@tearleads/client-sdk 0.1.63 → 0.1.65

package/workflows/containers/child/rekeyProjection.d.ts

@@ -1,46 +0,0 @@
-import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { MaterializedContainerRekeyPlan, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
-export declare function isSpeculativeContainerWriterProjection(projection: ContainerWriterProjectionResponse): boolean;
-/**
- * What any rotation plan (rekey, revoke, move) holds in common: enough to say
- * what its container's path entry will be once the server accepts it.
- */
-export interface RotationPlanArtifacts {
-    readonly body: object;
-    readonly containerId: string;
-    readonly containerKeyEpochId: string;
-    readonly event: MaterializedContainerRekeyPlan["plan"]["event"];
-    readonly eventHash: string;
-    readonly keyEpoch: MaterializedContainerRekeyPlan["plan"]["keyEpoch"];
-    readonly manifest: MaterializedContainerRekeyPlan["plan"]["manifest"];
-    readonly manifestHash: string;
-    readonly previousManifest: MaterializedContainerRekeyPlan["plan"]["previousManifest"];
-    readonly keyring: MaterializedContainerRekeyPlan["plan"]["keyring"];
-    readonly state: MaterializedContainerRekeyPlan["plan"]["state"];
-    readonly wraps: MaterializedContainerRekeyPlan["plan"]["wraps"];
-}
-/**
- * The projection a rotation will leave behind, before the server has accepted
- * it. `ancestors` is the path above the container afterwards: unchanged for a
- * rekey or revoke, the destination parent's path for a move.
- */
-export declare function containerWriterProjectionFromRotationPlan(input: {
-    ancestors?: Pick<ContainerWriterProjectionResponse, "containerKeks" | "path" | "policyEvidence">;
-    plan: RotationPlanArtifacts;
-    previousProjection: ContainerWriterProjectionResponse;
-}): Promise<ContainerWriterProjectionResponse>;
-export declare function containerWriterProjectionFromRekeyPlan(input: {
-    materializedPlan: Pick<MaterializedContainerRekeyPlan, "containerKey" | "plan">;
-    previousProjection: ContainerWriterProjectionResponse;
-}): Promise<ContainerWriterProjectionResponse>;
-/**
- * A descendant's served projection, re-rooted on rotations the server has not
- * accepted yet: `rotated` replaces the path down to and including its own
- * container. Null when the descendant does not sit below that container.
- */
-export declare function rebaseContainerWriterProjection(descendant: ContainerWriterProjectionResponse, rotated: Pick<ContainerWriterProjectionResponse, "containerKeks" | "path" | "policyEvidence">): ContainerWriterProjectionResponse | null;
-/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */
-export declare function containerWriterProjectionFromSharePlan(input: {
-    plan: MaterializedContainerSharePlan["plan"];
-    previousProjection: ContainerWriterProjectionResponse;
-}): Promise<ContainerWriterProjectionResponse>;

