@tearleads/client-sdk 0.1.63 → 0.1.65

package/workflows/containers/child/shareMaterialization.js

@@ -1,164 +0,0 @@
-import { assertContainerAuthorAccess } from "../../../data/containers/shared/authorAccess.js";
-import { signContainerMutationEvent } from "../../../data/containers/shared/events.js";
-import { asContainerManifestBundle, getTargetContainerContext, readContainerState, uniqueSortedManifestHashes, wrapContainerKeyToManagedPrincipal, wrapContainerKeyToRootUser, } from "../../../data/containers/shared/projection.js";
-import { readContainerKeyWraps } from "../../../data/containers/shared/readers.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { projectionVerificationOptions } from "../../../data/documents/shared/types.js";
-import { requireUnwrappedKek } from "./rotationContext.js";
-import { buildContainerSharePlanResult, collectContainerSharePrincipalPolicies, collectShareUserRecipientKeys, deriveContainerShareManifest, referencedPrincipalHeadFromPolicy, replaceContainerWrap, shareManifestHistory, } from "./sharePlanCore.js";
-async function materializeRecipientWrap(input) {
-    if (input.recipient.subjectType === "user") {
-        const shareRecipient = await wrapContainerKeyToRootUser({
-            containerKey: input.containerKey,
-            containerKeyEpochId: input.containerKeyEpochId,
-            manifestHash: input.manifestHash,
-            recipientEncapsulationPublicKey: input.recipient.recipientEncapsulationPublicKey,
-            userId: input.recipient.subjectId,
-        });
-        return {
-            recipientTarget: shareRecipient.recipientTarget,
-            userRecipientKeys: collectShareUserRecipientKeys({
-                newUserRecipientKey: shareRecipient.userRecipientKey,
-                state: input.state,
-                targetKek: input.targetKek,
-            }),
-            wrap: shareRecipient.wrap,
-        };
-    }
-    const shareRecipient = await wrapContainerKeyToManagedPrincipal({
-        containerKey: input.containerKey,
-        containerKeyEpochId: input.containerKeyEpochId,
-        manifestHash: input.manifestHash,
-        principalEncapsulationPublicKey: input.recipient.principalPolicy.state.encapsulationPublicKey,
-        principalHead: referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy),
-    });
-    return {
-        recipientTarget: shareRecipient.recipientTarget,
-        userRecipientKeys: collectShareUserRecipientKeys({
-            state: input.state,
-            targetKek: input.targetKek,
-        }),
-        wrap: shareRecipient.wrap,
-    };
-}
-async function buildShareTransition(input) {
-    const previousState = readContainerState(input.targetManifest);
-    if (previousState.organizationId !== input.author.organizationId) {
-        throw new Error("Container share author organization mismatch");
-    }
-    const grant = {
-        accessLevel: input.accessLevel,
-        subjectId: input.recipient.subjectId,
-        subjectType: input.recipient.subjectType,
-    };
-    const referencedPrincipalHead = input.recipient.subjectType === "user"
-        ? null
-        : referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy);
-    const body = {
-        eventType: "container.grant",
-        containerKeyEpochId: previousState.containerKeyEpochId,
-        containerKeyPublicKey: previousState.containerKeyPublicKey,
-        grant,
-        referencedPrincipalHead,
-    };
-    const { event, eventHash } = await signContainerMutationEvent({
-        author: input.author,
-        body,
-        containerId: previousState.containerId,
-        dependencyManifestHashes: uniqueSortedManifestHashes(input.previousProjection.path),
-        eventId: input.eventId ?? crypto.randomUUID(),
-        previousManifestHash: input.targetManifest.manifestHash,
-        signedAt: input.signedAt ?? new Date().toISOString(),
-    });
-    const manifestTransition = await deriveContainerShareManifest({
-        eventHash,
-        grant,
-        previousManifest: input.targetManifest,
-        referencedPrincipalHead,
-    });
-    return {
-        body,
-        event,
-        eventHash,
-        grant,
-        previousState,
-        ...manifestTransition,
-    };
-}
-async function collectAuthorizedSharePolicies(input) {
-    const principalPolicies = await collectContainerSharePrincipalPolicies({
-        execSql: input.execSql,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        principalPolicyCache: input.principalPolicyCache,
-        previousProjection: input.previousProjection,
-        ...(input.recipient.subjectType === "user"
-            ? {}
-            : { recipientPolicy: input.recipient.principalPolicy }),
-        resolveUserKey: input.resolveProjectionUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    assertContainerAuthorAccess({
-        author: input.author,
-        projection: input.previousProjection,
-        principalPolicies,
-        minimumAccess: "admin",
-    });
-    return principalPolicies;
-}
-export async function buildMaterializedContainerSharePlan(input) {
-    const keksByEpochId = await unwrapContainerKekPath({
-        execSql: input.execSql,
-        knownContainerKeks: input.knownContainerKeks,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        principalPolicyCache: input.principalPolicyCache,
-        projection: input.previousProjection,
-        secretKey: input.targetSecretKey,
-        ...projectionVerificationOptions(input),
-    });
-    const principalPolicies = await collectAuthorizedSharePolicies(input);
-    const target = getTargetContainerContext(input.previousProjection);
-    const { body, event, eventHash, grant, manifest, manifestHash, previousState, state, } = await buildShareTransition({
