@tearleads/client-sdk 0.1.63 → 0.1.65

package/workflows/containers/child/rotation/rotationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotationContext.js","sourceRoot":"","sources":["rotationContext.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wEAAwE,CAAC;AAC/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAiBxF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA6C,EAC7C,cAAoE;IAEpE,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,qBAAqB,CAAC;YACpC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,cAAc;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,aAA8C,EAC9C,GAAsD,EACtD,KAAa;IAEb,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAkBC,EACD,cAAsB;IAQtB,2FAA2F;IAC3F,6BAA6B,CAC3B,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,cAAc;QACd,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,uBAAuB,GAAG,mBAAmB,CACjD,aAAa,EACb,MAAM,CAAC,GAAG,EACV,aAAa,cAAc,cAAc,CAC1C,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,aAAa,cAAc,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7E,OAAO;QACL,SAAS;QACT,eAAe;QACf,uBAAuB;QACvB,aAAa;QACb,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type {\n  ContainerKekResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  getParentKekForTarget,\n  getParentWrappingPublicKey,\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../../data/documents/shared/containerKek/containerKekCurrency\";\nimport { signedHistoryEpochIds } from \"../../../../data/documents/shared/containerKek/containerKekPathHistory\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport { projectionVerificationOptions } from \"../../../../data/documents/shared/types\";\nimport type {\n  PrincipalPolicyCache,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\n\n/**\n * A rotation's target container, with the epoch ids its verified lineage\n * names wherever the projection served it; the re-sealed keyring is anchored\n * to them (#2365 finding 32).\n */\nexport type SignedRotationTarget = ReturnType<\n  typeof getTargetContainerContext\n> & { readonly signedEpochIds: ReadonlySet<string> };\n\n/**\n * The projection's target with its signed lineage ids, read from the manifests\n * this rotation's own verification recorded. Every rotation that re-seals a\n * keyring builds its target here, so none can skip the anchor.\n */\nexport function signedRotationTarget(\n  projection: ContainerWriterProjectionResponse,\n  verifiedByHash: ReadonlyMap<string, VerifiedContainerAccessManifest>,\n): SignedRotationTarget {\n  const target = getTargetContainerContext(projection);\n  return {\n    ...target,\n    signedEpochIds: signedHistoryEpochIds({\n      headManifestHash: target.manifest.manifestHash,\n      kek: target.kek,\n      verifiedByHash,\n    }),\n  };\n}\n\nexport function requireUnwrappedKek(\n  keksByEpochId: ReadonlyMap<string, Uint8Array>,\n  kek: Pick<ContainerKekResponse, \"containerKeyEpochId\">,\n  label: string,\n): Uint8Array {\n  const keyMaterial = keksByEpochId.get(kek.containerKeyEpochId);\n  if (!keyMaterial) {\n    throw new Error(`${label} KEK could not be unwrapped`);\n  }\n  return keyMaterial;\n}\n\n/**\n * The shared rotation prologue for rekey and revoke: unwrap the projection's\n * KEK path, require the predecessor key, check the author's organization, and\n * surface the authenticated parent public key when one exists.\n */\nexport async function resolveRotationContext(\n  input: {\n    author: ContainerMutationAuthor;\n    execSql: ExecSql;\n    /**\n     * Keys of epochs the projection names that no wrap on it opens for this\n     * signer yet: the ones a batch minted above and has not committed.\n     */\n    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n    persistVerificationCheckpoints?: boolean | undefined;\n    previousProjection: ContainerWriterProjectionResponse;\n    /** Verified policies the path may cite before they are stored locally. */\n    principalPolicyCache?: PrincipalPolicyCache | undefined;\n    resolveProjectionUserKey: ProjectionUserKeyResolver;\n    stillCurrent?: (() => boolean) | undefined;\n    targetSecretKey: Uint8Array;\n    warmReferencedPrincipalPolicies?:\n      | ReferencedPrincipalPolicyWarmer\n      | undefined;\n  },\n  operationLabel: string,\n): Promise<{\n  parentKek: ReturnType<typeof getParentKekForTarget>;\n  parentPublicKey: string | null;\n  predecessorContainerKey: Uint8Array;\n  previousState: ReturnType<typeof readContainerState>;\n  target: SignedRotationTarget;\n}> {\n  // The target may need repair, but wrapping its successor requires a current parent prefix.\n  assertContainerKekPathCurrent(\n    input.previousProjection.containerKeks.slice(0, -1),\n  );\n  const verifiedByHash = new Map<string, VerifiedContainerAccessManifest>();\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.previousProjection,\n    secretKey: input.targetSecretKey,\n    verifiedByHash,\n    ...projectionVerificationOptions(input),\n  });\n  const target = signedRotationTarget(input.previousProjection, verifiedByHash);\n  const predecessorContainerKey = requireUnwrappedKek(\n    keksByEpochId,\n    target.kek,\n    `Container ${operationLabel} predecessor`,\n  );\n  const previousState = readContainerState(target.manifest);\n  if (previousState.organizationId !== input.author.organizationId) {\n    throw new Error(`Container ${operationLabel} author organization mismatch`);\n  }\n\n  const parentKek = getParentKekForTarget(input.previousProjection);\n  const parentPublicKey = getParentWrappingPublicKey(input.previousProjection);\n  return {\n    parentKek,\n    parentPublicKey,\n    predecessorContainerKey,\n    previousState,\n    target,\n  };\n}\n"]}

