@tearleads/client-sdk 0.1.63 → 0.1.65

package/workflows/containers/child/moveArtifacts.js

@@ -1,102 +0,0 @@
-import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, } from "../../../internal/crypto/index.js";
-import { buildContainerCreateKeyEpoch, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
-import { readContainerState, } from "../../../data/containers/shared/projection.js";
-import { buildContainerRotationArtifacts } from "./moveRotation.js";
-async function deriveContainerMoveManifest(input) {
-    const previousState = readContainerState(input.previousManifest);
-    const destinationState = readContainerState(input.destinationParent);
-    const state = {
-        ...previousState,
-        epoch: previousState.epoch + 1,
-        previousManifestHash: input.previousManifest.manifestHash,
-        eventHash: input.eventHash,
-        parentContainerId: destinationState.containerId,
-        parentManifestHash: input.destinationParent.manifestHash,
-        containerKeyEpochId: input.containerKeyEpochId,
-        containerKeyPublicKey: input.containerKeyPublicKey,
-    };
-    const manifest = await deriveContainerAccessManifest(state);
-    return {
-        manifest,
-        manifestHash: await computeAccessManifestHash(manifest),
-        state,
-    };
-}
-async function buildContainerMoveEventBody(input) {
-    return {
-        eventType: "container.move",
-        parentContainerId: input.parentContainerId,
-        parentManifestHash: input.parentManifestHash,
-        containerKeyEpochId: input.containerKeyEpochId,
-        containerKeyPublicKey: input.containerKeyPublicKey,
-        keyringHash: await computeContainerKekKeyringHash(input.keyring),
-        predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(input.predecessorBridge),
-    };
-}
-function signContainerMoveEvent(input) {
-    return signContainerMutationEvent({
-        author: input.signing.author,
-        body: input.body,
-        containerId: input.containerId,
-        dependencyManifestHashes: input.signing.dependencyManifestHashes,
-        eventId: input.signing.eventId ?? crypto.randomUUID(),
-        previousManifestHash: input.source.manifest.manifestHash,
-        signedAt: input.signing.signedAt ?? new Date().toISOString(),
-    });
-}
-function buildMoveKeyEpoch(input) {
-    return buildContainerCreateKeyEpoch({
-        containerId: readContainerState(input.source.manifest).containerId,
-        containerKeyEpochId: input.containerKeyEpochId,
-        eventHash: input.eventHash,
-        keyEpoch: input.source.kek.containerKeyEpoch + 1,
-        manifestHash: input.manifestHash,
-        parentContainerKeyEpochId: input.destinationParent.kek.containerKeyEpochId,
-    });
-}
-export async function buildMoveRotationWithBody(input) {
-    const rotation = await buildContainerRotationArtifacts({
-        containerId: input.previousState.containerId,
-        currentKek: input.source.kek,
-        currentKeyMaterial: input.predecessorContainerKey,
-        keyEpoch: input.source.kek.containerKeyEpoch + 1,
-        override: input.override,
-        signedEpochIds: input.source.signedEpochIds,
-    });
-    const body = await buildContainerMoveEventBody({
-        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
-            containerId: input.previousState.containerId,
-            keyMaterial: rotation.containerKey,
-        }),
-        containerKeyEpochId: rotation.containerKeyEpochId,
-        keyring: rotation.keyring,
-        parentContainerId: input.destinationState.containerId,
-        parentManifestHash: input.destinationParent.manifest.manifestHash,
-        predecessorBridge: rotation.predecessorBridge,
-    });
-    return { ...rotation, body };
-}
-export async function deriveMoveManifestArtifacts(input) {
-    const { event, eventHash } = await signContainerMoveEvent({
-        body: input.body,
-        containerId: input.previousState.containerId,
-        signing: input.signing,
-        source: input.source,
-    });
-    const { manifest, manifestHash, state } = await deriveContainerMoveManifest({
-        containerKeyPublicKey: input.body.containerKeyPublicKey,
-        containerKeyEpochId: input.containerKeyEpochId,
-        destinationParent: input.destinationParent.manifest,
-        eventHash,
-        previousManifest: input.source.manifest,
-    });
-    const keyEpoch = buildMoveKeyEpoch({
-        containerKeyEpochId: input.containerKeyEpochId,
-        destinationParent: input.destinationParent,
-        eventHash,
-        manifestHash,
-        source: input.source,
-    });
-    return { event, eventHash, keyEpoch, manifest, manifestHash, state };
-}
-//# sourceMappingURL=moveArtifacts.js.map

package/workflows/containers/child/moveArtifacts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"moveArtifacts.js","sourceRoot":"","sources":["moveArtifacts.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAEL,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAGjE,KAAK,UAAU,2BAA2B,CAAC,KAM1C;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,gBAAgB,CAAC,WAAW;QAC/C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,YAAY;QACxD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IACC,OAAO;QACL,SAAS,EAAE,gBAAgB;QAC3B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;KACF,CAAC;AACJ,CAAC;AASD,SAAS,sBAAsB,CAAC,KAK/B;IACC,OAAO,0BAA0B,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,wBAAwB;QAChE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW;QAClE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,yBAAyB,EAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;QAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;QACjD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC;QAC7C,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,QAAQ,CAAC,YAAY;SACnC,CAAC;QACF,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC,WAAW;QACrD,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY;QACjE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAOjD;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,sBAAsB,CAAC;QACxD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QAC1E,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ;QACnD,SAAS;QACT,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;KACxC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS;QACT,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerKekKeyring,\n  ContainerKekPredecessorBridge,\n  ContainerMoveAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n  computeAccessManifestHash,\n  computeContainerKekKeyringHash,\n  computeContainerKekPredecessorBridgeHash,\n  deriveContainerAccessManifest,\n  deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  buildContainerCreateKeyEpoch,\n  signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  type getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerMovePlan,\n  ContainerMutationAuthor,\n} from \"../../../data/containers/shared/types\";\nimport { buildContainerRotationArtifacts } from \"./moveRotation\";\nimport type { SignedRotationTarget } from \"./rotationContext\";\n\nasync function deriveContainerMoveManifest(input: {\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string | null;\n  destinationParent: ContainerWriterProjectionResponse[\"path\"][number];\n  eventHash: string;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): Promise<Pick<ContainerMovePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const destinationState = readContainerState(input.destinationParent);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    parentContainerId: destinationState.containerId,\n    parentManifestHash: input.destinationParent.manifestHash,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nasync function buildContainerMoveEventBody(input: {\n  containerKeyEpochId: string;\n  containerKeyPublicKey: string | null;\n  keyring: ContainerKekKeyring;\n  parentContainerId: string;\n  parentManifestHash: string;\n  predecessorBridge: ContainerKekPredecessorBridge;\n}): Promise<ContainerMoveAccessEventBody> {\n  return {\n    eventType: \"container.move\",\n    parentContainerId: input.parentContainerId,\n    parentManifestHash: input.parentManifestHash,\n    containerKeyEpochId: input.containerKeyEpochId,\n    containerKeyPublicKey: input.containerKeyPublicKey,\n    keyringHash: await computeContainerKekKeyringHash(input.keyring),\n    predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n      input.predecessorBridge,\n    ),\n  };\n}\n\ninterface MoveSigningContext {\n  author: ContainerMutationAuthor;\n  dependencyManifestHashes: readonly string[];\n  eventId: string | undefined;\n  signedAt: string | undefined;\n}\n\nfunction signContainerMoveEvent(input: {\n  body: ContainerMoveAccessEventBody;\n  containerId: string;\n  signing: MoveSigningContext;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  return signContainerMutationEvent({\n    author: input.signing.author,\n    body: input.body,\n    containerId: input.containerId,\n    dependencyManifestHashes: input.signing.dependencyManifestHashes,\n    eventId: input.signing.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.source.manifest.manifestHash,\n    signedAt: input.signing.signedAt ?? new Date().toISOString(),\n  });\n}\n\nfunction buildMoveKeyEpoch(input: {\n  containerKeyEpochId: string;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  eventHash: string;\n  manifestHash: string;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  return buildContainerCreateKeyEpoch({\n    containerId: readContainerState(input.source.manifest).containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventHash: input.eventHash,\n    keyEpoch: input.source.kek.containerKeyEpoch + 1,\n    manifestHash: input.manifestHash,\n    parentContainerKeyEpochId: input.destinationParent.kek.containerKeyEpochId,\n  });\n}\n\nexport async function buildMoveRotationWithBody(input: {\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  destinationState: ContainerAccessManifestState;\n  override: string | undefined;\n  predecessorContainerKey: Uint8Array;\n  previousState: ContainerAccessManifestState;\n  source: SignedRotationTarget;\n}) {\n  const rotation = await buildContainerRotationArtifacts({\n    containerId: input.previousState.containerId,\n    currentKek: input.source.kek,\n    currentKeyMaterial: input.predecessorContainerKey,\n    keyEpoch: input.source.kek.containerKeyEpoch + 1,\n    override: input.override,\n    signedEpochIds: input.source.signedEpochIds,\n  });\n  const body = await buildContainerMoveEventBody({\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: input.previousState.containerId,\n      keyMaterial: rotation.containerKey,\n    }),\n    containerKeyEpochId: rotation.containerKeyEpochId,\n    keyring: rotation.keyring,\n    parentContainerId: input.destinationState.containerId,\n    parentManifestHash: input.destinationParent.manifest.manifestHash,\n    predecessorBridge: rotation.predecessorBridge,\n  });\n  return { ...rotation, body };\n}\n\nexport async function deriveMoveManifestArtifacts(input: {\n  body: ContainerMoveAccessEventBody;\n  containerKeyEpochId: string;\n  destinationParent: ReturnType<typeof getTargetContainerContext>;\n  previousState: ContainerAccessManifestState;\n  signing: MoveSigningContext;\n  source: ReturnType<typeof getTargetContainerContext>;\n}) {\n  const { event, eventHash } = await signContainerMoveEvent({\n    body: input.body,\n    containerId: input.previousState.containerId,\n    signing: input.signing,\n    source: input.source,\n  });\n  const { manifest, manifestHash, state } = await deriveContainerMoveManifest({\n    containerKeyPublicKey: input.body.containerKeyPublicKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    destinationParent: input.destinationParent.manifest,\n    eventHash,\n    previousManifest: input.source.manifest,\n  });\n  const keyEpoch = buildMoveKeyEpoch({\n    containerKeyEpochId: input.containerKeyEpochId,\n    destinationParent: input.destinationParent,\n    eventHash,\n    manifestHash,\n    source: input.source,\n  });\n  return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n"]}

package/workflows/containers/child/moveRotation.js

@@ -1,88 +0,0 @@
-import { createContainerKekPredecessorBridge, KeyingVerificationError, normalizeContainerKekKeyring, openContainerKekKeyring, sealContainerKekKeyring, } from "../../../internal/crypto/index.js";
-import { resolveContainerKekEpochId } from "../../../data/containers/shared/events.js";
-import { verifyContainerKekEntries } from "../../../data/documents/shared/containerKekEntryVerification.js";
-/**
- * A rotation must never launder history it did not verify: an
- * authenticated-but-poisoned keyring (sealed by a prior authorized writer
- * with wrong material) would otherwise be re-signed under the honest
- * rotator's event. Every entry is checked against the material-id its
- * ordinal commits to before it is sealed forward; entry i is key epoch
- * i + 1.
- */
-export async function verifyKeyringEntriesForSeal(containerId, entries, 
-/**
- * The epoch ids the KEK's signed history commits to, wherever the
- * projection served it (`signedHistoryEpochIds`). A self-consistent forgery
- * passes the material check but cannot also make a real id disappear, so an
- * honest rotation never re-signs one. The KEK's own served history alone is
- * not enough: a server can serve it under another KEK (#2365 finding 32).
- */
-signedEpochIds) {
-    await verifyContainerKekEntries(containerId, entries);
-    const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));
-    for (const historicalId of signedEpochIds) {
-        if (!entryIds.has(historicalId)) {
-            // Classified like the reader's and the override's refusal of it.
-            throw new KeyingVerificationError("missing_dependency", "Container KEK keyring omits an epoch its manifest history commits to");
-        }
-    }
-}
-/**
- * Re-seals the container's key history for a rotation: the previous
- * keyring's entries plus the retiring key, under the new epoch's key. One
- * decrypt and one seal regardless of container age.
- */
-export async function sealRotationKeyring(input) {
-    const previousEntries = input.currentKek.keyring
-        ? await openContainerKekKeyring({
-            keyEpoch: input.currentKek.containerKeyEpoch,
-            keyring: normalizeContainerKekKeyring(input.currentKek.keyring),
-            successorContainerKey: input.currentKeyMaterial,
-        })
-        : [];
-    await verifyKeyringEntriesForSeal(input.containerId, previousEntries, input.signedEpochIds);
-    return sealContainerKekKeyring({
-        containerId: input.containerId,
-        entries: [
-            ...previousEntries,
-            {
-                containerKeyEpochId: input.currentKek.containerKeyEpochId,
-                keyMaterial: input.currentKeyMaterial,
-            },
-        ],
-        keyEpoch: input.keyEpoch,
-        successorContainerKey: input.successorContainerKey,
-        successorContainerKeyEpochId: input.successorContainerKeyEpochId,
-    });
-}
-/**
- * Mints one container KEK rotation: fresh entropy for the new epoch, the
- * write-once bridge to the retiring epoch, and the re-sealed keyring.