package/workflows/containers/child/rekeyProjection.js

@@ -1,151 +0,0 @@
-import { computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, } from "../../../internal/crypto/index.js";
-import { canonicalKeyingJsonString, readCanonicalRecord, readCanonicalRecords, } from "../../../data/keying/canonicalJson.js";
-import { mergeProjectionPolicyEvidence } from "../../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence.js";
-const speculativeProjections = new WeakSet();
-export function isSpeculativeContainerWriterProjection(projection) {
-    return speculativeProjections.has(projection);
-}
-function recipientTargets(plan) {
-    return plan.wraps
-        .map((wrap) => ({
-        recipientId: wrap.recipientId,
-        recipientKeyEpochId: wrap.recipientKeyEpochId,
-        recipientKeyFingerprint: wrap.recipientKeyFingerprint,
-        recipientKind: wrap.recipientKind,
-    }))
-        .sort((left, right) => canonicalKeyingJsonString(left, "Container rekey recipient").localeCompare(canonicalKeyingJsonString(right, "Container rekey recipient")));
-}
-/**
- * The projection a rotation will leave behind, before the server has accepted
- * it. `ancestors` is the path above the container afterwards: unchanged for a
- * rekey or revoke, the destination parent's path for a move.
- */
-export async function containerWriterProjectionFromRotationPlan(input) {
-    const { plan } = input;
-    const previousManifest = input.previousProjection.path.at(-1);
-    const previousKek = input.previousProjection.containerKeks.at(-1);
-    if (!previousManifest ||
-        !previousKek ||
-        previousManifest.manifestHash !== plan.previousManifest.manifestHash ||
-        previousKek.containerId !== plan.containerId) {
-        throw new Error("Container rekey projection predecessor mismatch");
-    }
-    const targets = recipientTargets(plan);
-    const nextManifest = {
-        event: {
-            body: readCanonicalRecord(plan.body, "Container rekey body"),
-            event: readCanonicalRecord(plan.event, "Container rekey event"),
-            eventHash: plan.eventHash,
-        },
-        manifest: readCanonicalRecord(plan.manifest, "Container rekey manifest"),
-        manifestHash: plan.manifestHash,
-        state: readCanonicalRecord(plan.state, "Container rekey state"),
-    };
-    const nextKek = {
-        accessManifestHash: plan.manifestHash,
-        containerId: plan.containerId,
-        containerKeyEpoch: plan.keyEpoch.keyEpoch,
-        containerKeyEpochId: plan.containerKeyEpochId,
-        containerManifestHistory: [
-            previousManifest,
-            ...previousKek.containerManifestHistory,
-        ],
-        keyEpoch: readCanonicalRecord(plan.keyEpoch, "Container rekey key epoch"),
-        keyEpochHash: await computeContainerKeyEpochHash(plan.keyEpoch),
-        keyring: { ...plan.keyring },
-        keyTargetHash: await computeContainerKekRecipientTargetHash(targets),
-        parentContainerKeyEpochId: plan.keyEpoch.parentContainerKeyEpochId,
-        recipientTargets: readCanonicalRecords(targets, "Container rekey recipient targets"),
-        wraps: readCanonicalRecords(plan.wraps, "Container rekey wraps"),
-    };
-    const ancestors = input.ancestors ?? {
-        containerKeks: input.previousProjection.containerKeks.slice(0, -1),
-        path: input.previousProjection.path.slice(0, -1),
-    };
-    const projection = {
-        ...input.previousProjection,
-        policyEvidence: mergeProjectionPolicyEvidence([
-            input.previousProjection.policyEvidence,
-            ...(input.ancestors ? [input.ancestors.policyEvidence] : []),
-        ]),
-        path: [...ancestors.path, nextManifest],
-        containerKeks: [...ancestors.containerKeks, nextKek],
-    };
-    speculativeProjections.add(projection);
-    return projection;
-}
-export function containerWriterProjectionFromRekeyPlan(input) {
-    return containerWriterProjectionFromRotationPlan({
-        plan: input.materializedPlan.plan,
-        previousProjection: input.previousProjection,
-    });
-}
-/**
- * A descendant's served projection, re-rooted on rotations the server has not
- * accepted yet: `rotated` replaces the path down to and including its own
- * container. Null when the descendant does not sit below that container.
- */
-export function rebaseContainerWriterProjection(descendant, rotated) {
-    const rotatedId = rotated.containerKeks.at(-1)?.containerId;
-    const index = descendant.containerKeks.findIndex((kek) => kek.containerId === rotatedId);
-    if (rotatedId === undefined || index < 0)
-        return null;
-    if (index === descendant.containerKeks.length - 1)
-        return null;
-    const projection = {
-        ...descendant,
-        policyEvidence: mergeProjectionPolicyEvidence([
-            descendant.policyEvidence,
-            rotated.policyEvidence,
-        ]),
-        path: [...rotated.path, ...descendant.path.slice(index + 1)],
-        containerKeks: [
-            ...rotated.containerKeks,
-            ...descendant.containerKeks.slice(index + 1),
-        ],
-    };
-    speculativeProjections.add(projection);
-    return projection;
-}
-/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */
-export async function containerWriterProjectionFromSharePlan(input) {
-    const { plan, previousProjection } = input;
-    const previous = previousProjection.path.at(-1);
-    const kek = previousProjection.containerKeks.at(-1);
-    if (!previous ||
-        !kek ||
-        previous.manifestHash !== plan.previousManifest.manifestHash ||
-        kek.containerId !== plan.containerId)
-        throw new Error("Container grant projection predecessor mismatch");
-    const targets = recipientTargets({ wraps: plan.wraps });
-    const projection = {
-        ...previousProjection,
-        path: [
-            ...previousProjection.path.slice(0, -1),
-            {
-                event: {
-                    body: readCanonicalRecord(plan.body, "Container grant body"),
-                    event: readCanonicalRecord(plan.event, "Container grant event"),
-                    eventHash: plan.eventHash,
-                },
-                manifest: readCanonicalRecord(plan.manifest, "Container grant manifest"),
-                manifestHash: plan.manifestHash,
-                state: readCanonicalRecord(plan.state, "Container grant state"),
-            },
-        ],
-        containerKeks: [
-            ...previousProjection.containerKeks.slice(0, -1),
-            {
-                ...kek,
-                accessManifestHash: plan.manifestHash,
-                containerManifestHistory: [previous, ...kek.containerManifestHistory],
-                keyTargetHash: await computeContainerKekRecipientTargetHash(targets),
-                recipientTargets: readCanonicalRecords(targets, "Container grant targets"),
-                wraps: readCanonicalRecords(plan.wraps, "Container grant wraps"),
-            },
-        ],
-    };
-    speculativeProjections.add(projection);
-    return projection;
-}
-//# sourceMappingURL=rekeyProjection.js.map