-        accessLevel: input.accessLevel,
-        author: input.author,
-        eventId: input.eventId,
-        previousProjection: input.previousProjection,
-        recipient: input.recipient,
-        signedAt: input.signedAt,
-        targetManifest: target.manifest,
-    });
-    const containerKey = requireUnwrappedKek(keksByEpochId, target.kek, "Container share target");
-    const { recipientTarget, userRecipientKeys, wrap } = await materializeRecipientWrap({
-        containerKey,
-        containerKeyEpochId: target.kek.containerKeyEpochId,
-        manifestHash,
-        recipient: input.recipient,
-        state,
-        targetKek: target.kek,
-    });
-    const previousWraps = readContainerKeyWraps(target.kek.wraps, "Container share previous wraps");
-    return buildContainerSharePlanResult({
-        body,
-        containerManifestHistory: shareManifestHistory({
-            containerId: previousState.containerId,
-            targetKek: target.kek,
-            targetManifest: target.manifest,
-        }),
-        containerKey,
-        containerId: previousState.containerId,
-        event,
-        eventHash,
-        grant,
-        manifest,
-        manifestHash,
-        previousManifest: asContainerManifestBundle(target.manifest),
-        previousProjection: input.previousProjection,
-        principalPolicies,
-        recipientTarget,
-        state,
-        targetKek: target.kek,
-        userRecipientKeys,
-        wraps: replaceContainerWrap(previousWraps, wrap),
-    });
-}
-//# sourceMappingURL=shareMaterialization.js.map

package/workflows/containers/child/shareMaterialization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shareMaterialization.js","sourceRoot":"","sources":["shareMaterialization.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAKhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAOrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,6BAA6B,EAE7B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,KAAK,UAAU,wBAAwB,CAAC,KAOvC;IAKC,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC;YACtD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B;YACjD,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,cAAc,CAAC,eAAe;YAC/C,iBAAiB,EAAE,6BAA6B,CAAC;gBAC/C,mBAAmB,EAAE,cAAc,CAAC,gBAAgB;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YACF,IAAI,EAAE,cAAc,CAAC,IAAI;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,sBAAsB;QAC9D,aAAa,EAAE,iCAAiC,CAC9C,KAAK,CAAC,SAAS,CAAC,eAAe,CAChC;KACF,CAAC,CAAC;IACH,OAAO;QACL,eAAe,EAAE,cAAc,CAAC,eAAe;QAC/C,iBAAiB,EAAE,6BAA6B,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,EAAE,cAAc,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAoBD,KAAK,UAAU,oBAAoB,CAAC,KAQnC;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAyB;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;QACpC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;KACzC,CAAC;IACF,MAAM,uBAAuB,GAC3B,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;QACpC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,IAAI,GAAkC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,KAAK;QACL,uBAAuB;KACxB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,wBAAwB,EAAE,0BAA0B,CAClD,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAC9B;QACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,oBAAoB,EAAE,KAAK,CAAC,cAAc,CAAC,YAAY;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM,4BAA4B,CAAC;QAC5D,SAAS;QACT,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,cAAc;QACtC,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,KAAK;QACL,SAAS;QACT,KAAK;QACL,aAAa;QACb,GAAG,kBAAkB;KACtB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAA+C;IAE/C,MAAM,iBAAiB,GAAG,MAAM,sCAAsC,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,wBAAwB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,2BAA2B,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,iBAAiB;QACjB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAA+C;IAE/C,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,EACJ,IAAI,EACJ,KAAK,EACL,SAAS,EACT,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,KAAK,GACN,GAAG,MAAM,oBAAoB,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,mBAAmB,CACtC,aAAa,EACb,MAAM,CAAC,GAAG,EACV,wBAAwB,CACzB,CAAC;IACF,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAChD,MAAM,wBAAwB,CAAC;QAC7B,YAAY;QACZ,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;QACnD,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;KACtB,CAAC,CAAC;IACL,MAAM,aAAa,GAAG,qBAAqB,CACzC,MAAM,CAAC,GAAG,CAAC,KAAK,EAChB,gCAAgC,CACjC,CAAC;IAEF,OAAO,6BAA6B,CAAC;QACnC,IAAI;QACJ,wBAAwB,EAAE,oBAAoB,CAAC;YAC7C,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,cAAc,EAAE,MAAM,CAAC,QAAQ;SAChC,CAAC;QACF,YAAY;QACZ,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,KAAK;QACL,SAAS;QACT,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,gBAAgB,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;QACjB,eAAe;QACf,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,iBAAiB;QACjB,KAAK,EAAE,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerKekRecipientTarget,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport {\n  asContainerManifestBundle,\n  getTargetContainerContext,\n  readContainerState,\n  uniqueSortedManifestHashes,\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport { readContainerKeyWraps } from \"../../../data/containers/shared/readers\";\nimport type {\n  ContainerMutationAuthor,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../data/documents/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\nimport {\n  buildContainerSharePlanResult,\n  type ContainerShareRecipient,\n  collectContainerSharePrincipalPolicies,\n  