- */
-export async function buildContainerRotationArtifacts(input) {
-    const containerKey = crypto.getRandomValues(new Uint8Array(32));
-    const containerKeyEpochId = await resolveContainerKekEpochId({
-        containerId: input.containerId,
-        keyEpoch: input.keyEpoch,
-        keyMaterial: containerKey,
-        override: input.override,
-    });
-    const predecessorBridge = await createContainerKekPredecessorBridge({
-        containerId: input.containerId,
-        predecessorContainerKey: input.currentKeyMaterial,
-        predecessorContainerKeyEpochId: input.currentKek.containerKeyEpochId,
-        successorContainerKey: containerKey,
-        successorContainerKeyEpochId: containerKeyEpochId,
-    });
-    const keyring = await sealRotationKeyring({
-        containerId: input.containerId,
-        currentKek: input.currentKek,
-        currentKeyMaterial: input.currentKeyMaterial,
-        keyEpoch: input.keyEpoch,
-        signedEpochIds: input.signedEpochIds,
-        successorContainerKey: containerKey,
-        successorContainerKeyEpochId: containerKeyEpochId,
-    });
-    return { containerKey, containerKeyEpochId, keyring, predecessorBridge };
-}
-//# sourceMappingURL=moveRotation.js.map

package/workflows/containers/child/moveRotation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"moveRotation.js","sourceRoot":"","sources":["moveRotation.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAA4C;AAC5C;;;;;;GAMG;AACH,cAAmC;IAEnC,MAAM,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO;QAC9C,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB;YAC5C,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/D,qBAAqB,EAAE,KAAK,CAAC,kBAAkB;SAChD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,2BAA2B,CAC/B,KAAK,CAAC,WAAW,EACjB,eAAe,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,OAAO,uBAAuB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE;YACP,GAAG,eAAe;YAClB;gBACE,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;gBACzD,WAAW,EAAE,KAAK,CAAC,kBAAkB;aACtC;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAOrD;IAMC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,uBAAuB,EAAE,KAAK,CAAC,kBAAkB;QACjD,8BAA8B,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type {\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerKekPredecessorBridge,\n} from \"@tearleads/crypto\";\nimport {\n  createContainerKekPredecessorBridge,\n  KeyingVerificationError,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport { resolveContainerKekEpochId } from \"../../../data/containers/shared/events\";\nimport { verifyContainerKekEntries } from \"../../../data/documents/shared/containerKekEntryVerification\";\n\n/**\n * A rotation must never launder history it did not verify: an\n * authenticated-but-poisoned keyring (sealed by a prior authorized writer\n * with wrong material) would otherwise be re-signed under the honest\n * rotator's event. Every entry is checked against the material-id its\n * ordinal commits to before it is sealed forward; entry i is key epoch\n * i + 1.\n */\nexport async function verifyKeyringEntriesForSeal(\n  containerId: string,\n  entries: readonly ContainerKekKeyringEntry[],\n  /**\n   * The epoch ids the KEK's signed history commits to, wherever the\n   * projection served it (`signedHistoryEpochIds`). A self-consistent forgery\n   * passes the material check but cannot also make a real id disappear, so an\n   * honest rotation never re-signs one. The KEK's own served history alone is\n   * not enough: a server can serve it under another KEK (#2365 finding 32).\n   */\n  signedEpochIds: ReadonlySet<string>,\n): Promise<void> {\n  await verifyContainerKekEntries(containerId, entries);\n  const entryIds = new Set(entries.map((entry) => entry.containerKeyEpochId));\n  for (const historicalId of signedEpochIds) {\n    if (!entryIds.has(historicalId)) {\n      // Classified like the reader's and the override's refusal of it.\n      throw new KeyingVerificationError(\n        \"missing_dependency\",\n        \"Container KEK keyring omits an epoch its manifest history commits to\",\n      );\n    }\n  }\n}\n\n/**\n * Re-seals the container's key history for a rotation: the previous\n * keyring's entries plus the retiring key, under the new epoch's key. One\n * decrypt and one seal regardless of container age.\n */\nexport async function sealRotationKeyring(input: {\n  containerId: string;\n  currentKek: ContainerKekResponse;\n  currentKeyMaterial: Uint8Array;\n  keyEpoch: number;\n  signedEpochIds: ReadonlySet<string>;\n  successorContainerKey: Uint8Array;\n  successorContainerKeyEpochId: string;\n}): Promise<ContainerKekKeyring> {\n  const previousEntries = input.currentKek.keyring\n    ? await openContainerKekKeyring({\n        keyEpoch: input.currentKek.containerKeyEpoch,\n        keyring: normalizeContainerKekKeyring(input.currentKek.keyring),\n        successorContainerKey: input.currentKeyMaterial,\n      })\n    : [];\n  await verifyKeyringEntriesForSeal(\n    input.containerId,\n    previousEntries,\n    input.signedEpochIds,\n  );\n  return sealContainerKekKeyring({\n    containerId: input.containerId,\n    entries: [\n      ...previousEntries,\n      {\n        containerKeyEpochId: input.currentKek.containerKeyEpochId,\n        keyMaterial: input.currentKeyMaterial,\n      },\n    ],\n    keyEpoch: input.keyEpoch,\n    successorContainerKey: input.successorContainerKey,\n    successorContainerKeyEpochId: input.successorContainerKeyEpochId,\n  });\n}\n\n/**\n * Mints one container KEK rotation: fresh entropy for the new epoch, the\n * write-once bridge to the retiring epoch, and the re-sealed keyring.\n */\nexport async function buildContainerRotationArtifacts(input: {\n  containerId: string;\n  currentKek: ContainerKekResponse;\n  currentKeyMaterial: Uint8Array;\n  keyEpoch: number;\n  override?: string | undefined;\n  signedEpochIds: ReadonlySet<string>;\n}): Promise<{\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  keyring: ContainerKekKeyring;\n  predecessorBridge: ContainerKekPredecessorBridge;\n}> {\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerKeyEpochId = await resolveContainerKekEpochId({\n    containerId: input.containerId,\n    keyEpoch: input.keyEpoch,\n    keyMaterial: containerKey,\n    override: input.override,\n  });\n  const predecessorBridge = await createContainerKekPredecessorBridge({\n    containerId: input.containerId,\n    predecessorContainerKey: input.currentKeyMaterial,\n    predecessorContainerKeyEpochId: input.currentKek.containerKeyEpochId,\n    successorContainerKey: containerKey,\n    successorContainerKeyEpochId: containerKeyEpochId,\n  });\n  const keyring = await sealRotationKeyring({\n    containerId: input.containerId,\n    currentKek: input.currentKek,\n    currentKeyMaterial: input.currentKeyMaterial,\n    keyEpoch: input.keyEpoch,\n    signedEpochIds: input.signedEpochIds,\n    successorContainerKey: containerKey,\n    successorContainerKeyEpochId: containerKeyEpochId,\n  });\n  return { containerKey, containerKeyEpochId, keyring, predecessorBridge };\n}\n"]}