package/workflows/containers/child/rekeyProjection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rekeyProjection.js","sourceRoot":"","sources":["rekeyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0EAA0E,CAAC;AAEzH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEhF,MAAM,UAAU,sCAAsC,CACpD,UAA6C;IAE7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAqBD,SAAS,gBAAgB,CACvB,IAA0C;IAE1C,OAAO,IAAI,CAAC,KAAK;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,yBAAyB,CACvB,IAAI,EACJ,2BAA2B,CAC5B,CAAC,aAAa,CACb,yBAAyB,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAC9D,CACF,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAO/D;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IACE,CAAC,gBAAgB;QACjB,CAAC,WAAW;QACZ,gBAAgB,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QACpE,WAAW,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG;QACnB,KAAK,EAAE;YACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;YAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;YAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC;QACxE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KAChE,CAAC;IACF,MAAM,OAAO,GAAG;QACd,kBAAkB,EAAE,IAAI,CAAC,YAAY;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,wBAAwB,EAAE;YACxB,gBAAgB;YAChB,GAAG,WAAW,CAAC,wBAAwB;SACxC;QACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC;QACzE,YAAY,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/D,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;QACpE,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,yBAAyB;QAClE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,mCAAmC,CACpC;QACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;KACjE,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI;QACnC,aAAa,EAAE,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;KACjD,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,KAAK,CAAC,kBAAkB;QAC3B,cAAc,EAAE,6BAA6B,CAAC;YAC5C,KAAK,CAAC,kBAAkB,CAAC,cAAc;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;QACvC,aAAa,EAAE,CAAC,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC;KACrD,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,yCAAyC,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI;QACjC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAA6C,EAC7C,OAGC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAC9C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CACvC,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,UAAU,GAAG;QACjB,GAAG,UAAU;QACb,cAAc,EAAE,6BAA6B,CAAC;YAC5C,UAAU,CAAC,cAAc;YACzB,OAAO,CAAC,cAAc;SACvB,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5D,aAAa,EAAE;YACb,GAAG,OAAO,CAAC,aAAa;YACxB,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAC7C;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAG5D;IACC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IACE,CAAC,QAAQ;QACT,CAAC,GAAG;QACJ,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY;QAC5D,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QAEpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG;QACjB,GAAG,kBAAkB;QACrB,IAAI,EAAE;YACJ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;oBAC5D,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aAChE;SACF;QACD,aAAa,EAAE;YACb,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD;gBACE,GAAG,GAAG;gBACN,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,wBAAwB,CAAC;gBACrE,aAAa,EAAE,MAAM,sCAAsC,CAAC,OAAO,CAAC;gBACpE,gBAAgB,EAAE,oBAAoB,CACpC,OAAO,EACP,yBAAyB,CAC1B;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjE;SACF;KACF,CAAC;IACF,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import {\n  type ContainerKekRecipientTarget,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n} from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type {\n  MaterializedContainerRekeyPlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  canonicalKeyingJsonString,\n  readCanonicalRecord,\n  readCanonicalRecords,\n} from \"../../../data/keying/canonicalJson\";\nimport { mergeProjectionPolicyEvidence } from \"../../../data/keyingProjectionVerification/mergeProjectionPolicyEvidence\";\n\nconst speculativeProjections = new WeakSet<ContainerWriterProjectionResponse>();\n\nexport function isSpeculativeContainerWriterProjection(\n  projection: ContainerWriterProjectionResponse,\n): boolean {\n  return speculativeProjections.has(projection);\n}\n\n/**\n * What any rotation plan (rekey, revoke, move) holds in common: enough to say\n * what its container's path entry will be once the server accepts it.\n */\nexport interface RotationPlanArtifacts {\n  readonly body: object;\n  readonly containerId: string;\n  readonly containerKeyEpochId: string;\n  readonly event: MaterializedContainerRekeyPlan[\"plan\"][\"event\"];\n  readonly eventHash: string;\n  readonly keyEpoch: MaterializedContainerRekeyPlan[\"plan\"][\"keyEpoch\"];\n  readonly manifest: MaterializedContainerRekeyPlan[\"plan\"][\"manifest\"];\n  readonly manifestHash: string;\n  readonly previousManifest: MaterializedContainerRekeyPlan[\"plan\"][\"previousManifest\"];\n  readonly keyring: MaterializedContainerRekeyPlan[\"plan\"][\"keyring\"];\n  readonly state: MaterializedContainerRekeyPlan[\"plan\"][\"state\"];\n  readonly wraps: MaterializedContainerRekeyPlan[\"plan\"][\"wraps\"];\n}\n\nfunction recipientTargets(\n  plan: Pick<RotationPlanArtifacts, \"wraps\">,\n): ContainerKekRecipientTarget[] {\n  return plan.wraps\n    .map((wrap) => ({\n      recipientId: wrap.recipientId,\n      recipientKeyEpochId: wrap.recipientKeyEpochId,\n      recipientKeyFingerprint: wrap.recipientKeyFingerprint,\n      recipientKind: wrap.recipientKind,\n    }))\n    .sort((left, right) =>\n      canonicalKeyingJsonString(\n        left,\n        \"Container rekey recipient\",\n      ).localeCompare(\n        canonicalKeyingJsonString(right, \"Container rekey recipient\"),\n      ),\n    );\n}\n\n/**\n * The projection a rotation will leave behind, before the server has accepted\n * it. `ancestors` is the path above the container afterwards: unchanged for a\n * rekey or revoke, the destination parent's path for a move.\n */\nexport async function containerWriterProjectionFromRotationPlan(input: {\n  ancestors?: Pick<\n    ContainerWriterProjectionResponse,\n    \"containerKeks\" | \"path\" | \"policyEvidence\"\n  >;\n  plan: RotationPlanArtifacts;\n  previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n  const { plan } = input;\n  const previousManifest = input.previousProjection.path.at(-1);\n  const previousKek = input.previousProjection.containerKeks.at(-1);\n  if (\n    !previousManifest ||\n    !previousKek ||\n    previousManifest.manifestHash !== plan.previousManifest.manifestHash ||\n    previousKek.containerId !== plan.containerId\n  ) {\n    throw new Error(\"Container rekey projection predecessor mismatch\");\n  }\n  const targets = recipientTargets(plan);\n  const nextManifest = {\n    event: {\n      body: readCanonicalRecord(plan.body, \"Container rekey body\"),\n      event: readCanonicalRecord(plan.event, \"Container rekey event\"),\n      eventHash: plan.eventHash,\n    },\n    manifest: readCanonicalRecord(plan.manifest, \"Container rekey manifest\"),\n    manifestHash: plan.manifestHash,\n    state: readCanonicalRecord(plan.state, \"Container rekey state\"),\n  };\n  const nextKek = {\n    accessManifestHash: plan.manifestHash,\n    containerId: plan.containerId,\n    containerKeyEpoch: plan.keyEpoch.keyEpoch,\n    containerKeyEpochId: plan.containerKeyEpochId,\n    containerManifestHistory: [\n      previousManifest,\n      ...previousKek.containerManifestHistory,\n    ],\n    keyEpoch: readCanonicalRecord(plan.keyEpoch, \"Container rekey key epoch\"),\n    keyEpochHash: await computeContainerKeyEpochHash(plan.keyEpoch),\n    keyring: { ...plan.keyring },\n    keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n    parentContainerKeyEpochId: plan.keyEpoch.parentContainerKeyEpochId,\n    recipientTargets: readCanonicalRecords(\n      targets,\n      \"Container rekey recipient targets\",\n    ),\n    wraps: readCanonicalRecords(plan.wraps, \"Container rekey wraps\"),\n  };\n  const ancestors = input.ancestors ?? {\n    containerKeks: input.previousProjection.containerKeks.slice(0, -1),\n    path: input.previousProjection.path.slice(0, -1),\n  };\n  const projection = {\n    ...input.previousProjection,\n    policyEvidence: mergeProjectionPolicyEvidence([\n      input.previousProjection.policyEvidence,\n      ...(input.ancestors ? [input.ancestors.policyEvidence] : []),\n    ]),\n    path: [...ancestors.path, nextManifest],\n    containerKeks: [...ancestors.containerKeks, nextKek],\n  };\n  speculativeProjections.add(projection);\n  return projection;\n}\n\nexport function containerWriterProjectionFromRekeyPlan(input: {\n  materializedPlan: Pick<\n    MaterializedContainerRekeyPlan,\n    \"containerKey\" | \"plan\"\n  >;\n  previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n  return containerWriterProjectionFromRotationPlan({\n    plan: input.materializedPlan.plan,\n    previousProjection: input.previousProjection,\n  });\n}\n\n/**\n * A descendant's served projection, re-rooted on rotations the server has not\n * accepted yet: `rotated` replaces the path down to and including its own\n * container. Null when the descendant does not sit below that container.\n */\nexport function rebaseContainerWriterProjection(\n  descendant: ContainerWriterProjectionResponse,\n  rotated: Pick<\n    ContainerWriterProjectionResponse,\n    \"containerKeks\" | \"path\" | \"policyEvidence\"\n  >,\n): ContainerWriterProjectionResponse | null {\n  const rotatedId = rotated.containerKeks.at(-1)?.containerId;\n  const index = descendant.containerKeks.findIndex(\n    (kek) => kek.containerId === rotatedId,\n  );\n  if (rotatedId === undefined || index < 0) return null;\n  if (index === descendant.containerKeks.length - 1) return null;\n  const projection = {\n    ...descendant,\n    policyEvidence: mergeProjectionPolicyEvidence([\n      descendant.policyEvidence,\n      rotated.policyEvidence,\n    ]),\n    path: [...rotated.path, ...descendant.path.slice(index + 1)],\n    containerKeks: [\n      ...rotated.containerKeks,\n      ...descendant.containerKeks.slice(index + 1),\n    ],\n  };\n  speculativeProjections.add(projection);\n  return projection;\n}\n\n/** A grant keeps its key epoch while advancing the manifest and recipient wraps. */\nexport async function containerWriterProjectionFromSharePlan(input: {\n  plan: MaterializedContainerSharePlan[\"plan\"];\n  previousProjection: ContainerWriterProjectionResponse;\n}): Promise<ContainerWriterProjectionResponse> {\n  const { plan, previousProjection } = input;\n  const previous = previousProjection.path.at(-1);\n  const kek = previousProjection.containerKeks.at(-1);\n  if (\n    !previous ||\n    !kek ||\n    previous.manifestHash !== plan.previousManifest.manifestHash ||\n    kek.containerId !== plan.containerId\n  )\n    throw new Error(\"Container grant projection predecessor mismatch\");\n  const targets = recipientTargets({ wraps: plan.wraps });\n  const projection = {\n    ...previousProjection,\n    path: [\n      ...previousProjection.path.slice(0, -1),\n      {\n        event: {\n          body: readCanonicalRecord(plan.body, \"Container grant body\"),\n          event: readCanonicalRecord(plan.event, \"Container grant event\"),\n          eventHash: plan.eventHash,\n        },\n        manifest: readCanonicalRecord(\n          plan.manifest,\n          \"Container grant manifest\",\n        ),\n        manifestHash: plan.manifestHash,\n        state: readCanonicalRecord(plan.state, \"Container grant state\"),\n      },\n    ],\n    containerKeks: [\n      ...previousProjection.containerKeks.slice(0, -1),\n      {\n        ...kek,\n        accessManifestHash: plan.manifestHash,\n        containerManifestHistory: [previous, ...kek.containerManifestHistory],\n        keyTargetHash: await computeContainerKekRecipientTargetHash(targets),\n        recipientTargets: readCanonicalRecords(\n          targets,\n          \"Container grant targets\",\n        ),\n        wraps: readCanonicalRecords(plan.wraps, \"Container grant wraps\"),\n      },\n    ],\n  };\n  speculativeProjections.add(projection);\n  return projection;\n}\n"]}