package/workflows/containers/child/rotation/rotationPrincipalPolicies.js

@@ -0,0 +1,19 @@
+import { uniquePrincipalPolicies } from "../../../../data/containers/shared/principalPolicies.js";
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../../data/keyingProjectionVerification/index.js";
+/**
+ * Shared by rekey and revoke. Lives apart from both: background descendant
+ * repair imports the rekey planner, and revoke schedules that repair, so
+ * declaring this in revoke would close a dependency cycle.
+ */
+export async function collectContainerRevokePrincipalPolicies(input) {
+    return uniquePrincipalPolicies(await collectContainerWriterProjectionPrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.previousProjection,
+        resolveUserKey: input.resolveUserKey,
+        stillCurrent: input.stillCurrent,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    }));
+}
+//# sourceMappingURL=rotationPrincipalPolicies.js.map

package/workflows/containers/child/rotation/rotationPrincipalPolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotationPrincipalPolicies.js","sourceRoot":"","sources":["rotationPrincipalPolicies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EACL,iDAAiD,GAIlD,MAAM,+CAA+C,CAAC;AAIvD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAQ7D;IACC,OAAO,uBAAuB,CAC5B,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../../data/containers/shared/principalPolicies\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\n\n/**\n * Shared by rekey and revoke. Lives apart from both: background descendant\n * repair imports the rekey planner, and revoke schedules that repair, so\n * declaring this in revoke would close a dependency cycle.\n */\nexport async function collectContainerRevokePrincipalPolicies(input: {\n  execSql: ExecSql;\n  persistVerificationCheckpoints?: boolean | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  resolveUserKey: ProjectionUserKeyResolver;\n  stillCurrent?: (() => boolean) | undefined;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n  return uniquePrincipalPolicies(\n    await collectContainerWriterProjectionPrincipalPolicies({\n      execSql: input.execSql,\n      persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n      principalPolicyCache: input.principalPolicyCache,\n      projection: input.previousProjection,\n      resolveUserKey: input.resolveUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n    }),\n  );\n}\n"]}

package/workflows/containers/child/rotation/rotationWraps.js

@@ -0,0 +1,85 @@
+import { wrapContainerKeyToManagedPrincipal, wrapContainerKeyToParent, wrapContainerKeyToRootUser, } from "../../../../data/containers/shared/projection.js";
+function findPrincipalPolicy(input) {
+    const policy = input.principalPolicies.find((candidate) => candidate.principalType === input.reference.principalType &&
+        candidate.principalId === input.reference.principalId &&
+        candidate.version === input.reference.version &&
+        candidate.keyEpoch === input.reference.keyEpoch &&
+        candidate.stateHash === input.reference.stateHash);
+    if (!policy) {
+        // Invariant, not a recoverable state: the API commits a container head
+        // only when every referenced group head equals the group's current state
+        // (packages/api groupReferenceHeads.ts), and a group change that would
+        // leave a grant stale is refused unless it rematerializes that container
+        // in the same transaction (principalContainerRematerialization.ts). A
+        // verified projection therefore always carries the policy its manifest
+        // references; a miss means the caller resolved policies for a different
+        // head than the manifest it is rotating.
+        throw new Error(`${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`);
+    }
+    return policy;
+}
+function referenceForManagedGrant(input) {
+    const reference = input.state.referencedPrincipalHeads.find((candidate) => candidate.principalType === input.grant.subjectType &&
+        candidate.principalId === input.grant.subjectId);
+    if (reference?.principalType !== "group") {
+        throw new Error(`${input.operationLabel} referenced principal head is missing`);
+    }
+    return { ...reference, principalType: "group" };
+}
+export async function buildContainerRotationWraps(input) {
+    const userRecipientKeys = [];
+    const wraps = [];
+    if (input.parentKek) {
+        if (!input.parentPublicKey) {
+            throw new Error(`${input.operationLabel} parent wrapping public key is missing`);
+        }
+        wraps.push(await wrapContainerKeyToParent({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            parentKek: input.parentKek,
+            parentPublicKey: input.parentPublicKey,
+        }));
+    }
+    for (const grant of input.state.directGrants) {
+        if (grant.subjectType === "user") {
+            const userKey = await input.resolveUserKey(grant.subjectId);
+            if (!userKey) {
+                throw new Error(`${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`);
+            }
+            const recipient = await wrapContainerKeyToRootUser({
+                containerKey: input.containerKey,
+                containerKeyEpochId: input.containerKeyEpochId,
+                manifestHash: input.manifestHash,
+                recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,
+                userId: grant.subjectId,
+            });
+            userRecipientKeys.push(recipient.userRecipientKey);
+            wraps.push(recipient.wrap);
+            continue;
+        }
+        const reference = referenceForManagedGrant({
+            grant,
+            operationLabel: input.operationLabel,
+            state: input.state,
+        });
+        const policy = findPrincipalPolicy({
+            operationLabel: input.operationLabel,
+            principalPolicies: input.principalPolicies,
+            reference,
+        });
+        const recipient = await wrapContainerKeyToManagedPrincipal({
+            containerKey: input.containerKey,
+            containerKeyEpochId: input.containerKeyEpochId,
+            manifestHash: input.manifestHash,
+            principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,
+            principalHead: reference,
+        });
+        wraps.push(recipient.wrap);
+    }
+    return {
+        userRecipientKeys: userRecipientKeys.sort((left, right) => left.userId.localeCompare(right.userId)),
+        wraps: wraps.sort((left, right) => `${left.recipientKind}:${left.recipientId}`.localeCompare(`${right.recipientKind}:${right.recipientId}`)),
+    };
+}
+//# sourceMappingURL=rotationWraps.js.map