package/workflows/containers/child/moveWraps.js

@@ -1,49 +0,0 @@
-import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
-import { readContainerState } from "../../../data/containers/shared/projection.js";
-import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
-import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
-import { buildContainerRotationWraps } from "./rotationWraps.js";
-export async function collectContainerMovePrincipalPolicies(input) {
-    const [sourcePolicies, destinationParentPolicies] = await Promise.all([
-        collectContainerWriterProjectionPrincipalPolicies({
-            execSql: input.execSql,
-            projection: input.previousProjection,
-            resolveUserKey: input.resolveUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        }),
-        collectContainerWriterProjectionPrincipalPolicies({
-            execSql: input.execSql,
-            projection: input.destinationParentProjection,
-            resolveUserKey: input.resolveUserKey,
-            stillCurrent: input.stillCurrent,
-            warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-        }),
-    ]);
-    return uniquePrincipalPolicies([
-        ...sourcePolicies,
-        ...destinationParentPolicies,
-    ]);
-}
-export async function buildContainerMoveWraps(input) {
-    assertContainerKekPathCurrent(input.destinationParentProjection.containerKeks);
-    const principalPolicies = input.principalPolicies;
-    const parentManifest = input.destinationParentProjection.path.at(-1);
-    if (!parentManifest)
-        throw new Error("Container move destination parent is missing");
-    return {
-        principalPolicies,
-        ...(await buildContainerRotationWraps({
-            containerKey: input.containerKey,
-            containerKeyEpochId: input.containerKeyEpochId,
-            manifestHash: input.manifestHash,
-            operationLabel: "Container move",
-            parentKek: input.destinationParentKek,
-            parentPublicKey: readContainerState(parentManifest).containerKeyPublicKey,
-            principalPolicies,
-            resolveUserKey: input.resolveProjectionUserKey,
-            state: input.state,
-        })),
-    };
-}
-//# sourceMappingURL=moveWraps.js.map

package/workflows/containers/child/moveWraps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"moveWraps.js","sourceRoot":"","sources":["moveWraps.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EACL,iDAAiD,GAGlD,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAO3D;IACC,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,iDAAiD,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,kBAAkB;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACF,iDAAiD,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,2BAA2B;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;KACH,CAAC,CAAC;IACH,OAAO,uBAAuB,CAAC;QAC7B,GAAG,cAAc;QACjB,GAAG,yBAAyB;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAa7C;IACC,6BAA6B,CAC3B,KAAK,CAAC,2BAA2B,CAAC,aAAa,CAChD,CAAC;IACF,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClD,MAAM,cAAc,GAAG,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,OAAO;QACL,iBAAiB;QACjB,GAAG,CAAC,MAAM,2BAA2B,CAAC;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,gBAAgB;YAChC,SAAS,EAAE,KAAK,CAAC,oBAAoB;YACrC,eAAe,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC,qBAAqB;YACzE,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerAccessManifestState } from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport { readContainerState } from \"../../../data/containers/shared/projection\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\n\nexport async function collectContainerMovePrincipalPolicies(input: {\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  execSql: ExecSql;\n  previousProjection: ContainerWriterProjectionResponse;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const [sourcePolicies, destinationParentPolicies] = await Promise.all([\n    collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n    collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      projection: input.destinationParentProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  ]);\n  return uniquePrincipalPolicies([\n    ...sourcePolicies,\n    ...destinationParentPolicies,\n  ]);\n}\n\nexport async function buildContainerMoveWraps(input: {\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  destinationParentKek: ContainerKekResponse;\n  destinationParentProjection: ContainerWriterProjectionResponse;\n  execSql: ExecSql;\n  manifestHash: string;\n  previousProjection: ContainerWriterProjectionResponse;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  state: ContainerAccessManifestState;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}) {\n  assertContainerKekPathCurrent(\n    input.destinationParentProjection.containerKeks,\n  );\n  const principalPolicies = input.principalPolicies;\n  const parentManifest = input.destinationParentProjection.path.at(-1);\n  if (!parentManifest)\n    throw new Error(\"Container move destination parent is missing\");\n  return {\n    principalPolicies,\n    ...(await buildContainerRotationWraps({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      operationLabel: \"Container move\",\n      parentKek: input.destinationParentKek,\n      parentPublicKey: readContainerState(parentManifest).containerKeyPublicKey,\n      principalPolicies,\n      resolveUserKey: input.resolveProjectionUserKey,\n      state: input.state,\n    })),\n  };\n}\n"]}

package/workflows/containers/child/rekey.d.ts

@@ -1,32 +0,0 @@
-import type { ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
-import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerMutationAuthor, MaterializedContainerRekeyPlan } from "../../../data/containers/shared/types.js";
-import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { PrincipalPolicyCurrentEvidence } from "../../../data/principals/principalPolicyEvidence.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-/**
- * An explicit container KEK rotation with no membership change. Doubles as
- * the repair operation: passing `keyringEntriesOverride` seals a keyring
- * rebuilt from the bridge log instead of re-opening the served one, so a
- * poisoned snapshot is replaced by ground truth.
