@tearleads/client-sdk 0.1.74 → 0.1.76

package/workflows/containers/child/rekey/carriedDescendantRekeys.d.ts

@@ -0,0 +1,70 @@
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, ContainerRekeyApi, MaterializedContainerRekeyPlan } from "../../../../data/containers/shared/types.js";
+import { type PrincipalPolicyCache, type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { CurrentPolicyReferenceResolver } from "../../../../data/principals/currentPolicyReferenceResolver.js";
+import type { PrincipalPolicyCurrentEvidence } from "../../../../data/principals/principalPolicyEvidence.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+/** What a rotation needs in hand to sign the descendant rekeys it must carry. */
+export interface CarriedRekeyPlanningInput {
+    readonly apiClient: Pick<ContainerRekeyApi, "getContainerWriterProjection">;
+    readonly author: ContainerMutationAuthor;
+    readonly execSql: ExecSql;
+    /**
+     * Keys the batch minted and has yet to commit, by epoch id. A rotation's
+     * successor is wrapped to recipients at heads the batch itself commits, so
+     * no wrap on a re-rooted path opens it for the signer before then; the key
+     * the signer just minted does, and its keyring then opens what sits below.
+     */
+    readonly knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    /**
+     * Verified policies the batch itself commits, which the rebased paths cite
+     * before any store holds them; and the one each carried rekey cites anew.
+     */
+    readonly principalPolicyCache?: PrincipalPolicyCache | undefined;
+    readonly replacementPrincipalPolicy?: PrincipalPolicyCurrentEvidence | undefined;
+    readonly resolveAuthoredPolicyReferences?: CurrentPolicyReferenceResolver | undefined;
+    readonly resolveProjectionUserKey: ProjectionUserKeyResolver;
+    readonly stillCurrent?: (() => boolean) | undefined;
+    readonly targetSecretKey: Uint8Array;
+    readonly warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}
+/** A rotated container's own path once its batch is accepted. */
+export type SpeculativePath = Pick<ContainerWriterProjectionResponse, "containerKeks" | "organizationId" | "path" | "policyEvidence">;
+/**
+ * Re-root a served projection on the deepest not-yet-accepted proper ancestor
+ * among `speculativePaths`. Each carried plan's own path was built the same
+ * way, so the deepest one already holds every speculative level above it. The
+ * container's own path, when the batch rotates it too, is not an ancestor: the
+ * caller is re-planning that rotation, and it extends what sits above.
+ */
+export declare function rebaseOnDeepestAncestor(served: ContainerWriterProjectionResponse, speculativePaths: readonly SpeculativePath[]): {
+    ancestor: SpeculativePath;
+    projection: ContainerWriterProjectionResponse;
+} | null;
+/**
+ * Sign one carried rekey against the path its batch will leave behind. The
+ * served projection is fetched by the caller; here it is verified, must sit
+ * below one of the rotated containers and in that container's organization,
+ * and is signed only if this signer holds its key and write access — which a
+ * member able to rotate the ancestor always does, since both inherit downward.
+ */
+export declare function planCarriedDescendantRekey(input: CarriedRekeyPlanningInput & {
+    readonly rotated: readonly SpeculativePath[];
+    readonly served: ContainerWriterProjectionResponse;
+}): Promise<MaterializedContainerRekeyPlan>;
+/**
+ * Sign the descendant rekeys a rotation must commit with (#2340). The server
+ * refuses a rotation that would leave a level above a directly granted
+ * container pinned to a retired epoch, because the grantee could never re-key
+ * that level itself and its writes would wait on another device. It names the
+ * levels; this signs them, parent-first, each against the path the batch will
+ * leave behind rather than the one currently served.
+ *
+ * `requiredContainerIds` is a hint, never an authority: each container is
+ * fetched and verified here, and refused unless it sits below a rotation.
+ */
+export declare function planCarriedDescendantRekeys(input: CarriedRekeyPlanningInput & {
+    readonly requiredContainerIds: readonly string[];
+    /** Each rotated container's own path once the batch is accepted. */
+    readonly rotated: readonly SpeculativePath[];
+}): Promise<MaterializedContainerRekeyPlan[]>;

package/workflows/containers/child/share/index.d.ts

@@ -1,12 +1,10 @@
-import type { ContainerAccessLevel, SigningKeyPair } from "../../../../internal/crypto/index.js";
+import type { ContainerAccessLevel } from "../../../../internal/crypto/index.js";
 import type { ContainerMutationResponse, ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
 import type { ContainerMutationAuthor, ContainerShareApi, ContainerSharePlan } from "../../../../data/containers/shared/types.js";
 import { type ProjectionUserKeyResolver, type ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
 import type { SecurityIncidentReporter } from "../../../../data/shared/securityIncidents.js";
 import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
 import { type TrustedUserIdentityResolver } from "../../../../data/trustedUserIdentity/index.js";
-import type { GroupPolicyNameReader } from "../../../organizations/principalPolicy/principalPolicyRequest.js";
-import { type ContainerManagedPrincipalShareApi } from "./sharePrincipalPolicy.js";
 export declare function shareRemoteContainer(input: {
     reportSecurityIncident: SecurityIncidentReporter;
     accessLevel: ContainerAccessLevel;
@@ -28,38 +26,3 @@ export declare function shareRemoteContainer(input: {
     plan: ContainerSharePlan;
     response: ContainerMutationResponse;
 } | null>;
-interface RemoteContainerGroupShareInput {
-    reportSecurityIncident: SecurityIncidentReporter;
-    accessLevel: ContainerAccessLevel;
-    apiClient: ContainerManagedPrincipalShareApi;
-    author: ContainerMutationAuthor;
-    containerId: string;
-    eventId?: string | undefined;
-    execSql: ExecSql;
-    /**
-     * The display name the user chose the group by, checked against the name
-     * committed in the verified group policy so a relabeled read-model row
-     * cannot redirect the share onto another group. `null` is reserved for the
-     * grant-preserving re-wrap: a share that would mint a new grant without a
-     * name is refused.
-     */
-    expectedGroupName: string | null;
-    readEncryptedName?: GroupPolicyNameReader | undefined;
-    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
-    previousProjection?: ContainerWriterProjectionResponse | undefined;
-    recipientGroupId: string;
-    resolveProjectionUserKey: ProjectionUserKeyResolver;
-    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
-    signedAt?: string | undefined;
-    signingKeyPair?: SigningKeyPair | null | undefined;
-    stillCurrent?: (() => boolean) | undefined;
-    targetSecretKey: Uint8Array;
-    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
-}
-interface RemoteContainerGroupShareResult {
-    containerKey: Uint8Array;
-    plan: ContainerSharePlan;
-    response: ContainerMutationResponse;
-}
-export declare function shareRemoteContainerWithGroup(input: RemoteContainerGroupShareInput): Promise<RemoteContainerGroupShareResult | null>;
-export {};