package/workflows/containers/child/rotation/rotationWraps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotationWraps.js","sourceRoot":"","sources":["rotationWraps.ts"],"names":[],"mappings":"AASA,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,+CAA+C,CAAC;AAIvD,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CACzC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa;QACzD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW;QACrD,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO;QAC7C,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,CAAC,QAAQ;QAC/C,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CACpD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,eAAe,KAAK,CAAC,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,SAAS,CAAC,OAAO,eAAe,KAAK,CAAC,SAAS,CAAC,QAAQ,sHAAsH,CACtS,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAIjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACzD,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;QACnD,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAClD,CAAC;IACF,IAAI,SAAS,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,uCAAuC,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAUjD;IAIC,MAAM,iBAAiB,GAAgC,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,wCAAwC,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,MAAM,wBAAwB,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,cAAc,mDAAmD,KAAK,CAAC,SAAS,EAAE,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;gBACjD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAAE,OAAO,CAAC,sBAAsB;gBAC/D,MAAM,EAAE,KAAK,CAAC,SAAS;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;YACpE,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC;QACD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,CACvD,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAC9C,CACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  ContainerAccessManifestState,\n  ContainerDirectGrant,\n  ContainerGrantPrincipalHead,\n  ContainerKeyWrap,\n  ContainerUserRecipientKey,\n  ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { ContainerKekResponse } from \"@tearleads/validators/response\";\nimport {\n  wrapContainerKeyToManagedPrincipal,\n  wrapContainerKeyToParent,\n  wrapContainerKeyToRootUser,\n} from \"../../../../data/containers/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../../data/principals/principalPolicyEvidence\";\n\nfunction findPrincipalPolicy(input: {\n  operationLabel: string;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  reference: ReferencedPrincipalHead;\n}): PrincipalPolicyCurrentEvidence {\n  const policy = input.principalPolicies.find(\n    (candidate) =>\n      candidate.principalType === input.reference.principalType &&\n      candidate.principalId === input.reference.principalId &&\n      candidate.version === input.reference.version &&\n      candidate.keyEpoch === input.reference.keyEpoch &&\n      candidate.stateHash === input.reference.stateHash,\n  );\n  if (!policy) {\n    // Invariant, not a recoverable state: the API commits a container head\n    // only when every referenced group head equals the group's current state\n    // (packages/api groupReferenceHeads.ts), and a group change that would\n    // leave a grant stale is refused unless it rematerializes that container\n    // in the same transaction (principalContainerRematerialization.ts). A\n    // verified projection therefore always carries the policy its manifest\n    // references; a miss means the caller resolved policies for a different\n    // head than the manifest it is rotating.\n    throw new Error(\n      `${input.operationLabel} referenced ${input.reference.principalType} ${input.reference.principalId} at version ${input.reference.version} (key epoch ${input.reference.keyEpoch}), but no verified policy with that head was supplied; the API only commits heads whose group references are current`,\n    );\n  }\n  return policy;\n}\n\nfunction referenceForManagedGrant(input: {\n  grant: ContainerDirectGrant;\n  operationLabel: string;\n  state: ContainerAccessManifestState;\n}): ContainerGrantPrincipalHead {\n  const reference = input.state.referencedPrincipalHeads.find(\n    (candidate) =>\n      candidate.principalType === input.grant.subjectType &&\n      candidate.principalId === input.grant.subjectId,\n  );\n  if (reference?.principalType !== \"group\") {\n    throw new Error(\n      `${input.operationLabel} referenced principal head is missing`,\n    );\n  }\n  return { ...reference, principalType: \"group\" };\n}\n\nexport async function buildContainerRotationWraps(input: {\n  containerKey: Uint8Array;\n  containerKeyEpochId: string;\n  manifestHash: string;\n  operationLabel: string;\n  parentKek: ContainerKekResponse | null;\n  parentPublicKey: string | null;\n  principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n  resolveUserKey: ProjectionUserKeyResolver;\n  state: ContainerAccessManifestState;\n}): Promise<{\n  readonly userRecipientKeys: ContainerUserRecipientKey[];\n  readonly wraps: ContainerKeyWrap[];\n}> {\n  const userRecipientKeys: ContainerUserRecipientKey[] = [];\n  const wraps: ContainerKeyWrap[] = [];\n  if (input.parentKek) {\n    if (!input.parentPublicKey) {\n      throw new Error(\n        `${input.operationLabel} parent wrapping public key is missing`,\n      );\n    }\n    wraps.push(\n      await wrapContainerKeyToParent({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        parentKek: input.parentKek,\n        parentPublicKey: input.parentPublicKey,\n      }),\n    );\n  }\n\n  for (const grant of input.state.directGrants) {\n    if (grant.subjectType === \"user\") {\n      const userKey = await input.resolveUserKey(grant.subjectId);\n      if (!userKey) {\n        throw new Error(\n          `${input.operationLabel} recipient key is missing for direct user grant ${grant.subjectId}`,\n        );\n      }\n      const recipient = await wrapContainerKeyToRootUser({\n        containerKey: input.containerKey,\n        containerKeyEpochId: input.containerKeyEpochId,\n        manifestHash: input.manifestHash,\n        recipientEncapsulationPublicKey: userKey.encapsulationPublicKey,\n        userId: grant.subjectId,\n      });\n      userRecipientKeys.push(recipient.userRecipientKey);\n      wraps.push(recipient.wrap);\n      continue;\n    }\n\n    const reference = referenceForManagedGrant({\n      grant,\n      operationLabel: input.operationLabel,\n      state: input.state,\n    });\n    const policy = findPrincipalPolicy({\n      operationLabel: input.operationLabel,\n      principalPolicies: input.principalPolicies,\n      reference,\n    });\n    const recipient = await wrapContainerKeyToManagedPrincipal({\n      containerKey: input.containerKey,\n      containerKeyEpochId: input.containerKeyEpochId,\n      manifestHash: input.manifestHash,\n      principalEncapsulationPublicKey: policy.state.encapsulationPublicKey,\n      principalHead: reference,\n    });\n    wraps.push(recipient.wrap);\n  }\n\n  return {\n    userRecipientKeys: userRecipientKeys.sort((left, right) =>\n      left.userId.localeCompare(right.userId),\n    ),\n    wraps: wraps.sort((left, right) =>\n      `${left.recipientKind}:${left.recipientId}`.localeCompare(\n        `${right.recipientKind}:${right.recipientId}`,\n      ),\n    ),\n  };\n}\n"]}