package/workflows/containers/child/rekeyRemote.d.ts

@@ -1,24 +0,0 @@
-import type { ContainerKekKeyringEntry } from "../../../internal/crypto/index.js";
-import type { ContainerRotationResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerMutationAuthor, ContainerRekeyApi, ContainerRekeyPlan } from "../../../data/containers/shared/types.js";
-import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-export declare function rekeyRemoteContainer(input: {
-    reportSecurityIncident: SecurityIncidentReporter;
-    apiClient: ContainerRekeyApi;
-    author: ContainerMutationAuthor;
-    containerId: string;
-    eventId?: string | undefined;
-    execSql: ExecSql;
-    keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;
-    resolveProjectionUserKey: ProjectionUserKeyResolver;
-    signedAt?: string | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    targetSecretKey: Uint8Array;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<{
-    containerKey: Uint8Array;
-    plan: ContainerRekeyPlan;
-    response: ContainerRotationResponse;
-} | null>;

package/workflows/containers/child/rekeyRemote.js

@@ -1,64 +0,0 @@
-import { submitAcknowledgedContainerMutation, submitContainerRotation, } from "./mutationSubmit.js";
-import { buildMaterializedContainerRekeyPlan } from "./rekey.js";
-export async function rekeyRemoteContainer(input) {
-    const previousProjection = await input.apiClient.getContainerWriterProjection(input.containerId);
-    if (!previousProjection) {
-        return null;
-    }
-    const materializedPlan = await buildMaterializedContainerRekeyPlan({
-        author: input.author,
-        eventId: input.eventId,
-        execSql: input.execSql,
-        keyringEntriesOverride: input.keyringEntriesOverride,
-        previousProjection,
-        resolveProjectionUserKey: input.resolveProjectionUserKey,
-        signedAt: input.signedAt,
-        stillCurrent: input.stillCurrent,
-        targetSecretKey: input.targetSecretKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    return submitAcknowledgedContainerMutation({
-        reportSecurityIncident: input.reportSecurityIncident,
-        recitationPolicies: [],
-        apiClient: input.apiClient,
-        author: input.author,
-        carriedRekeys: {
-            planning: {
-                apiClient: input.apiClient,
-                author: input.author,
-                execSql: input.execSql,
-                knownContainerKeks: new Map([
-                    [
-                        materializedPlan.plan.containerKeyEpochId,
-                        materializedPlan.containerKey,
-                    ],
-                ]),
-                resolveProjectionUserKey: input.resolveProjectionUserKey,
-                stillCurrent: input.stillCurrent,
-                targetSecretKey: input.targetSecretKey,
-                warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-            },
-            rotated: async () => materializedPlan.writerProjection,
-        },
-        containerKey: materializedPlan.containerKey,
-        execSql: input.execSql,
-        plan: materializedPlan.plan,
-        stillCurrent: input.stillCurrent,
-        submit: (carried) => {
-            const request = carried.length
-                ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }
-                : materializedPlan.plan.request;
-            const options = {
-                expectedPaymentRequiredOrganizationId: input.author.organizationId,
-            };
-            const { rekeyContainerResult } = input.apiClient;
-            return submitContainerRotation({
-                plain: () => input.apiClient.rekeyContainer(input.containerId, request, options),
-                result: rekeyContainerResult
-                    ? () => rekeyContainerResult.call(input.apiClient, input.containerId, request, { ...options, reportErrors: false })
-                    : undefined,
-            });
-        },
-    });
-}
-//# sourceMappingURL=rekeyRemote.js.map