package/workflows/containers/child/share/index.js

@@ -1,17 +1,8 @@
-import { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
-import { principalPolicyCacheForVerifiedPolicies } from "../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
-import { savePrincipalPolicyBundle } from "../../../../data/persistence/principalPolicy/principalPolicyPersistence.js";
+import { nullOnProjectionVerificationCancellation, requireProjectionUserKeyResolver, } from "../../../../data/keyingProjectionVerification/index.js";
 import { requireTrustedUserIdentityResolver, } from "../../../../data/trustedUserIdentity/index.js";
-import { createGroupMetadataAccess } from "../../../organizations/groupMetadata/groupMetadataAccess.js";
-import { createGroupMetadataContainerVerifier } from "../../../organizations/groupMetadata/groupMetadataContainerAuthority.js";
-import { setOrganizationGroupContainerGrant } from "../../../organizations/principalPolicy/index.js";
-import { preparePrincipalContainerRematerializationBatch } from "../../../organizations/rematerialization/principalContainerRematerialization.js";
 import { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "../mutationSubmit.js";
 import { buildMaterializedContainerSharePlan } from "./shareMaterialization.js";
-import { advanceVerifiedSharePolicies, loadVerifiedGroupSharePrincipalPolicy, } from "./sharePrincipalPolicy.js";
 import { resolveShareProjection } from "./shareProjection.js";
-class ContainerShareGenerationExpiredError extends Error {
-}
 async function buildCurrentContainerSharePlan(input) {
     return nullOnProjectionVerificationCancellation(() => buildMaterializedContainerSharePlan(input));
 }
@@ -58,199 +49,4 @@ export async function shareRemoteContainer(input) {
         })),
     });
 }
-function isMaterializedContainerSharePlan(value) {
-    return value.plan.body.eventType === "container.grant";
-}
-async function prepareMissingGroupGrantMutations(input) {
-    const { currentPolicy, nextPolicy, shareInput } = input;
-    return preparePrincipalContainerRematerializationBatch({
-        reportSecurityIncident: shareInput.reportSecurityIncident,
-        apiClient: shareInput.apiClient,
-        author: shareInput.author,
-        execSql: shareInput.execSql,
-        grants: [
-            ...new Map([...currentPolicy.currentGrants, ...nextPolicy.grants].map((grant) => [grant.containerId, grant])).values(),
-        ],
-        groupId: shareInput.recipientGroupId,
-        nextPolicy,
-        resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,
-        stillCurrent: shareInput.stillCurrent,
-        targetSecretKey: shareInput.targetSecretKey,
-        warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,
-    });
-}
-async function commitMissingGroupGrantPolicy(input) {
-    const signingKeyPair = input.signingKeyPair;
-    if (!signingKeyPair) {
-        throw new Error("Container group share requires principal policy signing context");
-    }
-    const policyApi = {
-        recoverPendingPrincipalMutation: input.apiClient.recoverPendingPrincipalMutation?.bind(input.apiClient),
-        commitOrganizationGroupPolicy: input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),
-        getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(input.apiClient),
-    };
-    let preparedTarget;
-    try {
-        const storedPolicy = await setOrganizationGroupContainerGrant({
-            accessLevel: input.accessLevel,
-            apiClient: policyApi,
-            assertCanCommit: () => {
-                if (input.stillCurrent?.() === false) {
-                    throw new ContainerShareGenerationExpiredError();
-                }
-            },
-            containerId: input.containerId,
-            execSql: input.execSql,
-            groupId: input.recipientGroupId,
-            organizationId: input.author.organizationId,
-            prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {
-                preparedTarget = await prepareMissingGroupGrantMutations({
-                    currentPolicy,
-                    nextPolicy,
-                    shareInput: input,
-                });
-                return preparedTarget;
-            },
-            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-            signerUserId: input.author.signerUserId,
-            signingFingerprint: input.author.signerKeyFingerprint,
-            signingKeyPair,
-        });
-        if (!preparedTarget) {
-            throw new Error("Container group share preparation is incomplete");
-        }
-        return { preparedTarget, storedPolicy };
-    }
-    catch (error) {
-        if (error instanceof ContainerShareGenerationExpiredError ||
-            isProjectionVerificationCancelledError(error)) {
-            return null;
-        }
-        throw error;
-    }
-}
-async function commitMissingGroupGrant(input) {
-    if (!input.signingKeyPair) {
-        throw new Error("Container group share requires principal policy signing context");
-    }
-    if (input.stillCurrent?.() === false)
-        return null;
-    const committed = await commitMissingGroupGrantPolicy(input);
-    if (!committed)
-        return null;
-    const { preparedTarget, storedPolicy } = committed;
-    const targetIndex = preparedTarget?.plans.findIndex((planned) => planned.plan.containerId === input.containerId);
-    const response = targetIndex === undefined || targetIndex < 0
-        ? undefined
-        : storedPolicy.containerMutations[targetIndex];
-    const targetPlan = targetIndex === undefined || targetIndex < 0
-        ? undefined
-        : preparedTarget?.plans[targetIndex];
-    if (!targetPlan ||
-        !response ||
-        !isMaterializedContainerSharePlan(targetPlan)) {
-        throw new Error("Container group share acknowledgement is incomplete");
-    }
-    return {
-        containerKey: targetPlan.containerKey,
-        plan: targetPlan.plan,
-        response,
-    };
-}
-// Only a re-wrap of an existing signed grant may run without the chosen name;
-// minting a grant is exactly the operation the name binding protects.
-function assertGrantMintNamed(expectedGroupName) {
-    if (expectedGroupName === null) {
-        throw new Error("Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it");
-    }
-}
-function loadShareGroupPolicy(input) {
-    return loadVerifiedGroupSharePrincipalPolicy({
-        apiClient: input.apiClient,
-        execSql: input.execSql,
-        expectedGroupName: input.expectedGroupName ?? undefined,
-        readEncryptedName: input.readEncryptedName ??
-            createGroupMetadataAccess({
-                ...input,
-                organizationId: input.author.organizationId,
-                verifyMetadataContainer: createGroupMetadataContainerVerifier({
-                    ...input,
-                    organizationId: input.author.organizationId,
-                    stillCurrent: input.stillCurrent ?? (() => true),
-                }),
-            }).readName,
-        groupId: input.recipientGroupId,
-        organizationId: input.author.organizationId,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        stillCurrent: input.stillCurrent,
-    });
-}
-export async function shareRemoteContainerWithGroup(input) {
-    if (input.stillCurrent?.() === false)
-        return null;
-    await input.apiClient.recoverPendingPrincipalMutation?.(input.author.organizationId);
-    if (input.stillCurrent?.() === false)
-        return null;
-    const resolveProjectionUserKey = requireProjectionUserKeyResolver(input.resolveProjectionUserKey, "Remote container share");
-    const previousProjection = await resolveShareProjection(input, resolveProjectionUserKey);
-    if (!previousProjection)
-        return null;
-    const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);
-    if (input.stillCurrent?.() === false)
-        return null;
-    await advanceVerifiedSharePolicies(input.execSql, verifiedPrincipalPolicy, input.stillCurrent);
-    if (input.stillCurrent?.() === false)
-        return null;
-    const signedGrant = verifiedPrincipalPolicy.policy.grants.find((grant) => grant.containerId === input.containerId);
-    if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {
-        assertGrantMintNamed(input.expectedGroupName);
-        return commitMissingGroupGrant(input);
-    }
-    const materializedPlan = await buildCurrentContainerSharePlan({
-        accessLevel: input.accessLevel,
-        author: input.author,
-        eventId: input.eventId,
-        execSql: input.execSql,
-        knownContainerKeks: input.knownContainerKeks,
-        principalPolicyCache: principalPolicyCacheForVerifiedPolicies(verifiedPrincipalPolicy.checkpointPolicies),
-        previousProjection,
-        recipient: {
-            principalPolicy: verifiedPrincipalPolicy.policy,
-            subjectId: input.recipientGroupId,
-            subjectType: "group",
-        },
-        resolveProjectionUserKey,
-        signedAt: input.signedAt,
-        stillCurrent: input.stillCurrent,
-        targetSecretKey: input.targetSecretKey,
-        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
-    });
-    if (!materializedPlan)
-        return null;
-    const result = await submitAcknowledgedContainerMutation({
-        reportSecurityIncident: input.reportSecurityIncident,
-        recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,
-        apiClient: input.apiClient,
-        author: input.author,
-        containerKey: materializedPlan.containerKey,
-        execSql: input.execSql,
-        plan: materializedPlan.plan,
-        stillCurrent: input.stillCurrent,
-        submit: () => submitPlainContainerMutation(() => input.apiClient.shareContainer(input.containerId, materializedPlan.plan.request, {
-            expectedPaymentRequiredOrganizationId: input.author.organizationId,
-        })),
-    });
-    if (!result)
-        return null;
-    // Keep the previously cached group epoch available until the old container
-    // wrap has been unwrapped and the replacement has committed. Root has no
-    // parent fallback, so caching the rotated policy any earlier destroys the
-    // only local path to the KEK that must be re-wrapped.
-    if (input.stillCurrent?.() !== false) {
-        await savePrincipalPolicyBundle(input.execSql, verifiedPrincipalPolicy.bundle, new Date().toISOString(), input.author.organizationId, { stillCurrent: input.stillCurrent });
-    }
-    if (input.stillCurrent?.() === false)
-        return null;
-    return result;
-}
 //# sourceMappingURL=index.js.map