package/workflows/containers/child/share/currentShareGrantMutation.js

@@ -0,0 +1,82 @@
+import { assertProjectionVerificationCurrent } from "../../../../data/keyingProjectionVerification/types.js";
+import { createRuntimeGroupMetadataAccess } from "../../../organizations/groupMetadata/groupMetadataRuntime.js";
+import { commitCurrentGroupPolicyMutation } from "../../../organizations/groupPolicy/commitCurrentGroupPolicyMutation.js";
+import { buildSetGroupContainerGrantPolicyRequest } from "../../../organizations/groupPolicy/groupPolicyRequests.js";
+import { groupPolicyNameMismatch } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { preparePrincipalContainerRematerializationBatch, } from "../../../organizations/rematerialization/principalContainerRematerialization.js";
+import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
+/** Fresh mutation authority rechecks the chosen name before authoring a grant. */
+export async function commitCurrentShareGrant(input) {
+    const share = input.share;
+    const expectedName = share.expectedGroupName;
+    if (expectedName === null)
+        throw new Error("Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it");
+    const signingKeyPair = share.signingKeyPair;
+    if (!signingKeyPair)
+        throw new Error("Container group share requires principal policy signing context");
+    return input.mutate({
+        groupId: share.recipientGroupId,
+        organizationId: share.author.organizationId,
+        signerUserId: share.author.signerUserId,
+        stillCurrent: share.stillCurrent ?? (() => true),
+    }, async (context) => {
+        await assertCurrentShareGrantName(input.runtime, share, context, expectedName);
+        const request = await buildSetGroupContainerGrantPolicyRequest({
+            ...context,
+            accessLevel: share.accessLevel,
+            containerId: share.containerId,
+            signerUserId: share.author.signerUserId,
+            signingFingerprint: share.author.signerKeyFingerprint,
+            signingKeyPair,
+        });
+        const prepared = {};
+        const response = await commitCurrentGroupPolicyMutation({
+            apiClient: share.apiClient,
+            context,
+            groupId: share.recipientGroupId,
+            organizationId: share.author.organizationId,
+            request,
+            signerUserId: share.author.signerUserId,
+            signingFingerprint: share.author.signerKeyFingerprint,
+            signingKeyPair,
+            resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,
+            prepareContainerMutations: async (nextPolicy) => {
+                prepared.batch = await prepareCurrentShareGrantBatch(share, context, nextPolicy, input.recitationStillCurrent);
+                return prepared.batch;
+            },
+        });
+        const index = prepared.batch?.plans.findIndex((planned) => planned.plan.containerId === share.containerId) ?? -1;
+        const plan = prepared.batch?.plans[index];
+        const acknowledgement = response.containerMutations[index];
+        if (!plan || !acknowledgement || !isSharePlan(plan))
+            throw new Error("Container group share acknowledgement is incomplete");
+        return {
+            containerKey: plan.containerKey,
+            plan: plan.plan,
+            response: acknowledgement,
+        };
+    });
+}
+function isSharePlan(plan) {
+    return plan.plan.body.eventType === "container.grant";
+}
+async function assertCurrentShareGrantName(runtime, share, context, expectedName) {
+    const mismatch = await groupPolicyNameMismatch(context.currentPolicy, expectedName, createRuntimeGroupMetadataAccess(runtime, share.author.organizationId, context.stillCurrent, context.verifyMetadataContainer).readName);
+    if (mismatch)
+        throw new GroupShareNameMismatchError("Container share group name does not match the signed group policy");
+    assertProjectionVerificationCurrent(context.stillCurrent);
+}
+function prepareCurrentShareGrantBatch(share, context, nextPolicy, recitationStillCurrent) {
+    return preparePrincipalContainerRematerializationBatch({
+        ...share,
+        grants: [
+            ...new Map([...context.currentPolicy.currentGrants, ...nextPolicy.grants].map((grant) => [grant.containerId, grant])).values(),
+        ],
+        groupId: share.recipientGroupId,
+        nextPolicy,
+        resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,
+        stillCurrent: context.stillCurrent,
+        recitationStillCurrent,
+    });
+}
+//# sourceMappingURL=currentShareGrantMutation.js.map