package/workflows/containers/child/rekeyRemote.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rekeyRemote.js","sourceRoot":"","sources":["rekeyRemote.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAa1C;IAKC,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAC3E,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,mCAAmC,CAAC;QACjE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB;QAClB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE;YACb,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,kBAAkB,EAAE,IAAI,GAAG,CAAC;oBAC1B;wBACE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB;wBACzC,gBAAgB,CAAC,YAAY;qBAC9B;iBACF,CAAC;gBACF,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;aACvE;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,gBAAgB;SACvD;QACD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE;gBACrE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,OAAO,GAAG;gBACd,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aACnE,CAAC;YACF,MAAM,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YACjD,OAAO,uBAAuB,CAAC;gBAC7B,KAAK,EAAE,GAAG,EAAE,CACV,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;gBACrE,MAAM,EAAE,oBAAoB;oBAC1B,CAAC,CAAC,GAAG,EAAE,CACH,oBAAoB,CAAC,IAAI,CACvB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC;oBACL,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerKekKeyringEntry } from \"@tearleads/crypto\";\nimport type { ContainerRotationResponse } from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerRekeyApi,\n  ContainerRekeyPlan,\n} from \"../../../data/containers/shared/types\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitContainerRotation,\n} from \"./mutationSubmit\";\nimport { buildMaterializedContainerRekeyPlan } from \"./rekey\";\n\nexport async function rekeyRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  apiClient: ContainerRekeyApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  keyringEntriesOverride?: readonly ContainerKekKeyringEntry[] | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerRekeyPlan;\n  response: ContainerRotationResponse;\n} | null> {\n  const previousProjection = await input.apiClient.getContainerWriterProjection(\n    input.containerId,\n  );\n  if (!previousProjection) {\n    return null;\n  }\n\n  const materializedPlan = await buildMaterializedContainerRekeyPlan({\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    keyringEntriesOverride: input.keyringEntriesOverride,\n    previousProjection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    carriedRekeys: {\n      planning: {\n        apiClient: input.apiClient,\n        author: input.author,\n        execSql: input.execSql,\n        knownContainerKeks: new Map([\n          [\n            materializedPlan.plan.containerKeyEpochId,\n            materializedPlan.containerKey,\n          ],\n        ]),\n        resolveProjectionUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        targetSecretKey: input.targetSecretKey,\n        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n      },\n      rotated: async () => materializedPlan.writerProjection,\n    },\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: (carried) => {\n      const request = carried.length\n        ? { ...materializedPlan.plan.request, containerRekeys: [...carried] }\n        : materializedPlan.plan.request;\n      const options = {\n        expectedPaymentRequiredOrganizationId: input.author.organizationId,\n      };\n      const { rekeyContainerResult } = input.apiClient;\n      return submitContainerRotation({\n        plain: () =>\n          input.apiClient.rekeyContainer(input.containerId, request, options),\n        result: rekeyContainerResult\n          ? () =>\n              rekeyContainerResult.call(\n                input.apiClient,\n                input.containerId,\n                request,\n                { ...options, reportErrors: false },\n              )\n          : undefined,\n      });\n    },\n  });\n}\n"]}

package/workflows/containers/child/replacementPrincipalPolicyReferences.js

@@ -1,19 +0,0 @@
-import { readContainerState } from "../../../data/containers/shared/projection.js";
-import { dedupeReferencedPrincipalStates, referencedPrincipalPolicyKey, } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
-/** Current membership with only the historical group citations this path uses. */
-export async function selectReplacementPrincipalPolicyReferences(input) {
-    if (!("retainedHistory" in input.policy) ||
-        !input.resolveAuthoredPolicyReferences)
-        return input.policy;
-    const references = dedupeReferencedPrincipalStates(input.projection.path
-        .flatMap((manifest) => readContainerState(manifest).referencedPrincipalHeads)
-        .filter((reference) => reference.principalType === input.policy.principalType &&
-        reference.principalId === input.policy.principalId));
-    const selected = await input.resolveAuthoredPolicyReferences(input.policy, references);
-    // Planning is sequential: each path selects its own citations before use.
-    // Only speculative successor citations use this cache entry. Served historical
-    // references still resolve to acknowledged policies and cannot pin our new head.
-    input.principalPolicyCache?.set(referencedPrincipalPolicyKey(selected.state), selected);
-    return selected;
-}
-//# sourceMappingURL=replacementPrincipalPolicyReferences.js.map