package/workflows/containers/child/share/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,sCAAsC,EACtC,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AAGpH,OAAO,EACL,kCAAkC,GAEnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,sEAAsE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAAE,+CAA+C,EAAE,MAAM,8EAA8E,CAAC;AAC/I,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAE5B,qCAAqC,GACtC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,oCAAqC,SAAQ,KAAK;CAAG;AAE3D,KAAK,UAAU,8BAA8B,CAC3C,KAAgE;IAEhE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,mCAAmC,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAgB1C;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,SAAS,EAAE;YACT,+BAA+B,EAAE,iBAAiB,CAAC,sBAAsB;YACzE,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,WAAW,EAAE,MAAM;SACpB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;AACL,CAAC;AAqCD,SAAS,gCAAgC,CACvC,KAEkB;IAElB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAIhD;IACC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,+CAA+C,CAAC;QACrD,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACxD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,UAAU,CAAC,gBAAgB;QACpC,UAAU;QACV,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,KAAqC;IAOrC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,+BAA+B,EAC7B,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACxE,6BAA6B,EAC3B,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACrE,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CACvE,KAAK,CAAC,SAAS,CAChB;KACF,CAAC;IACF,IAAI,cAIS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;YAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,GAAG,EAAE;gBACpB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;oBACrC,MAAM,IAAI,oCAAoC,EAAE,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,yBAAyB,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;gBACjE,cAAc,GAAG,MAAM,iCAAiC,CAAC;oBACvD,aAAa;oBACb,UAAU;oBACV,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACrD,cAAc;SACf,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,oCAAoC;YACrD,sCAAsC,CAAC,KAAK,CAAC,EAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACnD,MAAM,WAAW,GAAG,cAAc,EAAE,KAAK,CAAC,SAAS,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC5D,CAAC;IACF,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,UAAU,GACd,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,IACE,CAAC,UAAU;QACX,CAAC,QAAQ;QACT,CAAC,gCAAgC,CAAC,UAAU,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,iBAAgC;IAC5D,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAqC;IACjE,OAAO,qCAAqC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;QACvD,iBAAiB,EACf,KAAK,CAAC,iBAAiB;YACvB,yBAAyB,CAAC;gBACxB,GAAG,KAAK;gBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,uBAAuB,EAAE,oCAAoC,CAAC;oBAC5D,GAAG,KAAK;oBACR,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;oBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;iBACjD,CAAC;aACH,CAAC,CAAC,QAAQ;QACb,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAqC;IAErC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CACrD,KAAK,CAAC,MAAM,CAAC,cAAc,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,uBAAuB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,4BAA4B,CAChC,KAAK,CAAC,OAAO,EACb,uBAAuB,EACvB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,oBAAoB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9C,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,uCAAuC,CAC3D,uBAAuB,CAAC,kBAAkB,CAC3C;QACD,kBAAkB;QAClB,SAAS,EAAE;YACT,eAAe,EAAE,uBAAuB,CAAC,MAAM;YAC/C,SAAS,EAAE,KAAK,CAAC,gBAAgB;YACjC,WAAW,EAAE,OAAO;SACrB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;QACvD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,uBAAuB,CAAC,kBAAkB;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,sDAAsD;IACtD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,uBAAuB,CAAC,MAAM,EAC9B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  ContainerAccessLevel,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerShareApi,\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { savePrincipalPolicyBundle } from \"../../../../data/persistence/principalPolicy/principalPolicyPersistence\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../../../data/trustedUserIdentity\";\nimport { createGroupMetadataAccess } from \"../../../organizations/groupMetadata/groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"../../../organizations/groupMetadata/groupMetadataContainerAuthority\";\nimport { setOrganizationGroupContainerGrant } from \"../../../organizations/principalPolicy\";\nimport type { GroupPolicyNameReader } from \"../../../organizations/principalPolicy/principalPolicyRequest\";\nimport { preparePrincipalContainerRematerializationBatch } from \"../../../organizations/rematerialization/principalContainerRematerialization\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"../mutationSubmit\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport {\n  advanceVerifiedSharePolicies,\n  type ContainerManagedPrincipalShareApi,\n  loadVerifiedGroupSharePrincipalPolicy,\n} from \"./sharePrincipalPolicy\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\nclass ContainerShareGenerationExpiredError extends Error {}\n\nasync function buildCurrentContainerSharePlan(\n  input: Parameters<typeof buildMaterializedContainerSharePlan>[0],\n): Promise<MaterializedContainerSharePlan | null> {\n  return nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerSharePlan(input),\n  );\n}\n\nexport async function shareRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const recipientIdentity = await resolveTrustedUserIdentity(\n    input.recipientUserId,\n  );\n  if (!recipientIdentity || input.stillCurrent?.() === false) {\n    return null;\n  }\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    recipient: {\n      recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,\n      subjectId: input.recipientUserId,\n      subjectType: \"user\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n}\n\ninterface RemoteContainerGroupShareInput {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerManagedPrincipalShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  /**\n   * The display name the user chose the group by, checked against the name\n   * committed in the verified group policy so a relabeled read-model row\n   * cannot redirect the share onto another group. `null` is reserved for the\n   * grant-preserving re-wrap: a share that would mint a new grant without a\n   * name is refused.