package/workflows/containers/child/share/currentShareGrantMutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentShareGrantMutation.js","sourceRoot":"","sources":["currentShareGrantMutation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,wCAAwC,EAAE,MAAM,wDAAwD,CAAC;AAKlH,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAEL,+CAA+C,GAChD,MAAM,8EAA8E,CAAC;AAGtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAErE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,YAAY,KAAK,IAAI;QACvB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CACjB;QACE,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,2BAA2B,CAC/B,KAAK,CAAC,OAAO,EACb,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC7D,GAAG,OAAO;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAEV,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;YACd,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,CAAC,KAAK,GAAG,MAAM,6BAA6B,CAClD,KAAK,EACL,OAAO,EACP,UAAU,EACV,KAAK,CAAC,sBAAsB,CAC7B,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,IAAI,CAAC,CAAC,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAuE;IAEvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAuE,EACvE,KAA0D,EAC1D,OAA2C,EAC3C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,aAAa,EACrB,YAAY,EACZ,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAC;IACJ,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA0D,EAC1D,OAA2C,EAC3C,UAEkB,EAClB,sBAAsC;IAEtC,OAAO,+CAA+C,CAAC;QACrD,GAAG,KAAK;QACR,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,UAAU;QACV,+BAA+B,EAAE,OAAO,CAAC,+BAA+B;QACxE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { MaterializedContainerSharePlan } from \"../../../../data/containers/shared/types\";\nimport { assertProjectionVerificationCurrent } from \"../../../../data/keyingProjectionVerification/types\";\nimport { createRuntimeGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { commitCurrentGroupPolicyMutation } from \"../../../organizations/groupPolicy/commitCurrentGroupPolicyMutation\";\nimport { buildSetGroupContainerGrantPolicyRequest } from \"../../../organizations/groupPolicy/groupPolicyRequests\";\nimport type {\n  createRuntimeCurrentGroupMutation,\n  RuntimeCurrentGroupMutationContext,\n} from \"../../../organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport { groupPolicyNameMismatch } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../../organizations/rematerialization/principalContainerRematerialization\";\nimport type { createRuntimeCurrentSharePrincipalPolicy } from \"./currentSharePrincipalPolicy\";\nimport type { shareRemoteContainerWithGroup } from \"./index\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\n/** Fresh mutation authority rechecks the chosen name before authoring a grant. */\nexport async function commitCurrentShareGrant(input: {\n  readonly runtime: Parameters<\n    typeof createRuntimeCurrentSharePrincipalPolicy\n  >[0];\n  readonly share: Parameters<typeof shareRemoteContainerWithGroup>[0];\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n  readonly mutate: NonNullable<\n    ReturnType<typeof createRuntimeCurrentGroupMutation>\n  >;\n}): ReturnType<typeof shareRemoteContainerWithGroup> {\n  const share = input.share;\n  const expectedName = share.expectedGroupName;\n  if (expectedName === null)\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  const signingKeyPair = share.signingKeyPair;\n  if (!signingKeyPair)\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  return input.mutate(\n    {\n      groupId: share.recipientGroupId,\n      organizationId: share.author.organizationId,\n      signerUserId: share.author.signerUserId,\n      stillCurrent: share.stillCurrent ?? (() => true),\n    },\n    async (context) => {\n      await assertCurrentShareGrantName(\n        input.runtime,\n        share,\n        context,\n        expectedName,\n      );\n      const request = await buildSetGroupContainerGrantPolicyRequest({\n        ...context,\n        accessLevel: share.accessLevel,\n        containerId: share.containerId,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n      });\n      const prepared: {\n        batch?: PreparedPrincipalContainerRematerializationBatch;\n      } = {};\n      const response = await commitCurrentGroupPolicyMutation({\n        apiClient: share.apiClient,\n        context,\n        groupId: share.recipientGroupId,\n        organizationId: share.author.organizationId,\n        request,\n        signerUserId: share.author.signerUserId,\n        signingFingerprint: share.author.signerKeyFingerprint,\n        signingKeyPair,\n        resolveTrustedUserIdentity: share.resolveTrustedUserIdentity,\n        prepareContainerMutations: async (nextPolicy) => {\n          prepared.batch = await prepareCurrentShareGrantBatch(\n            share,\n            context,\n            nextPolicy,\n            input.recitationStillCurrent,\n          );\n          return prepared.batch;\n        },\n      });\n      const index =\n        prepared.batch?.plans.findIndex(\n          (planned) => planned.plan.containerId === share.containerId,\n        ) ?? -1;\n      const plan = prepared.batch?.plans[index];\n      const acknowledgement = response.containerMutations[index];\n      if (!plan || !acknowledgement || !isSharePlan(plan))\n        throw new Error(\"Container group share acknowledgement is incomplete\");\n      return {\n        containerKey: plan.containerKey,\n        plan: plan.plan,\n        response: acknowledgement,\n      };\n    },\n  );\n}\n\nfunction isSharePlan(\n  plan: PreparedPrincipalContainerRematerializationBatch[\"plans\"][number],\n): plan is MaterializedContainerSharePlan {\n  return plan.plan.body.eventType === \"container.grant\";\n}\n\nasync function assertCurrentShareGrantName(\n  runtime: Parameters<typeof createRuntimeCurrentSharePrincipalPolicy>[0],\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  expectedName: string,\n) {\n  const mismatch = await groupPolicyNameMismatch(\n    context.currentPolicy,\n    expectedName,\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      share.author.organizationId,\n      context.stillCurrent,\n      context.verifyMetadataContainer,\n    ).readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      \"Container share group name does not match the signed group policy\",\n    );\n  assertProjectionVerificationCurrent(context.stillCurrent);\n}\n\nfunction prepareCurrentShareGrantBatch(\n  share: Parameters<typeof shareRemoteContainerWithGroup>[0],\n  context: RuntimeCurrentGroupMutationContext,\n  nextPolicy: Parameters<\n    typeof preparePrincipalContainerRematerializationBatch\n  >[0][\"nextPolicy\"],\n  recitationStillCurrent?: () => boolean,\n) {\n  return preparePrincipalContainerRematerializationBatch({\n    ...share,\n    grants: [\n      ...new Map(\n        [...context.currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: share.recipientGroupId,\n    nextPolicy,\n    resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,\n    stillCurrent: context.stillCurrent,\n    recitationStillCurrent,\n  });\n}\n"]}