collectShareUserRecipientKeys,\n  deriveContainerShareManifest,\n  referencedPrincipalHeadFromPolicy,\n  replaceContainerWrap,\n  shareManifestHistory,\n} from \"./sharePlanCore\";\n\nasync function materializeRecipientWrap(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  recipient: ContainerShareRecipient;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): Promise<{\n  recipientTarget: ContainerKekRecipientTarget;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wrap: ContainerKeyWrap;\n}> {\n  if (input.recipient.subjectType === \"user\") {\n    const shareRecipient = await wrapContainerKeyToRootUser({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      recipientEncapsulationPublicKey:\n        input.recipient.recipientEncapsulationPublicKey,\n      userId: input.recipient.subjectId,\n    });\n    return {\n      recipientTarget: shareRecipient.recipientTarget,\n      userRecipientKeys: collectShareUserRecipientKeys({\n        newUserRecipientKey: shareRecipient.userRecipientKey,\n        state: input.state,\n        targetKek: input.targetKek,\n      }),\n      wrap: shareRecipient.wrap,\n    };\n  }\n\n  const shareRecipient = await wrapContainerKeyToManagedPrincipal({\n    containerKey: input.containerKey,\n    containerKeyEpochId: input.containerKeyEpochId,\n    manifestHash: input.manifestHash,\n    principalEncapsulationPublicKey:\n      input.recipient.principalPolicy.state.encapsulationPublicKey,\n    principalHead: referencedPrincipalHeadFromPolicy(\n      input.recipient.principalPolicy,\n    ),\n  });\n  return {\n    recipientTarget: shareRecipient.recipientTarget,\n    userRecipientKeys: collectShareUserRecipientKeys({\n      state: input.state,\n      targetKek: input.targetKek,\n    }),\n    wrap: shareRecipient.wrap,\n  };\n}\n\ninterface BuildMaterializedContainerSharePlanInput {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  /** False for a projection re-rooted on rotations not yet acknowledged. */\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\nasync function buildShareTransition(input: {\n  accessLevel: ContainerAccessLevel;\n  author: ContainerMutationAuthor;\n  eventId?: string | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipient: ContainerShareRecipient;\n  signedAt?: string | undefined;\n  targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}) {\n  const previousState = readContainerState(input.targetManifest);\n  if (previousState.organizationId !== input.author.organizationId) {\n    throw new Error(\"Container share author organization mismatch\");\n  }\n  const grant: ContainerDirectGrant = {\n    accessLevel: input.accessLevel,\n    subjectId: input.recipient.subjectId,\n    subjectType: input.recipient.subjectType,\n  };\n  const referencedPrincipalHead =\n    input.recipient.subjectType === \"user\"\n      ? null\n      : referencedPrincipalHeadFromPolicy(input.recipient.principalPolicy);\n  const body: ContainerGrantAccessEventBody = {\n    eventType: \"container.grant\",\n    containerKeyEpochId: previousState.containerKeyEpochId,\n    containerKeyPublicKey: previousState.containerKeyPublicKey,\n    grant,\n    referencedPrincipalHead,\n  };\n  const { event, eventHash } = await signContainerMutationEvent({\n    author: input.author,\n    body,\n    containerId: previousState.containerId,\n    dependencyManifestHashes: uniqueSortedManifestHashes(\n      input.previousProjection.path,\n    ),\n    eventId: input.eventId ?? crypto.randomUUID(),\n    previousManifestHash: input.targetManifest.manifestHash,\n    signedAt: input.signedAt ?? new Date().toISOString(),\n  });\n  const manifestTransition = await deriveContainerShareManifest({\n    eventHash,\n    grant,\n    previousManifest: input.targetManifest,\n    referencedPrincipalHead,\n  });\n  return {\n    body,\n    event,\n    eventHash,\n    grant,\n    previousState,\n    ...manifestTransition,\n  };\n}\n\nasync function collectAuthorizedSharePolicies(\n  input: BuildMaterializedContainerSharePlanInput,\n) {\n  const principalPolicies = await collectContainerSharePrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    previousProjection: input.previousProjection,\n    ...(input.recipient.subjectType === \"user\"\n      ? {}\n      : { recipientPolicy: input.recipient.principalPolicy }),\n    resolveUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  assertContainerAuthorAccess({\n    author: input.author,\n    projection: input.previousProjection,\n    principalPolicies,\n    minimumAccess: \"admin\",\n  });\n  return principalPolicies;\n}\n\nexport async function buildMaterializedContainerSharePlan(\n  input: BuildMaterializedContainerSharePlanInput,\n): Promise<MaterializedContainerSharePlan> {\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    ...projectionVerificationOptions(input),\n  });\n  const principalPolicies = await collectAuthorizedSharePolicies(input);\n  const target = getTargetContainerContext(input.previousProjection);\n  const {\n    body,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousState,\n    state,\n  } = await buildShareTransition({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    previousProjection: input.previousProjection,\n    recipient: input.recipient,\n    signedAt: input.signedAt,\n    targetManifest: target.manifest,\n  });\n  const containerKey = requireUnwrappedKek(\n    keksByEpochId,\n    target.kek,\n    \"Container share target\",\n  );\n  const { recipientTarget, userRecipientKeys, wrap } =\n    await materializeRecipientWrap({\n      containerKey,\n      containerKeyEpochId: target.kek.containerKeyEpochId,\n      manifestHash,\n      recipient: input.recipient,\n      state,\n      targetKek: target.kek,\n    });\n  const previousWraps = readContainerKeyWraps(\n    target.kek.wraps,\n    \"Container share previous wraps\",\n  );\n\n  return buildContainerSharePlanResult({\n    body,\n    containerManifestHistory: shareManifestHistory({\n      containerId: previousState.containerId,\n      targetKek: target.kek,\n      targetManifest: target.manifest,\n    }),\n    containerKey,\n    containerId: previousState.containerId,\n    event,\n    eventHash,\n    grant,\n    manifest,\n    manifestHash,\n    previousManifest: asContainerManifestBundle(target.manifest),\n    previousProjection: input.previousProjection,\n    principalPolicies,\n    recipientTarget,\n    state,\n    targetKek: target.kek,\n    userRecipientKeys,\n    wraps: replaceContainerWrap(previousWraps, wrap),\n  });\n}\n"]}