\n   */\n  expectedGroupName: string | null;\n  readEncryptedName?: GroupPolicyNameReader | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}\n\ninterface RemoteContainerGroupShareResult {\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n}\n\nfunction isMaterializedContainerSharePlan(\n  value: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >[\"plans\"][number],\n): value is MaterializedContainerSharePlan {\n  return value.plan.body.eventType === \"container.grant\";\n}\n\nasync function prepareMissingGroupGrantMutations(input: {\n  currentPolicy: PrincipalPolicyBundleResponse;\n  nextPolicy: VerifiedPrincipalPolicy;\n  shareInput: RemoteContainerGroupShareInput;\n}) {\n  const { currentPolicy, nextPolicy, shareInput } = input;\n  return preparePrincipalContainerRematerializationBatch({\n    reportSecurityIncident: shareInput.reportSecurityIncident,\n    apiClient: shareInput.apiClient,\n    author: shareInput.author,\n    execSql: shareInput.execSql,\n    grants: [\n      ...new Map(\n        [...currentPolicy.currentGrants, ...nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: shareInput.recipientGroupId,\n    nextPolicy,\n    resolveTrustedUserIdentity: shareInput.resolveTrustedUserIdentity,\n    stillCurrent: shareInput.stillCurrent,\n    targetSecretKey: shareInput.targetSecretKey,\n    warmReferencedPrincipalPolicies: shareInput.warmReferencedPrincipalPolicies,\n  });\n}\n\nasync function commitMissingGroupGrantPolicy(\n  input: RemoteContainerGroupShareInput,\n): Promise<{\n  preparedTarget: Awaited<\n    ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n  >;\n  storedPolicy: Awaited<ReturnType<typeof setOrganizationGroupContainerGrant>>;\n} | null> {\n  const signingKeyPair = input.signingKeyPair;\n  if (!signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  const policyApi = {\n    recoverPendingPrincipalMutation:\n      input.apiClient.recoverPendingPrincipalMutation?.bind(input.apiClient),\n    commitOrganizationGroupPolicy:\n      input.apiClient.commitOrganizationGroupPolicy.bind(input.apiClient),\n    getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(\n      input.apiClient,\n    ),\n  };\n  let preparedTarget:\n    | Awaited<\n        ReturnType<typeof preparePrincipalContainerRematerializationBatch>\n      >\n    | undefined;\n  try {\n    const storedPolicy = await setOrganizationGroupContainerGrant({\n      accessLevel: input.accessLevel,\n      apiClient: policyApi,\n      assertCanCommit: () => {\n        if (input.stillCurrent?.() === false) {\n          throw new ContainerShareGenerationExpiredError();\n        }\n      },\n      containerId: input.containerId,\n      execSql: input.execSql,\n      groupId: input.recipientGroupId,\n      organizationId: input.author.organizationId,\n      prepareContainerMutations: async ({ currentPolicy, nextPolicy }) => {\n        preparedTarget = await prepareMissingGroupGrantMutations({\n          currentPolicy,\n          nextPolicy,\n          shareInput: input,\n        });\n        return preparedTarget;\n      },\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n      signerUserId: input.author.signerUserId,\n      signingFingerprint: input.author.signerKeyFingerprint,\n      signingKeyPair,\n    });\n    if (!preparedTarget) {\n      throw new Error(\"Container group share preparation is incomplete\");\n    }\n    return { preparedTarget, storedPolicy };\n  } catch (error) {\n    if (\n      error instanceof ContainerShareGenerationExpiredError ||\n      isProjectionVerificationCancelledError(error)\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n\nasync function commitMissingGroupGrant(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (!input.signingKeyPair) {\n    throw new Error(\n      \"Container group share requires principal policy signing context\",\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n  const committed = await commitMissingGroupGrantPolicy(input);\n  if (!committed) return null;\n  const { preparedTarget, storedPolicy } = committed;\n  const targetIndex = preparedTarget?.plans.findIndex(\n    (planned) => planned.plan.containerId === input.containerId,\n  );\n  const response =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : storedPolicy.containerMutations[targetIndex];\n  const targetPlan =\n    targetIndex === undefined || targetIndex < 0\n      ? undefined\n      : preparedTarget?.plans[targetIndex];\n  if (\n    !targetPlan ||\n    !response ||\n    !isMaterializedContainerSharePlan(targetPlan)\n  ) {\n    throw new Error(\"Container group share acknowledgement is incomplete\");\n  }\n  return {\n    containerKey: targetPlan.containerKey,\n    plan: targetPlan.plan,\n    response,\n  };\n}\n\n// Only a re-wrap of an existing signed grant may run without the chosen name;\n// minting a grant is exactly the operation the name binding protects.\nfunction assertGrantMintNamed(expectedGroupName: string | null): void {\n  if (expectedGroupName === null) {\n    throw new Error(\n      \"Minting a group grant requires the chosen group name; only a re-wrap of an existing signed grant may omit it\",\n    );\n  }\n}\n\nfunction loadShareGroupPolicy(input: RemoteContainerGroupShareInput) {\n  return loadVerifiedGroupSharePrincipalPolicy({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedGroupName: input.expectedGroupName ?? undefined,\n    readEncryptedName:\n      input.readEncryptedName ??\n      createGroupMetadataAccess({\n        ...input,\n        organizationId: input.author.organizationId,\n        verifyMetadataContainer: createGroupMetadataContainerVerifier({\n          ...input,\n          organizationId: input.author.organizationId,\n          stillCurrent: input.stillCurrent ?? (() => true),\n        }),\n      }).readName,\n    groupId: input.recipientGroupId,\n    organizationId: input.author.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nexport async function shareRemoteContainerWithGroup(\n  input: RemoteContainerGroupShareInput,\n): Promise<RemoteContainerGroupShareResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  await input.apiClient.recoverPendingPrincipalMutation?.(\n    input.author.organizationId,\n  );\n  if (input.stillCurrent?.() === false) return null;\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n  const verifiedPrincipalPolicy = await loadShareGroupPolicy(input);\n  if (input.stillCurrent?.