package/workflows/containers/child/share/currentSharePrincipalPolicy.js

@@ -0,0 +1,83 @@
+import { KeyingVerificationError, } from "../../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js";
+import { principalHeadMatchesReference } from "../../../../data/principals/organizationAuthorityDescriptor.js";
+import { loadCurrentOrganizationAuthority } from "../../../organizations/currentOrganizationAuthority.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../../organizations/groupMetadata/currentGroupMetadataAuthority.js";
+import { assertGroupMetadataBinding } from "../../../organizations/groupMetadata/groupMetadataBinding.js";
+import { createRuntimeGroupMetadataAccess } from "../../../organizations/groupMetadata/groupMetadataRuntime.js";
+import { createCurrentPrincipalMutationLease } from "../../../organizations/principalMutations/currentPrincipalMutationLease.js";
+import { groupPolicyNameMismatch, } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { GroupShareNameMismatchError } from "./sharePrincipalPolicy.js";
+/** A share read need not be a group administrator; minting a grant checks that separately. */
+export function createRuntimeCurrentSharePrincipalPolicy(runtime) {
+    const lease = createCurrentPrincipalMutationLease(runtime);
+    if (!lease)
+        return undefined;
+    return async (input, work) => {
+        input = {
+            ...input,
+            expectedGroupHead: input.expectedGroupHead
+                ? { ...input.expectedGroupHead }
+                : undefined,
+        };
+        return lease(input.stillCurrent, async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {
+            await runtime.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
+            assertProjectionVerificationCurrent(leaseCurrent);
+            const authority = await loadCurrentOrganizationAuthority({
+                execSql: runtime.infra.execSql,
+                organizationId: input.organizationId,
+                resolveCurrentPolicy,
+                stillCurrent: leaseCurrent,
+            });
+            const group = await authority.readGroup(input.groupId);
+            const stillCurrent = () => leaseCurrent() && authority.stillCurrent() && group.stillCurrent();
+            assertProjectionVerificationCurrent(stillCurrent);
+            if (input.expectedGroupHead &&
+                !principalHeadMatchesReference(group.policy.state, input.expectedGroupHead))
+                throw new KeyingVerificationError("object_mismatch", "Container share expected group head conflicts with the signed organization directory");
+            assertGroupMetadataBinding(group.current, authority.descriptor);
+            await assertCurrentShareName({
+                runtime,
+                input,
+                authority,
+                group,
+                stillCurrent,
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            const checkpointPolicies = [...group.dependencies, group.policy];
+            await advanceKeyingCheckpointsAtomically({
+                access: [],
+                execSql: runtime.infra.execSql,
+                organizationId: input.organizationId,
+                policies: checkpointPolicies,
+                stillCurrent,
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            const result = await work({
+                current: group.current,
+                policy: group.policy,
+                checkpointPolicies,
+                stillCurrent,
+            });
+            assertProjectionVerificationCurrent(stillCurrent);
+            return result;
+        });
+    };
+}
+async function assertCurrentShareName({ runtime, input, authority, group, stillCurrent, }) {
+    if (input.expectedGroupName === undefined)
+        return;
+    const readName = input.readEncryptedName ??
+        createRuntimeGroupMetadataAccess(runtime, input.organizationId, stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
+            authority,
+            organizationId: input.organizationId,
+            stillCurrent,
+        })).readName;
+    const mismatch = await groupPolicyNameMismatch(group.current, input.expectedGroupName, readName);
+    if (mismatch)
+        throw new GroupShareNameMismatchError(mismatch === "forbidden_characters"
+            ? "Container share group name contains control or format characters"
+            : "Container share group name does not match the signed group policy");
+}
+//# sourceMappingURL=currentSharePrincipalPolicy.js.map