package/workflows/containers/child/sharePlanCore.d.ts

@@ -1,82 +0,0 @@
-import { type AccessEvent, type AccessManifest, type ContainerAccessManifestState, type ContainerDirectGrant, type ContainerGrantAccessEventBody, type ContainerGrantPrincipalHead, type ContainerKekRecipientTarget, type ContainerKeyWrap, type ContainerUserRecipientKey } from "../../../internal/crypto/index.js";
-import type { AccessManifestBundleWire } from "../../../internal/validators/request/index.js";
-import type { ContainerKekResponse, ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerSharePlan, MaterializedContainerSharePlan } from "../../../data/containers/shared/types.js";
-import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../data/keyingProjectionVerification/index.js";
-import type { PrincipalPolicyCurrentEvidence } from "../../../data/principals/principalPolicyEvidence.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-export type ContainerShareRecipient = {
-    readonly recipientEncapsulationPublicKey: Uint8Array;
-    readonly subjectId: string;
-    readonly subjectType: "user";
-} | {
-    readonly principalPolicy: PrincipalPolicyCurrentEvidence;
-    readonly subjectId: string;
-    readonly subjectType: "group";
-};
-export declare function referencedPrincipalHeadFromPolicy(policy: PrincipalPolicyCurrentEvidence): ContainerGrantPrincipalHead;
-/**
- * The previous manifest's referenced principal heads with the replacement
- * policy's head upserted in place of any stale head for the same principal.
- * A rekey substitutes references and never adds one: a manifest may reference
- * only principals it grants, so a replacement for one it does not grant —
- * a carried rekey below the container the policy is granted on — is left out.
- */
-export declare function refreshedPrincipalReferences(input: {
-    readonly previousState: ContainerAccessManifestState;
-    readonly replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
-}): ContainerGrantPrincipalHead[];
-/**
- * The previous policies with the replacement policy substituted for any
- * existing policy of the same principal identity.
- */
-export declare function refreshedPrincipalPolicies(input: {
-    readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];
-    readonly replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
-}): PrincipalPolicyCurrentEvidence[];
-export declare function deriveContainerShareManifest(input: {
-    eventHash: string;
-    grant: ContainerDirectGrant;
-    previousManifest: ContainerWriterProjectionResponse["path"][number];
-    referencedPrincipalHead: ContainerGrantPrincipalHead | null;
-}): Promise<Pick<ContainerSharePlan, "manifest" | "manifestHash" | "state">>;
-export declare function replaceContainerWrap(wraps: readonly ContainerKeyWrap[], nextWrap: ContainerKeyWrap): ContainerKeyWrap[];
-export declare function shareManifestHistory(input: {
-    readonly containerId: string;
-    readonly targetKek: ContainerKekResponse;
-    readonly targetManifest: ContainerWriterProjectionResponse["path"][number];
-}): AccessManifestBundleWire[];
-export declare function buildContainerSharePlanResult(input: {
-    body: ContainerGrantAccessEventBody;
-    containerManifestHistory: readonly AccessManifestBundleWire[];
-    containerId: string;
-    containerKey: Uint8Array;
-    event: AccessEvent;
-    eventHash: string;
-    grant: ContainerDirectGrant;
-    manifest: AccessManifest;
-    manifestHash: string;
-    previousManifest: AccessManifestBundleWire;
-    previousProjection: ContainerWriterProjectionResponse;
-    principalPolicies: readonly PrincipalPolicyCurrentEvidence[];
-    recipientTarget: ContainerKekRecipientTarget;
-    state: ContainerAccessManifestState;
-    targetKek: ContainerKekResponse;
-    userRecipientKeys: ContainerUserRecipientKey[];
-    wraps: ContainerKeyWrap[];
-}): MaterializedContainerSharePlan;
-export declare function collectShareUserRecipientKeys(input: {
-    newUserRecipientKey?: ContainerUserRecipientKey | undefined;
-    state: ContainerAccessManifestState;
-    targetKek: ContainerKekResponse;
-}): ContainerUserRecipientKey[];
-export declare function collectContainerSharePrincipalPolicies(input: {
-    execSql: ExecSql;
-    persistVerificationCheckpoints?: boolean | undefined;
-    principalPolicyCache?: PrincipalPolicyCache | undefined;
-    previousProjection: ContainerWriterProjectionResponse;
-    recipientPolicy?: PrincipalPolicyCurrentEvidence | undefined;
-    resolveUserKey: ProjectionUserKeyResolver;
-    stillCurrent?: (() => boolean) | undefined;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}): Promise<PrincipalPolicyCurrentEvidence[]>;

package/workflows/containers/child/sharePlanCore.js

@@ -1,191 +0,0 @@
-import { computeAccessManifestHash, deriveContainerAccessManifest, } from "../../../internal/crypto/index.js";
-import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
