Initial Commit

openspec/archive/2026-05-04-enterprise-drive-sharing/tasks.md

@@ -0,0 +1,77 @@
+# Tasks: enterprise-drive-sharing
+
+**Change ID**: enterprise-drive-sharing
+**Package**: `@suaveplan/drive-sharing`
+**Target path**: `packages/drive/drive-sharing`
+**Prerequisite packages on Verdaccio**: `@suaveplan/drive`, `@suaveplan/error`, `@suaveplan/types`, `@suaveplan/crypto`, `@suaveplan/crypto-cipher`, `@suaveplan/crypto-hash`, `@suaveplan/crypto-utils`, `@suaveplan/events`
+
+> Every checkbox MUST reflect work actually done in this change. Do not retroactively tick boxes for work that was already in main when this change opened. Do not tick a box for a test that doesn't exist or doesn't pin the requirement it claims to verify.
+
+---
+
+## 1. Spec authoring
+
+- [x] 1.1 Read `../suaveplan/enterprise/drive-sharing.md` end-to-end
+- [x] 1.2 Read `openspec/specs/drive-sharing/spec.md` (if it exists)
+- [x] 1.3 Read `openspec/AGENTS.md` Sections 13 and 14
+- [x] 1.4 Draft `proposal.md` from `openspec/templates/proposal.md`
+- [x] 1.5 Fill in `## Source mapping` table in `proposal.md` — every requirement cites a line range OR appears in the "no source line" table with justification
+- [x] 1.6 Draft `specs/drive-sharing/spec.md` from `openspec/templates/spec-delta.md`
+- [x] 1.7 Every requirement in the spec delta carries a `**Verified by:**` line naming concrete `it(...)` titles
+
+## 2. Implementation
+
+- [x] 2.1 Scaffold `packages/drive/drive-sharing/` with `src/`, `tests/`, `src/__benchmarks__/`, and all feature subdirectories per `proposal.md` layout
+- [x] 2.2 Write `package.json` at `0.1.0` with `"type": "module"`, `"sideEffects": false`, full `exports` map, catalog deps, and dev deps
+- [x] 2.3 Write `tsconfig.lib.json` extending `../../../tsconfig.base.json`
+- [x] 2.4 Write `vitest.config.ts` using `createTestConfig()` from `@suaveplan/testing/config`
+- [x] 2.5 Implement `src/types/common.ts` — branded types, `Result`, ID factories, common interfaces
+- [x] 2.6 Implement `src/types/schemas.ts` — Zod schemas for all public option types
+- [x] 2.7 Implement `src/error-codes.ts` — `DriveShareErrorCode`, `DRIVE_SHARE_CODES`, `DriveShareError`, `registerDriveShareErrorCodes()`
+- [x] 2.8 Implement `src/constants/index.ts` — `DEFAULT_TOKEN_TTL_MS`, `DEFAULT_GRANT_TTL_MS`, `ENCRYPTION_ALGORITHM`, `KEYRING_FORMAT_VERSION`, capacity caps
+- [x] 2.9 Implement `src/encryption/envelope/envelope.ts` — `CryptoProvider`, `WebCryptoProvider`, `envelopeEncrypt`, `envelopeDecrypt`, `wrapKey`, `unwrapKey`, `rewrapKey`, `computeIntegrity`, `verifyIntegrity`
+- [x] 2.9a Wire `randomBytes` from `@suaveplan/crypto-utils` through `WebCryptoProvider` nonce generation
+- [x] 2.10 Implement `src/encryption/key-ring/key-ring.ts` — `KeyRing` with add/get/remove/rotate/export/import and events
+- [x] 2.11 Implement `src/partitions/partition-policy/partition-policy.ts` — `createPolicy`, `getDefaultPolicy`, `mergePolicies`, `validateAction`, `requiresEncryption`, `requiresReauth`, `DEFAULT_PRESETS`
+- [x] 2.12 Implement `src/partitions/partition-store/partition-store.ts` — `PartitionStore` interface, `InMemoryPartitionStore`
+- [x] 2.13 Implement `src/partitions/partition-manager/partition-manager.ts` — CRUD, membership, policy validation, events, OTel
+- [x] 2.14 Implement `src/sharing/grants/grants.ts` — `GrantManager` with create/check/revoke/list, OTel
+- [x] 2.15 Implement `src/sharing/tokens/tokens.ts` — `TokenManager` with create/validate/revoke/list, injectable clock, OTel, HMAC integrity
+- [x] 2.16 Implement `src/transfer/transfer/transfer.ts` — `TransferManager` with KEK resolution, DEK rewrap, policy validation, `AbortSignal`, OTel
+
+## 3. Tests
+
+- [x] 3.1 Unit tests at `src/<feature>/<feature>.test.ts` covering every scenario in `specs/drive-sharing/spec.md`
+- [x] 3.2 Spec-conformance tests at `src/<feature>/<feature>.spec-conformance.test.ts` pinning type-level / observability / strict-mode / lifecycle scenarios
+- [x] 3.3 Integration test at `tests/integration.test.ts` — end-to-end: create partition, add member, grant, transfer
+- [x] 3.4 Property tests at `tests/property.test.ts` — grant expiry, token revocation finality, policy merge commutativity, partition member invariant
+- [x] 3.5 Every `it(...)` carries `{ timeout: 5000 }` (or `30000` for genuinely async / crypto)
+
+## 4. Documentation
+
+- [x] 4.1 Sibling `.md` for every implementation `.ts` (≥200 words, basic + advanced examples, full API reference)
+- [x] 4.2 Root `packages/drive/drive-sharing/README.md` with install, quick-start, modules list, benchmark table
+- [x] 4.3 Update `CLAUDE.md` package listing to include `@suaveplan/drive-sharing`
+
+## 5. Pre-archive verification (the 5-gate triple)
+
+- [x] 5.1 `bunx biome check src/ tests/` — 0 errors / 0 warnings
+- [x] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/drive-sharing` — green
+- [x] 5.3 `bunx turbo test:coverage --filter=@suaveplan/drive-sharing` — 100/100/100/100
+- [x] 5.4 `bunx turbo build --filter=@suaveplan/drive-sharing` — green
+
+## 6. Pre-archive 7-row checklist (AGENTS.md Section 13)
+
+- [x] 6.1 Generics threaded; `expectTypeOf` assertions on every literal-type claim
+- [x] 6.2 Zod schemas wired at every declared boundary
+- [x] 6.3 Every error code in `error-codes.ts` thrown by at least one production path
+- [x] 6.4 Strict-mode behaviors tested both on and off (read-only mode, abort signal)
+- [x] 6.5 OTel instruments emitted from production paths and asserted with capture-MeterProvider
+- [x] 6.6 Lifecycle dedup tested where claimed (idempotent revoke, idempotent removeMember)
+- [x] 6.7 No retroactive tick — every box above reflects work done in this change
+
+## 7. Archive
+
+- [x] 7.1 Fold spec delta into `openspec/specs/drive-sharing/spec.md`
+- [x] 7.2 Move `openspec/changes/enterprise-drive-sharing/` → `openspec/archive/2026-05-04-enterprise-drive-sharing/`
+- [ ] 7.3 Refresh `MANIFEST.md` if package set or deps changed (orchestrator §13b)