package/workflows/containers/child/share/currentSharePrincipalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentSharePrincipalPolicy.js","sourceRoot":"","sources":["currentSharePrincipalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,mFAAmF,CAAC;AACvI,OAAO,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC5G,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,EAAE,mDAAmD,EAAE,MAAM,oEAAoE,CAAC;AACzI,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,mCAAmC,EAAE,MAAM,yEAAyE,CAAC;AAE9H,OAAO,EAEL,uBAAuB,GACxB,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAoCrE,8FAA8F;AAC9F,MAAM,UAAU,wCAAwC,CACtD,OAA4B;IAE5B,MAAM,KAAK,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,EACV,KAAwB,EACxB,IAAyD,EAC7C,EAAE;QACd,KAAK,GAAG;YACN,GAAG,KAAK;YACR,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBACxC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE;gBAChC,CAAC,CAAC,SAAS;SACd,CAAC;QACF,OAAO,KAAK,CACV,KAAK,CAAC,YAAY,EAClB,KAAK,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;YAC7D,MAAM,OAAO,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACvD,KAAK,CAAC,cAAc,CACrB,CAAC;YACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;gBACvD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,oBAAoB;gBACpB,YAAY,EAAE,YAAY;aAC3B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrE,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,IACE,KAAK,CAAC,iBAAiB;gBACvB,CAAC,6BAA6B,CAC5B,KAAK,CAAC,MAAM,CAAC,KAAK,EAClB,KAAK,CAAC,iBAAiB,CACxB;gBAED,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,sFAAsF,CACvF,CAAC;YACJ,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,KAAK;gBACL,SAAS;gBACT,KAAK;gBACL,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,kBAAkB,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,kCAAkC,CAAC;gBACvC,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,kBAAkB;gBAClB,YAAY;aACb,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,SAAS,EACT,KAAK,EACL,YAAY,GAOb;IACC,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,iBAAiB;QACvB,gCAAgC,CAC9B,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,YAAY,EACZ,mDAAmD,CAAC;YAClD,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY;SACb,CAAC,CACH,CAAC,QAAQ,CAAC;IACb,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,QAAQ;QACV,MAAM,IAAI,2BAA2B,CACnC,QAAQ,KAAK,sBAAsB;YACjC,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,mEAAmE,CACxE,CAAC;AACN,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../../data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence\";\nimport { principalHeadMatchesReference } from \"../../../../data/principals/organizationAuthorityDescriptor\";\nimport { loadCurrentOrganizationAuthority } from \"../../../organizations/currentOrganizationAuthority\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../../organizations/groupMetadata/currentGroupMetadataAuthority\";\nimport { assertGroupMetadataBinding } from \"../../../organizations/groupMetadata/groupMetadataBinding\";\nimport { createRuntimeGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createCurrentPrincipalMutationLease } from \"../../../organizations/principalMutations/currentPrincipalMutationLease\";\nimport type { PrincipalMutationRecoveryApi } from \"../../../organizations/principalMutations/principalMutationJournalManagement\";\nimport {\n  type GroupPolicyNameReader,\n  groupPolicyNameMismatch,\n} from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport { GroupShareNameMismatchError } from \"./sharePrincipalPolicy\";\n\ntype CurrentShareRuntime = Parameters<\n  typeof createRuntimeGroupMetadataAccess\n>[0] &\n  Parameters<typeof createCurrentPrincipalMutationLease>[0] & {\n    readonly apiClient: {\n      readonly recoverPendingPrincipalMutation?:\n        | PrincipalMutationRecoveryApi[\"recoverPendingPrincipalMutation\"]\n        | undefined;\n    };\n  };\n\ninterface CurrentShareInput {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly expectedGroupHead?: ReferencedPrincipalHead | undefined;\n  readonly expectedGroupName?: string | undefined;\n  /** Trusted internal reader; it must authenticate the signed metadata container. */\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly stillCurrent: () => boolean;\n}\n\ntype CurrentGroup = Awaited<\n  ReturnType<\n    Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>[\"readGroup\"]\n  >\n>;\n\nexport interface CurrentSharePrincipalPolicy {\n  readonly current: CurrentGroup[\"current\"];\n  readonly policy: CurrentGroup[\"policy\"];\n  readonly checkpointPolicies: readonly CurrentGroup[\"policy\"][];\n  readonly stillCurrent: () => boolean;\n}\n\n/** A share read need not be a group administrator; minting a grant checks that separately. */\nexport function createRuntimeCurrentSharePrincipalPolicy(\n  runtime: CurrentShareRuntime,\n) {\n  const lease = createCurrentPrincipalMutationLease(runtime);\n  if (!lease) return undefined;\n  return async <T>(\n    input: CurrentShareInput,\n    work: (policy: CurrentSharePrincipalPolicy) => Promise<T>,\n  ): Promise<T> => {\n    input = {\n      ...input,\n      expectedGroupHead: input.expectedGroupHead\n        ? { ...input.expectedGroupHead }\n        : undefined,\n    };\n    return lease(\n      input.stillCurrent,\n      async ({ resolveCurrentPolicy, stillCurrent: leaseCurrent }) => {\n        await runtime.apiClient.recoverPendingPrincipalMutation?.(\n          input.organizationId,\n        );\n        assertProjectionVerificationCurrent(leaseCurrent);\n        const authority = await loadCurrentOrganizationAuthority({\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          resolveCurrentPolicy,\n          stillCurrent: leaseCurrent,\n        });\n        const group = await authority.readGroup(input.groupId);\n        const stillCurrent = () =>\n          leaseCurrent() && authority.stillCurrent() && group.stillCurrent();\n        assertProjectionVerificationCurrent(stillCurrent);\n        if (\n          input.expectedGroupHead &&\n          !principalHeadMatchesReference(\n            group.policy.state,\n            input.expectedGroupHead,\n          )\n        )\n          throw new KeyingVerificationError(\n            \"object_mismatch\",\n            \"Container share expected group head conflicts with the signed organization directory\",\n          );\n        assertGroupMetadataBinding(group.current, authority.descriptor);\n        await assertCurrentShareName({\n          runtime,\n          input,\n          authority,\n          group,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const checkpointPolicies = [...group.dependencies, group.policy];\n        await advanceKeyingCheckpointsAtomically({\n          access: [],\n          execSql: runtime.infra.execSql,\n          organizationId: input.organizationId,\n          policies: checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        const result = await work({\n          current: group.current,\n          policy: group.policy,\n          checkpointPolicies,\n          stillCurrent,\n        });\n        assertProjectionVerificationCurrent(stillCurrent);\n        return result;\n      },\n    );\n  };\n}\n\nasync function assertCurrentShareName({\n  runtime,\n  input,\n  authority,\n  group,\n  stillCurrent,\n}: {\n  runtime: CurrentShareRuntime;\n  input: CurrentShareInput;\n  authority: Awaited<ReturnType<typeof loadCurrentOrganizationAuthority>>;\n  group: CurrentGroup;\n  stillCurrent: () => boolean;\n}) {\n  if (input.expectedGroupName === undefined) return;\n  const readName =\n    input.readEncryptedName ??\n    createRuntimeGroupMetadataAccess(\n      runtime,\n      input.organizationId,\n      stillCurrent,\n      createSelectedCurrentGroupMetadataContainerVerifier({\n        authority,\n        organizationId: input.organizationId,\n        stillCurrent,\n      }),\n    ).readName;\n  const mismatch = await groupPolicyNameMismatch(\n    group.current,\n    input.expectedGroupName,\n    readName,\n  );\n  if (mismatch)\n    throw new GroupShareNameMismatchError(\n      mismatch === \"forbidden_characters\"\n        ? \"Container share group name contains control or format characters\"\n        : \"Container share group name does not match the signed group policy\",\n    );\n}\n"]}