- */
-interface RekeyPlanInput {
-    author: ContainerMutationAuthor;
-    eventId?: string | undefined;
-    execSql: ExecSql;
-    keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;
-    /** Keys a batch minted above this container and has yet to commit. */
-    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
-    persistVerificationCheckpoints?: boolean | undefined;
-    previousProjection: ContainerWriterProjectionResponse;
-    /** Verified policies the path may cite before they are stored locally. */
-    principalPolicyCache?: PrincipalPolicyCache | undefined;
-    replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
-    resolveProjectionUserKey: ProjectionUserKeyResolver;
-    signedAt?: string | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    targetSecretKey: Uint8Array;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}
-export declare function buildMaterializedContainerRekeyPlan(input: RekeyPlanInput): Promise<MaterializedContainerRekeyPlan>;
-export {};

package/workflows/containers/child/rekey.js

@@ -1,227 +0,0 @@
-import { computeAccessManifestHash, computeContainerKekKeyringHash, computeContainerKekPredecessorBridgeHash, createContainerKekPredecessorBridge, deriveContainerAccessManifest, deriveContainerKekWrappingPublicKey, sealContainerKekKeyring, } from "../../../internal/crypto/index.js";
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { buildContainerCreateKeyEpoch, resolveContainerKekEpochId, signContainerMutationEvent, } from "../../../data/containers/shared/events.js";
-import { asContainerManifestBundle, uniqueSortedManifestHashes, } from "../../../data/containers/shared/projection.js";
-import { readCanonicalRecord } from "../../../data/keying/canonicalJson.js";
-import { requireProjectionUserKeyResolver, } from "../../../data/keyingProjectionVerification/index.js";
-import { assertOverrideMatchesSignedLineage } from "./keyringOverrideLineage.js";
-import { sealRotationKeyring, verifyKeyringEntriesForSeal, } from "./moveRotation.js";
-import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
-import { containerWriterProjectionFromRekeyPlan, isSpeculativeContainerWriterProjection, } from "./rekeyProjection.js";
-import { resolveRotationContext, } from "./rotationContext.js";
-import { collectContainerRevokePrincipalPolicies } from "./rotationPrincipalPolicies.js";
-import { buildContainerRotationWraps } from "./rotationWraps.js";
-import { refreshedPrincipalPolicies, refreshedPrincipalReferences, } from "./sharePlanCore.js";
-async function buildRekeyRotationArtifacts(input) {
-    const containerKeyEpochId = await resolveContainerKekEpochId({
-        containerId: input.previousContainerId,
-        keyEpoch: input.nextContainerKeyEpoch,
-        keyMaterial: input.containerKey,
-    });
-    const predecessorBridge = await createContainerKekPredecessorBridge({
-        containerId: input.previousContainerId,
-        predecessorContainerKey: input.predecessorContainerKey,
-        predecessorContainerKeyEpochId: input.target.kek.containerKeyEpochId,
-        successorContainerKey: input.containerKey,
-        successorContainerKeyEpochId: containerKeyEpochId,
-    });
-    if (input.keyringEntriesOverride) {
-        // A rebuilt override still has to agree with the epochs the projection's
-        // signed history commits to; otherwise a repair could seal a forgery.
-        // Exact match first, for distinct errors; the seal check below then adds
-        // only the per-entry material check for an override.
-        assertOverrideMatchesSignedLineage(input.keyringEntriesOverride, input.target.signedEpochIds);
-        await verifyKeyringEntriesForSeal(input.previousContainerId, input.keyringEntriesOverride, input.target.signedEpochIds);
-    }
-    const keyring = input.keyringEntriesOverride
-        ? await sealContainerKekKeyring({
-            containerId: input.previousContainerId,
-            entries: [
-                ...input.keyringEntriesOverride,
-                {
-                    containerKeyEpochId: input.target.kek.containerKeyEpochId,
-                    keyMaterial: input.predecessorContainerKey,
-                },
-            ],
-            keyEpoch: input.nextContainerKeyEpoch,
-            successorContainerKey: input.containerKey,
-            successorContainerKeyEpochId: containerKeyEpochId,
-        })
-        : await sealRotationKeyring({
-            containerId: input.previousContainerId,
-            currentKek: input.target.kek,
-            currentKeyMaterial: input.predecessorContainerKey,
-            keyEpoch: input.nextContainerKeyEpoch,
-            signedEpochIds: input.target.signedEpochIds,
-            successorContainerKey: input.containerKey,
-            successorContainerKeyEpochId: containerKeyEpochId,
-        });
-    return { containerKeyEpochId, keyring, predecessorBridge };
-}
-async function deriveRekeyManifestArtifacts(input) {
-    const body = {
-        eventType: "container.rekey",
-        parentManifestHash: input.previousProjection.path.at(-2)?.manifestHash ?? null,
-        containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({
-            containerId: input.previousState.containerId,
-            keyMaterial: input.containerKey,
-        }),
-        containerKeyEpochId: input.containerKeyEpochId,
-        keyringHash: await computeContainerKekKeyringHash(input.keyring),
-        predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(input.predecessorBridge),
-        referencedPrincipalHeads: [...input.referencedPrincipalHeads],
-    };
-    const { event, eventHash } = await signContainerMutationEvent({
-        author: input.author,
-        body,
-        containerId: input.previousState.containerId,
-        dependencyManifestHashes: uniqueSortedManifestHashes(input.previousProjection.path),
-        eventId: input.eventId ?? crypto.randomUUID(),
-        previousManifestHash: input.target.manifest.manifestHash,
-        signedAt: input.signedAt ?? new Date().toISOString(),
-    });
-    const state = {
-        ...input.previousState,
-        parentManifestHash: body.parentManifestHash,
-        containerKeyPublicKey: body.containerKeyPublicKey,
-        epoch: input.previousState.epoch + 1,
-        previousManifestHash: input.target.manifest.manifestHash,
-        eventHash,
-        containerKeyEpochId: input.containerKeyEpochId,
-        referencedPrincipalHeads: [...input.referencedPrincipalHeads],
-    };
-    const manifest = await deriveContainerAccessManifest(state);
-    const manifestHash = await computeAccessManifestHash(manifest);
-    const keyEpoch = buildContainerCreateKeyEpoch({
-        containerId: input.previousState.containerId,
-        containerKeyEpochId: input.containerKeyEpochId,
-        eventHash,
-        keyEpoch: input.target.kek.containerKeyEpoch + 1,
-        manifestHash,
-        parentContainerKeyEpochId: input.parentKek?.containerKeyEpochId ?? null,
-    });
-    return { body, event, eventHash, keyEpoch, manifest, manifestHash, state };
-}
-function speculativeSafeRekeyInput(input) {