-import { asContainerManifestBundle, containerManifestRef, getParentKekForTarget, readContainerState, } from "../../../data/containers/shared/projection.js";
-import { readContainerKekRecipientTargets, readContainerKeyEpoch, } from "../../../data/containers/shared/readers.js";
-import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification/index.js";
-import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
-function grantKey(grant) {
-    return `${grant.subjectType}:${grant.subjectId}`;
-}
-function upsertContainerGrant(grants, grant) {
-    return [
-        ...grants.filter((existingGrant) => grantKey(existingGrant) !== grantKey(grant)),
-        grant,
-    ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));
-}
-function referencedPrincipalKey(reference) {
-    return `${reference.principalType}:${reference.principalId}`;
-}
-export function referencedPrincipalHeadFromPolicy(policy) {
-    if (policy.principalType !== "group") {
-        throw new Error("Container grants can reference only group policies");
-    }
-    return {
-        principalType: "group",
-        principalId: policy.principalId,
-        version: policy.version,
-        keyEpoch: policy.keyEpoch,
-        stateHash: policy.stateHash,
-        keyFingerprint: policy.state.keyFingerprint,
-    };
-}
-function upsertReferencedPrincipalHead(references, reference) {
-    return [
-        ...references.filter((existingReference) => referencedPrincipalKey(existingReference) !==
-            referencedPrincipalKey(reference)),
-        reference,
-    ].sort((left, right) => referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)));
-}
-/**
- * The previous manifest's referenced principal heads with the replacement
- * policy's head upserted in place of any stale head for the same principal.
- * A rekey substitutes references and never adds one: a manifest may reference
- * only principals it grants, so a replacement for one it does not grant —
- * a carried rekey below the container the policy is granted on — is left out.
- */
-export function refreshedPrincipalReferences(input) {
-    const replacement = input.replacementPrincipalPolicy;
-    if (!replacement ||
-        !input.previousState.directGrants.some((grant) => grant.subjectType === replacement.principalType &&
-            grant.subjectId === replacement.principalId)) {
-        return [...input.previousState.referencedPrincipalHeads];
-    }
-    return upsertReferencedPrincipalHead(input.previousState.referencedPrincipalHeads, referencedPrincipalHeadFromPolicy(replacement));
-}
-/**
- * The previous policies with the replacement policy substituted for any
- * existing policy of the same principal identity.
- */
-export function refreshedPrincipalPolicies(input) {
-    const replacement = input.replacementPrincipalPolicy;
-    if (!replacement) {
-        return uniquePrincipalPolicies(input.previousPolicies);
-    }
-    return uniquePrincipalPolicies([
-        ...input.previousPolicies.filter((policy) => policy.principalType !== replacement.principalType ||
-            policy.principalId !== replacement.principalId),
-        replacement,
-    ]);
-}
-export async function deriveContainerShareManifest(input) {
-    const previousState = readContainerState(input.previousManifest);
-    const state = {
-        ...previousState,
-        epoch: previousState.epoch + 1,
-        previousManifestHash: input.previousManifest.manifestHash,
-        eventHash: input.eventHash,
-        directGrants: upsertContainerGrant(previousState.directGrants, input.grant),
-        referencedPrincipalHeads: input.referencedPrincipalHead
-            ? upsertReferencedPrincipalHead(previousState.referencedPrincipalHeads, input.referencedPrincipalHead)
-            : previousState.referencedPrincipalHeads,
-    };
-    const manifest = await deriveContainerAccessManifest(state);
-    return {
-        manifest,
-        manifestHash: await computeAccessManifestHash(manifest),
-        state,
-    };
-}
-function buildContainerShareRequest(input) {
-    return {
-        ...containerMutationRequestCore("share", input),
-        ...previousPathRequestFields(input.previousManifest, input.previousProjection),
-        containerManifestHistoryRefs: input.containerManifestHistory.map(containerManifestRef),
-        predecessorBridge: null,
-        keyring: null,
-        parentKekState: readCanonicalRecordOrNull(input.parentKek, "Container share parent KEK state"),
-    };
-}
-export function replaceContainerWrap(wraps, nextWrap) {
-    return [
-        ...wraps.filter((wrap) => !(wrap.recipientKind === nextWrap.recipientKind &&
-            wrap.recipientId === nextWrap.recipientId)),
-        nextWrap,
-    ];
-}
-export function shareManifestHistory(input) {
-    const byHash = new Map();
-    for (const bundle of [
-        input.targetManifest,
-        ...input.targetKek.containerManifestHistory,
-    ]) {
-        if (readContainerState(bundle).containerId === input.containerId &&
-            !byHash.has(bundle.manifestHash)) {
-            byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));
-        }
-    }
-    return [...byHash.values()];
-}
-export function buildContainerSharePlanResult(input) {
-    const keyEpoch = readContainerKeyEpoch(input.targetKek.keyEpoch, "Container share key epoch");
-    const plan = {
-        body: input.body,
-        containerId: input.containerId,
-        event: input.event,
-        eventHash: input.eventHash,
-        grant: input.grant,
-        keyEpoch,
-        manifest: input.manifest,
-        manifestHash: input.manifestHash,
-        previousKeyring: readCanonicalRecordOrNull(input.previousProjection.containerKeks.at(-1)?.keyring ?? null, "Container share previous keyring"),
