js";
 import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
-import { documentContainerProjections } from "../../../data/keyingProjectionVerification/documentContainerProjections.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/document/documentContainerProjections.js";
 import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
 /** Both paths have been verified; a readable proof does not authorize a link. */
 export function assertDocumentLinkAuthorAccess(input) {

package/workflows/documents/linkSet/linkSetAuthority.js.map

@@ -1 +1 @@
-{"version":3,"file":"linkSetAuthority.js","sourceRoot":"","sources":["linkSetAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAEL,yBAAyB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,iDAAiD,GAElD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yEAAyE,CAAC;AACvH,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAI3G,iFAAiF;AACjF,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,MAAM;QACf,cAAc,EAAE,KAAK,CAAC,yBAAyB,CAAC,cAAc;KAC/D,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,MAAM;QACN,aAAa,EAAE,OAAgB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;IACF,2BAA2B,CAAC;QAC1B,GAAG,UAAU;QACb,UAAU,EAAE,KAAK,CAAC,yBAAyB;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,0CAA0C,CACvD,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,2BAA2B,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAClC,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAKiC;IAEjC,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,OAAO;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,UAAU,IAAI;YACvB,KAAK,CAAC,yBAAyB;YAC/B,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;SACxD,EAAE,CAAC;YACF,MAAM,iDAAiD,CAAC;gBACtD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uCAAuC,CACrC,KAAK,EACL,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  assertContainerAuthorAccess,\n  ContainerAuthorAccessError,\n} from \"../../../data/containers/shared/authorAccess\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../../data/documents/shared/projection\";\nimport type { DocumentCreateAuthor } from \"../../../data/documents/shared/types\";\nimport {\n  type ProjectionVerificationOptions,\n  resolveProjectionVerifier,\n} from \"../../../data/documents/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../../data/keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../data/keyingProjectionVerification/error\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/** Both paths have been verified; a readable proof does not authorize a link. */\nexport function assertDocumentLinkAuthorAccess(input: {\n  author: DocumentCreateAuthor;\n  principalPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  const author = {\n    ...input.author,\n    organizationId: input.targetContainerProjection.organizationId,\n  };\n  const permission = {\n    author,\n    minimumAccess: \"write\" as const,\n    principalPolicies: input.principalPolicies,\n  };\n  assertContainerAuthorAccess({\n    ...permission,\n    projection: input.targetContainerProjection,\n  });\n  const linked = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    if (!linked.includes(projection.containerId)) continue;\n    try {\n      assertContainerAuthorAccess({ ...permission, projection });\n      return;\n    } catch (error) {\n      if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    }\n  }\n  throw new ContainerAuthorAccessError(\n    \"Document signer lacks write access through a linked container\",\n  );\n}\n\n/** Current write authorization needs full policies for the readable paths. */\nexport async function verifyDocumentLinkSetCurrentPolicies(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache: PrincipalPolicyCache;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<void> {\n  resolveProjectionVerifier(input, \"Document link-set current policies\");\n  if (input.trustedLocalProjection === true) return;\n  try {\n    for (const projection of [\n      input.targetContainerProjection,\n      ...documentContainerProjections(input.writerProjection),\n    ]) {\n      await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      });\n    }\n  } catch (error) {\n    throwKeyingVerificationErrorWithContext(\n      error,\n      \"Document link-set current policy verification failed\",\n    );\n  }\n}\n"]}