() === false) return null;\n  await advanceVerifiedSharePolicies(\n    input.execSql,\n    verifiedPrincipalPolicy,\n    input.stillCurrent,\n  );\n  if (input.stillCurrent?.() === false) return null;\n\n  const signedGrant = verifiedPrincipalPolicy.policy.grants.find(\n    (grant) => grant.containerId === input.containerId,\n  );\n  if (!signedGrant || signedGrant.accessLevel !== input.accessLevel) {\n    assertGrantMintNamed(input.expectedGroupName);\n    return commitMissingGroupGrant(input);\n  }\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    knownContainerKeks: input.knownContainerKeks,\n    principalPolicyCache: principalPolicyCacheForVerifiedPolicies(\n      verifiedPrincipalPolicy.checkpointPolicies,\n    ),\n    previousProjection,\n    recipient: {\n      principalPolicy: verifiedPrincipalPolicy.policy,\n      subjectId: input.recipientGroupId,\n      subjectType: \"group\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  const result = await submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: verifiedPrincipalPolicy.checkpointPolicies,\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n  if (!result) return null;\n\n  // Keep the previously cached group epoch available until the old container\n  // wrap has been unwrapped and the replacement has committed. Root has no\n  // parent fallback, so caching the rotated policy any earlier destroys the\n  // only local path to the KEK that must be re-wrapped.\n  if (input.stillCurrent?.() !== false) {\n    await savePrincipalPolicyBundle(\n      input.execSql,\n      verifiedPrincipalPolicy.bundle,\n      new Date().toISOString(),\n      input.author.organizationId,\n      { stillCurrent: input.stillCurrent },\n    );\n  }\n  if (input.stillCurrent?.() === false) return null;\n\n  return result;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,wCAAwC,EAGxC,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EACL,kCAAkC,GAEnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,KAAK,UAAU,8BAA8B,CAC3C,KAAgE;IAEhE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,mCAAmC,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAgB1C;IAKC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,wBAAwB,CACzB,CAAC;IACF,MAAM,0BAA0B,GAAG,kCAAkC,CACnE,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACxD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CACrD,KAAK,EACL,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB;QAClB,SAAS,EAAE;YACT,+BAA+B,EAAE,iBAAiB,CAAC,sBAAsB;YACzE,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,WAAW,EAAE,MAAM;SACpB;QACD,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,mCAAmC,CAAC;QACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,GAAG,EAAE,CACX,4BAA4B,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B;YACE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SACnE,CACF,CACF;KACJ,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerAccessLevel } from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport type {\n  ContainerMutationAuthor,\n  ContainerShareApi,\n  ContainerSharePlan,\n  MaterializedContainerSharePlan,\n} from \"../../../../data/containers/shared/types\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  type ReferencedPrincipalPolicyWarmer,\n  requireProjectionUserKeyResolver,\n} from \"../../../../data/keyingProjectionVerification\";\nimport type { SecurityIncidentReporter } from \"../../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../../../data/trustedUserIdentity\";\nimport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"../mutationSubmit\";\nimport { buildMaterializedContainerSharePlan } from \"./shareMaterialization\";\nimport { resolveShareProjection } from \"./shareProjection\";\n\nasync function buildCurrentContainerSharePlan(\n  input: Parameters<typeof buildMaterializedContainerSharePlan>[0],\n): Promise<MaterializedContainerSharePlan | null> {\n  return nullOnProjectionVerificationCancellation(() =>\n    buildMaterializedContainerSharePlan(input),\n  );\n}\n\nexport async function shareRemoteContainer(input: {\n  reportSecurityIncident: SecurityIncidentReporter;\n  accessLevel: ContainerAccessLevel;\n  apiClient: ContainerShareApi;\n  author: ContainerMutationAuthor;\n  containerId: string;\n  eventId?: string | undefined;\n  execSql: ExecSql;\n  previousProjection?: ContainerWriterProjectionResponse | undefined;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  signedAt?: string | undefined;\n  stillCurrent?: (() => boolean) | undefined;\n  targetSecretKey: Uint8Array;\n  warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;\n}): Promise<{\n  containerKey: Uint8Array;\n  plan: ContainerSharePlan;\n  response: ContainerMutationResponse;\n} | null> {\n  const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n    input.resolveProjectionUserKey,\n    \"Remote container share\",\n  );\n  const resolveTrustedUserIdentity = requireTrustedUserIdentityResolver(\n    input.resolveTrustedUserIdentity,\n  );\n  const recipientIdentity = await resolveTrustedUserIdentity(\n    input.recipientUserId,\n  );\n  if (!recipientIdentity || input.stillCurrent?.() === false) {\n    return null;\n  }\n  const previousProjection = await resolveShareProjection(\n    input,\n    resolveProjectionUserKey,\n  );\n  if (!previousProjection) return null;\n\n  const materializedPlan = await buildCurrentContainerSharePlan({\n    accessLevel: input.accessLevel,\n    author: input.author,\n    eventId: input.eventId,\n    execSql: input.execSql,\n    previousProjection,\n    recipient: {\n      recipientEncapsulationPublicKey: recipientIdentity.encapsulationPublicKey,\n      subjectId: input.recipientUserId,\n      subjectType: \"user\",\n    },\n    resolveProjectionUserKey,\n    signedAt: input.signedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.targetSecretKey,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n  if (!materializedPlan) return null;\n  return submitAcknowledgedContainerMutation({\n    reportSecurityIncident: input.reportSecurityIncident,\n    recitationPolicies: [],\n    apiClient: input.apiClient,\n    author: input.author,\n    containerKey: materializedPlan.containerKey,\n    execSql: input.execSql,\n    plan: materializedPlan.plan,\n    stillCurrent: input.stillCurrent,\n    submit: () =>\n      submitPlainContainerMutation(() =>\n        input.apiClient.shareContainer(\n          input.containerId,\n          materializedPlan.plan.request,\n          {\n            expectedPaymentRequiredOrganizationId: input.author.organizationId,\n          },\n        ),\n      ),\n  });\n}\n"]}