package/workflows/containers/child/replacementPrincipalPolicyReferences.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"replacementPrincipalPolicyReferences.js","sourceRoot":"","sources":["replacementPrincipalPolicyReferences.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,iEAAiE,CAAC;AAIzE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAOhE;IACC,IACE,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM,CAAC;QACpC,CAAC,KAAK,CAAC,+BAA+B;QAEtC,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,+BAA+B,CAChD,KAAK,CAAC,UAAU,CAAC,IAAI;SAClB,OAAO,CACN,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,wBAAwB,CACpE;SACA,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,MAAM,CAAC,aAAa;QACtD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CACrD,CACJ,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+BAA+B,CAC1D,KAAK,CAAC,MAAM,EACZ,UAAU,CACX,CAAC;IACF,0EAA0E;IAC1E,+EAA+E;IAC/E,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAC7B,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5C,QAAQ,CACT,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { readContainerState } from \"../../../data/containers/shared/projection\";\nimport type { PrincipalPolicyCache } from \"../../../data/keyingProjectionVerification\";\nimport {\n  dedupeReferencedPrincipalStates,\n  referencedPrincipalPolicyKey,\n} from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport type { CurrentPolicyReferenceResolver } from \"../../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\n/** Current membership with only the historical group citations this path uses. */\nexport async function selectReplacementPrincipalPolicyReferences(input: {\n  readonly policy: PrincipalPolicyCurrentEvidence;\n  readonly projection: ContainerWriterProjectionResponse;\n  readonly principalPolicyCache?: PrincipalPolicyCache | undefined;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence> {\n  if (\n    !(\"retainedHistory\" in input.policy) ||\n    !input.resolveAuthoredPolicyReferences\n  )\n    return input.policy;\n  const references = dedupeReferencedPrincipalStates(\n    input.projection.path\n      .flatMap(\n        (manifest) => readContainerState(manifest).referencedPrincipalHeads,\n      )\n      .filter(\n        (reference) =>\n          reference.principalType === input.policy.principalType &&\n          reference.principalId === input.policy.principalId,\n      ),\n  );\n  const selected = await input.resolveAuthoredPolicyReferences(\n    input.policy,\n    references,\n  );\n  // Planning is sequential: each path selects its own citations before use.\n  // Only speculative successor citations use this cache entry. Served historical\n  // references still resolve to acknowledged policies and cannot pin our new head.\n  input.principalPolicyCache?.set(\n    referencedPrincipalPolicyKey(selected.state),\n    selected,\n  );\n  return selected;\n}\n"]}

package/workflows/containers/child/rotationContext.js

@@ -1,64 +0,0 @@
-import { getParentKekForTarget, getParentWrappingPublicKey, getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
-import { assertContainerKekPathCurrent } from "../../../data/documents/shared/containerKekCurrency.js";
-import { signedHistoryEpochIds } from "../../../data/documents/shared/containerKekPathHistory.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
-/**
- * The projection's target with its signed lineage ids, read from the manifests
- * this rotation's own verification recorded. Every rotation that re-seals a
- * keyring builds its target here, so none can skip the anchor.
- */
-export function signedRotationTarget(projection, verifiedByHash) {
-    const target = getTargetContainerContext(projection);
-    return {
-        ...target,
-        signedEpochIds: signedHistoryEpochIds({
-            headManifestHash: target.manifest.manifestHash,
-            kek: target.kek,
-            verifiedByHash,
-        }),
-    };
-}
-export function requireUnwrappedKek(keksByEpochId, kek, label) {
-    const keyMaterial = keksByEpochId.get(kek.containerKeyEpochId);
-    if (!keyMaterial) {
-        throw new Error(`${label} KEK could not be unwrapped`);
-    }
-    return keyMaterial;
-}
-/**
- * The shared rotation prologue for rekey and revoke: unwrap the projection's
- * KEK path, require the predecessor key, check the author's organization, and
- * surface the authenticated parent public key when one exists.
- */
-export async function resolveRotationContext(input, operationLabel) {
-    // The target may need repair, but wrapping its successor requires a current parent prefix.
-    assertContainerKekPathCurrent(input.previousProjection.containerKeks.slice(0, -1));
-    const verifiedByHash = new Map();
-    const keksByEpochId = await unwrapContainerKekPath({
-        execSql: input.execSql,
-        knownContainerKeks: input.knownContainerKeks,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        principalPolicyCache: input.principalPolicyCache,
-        projection: input.previousProjection,
-        secretKey: input.targetSecretKey,
-        verifiedByHash,
-        ...projectionVerificationOptions(input),
-    });
-    const target = signedRotationTarget(input.previousProjection, verifiedByHash);
-    const predecessorContainerKey = requireUnwrappedKek(keksByEpochId, target.kek, `Container ${operationLabel} predecessor`);
-    const previousState = readContainerState(target.manifest);
-    if (previousState.organizationId !== input.author.organizationId) {
-        throw new Error(`Container ${operationLabel} author organization mismatch`);
-    }
-    const parentKek = getParentKekForTarget(input.previousProjection);
-    const parentPublicKey = getParentWrappingPublicKey(input.previousProjection);
-    return {
-        parentKek,
-        parentPublicKey,
-        predecessorContainerKey,
-        previousState,
-        target,
-    };
-}
-//# sourceMappingURL=rotationContext.js.map