+{"version":3,"file":"linkSetAuthority.js","sourceRoot":"","sources":["linkSetAuthority.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAEL,yBAAyB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,iDAAiD,GAElD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kFAAkF,CAAC;AAChI,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAI3G,iFAAiF;AACjF,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,MAAM;QACf,cAAc,EAAE,KAAK,CAAC,yBAAyB,CAAC,cAAc;KAC/D,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,MAAM;QACN,aAAa,EAAE,OAAgB;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;IACF,2BAA2B,CAAC;QAC1B,GAAG,UAAU;QACb,UAAU,EAAE,KAAK,CAAC,yBAAyB;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,0CAA0C,CACvD,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,4BAA4B,CACnD,KAAK,CAAC,gBAAgB,CACvB,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,2BAA2B,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAClC,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAKiC;IAEjC,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,OAAO;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,UAAU,IAAI;YACvB,KAAK,CAAC,yBAAyB;YAC/B,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;SACxD,EAAE,CAAC;YACF,MAAM,iDAAiD,CAAC;gBACtD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,UAAU;gBACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uCAAuC,CACrC,KAAK,EACL,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  assertContainerAuthorAccess,\n  ContainerAuthorAccessError,\n} from \"../../../data/containers/shared/authorAccess\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../../data/documents/shared/projection\";\nimport type { DocumentCreateAuthor } from \"../../../data/documents/shared/types\";\nimport {\n  type ProjectionVerificationOptions,\n  resolveProjectionVerifier,\n} from \"../../../data/documents/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../../data/keyingProjectionVerification\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/document/documentContainerProjections\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../data/keyingProjectionVerification/error\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/** Both paths have been verified; a readable proof does not authorize a link. */\nexport function assertDocumentLinkAuthorAccess(input: {\n  author: DocumentCreateAuthor;\n  principalPolicies: readonly PrincipalPolicyCheckpointEvidence[];\n  targetContainerProjection: ContainerWriterProjectionResponse;\n  writerProjection: DocumentWriterProjectionResponse;\n}): void {\n  const author = {\n    ...input.author,\n    organizationId: input.targetContainerProjection.organizationId,\n  };\n  const permission = {\n    author,\n    minimumAccess: \"write\" as const,\n    principalPolicies: input.principalPolicies,\n  };\n  assertContainerAuthorAccess({\n    ...permission,\n    projection: input.targetContainerProjection,\n  });\n  const linked = readLinkedContainerIdsFromDocumentManifest(\n    input.writerProjection,\n  );\n  for (const projection of documentContainerProjections(\n    input.writerProjection,\n  )) {\n    if (!linked.includes(projection.containerId)) continue;\n    try {\n      assertContainerAuthorAccess({ ...permission, projection });\n      return;\n    } catch (error) {\n      if (!(error instanceof ContainerAuthorAccessError)) throw error;\n    }\n  }\n  throw new ContainerAuthorAccessError(\n    \"Document signer lacks write access through a linked container\",\n  );\n}\n\n/** Current write authorization needs full policies for the readable paths. */\nexport async function verifyDocumentLinkSetCurrentPolicies(\n  input: {\n    execSql?: ExecSql | undefined;\n    principalPolicyCache: PrincipalPolicyCache;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<void> {\n  resolveProjectionVerifier(input, \"Document link-set current policies\");\n  if (input.trustedLocalProjection === true) return;\n  try {\n    for (const projection of [\n      input.targetContainerProjection,\n      ...documentContainerProjections(input.writerProjection),\n    ]) {\n      await collectContainerWriterProjectionPrincipalPolicies({\n        execSql: input.execSql,\n        principalPolicyCache: input.principalPolicyCache,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      });\n    }\n  } catch (error) {\n    throwKeyingVerificationErrorWithContext(\n      error,\n      \"Document link-set current policy verification failed\",\n    );\n  }\n}\n"]}