package/workflows/containers/child/share/shareAncestorRepair.d.ts

@@ -0,0 +1,37 @@
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ContainerMutationAuthor, ContainerRekeyApi, ContainerShareApi } from "../../../../data/containers/shared/types.js";
+import type { ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer } from "../../../../data/keyingProjectionVerification/index.js";
+import type { SecurityIncidentReporter } from "../../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../../data/sqlite/sqlSchema.js";
+/**
+ * Repair a stale path down to and including a container before granting on it
+ * (#2340).
+ *
+ * A chain with no grant beneath it may sit lazily stale after an ancestor
+ * rotation, since nobody's writes depend on it. The first grant changes that:
+ * its grantee could never re-key the levels above its container, so the server
+ * refuses a first grant below a stale chain. The container's own edge must be
+ * current too, because a grant cites the parent's current epoch and the
+ * container's key epoch has to pin it. The sharer administers the container
+ * through a grant at or above it, and the levels above that grant are already
+ * current, so every stale level here is one the sharer can re-key. These
+ * repairs are standalone and need not be atomic with the grant: a repair never
+ * strands anyone.
+ *
+ * Every share does this, not only a first grant, which is all the server
+ * insists on. A container that already carries a grant is stale only past the
+ * carried-rekey cap, and its grantees are then parked behind exactly these
+ * levels; the sharer is already here and able.
+ */
+export declare function projectionWithCurrentAncestors(input: {
+    apiClient: ContainerShareApi & Partial<Pick<ContainerRekeyApi, "rekeyContainer" | "rekeyContainerResult">>;
+    author: ContainerMutationAuthor;
+    containerId: string;
+    execSql: ExecSql;
+    previousProjection: ContainerWriterProjectionResponse;
+    reportSecurityIncident: SecurityIncidentReporter;
+    resolveProjectionUserKey: ProjectionUserKeyResolver;
+    stillCurrent?: (() => boolean) | undefined;
+    targetSecretKey: Uint8Array;
+    warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer | undefined;
+}): Promise<ContainerWriterProjectionResponse | null>;

package/workflows/containers/child/share/shareProjection.d.ts

@@ -0,0 +1,7 @@
+import type { ContainerWriterProjectionResponse } from "../../../../internal/validators/response/index.js";
+import type { ProjectionUserKeyResolver } from "../../../../data/keyingProjectionVerification/index.js";
+import { projectionWithCurrentAncestors } from "./shareAncestorRepair.js";
+/** The container's projection, with any lazily stale chain above it repaired. */
+export declare function resolveShareProjection(input: Omit<Parameters<typeof projectionWithCurrentAncestors>[0], "previousProjection" | "resolveProjectionUserKey"> & {
+    previousProjection?: ContainerWriterProjectionResponse | undefined;
+}, resolveProjectionUserKey: ProjectionUserKeyResolver): Promise<ContainerWriterProjectionResponse | null>;

package/workflows/containers/index.d.ts

@@ -8,15 +8,16 @@ export { fetchContainerKekLog, HistoricalWrapUnavailableError, type HistoricalWr
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
 export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
 export { type AppliedContainerMove, moveRemoteContainer, replayRemoteContainerMove, } from "./child/move/index.js";
+export { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "./child/mutationSubmit.js";
 export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
 export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
 export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
 export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { shareRemoteContainer } from "./child/share/index.js";
 export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
 export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, type VerifiedSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
+export { resolveShareProjection } from "./child/share/shareProjection.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { type ContainerWriteRefusal, classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js