-        previousManifest: input.previousManifest,
-        recipientTarget: input.recipientTarget,
-        request: buildContainerShareRequest({
-            body: input.body,
-            containerManifestHistory: input.containerManifestHistory,
-            event: input.event,
-            keyEpoch,
-            manifest: input.manifest,
-            manifestHash: input.manifestHash,
-            parentKek: getParentKekForTarget(input.previousProjection),
-            previousManifest: input.previousManifest,
-            previousProjection: input.previousProjection,
-            principalPolicies: input.principalPolicies,
-            userRecipientKeys: input.userRecipientKeys,
-            wraps: input.wraps,
-        }),
-        state: input.state,
-        userRecipientKeys: input.userRecipientKeys,
-        wraps: input.wraps,
-    };
-    return { containerKey: input.containerKey, plan };
-}
-export function collectShareUserRecipientKeys(input) {
-    const directUserIds = new Set(input.state.directGrants.flatMap((grant) => grant.subjectType === "user" ? [grant.subjectId] : []));
-    const userRecipientKeyByUserId = new Map();
-    for (const target of readContainerKekRecipientTargets(input.targetKek.recipientTargets, "Container share target KEK recipient targets")) {
-        if (target.recipientKind !== "user" ||
-            !directUserIds.has(target.recipientId)) {
-            continue;
-        }
-        userRecipientKeyByUserId.set(target.recipientId, {
-            userId: target.recipientId,
-            recipientKeyEpochId: target.recipientKeyEpochId,
-            recipientKeyFingerprint: target.recipientKeyFingerprint,
-        });
-    }
-    if (input.newUserRecipientKey) {
-        userRecipientKeyByUserId.set(input.newUserRecipientKey.userId, input.newUserRecipientKey);
-    }
-    const missingUserId = [...directUserIds].find((userId) => !userRecipientKeyByUserId.has(userId));
-    if (missingUserId) {
-        throw new Error(`Container share recipient key is missing for direct user grant ${missingUserId}`);
-    }
-    return [...userRecipientKeyByUserId.values()].sort((left, right) => left.userId.localeCompare(right.userId));
-}
-export async function collectContainerSharePrincipalPolicies(input) {
-    const previousPolicies = await collectContainerWriterProjectionPrincipalPolicies({
-        execSql: input.execSql,
-        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
-        principalPolicyCache: input.principalPolicyCache,
-        projection: input.previousProjection,
-        resolveUserKey: input.resolveUserKey,
-        stillCurrent: input.stillCurrent,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    return refreshedPrincipalPolicies({
-        previousPolicies,
-        replacementPrincipalPolicy: input.recipientPolicy,
-    });
-}
-//# sourceMappingURL=sharePlanCore.js.map

package/workflows/containers/child/sharePlanCore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAc/B,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,4BAA4B,EAC1B,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC1D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  type AccessEvent,\n  type AccessManifest,\n  type ContainerAccessManifestState,\n  type ContainerDirectGrant,\n  type ContainerGrantAccessEventBody,\n  type ContainerGrantPrincipalHead,\n  type ContainerKekRecipientTarget,\n  type ContainerKeyEpoch,\n  type ContainerKeyWrap,\n  type ContainerUserRecipientKey,\n  computeAccessManifestHash,\n  deriveContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n  AccessManifestBundleWire,\n  ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n  asContainerManifestBundle,\n  containerManifestRef,\n  getParentKekForTarget,\n  readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n  readContainerKekRecipientTargets,\n  readContainerKeyEpoch,\n} from \"../../../data/containers/shared/readers\";\nimport type {\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  containerMutationRequestCore,\n  previousPathRequestFields,\n  readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n  | {\n      readonly recipientEncapsulationPublicKey: Uint8Array;\n      readonly subjectId: string;\n      readonly subjectType: \"user\";\n    }\n  | {\n      readonly principalPolicy: PrincipalPolicyCurrentEvidence;\n      readonly subjectId: string;\n      readonly subjectType: \"group\";\n    };\n\nfunction grantKey(\n  grant: Pick<ContainerDirectGrant, \"subjectId\" | \"subjectType\">,\n): string {\n  return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n  grants: readonly ContainerDirectGrant[],\n  grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n  return [\n    ...grants.filter(\n      (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n    ),\n    grant,\n  ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n  readonly principalId: string;\n  readonly principalType: \"group\";\n}): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n  policy: PrincipalPolicyCurrentEvidence,\n): ContainerGrantPrincipalHead {\n  if (policy.principalType !== \"group\") {\n    throw new Error(\"Container grants can reference only group policies\");\n  }\n  return {\n    principalType: \"group\",\n    principalId: policy.principalId,\n    version: policy.version,\n    keyEpoch: policy.keyEpoch,\n    stateHash: policy.stateHash,\n    keyFingerprint: policy.state.keyFingerprint,\n  };\n}\n\nfunction upsertReferencedPrincipalHead(\n  references: readonly ContainerGrantPrincipalHead[],\n  reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n  return [\n    ...references.filter(\n      (existingReference) =>\n        referencedPrincipalKey(existingReference) !