package/workflows/documents/linkSet/linkSetBlobRewraps.js

@@ -6,7 +6,7 @@ import { projectionVerificationOptions } from "../../../data/documents/shared/ty
 import { readCanonicalJson } from "../../../data/keying/canonicalJson.js";
 import { requireProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/index.js";
 import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { documentContainerProjections } from "../../../data/keyingProjectionVerification/documentContainerProjections.js";
+import { documentContainerProjections } from "../../../data/keyingProjectionVerification/document/documentContainerProjections.js";
 import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
 import { createAttachmentProofReader } from "../../blobs/verification/attachmentDecryptor.js";
 import { createAttachmentKeyAuthenticator } from "../../blobs/verification/attachmentKeyAuthenticator.js";

package/workflows/documents/linkSet/linkSetBlobRewraps.js.map

@@ -1 +1 @@
-{"version":3,"file":"linkSetBlobRewraps.js","sourceRoot":"","sources":["linkSetBlobRewraps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAG3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EACL,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,4BAA4B,EAAE,MAAM,yEAAyE,CAAC;AACvH,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAEvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,EAAE,wBAAwB,EAAE,MAAM,yDAAyD,CAAC;AAQnG,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAOiC;IAEjC,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,gCAAgC,CACtD,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;IACF,MAAM,cAAc,GAAG,2BAA2B,CAChD,KAAK,CAAC,SAAS,EACf,UAAU,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,kBAAkB,EAAE,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,wBAAwB,EAAE,gCAAgC,CACxD,KAAK,CAAC,wBAAwB,EAC9B,mBAAmB,CACpB;YACD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,CAAC,QAAQ;YAAE,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBACV,OAAO;oBACL,GAAG,QAAQ;oBACX,GAAG,MAAM;oBACT,gBAAgB,EAAE,iBAAiB,CACjC,QAAQ,CAAC,gBAAgB,EACzB,0BAA0B,CAC3B;iBACF,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;YACJ,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,OAAO,oBAAoB,CAAC;gBAC1B,OAAO;gBACP,UAAU;gBACV,UAAU;gBACV,GAAG;gBACH,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACzD,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAMnC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QAChE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,gBAAgB,EAAE;YAChB,KAAK,EAAE,2BAA2B;YAClC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,OAA8B,EAC9B,MAAgC,EAChC,UAAkB;IAElB,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACzC,SAAS,CAAC,UAAU,KAAK,UAAU;QACnC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAC5C,SAAS,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI;QACvB,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACvD,KAAK,CAAC,yBAAyB;KAChC,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,yEAAyE;QACzE,8EAA8E;QAC9E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,kCAAkC,CAAC;gBAChD,GAAG,UAAU;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBACzC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;aAC5D,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjD,+DAA+D;YAC/D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ;gBACV,gBAAgB,CACd,QAAQ,EACR,GAAG,EACH,sDAAsD,CACvD,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAqB,EAAE,CAAqB;IAClE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkAccessEventBody,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  BlobAttachmentSummary,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  deriveDocumentTargetFromProjection,\n  unwrapContainerKekPath,\n} from \"../../../data/documents/shared/projection\";\nimport {\n  assertEqualBytes,\n  targetKey,\n} from \"../../../data/documents/shared/readers\";\nimport type {\n  DocumentLinkSetMutationApi,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { readCanonicalJson } from \"../../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/documentContainerProjections\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { createAttachmentProofReader } from \"../../blobs/verification/attachmentDecryptor\";\nimport { createAttachmentKeyAuthenticator } from \"../../blobs/verification/attachmentKeyAuthenticator\";\nimport { verifyRetainedAttachment } from \"../../blobs/verification/retainedAttachmentVerification\";\n\ninterface