@@ -11,16 +11,18 @@ export { fetchContainerKekLog, HistoricalWrapUnavailableError, rebuildKeyringEnt
 export { isProjectionVerificationCancelledError } from "../../data/keyingProjectionVerification/types.js";
 export { buildContainerCreatePlan, buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, createRemoteContainer, } from "./child/create/index.js";
 export { moveRemoteContainer, replayRemoteContainerMove, } from "./child/move/index.js";
+// Organizations' group shares submit and acknowledge their container mutation.
+export { submitAcknowledgedContainerMutation, submitPlainContainerMutation, } from "./child/mutationSubmit.js";
 export { buildMaterializedContainerRekeyPlan } from "./child/rekey/index.js";
 // A rebuilt keyring override that a concurrent rotation outdated: rebuild it.
 export { ContainerKeyringOverrideStaleError } from "./child/rekey/keyringOverrideLineage.js";
 export { containerWriterProjectionFromRekeyPlan } from "./child/rekey/rekeyProjection.js";
 export { rekeyRemoteContainer } from "./child/rekey/rekeyRemote.js";
 export { buildMaterializedContainerRevokePlan, revokeRemoteContainer, } from "./child/revoke.js";
-export { shareRemoteContainer, shareRemoteContainerWithGroup, } from "./child/share/index.js";
+export { shareRemoteContainer } from "./child/share/index.js";
 export { buildMaterializedContainerSharePlan } from "./child/share/shareMaterialization.js";
 export { referencedPrincipalHeadFromPolicy } from "./child/share/sharePlanCore.js";
-export { advanceVerifiedSharePolicies, GroupShareNameMismatchError, loadVerifiedGroupSharePrincipalPolicy, } from "./child/share/sharePrincipalPolicy.js";
+export { resolveShareProjection } from "./child/share/shareProjection.js";
 export { readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, } from "./mutationResponse.js";
 export { buildRootContainerCreatePlan, rootContainerWriterProjectionFromCreatePlan, } from "./root/create.js";
 export { classifyContainerWriteRefusal, } from "./writeRefusal.js";

package/workflows/containers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,yDAAyD,CAAC;AACjE,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,qCAAqC,GAEtC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKek/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\nexport {\n  type AppliedContainerMove,\n  moveRemoteContainer,\n  replayRemoteContainerMove,\n} from \"./child/move\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/rekey/keyringOverrideLineage\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekey/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekey/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport {\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/share/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/share/sharePlanCore\";\nexport {\n  advanceVerifiedSharePolicies,\n  GroupShareNameMismatchError,\n  loadVerifiedGroupSharePrincipalPolicy,\n  type VerifiedSharePrincipalPolicy,\n} from \"./child/share/sharePrincipalPolicy\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,4DAA4D;AAC5D,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAM7F,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAE9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,yDAAyD,CAAC;AACjE,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,4CAA4C,EAC5C,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,+EAA+E;AAC/E,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AACpE,8EAA8E;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,uCAAuC,EACvC,qDAAqD,GACtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,2CAA2C,GAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC","sourcesContent":["// Refusals the SDK raises before it encrypts or sends a container-scoped\n// write; hosts classify them with classifyContainerWriteRefusal.\nexport { ContainerAuthorAccessError } from \"../../data/containers/shared/authorAccess\";\n// A create or move past the readable path length; `code` is\n// `container_path_too_deep`. Queued moves are abandoned, queued creates wait.\nexport { ContainerPathTooDeepError } from \"../../data/containers/shared/containerPathLimits\";\nexport type { ContainerReciteApi } from \"../../data/containers/shared/reciteApi\";\nexport type {\n  ContainerMutationAuthor,\n  MaterializedContainerRekeyPlan,\n} from \"../../data/containers/shared/types\";\nexport {\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n} from \"../../data/documents/shared/containerKek/containerKekCurrency\";\nexport type {\n  AggregatedContainerKekLog,\n  KeyringRebuildResult,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\nexport {\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n} from \"../../data/documents/shared/containerKek/keyringRebuild\";\n// A share's projection verification can be cancelled by a newer generation\n// underneath the caller; hosts filter that outcome from their own reporting.\nexport { isProjectionVerificationCancelledError } from \"../../data/keyingProjectionVerification/types\";\nexport {\n  buildContainerCreatePlan,\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n  createRemoteContainer,\n} from \"./child/create\";\nexport {\n  type AppliedContainerMove,\n  moveRemoteContainer,\n  replayRemoteContainerMove,\n} from \"./child/move\";\n// Organizations' group shares submit and acknowledge their container mutation.\nexport {\n  submitAcknowledgedContainerMutation,\n  submitPlainContainerMutation,\n} from \"./child/mutationSubmit\";\nexport { buildMaterializedContainerRekeyPlan } from \"./child/rekey\";\n// A rebuilt keyring override that a concurrent rotation outdated: rebuild it.\nexport { ContainerKeyringOverrideStaleError } from \"./child/rekey/keyringOverrideLineage\";\nexport { containerWriterProjectionFromRekeyPlan } from \"./child/rekey/rekeyProjection\";\nexport { rekeyRemoteContainer } from \"./child/rekey/rekeyRemote\";\nexport {\n  buildMaterializedContainerRevokePlan,\n  revokeRemoteContainer,\n} from \"./child/revoke\";\nexport { shareRemoteContainer } from \"./child/share\";\nexport { buildMaterializedContainerSharePlan } from \"./child/share/shareMaterialization\";\nexport { referencedPrincipalHeadFromPolicy } from \"./child/share/sharePlanCore\";\nexport { resolveShareProjection } from \"./child/share/shareProjection\";\nexport {\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n} from \"./mutationResponse\";\nexport {\n  buildRootContainerCreatePlan,\n  rootContainerWriterProjectionFromCreatePlan,\n} from \"./root/create\";\nexport {\n  type ContainerWriteRefusal,\n  classifyContainerWriteRefusal,\n} from \"./writeRefusal\";\n"]}

package/workflows/containers/rematerialization/index.js

@@ -0,0 +1,4 @@
+// A principal policy change re-wraps every container it grants or revokes.
+// Group-policy commits and group shares prepare that batch through this surface.
+export { preparePrincipalContainerRematerializationBatch, } from "./principalContainerRematerialization.js";
+//# sourceMappingURL=index.js.map

package/workflows/containers/rematerialization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,iFAAiF;AACjF,OAAO,EAEL,+CAA+C,GAChD,MAAM,uCAAuC,CAAC","sourcesContent":["// A principal policy change re-wraps every container it grants or revokes.\n// Group-policy commits and group shares prepare that batch through this surface.\nexport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"./principalContainerRematerialization\";\nexport type { PrincipalRematerializationPredecessor } from \"./principalContainerRematerializationPlanning\";\n"]}

package/workflows/{organizations → containers}/rematerialization/precedingPrincipalRematerialization.js