package/workflows/containers/child/rotationContext.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rotationContext.js","sourceRoot":"","sources":["rotationContext.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAiBrF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA6C,EAC7C,cAAoE;IAEpE,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,qBAAqB,CAAC;YACpC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,cAAc;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,aAA8C,EAC9C,GAAsD,EACtD,KAAa;IAEb,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAkBC,EACD,cAAsB;IAQtB,2FAA2F;IAC3F,6BAA6B,CAC3B,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,uBAAuB,GAAG,mBAAmB,CACjD,aAAa,EACb,MAAM,CAAC,GAAG,EACV,aAAa,cAAc,cAAc,CAC1C,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,aAAa,cAAc,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7E,OAAO;QACL,SAAS;QACT,eAAe;QACf,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  getParentKekForTarget,\n  getParentWrappingPublicKey,\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { signedHistoryEpochIds } from \"../../../data/documents/shared/containerKekPathHistory\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/**\n * A rotation's target container, with the epoch ids its verified lineage\n * names wherever the projection served it; the re-sealed keyring is anchored\n * to them (#2365 finding 32).\n */\nexport type SignedRotationTarget = ReturnType<\n  typeof getTargetContainerContext\n> & { readonly signedEpochIds: ReadonlySet<string> };\n\n/**\n * The projection's target with its signed lineage ids, read from the manifests\n * this rotation's own verification recorded. Every rotation that re-seals a\n * keyring builds its target here, so none can skip the anchor.\n */\nexport function signedRotationTarget(\n  projection: ContainerWriterProjectionResponse,\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): SignedRotationTarget {\n  const target = getTargetContainerContext(projection);\n  return {\n    ...target,\n    signedEpochIds: signedHistoryEpochIds({\n      headManifestHash: target.manifest.manifestHash,\n      kek: target.kek,\n      verifiedByHash,\n    }),\n  };\n}\n\nexport function requireUnwrappedKek(\n  keksByEpochId: ReadonlyMap<string, Uint8Array>,\n  kek: Pick<ContainerKekResponse, \"containerKeyEpochId\">,\n  label: string,\n): Uint8Array {\n  const keyMaterial = keksByEpochId.get(kek.containerKeyEpochId);\n  if (!keyMaterial) {\n    throw new Error(`${label} KEK could not be unwrapped`);\n  }\n  return keyMaterial;\n}\n\n/**\n * The shared rotation prologue for rekey and revoke: unwrap the projection's\n * KEK path, require the predecessor key, check the author's organization, and\n * surface the authenticated parent public key when one exists.\n */\nexport async function resolveRotationContext(\n  input: {\n    author: ContainerMutationAuthor;\n    execSql: ExecSql;\n    /**\n     * Keys of epochs the projection names that no wrap on it opens for this\n     * signer yet: the ones a batch minted above and has not committed.\n     */\n    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    previousProjection: ContainerWriterProjectionResponse;\n    /** Verified policies the path may cite before they are stored locally. */\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    resolveProjectionUserKey: ProjectionUserKeyResolver;\n    stillCurrent?: (() => boolean) | undefined;\n    targetSecretKey: Uint8Array;\n    warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  },\n  operationLabel: string,\n): Promise<{\n  parentKek: ReturnType<typeof getParentKekForTarget>;\n  parentPublicKey: string | null;\n  predecessorContainerKey: Uint8Array;\n  previousState: ReturnType<typeof readContainerState>;\n  target: SignedRotationTarget;\n}> {\n  // The target may need repair, but wrapping its successor requires a current parent prefix.\n  assertContainerKekPathCurrent(\n    input.previousProjection.containerKeks.slice(0, -1),\n  );\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    ...projectionVerificationOptions(input),\n  });\n  const target = signedRotationTarget(input.previousProjection, verifiedByHash);\n  const predecessorContainerKey = requireUnwrappedKek(\n    keksByEpochId,\n    target.kek,\n    `Container ${operationLabel} predecessor`,\n  );\n  const previousState = readContainerState(target.manifest);\n  if (previousState.organizationId !== input.author.organizationId) {\n    throw new Error(`Container ${operationLabel} author organization mismatch`);\n  }\n\n  const parentKek = getParentKekForTarget(input.previousProjection);\n  const parentPublicKey = getParentWrappingPublicKey(input.previousProjection);\n  return {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  };\n}\n"]}

package/workflows/containers/child/rotationPrincipalPolicies.js

@@ -1,19 +0,0 @@
-import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
-import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
-/**
- * Shared by rekey and revoke. Lives apart from both: background descendant
- * repair imports the rekey planner, and revoke schedules that repair, so
- * declaring this in revoke would close a dependency cycle.
- */
-export async function collectContainerRevokePrincipalPolicies(input) {
-    return uniquePrincipalPolicies(await collectContainerWriterProjectionPrincipalPolicies({
-        execSql: input.execSql,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        principalPolicyCache: input.principalPolicyCache,
-        projection: input.previousProjection,
-        resolveUserKey: input.resolveUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    }));
-}
-//# sourceMappingURL=rotationPrincipalPolicies.js.map

package/workflows/containers/child/rotationPrincipalPolicies.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rotationPrincipalPolicies.js","sourceRoot":"","sources":["rotationPrincipalPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAIpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAQ7D;IACC,OAAO,uBAAuB,CAC5B,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/**\n * Shared by rekey and revoke. Lives apart from both: background descendant\n * repair imports the rekey planner, and revoke schedules that repair, so\n * declaring this in revoke would close a dependency cycle.\n */\nexport async function collectContainerRevokePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  return uniquePrincipalPolicies(\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  );\n}\n"]}

package/workflows/containers/child/rotationWraps.js

@@ -1,85 +0,0 @@
-import { wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, wrapContainerKeyToRootUser, } from "../../../data/containers/shared/projection.js";
-function findPrincipalPolicy(input) {
-    const policy = input.principalPolicies.find((candidate) => candidate.principalType === input.reference.principalType &&
-        candidate.principalId === input.reference.principalId &&
-        candidate.version === input.reference.version &&
-        candidate.keyEpoch === input.reference.keyEpoch &&
-        candidate.stateHash === input.reference.stateHash);
-    if (!policy) {
-        // Invariant, not a recoverable state: the API commits a container head
-        // only when every referenced group head equals the group's current state
-        // (packages/api groupReferenceHeads.ts), and a group change that would
-        // leave a grant stale is refused unless it rematerializes that container
-        // in the same transaction (principalContainerRematerialization.ts). A
-        // verified projection therefore always carries the policy its manifest
-        // references; a miss means the caller resolved policies for a different
-        // head than the manifest it is rotating.
-        throw new Error(`${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`);
-    }
-    return policy;
-}
-function referenceForManagedGrant(input) {
-    const reference = input.state.referencedPrincipalHeads.find((candidate) => candidate.principalType === input.grant.subjectType &&
-        candidate.principalId === input.grant.subjectId);
-    if (reference?.principalType !== "group") {
-        throw new Error(`${input.operationLabel} referenced principal head is missing`);
-    }
-    return { ...reference, principalType: "group" };
-}
-export async function buildContainerRotationWraps(input) {
-    const userRecipientKeys = [];
-    const wraps = [];
-    if (input.parentKek) {
-        if (!input.parentPublicKey) {
-            throw new Error(`${input.operationLabel} parent wrapping public key is missing`);
-        }
-        wraps.push(await wrapContainerKeyToParent({
-            containerKey: input.containerKey,
-            containerKeyEpochId: input.containerKeyEpochId,
-            manifestHash: input.manifestHash,
-            parentKek: input.parentKek,
-            parentPublicKey: input.parentPublicKey,
-        }));
-    }
-    for (const grant of input.state.directGrants) {
-        if (grant.subjectType === "user") {
-            const userKey = await input.resolveUserKey(grant.subjectId);
-            if (!userKey) {
-                throw new Error(`${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`);
-            }
-            const recipient = await wrapContainerKeyToRootUser({
-                containerKey: input.containerKey,
-                containerKeyEpochId: input.containerKeyEpochId,
-                manifestHash: input.manifestHash,
-                recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,
-                userId: grant.subjectId,
-            });
-            userRecipientKeys.push(recipient.userRecipientKey);
-            wraps.push(recipient.wrap);
-            continue;
-        }
-        const reference = referenceForManagedGrant({
-            grant,
-            operationLabel: input.operationLabel,
-            state: input.state,
-        });
-        const policy = findPrincipalPolicy({
-            operationLabel: input.operationLabel,
-            principalPolicies: input.principalPolicies,
-            reference,
-        });
-        const recipient = await wrapContainerKeyToManagedPrincipal({
-            containerKey: input.containerKey,
-            containerKeyEpochId: input.containerKeyEpochId,
-            manifestHash: input.manifestHash,
-            principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,
-            principalHead: reference,
-        });
-        wraps.push(recipient.wrap);
-    }
-    return {
-        userRecipientKeys: userRecipientKeys.sort((left, right) => left.userId.localeCompare(right.userId)),
-        wraps: wraps.sort((left, right) => `${left.recipientKind}:${left.recipientId}`.localeCompare(`${right.recipientKind}:${right.recipientId}`)),
-    };
-}
-//# sourceMappingURL=rotationWraps.js.map