BlobRewrap {\n  blobId: string;\n  contentKeyEpoch: number;\n  targets: DocumentLinkAccessEventBody[\"blobRewraps\"][number][\"targets\"][number][];\n}\n\n/** Authenticate the existing bytes before propagating their DEK to a new scope. */\nexport async function prepareDocumentLinkBlobRewraps(\n  input: {\n    apiClient: DocumentLinkSetMutationApi;\n    execSql: ExecSql;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    targets: readonly DocumentContentKeyTarget[];\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<DocumentLinkAccessEventBody[\"blobRewraps\"]> {\n  const documentId = input.writerProjection.documentId;\n  const bindings = await input.apiClient.listDocumentAttachments(documentId);\n  // The API refuses the link unless every active binding is rewrapped, so an\n  // unavailable listing (offline, or a 409 while a bind is mid-flight) is a\n  // retryable availability failure of this mutation, not integrity evidence.\n  if (!bindings)\n    throw new ProjectionDependencyUnavailableError(\n      \"Document attachments are unavailable for relinking\",\n    );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (bindings.length === 0) return [];\n  const keks = await collectRelinkKeks(input);\n  const authenticateKey = createAttachmentKeyAuthenticator(\n    input.apiClient,\n    documentId,\n  );\n  const verifyRetained = createAttachmentProofReader(\n    input.apiClient,\n    documentId,\n    verifyRetainedAttachment,\n  );\n  const rewrapByBlob = new Map<string, BlobRewrap>();\n  for (const binding of bindings) {\n    const verification = {\n      binding,\n      expectedDocumentId: documentId,\n      expectedSlotId: binding.slotId,\n      execSql: input.execSql,\n      resolveProjectionUserKey: requireProjectionUserKeyResolver(\n        input.resolveProjectionUserKey,\n        \"Attachment relink\",\n      ),\n      targetSecretKey: input.targetSecretKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      writerProjection: input.writerProjection,\n    };\n    const needsKey = input.targets.some(\n      (target) => !retainedTarget(binding, target, documentId),\n    );\n    const contentKey = needsKey ? await authenticateKey(verification) : null;\n    if (!needsKey) await verifyRetained(verification);\n    const targets = await Promise.all(\n      input.targets.map(async (target) => {\n        const previous = retainedTarget(binding, target, documentId);\n        if (previous)\n          return {\n            ...previous,\n            ...target,\n            wrappingMetadata: readCanonicalJson(\n              previous.wrappingMetadata,\n              \"Attachment wrap metadata\",\n            ),\n          };\n        const kek = keks.get(targetKey(target));\n        if (!kek)\n          throw new Error(\n            \"Attachment destination is not a verified current container head\",\n          );\n        if (!contentKey)\n          throw new Error(\"Attachment content key is unavailable\");\n        return wrapBlobKeyForTarget({\n          binding,\n          contentKey,\n          documentId,\n          kek,\n          target,\n        });\n      }),\n    );\n    const rewrap = rewrapByBlob.get(binding.blobId) ?? {\n      blobId: binding.blobId,\n      contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n      targets: [],\n    };\n    if (rewrap.contentKeyEpoch !== binding.contentKeyBundle.contentKeyEpoch)\n      throw new Error(\"Attachment content epoch changed during relinking\");\n    rewrap.targets.push(...targets);\n    rewrapByBlob.set(binding.blobId, rewrap);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  }\n  return [...rewrapByBlob.values()].sort(compareBlobIds);\n}\n\nasync function wrapBlobKeyForTarget(input: {\n  binding: BlobAttachmentSummary;\n  contentKey: Uint8Array;\n  documentId: string;\n  kek: Uint8Array;\n  target: DocumentContentKeyTarget;\n}) {\n  const { binding, target } = input;\n  const wrapped = await wrapContentKey(input.contentKey, input.kek, {\n    kind: \"Blob\",\n    objectId: binding.blobId,\n    contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n    containerId: target.containerId,\n    containerKeyEpochId: target.containerKeyEpochId,\n  });\n  return {\n    ...target,\n    bindingId: binding.bindingId,\n    documentId: input.documentId,\n    wrappedKey: bytesToBase64(wrapped.ciphertext),\n    wrappingMetadata: {\n      suite: BLOB_CONTENT_KEY_WRAP_SUITE,\n      iv: bytesToBase64(wrapped.iv),\n    },\n  };\n}\n\nfunction retainedTarget(\n  binding: BlobAttachmentSummary,\n  target: DocumentContentKeyTarget,\n  documentId: string,\n) {\n  return binding.contentKeyBundle.targets.find(\n    (candidate) =>\n      candidate.bindingId === binding.bindingId &&\n      candidate.documentId === documentId &&\n      candidate.containerId === target.containerId &&\n      candidate.containerKeyEpochId === target.containerKeyEpochId,\n  );\n}\n\nasync function collectRelinkKeks(\n  input: Parameters<typeof prepareDocumentLinkBlobRewraps>[0],\n): Promise<Map<string, Uint8Array>> {\n  const keks = new Map<string, Uint8Array>();\n  for (const projection of [\n    ...documentContainerProjections(input.writerProjection),\n    input.targetContainerProjection,\n  ]) {\n    const keys = await unwrapContainerKekPath({\n      projection,\n      secretKey: input.targetSecretKey,\n      execSql: input.execSql,\n      ...projectionVerificationOptions(input),\n    });\n    // Every node of this verified path has a current signed head. Historical\n    // keyring entries may open source bytes, but never enter the destination map.\n    for (const [index, head] of projection.containerKeks.entries()) {\n      const target = deriveDocumentTargetFromProjection({\n        ...projection,\n        containerId: head.containerId,\n        path: projection.path.slice(0, index + 1),\n        containerKeks: projection.containerKeks.slice(0, index + 1),\n      });\n      const key = keys.get(target.containerKeyEpochId);\n      // A direct child grantee need not possess any ancestor secret.\n      if (!key) continue;\n      const id = targetKey(target);\n      const previous = keks.get(id);\n      if (previous)\n        assertEqualBytes(\n          previous,\n          key,\n          \"Attachment link projections contain conflicting KEKs\",\n        );\n      keks.set(id, key);\n    }\n  }\n  return keks;\n}\n\nfunction compareBlobIds(a: { blobId: string }, b: { blobId: string }): number {\n  return a.blobId < b.blobId ? -1 : a.blobId > b.blobId ? 1 : 0;\n}\n"]}
+{"version":3,"file":"linkSetBlobRewraps.js","sourceRoot":"","sources":["linkSetBlobRewraps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAG3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EACL,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,4BAA4B,EAAE,MAAM,kFAAkF,CAAC;AAChI,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAEvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,EAAE,wBAAwB,EAAE,MAAM,yDAAyD,CAAC;AAQnG,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAOiC;IAEjC,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,oCAAoC,CAC5C,oDAAoD,CACrD,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,gCAAgC,CACtD,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;IACF,MAAM,cAAc,GAAG,2BAA2B,CAChD,KAAK,CAAC,SAAS,EACf,UAAU,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,kBAAkB,EAAE,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,wBAAwB,EAAE,gCAAgC,CACxD,KAAK,CAAC,wBAAwB,EAC9B,mBAAmB,CACpB;YACD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,CAAC,QAAQ;YAAE,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBACV,OAAO;oBACL,GAAG,QAAQ;oBACX,GAAG,MAAM;oBACT,gBAAgB,EAAE,iBAAiB,CACjC,QAAQ,CAAC,gBAAgB,EACzB,0BAA0B,CAC3B;iBACF,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;YACJ,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,OAAO,oBAAoB,CAAC;gBAC1B,OAAO;gBACP,UAAU;gBACV,UAAU;gBACV,GAAG;gBACH,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACzD,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,eAAe;YACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAMnC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE;QAChE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,gBAAgB,EAAE;YAChB,KAAK,EAAE,2BAA2B;YAClC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,OAA8B,EAC9B,MAAgC,EAChC,UAAkB;IAElB,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACzC,SAAS,CAAC,UAAU,KAAK,UAAU;QACnC,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QAC5C,SAAS,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI;QACvB,GAAG,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACvD,KAAK,CAAC,yBAAyB;KAChC,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,6BAA6B,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,yEAAyE;QACzE,8EAA8E;QAC9E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,kCAAkC,CAAC;gBAChD,GAAG,UAAU;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBACzC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;aAC5D,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjD,+DAA+D;YAC/D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ;gBACV,gBAAgB,CACd,QAAQ,EACR,GAAG,EACH,sDAAsD,CACvD,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAqB,EAAE,CAAqB;IAClE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  