==\n        referencedPrincipalKey(reference),\n    ),\n    reference,\n  ].sort((left, right) =>\n    referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n  );\n}\n\n/**\n * The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n */\nexport function refreshedPrincipalReferences(input: {\n  readonly previousState: ContainerAccessManifestState;\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): ContainerGrantPrincipalHead[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (\n    !replacement ||\n    !input.previousState.directGrants.some(\n      (grant) =>\n        grant.subjectType === replacement.principalType &&\n        grant.subjectId === replacement.principalId,\n    )\n  ) {\n    return [...input.previousState.referencedPrincipalHeads];\n  }\n  return upsertReferencedPrincipalHead(\n    input.previousState.referencedPrincipalHeads,\n    referencedPrincipalHeadFromPolicy(replacement),\n  );\n}\n\n/**\n * The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n  readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  readonly replacementPrincipalPolicy?:\n    | PrincipalPolicyCurrentEvidence\n    | undefined;\n}): PrincipalPolicyCurrentEvidence[] {\n  const replacement = input.replacementPrincipalPolicy;\n  if (!replacement) {\n    return uniquePrincipalPolicies(input.previousPolicies);\n  }\n  return uniquePrincipalPolicies([\n    ...input.previousPolicies.filter(\n      (policy) =>\n        policy.principalType !== replacement.principalType ||\n        policy.principalId !== replacement.principalId,\n    ),\n    replacement,\n  ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n  referencedPrincipalHead: ContainerGrantPrincipalHead | null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" | \"manifestHash\" | \"state\">> {\n  const previousState = readContainerState(input.previousManifest);\n  const state: ContainerAccessManifestState = {\n    ...previousState,\n    epoch: previousState.epoch + 1,\n    previousManifestHash: input.previousManifest.manifestHash,\n    eventHash: input.eventHash,\n    directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n    referencedPrincipalHeads: input.referencedPrincipalHead\n      ? upsertReferencedPrincipalHead(\n          previousState.referencedPrincipalHeads,\n          input.referencedPrincipalHead,\n        )\n      : previousState.referencedPrincipalHeads,\n  };\n  const manifest = await deriveContainerAccessManifest(state);\n\n  return {\n    manifest,\n    manifestHash: await computeAccessManifestHash(manifest),\n    state,\n  };\n}\n\nfunction buildContainerShareRequest(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  event: AccessEvent;\n  keyEpoch: ContainerKeyEpoch;\n  manifest: AccessManifest;\n  manifestHash: string;\n  parentKek: ContainerKekResponse | null;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  userRecipientKeys: readonly ContainerUserRecipientKey[];\n  wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n  return {\n    ...containerMutationRequestCore(\"share\", input),\n    ...previousPathRequestFields(\n      input.previousManifest,\n      input.previousProjection,\n    ),\n    containerManifestHistoryRefs:\n      input.containerManifestHistory.map(containerManifestRef),\n    predecessorBridge: null,\n    keyring: null,\n    parentKekState: readCanonicalRecordOrNull(\n      input.parentKek,\n      \"Container share parent KEK state\",\n    ),\n  };\n}\n\nexport function replaceContainerWrap(\n  wraps: readonly ContainerKeyWrap[],\n  nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n  return [\n    ...wraps.filter(\n      (wrap) =>\n        !(\n          wrap.recipientKind === nextWrap.recipientKind &&\n          wrap.recipientId === nextWrap.recipientId\n        ),\n    ),\n    nextWrap,\n  ];\n}\n\nexport function shareManifestHistory(input: {\n  readonly containerId: string;\n  readonly targetKek: ContainerKekResponse;\n  readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n  const byHash = new Map<string, AccessManifestBundleWire>();\n  for (const bundle of [\n    input.targetManifest,\n    ...input.targetKek.containerManifestHistory,\n  ]) {\n    if (\n      readContainerState(bundle).containerId === input.containerId &&\n      !byHash.has(bundle.manifestHash)\n    ) {\n      byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n    }\n  }\n  return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n  body: ContainerGrantAccessEventBody;\n  containerManifestHistory: readonly AccessManifestBundleWire[];\n  containerId: string;\n  containerKey: Uint8Array;\n  event: AccessEvent;\n  eventHash: string;\n  grant: ContainerDirectGrant;\n  manifest: AccessManifest;\n  manifestHash: string;\n  previousManifest: AccessManifestBundleWire;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  recipientTarget: ContainerKekRecipientTarget;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n  userRecipientKeys: ContainerUserRecipientKey[];\n  wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n  const keyEpoch = readContainerKeyEpoch(\n    input.targetKek.keyEpoch,\n    \"Container share key epoch\",\n  );\n  const plan: ContainerSharePlan = {\n    body: input.body,\n    containerId: input.containerId,\n    event: input.event,\n    eventHash: input.eventHash,\n    grant: input.grant,\n    keyEpoch,\n    manifest: input.manifest,\n    manifestHash: input.manifestHash,\n    previousKeyring: readCanonicalRecordOrNull(\n      input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n      \"Container share previous keyring\",\n    ),\n    previousManifest: input.previousManifest,\n    recipientTarget: input.recipientTarget,\n    request: buildContainerShareRequest({\n      body: input.body,\n      containerManifestHistory: input.containerManifestHistory,\n      event: input.event,\n      keyEpoch,\n      manifest: input.manifest,\n      manifestHash: input.manifestHash,\n      parentKek: getParentKekForTarget(input.previousProjection),\n      previousManifest: input.previousManifest,\n      previousProjection: input.previousProjection,\n      principalPolicies: input.principalPolicies,\n      userRecipientKeys: input.userRecipientKeys,\n      wraps: input.wraps,\n    }),\n    state: input.state,\n    userRecipientKeys: input.userRecipientKeys,\n    wraps: input.wraps,\n  };\n\n  return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n  newUserRecipientKey?: ContainerUserRecipientKey | undefined;\n  state: ContainerAccessManifestState;\n  targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n  const directUserIds = new Set(\n    input.state.directGrants.flatMap((grant) =>\n      grant.subjectType === \"user\" ? [grant.subjectId] : [],\n    ),\n  );\n  const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n  for (const target of readContainerKekRecipientTargets(\n    input.targetKek.recipientTargets,\n    \"Container share target KEK recipient targets\",\n  )) {\n    if (\n      target.recipientKind !== \"user\" ||\n      !directUserIds.has(target.recipientId)\n    ) {\n      continue;\n    }\n    userRecipientKeyByUserId.set(target.recipientId, {\n      userId: target.recipientId,\n      recipientKeyEpochId: target.recipientKeyEpochId,\n      recipientKeyFingerprint: target.recipientKeyFingerprint,\n    });\n  }\n\n  if (input.newUserRecipientKey) {\n    userRecipientKeyByUserId.set(\n      input.newUserRecipientKey.userId,\n      input.newUserRecipientKey,\n    );\n  }\n\n  const missingUserId = [...directUserIds].find(\n    (userId) => !userRecipientKeyByUserId.has(userId),\n  );\n  if (missingUserId) {\n    throw new Error(\n      `Container share recipient key is missing for direct user grant ${missingUserId}`,\n    );\n  }\n\n  return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n    left.userId.localeCompare(right.userId),\n  );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientPolicy?: PrincipalPolicyCurrentEvidence | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  const previousPolicies =\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    });\n  return refreshedPrincipalPolicies({\n    previousPolicies,\n    replacementPrincipalPolicy: input.recipientPolicy,\n  });\n}\n"]}

package/workflows/containers/child/sharePrincipalPolicy.d.ts

@@ -1,51 +0,0 @@
-import type { ApiClient } from "../../../internal/api-client/index.js";
-import { KeyingVerificationError, type ReferencedPrincipalHead, type VerifiedPrincipalPolicy } from "../../../internal/crypto/index.js";
-import type { CommitOrganizationGroupPolicyRequest } from "../../../internal/validators/request/index.js";
-import type { CommitOrganizationGroupPolicyResponse, PrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
-import type { ContainerShareApi } from "../../../data/containers/shared/types.js";
-import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
-import { type GroupPolicyNameReader } from "../../organizations/principalPolicy/principalPolicyRequest.js";
-import type { CurrentPrincipalPolicyReader } from "../../principals/currentPrincipalPolicyReader.js";
-export interface ContainerManagedPrincipalShareApi extends ContainerShareApi, CurrentPrincipalPolicyReader, Pick<ApiClient, "evictContainerWriterProjection" | "getContainerWriterProjectionResult"> {
-    readonly recoverPendingPrincipalMutation?: ((organizationId: string) => Promise<void>) | undefined;
-    commitOrganizationGroupPolicy: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest) => Promise<CommitOrganizationGroupPolicyResponse | null>;
-}
-export interface VerifiedSharePrincipalPolicy {
-    readonly bundle: PrincipalPolicyBundleResponse;
-    readonly checkpointPolicies: readonly VerifiedPrincipalPolicy[];
-    readonly dependencyBundles: readonly PrincipalPolicyBundleResponse[];
-    readonly organizationId: string;
-    readonly policy: VerifiedPrincipalPolicy;
-}
-/**
- * Commits the verification a loadVerifiedGroupSharePrincipalPolicy call
- * deferred: advances the keying checkpoints for the verified policies and
- * caches the dependency bundles they were verified against.
- */
-export declare function advanceVerifiedSharePolicies(execSql: ExecSql, verified: Pick<VerifiedSharePrincipalPolicy, "checkpointPolicies" | "dependencyBundles" | "organizationId">, stillCurrent?: (() => boolean) | undefined): Promise<void>;
-/**
- * The chosen group label does not match the name in the group's verified
- * policy. A KeyingVerificationError (so it is reported as an incident), with
- * its own class so a caller can tell this refusal from every other
- * `object_mismatch` and say what happened.
- */
-export declare class GroupShareNameMismatchError extends KeyingVerificationError {
-    constructor(message: string);
-}
-export declare function loadVerifiedGroupSharePrincipalPolicy(input: {
-    readEncryptedName?: GroupPolicyNameReader | undefined;
-    apiClient: ContainerManagedPrincipalShareApi;
-    execSql: ExecSql;
-    expectedGroupHead?: ReferencedPrincipalHead | undefined;
-    /**
-     * The display name the user chose the group by. The read model that labels
-     * groups is a server projection; only the name committed in the signed
-     * group payload can confirm the share lands on the group the user saw.
-     */
-    expectedGroupName?: string | undefined;
-    groupId: string;
-    organizationId: string;
-    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    stillCurrent?: (() => boolean) | undefined;
-}): Promise<VerifiedSharePrincipalPolicy>;