@@ -1,4 +1,4 @@
-import { rebaseOnDeepestAncestor } from "../../containers/child/rekey/carriedDescendantRekeys.js";
+import { rebaseOnDeepestAncestor } from "../child/rekey/carriedDescendantRekeys.js";
 import { withAuthoredPrincipalPolicies } from "./authoredPrincipalPolicyWarmer.js";
 /** Plan the next group against container heads authored earlier in the same transaction. */
 export function withPrecedingRematerialization(input) {

package/workflows/containers/rematerialization/precedingPrincipalRematerialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"precedingPrincipalRematerialization.js","sourceRoot":"","sources":["precedingPrincipalRematerialization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAGhF,4FAA4F;AAC5F,MAAM,UAAU,8BAA8B,CAC5C,KAA+C;IAE/C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,MAAyC,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,QAAQ,CACxC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,CAAC;QACjC,OAAO,CACL,uBAAuB,CAAC,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,UAAU;YACtE,UAAU,CACX,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,+BAA+B,EAAE,6BAA6B,CAC5D,KAAK,CAAC,+BAA+B,EACrC,SAAS,CAAC,QAAQ,IAAI,EAAE,CACzB;QACD,SAAS,EAAE;YACT,GAAG,KAAK,CAAC,SAAS;YAClB,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,4BAA4B,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;gBAClD,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;gBAClE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC;YACD,kCAAkC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;gBACjE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACrE,WAAW,EACX,OAAO,CACR,CAAC;gBACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,CAAC;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { rebaseOnDeepestAncestor } from \"../child/rekey/carriedDescendantRekeys\";\nimport { withAuthoredPrincipalPolicies } from \"./authoredPrincipalPolicyWarmer\";\nimport type { PrincipalContainerRematerializationInput } from \"./principalContainerRematerializationPlanning\";\n\n/** Plan the next group against container heads authored earlier in the same transaction. */\nexport function withPrecedingRematerialization(\n  input: PrincipalContainerRematerializationInput,\n): PrincipalContainerRematerializationInput {\n  const preceding = input.preceding;\n  if (!preceding) return input;\n  const rebase = (served: ContainerWriterProjectionResponse) => {\n    const own = preceding.projections.findLast(\n      (projection) => projection.containerId === served.containerId,\n    );\n    const projection = own ?? served;\n    return (\n      rebaseOnDeepestAncestor(projection, preceding.projections)?.projection ??\n      projection\n    );\n  };\n  return {\n    ...input,\n    warmReferencedPrincipalPolicies: withAuthoredPrincipalPolicies(\n      input.warmReferencedPrincipalPolicies,\n      preceding.authored ?? [],\n    ),\n    apiClient: {\n      ...input.apiClient,\n      reciteContainer: input.apiClient.reciteContainer.bind(input.apiClient),\n      getContainerWriterProjection: async (containerId) => {\n        const projection =\n          await input.apiClient.getContainerWriterProjection(containerId);\n        return projection ? rebase(projection) : null;\n      },\n      getContainerWriterProjectionResult: async (containerId, options) => {\n        const result = await input.apiClient.getContainerWriterProjectionResult(\n          containerId,\n          options,\n        );\n        return result.ok ? { ...result, data: rebase(result.data) } : result;\n      },\n    },\n  };\n}\n"]}

package/workflows/{organizations → containers}/rematerialization/principalContainerRematerialization.js

@@ -4,13 +4,13 @@ import { acknowledgeContainerMutationBatch } from "../../../data/containers/shar
 import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
 import { verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
 import { createProjectionUserKeyResolver } from "../../../data/keyingProjectionVerification/userKeyResolver.js";
-import { scheduleHeldDescendantRecitations } from "../../containers/child/recite.js";
-import { buildMaterializedContainerRekeyPlan } from "../../containers/child/rekey/index.js";
-import { rebaseOnDeepestAncestor } from "../../containers/child/rekey/carriedDescendantRekeys.js";
-import { containerWriterProjectionFromRotationPlan, containerWriterProjectionFromSharePlan, isSpeculativeContainerWriterProjection, } from "../../containers/child/rekey/rekeyProjection.js";
-import { buildMaterializedContainerRevokePlan } from "../../containers/child/revoke.js";
-import { selectReplacementPrincipalPolicyReferences } from "../../containers/child/rotation/replacementPrincipalPolicyReferences.js";
-import { buildMaterializedContainerSharePlan } from "../../containers/child/share/shareMaterialization.js";
+import { scheduleHeldDescendantRecitations } from "../child/recite.js";
+import { buildMaterializedContainerRekeyPlan } from "../child/rekey/index.js";
+import { rebaseOnDeepestAncestor } from "../child/rekey/carriedDescendantRekeys.js";
+import { containerWriterProjectionFromRotationPlan, containerWriterProjectionFromSharePlan, isSpeculativeContainerWriterProjection, } from "../child/rekey/rekeyProjection.js";
+import { buildMaterializedContainerRevokePlan } from "../child/revoke.js";
+import { selectReplacementPrincipalPolicyReferences } from "../child/rotation/replacementPrincipalPolicyReferences.js";
+import { buildMaterializedContainerSharePlan } from "../child/share/shareMaterialization.js";
 import { withPrecedingRematerialization } from "./precedingPrincipalRematerialization.js";
 import { addPlan, carryLevel, staleLevelsAbove, } from "./principalContainerRematerializationPlanning.js";
 import { loadRematerializationTargets, loadServedProjection, seededPrincipalPolicyCache, } from "./principalContainerRematerializationTargets.js";