-    return isSpeculativeContainerWriterProjection(input.previousProjection)
-        ? { ...input, persistVerificationCheckpoints: false }
-        : input;
-}
-async function collectRekeyPrincipalPolicies(input, resolveUserKey) {
-    const previousPolicies = await collectContainerRevokePrincipalPolicies({
-        execSql: input.execSql,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        previousProjection: input.previousProjection,
-        principalPolicyCache: input.principalPolicyCache,
-        resolveUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    const principalPolicies = refreshedPrincipalPolicies({
-        previousPolicies,
-        replacementPrincipalPolicy: input.replacementPrincipalPolicy,
-    });
-    assertContainerAuthorAccess({
-        author: input.author,
-        projection: input.previousProjection,
-        principalPolicies,
-        minimumAccess: "write",
-    });
-    return principalPolicies;
-}
-export async function buildMaterializedContainerRekeyPlan(input) {
-    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container rekey");
-    const planningInput = speculativeSafeRekeyInput(input);
-    const containerKey = crypto.getRandomValues(new Uint8Array(32));
-    const { parentKek, parentPublicKey, predecessorContainerKey, previousState, target, } = await resolveRotationContext(planningInput, "rekey");
-    const { containerKeyEpochId, keyring, predecessorBridge } = await buildRekeyRotationArtifacts({
-        containerKey,
-        keyringEntriesOverride: input.keyringEntriesOverride,
-        nextContainerKeyEpoch: target.kek.containerKeyEpoch + 1,
-        predecessorContainerKey,
-        previousContainerId: previousState.containerId,
-        target,
-    });
-    const principalPolicies = await collectRekeyPrincipalPolicies(planningInput, resolveProjectionUserKey);
-    const referencedPrincipalHeads = refreshedPrincipalReferences({
-        previousState,
-        replacementPrincipalPolicy: input.replacementPrincipalPolicy,
-    });
-    const { body, event, eventHash, keyEpoch, manifest, manifestHash, state } = await deriveRekeyManifestArtifacts({
-        containerKey,
-        author: input.author,
-        containerKeyEpochId,
-        eventId: input.eventId,
-        keyring,
-        parentKek,
-        predecessorBridge,
-        previousProjection: input.previousProjection,
-        previousState,
-        referencedPrincipalHeads,
-        signedAt: input.signedAt,
-        target,
-    });
-    const { userRecipientKeys, wraps } = await buildContainerRotationWraps({
-        containerKey,
-        containerKeyEpochId,
-        manifestHash,
-        operationLabel: "Container rekey",
-        parentKek,
-        parentPublicKey,
-        principalPolicies,
-        resolveUserKey: resolveProjectionUserKey,
-        state,
-    });
-    const plan = buildContainerRekeyPlan({
-        body,
-        containerId: previousState.containerId,
-        containerKeyEpochId,
-        event,
-        eventHash,
-        keyEpoch,
-        keyring,
-        manifest,
-        manifestHash,
-        parentKek,
-        predecessorBridge,
-        previousManifest: asContainerManifestBundle(target.manifest),
-        previousProjection: input.previousProjection,
-        principalPolicies,
-        state,
-        userRecipientKeys,
-        wraps,
-    });
-    const materializedPlan = { containerKey, plan };
-    return {
-        ...materializedPlan,
-        writerProjection: await containerWriterProjectionFromRekeyPlan({
-            materializedPlan,
-            previousProjection: input.previousProjection,
-        }),
-    };
-}
-function buildContainerRekeyPlan(input) {
-    return {
-        body: input.body,
-        containerId: input.containerId,
-        containerKeyEpochId: input.containerKeyEpochId,
-        event: input.event,
-        eventHash: input.eventHash,
-        keyEpoch: input.keyEpoch,
-        keyring: input.keyring,
-        manifest: input.manifest,
-        manifestHash: input.manifestHash,
-        previousManifest: input.previousManifest,
-        request: {
-            ...containerMutationRequestCore("rekey", input),
-            ...previousPathRequestFields(input.previousManifest, input.previousProjection),
-            predecessorBridge: readCanonicalRecord(input.predecessorBridge, "Container rekey predecessor bridge"),
-            keyring: readCanonicalRecord(input.keyring, "Container rekey keyring"),
-            parentKekState: readCanonicalRecordOrNull(input.parentKek, "Container rekey parent KEK state"),
-        },
-        state: input.state,
-        userRecipientKeys: input.userRecipientKeys,
-        wraps: input.wraps,
-    };
-}
-//# sourceMappingURL=rekey.js.map

package/workflows/containers/child/rekey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rekey.js","sourceRoot":"","sources":["rekey.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EAIzB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAIL,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,KAAK,UAAU,2BAA2B,CAAC,KAO1C;IAOC,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,QAAQ,EAAE,KAAK,CAAC,qBAAqB;QACrC,WAAW,EAAE,KAAK,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,mCAAmC,CAAC;QAClE,WAAW,EAAE,KAAK,CAAC,mBAAmB;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACpE,qBAAqB,EAAE,KAAK,CAAC,YAAY;QACzC,4BAA4B,EAAE,mBAAmB;KAClD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,qDAAqD;QACrD,kCAAkC,CAChC,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;QACF,MAAM,2BAA2B,CAC/B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAwB,KAAK,CAAC,sBAAsB;QAC/D,CAAC,CAAC,MAAM,uBAAuB,CAAC;YAC5B,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,sBAAsB;gBAC/B;oBACE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;oBACzD,WAAW,EAAE,KAAK,CAAC,uBAAuB;iBAC3C;aACF;YACD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC;QACJ,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,mBAAmB;YACtC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YAC5B,kBAAkB,EAAE,KAAK,CAAC,uBAAuB;YACjD,QAAQ,EAAE,KAAK,CAAC,qBAAqB;YACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,4BAA4B,EAAE,mBAAmB;SAClD,CAAC,CAAC;IACP,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAe3C;IACC,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC5D,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,WAAW,EAAE,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;QAChE,qBAAqB,EAAE,MAAM,wCAAwC,CACnE,KAAK,CAAC,iBAAiB,CACxB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,aAAa;QACtB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC;QACpC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QACxD,SAAS;QACT,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;KAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QAChD,YAAY;QACZ,yBAAyB,EAAE,KAAK,CAAC,SAAS,EAAE,mBAAmB,IAAI,IAAI;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AA2BD,SAAS,yBAAyB,CAAC,KAAqB;IACtD,OAAO,sCAAsC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACrE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE;QACrD