package/workflows/containers/child/rotationWraps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rotationWraps.js","sourceRoot":"","sources":["rotationWraps.ts"],"names":[],"mappings":"AASA,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAIpD,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CACzC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa;QACzD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW;QACrD,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO;QAC7C,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC,QAAQ;QAC/C,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CACpD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,eAAe,KAAK,CAAC,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,SAAS,CAAC,OAAO,eAAe,KAAK,CAAC,SAAS,CAAC,QAAQ,sHAAsH,CACtS,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAIjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACzD,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QACnD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAClD,CAAC;IACF,IAAI,SAAS,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,uCAAuC,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAUjD;IAIC,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,wCAAwC,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,MAAM,wBAAwB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,mDAAmD,KAAK,CAAC,SAAS,EAAE,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;gBACjD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,OAAO,CAAC,sBAAsB;gBAC/D,MAAM,EAAE,KAAK,CAAC,SAAS;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;YACpE,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC;QACD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,CACvD,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAC9C,CACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantPrincipalHead,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nfunction findPrincipalPolicy(input: {\n  operationLabel: string;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  reference: ReferencedPrincipalHead;\n}): PrincipalPolicyCurrentEvidence {\n  const policy = input.principalPolicies.find(\n    (candidate) =>\n      candidate.principalType === input.reference.principalType &&\n      candidate.principalId === input.reference.principalId &&\n      candidate.version === input.reference.version &&\n      candidate.keyEpoch === input.reference.keyEpoch &&\n      candidate.stateHash === input.reference.stateHash,\n  );\n  if (!policy) {\n    // Invariant, not a recoverable state: the API commits a container head\n    // only when every referenced group head equals the group's current state\n    // (packages/api groupReferenceHeads.ts), and a group change that would\n    // leave a grant stale is refused unless it rematerializes that container\n    // in the same transaction (principalContainerRematerialization.ts). A\n    // verified projection therefore always carries the policy its manifest\n    // references; a miss means the caller resolved policies for a different\n    // head than the manifest it is rotating.\n    throw new Error(\n      `${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`,\n    );\n  }\n  return policy;\n}\n\nfunction referenceForManagedGrant(input: {\n  grant: ContainerDirectGrant;\n  operationLabel: string;\n  state: ContainerAccessManifestState;\n}): ContainerGrantPrincipalHead {\n  const reference = input.state.referencedPrincipalHeads.find(\n    (candidate) =>\n      candidate.principalType === input.grant.subjectType &&\n      candidate.principalId === input.grant.subjectId,\n  );\n  if (reference?.principalType !== \"group\") {\n    throw new Error(\n      `${input.operationLabel} referenced principal head is missing`,\n    );\n  }\n  return { ...reference, principalType: \"group\" };\n}\n\nexport async function buildContainerRotationWraps(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  operationLabel: string;\n  parentKek: ContainerKekResponse | null;\n  parentPublicKey: string | null;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  state: ContainerAccessManifestState;\n}): Promise<{\n  readonly userRecipientKeys: ContainerUserRecipientKey[];\n  readonly wraps: ContainerKeyWrap[];\n}> {\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n  const wraps: ContainerKeyWrap[] = [];\n  if (input.parentKek) {\n    if (!input.parentPublicKey) {\n      throw new Error(\n        `${input.operationLabel} parent wrapping public key is missing`,\n      );\n    }\n    wraps.push(\n      await wrapContainerKeyToParent({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        parentKek: input.parentKek,\n        parentPublicKey: input.parentPublicKey,\n      }),\n    );\n  }\n\n  for (const grant of input.state.directGrants) {\n    if (grant.subjectType === \"user\") {\n      const userKey = await input.resolveUserKey(grant.subjectId);\n      if (!userKey) {\n        throw new Error(\n          `${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`,\n        );\n      }\n      const recipient = await wrapContainerKeyToRootUser({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,\n        userId: grant.subjectId,\n      });\n      userRecipientKeys.push(recipient.userRecipientKey);\n      wraps.push(recipient.wrap);\n      continue;\n    }\n\n    const reference = referenceForManagedGrant({\n      grant,\n      operationLabel: input.operationLabel,\n      state: input.state,\n    });\n    const policy = findPrincipalPolicy({\n      operationLabel: input.operationLabel,\n      principalPolicies: input.principalPolicies,\n      reference,\n    });\n    const recipient = await wrapContainerKeyToManagedPrincipal({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,\n      principalHead: reference,\n    });\n    wraps.push(recipient.wrap);\n  }\n\n  return {\n    userRecipientKeys: userRecipientKeys.sort((left, right) =>\n      left.userId.localeCompare(right.userId),\n    ),\n    wraps: wraps.sort((left, right) =>\n      `${left.recipientKind}:${left.recipientId}`.localeCompare(\n        `${right.recipientKind}:${right.recipientId}`,\n      ),\n    ),\n  };\n}\n"]}