package/workflows/containers/child/share/index.d.ts

@@ -0,0 +1,65 @@
+import type { ContainerAccessLevel, SigningKeyPair } from "../../../../internal/crypto/index.js";
+import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, ContainerShareApi, ContainerSharePlan } from "../../../../data/containers/shared/types.js";
+import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+import { type TrustedUserIdentityResolver } from "../../../../data/trustedUserIdentity/index.js";
+import type { GroupPolicyNameReader } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
+import { type ContainerManagedPrincipalShareApi } from "./sharePrincipalPolicy.js";
+export declare function shareRemoteContainer(input: {
+    reportSecurityIncident: SecurityIncidentReporter;
+    accessLevel: ContainerAccessLevel;
+    apiClient: ContainerShareApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    previousProjection?: ContainerWriterProjectionResponse | undefined;
+    recipientUserId: string;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    signedAt?: string | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<{
+    containerKey: Uint8Array;
+    plan: ContainerSharePlan;
+    response: ContainerMutationResponse;
+} | null>;
+interface RemoteContainerGroupShareInput {
+    reportSecurityIncident: SecurityIncidentReporter;
+    accessLevel: ContainerAccessLevel;
+    apiClient: ContainerManagedPrincipalShareApi;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    eventId?: string | undefined;
+    execSql: ExecSql;
+    /**
+     * The display name the user chose the group by, checked against the name
+     * committed in the verified group policy so a relabeled read-model row
+     * cannot redirect the share onto another group. `null` is reserved for the
+     * grant-preserving re-wrap: a share that would mint a new grant without a
+     * name is refused.
+     */
+    expectedGroupName: string | null;
+    readEncryptedName?: GroupPolicyNameReader | undefined;
+    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    previousProjection?: ContainerWriterProjectionResponse | undefined;
+    recipientGroupId: string;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    signedAt?: string | undefined;
+    signingKeyPair?: SigningKeyPair | null | undefined;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+interface RemoteContainerGroupShareResult {
+    containerKey: Uint8Array;
+    plan: ContainerSharePlan;
+    response: ContainerMutationResponse;
+}
+export declare function shareRemoteContainerWithGroup(input: RemoteContainerGroupShareInput): Promise<RemoteContainerGroupShareResult | null>;
+export {};