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqB,EACrB,cAAyC;IAEzC,MAAM,gBAAgB,GAAG,MAAM,uCAAuC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;QACnD,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqB;IAErB,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,EACJ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,MAAM,GACP,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACvD,MAAM,2BAA2B,CAAC;QAChC,YAAY;QACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC;QACvD,uBAAuB;QACvB,mBAAmB,EAAE,aAAa,CAAC,WAAW;QAC9C,MAAM;KACP,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,MAAM,6BAA6B,CAC3D,aAAa,EACb,wBAAwB,CACzB,CAAC;IAEF,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;QAC5D,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACvE,MAAM,4BAA4B,CAAC;QACjC,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,SAAS;QACT,iBAAiB;QACjB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,aAAa;QACb,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM;KACP,CAAC,CAAC;IACL,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;QACrE,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,cAAc,EAAE,iBAAiB;QACjC,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,cAAc,EAAE,wBAAwB;QACxC,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,iBAAiB;QACjB,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,KAAK;QACL,iBAAiB;QACjB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO;QACL,GAAG,gBAAgB;QACnB,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;YAC7D,gBAAgB;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAoBhC;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE;YACP,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;YAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;YACD,iBAAiB,EAAE,mBAAmB,CACpC,KAAK,CAAC,iBAAiB,EACvB,oCAAoC,CACrC;YACD,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;YACtE,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;SACF;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerGrantPrincipalHead,\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerRekeyAccessEventBody,\n} from \"@tearleads/crypto\";\nimport {\n  computeAccessManifestHash,\n  computeContainerKekKeyringHash,\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  deriveContainerAccessManifest,\n  deriveContainerKekWrappingPublicKey,\n  sealContainerKekKeyring,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport {\n  buildContainerCreateKeyEpoch,\n  resolveContainerKekEpochId,\n  signContainerMutationEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  type getParentKekForTarget,\n  type getTargetContainerContext,\n  type readContainerState,\n  uniqueSortedManifestHashes,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyPlan,\n  MaterializedContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keying/canonicalJson\";\nimport {\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { assertOverrideMatchesSignedLineage } from \"./keyringOverrideLineage\";\nimport {\n  sealRotationKeyring,\n  verifyKeyringEntriesForSeal,\n} from \"./moveRotation\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\nimport {\n  containerWriterProjectionFromRekeyPlan,\n  isSpeculativeContainerWriterProjection,\n} from \"./rekeyProjection\";\nimport {\n  resolveRotationContext,\n  type SignedRotationTarget,\n} from \"./rotationContext\";\nimport { collectContainerRevokePrincipalPolicies } from \"./rotationPrincipalPolicies\";\nimport { buildContainerRotationWraps } from \"./rotationWraps\";\nimport {\n  refreshedPrincipalPolicies,\n  refreshedPrincipalReferences,\n} from \"./sharePlanCore\";\n\nasync function buildRekeyRotationArtifacts(input: {\n  containerKey: Uint8Array;\n  keyringEntriesOverride: readonly ContainerKekKeyringEntry[] | undefined;\n  nextContainerKeyEpoch: number;\n  predecessorContainerKey: Uint8Array;\n  previousContainerId: string;\n  target: SignedRotationTarget;\n}): Promise<{\n  containerKeyEpochId: string;\n  keyring: ContainerKekKeyring;\n  predecessorBridge: Awaited<\n    ReturnType<typeof createContainerKekPredecessorBridge>\n  >;\n}> {\n  const containerKeyEpochId = await resolveContainerKekEpochId({\n    containerId: input.previousContainerId,\n    keyEpoch: input.nextContainerKeyEpoch,\n    keyMaterial: input.containerKey,\n  });\n  const predecessorBridge = await createContainerKekPredecessorBridge({\n    containerId: input.previousContainerId,\n    predecessorContainerKey: input.predecessorContainerKey,\n    predecessorContainerKeyEpochId: input.target.kek.containerKeyEpochId,\n    successorContainerKey: input.containerKey,\n    successorContainerKeyEpochId: containerKeyEpochId,\n  });\n  if (input.keyringEntriesOverride) {\n    // A rebuilt override still has to agree with the epochs the projection's\n    // signed history commits to; otherwise a repair could seal a forgery.\n    // Exact match first, for distinct errors; the seal check below then adds\n    // only the per-entry material check for an override.\n    assertOverrideMatchesSignedLineage(\n      input.keyringEntriesOverride,\n      input.target.signedEpochIds,\n    );\n    await verifyKeyringEntriesForSeal(\n      input.previousContainerId,\n      input.keyringEntriesOverride,\n      input.target.signedEpochIds,\n    );\n  }\n  const keyring: ContainerKekKeyring = input.keyringEntriesOverride\n    ? await sealContainerKekKeyring({\n        containerId: input.previousContainerId,\n        entries: [\n          ...input.keyringEntriesOverride,\n          {\n            containerKeyEpochId: input.target.kek.containerKeyEpochId,\n            keyMaterial: input.predecessorContainerKey,\n          },\n        ],\n        keyEpoch: input.nextContainerKeyEpoch,\n        successorContainerKey: input.containerKey,\n        successorContainerKeyEpochId: containerKeyEpochId,\n      })\n    : await sealRotationKeyring({\n        containerId: input.previousContainerId,\n        currentKek: input.target.kek,\n        currentKeyMaterial: input.predecessorContainerKey,\n        keyEpoch: input.nextContainerKeyEpoch,\n        signedEpochIds: input.target.signedEpochIds,\n        successorContainerKey: input.containerKey,\n        successorContainerKeyEpochId: containerKeyEpochId,\n      });\n  return { containerKeyEpochId, keyring, predecessorBridge };\n}\n\nasync function deriveRekeyManifestArtifacts(input: {\n  containerKey: Uint8Array;\n  author: ContainerMutationAuthor;\n  containerKeyEpochId: string;\n  eventId: string | undefined;\n  keyring: ContainerKekKeyring;\n  parentKek: ReturnType<typeof getParentKekForTarget>;\n  predecessorBridge: Awaited<\n    ReturnType<typeof createContainerKekPredecessorBridge>\n  >;\n  previousProjection: ContainerWriterProjectionResponse;\n  previousState: ReturnType<typeof readContainerState>;\n  referencedPrincipalHeads: readonly ContainerGrantPrincipalHead[];\n  signedAt: string | undefined;\n  target: ReturnType<typeof getTargetContainerContext>;\n}) {\n  const body: ContainerRekeyAccessEventBody = {\n    eventType: \"container.rekey\",\n    parentManifestHash:\n      input.previousProjection.path.at(-2)?.manifestHash ?? null,\n    containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n      containerId: input.previousState.containerId,\n      keyMaterial: input.containerKey,\n    }),\n    containerKeyEpochId: input.containerKeyEpochId,\n    keyringHash: await computeContainerKekKeyringHash(input.keyring),\n    predecessorBridgeHash: await computeContainerKekPredecessorBridgeHash(\n      input.predecessorBridge,\n    ),\n    referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: input.previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.target.manifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const state = {\n    ...input.previousState,\n    parentManifestHash: body.parentManifestHash,\n    containerKeyPublicKey: body.containerKeyPublicKey,\n    epoch: input.previousState.epoch + 1,\n    previousManifestHash: input.target.manifest.manifestHash,\n    eventHash,\n    containerKeyEpochId: input.containerKeyEpochId,\n    referencedPrincipalHeads: [...input.referencedPrincipalHeads],\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n  const manifestHash = await computeAccessManifestHash(manifest);\n  const keyEpoch = buildContainerCreateKeyEpoch({\n    containerId: input.previousState.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    eventHash,\n    keyEpoch: input.target.kek.containerKeyEpoch + 1,\n    manifestHash,\n    parentContainerKeyEpochId: input.parentKek?.containerKeyEpochId ?? null,\n  });\n  return { body, event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\n/**\n * An explicit container KEK rotation with no membership change. Doubles as\n * the repair operation: passing `keyringEntriesOverride` seals a keyring\n * rebuilt from the bridge log instead of re-opening the served one, so a\n * poisoned snapshot is replaced by ground truth.\n */\ninterface RekeyPlanInput {\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;\n  /** Keys a batch minted above this container and has yet to commit. */\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  /** Verified policies the path may cite before they are stored locally. */\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nfunction speculativeSafeRekeyInput(input: RekeyPlanInput): RekeyPlanInput {\n  return isSpeculativeContainerWriterProjection(input.previousProjection)\n    ? { ...input, persistVerificationCheckpoints: false }\n    : input;\n}\n\nasync function collectRekeyPrincipalPolicies(\n  input: RekeyPlanInput,\n  resolveUserKey: ProjectionUserKeyResolver,\n): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const previousPolicies = await collectContainerRevokePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    previousProjection: input.previousProjection,\n    principalPolicyCache: input.principalPolicyCache,\n    resolveUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  const principalPolicies = refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"write\",\n  });\n  return principalPolicies;\n}\n\nexport async function buildMaterializedContainerRekeyPlan(\n  input: RekeyPlanInput,\n): Promise<MaterializedContainerRekeyPlan> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container rekey\",\n  );\n  const planningInput = speculativeSafeRekeyInput(input);\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  } = await resolveRotationContext(planningInput, \"rekey\");\n  const { containerKeyEpochId, keyring, predecessorBridge } =\n    await buildRekeyRotationArtifacts({\n      containerKey,\n      keyringEntriesOverride: input.keyringEntriesOverride,\n      nextContainerKeyEpoch: target.kek.containerKeyEpoch + 1,\n      predecessorContainerKey,\n      previousContainerId: previousState.containerId,\n      target,\n    });\n  const principalPolicies = await collectRekeyPrincipalPolicies(\n    planningInput,\n    resolveProjectionUserKey,\n  );\n\n  const referencedPrincipalHeads = refreshedPrincipalReferences({\n    previousState,\n    replacementPrincipalPolicy: input.replacementPrincipalPolicy,\n  });\n  const { body, event, eventHash, keyEpoch, manifest, manifestHash, state } =\n    await deriveRekeyManifestArtifacts({\n      containerKey,\n      author: input.author,\n      containerKeyEpochId,\n      eventId: input.eventId,\n      keyring,\n      parentKek,\n      predecessorBridge,\n      previousProjection: input.previousProjection,\n      previousState,\n      referencedPrincipalHeads,\n      signedAt: input.signedAt,\n      target,\n    });\n  const { userRecipientKeys, wraps } = await buildContainerRotationWraps({\n    containerKey,\n    containerKeyEpochId,\n    manifestHash,\n    operationLabel: \"Container rekey\",\n    parentKek,\n    parentPublicKey,\n    principalPolicies,\n    resolveUserKey: resolveProjectionUserKey,\n    state,\n  });\n\n  const plan = buildContainerRekeyPlan({\n    body,\n    containerId: previousState.containerId,\n    containerKeyEpochId,\n    event,\n    eventHash,\n    keyEpoch,\n    keyring,\n    manifest,\n    manifestHash,\n    parentKek,\n    predecessorBridge,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies,\n    state,\n    userRecipientKeys,\n    wraps,\n  });\n  const materializedPlan = { containerKey, plan };\n  return {\n    ...materializedPlan,\n    writerProjection: await containerWriterProjectionFromRekeyPlan({\n      materializedPlan,\n      previousProjection: input.previousProjection,\n    }),\n  };\n}\n\nfunction buildContainerRekeyPlan(input: {\n  body: ContainerRekeyAccessEventBody;\n  containerId: string;\n  containerKeyEpochId: string;\n  event: ContainerRekeyPlan[\"event\"];\n  eventHash: string;\n  keyEpoch: ContainerRekeyPlan[\"keyEpoch\"];\n  keyring: ContainerKekKeyring;\n  manifest: ContainerRekeyPlan[\"manifest\"];\n  manifestHash: string;\n  parentKek: ReturnType<typeof getParentKekForTarget>;\n  predecessorBridge: Awaited<\n    ReturnType<typeof createContainerKekPredecessorBridge>\n  >;\n  previousManifest: ContainerRekeyPlan[\"previousManifest\"];\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  state: ContainerRekeyPlan[\"state\"];\n  userRecipientKeys: ContainerRekeyPlan[\"userRecipientKeys\"];\n  wraps: ContainerRekeyPlan[\"wraps\"];\n}): ContainerRekeyPlan {\n  return {\n    body: input.body,\n    containerId: input.containerId,\n    containerKeyEpochId: input.containerKeyEpochId,\n    event: input.event,\n    eventHash: input.eventHash,\n    keyEpoch: input.keyEpoch,\n    keyring: input.keyring,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousManifest: input.previousManifest,\n    request: {\n      ...containerMutationRequestCore(\"rekey\", input),\n      ...previousPathRequestFields(\n        input.previousManifest,\n        input.previousProjection,\n      ),\n      predecessorBridge: readCanonicalRecord(\n        input.predecessorBridge,\n        \"Container rekey predecessor bridge\",\n      ),\n      keyring: readCanonicalRecord(input.keyring, \"Container rekey keyring\"),\n      parentKekState: readCanonicalRecordOrNull(\n        input.parentKek,\n        \"Container rekey parent KEK state\",\n      ),\n    },\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n}\n"]}