type DocumentContentKeyTarget,\n  type DocumentLinkAccessEventBody,\n  wrapContentKey,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  BlobAttachmentSummary,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  deriveDocumentTargetFromProjection,\n  unwrapContainerKekPath,\n} from \"../../../data/documents/shared/projection\";\nimport {\n  assertEqualBytes,\n  targetKey,\n} from \"../../../data/documents/shared/readers\";\nimport type {\n  DocumentLinkSetMutationApi,\n  ProjectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport { readCanonicalJson } from \"../../../data/keying/canonicalJson\";\nimport { requireProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { documentContainerProjections } from \"../../../data/keyingProjectionVerification/document/documentContainerProjections\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { createAttachmentProofReader } from \"../../blobs/verification/attachmentDecryptor\";\nimport { createAttachmentKeyAuthenticator } from \"../../blobs/verification/attachmentKeyAuthenticator\";\nimport { verifyRetainedAttachment } from \"../../blobs/verification/retainedAttachmentVerification\";\n\ninterface BlobRewrap {\n  blobId: string;\n  contentKeyEpoch: number;\n  targets: DocumentLinkAccessEventBody[\"blobRewraps\"][number][\"targets\"][number][];\n}\n\n/** Authenticate the existing bytes before propagating their DEK to a new scope. */\nexport async function prepareDocumentLinkBlobRewraps(\n  input: {\n    apiClient: DocumentLinkSetMutationApi;\n    execSql: ExecSql;\n    targetContainerProjection: ContainerWriterProjectionResponse;\n    targetSecretKey: Uint8Array;\n    targets: readonly DocumentContentKeyTarget[];\n    writerProjection: DocumentWriterProjectionResponse;\n  } & ProjectionVerificationOptions,\n): Promise<DocumentLinkAccessEventBody[\"blobRewraps\"]> {\n  const documentId = input.writerProjection.documentId;\n  const bindings = await input.apiClient.listDocumentAttachments(documentId);\n  // The API refuses the link unless every active binding is rewrapped, so an\n  // unavailable listing (offline, or a 409 while a bind is mid-flight) is a\n  // retryable availability failure of this mutation, not integrity evidence.\n  if (!bindings)\n    throw new ProjectionDependencyUnavailableError(\n      \"Document attachments are unavailable for relinking\",\n    );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (bindings.length === 0) return [];\n  const keks = await collectRelinkKeks(input);\n  const authenticateKey = createAttachmentKeyAuthenticator(\n    input.apiClient,\n    documentId,\n  );\n  const verifyRetained = createAttachmentProofReader(\n    input.apiClient,\n    documentId,\n    verifyRetainedAttachment,\n  );\n  const rewrapByBlob = new Map<string, BlobRewrap>();\n  for (const binding of bindings) {\n    const verification = {\n      binding,\n      expectedDocumentId: documentId,\n      expectedSlotId: binding.slotId,\n      execSql: input.execSql,\n      resolveProjectionUserKey: requireProjectionUserKeyResolver(\n        input.resolveProjectionUserKey,\n        \"Attachment relink\",\n      ),\n      targetSecretKey: input.targetSecretKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      writerProjection: input.writerProjection,\n    };\n    const needsKey = input.targets.some(\n      (target) => !retainedTarget(binding, target, documentId),\n    );\n    const contentKey = needsKey ? await authenticateKey(verification) : null;\n    if (!needsKey) await verifyRetained(verification);\n    const targets = await Promise.all(\n      input.targets.map(async (target) => {\n        const previous = retainedTarget(binding, target, documentId);\n        if (previous)\n          return {\n            ...previous,\n            ...target,\n            wrappingMetadata: readCanonicalJson(\n              previous.wrappingMetadata,\n              \"Attachment wrap metadata\",\n            ),\n          };\n        const kek = keks.get(targetKey(target));\n        if (!kek)\n          throw new Error(\n            \"Attachment destination is not a verified current container head\",\n          );\n        if (!contentKey)\n          throw new Error(\"Attachment content key is unavailable\");\n        return wrapBlobKeyForTarget({\n          binding,\n          contentKey,\n          documentId,\n          kek,\n          target,\n        });\n      }),\n    );\n    const rewrap = rewrapByBlob.get(binding.blobId) ?? {\n      blobId: binding.blobId,\n      contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n      targets: [],\n    };\n    if (rewrap.contentKeyEpoch !== binding.contentKeyBundle.contentKeyEpoch)\n      throw new Error(\"Attachment content epoch changed during relinking\");\n    rewrap.targets.push(...targets);\n    rewrapByBlob.set(binding.blobId, rewrap);\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  }\n  return [...rewrapByBlob.values()].sort(compareBlobIds);\n}\n\nasync function wrapBlobKeyForTarget(input: {\n  binding: BlobAttachmentSummary;\n  contentKey: Uint8Array;\n  documentId: string;\n  kek: Uint8Array;\n  target: DocumentContentKeyTarget;\n}) {\n  const { binding, target } = input;\n  const wrapped = await wrapContentKey(input.contentKey, input.kek, {\n    kind: \"Blob\",\n    objectId: binding.blobId,\n    contentKeyEpoch: binding.contentKeyBundle.contentKeyEpoch,\n    containerId: target.containerId,\n    containerKeyEpochId: target.containerKeyEpochId,\n  });\n  return {\n    ...target,\n    bindingId: binding.bindingId,\n    documentId: input.documentId,\n    wrappedKey: bytesToBase64(wrapped.ciphertext),\n    wrappingMetadata: {\n      suite: BLOB_CONTENT_KEY_WRAP_SUITE,\n      iv: bytesToBase64(wrapped.iv),\n    },\n  };\n}\n\nfunction retainedTarget(\n  binding: BlobAttachmentSummary,\n  target: DocumentContentKeyTarget,\n  documentId: string,\n) {\n  return binding.contentKeyBundle.targets.find(\n    (candidate) =>\n      candidate.bindingId === binding.bindingId &&\n      candidate.documentId === documentId &&\n      candidate.containerId === target.containerId &&\n      candidate.containerKeyEpochId === target.containerKeyEpochId,\n  );\n}\n\nasync function collectRelinkKeks(\n  input: Parameters<typeof prepareDocumentLinkBlobRewraps>[0],\n): Promise<Map<string, Uint8Array>> {\n  const keks = new Map<string, Uint8Array>();\n  for (const projection of [\n    ...documentContainerProjections(input.writerProjection),\n    input.targetContainerProjection,\n  ]) {\n    const keys = await unwrapContainerKekPath({\n      projection,\n      secretKey: input.targetSecretKey,\n      execSql: input.execSql,\n      ...projectionVerificationOptions(input),\n    });\n    // Every node of this verified path has a current signed head. Historical\n    // keyring entries may open source bytes, but never enter the destination map.\n    for (const [index, head] of projection.containerKeks.entries()) {\n      const target = deriveDocumentTargetFromProjection({\n        ...projection,\n        containerId: head.containerId,\n        path: projection.path.slice(0, index + 1),\n        containerKeks: projection.containerKeks.slice(0, index + 1),\n      });\n      const key = keys.get(target.containerKeyEpochId);\n      // A direct child grantee need not possess any ancestor secret.\n      if (!key) continue;\n      const id = targetKey(target);\n      const previous = keks.get(id);\n      if (previous)\n        assertEqualBytes(\n          previous,\n          key,\n          \"Attachment link projections contain conflicting KEKs\",\n        );\n      keks.set(id, key);\n    }\n  }\n  return keks;\n}\n\nfunction compareBlobIds(a: { blobId: string }, b: { blobId: string }): number {\n  return a.blobId < b.blobId ? -1 : a.blobId > b.blobId ? 1 : 0;\n}\n"]}

package/workflows/documents/linkSet/linkSetProjectionSeed.js

@@ -1,5 +1,5 @@
 import { assertDocumentWriterProjectionConsistent } from "../../../data/documents/shared/projection.js";
-import { mergeProjectionPolicyEvidence } from "../../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js";
+import { mergeProjectionPolicyEvidence } from "../../../data/keyingProjectionVerification/principalPolicy/mergeProjectionPolicyEvidence.js";
 function uniqueManifestBundles(bundles) {
     const byHash = new Map();
     for (const bundle of bundles) {