suaveplan/openspec/archive/2026-05-04-enterprise-drive-sharing/tasks.md

Tasks: enterprise-drive-sharing

Change ID: enterprise-drive-sharing Package: @suaveplan/drive-sharing Target path: packages/drive/drive-sharing Prerequisite packages on Verdaccio: @suaveplan/drive, @suaveplan/error, @suaveplan/types, @suaveplan/crypto, @suaveplan/crypto-cipher, @suaveplan/crypto-hash, @suaveplan/crypto-utils, @suaveplan/events

Every checkbox MUST reflect work actually done in this change. Do not retroactively tick boxes for work that was already in main when this change opened. Do not tick a box for a test that doesn't exist or doesn't pin the requirement it claims to verify.

---

1. Spec authoring

• 1.1 Read ../suaveplan/enterprise/drive-sharing.md end-to-end
• 1.2 Read openspec/specs/drive-sharing/spec.md (if it exists)
• 1.3 Read openspec/AGENTS.md Sections 13 and 14
• 1.4 Draft proposal.md from openspec/templates/proposal.md
• 1.5 Fill in ## Source mapping table in proposal.md — every requirement cites a line range OR appears in the "no source line" table with justification
• 1.6 Draft specs/drive-sharing/spec.md from openspec/templates/spec-delta.md
• 1.7 Every requirement in the spec delta carries a **Verified by:** line naming concrete it(...) titles

2. Implementation

• 2.1 Scaffold packages/drive/drive-sharing/ with src/, tests/, src/__benchmarks__/, and all feature subdirectories per proposal.md layout
• 2.2 Write package.json at 0.1.0 with "type": "module", "sideEffects": false, full exports map, catalog deps, and dev deps
• 2.3 Write tsconfig.lib.json extending ../../../tsconfig.base.json
• 2.4 Write vitest.config.ts using createTestConfig() from @suaveplan/testing/config
• 2.5 Implement src/types/common.ts — branded types, Result, ID factories, common interfaces
• 2.6 Implement src/types/schemas.ts — Zod schemas for all public option types
• 2.7 Implement src/error-codes.ts — DriveShareErrorCode, DRIVE_SHARE_CODES, DriveShareError, registerDriveShareErrorCodes()
• 2.8 Implement src/constants/index.ts — DEFAULT_TOKEN_TTL_MS, DEFAULT_GRANT_TTL_MS, ENCRYPTION_ALGORITHM, KEYRING_FORMAT_VERSION, capacity caps
• 2.9 Implement src/encryption/envelope/envelope.ts — CryptoProvider, WebCryptoProvider, envelopeEncrypt, envelopeDecrypt, wrapKey, unwrapKey, rewrapKey, computeIntegrity, verifyIntegrity
• 2.9a Wire randomBytes from @suaveplan/crypto-utils through WebCryptoProvider nonce generation
• 2.10 Implement src/encryption/key-ring/key-ring.ts — KeyRing with add/get/remove/rotate/export/import and events
• 2.11 Implement src/partitions/partition-policy/partition-policy.ts — createPolicy, getDefaultPolicy, mergePolicies, validateAction, requiresEncryption, requiresReauth, DEFAULT_PRESETS
• 2.12 Implement src/partitions/partition-store/partition-store.ts — PartitionStore interface, InMemoryPartitionStore
• 2.13 Implement src/partitions/partition-manager/partition-manager.ts — CRUD, membership, policy validation, events, OTel
• 2.14 Implement src/sharing/grants/grants.ts — GrantManager with create/check/revoke/list, OTel
• 2.15 Implement src/sharing/tokens/tokens.ts — TokenManager with create/validate/revoke/list, injectable clock, OTel, HMAC integrity
• 2.16 Implement src/transfer/transfer/transfer.ts — TransferManager with KEK resolution, DEK rewrap, policy validation, AbortSignal, OTel

3. Tests

• 3.1 Unit tests at src/<feature>/<feature>.test.ts covering every scenario in specs/drive-sharing/spec.md
• 3.2 Spec-conformance tests at src/<feature>/<feature>.spec-conformance.test.ts pinning type-level / observability / strict-mode / lifecycle scenarios
• 3.3 Integration test at tests/integration.test.ts — end-to-end: create partition, add member, grant, transfer
• 3.4 Property tests at tests/property.test.ts — grant expiry, token revocation finality, policy merge commutativity, partition member invariant
• 3.5 Every it(...) carries { timeout: 5000 } (or 30000 for genuinely async / crypto)

4. Documentation

• 4.1 Sibling .md for every implementation .ts (≥200 words, basic + advanced examples, full API reference)
• 4.2 Root packages/drive/drive-sharing/README.md with install, quick-start, modules list, benchmark table
• 4.3 Update CLAUDE.md package listing to include @suaveplan/drive-sharing

5. Pre-archive verification (the 5-gate triple)

• 5.1 bunx biome check src/ tests/ — 0 errors / 0 warnings
• 5.2 bunx turbo lint typecheck test --filter=@suaveplan/drive-sharing — green
• 5.3 bunx turbo test:coverage --filter=@suaveplan/drive-sharing — 100/100/100/100
• 5.4 bunx turbo build --filter=@suaveplan/drive-sharing — green

6. Pre-archive 7-row checklist (AGENTS.md Section 13)

• 6.1 Generics threaded; expectTypeOf assertions on every literal-type claim
• 6.2 Zod schemas wired at every declared boundary
• 6.3 Every error code in error-codes.ts thrown by at least one production path
• 6.4 Strict-mode behaviors tested both on and off (read-only mode, abort signal)
• 6.5 OTel instruments emitted from production paths and asserted with capture-MeterProvider
• 6.6 Lifecycle dedup tested where claimed (idempotent revoke, idempotent removeMember)
• 6.7 No retroactive tick — every box above reflects work done in this change

7. Archive

• 7.1 Fold spec delta into openspec/specs/drive-sharing/spec.md
• 7.2 Move openspec/changes/enterprise-drive-sharing/ → openspec/archive/2026-05-04-enterprise-drive-sharing/
• 7.3 Refresh MANIFEST.md if package set or deps changed (orchestrator §13b)